@server/next 0.42.0 → 0.44.0

package/index.d.ts

@@ -96,17 +96,20 @@ type RouteSchema = {
     description?: string;
 };
 type RouteOptions = {
-    schema?: RouteSchema;
+    schema?: RouteSchema | false;
     parser?: BodyMode;
     body?: StandardSchemaV1<any, any>;
     query?: StandardSchemaV1<any, any>;
     params?: StandardSchemaV1<any, any>;
     response?: StandardSchemaV1<any, any>;
     cache?: CacheOption;
+    uploads?: string | Bucket | UploadOptions | false;
 };
 type Route = {
     path: string;
-    options: RouteOptions;
+    options: Omit<RouteOptions, "uploads"> & {
+        uploads?: Settings["uploads"];
+    };
     fns: Middleware[];
 };
 type Cookie = {
@@ -256,11 +259,15 @@ type Options = {
     sessions?: StoreSource;
     cors?: CorsOptions;
     auth?: AuthOption;
-    openapi?: any;
+    openapi?: boolean | string | {
+        path?: string;
+        title?: string;
+        description?: string;
+        version?: string;
+    };
     onError?: OnError;
     onResponse?: OnResponse;
     log?: LogLevel | boolean;
-    favicon?: string | BucketFile;
     security?: boolean | SecurityOptions;
     parser?: BodyMode;
     cache?: CacheOption;
@@ -276,11 +283,15 @@ type Settings = {
     sessionsDefault?: boolean;
     cors?: CorsSettings;
     auth?: AuthSettings;
-    openapi?: any;
+    openapi?: {
+        path: string;
+        title?: string;
+        description?: string;
+        version?: string;
+    };
     onError?: OnError;
     onResponse?: OnResponse;
     log: Logger;
-    favicon?: string | BucketFile;
     security: SecuritySettings;
     parser: BodyMode;
     cache?: CacheOption;
@@ -316,9 +327,9 @@ interface ContextExtension {
 type Context<C extends ContextTypes = {}> = {
     method: Method;
     ip: string;
+    signal: AbortSignal;
     headers: Record<string, string | string[]>;
     cookies: Record<string, string>;
-    body?: Field<C, "body", SerializableValue | Buffer | ReadableStream>;
     url: URL & {
         params: Field<C, "params", Record<string, any>>;
         query: Field<C, "query", Record<string, any>>;
@@ -331,12 +342,12 @@ type Context<C extends ContextTypes = {}> = {
     session: Field<C, "session", Record<string, any>>;
     user?: Field<C, "user", Record<string, any>>;
     init: number;
-    req?: Request;
-    res?: Response & {
-        cookies?: Record<string, string>;
-    };
     app: Server;
-} & ContextExtension;
+} & ("body" extends keyof C ? {
+    body: Field<C, "body", never>;
+} : {
+    body?: SerializableValue | Buffer | ReadableStream;
+}) & ContextExtension;
 type InlineReply = Response | Reply | BucketFile | {
     body: string;
     headers?: Headers;
@@ -431,11 +442,6 @@ declare class Server<C extends ContextTypes = {}> extends Router<C> {
     platform: Platform;
     sockets: any[];
     websocket: any;
-    faviconCache?: {
-        bytes: Buffer;
-        type: string;
-        etag: string;
-    } | null;
     port?: number;
     constructor(options?: Options);
     self(): this;
@@ -445,6 +451,7 @@ declare class Server<C extends ContextTypes = {}> extends Router<C> {
     test(): {
         get: (path: string, options?: {
             method?: string;
+            signal?: AbortSignal | null;
             headers?: HeadersInit;
             cache?: RequestCache;
             redirect?: RequestRedirect;
@@ -455,11 +462,11 @@ declare class Server<C extends ContextTypes = {}> extends Router<C> {
             priority?: RequestPriority;
             referrer?: string;
             referrerPolicy?: ReferrerPolicy;
-            signal?: AbortSignal | null;
             window?: null;
         }) => Promise<Response>;
         head: (path: string, options?: {
             method?: string;
+            signal?: AbortSignal | null;
             headers?: HeadersInit;
             cache?: RequestCache;
             redirect?: RequestRedirect;
@@ -470,13 +477,13 @@ declare class Server<C extends ContextTypes = {}> extends Router<C> {
             priority?: RequestPriority;
             referrer?: string;
             referrerPolicy?: ReferrerPolicy;
-            signal?: AbortSignal | null;
             window?: null;
         }) => Promise<Response>;
         post: (path: string, body?: string | number | boolean | ArrayBuffer | {
             [key: string]: SerializableValue;
         } | SerializableValue[] | ReadableStream<any> | Blob | ArrayBufferView<ArrayBuffer> | FormData | URLSearchParams, options?: {
             method?: string;
+            signal?: AbortSignal | null;
             headers?: HeadersInit;
             cache?: RequestCache;
             redirect?: RequestRedirect;
@@ -487,13 +494,13 @@ declare class Server<C extends ContextTypes = {}> extends Router<C> {
             priority?: RequestPriority;
             referrer?: string;
             referrerPolicy?: ReferrerPolicy;
-            signal?: AbortSignal | null;
             window?: null;
         }) => Promise<Response>;
         put: (path: string, body?: string | number | boolean | ArrayBuffer | {
             [key: string]: SerializableValue;
         } | SerializableValue[] | ReadableStream<any> | Blob | ArrayBufferView<ArrayBuffer> | FormData | URLSearchParams, options?: {
             method?: string;
+            signal?: AbortSignal | null;
             headers?: HeadersInit;
             cache?: RequestCache;
             redirect?: RequestRedirect;
@@ -504,13 +511,13 @@ declare class Server<C extends ContextTypes = {}> extends Router<C> {
             priority?: RequestPriority;
             referrer?: string;
             referrerPolicy?: ReferrerPolicy;
-            signal?: AbortSignal | null;
             window?: null;
         }) => Promise<Response>;
         patch: (path: string, body?: string | number | boolean | ArrayBuffer | {
             [key: string]: SerializableValue;
         } | SerializableValue[] | ReadableStream<any> | Blob | ArrayBufferView<ArrayBuffer> | FormData | URLSearchParams, options?: {
             method?: string;
+            signal?: AbortSignal | null;
             headers?: HeadersInit;
             cache?: RequestCache;
             redirect?: RequestRedirect;
@@ -521,11 +528,11 @@ declare class Server<C extends ContextTypes = {}> extends Router<C> {
             priority?: RequestPriority;
             referrer?: string;
             referrerPolicy?: ReferrerPolicy;
-            signal?: AbortSignal | null;
             window?: null;
         }) => Promise<Response>;
         delete: (path: string, options?: {
             method?: string;
+            signal?: AbortSignal | null;
             headers?: HeadersInit;
             cache?: RequestCache;
             redirect?: RequestRedirect;
@@ -536,11 +543,11 @@ declare class Server<C extends ContextTypes = {}> extends Router<C> {
             priority?: RequestPriority;
             referrer?: string;
             referrerPolicy?: ReferrerPolicy;
-            signal?: AbortSignal | null;
             window?: null;
         }) => Promise<Response>;
         options: (path: string, options?: {
             method?: string;
+            signal?: AbortSignal | null;
             headers?: HeadersInit;
             cache?: RequestCache;
             redirect?: RequestRedirect;
@@ -551,7 +558,6 @@ declare class Server<C extends ContextTypes = {}> extends Router<C> {
             priority?: RequestPriority;
             referrer?: string;
             referrerPolicy?: ReferrerPolicy;
-            signal?: AbortSignal | null;
             window?: null;
         }) => Promise<Response>;
     };

package/index.js

@@ -50,6 +50,7 @@ ServerError_default.extend({
     message: "Missing the OAuth 'code' in the request body"
   },
   SESSION_JWT: "The `jwt` strategy is stateless, so there is no `ctx.session` (tried '{key}'). Use the `token` strategy for server-side sessions, or `cookie` for browsers",
+  SESSION_GUEST: "No `ctx.session` for this request (tried '{key}'): the `token` strategy carries the session in the Authorization header, and this request has none. Sign in first, or use the `cookie` strategy for guest sessions",
   AUTH_INVALID_HEADER: {
     status: 401,
     message: "Invalid authorization header {type}, must send 'Bearer {TOKEN}' (with space)"
@@ -104,6 +105,17 @@ var StatusError = class extends Error {
   }
 };
 
+// src/helpers/bucket.ts
+import FileSystem from "bucket/fs";
+function bucket(root) {
+  if (!root) return null;
+  if (typeof root === "string") return FileSystem(root);
+  if (typeof root.file === "function") return root;
+  throw new Error(
+    "Invalid bucket: pass a directory path or a `bucket` instance (with .file())"
+  );
+}
+
 // src/helpers/createId.ts
 var alphabet = "useandom26T198340PX75pxJACKVERYMINDBUSHWOLFGQZbfghjklqvwyzrict";
 var random = (bytes) => crypto.getRandomValues(new Uint8Array(bytes));
@@ -146,6 +158,16 @@ function createId(source, size = 16) {
 }
 
 // src/helpers/upload.ts
+function resolveUploads(up) {
+  if (!up) return null;
+  if (typeof up === "object" && "bucket" in up) {
+    const { bucket: bucket2, maxSize, minSize, fileType: fileType2 } = up;
+    if (maxSize != null) parseBytes(maxSize);
+    if (minSize != null) parseBytes(minSize);
+    return { bucket: bucket(bucket2), maxSize, minSize, fileType: fileType2 };
+  }
+  return { bucket: bucket(up) };
+}
 function parseBytes(value) {
   if (typeof value === "number") return value;
   const units = {
@@ -164,8 +186,8 @@ function getExt(filename) {
   return filename.slice(i).toLowerCase();
 }
 async function saveFileToBucket(originalName, data, bucket2, contentType) {
-  const ext2 = getExt(originalName);
-  const id = `${createId()}${ext2}`;
+  const ext = getExt(originalName);
+  const id = `${createId()}${ext}`;
   const file2 = bucket2.file(id);
   await file2.write(data, { type: contentType });
   return {
@@ -188,10 +210,10 @@ function validateFile(originalName, data, contentType, limits) {
     );
   }
   if (fileType2 && fileType2.length > 0) {
-    const ext2 = getExt(originalName);
+    const ext = getExt(originalName);
     const mime = contentType.toLowerCase();
     const allowed = fileType2.some(
-      (t) => t.toLowerCase() === mime || t.toLowerCase() === ext2
+      (t) => t.toLowerCase() === mime || t.toLowerCase() === ext
     );
     if (!allowed) {
       throw new Error(
@@ -331,11 +353,11 @@ function isProbablyText(buffer) {
   return true;
 }
 var extByMime = {};
-for (const ext2 in mimes_default) extByMime[mimes_default[ext2]] = ext2;
+for (const ext in mimes_default) extByMime[mimes_default[ext]] = ext;
 function extFromType(type2) {
   const base = (type2 || "").split(";")[0].trim().toLowerCase();
-  const ext2 = extByMime[base];
-  if (ext2) return `.${ext2}`;
+  const ext = extByMime[base];
+  if (ext) return `.${ext}`;
   const sub = base.split("/")[1];
   return sub && /^[a-z0-9]+$/.test(sub) ? `.${sub}` : ".bin";
 }
@@ -748,20 +770,20 @@ var encodeExt = (name) => encodeURIComponent(name).replace(
 );
 function disposition(name) {
   if (!name) return "attachment";
-  const clean = name.replace(/[\r\n]/g, "").split(/[\\/]/).pop() || "";
-  if (!clean) return "attachment";
-  const ascii = clean.replace(/[^\x20-\x7e]/g, "?");
+  const clean2 = name.replace(/[\r\n]/g, "").split(/[\\/]/).pop() || "";
+  if (!clean2) return "attachment";
+  const ascii = clean2.replace(/[^\x20-\x7e]/g, "?");
   const value = `attachment; filename="${ascii.replace(/["\\]/g, "\\$&")}"`;
-  if (clean === ascii) return value;
-  return `${value}; filename*=UTF-8''${encodeExt(clean)}`;
+  if (clean2 === ascii) return value;
+  return `${value}; filename*=UTF-8''${encodeExt(clean2)}`;
 }
 
 // src/helpers/fileType.ts
 function fileType(file2) {
   if (file2.type) return file2.type;
   const name = file2.path || file2.name || "";
-  const ext2 = name.split(".").pop()?.toLowerCase();
-  return ext2 ? mimes_default[ext2] : void 0;
+  const ext = name.split(".").pop()?.toLowerCase();
+  return ext ? mimes_default[ext] : void 0;
 }
 
 // src/helpers/isHtml.ts
@@ -795,8 +817,8 @@ var Reply = class {
     return this;
   }
   download(name) {
-    const ext2 = name?.split(".").pop();
-    if (ext2 && !this.res.headers.get("content-type")) this.type(ext2);
+    const ext = name?.split(".").pop();
+    if (ext && !this.res.headers.get("content-type")) this.type(ext);
     return this.headers("content-disposition", disposition(name));
   }
   headers(key, value) {
@@ -854,10 +876,10 @@ var Reply = class {
     if (/(?:^|[\\/])\.\.(?:[\\/]|$)/.test(path)) return this.status(404).send();
     try {
       const fs = await import("fs");
-      const ext2 = path.split(".").pop();
+      const ext = path.split(".").pop();
       await fs.promises.access(path);
       const stream = fs.createReadStream(path);
-      return this.type(ext2).send(stream);
+      return this.type(ext).send(stream);
     } catch (error) {
       if (error.code === "ENOENT" || error.code === "EISDIR") {
         return this.status(404).send();
@@ -1010,8 +1032,8 @@ var validateToken = (authorization) => {
   return id;
 };
 function findSessionId(ctx) {
-  const strategy = ctx.options.auth?.strategy;
-  if (strategy?.includes("token") && ctx.headers.authorization) {
+  if (ctx.options.auth?.strategy.includes("token")) {
+    if (!ctx.headers.authorization) return;
     return validateToken(ctx.headers.authorization);
   }
   return ctx.cookies.session || void 0;
@@ -1019,28 +1041,33 @@ function findSessionId(ctx) {
 
 // src/middle/session.ts
 var loaded = /* @__PURE__ */ new WeakMap();
-function jwtSession() {
+function noSession(error) {
   const target = {};
   return new Proxy(target, {
     get(target2, key) {
       if (typeof key === "symbol" || key === "then") return target2[key];
-      throw ServerError_default.SESSION_JWT({ key: String(key) });
+      throw error(String(key));
     },
     set(target2, key, value) {
       if (typeof key === "symbol") {
         target2[key] = value;
         return true;
       }
-      throw ServerError_default.SESSION_JWT({ key: String(key) });
+      throw error(String(key));
     }
   });
 }
 async function session(ctx) {
-  if (ctx.options.auth?.strategy.includes("jwt")) {
-    ctx.session = jwtSession();
+  const strategy = ctx.options.auth?.strategy;
+  if (strategy?.includes("jwt")) {
+    ctx.session = noSession((key) => ServerError_default.SESSION_JWT({ key }));
     return;
   }
   const id = findSessionId(ctx);
+  if (!id && strategy?.includes("token")) {
+    ctx.session = noSession((key) => ServerError_default.SESSION_GUEST({ key }));
+    return;
+  }
   ctx.session = id && await ctx.options.sessions.get(id) || {};
   loaded.set(ctx, { id, data: JSON.stringify(ctx.session) });
 }
@@ -1050,6 +1077,10 @@ async function finishLogin(ctx, input, opts = {}) {
   const settings = ctx.options.auth;
   const { strategy, onLogin, onUser, onToken } = settings;
   const key = String(input.key);
+  if (!strategy.includes("jwt") && !loaded.has(ctx)) {
+    ctx.session = {};
+    loaded.set(ctx, { id: void 0, data: "{}" });
+  }
   const auth2 = {
     user: key,
     provider: input.provider,
@@ -1613,17 +1644,6 @@ function parseAuthOptions(auth2) {
   };
 }
 
-// src/helpers/bucket.ts
-import FileSystem from "bucket/fs";
-function bucket(root) {
-  if (!root) return null;
-  if (typeof root === "string") return FileSystem(root);
-  if (typeof root.file === "function") return root;
-  throw new Error(
-    "Invalid bucket: pass a directory path or a `bucket` instance (with .file())"
-  );
-}
-
 // src/helpers/color.ts
 var map = {
   reset: 0,
@@ -1863,19 +1883,7 @@ function config(options = {}) {
   }
   const publicDir = options.public || env2.PUBLIC;
   settings.public = publicDir ? bucket(publicDir) : null;
-  const up = options.uploads;
-  if (!up) {
-    settings.uploads = null;
-  } else if (typeof up === "object" && "bucket" in up) {
-    const { bucket: bucket2, maxSize, minSize, fileType: fileType2 } = up;
-    if (maxSize != null) parseBytes(maxSize);
-    if (minSize != null) parseBytes(minSize);
-    settings.uploads = { bucket: bucket(bucket2), maxSize, minSize, fileType: fileType2 };
-  } else {
-    settings.uploads = { bucket: bucket(up) };
-  }
-  const favicon2 = options.favicon || env2.FAVICON;
-  if (favicon2) settings.favicon = favicon2;
+  settings.uploads = resolveUploads(options.uploads);
   const production = env2.NODE_ENV === "production";
   const defaulted = options.sessions == null;
   settings.sessionsDefault = defaulted;
@@ -1886,7 +1894,7 @@ function config(options = {}) {
     if (!settings.auth.users) {
       if (production) {
         throw new Error(
-          "Auth in production needs a persistent `users` store, like auth: { ..., users: kv(redis).prefix('users:') }."
+          "Auth in production needs a persistent `users` store, like auth: { ..., users: kv(redis).prefix('user:') }."
         );
       }
       settings.auth.users = toStore(/* @__PURE__ */ new Map());
@@ -1903,9 +1911,10 @@ function config(options = {}) {
     );
   }
   if (options.openapi) {
-    if (options.openapi === true) {
-      settings.openapi = {};
-    }
+    const o = options.openapi;
+    if (o === true) settings.openapi = { path: "/openapi.json" };
+    else if (typeof o === "string") settings.openapi = { path: o };
+    else settings.openapi = { path: "/openapi.json", ...o };
   }
   settings.onError = options.onError || ((error) => {
     return new Response(error.message || "Server Error", {
@@ -1924,9 +1933,8 @@ function config(options = {}) {
     const origin = settings.cors.origin === true ? "*" : String(settings.cors.origin);
     log.message("cors", origin);
   }
-  if (settings.favicon) log.message("favicon", loc(settings.favicon));
   if (settings.cache !== void 0) log.message("cache", loc(options.cache));
-  if (settings.openapi) log.message("openapi", settings.openapi.path || "/docs");
+  if (settings.openapi) log.message("openapi", settings.openapi.path);
   return settings;
 }
 
@@ -2106,13 +2114,11 @@ async function parseResponse(out, ctx) {
     out.headers.set("Server-Timing", ctx.time.headers());
   }
   const prev = loaded.get(ctx);
-  const jwt = ctx.options.auth?.strategy.includes("jwt");
-  const data = jwt ? "{}" : JSON.stringify(ctx.session ?? {});
-  if (!jwt && data !== (prev?.data ?? "{}")) {
+  if (prev && JSON.stringify(ctx.session ?? {}) !== prev.data) {
     if (ctx.options.sessionsDefault && ctx.platform.production) {
       warnDefault();
     }
-    let id = prev?.id;
+    let id = prev.id;
     if (!id) {
       id = createId();
       out.headers.append(
@@ -2128,11 +2134,6 @@ async function parseResponse(out, ctx) {
     }
     ctx.options.sessions.set(id, ctx.session);
   }
-  if (ctx?.res?.headers) {
-    for (const key in ctx.res.headers) {
-      out.headers[key] = ctx.res.headers[key];
-    }
-  }
   return out;
 }
 
@@ -2465,14 +2466,14 @@ async function getJwtUser(ctx) {
   return exposed;
 }
 async function getAuthSession(ctx) {
-  let session2 = ctx.session;
-  if (!session2) {
-    const id = findSessionId(ctx);
-    if (!id) return;
-    session2 = await ctx.options.sessions.get(id) ?? void 0;
+  if (loaded.has(ctx)) {
+    const session3 = ctx.session;
+    return session3?.user ? session3 : void 0;
   }
-  if (!session2?.user) return;
-  return session2;
+  const id = findSessionId(ctx);
+  if (!id) return;
+  const session2 = await ctx.options.sessions.get(id);
+  return session2?.user ? session2 : void 0;
 }
 async function getUser(ctx) {
   if (!ctx.options.auth) return;
@@ -2524,31 +2525,32 @@ function auth(app) {
   app.use(async function middle(ctx) {
     ctx.user = await getUser(ctx);
   });
-  app.post("/auth/logout", logout);
+  const spec = { schema: { tags: "auth" } };
+  app.post("/auth/logout", spec, logout);
   const enabled = app.settings.auth.providers;
   for (const name of oauth2) {
     if (!enabled.includes(name)) continue;
     const key = name.toUpperCase();
     if (!env[`${key}_ID`]) throw new Error(`${key}_ID not defined`);
     if (!env[`${key}_SECRET`]) throw new Error(`${key}_SECRET not defined`);
-    app.get(`/auth/login/${name}`, providers_default[name].login);
-    app.get(`/auth/callback/${name}`, providers_default[name].callback);
-    app.post(`/auth/verify/${name}`, providers_default[name].verify);
+    app.get(`/auth/login/${name}`, spec, providers_default[name].login);
+    app.get(`/auth/callback/${name}`, spec, providers_default[name].callback);
+    app.post(`/auth/verify/${name}`, spec, providers_default[name].verify);
   }
   if (enabled.includes("apple")) {
     const keys = ["APPLE_ID", "APPLE_TEAM_ID", "APPLE_KEY_ID", "APPLE_PRIVATE_KEY"];
     for (const key of keys) {
       if (!env[key]) throw new Error(`${key} not defined`);
     }
-    app.get("/auth/login/apple", providers_default.apple.login);
-    app.post("/auth/callback/apple", providers_default.apple.callback);
-    app.post("/auth/verify/apple", providers_default.apple.verify);
+    app.get("/auth/login/apple", spec, providers_default.apple.login);
+    app.post("/auth/callback/apple", spec, providers_default.apple.callback);
+    app.post("/auth/verify/apple", spec, providers_default.apple.verify);
   }
   if (enabled.includes("email")) {
-    app.post("/auth/register/email", providers_default.email.register);
-    app.post("/auth/login/email", providers_default.email.login);
-    app.put("/auth/password/email", providers_default.email.password);
-    app.put("/auth/reset/email", providers_default.email.reset);
+    app.post("/auth/register/email", spec, providers_default.email.register);
+    app.post("/auth/login/email", spec, providers_default.email.login);
+    app.put("/auth/password/email", spec, providers_default.email.password);
+    app.put("/auth/reset/email", spec, providers_default.email.reset);
   }
 }
 
@@ -2587,8 +2589,8 @@ async function assets(ctx) {
     const info = file2.info?.bind(file2);
     const meta = info ? await info() : null;
     if (info ? !meta : !await file2.exists()) return;
-    const ext2 = ctx.url.pathname.split(".").pop()?.toLowerCase();
-    const ctype = ext2 && mimes_default[ext2] || meta?.type || ext2;
+    const ext = ctx.url.pathname.split(".").pop()?.toLowerCase();
+    const ctype = ext && mimes_default[ext] || meta?.type || ext;
     const headers2 = { "cache-control": CACHE_CONTROL };
     let tag;
     if (meta) {
@@ -2623,46 +2625,8 @@ async function assets(ctx) {
   }
 }
 
-// src/middle/favicon.ts
-var CACHE_CONTROL2 = "public, max-age=86400";
-var ext = (name) => name.split(".").pop() || "ico";
-async function loadFavicon(fav) {
-  try {
-    const type2 = ext(typeof fav === "string" ? fav : fav?.name);
-    const bytes = typeof fav === "string" ? await (await import("fs/promises")).readFile(fav) : Buffer.from(await fav.bytes());
-    return { bytes, type: type2, etag: etag(bytes) };
-  } catch {
-    return null;
-  }
-}
-async function favicon(ctx) {
-  const fav = ctx.options.favicon;
-  if (!fav) return;
-  if (ctx.app.faviconCache === void 0) {
-    ctx.app.faviconCache = await loadFavicon(fav);
-  }
-  const entry = ctx.app.faviconCache;
-  if (!entry) return 204;
-  const headers2 = { "cache-control": CACHE_CONTROL2, etag: entry.etag };
-  if (ctx.headers["if-none-match"] === entry.etag) {
-    return status(304).headers(headers2).send();
-  }
-  return type(entry.type).headers(headers2).send(entry.bytes);
-}
-
 // src/middle/openapi.ts
 import * as fsp from "fs/promises";
-var entities = {
-  "&": "&",
-  "<": "&lt;",
-  ">": "&gt;",
-  '"': "&quot;"
-};
-var encode = (str = "") => {
-  if (typeof str === "number") str = String(str);
-  if (typeof str !== "string") return "";
-  return str.replace(/[&<>"]/g, (tag) => entities[tag]);
-};
 var getConfig = (options = {}) => {
   const config2 = { ...options };
   if (config2.tags) {
@@ -2676,6 +2640,25 @@ var getConfig = (options = {}) => {
   }
   return config2;
 };
+var clean = ({ $schema, ...schema }) => schema;
+async function toJsonSchema(schema) {
+  try {
+    if (typeof schema?.toJsonSchema === "function") {
+      return clean(schema.toJsonSchema());
+    }
+    const vendor = schema?.["~standard"]?.vendor;
+    if (vendor === "zod") {
+      const mod = await import("zod");
+      return clean((mod.toJSONSchema ?? mod.z.toJSONSchema)(schema));
+    }
+    if (vendor === "valibot") {
+      const mod = await import("@valibot/to-json-schema");
+      return clean(mod.toJsonSchema(schema));
+    }
+  } catch {
+  }
+  return zodToSchema(schema);
+}
 function zodToSchema(schema) {
   const type2 = schema?.def?.type || "string";
   if (type2 === "object") {
@@ -2698,48 +2681,31 @@ function zodToSchema(schema) {
   return { type: type2 };
 }
 var pkgProm = fsp.readFile("package.json", "utf-8").then((data) => JSON.parse(data)).catch(() => ({}));
-var getTag = (name, fn) => {
-  const found = fn.toString().split("\n").filter((l) => /\s+\/\/\s/.test(l)).map((l) => l.trim().replace("// ", "")).find((l) => l.startsWith(name));
-  if (!found) return "";
-  return encode(found.replace(name, "").trim());
-};
-var getDescription = (fn) => getTag("@description", fn) || "";
-var getReturn = (fn) => getTag("@returns", fn) || "OK";
-var generateOpenApiPaths = (handlers) => {
+var generateOpenApiPaths = async (handlers, specPath) => {
   const paths = {};
   for (const [method, routes] of Object.entries(handlers)) {
     for (const route of routes) {
       const path = route.path;
-      const fn = route.fns.find((p) => typeof p === "function");
       const meta = route.options ?? {};
       const config2 = getConfig(route.options?.schema);
-      if (typeof path !== "string" || path === "*" || path === "/docs" || !fn) {
+      if (typeof path !== "string" || path === "*" || path === specPath) {
         continue;
       }
+      if (route.options?.schema === false) continue;
       const normalizedPath = path.replace(/\(\w+\)/gi, "").replace(/:([a-zA-Z0-9_]+)/g, "{$1}");
       if (!paths[normalizedPath]) {
         paths[normalizedPath] = {};
       }
-      const getTitle = (fn2) => {
-        if (!fn2.name) return null;
-        const wrongNames = ["default"];
-        if (wrongNames.includes(fn2.name)) return null;
-        if (fn2.name.length <= 3) return null;
-        if (fn2.name.includes("_")) return fn2.name.replace(/_/g, " ");
-        const name = fn2.name.split(/(?=[A-Z])/).join(" ").toLowerCase();
-        return name[0].toUpperCase() + name.slice(1);
-      };
       let requestBody;
       if (meta?.body) {
-        const schema = zodToSchema(meta.body);
+        const schema = await toJsonSchema(meta.body);
         requestBody = { content: { "application/json": { schema } } };
       }
       let responses;
       if (meta?.response) {
-        const schema = zodToSchema(meta.response);
-        const description = getReturn(fn);
+        const schema = await toJsonSchema(meta.response);
         responses = {
-          200: { description, content: { "application/json": { schema } } }
+          200: { description: "OK", content: { "application/json": { schema } } }
         };
       }
       const parameters = [];
@@ -2754,18 +2720,20 @@ var generateOpenApiPaths = (handlers) => {
         });
       });
       if (meta?.query) {
-        Object.entries(meta.query).map(([key, value]) => ({
-          name: key,
-          in: "query",
-          required: false,
-          schema: { type: typeof value },
-          example: value
-        }));
+        const schema = await toJsonSchema(meta.query);
+        for (const [name, prop] of Object.entries(schema.properties ?? {})) {
+          parameters.push({
+            name,
+            in: "query",
+            required: schema.required?.includes(name) ?? false,
+            schema: prop
+          });
+        }
       }
       paths[normalizedPath][method] = {
         tags: config2.tags,
-        summary: config2.title || getTag("@title", fn) || `${method.toUpperCase()} ${normalizedPath}`,
-        description: config2.description || getTitle(fn) || getDescription(fn),
+        summary: config2.title,
+        description: config2.description,
         requestBody,
         parameters,
         responses
@@ -2776,34 +2744,21 @@ var generateOpenApiPaths = (handlers) => {
 };
 var openapi_default = async (ctx) => {
   const pkg = await pkgProm;
+  const { title, description, version } = ctx.options.openapi ?? {};
   const domain = pkg.homepage || ctx.url.origin;
-  const openApi = {
+  return {
     openapi: "3.0.0",
     info: {
-      title: pkg.name || "API Documentation",
-      version: pkg.version || "1.0.0",
-      description: pkg.description || ""
+      title: title || pkg.name || "API Documentation",
+      version: version || pkg.version || "1.0.0",
+      description: description ?? (pkg.description || "")
     },
     servers: domain ? [{ url: domain }] : [],
-    paths: generateOpenApiPaths(ctx.app.handlers)
+    paths: await generateOpenApiPaths(
+      ctx.app.handlers,
+      ctx.options.openapi?.path ?? ""
+    )
   };
-  const configuration = ctx.options.openapi?.scalar || {};
-  return `
-<!doctype html>
-<html>
-  <head>
-    <title>API Reference</title>
-    <meta charset="utf-8" />
-    <meta
-      name="viewport"
-      content="width=device-width, initial-scale=1" />
-    <style>.open-api-client-button {display: none!important;}</style>
-  </head>
-  <body>
-    <script id="api-reference" type="application/json" data-configuration="${encode(JSON.stringify(configuration))}">${JSON.stringify(openApi, null, 2)}</script>
-    <script src="https://cdn.jsdelivr.net/npm/@scalar/api-reference"></script>
-  </body>
-</html> `;
 };
 
 // src/middle/preflight.ts
@@ -3038,7 +2993,7 @@ function isValidMethod(method) {
 
 // src/context/node.ts
 var chunkArray = (arr) => arr.length > 2 ? [[arr[0], arr[1]], ...chunkArray(arr.slice(2))] : [arr];
-async function createNode(req, app) {
+async function createNode(req, app, signal = new AbortController().signal) {
   const init = performance.now();
   const method = req.method?.toLowerCase() || "get";
   if (!isValidMethod(method)) {
@@ -3072,6 +3027,7 @@ async function createNode(req, app) {
     body: void 0,
     headers: headers2,
     cookies: cookies2,
+    signal,
     session: {},
     init,
     app,
@@ -3112,6 +3068,7 @@ async function createWinter(req, app, server2) {
     body: void 0,
     headers: headers2,
     cookies: cookies2,
+    signal: req.signal,
     session: {},
     init,
     app,
@@ -3149,7 +3106,11 @@ var Node = async (app) => {
   const http = await import("http");
   const server2 = http.createServer(
     async (request, response) => {
-      const ctx = await createNode(request, app);
+      const controller = new AbortController();
+      response.on("close", () => {
+        if (!response.writableFinished) controller.abort();
+      });
+      const ctx = await createNode(request, app, controller.signal);
       if ("error" in ctx) throw ctx.error;
       const out = await handleRequest(app, ctx);
       response.writeHead(out.status || 200, parseHeaders_default(out.headers));
@@ -3231,6 +3192,9 @@ var Router = class _Router {
       options = rest.shift();
     }
     checkParserConflict(options, this.settings?.parser);
+    if (options.uploads !== void 0) {
+      options.uploads = resolveUploads(options.uploads);
+    }
     const base = method === "socket" ? [] : this.middleware;
     const fns = [...base, ...rest].filter((fn) => fn != null);
     this.handlers[method].push({ path, options, fns });
@@ -3337,9 +3301,6 @@ var Server = class extends Router {
   platform;
   sockets;
   websocket;
-  // Lazily-loaded favicon bytes, cached per server until restart (see favicon
-  // middleware). `undefined` = not loaded yet; `null` = configured but missing.
-  faviconCache;
   port;
   constructor(options = {}) {
     super();
@@ -3359,13 +3320,12 @@ var Server = class extends Router {
     app.use(timer);
     if (this.settings.cors) app.use(preflight);
     app.use(assets);
-    if (this.settings.favicon) app.get("/favicon.ico", favicon);
     app.use(session);
     if (this.settings.auth) {
       auth(app);
     }
     if (this.settings.openapi) {
-      app.get(this.settings.openapi.path || "/docs", openapi_default);
+      app.get(this.settings.openapi.path, openapi_default);
     }
   }
   self() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.42.0",
+  "version": "0.44.0",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "github:franciscop/server-next",
@@ -13,7 +13,8 @@
     "server.js"
   ],
   "scripts": {
-    "build": "bunx tsup src/index.ts --format esm --dts --out-dir . --target node24",
+    "build": "bunx tsup src/index.ts --format esm --dts --out-dir . --target node24 --external zod --external @valibot/to-json-schema",
+    "prepare": "mkdir -p node_modules/@server && ln -sfn ../.. node_modules/@server/next",
     "start": "bun test --watch",
     "lint": "npx tsc --noEmit && npx @biomejs/biome lint ./src --skip=lint/suspicious/noExplicitAny --skip=lint/style/noParameterAssign --skip=lint/suspicious/noConfusingVoidType --skip=lint/complexity/noBannedTypes",
     "test": "npm run test:bun && tsc --noEmit",
@@ -54,7 +55,7 @@
       "Reply": "docs/4. Reply.md",
       "Authentication": "docs/5. Authentication.md",
       "Testing": "docs/6. Testing.md",
-      "Platforms": "docs/7. Platforms.md",
+      "Concepts": "docs/7. Concepts.md",
       "FAQ": "docs/8. FAQ.md"
     },
     "tutorials": "docs/tutorials"
@@ -66,6 +67,7 @@
   "devDependencies": {
     "@types/bun": "^1.3.0",
     "@types/node": "^24.10.0",
+    "@valibot/to-json-schema": "^1.7.1",
     "arktype": "^2.2.3",
     "bun": "^1.3.13",
     "check-dts": "^0.8.2",