@sleepy-hollow/framework 0.3.2 → 0.3.3

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to Sleepy Hollow are documented in this file.
 
+## 0.3.3 - 2026-08-21
+
+### Changed: Node/Bun documentation and scaffold alignment
+
+The framework documentation and Sleepy Hollow skill now describe the runtime's
+object-shaped route security metadata, case-sensitive endpoint requirement
+headings, the `sgad-application/v0.2` application format, and the current
+framework 0.3.3 testing workflow. `hollow create` now emits the matching
+application metadata, Node/Bun TypeScript configuration, and Node typings.
+
+The framework's route evidence and fixtures were aligned with the same security
+shape, while retained Deno-era verification records are explicitly marked as
+historical migration evidence.
+
 ## 0.3.2 - 2026-08-20
 
 ### Fixed: global `hollow` executable

package/README.md

@@ -51,7 +51,7 @@ export default defineRoute({
       params: z.object({ id: z.string() }).strict(),
       responses: { 200: z.object({ id: z.string(), url: z.string() }).strict() },
     },
-    security: { authentication: "none" },
+    security: { authentication: { mode: "none" } },
     contract: { summary: "Return one bookmark" },
     handler: ({ params }) => Response.json({ id: params.id, url: "https://example.com" }),
   },

package/dist/{chunk-BJONRVDG.js → chunk-4PPSJ2LE.js}

@@ -1,12 +1,12 @@
 import {
   redactSecurityData
-} from "./chunk-DGTHFZPZ.js";
+} from "./chunk-LZ2HLHDW.js";
 import {
   z
-} from "./chunk-CAPFDC25.js";
+} from "./chunk-JRFHLLLF.js";
 import {
   platform
-} from "./chunk-53TZY5YP.js";
+} from "./chunk-S3Z6CO7J.js";
 
 // core/config/types.ts
 var RUNTIME_MODES = [
@@ -426,4 +426,4 @@ export {
   createJsonLogger,
   createOperationalRoutes
 };
-//# sourceMappingURL=chunk-BJONRVDG.js.map
+//# sourceMappingURL=chunk-4PPSJ2LE.js.map

package/dist/{chunk-CAPFDC25.js → chunk-JRFHLLLF.js}

@@ -1,6 +1,6 @@
 import {
   createRouter
-} from "./chunk-53TZY5YP.js";
+} from "./chunk-S3Z6CO7J.js";
 
 // core/validation/mod.ts
 import { z as z2 } from "zod";
@@ -595,4 +595,4 @@ export {
   createValidatedRouter,
   z2 as z
 };
-//# sourceMappingURL=chunk-CAPFDC25.js.map
+//# sourceMappingURL=chunk-JRFHLLLF.js.map

package/dist/{chunk-DGTHFZPZ.js → chunk-LZ2HLHDW.js}

@@ -1,9 +1,9 @@
 import {
   createValidatedRouter
-} from "./chunk-CAPFDC25.js";
+} from "./chunk-JRFHLLLF.js";
 import {
   platform
-} from "./chunk-53TZY5YP.js";
+} from "./chunk-S3Z6CO7J.js";
 
 // core/security/declaration.ts
 import { isAbsolute, resolve, sep } from "path";
@@ -827,4 +827,4 @@ export {
   composeProjectSecurity,
   createMemoryRateLimiter
 };
-//# sourceMappingURL=chunk-DGTHFZPZ.js.map
+//# sourceMappingURL=chunk-LZ2HLHDW.js.map

package/dist/{chunk-D4U3ZY4O.js → chunk-M4D63YC7.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-BAKXP7IR.js";
 import {
   composeProjectSecurity
-} from "./chunk-DGTHFZPZ.js";
+} from "./chunk-LZ2HLHDW.js";
 import {
   __commonJS,
   __toESM
@@ -4582,4 +4582,4 @@ export {
    * LICENSE file in the root directory of this source tree.
    *)
 */
-//# sourceMappingURL=chunk-D4U3ZY4O.js.map
+//# sourceMappingURL=chunk-M4D63YC7.js.map

package/dist/{chunk-53TZY5YP.js → chunk-S3Z6CO7J.js}

@@ -467,4 +467,4 @@ export {
   discoverRoutes,
   createRouter
 };
-//# sourceMappingURL=chunk-53TZY5YP.js.map
+//# sourceMappingURL=chunk-S3Z6CO7J.js.map

package/dist/chunk-S3Z6CO7J.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../core/routing/define_route.ts","../runtime/platform.ts","../core/routing/discover.ts","../core/routing/types.ts","../core/routing/router.ts"],"sourcesContent":["import type {\n  HttpMethod,\n  RouteHandlerContext,\n  RouteOperation,\n} from \"./types.ts\";\n\ntype MethodMap = Partial<Record<HttpMethod, unknown>>;\n\ntype DefinedRoute<\n  Schemas extends MethodMap,\n  Security extends { readonly [Method in keyof Schemas]: unknown },\n  Contract extends { readonly [Method in keyof Schemas]: unknown },\n> = {\n  readonly [Method in keyof Schemas]: RouteOperation<\n    Schemas[Method],\n    Security[Method],\n    Contract[Method]\n  >;\n};\n\n/**\n * Declares the operations a route file answers, one per HTTP method.\n *\n * The call is an identity function at runtime; its work is done in the type\n * system, where the schemas you pass become the types of `params`, `query`,\n * `headers`, and `body` inside each handler, and the declared authentication\n * mode determines whether `principal` can be `null`.\n *\n * ```ts\n * import { defineRoute } from \"@sleepy-hollow/framework/routing\";\n * import { z } from \"@sleepy-hollow/framework/validation\";\n *\n * export default defineRoute({\n *   GET: {\n *     schemas: {\n *       params: z.object({ id: z.string() }).strict(),\n *       responses: { 200: z.object({ id: z.string() }).strict() },\n *     },\n *     security: { authentication: { mode: \"none\" } },\n *     contract: { summary: \"Return one widget\" },\n *     handler: ({ params }) => Response.json({ id: params.id }),\n *   },\n * });\n * ```\n *\n * @param route The operations this file answers, keyed by HTTP method.\n * @returns The same declaration, typed so handlers infer their inputs.\n */\nexport function defineRoute<\n  const Schemas extends MethodMap,\n  const Security extends { readonly [Method in keyof Schemas]: unknown },\n  const Contract extends { readonly [Method in keyof Schemas]: unknown },\n>(\n  route: {\n    readonly [Method in keyof Schemas]: {\n      readonly schemas: Schemas[Method];\n      readonly security: Security[Method];\n      readonly contract: Contract[Method];\n      readonly handler: (\n        context: RouteHandlerContext<Schemas[Method], Security[Method]>,\n      ) => Response | Promise<Response>;\n    };\n  },\n): DefinedRoute<Schemas, Security, Contract> {\n  return route;\n}\n","import { spawn as spawnChild } from \"child_process\";\nimport {\n  copyFile,\n  lstat,\n  mkdir,\n  mkdtemp,\n  readFile,\n  readdir,\n  realpath,\n  rename,\n  rm,\n  stat,\n  writeFile,\n} from \"fs/promises\";\nimport { readdirSync, watch, type FSWatcher } from \"fs\";\nimport { symlink } from \"fs/promises\";\nimport { Readable } from \"stream\";\nimport { tmpdir } from \"os\";\nimport { join } from \"path\";\nimport { serve as nodeServe, type FetchHandler } from \"./server.ts\";\n\nexport interface PlatformDirEntry {\n  readonly name: string;\n  readonly isFile: boolean;\n  readonly isDirectory: boolean;\n  readonly isSymlink: boolean;\n}\n\nexport interface PlatformCommandOutput {\n  readonly code: number;\n  readonly success: boolean;\n  readonly stdout: Uint8Array;\n  readonly stderr: Uint8Array;\n}\n\nclass NotFound extends Error {\n  constructor(path?: string) {\n    super(path ? `Not found: ${path}` : \"Not found\");\n    this.name = \"NotFound\";\n  }\n}\n\nfunction normalizeFilesystemError(error: unknown, path?: string): never {\n  if (typeof error === \"object\" && error !== null && \"code\" in error &&\n    (error as { readonly code?: unknown }).code === \"ENOENT\") {\n    throw new NotFound(path);\n  }\n  throw error;\n}\n\nasync function filesystem<T>(operation: Promise<T>, path?: string): Promise<T> {\n  try {\n    return await operation;\n  } catch (error) {\n    return normalizeFilesystemError(error, path);\n  }\n}\n\ninterface CommandOptions {\n  readonly args?: readonly string[];\n  readonly cwd?: string;\n  readonly env?: Readonly<Record<string, string>>;\n  readonly clearEnv?: boolean;\n  readonly stdin?: \"null\" | \"piped\";\n  readonly stdout?: \"piped\" | \"null\";\n  readonly stderr?: \"piped\" | \"null\";\n}\n\nexport class Command {\n  readonly #command: string;\n  readonly #options: CommandOptions;\n\n  constructor(command: string, options: CommandOptions = {}) {\n    this.#command = command;\n    this.#options = options;\n  }\n\n  async output(): Promise<PlatformCommandOutput> {\n    const child = spawnChild(this.#command, this.#options.args ?? [], {\n      cwd: this.#options.cwd,\n      env: this.#options.clearEnv ? this.#options.env : { ...process.env, ...this.#options.env },\n      stdio: [\"ignore\", \"pipe\", \"pipe\"],\n    });\n    const stdout: Buffer[] = [];\n    const stderr: Buffer[] = [];\n    child.stdout.on(\"data\", (chunk: Buffer) => stdout.push(chunk));\n    child.stderr.on(\"data\", (chunk: Buffer) => stderr.push(chunk));\n    const code = await new Promise<number>((resolve, reject) => {\n      child.once(\"error\", reject);\n      child.once(\"close\", (status) => resolve(status ?? 1));\n    });\n    return { code, success: code === 0, stdout: Buffer.concat(stdout), stderr: Buffer.concat(stderr) };\n  }\n\n  spawn() {\n    const child = spawnChild(this.#command, this.#options.args ?? [], {\n      cwd: this.#options.cwd,\n      env: this.#options.clearEnv ? this.#options.env : { ...process.env, ...this.#options.env },\n      stdio: [\"ignore\", \"pipe\", \"pipe\"],\n    });\n    return {\n      stdout: Readable.toWeb(child.stdout) as ReadableStream<Uint8Array>,\n      stderr: Readable.toWeb(child.stderr) as ReadableStream<Uint8Array>,\n      status: new Promise<{ code: number; success: boolean }>((resolve, reject) => {\n        child.once(\"error\", reject);\n        child.once(\"close\", (code) => {\n          const resolved = code ?? 1;\n          resolve({ code: resolved, success: resolved === 0 });\n        });\n      }),\n      kill: (signal?: NodeJS.Signals) => child.kill(signal),\n    };\n  }\n}\n\nclass Watcher implements AsyncIterable<{ readonly paths: readonly string[] }> {\n  readonly #watcher: FSWatcher;\n  #closed = false;\n  #pending: Array<{ readonly paths: readonly string[] }> = [];\n  #resolve?: (event: IteratorResult<{ readonly paths: readonly string[] }>) => void;\n  #reject?: (reason: unknown) => void;\n  #failure?: unknown;\n\n  constructor(root: string) {\n    this.#watcher = watch(root, { recursive: true }, (_event, filename) => {\n      const event = { paths: [join(root, String(filename ?? \"\"))] };\n      if (this.#resolve) {\n        this.#resolve({ done: false, value: event });\n        this.#resolve = undefined;\n      } else this.#pending.push(event);\n    });\n    this.#watcher.on(\"error\", (error) => {\n      if (this.#closed) return;\n      this.#failure = error;\n      this.#closed = true;\n      this.#reject?.(error);\n      this.#resolve = undefined;\n      this.#reject = undefined;\n    });\n  }\n\n  close(): void {\n    this.#closed = true;\n    this.#watcher.close();\n    this.#resolve?.({ done: true, value: undefined });\n    this.#resolve = undefined;\n    this.#reject = undefined;\n  }\n\n  [Symbol.asyncIterator](): AsyncIterator<{ readonly paths: readonly string[] }> {\n    return {\n      next: () => {\n        const value = this.#pending.shift();\n        if (value) return Promise.resolve({ done: false, value });\n        if (this.#failure) return Promise.reject(this.#failure);\n        if (this.#closed) return Promise.resolve({ done: true, value: undefined });\n        return new Promise((resolve, reject) => {\n          this.#resolve = resolve;\n          this.#reject = reject;\n        });\n      },\n    };\n  }\n}\n\nexport const platform = Object.freeze({\n  args: process.argv.slice(2),\n  cwd: () => process.cwd(),\n  exit: (code?: number) => process.exit(code),\n  execPath: () => process.execPath,\n  env: Object.freeze({\n    get: (name: string) => process.env[name],\n    toObject: () => ({ ...process.env }),\n  }),\n  errors: Object.freeze({\n    NotFound,\n    AddrInUse: class AddrInUse extends Error {},\n    PermissionDenied: class PermissionDenied extends Error {},\n  }),\n  isNotFound: (error: unknown) =>\n    error instanceof NotFound ||\n    (typeof error === \"object\" && error !== null &&\n      \"code\" in error && (error as { readonly code?: unknown }).code === \"ENOENT\"),\n  readTextFile: async (path: string) => filesystem(readFile(path, \"utf8\"), path),\n  readFile: async (path: string) => filesystem(readFile(path), path),\n  writeTextFile: async (path: string, text: string, options?: { readonly createNew?: boolean }) =>\n    writeFile(path, text, options?.createNew ? { flag: \"wx\" } : undefined),\n  stat: (path: string) => filesystem(stat(path), path),\n  lstat: (path: string) => filesystem(lstat(path), path),\n  mkdir,\n  rename,\n  remove: (path: string, options?: { readonly recursive?: boolean }) => rm(path, { recursive: options?.recursive, force: true }),\n  realPath: (path: string) => filesystem(realpath(path), path),\n  copyFile: (source: string, target: string) => filesystem(copyFile(source, target), source),\n  symlink: (target: string, path: string) => filesystem(symlink(target, path), path),\n  readDirSync: (path: string) => readdirSync(path, { withFileTypes: true }).map((entry) => ({ name: entry.name, isFile: entry.isFile(), isDirectory: entry.isDirectory(), isSymlink: entry.isSymbolicLink() })),\n  makeTempDir: async (options?: { readonly prefix?: string; readonly dir?: string }) =>\n    mkdtemp(join(options?.dir ?? tmpdir(), options?.prefix ?? \"sleepy-hollow-\")),\n  async *readDir(path: string): AsyncIterable<PlatformDirEntry> {\n    for (const entry of await readdir(path, { withFileTypes: true })) {\n      yield { name: entry.name, isFile: entry.isFile(), isDirectory: entry.isDirectory(), isSymlink: entry.isSymbolicLink() };\n    }\n  },\n  watchFs: (root: string, _options?: { readonly recursive?: boolean }) => new Watcher(root),\n  addSignalListener: (signal: NodeJS.Signals, listener: () => void) => process.on(signal, listener),\n  removeSignalListener: (signal: NodeJS.Signals, listener: () => void) => process.off(signal, listener),\n  serve: (options: { readonly port?: number; readonly hostname?: string }, handler: FetchHandler) => nodeServe(handler, options),\n  Command,\n});\n","import { platform, type PlatformDirEntry } from \"#platform\";\nimport { dirname, relative, resolve, sep } from \"path\";\nimport { fileURLToPath, pathToFileURL } from \"url\";\n\nimport {\n  HTTP_METHODS,\n  type HttpMethod,\n  type NormalizedRoute,\n  RouteDiscoveryError,\n  type RouteModule,\n  type RouteOperation,\n  type RoutingDiagnostic,\n} from \"./types.ts\";\n\nconst dynamicSegment = /^\\[([^\\]]+)\\]$/;\nconst parameterName = /^[A-Za-z_][A-Za-z0-9_]*$/;\nconst methods = new Set<string>(HTTP_METHODS);\n\ninterface RouteFile {\n  readonly path: string;\n  readonly segments: readonly string[];\n  readonly routePath: string;\n  readonly conflictPath: string;\n  readonly parameterNames: readonly string[];\n}\n\nconst portablePath = (path: string) => path.split(sep).join(\"/\");\n\nasync function collectRouteFiles(directory: string): Promise<string[]> {\n  const files: string[] = [];\n  const entries: PlatformDirEntry[] = [];\n\n  for await (const entry of platform.readDir(directory)) entries.push(entry);\n  entries.sort((left, right) => left.name.localeCompare(right.name));\n\n  for (const entry of entries) {\n    const path = resolve(directory, entry.name);\n    if (entry.isDirectory) files.push(...await collectRouteFiles(path));\n    if (entry.isFile && entry.name === \"route.ts\") files.push(path);\n  }\n\n  return files;\n}\n\nfunction normalizeRouteFile(\n  apiRoot: string,\n  path: string,\n): RouteFile | RoutingDiagnostic {\n  const segments = portablePath(relative(apiRoot, dirname(path))).split(\"/\")\n    .filter(Boolean);\n  const routeSegments: string[] = [];\n  const conflictSegments: string[] = [];\n  const parameterNames: string[] = [];\n\n  for (const segment of segments) {\n    const match = segment.match(dynamicSegment);\n    if (!match) {\n      if (segment.includes(\"[\") || segment.includes(\"]\")) {\n        return invalidSegment(path, segment);\n      }\n      routeSegments.push(segment);\n      conflictSegments.push(segment);\n      continue;\n    }\n\n    const name = match[1];\n    if (!parameterName.test(name)) return invalidSegment(path, segment);\n    if (parameterNames.includes(name)) {\n      return {\n        code: \"SH_ROUTE_INVALID_SEGMENT\",\n        summary: `Dynamic parameter '${name}' is repeated in one route`,\n        files: [portablePath(path)],\n        correction: \"Use a unique parameter name for every dynamic segment.\",\n      };\n    }\n\n    parameterNames.push(name);\n    routeSegments.push(`:${name}`);\n    conflictSegments.push(\":parameter\");\n  }\n\n  return {\n    path: portablePath(path),\n    segments,\n    routePath: `/${routeSegments.join(\"/\")}`,\n    conflictPath: `/${conflictSegments.join(\"/\")}`,\n    parameterNames,\n  };\n}\n\nfunction invalidSegment(path: string, segment: string): RoutingDiagnostic {\n  return {\n    code: \"SH_ROUTE_INVALID_SEGMENT\",\n    summary: `Invalid dynamic route segment '${segment}'`,\n    files: [portablePath(path)],\n    correction:\n      \"Use [name] with a TypeScript identifier as the parameter name.\",\n  };\n}\n\nfunction validateModule(\n  value: unknown,\n  file: RouteFile,\n): RoutingDiagnostic | RouteModule {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n    return invalidModule(\n      file.path,\n      \"The default export must be created with defineRoute\",\n    );\n  }\n\n  const entries = Object.entries(value);\n  if (entries.length === 0) {\n    return invalidModule(\n      file.path,\n      \"The route must declare at least one HTTP method\",\n    );\n  }\n\n  for (const [method, operation] of entries) {\n    if (!methods.has(method)) {\n      return invalidModule(file.path, `Unsupported HTTP method '${method}'`);\n    }\n    if (!isOperation(operation)) {\n      return invalidModule(\n        file.path,\n        `${method} must declare schemas, security, contract, and a handler`,\n      );\n    }\n  }\n\n  return value as RouteModule;\n}\n\nfunction isOperation(value: unknown): value is RouteOperation {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return false;\n  const operation = value as Record<string, unknown>;\n  return Object.hasOwn(operation, \"schemas\") &&\n    Object.hasOwn(operation, \"security\") &&\n    Object.hasOwn(operation, \"contract\") &&\n    typeof operation.handler === \"function\";\n}\n\nfunction invalidModule(path: string, summary: string): RoutingDiagnostic {\n  return {\n    code: \"SH_ROUTE_INVALID_MODULE\",\n    summary,\n    files: [portablePath(path)],\n    correction:\n      \"Default-export one defineRoute method map with complete operations.\",\n  };\n}\n\nfunction findConflicts(files: readonly RouteFile[]): RoutingDiagnostic[] {\n  const groups = Map.groupBy(files, (file) => file.conflictPath);\n  const diagnostics: RoutingDiagnostic[] = [];\n\n  for (const [route, group] of groups) {\n    if (group.length < 2) continue;\n    diagnostics.push({\n      code: \"SH_ROUTE_CONFLICT\",\n      summary: `Ambiguous route definitions normalize to '${route}'`,\n      files: group.map((file) => file.path).sort(),\n      route,\n      correction: \"Keep only one dynamic sibling at each route depth.\",\n    });\n  }\n\n  return diagnostics.sort((left, right) =>\n    (left.route ?? \"\").localeCompare(right.route ?? \"\")\n  );\n}\n\n/**\n * Walks a directory and derives the route table from the file layout.\n *\n * Each `route.ts` becomes one route whose URL path is its position in the\n * tree, and each method it exports becomes one entry. Faults are collected\n * across the whole tree and thrown together as a\n * {@linkcode RouteDiscoveryError}, so one run reports every correction rather\n * than stopping at the first.\n *\n * @param apiRoot Directory to walk, as a path or a `file:` URL.\n * @returns Every discovered route, one entry per method.\n * @throws {RouteDiscoveryError} When any route in the tree is malformed.\n */\nexport async function discoverRoutes(\n  apiRoot: URL | string,\n): Promise<readonly NormalizedRoute[]> {\n  const root = resolve(\n    apiRoot instanceof URL ? fileURLToPath(apiRoot) : apiRoot,\n  );\n  const diagnostics: RoutingDiagnostic[] = [];\n  const routeFiles: RouteFile[] = [];\n\n  for (const path of await collectRouteFiles(root)) {\n    const normalized = normalizeRouteFile(root, path);\n    if (\"code\" in normalized) diagnostics.push(normalized);\n    else routeFiles.push(normalized);\n  }\n\n  diagnostics.push(...findConflicts(routeFiles));\n\n  const routes: NormalizedRoute[] = [];\n  for (const file of routeFiles) {\n    try {\n      const imported = await import(pathToFileURL(file.path).href);\n      const routeModule = validateModule(imported.default, file);\n      if (\"code\" in routeModule) {\n        diagnostics.push(routeModule);\n        continue;\n      }\n\n      for (const [method, operation] of Object.entries(routeModule)) {\n        routes.push({\n          method: method as HttpMethod,\n          path: file.routePath,\n          source: file.path,\n          parameterNames: file.parameterNames,\n          operation,\n        });\n      }\n    } catch (error) {\n      diagnostics.push(invalidModule(\n        file.path,\n        `Route module could not be loaded: ${\n          error instanceof Error ? error.message : String(error)\n        }`,\n      ));\n    }\n  }\n\n  if (diagnostics.length > 0) {\n    diagnostics.sort((left, right) =>\n      `${left.code}:${left.files.join(\":\")}`.localeCompare(\n        `${right.code}:${right.files.join(\":\")}`,\n      )\n    );\n    throw new RouteDiscoveryError(diagnostics);\n  }\n\n  return routes.sort((left, right) =>\n    left.path.localeCompare(right.path) ||\n    left.method.localeCompare(right.method)\n  );\n}\n","/** The HTTP methods a route module may export an operation for. */\nexport const HTTP_METHODS = [\n  \"DELETE\",\n  \"GET\",\n  \"HEAD\",\n  \"OPTIONS\",\n  \"PATCH\",\n  \"POST\",\n  \"PUT\",\n] as const;\n\n/** One of the {@linkcode HTTP_METHODS} a route operation may answer. */\nexport type HttpMethod = (typeof HTTP_METHODS)[number];\n\ntype SchemaOutput<Schema, Fallback> = Schema extends {\n  readonly _zod: { readonly output: infer Output };\n} ? Output\n  : Schema extends { readonly _output: infer Output } ? Output\n  : Fallback;\n\ntype ReadonlyOutput<Output> = Output extends object ? Readonly<Output> : Output;\n\ntype LocationOutput<\n  Schemas,\n  Location extends PropertyKey,\n  Fallback,\n> = Schemas extends { readonly [Key in Location]: infer Schema }\n  ? ReadonlyOutput<SchemaOutput<Schema, Fallback>>\n  : Fallback;\n\ntype BodyOutput<Schemas> = Schemas extends {\n  readonly body: { readonly schema: infer Schema };\n} ? ReadonlyOutput<SchemaOutput<Schema, unknown>>\n  : undefined;\n\n/**\n * The authenticated caller a handler runs on behalf of.\n *\n * Present only on routes whose security declares authentication; a route\n * declaring `\"none\"` receives `null` instead, and the type reflects that so a\n * handler cannot read a principal it was never given.\n */\nexport interface RoutePrincipal {\n  /** Stable identifier for the caller, unique within its {@linkcode type}. */\n  readonly id: string;\n  /** What kind of caller this is, as named by the authentication provider. */\n  readonly type: string;\n  /** Additional claims the provider asserted about the caller. */\n  readonly claims?: Readonly<Record<string, unknown>>;\n}\n\ntype SecurityPrincipal<Security> = Security extends {\n  readonly authentication: { readonly mode: \"required\" };\n} ? RoutePrincipal\n  : Security extends {\n    readonly authentication: { readonly mode: \"none\" };\n  } ? null\n  : RoutePrincipal | null;\n\n/**\n * What a route handler receives.\n *\n * Each validated location is typed from the route's own schemas, so `params`,\n * `query`, `headers`, and `body` arrive already parsed rather than as raw\n * strings the handler has to re-check.\n */\nexport interface RouteHandlerContext<Schemas = unknown, Security = unknown> {\n  /** The incoming request, unmodified. */\n  readonly request: Request;\n  /** Path parameters, parsed by the route's `params` schema. */\n  readonly params: LocationOutput<\n    Schemas,\n    \"params\",\n    Readonly<Record<string, string>>\n  >;\n  /** Query string values, parsed by the route's `query` schema. */\n  readonly query: LocationOutput<\n    Schemas,\n    \"query\",\n    Readonly<Record<string, unknown>>\n  >;\n  /** Request headers, parsed by the route's `headers` schema. */\n  readonly headers: LocationOutput<\n    Schemas,\n    \"headers\",\n    Readonly<Record<string, unknown>>\n  >;\n  /** The parsed request body, or `undefined` when the route declares none. */\n  readonly body: BodyOutput<Schemas>;\n  /** Aborts when the client disconnects or the request times out. */\n  readonly signal: AbortSignal;\n  /** The authenticated caller, or `null` on an unauthenticated route. */\n  readonly principal: SecurityPrincipal<Security>;\n  /** Correlates this request across logs and captured evidence. */\n  readonly requestId: string;\n}\n\n/**\n * One method's implementation within a route module: its schemas, its security,\n * its documented contract, and the handler that answers it.\n */\nexport interface RouteOperation<\n  Schemas = unknown,\n  Security = unknown,\n  Contract = unknown,\n> {\n  /** Validation schemas for each request location and each response status. */\n  readonly schemas: Schemas;\n  /** Authentication and authorization requirements for this operation. */\n  readonly security: Security;\n  /** Documentation for this operation, such as its summary. */\n  readonly contract: Contract;\n  /** Answers the request once validation and security have passed. */\n  readonly handler: (\n    context: RouteHandlerContext<Schemas, Security>,\n  ) => Response | Promise<Response>;\n}\n\n/** A route file's default export: one operation per method it answers. */\nexport type RouteModule = Partial<\n  Record<HttpMethod, RouteOperation<unknown, unknown, unknown>>\n>;\n\n/**\n * One method of one route after discovery, with its URL path derived from the\n * file's position in the tree. This is what the router dispatches against.\n */\nexport interface NormalizedRoute {\n  /** The method this entry answers. */\n  readonly method: HttpMethod;\n  /** The URL path, with parameters as `[name]` segments. */\n  readonly path: string;\n  /** Path of the file this route was discovered from. */\n  readonly source: string;\n  /** Names of the path parameters, in the order they appear. */\n  readonly parameterNames: readonly string[];\n  /** The operation to invoke for this method. */\n  readonly operation: RouteOperation<unknown, unknown, unknown>;\n}\n\n/** One reason discovery refused a route tree. */\nexport interface RoutingDiagnostic {\n  /** Stable machine-readable identifier for this kind of fault. */\n  readonly code: string;\n  /** What is wrong, in one sentence. */\n  readonly summary: string;\n  /** The files this diagnostic was raised against. */\n  readonly files: readonly string[];\n  /** The route path concerned, when the fault is specific to one. */\n  readonly route?: string;\n  /** What to change to resolve it. */\n  readonly correction?: string;\n}\n\n/**\n * Thrown when a route tree cannot be discovered.\n *\n * Discovery reports every fault it found rather than the first, so one run\n * surfaces the whole set of corrections.\n */\nexport class RouteDiscoveryError extends Error {\n  /**\n   * Builds an error whose message lists every diagnostic, one per line.\n   *\n   * @param diagnostics Every fault discovery found, in the order detected.\n   */\n  constructor(readonly diagnostics: readonly RoutingDiagnostic[]) {\n    super(\n      diagnostics.map((diagnostic) =>\n        `${diagnostic.code}: ${diagnostic.summary}`\n      ).join(\"\\n\"),\n    );\n    this.name = \"RouteDiscoveryError\";\n  }\n}\n","import { platform } from \"#platform\";\nimport type { NormalizedRoute } from \"./types.ts\";\n\ninterface Match {\n  readonly route: NormalizedRoute;\n  readonly params: Readonly<Record<string, string>>;\n}\n\nfunction splitPath(path: string): readonly string[] | undefined {\n  try {\n    return path.split(\"/\").filter(Boolean).map(decodeURIComponent);\n  } catch {\n    return undefined;\n  }\n}\n\nfunction matchRoute(\n  route: NormalizedRoute,\n  requestSegments: readonly string[],\n): Match | undefined {\n  const routeSegments = route.path.split(\"/\").filter(Boolean);\n  if (routeSegments.length !== requestSegments.length) return undefined;\n\n  const params: Record<string, string> = {};\n  for (let index = 0; index < routeSegments.length; index += 1) {\n    const expected = routeSegments[index];\n    const actual = requestSegments[index];\n    if (expected.startsWith(\":\")) params[expected.slice(1)] = actual;\n    else if (expected !== actual) return undefined;\n  }\n\n  return { route, params };\n}\n\nfunction compareSpecificity(left: Match, right: Match): number {\n  const leftSegments = left.route.path.split(\"/\").filter(Boolean);\n  const rightSegments = right.route.path.split(\"/\").filter(Boolean);\n\n  for (let index = 0; index < leftSegments.length; index += 1) {\n    const leftDynamic = leftSegments[index].startsWith(\":\");\n    const rightDynamic = rightSegments[index].startsWith(\":\");\n    if (leftDynamic !== rightDynamic) return leftDynamic ? 1 : -1;\n  }\n\n  return left.route.path.localeCompare(right.route.path);\n}\n\nfunction problem(\n  status: number,\n  title: string,\n  instance: string,\n  headers?: HeadersInit,\n): Response {\n  return new Response(\n    JSON.stringify({ type: \"about:blank\", title, status, instance }),\n    {\n      status,\n      headers: {\n        \"content-type\": \"application/problem+json\",\n        ...headers,\n      },\n    },\n  );\n}\n\n/**\n * Builds a request handler that dispatches to a discovered route table.\n *\n * The returned object exposes `fetch`, so it can be passed to `platform.serve`\n * directly. An unmatched path answers 404 and an unmatched method answers 405,\n * both as problem-details responses.\n *\n * ```ts\n * import { createRouter, discoverRoutes } from \"@sleepy-hollow/framework\";\n *\n * const router = createRouter(await discoverRoutes(\"./api\"));\n * platform.serve(router.fetch);\n * ```\n *\n * @param routes The route table, normally from {@linkcode discoverRoutes}.\n * @returns A handler suitable for `platform.serve`.\n */\nexport function createRouter(\n  routes: readonly NormalizedRoute[],\n): { fetch(request: Request): Promise<Response> } {\n  const inventory = [...routes];\n\n  return {\n    async fetch(request: Request): Promise<Response> {\n      const url = new URL(request.url);\n      const requestSegments = splitPath(url.pathname);\n      if (!requestSegments) return problem(404, \"Not Found\", url.pathname);\n\n      const matches = inventory\n        .map((route) => matchRoute(route, requestSegments))\n        .filter((match): match is Match => match !== undefined)\n        .sort(compareSpecificity);\n\n      if (matches.length === 0) return problem(404, \"Not Found\", url.pathname);\n\n      const selectedPath = matches[0].route.path;\n      const pathMatches = matches.filter((match) =>\n        match.route.path === selectedPath\n      );\n      const method = request.method.toUpperCase();\n      const selected = pathMatches.find((match) =>\n        match.route.method === method\n      );\n      if (!selected) {\n        const allowed = [\n          ...new Set(pathMatches.map((match) => match.route.method)),\n        ]\n          .sort();\n        return problem(405, \"Method Not Allowed\", url.pathname, {\n          allow: allowed.join(\", \"),\n        });\n      }\n\n      return await selected.route.operation.handler({\n        request,\n        params: selected.params,\n        query: Object.freeze({}),\n        headers: Object.freeze({}),\n        body: undefined,\n        signal: request.signal,\n        principal: null,\n        requestId: \"\",\n      });\n    },\n  };\n}\n"],"mappings":";;;;;AAgDO,SAAS,YAKd,OAU2C;AAC3C,SAAO;AACT;;;ACjEA,SAAS,SAAS,kBAAkB;AACpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa,aAA6B;AACnD,SAAS,eAAe;AACxB,SAAS,gBAAgB;AACzB,SAAS,cAAc;AACvB,SAAS,YAAY;AAiBrB,IAAM,WAAN,cAAuB,MAAM;AAAA,EAC3B,YAAY,MAAe;AACzB,UAAM,OAAO,cAAc,IAAI,KAAK,WAAW;AAC/C,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,yBAAyB,OAAgB,MAAsB;AACtE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAC1D,MAAsC,SAAS,UAAU;AAC1D,UAAM,IAAI,SAAS,IAAI;AAAA,EACzB;AACA,QAAM;AACR;AAEA,eAAe,WAAc,WAAuB,MAA2B;AAC7E,MAAI;AACF,WAAO,MAAM;AAAA,EACf,SAAS,OAAO;AACd,WAAO,yBAAyB,OAAO,IAAI;AAAA,EAC7C;AACF;AAYO,IAAM,UAAN,MAAc;AAAA,EACV;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,UAA0B,CAAC,GAAG;AACzD,SAAK,WAAW;AAChB,SAAK,WAAW;AAAA,EAClB;AAAA,EAEA,MAAM,SAAyC;AAC7C,UAAM,QAAQ,WAAW,KAAK,UAAU,KAAK,SAAS,QAAQ,CAAC,GAAG;AAAA,MAChE,KAAK,KAAK,SAAS;AAAA,MACnB,KAAK,KAAK,SAAS,WAAW,KAAK,SAAS,MAAM,EAAE,GAAG,QAAQ,KAAK,GAAG,KAAK,SAAS,IAAI;AAAA,MACzF,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAClC,CAAC;AACD,UAAM,SAAmB,CAAC;AAC1B,UAAM,SAAmB,CAAC;AAC1B,UAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AAC7D,UAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AAC7D,UAAM,OAAO,MAAM,IAAI,QAAgB,CAACA,UAAS,WAAW;AAC1D,YAAM,KAAK,SAAS,MAAM;AAC1B,YAAM,KAAK,SAAS,CAAC,WAAWA,SAAQ,UAAU,CAAC,CAAC;AAAA,IACtD,CAAC;AACD,WAAO,EAAE,MAAM,SAAS,SAAS,GAAG,QAAQ,OAAO,OAAO,MAAM,GAAG,QAAQ,OAAO,OAAO,MAAM,EAAE;AAAA,EACnG;AAAA,EAEA,QAAQ;AACN,UAAM,QAAQ,WAAW,KAAK,UAAU,KAAK,SAAS,QAAQ,CAAC,GAAG;AAAA,MAChE,KAAK,KAAK,SAAS;AAAA,MACnB,KAAK,KAAK,SAAS,WAAW,KAAK,SAAS,MAAM,EAAE,GAAG,QAAQ,KAAK,GAAG,KAAK,SAAS,IAAI;AAAA,MACzF,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAClC,CAAC;AACD,WAAO;AAAA,MACL,QAAQ,SAAS,MAAM,MAAM,MAAM;AAAA,MACnC,QAAQ,SAAS,MAAM,MAAM,MAAM;AAAA,MACnC,QAAQ,IAAI,QAA4C,CAACA,UAAS,WAAW;AAC3E,cAAM,KAAK,SAAS,MAAM;AAC1B,cAAM,KAAK,SAAS,CAAC,SAAS;AAC5B,gBAAM,WAAW,QAAQ;AACzB,UAAAA,SAAQ,EAAE,MAAM,UAAU,SAAS,aAAa,EAAE,CAAC;AAAA,QACrD,CAAC;AAAA,MACH,CAAC;AAAA,MACD,MAAM,CAAC,WAA4B,MAAM,KAAK,MAAM;AAAA,IACtD;AAAA,EACF;AACF;AAEA,IAAM,UAAN,MAA8E;AAAA,EACnE;AAAA,EACT,UAAU;AAAA,EACV,WAAyD,CAAC;AAAA,EAC1D;AAAA,EACA;AAAA,EACA;AAAA,EAEA,YAAY,MAAc;AACxB,SAAK,WAAW,MAAM,MAAM,EAAE,WAAW,KAAK,GAAG,CAAC,QAAQ,aAAa;AACrE,YAAM,QAAQ,EAAE,OAAO,CAAC,KAAK,MAAM,OAAO,YAAY,EAAE,CAAC,CAAC,EAAE;AAC5D,UAAI,KAAK,UAAU;AACjB,aAAK,SAAS,EAAE,MAAM,OAAO,OAAO,MAAM,CAAC;AAC3C,aAAK,WAAW;AAAA,MAClB,MAAO,MAAK,SAAS,KAAK,KAAK;AAAA,IACjC,CAAC;AACD,SAAK,SAAS,GAAG,SAAS,CAAC,UAAU;AACnC,UAAI,KAAK,QAAS;AAClB,WAAK,WAAW;AAChB,WAAK,UAAU;AACf,WAAK,UAAU,KAAK;AACpB,WAAK,WAAW;AAChB,WAAK,UAAU;AAAA,IACjB,CAAC;AAAA,EACH;AAAA,EAEA,QAAc;AACZ,SAAK,UAAU;AACf,SAAK,SAAS,MAAM;AACpB,SAAK,WAAW,EAAE,MAAM,MAAM,OAAO,OAAU,CAAC;AAChD,SAAK,WAAW;AAChB,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,CAAC,OAAO,aAAa,IAA0D;AAC7E,WAAO;AAAA,MACL,MAAM,MAAM;AACV,cAAM,QAAQ,KAAK,SAAS,MAAM;AAClC,YAAI,MAAO,QAAO,QAAQ,QAAQ,EAAE,MAAM,OAAO,MAAM,CAAC;AACxD,YAAI,KAAK,SAAU,QAAO,QAAQ,OAAO,KAAK,QAAQ;AACtD,YAAI,KAAK,QAAS,QAAO,QAAQ,QAAQ,EAAE,MAAM,MAAM,OAAO,OAAU,CAAC;AACzE,eAAO,IAAI,QAAQ,CAACA,UAAS,WAAW;AACtC,eAAK,WAAWA;AAChB,eAAK,UAAU;AAAA,QACjB,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,WAAW,OAAO,OAAO;AAAA,EACpC,MAAM,QAAQ,KAAK,MAAM,CAAC;AAAA,EAC1B,KAAK,MAAM,QAAQ,IAAI;AAAA,EACvB,MAAM,CAAC,SAAkB,QAAQ,KAAK,IAAI;AAAA,EAC1C,UAAU,MAAM,QAAQ;AAAA,EACxB,KAAK,OAAO,OAAO;AAAA,IACjB,KAAK,CAAC,SAAiB,QAAQ,IAAI,IAAI;AAAA,IACvC,UAAU,OAAO,EAAE,GAAG,QAAQ,IAAI;AAAA,EACpC,CAAC;AAAA,EACD,QAAQ,OAAO,OAAO;AAAA,IACpB;AAAA,IACA,WAAW,MAAM,kBAAkB,MAAM;AAAA,IAAC;AAAA,IAC1C,kBAAkB,MAAM,yBAAyB,MAAM;AAAA,IAAC;AAAA,EAC1D,CAAC;AAAA,EACD,YAAY,CAAC,UACX,iBAAiB,YAChB,OAAO,UAAU,YAAY,UAAU,QACtC,UAAU,SAAU,MAAsC,SAAS;AAAA,EACvE,cAAc,OAAO,SAAiB,WAAW,SAAS,MAAM,MAAM,GAAG,IAAI;AAAA,EAC7E,UAAU,OAAO,SAAiB,WAAW,SAAS,IAAI,GAAG,IAAI;AAAA,EACjE,eAAe,OAAO,MAAc,MAAc,YAChD,UAAU,MAAM,MAAM,SAAS,YAAY,EAAE,MAAM,KAAK,IAAI,MAAS;AAAA,EACvE,MAAM,CAAC,SAAiB,WAAW,KAAK,IAAI,GAAG,IAAI;AAAA,EACnD,OAAO,CAAC,SAAiB,WAAW,MAAM,IAAI,GAAG,IAAI;AAAA,EACrD;AAAA,EACA;AAAA,EACA,QAAQ,CAAC,MAAc,YAA+C,GAAG,MAAM,EAAE,WAAW,SAAS,WAAW,OAAO,KAAK,CAAC;AAAA,EAC7H,UAAU,CAAC,SAAiB,WAAW,SAAS,IAAI,GAAG,IAAI;AAAA,EAC3D,UAAU,CAAC,QAAgB,WAAmB,WAAW,SAAS,QAAQ,MAAM,GAAG,MAAM;AAAA,EACzF,SAAS,CAAC,QAAgB,SAAiB,WAAW,QAAQ,QAAQ,IAAI,GAAG,IAAI;AAAA,EACjF,aAAa,CAAC,SAAiB,YAAY,MAAM,EAAE,eAAe,KAAK,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,MAAM,MAAM,QAAQ,MAAM,OAAO,GAAG,aAAa,MAAM,YAAY,GAAG,WAAW,MAAM,eAAe,EAAE,EAAE;AAAA,EAC5M,aAAa,OAAO,YAClB,QAAQ,KAAK,SAAS,OAAO,OAAO,GAAG,SAAS,UAAU,gBAAgB,CAAC;AAAA,EAC7E,OAAO,QAAQ,MAA+C;AAC5D,eAAW,SAAS,MAAM,QAAQ,MAAM,EAAE,eAAe,KAAK,CAAC,GAAG;AAChE,YAAM,EAAE,MAAM,MAAM,MAAM,QAAQ,MAAM,OAAO,GAAG,aAAa,MAAM,YAAY,GAAG,WAAW,MAAM,eAAe,EAAE;AAAA,IACxH;AAAA,EACF;AAAA,EACA,SAAS,CAAC,MAAc,aAAgD,IAAI,QAAQ,IAAI;AAAA,EACxF,mBAAmB,CAAC,QAAwB,aAAyB,QAAQ,GAAG,QAAQ,QAAQ;AAAA,EAChG,sBAAsB,CAAC,QAAwB,aAAyB,QAAQ,IAAI,QAAQ,QAAQ;AAAA,EACpG,OAAO,CAAC,SAAiE,YAA0B,MAAU,SAAS,OAAO;AAAA,EAC7H;AACF,CAAC;;;AC/MD,SAAS,SAAS,UAAU,SAAS,WAAW;AAChD,SAAS,eAAe,qBAAqB;;;ACDtC,IAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAuJO,IAAM,sBAAN,cAAkC,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM7C,YAAqB,aAA2C;AAC9D;AAAA,MACE,YAAY;AAAA,QAAI,CAAC,eACf,GAAG,WAAW,IAAI,KAAK,WAAW,OAAO;AAAA,MAC3C,EAAE,KAAK,IAAI;AAAA,IACb;AALmB;AAMnB,SAAK,OAAO;AAAA,EACd;AAAA,EAPqB;AAQvB;;;ADhKA,IAAM,iBAAiB;AACvB,IAAM,gBAAgB;AACtB,IAAM,UAAU,IAAI,IAAY,YAAY;AAU5C,IAAM,eAAe,CAAC,SAAiB,KAAK,MAAM,GAAG,EAAE,KAAK,GAAG;AAE/D,eAAe,kBAAkB,WAAsC;AACrE,QAAM,QAAkB,CAAC;AACzB,QAAM,UAA8B,CAAC;AAErC,mBAAiB,SAAS,SAAS,QAAQ,SAAS,EAAG,SAAQ,KAAK,KAAK;AACzE,UAAQ,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;AAEjE,aAAW,SAAS,SAAS;AAC3B,UAAM,OAAO,QAAQ,WAAW,MAAM,IAAI;AAC1C,QAAI,MAAM,YAAa,OAAM,KAAK,GAAG,MAAM,kBAAkB,IAAI,CAAC;AAClE,QAAI,MAAM,UAAU,MAAM,SAAS,WAAY,OAAM,KAAK,IAAI;AAAA,EAChE;AAEA,SAAO;AACT;AAEA,SAAS,mBACP,SACA,MAC+B;AAC/B,QAAM,WAAW,aAAa,SAAS,SAAS,QAAQ,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,EACtE,OAAO,OAAO;AACjB,QAAM,gBAA0B,CAAC;AACjC,QAAM,mBAA6B,CAAC;AACpC,QAAM,iBAA2B,CAAC;AAElC,aAAW,WAAW,UAAU;AAC9B,UAAM,QAAQ,QAAQ,MAAM,cAAc;AAC1C,QAAI,CAAC,OAAO;AACV,UAAI,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AAClD,eAAO,eAAe,MAAM,OAAO;AAAA,MACrC;AACA,oBAAc,KAAK,OAAO;AAC1B,uBAAiB,KAAK,OAAO;AAC7B;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,CAAC;AACpB,QAAI,CAAC,cAAc,KAAK,IAAI,EAAG,QAAO,eAAe,MAAM,OAAO;AAClE,QAAI,eAAe,SAAS,IAAI,GAAG;AACjC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,sBAAsB,IAAI;AAAA,QACnC,OAAO,CAAC,aAAa,IAAI,CAAC;AAAA,QAC1B,YAAY;AAAA,MACd;AAAA,IACF;AAEA,mBAAe,KAAK,IAAI;AACxB,kBAAc,KAAK,IAAI,IAAI,EAAE;AAC7B,qBAAiB,KAAK,YAAY;AAAA,EACpC;AAEA,SAAO;AAAA,IACL,MAAM,aAAa,IAAI;AAAA,IACvB;AAAA,IACA,WAAW,IAAI,cAAc,KAAK,GAAG,CAAC;AAAA,IACtC,cAAc,IAAI,iBAAiB,KAAK,GAAG,CAAC;AAAA,IAC5C;AAAA,EACF;AACF;AAEA,SAAS,eAAe,MAAc,SAAoC;AACxE,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,kCAAkC,OAAO;AAAA,IAClD,OAAO,CAAC,aAAa,IAAI,CAAC;AAAA,IAC1B,YACE;AAAA,EACJ;AACF;AAEA,SAAS,eACP,OACA,MACiC;AACjC,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,QAAQ,KAAK;AACpC,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAEA,aAAW,CAAC,QAAQ,SAAS,KAAK,SAAS;AACzC,QAAI,CAAC,QAAQ,IAAI,MAAM,GAAG;AACxB,aAAO,cAAc,KAAK,MAAM,4BAA4B,MAAM,GAAG;AAAA,IACvE;AACA,QAAI,CAAC,YAAY,SAAS,GAAG;AAC3B,aAAO;AAAA,QACL,KAAK;AAAA,QACL,GAAG,MAAM;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,YAAY,OAAyC;AAC5D,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,YAAY;AAClB,SAAO,OAAO,OAAO,WAAW,SAAS,KACvC,OAAO,OAAO,WAAW,UAAU,KACnC,OAAO,OAAO,WAAW,UAAU,KACnC,OAAO,UAAU,YAAY;AACjC;AAEA,SAAS,cAAc,MAAc,SAAoC;AACvE,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,OAAO,CAAC,aAAa,IAAI,CAAC;AAAA,IAC1B,YACE;AAAA,EACJ;AACF;AAEA,SAAS,cAAc,OAAkD;AACvE,QAAM,SAAS,IAAI,QAAQ,OAAO,CAAC,SAAS,KAAK,YAAY;AAC7D,QAAM,cAAmC,CAAC;AAE1C,aAAW,CAAC,OAAO,KAAK,KAAK,QAAQ;AACnC,QAAI,MAAM,SAAS,EAAG;AACtB,gBAAY,KAAK;AAAA,MACf,MAAM;AAAA,MACN,SAAS,6CAA6C,KAAK;AAAA,MAC3D,OAAO,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,KAAK;AAAA,MAC3C;AAAA,MACA,YAAY;AAAA,IACd,CAAC;AAAA,EACH;AAEA,SAAO,YAAY;AAAA,IAAK,CAAC,MAAM,WAC5B,KAAK,SAAS,IAAI,cAAc,MAAM,SAAS,EAAE;AAAA,EACpD;AACF;AAeA,eAAsB,eACpB,SACqC;AACrC,QAAM,OAAO;AAAA,IACX,mBAAmB,MAAM,cAAc,OAAO,IAAI;AAAA,EACpD;AACA,QAAM,cAAmC,CAAC;AAC1C,QAAM,aAA0B,CAAC;AAEjC,aAAW,QAAQ,MAAM,kBAAkB,IAAI,GAAG;AAChD,UAAM,aAAa,mBAAmB,MAAM,IAAI;AAChD,QAAI,UAAU,WAAY,aAAY,KAAK,UAAU;AAAA,QAChD,YAAW,KAAK,UAAU;AAAA,EACjC;AAEA,cAAY,KAAK,GAAG,cAAc,UAAU,CAAC;AAE7C,QAAM,SAA4B,CAAC;AACnC,aAAW,QAAQ,YAAY;AAC7B,QAAI;AACF,YAAM,WAAW,MAAM,OAAO,cAAc,KAAK,IAAI,EAAE;AACvD,YAAM,cAAc,eAAe,SAAS,SAAS,IAAI;AACzD,UAAI,UAAU,aAAa;AACzB,oBAAY,KAAK,WAAW;AAC5B;AAAA,MACF;AAEA,iBAAW,CAAC,QAAQ,SAAS,KAAK,OAAO,QAAQ,WAAW,GAAG;AAC7D,eAAO,KAAK;AAAA,UACV;AAAA,UACA,MAAM,KAAK;AAAA,UACX,QAAQ,KAAK;AAAA,UACb,gBAAgB,KAAK;AAAA,UACrB;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,SAAS,OAAO;AACd,kBAAY,KAAK;AAAA,QACf,KAAK;AAAA,QACL,qCACE,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACvD;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,YAAY,SAAS,GAAG;AAC1B,gBAAY;AAAA,MAAK,CAAC,MAAM,UACtB,GAAG,KAAK,IAAI,IAAI,KAAK,MAAM,KAAK,GAAG,CAAC,GAAG;AAAA,QACrC,GAAG,MAAM,IAAI,IAAI,MAAM,MAAM,KAAK,GAAG,CAAC;AAAA,MACxC;AAAA,IACF;AACA,UAAM,IAAI,oBAAoB,WAAW;AAAA,EAC3C;AAEA,SAAO,OAAO;AAAA,IAAK,CAAC,MAAM,UACxB,KAAK,KAAK,cAAc,MAAM,IAAI,KAClC,KAAK,OAAO,cAAc,MAAM,MAAM;AAAA,EACxC;AACF;;;AE7OA,SAAS,UAAU,MAA6C;AAC9D,MAAI;AACF,WAAO,KAAK,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,IAAI,kBAAkB;AAAA,EAC/D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,WACP,OACA,iBACmB;AACnB,QAAM,gBAAgB,MAAM,KAAK,MAAM,GAAG,EAAE,OAAO,OAAO;AAC1D,MAAI,cAAc,WAAW,gBAAgB,OAAQ,QAAO;AAE5D,QAAM,SAAiC,CAAC;AACxC,WAAS,QAAQ,GAAG,QAAQ,cAAc,QAAQ,SAAS,GAAG;AAC5D,UAAM,WAAW,cAAc,KAAK;AACpC,UAAM,SAAS,gBAAgB,KAAK;AACpC,QAAI,SAAS,WAAW,GAAG,EAAG,QAAO,SAAS,MAAM,CAAC,CAAC,IAAI;AAAA,aACjD,aAAa,OAAQ,QAAO;AAAA,EACvC;AAEA,SAAO,EAAE,OAAO,OAAO;AACzB;AAEA,SAAS,mBAAmB,MAAa,OAAsB;AAC7D,QAAM,eAAe,KAAK,MAAM,KAAK,MAAM,GAAG,EAAE,OAAO,OAAO;AAC9D,QAAM,gBAAgB,MAAM,MAAM,KAAK,MAAM,GAAG,EAAE,OAAO,OAAO;AAEhE,WAAS,QAAQ,GAAG,QAAQ,aAAa,QAAQ,SAAS,GAAG;AAC3D,UAAM,cAAc,aAAa,KAAK,EAAE,WAAW,GAAG;AACtD,UAAM,eAAe,cAAc,KAAK,EAAE,WAAW,GAAG;AACxD,QAAI,gBAAgB,aAAc,QAAO,cAAc,IAAI;AAAA,EAC7D;AAEA,SAAO,KAAK,MAAM,KAAK,cAAc,MAAM,MAAM,IAAI;AACvD;AAEA,SAAS,QACP,QACA,OACA,UACA,SACU;AACV,SAAO,IAAI;AAAA,IACT,KAAK,UAAU,EAAE,MAAM,eAAe,OAAO,QAAQ,SAAS,CAAC;AAAA,IAC/D;AAAA,MACE;AAAA,MACA,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MACL;AAAA,IACF;AAAA,EACF;AACF;AAmBO,SAAS,aACd,QACgD;AAChD,QAAM,YAAY,CAAC,GAAG,MAAM;AAE5B,SAAO;AAAA,IACL,MAAM,MAAM,SAAqC;AAC/C,YAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,YAAM,kBAAkB,UAAU,IAAI,QAAQ;AAC9C,UAAI,CAAC,gBAAiB,QAAO,QAAQ,KAAK,aAAa,IAAI,QAAQ;AAEnE,YAAM,UAAU,UACb,IAAI,CAAC,UAAU,WAAW,OAAO,eAAe,CAAC,EACjD,OAAO,CAAC,UAA0B,UAAU,MAAS,EACrD,KAAK,kBAAkB;AAE1B,UAAI,QAAQ,WAAW,EAAG,QAAO,QAAQ,KAAK,aAAa,IAAI,QAAQ;AAEvE,YAAM,eAAe,QAAQ,CAAC,EAAE,MAAM;AACtC,YAAM,cAAc,QAAQ;AAAA,QAAO,CAAC,UAClC,MAAM,MAAM,SAAS;AAAA,MACvB;AACA,YAAM,SAAS,QAAQ,OAAO,YAAY;AAC1C,YAAM,WAAW,YAAY;AAAA,QAAK,CAAC,UACjC,MAAM,MAAM,WAAW;AAAA,MACzB;AACA,UAAI,CAAC,UAAU;AACb,cAAM,UAAU;AAAA,UACd,GAAG,IAAI,IAAI,YAAY,IAAI,CAAC,UAAU,MAAM,MAAM,MAAM,CAAC;AAAA,QAC3D,EACG,KAAK;AACR,eAAO,QAAQ,KAAK,sBAAsB,IAAI,UAAU;AAAA,UACtD,OAAO,QAAQ,KAAK,IAAI;AAAA,QAC1B,CAAC;AAAA,MACH;AAEA,aAAO,MAAM,SAAS,MAAM,UAAU,QAAQ;AAAA,QAC5C;AAAA,QACA,QAAQ,SAAS;AAAA,QACjB,OAAO,OAAO,OAAO,CAAC,CAAC;AAAA,QACvB,SAAS,OAAO,OAAO,CAAC,CAAC;AAAA,QACzB,MAAM;AAAA,QACN,QAAQ,QAAQ;AAAA,QAChB,WAAW;AAAA,QACX,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["resolve"]}

package/dist/cli.d.ts

@@ -307,7 +307,7 @@ interface CliDependencies {
  */
 
 /** Version of the CLI, reported by `hollow --version`. */
-declare const VERSION = "0.3.2";
+declare const VERSION = "0.3.3";
 /**
  * Runs one CLI invocation against caller-supplied I/O.
  *

package/dist/cli.js

@@ -1,22 +1,22 @@
 #!/usr/bin/env node
 import {
   resolveConfiguration
-} from "./chunk-BJONRVDG.js";
+} from "./chunk-4PPSJ2LE.js";
 import {
   createTraceabilityReport,
   selectAffectedTests
-} from "./chunk-D4U3ZY4O.js";
+} from "./chunk-M4D63YC7.js";
 import "./chunk-BAKXP7IR.js";
 import {
   composeProjectSecurity
-} from "./chunk-DGTHFZPZ.js";
+} from "./chunk-LZ2HLHDW.js";
 import {
   normalizeRoutes
-} from "./chunk-CAPFDC25.js";
+} from "./chunk-JRFHLLLF.js";
 import {
   discoverRoutes,
   platform
-} from "./chunk-53TZY5YP.js";
+} from "./chunk-S3Z6CO7J.js";
 import "./chunk-LNJDFJGT.js";
 import "./chunk-5WRI5ZAA.js";
 
@@ -1006,7 +1006,7 @@ var CreationError = class extends Error {
 };
 
 // cli/create/create.ts
-var VERSION = "0.3.2";
+var VERSION = "0.3.3";
 var NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
 function files(name) {
   return {
@@ -1090,7 +1090,33 @@ test("capture artifact is persisted", async () => { await persist(); });
         engines: { node: ">=24" },
         scripts: { check: "tsc --noEmit", test: "vitest run", verify: "npm run check && npm run test && node .sleepyhollow/verify.ts" },
         dependencies: { "@sleepy-hollow/framework": `^${FRAMEWORK_VERSION}` },
-        devDependencies: { typescript: "5.9.3", vitest: "4.1.11" }
+        devDependencies: { "@types/node": "26.2.0", typescript: "5.9.3", vitest: "4.1.11" }
+      },
+      null,
+      2
+    ) + "\n",
+    "tsconfig.json": JSON.stringify(
+      {
+        compilerOptions: {
+          target: "ES2024",
+          module: "NodeNext",
+          moduleResolution: "NodeNext",
+          strict: true,
+          noEmit: true,
+          allowImportingTsExtensions: true,
+          verbatimModuleSyntax: true,
+          skipLibCheck: true,
+          types: ["node", "vitest/globals"]
+        },
+        include: [
+          ".sleepyhollow/**/*.ts",
+          "api/**/*.ts",
+          "models/**/*.ts",
+          "tests/**/*.ts",
+          "sleepyhollow.config.ts",
+          "vitest.config.ts"
+        ],
+        exclude: ["generated", "node_modules"]
       },
       null,
       2
@@ -1102,15 +1128,20 @@ export default defineConfig({ test: { globals: true, include: ["**/*_test.ts", "
     "generated/.gitkeep": "",
     "models/.gitkeep": "",
     "requirements/application.req.md": `---
-schema: sleepy-hollow-application/v0.1
+schema: sgad-application/v0.2
+id: ${name}-application
 title: ${name}
 status: draft
+risk: standard
+depends_on: []
+owners:
+  - application owner
 ---
 
 # Application requirements
 
-Use the official Sleepy Hollow skill to plan actors, behavior, data, security,
-operations, and acceptance criteria before generating endpoints.
+Use the official Sleepy Hollow skill to replace this planning placeholder with
+the complete application requirements before generating endpoints.
 `,
     "sleepyhollow.config.ts": `import { defineProject } from "./.sleepyhollow/project.ts";
 
@@ -1142,7 +1173,7 @@ async function pathExists(path) {
     throw error;
   }
 }
-var FRAMEWORK_VERSION = "0.3.2";
+var FRAMEWORK_VERSION = "0.3.3";
 async function createProject(options) {
   if (!NAME.test(options.name) || options.name.length > 64) {
     throw creationError(
@@ -2880,7 +2911,7 @@ function renderArtifacts(inventory2) {
   ];
   const manifestContent = canonicalJson({
     schema: "sleepy-hollow-generated-manifest/v1",
-    generatorVersion: "0.3.2",
+    generatorVersion: "0.3.3",
     serviceId: normalized.serviceId,
     inputDigest: digest2(input),
     artifacts: Object.fromEntries(
@@ -3154,7 +3185,7 @@ function inventoryFromRoutes(routes2, options) {
   return {
     serviceId: options.serviceId,
     title: options.title ?? options.serviceId,
-    version: options.version ?? "0.3.2",
+    version: options.version ?? "0.3.3",
     ...options.description ? { description: options.description } : {},
     operations,
     securitySchemes: options.securitySchemes ?? {}
@@ -4008,7 +4039,7 @@ var CLI_COMMANDS = [
   "generate",
   "deploy"
 ];
-var CLI_VERSION = "0.3.2";
+var CLI_VERSION = "0.3.3";
 var commandMetadata = {
   create: {
     description: "Create one deterministic Sleepy Hollow project.",
@@ -5578,7 +5609,8 @@ function declaredStatuses(schemas) {
 function authenticationOf(security2) {
   if (typeof security2 !== "object" || security2 === null) return "none";
   const declared = security2.authentication;
-  return declared === "required" ? "required" : "none";
+  if (typeof declared !== "object" || declared === null) return "none";
+  return declared.mode === "required" ? "required" : "none";
 }
 async function routes(project, artifact2) {
   const roots = project.services.length > 0 ? project.services.map((service) => ({