@terreno/api 0.11.9 → 0.12.1

package/dist/__tests__/openApiCompat.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/openApiCompat.test.js

@@ -0,0 +1,311 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __values = (this && this.__values) || function(o) {
+    var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
+    if (m) return m.call(o);
+    if (o && typeof o.length === "number") return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
+        }
+    };
+    throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var bun_test_1 = require("bun:test");
+var express_1 = __importDefault(require("express"));
+var supertest_1 = __importDefault(require("supertest"));
+var openApiCompat_1 = require("../openApiCompat");
+var getRouterStack = function (app) {
+    var _a;
+    var internal = app;
+    var router = (_a = internal._router) !== null && _a !== void 0 ? _a : internal.router;
+    if (!router) {
+        throw new Error("Express app has no router");
+    }
+    return router.stack;
+};
+var findLayer = function (stack, predicate) {
+    var e_1, _a;
+    var _b, _c;
+    try {
+        for (var stack_1 = __values(stack), stack_1_1 = stack_1.next(); !stack_1_1.done; stack_1_1 = stack_1.next()) {
+            var layer = stack_1_1.value;
+            if (predicate(layer)) {
+                return layer;
+            }
+            if ((_b = layer.handle) === null || _b === void 0 ? void 0 : _b.stack) {
+                var nested = findLayer(layer.handle.stack, predicate);
+                if (nested) {
+                    return nested;
+                }
+            }
+            if ((_c = layer.route) === null || _c === void 0 ? void 0 : _c.stack) {
+                var nested = findLayer(layer.route.stack, predicate);
+                if (nested) {
+                    return nested;
+                }
+            }
+        }
+    }
+    catch (e_1_1) { e_1 = { error: e_1_1 }; }
+    finally {
+        try {
+            if (stack_1_1 && !stack_1_1.done && (_a = stack_1.return)) _a.call(stack_1);
+        }
+        finally { if (e_1) throw e_1.error; }
+    }
+    return undefined;
+};
+var runMiddleware = function (app) {
+    var middlewareReq = { app: app };
+    var middlewareRes = {};
+    var called = false;
+    (0, openApiCompat_1.openApiCompatMiddleware)(middlewareReq, middlewareRes, function () {
+        called = true;
+    });
+    if (!called) {
+        throw new Error("next() was not called by openApiCompatMiddleware");
+    }
+};
+(0, bun_test_1.describe)("openApiCompat", function () {
+    (0, bun_test_1.describe)("patchAppUse", function () {
+        (0, bun_test_1.it)("annotates layers added via app.use(mountPath, ...) with the mount path", function () {
+            var app = (0, express_1.default)();
+            (0, openApiCompat_1.patchAppUse)(app);
+            var subRouter = express_1.default.Router();
+            subRouter.get("/list", function (_req, res) {
+                res.json({ ok: true });
+            });
+            app.use("/sub", subRouter);
+            var stack = getRouterStack(app);
+            var mountedLayer = stack.find(function (layer) { return layer.__openApiMountPath !== undefined; });
+            (0, bun_test_1.expect)(mountedLayer).toBeDefined();
+            (0, bun_test_1.expect)(mountedLayer === null || mountedLayer === void 0 ? void 0 : mountedLayer.__openApiMountPath).toBe("/sub");
+        });
+        (0, bun_test_1.it)("strips trailing slashes from the recorded mount path", function () {
+            var app = (0, express_1.default)();
+            (0, openApiCompat_1.patchAppUse)(app);
+            var subRouter = express_1.default.Router();
+            subRouter.get("/", function (_req, res) {
+                res.send("ok");
+            });
+            app.use("/api/v1///", subRouter);
+            var stack = getRouterStack(app);
+            var mountedLayer = stack.find(function (layer) { return layer.__openApiMountPath !== undefined; });
+            (0, bun_test_1.expect)(mountedLayer === null || mountedLayer === void 0 ? void 0 : mountedLayer.__openApiMountPath).toBe("/api/v1");
+        });
+        (0, bun_test_1.it)("does not annotate layers when mount path is missing or '/'", function () {
+            var e_2, _a;
+            var app = (0, express_1.default)();
+            (0, openApiCompat_1.patchAppUse)(app);
+            app.use(function (_req, _res, next) { return next(); });
+            var subRouter = express_1.default.Router();
+            subRouter.get("/x", function (_req, res) { return res.send("x"); });
+            app.use("/", subRouter);
+            var stack = getRouterStack(app);
+            try {
+                for (var stack_2 = __values(stack), stack_2_1 = stack_2.next(); !stack_2_1.done; stack_2_1 = stack_2.next()) {
+                    var layer = stack_2_1.value;
+                    (0, bun_test_1.expect)(layer.__openApiMountPath).toBeUndefined();
+                }
+            }
+            catch (e_2_1) { e_2 = { error: e_2_1 }; }
+            finally {
+                try {
+                    if (stack_2_1 && !stack_2_1.done && (_a = stack_2.return)) _a.call(stack_2);
+                }
+                finally { if (e_2) throw e_2.error; }
+            }
+        });
+        (0, bun_test_1.it)("returns the underlying use() return value", function () {
+            var app = (0, express_1.default)();
+            (0, openApiCompat_1.patchAppUse)(app);
+            var result = app.use(function (_req, _res, next) { return next(); });
+            (0, bun_test_1.expect)(result).toBe(app);
+        });
+    });
+    (0, bun_test_1.describe)("openApiCompatMiddleware", function () {
+        (0, bun_test_1.it)("calls next() and is a no-op when the app has no router yet", function () {
+            var fakeReq = { app: {} };
+            var fakeRes = {};
+            var nextCalled = false;
+            (0, openApiCompat_1.openApiCompatMiddleware)(fakeReq, fakeRes, function () {
+                nextCalled = true;
+            });
+            (0, bun_test_1.expect)(nextCalled).toBe(true);
+        });
+        (0, bun_test_1.it)("sets fast_slash regexp on layers that use Express 5 .slash", function () {
+            var app = (0, express_1.default)();
+            (0, openApiCompat_1.patchAppUse)(app);
+            app.use(function (_req, _res, next) { return next(); });
+            var stack = getRouterStack(app);
+            var slashLayer = stack.find(function (layer) { return layer.slash === true; });
+            (0, bun_test_1.expect)(slashLayer).toBeDefined();
+            runMiddleware(app);
+            var patchedRegexp = slashLayer === null || slashLayer === void 0 ? void 0 : slashLayer.regexp;
+            (0, bun_test_1.expect)(patchedRegexp === null || patchedRegexp === void 0 ? void 0 : patchedRegexp.fast_slash).toBe(true);
+        });
+        (0, bun_test_1.it)("builds a regexp for sub-routers mounted at a non-root path", function () {
+            var app = (0, express_1.default)();
+            (0, openApiCompat_1.patchAppUse)(app);
+            var subRouter = express_1.default.Router();
+            subRouter.get("/foo", function (_req, res) { return res.send("foo"); });
+            app.use("/sub", subRouter);
+            runMiddleware(app);
+            var stack = getRouterStack(app);
+            var subLayer = stack.find(function (layer) { return layer.__openApiMountPath === "/sub"; });
+            (0, bun_test_1.expect)(subLayer).toBeDefined();
+            var regexp = subLayer === null || subLayer === void 0 ? void 0 : subLayer.regexp;
+            (0, bun_test_1.expect)(regexp).toBeInstanceOf(RegExp);
+            (0, bun_test_1.expect)(regexp.test("/sub/foo")).toBe(true);
+        });
+        (0, bun_test_1.it)("builds a regexp from layer.path and extracts :param keys", function () {
+            var app = (0, express_1.default)();
+            (0, openApiCompat_1.patchAppUse)(app);
+            var stack = getRouterStack(app);
+            stack.push({
+                name: "boundDispatch",
+                path: "/users/:userId",
+            });
+            runMiddleware(app);
+            var inserted = stack[stack.length - 1];
+            (0, bun_test_1.expect)(inserted.regexp).toBeInstanceOf(RegExp);
+            (0, bun_test_1.expect)(inserted.regexp.test("/users/abc")).toBe(true);
+            (0, bun_test_1.expect)(inserted.keys).toEqual([{ name: "userId", optional: false }]);
+        });
+        (0, bun_test_1.it)("builds a regexp from route.path for plain route layers", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var app, stack, routeLayer, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        app = (0, express_1.default)();
+                        (0, openApiCompat_1.patchAppUse)(app);
+                        app.get("/items/:itemId", function (_req, res) {
+                            res.json({ ok: true });
+                        });
+                        runMiddleware(app);
+                        stack = getRouterStack(app);
+                        routeLayer = findLayer(stack, function (layer) { var _a; return ((_a = layer.route) === null || _a === void 0 ? void 0 : _a.path) === "/items/:itemId"; });
+                        (0, bun_test_1.expect)(routeLayer).toBeDefined();
+                        (0, bun_test_1.expect)(routeLayer === null || routeLayer === void 0 ? void 0 : routeLayer.regexp).toBeInstanceOf(RegExp);
+                        (0, bun_test_1.expect)((routeLayer === null || routeLayer === void 0 ? void 0 : routeLayer.regexp).test("/items/123")).toBe(true);
+                        (0, bun_test_1.expect)(routeLayer === null || routeLayer === void 0 ? void 0 : routeLayer.keys).toEqual([{ name: "itemId", optional: false }]);
+                        return [4 /*yield*/, (0, supertest_1.default)(app).get("/items/123").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body).toEqual({ ok: true });
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("falls back to /^\\/?$/ when no path information is available", function () {
+            var app = (0, express_1.default)();
+            (0, openApiCompat_1.patchAppUse)(app);
+            var stack = getRouterStack(app);
+            stack.push({ name: "anonymous" });
+            runMiddleware(app);
+            var inserted = stack[stack.length - 1];
+            (0, bun_test_1.expect)(inserted.regexp).toBeInstanceOf(RegExp);
+            (0, bun_test_1.expect)(inserted.regexp.source).toBe("^\\/?$");
+            (0, bun_test_1.expect)(inserted.keys).toEqual([]);
+        });
+        (0, bun_test_1.it)("skips layers that already have a regexp set", function () {
+            var app = (0, express_1.default)();
+            (0, openApiCompat_1.patchAppUse)(app);
+            var stack = getRouterStack(app);
+            var existing = /^prebuilt$/;
+            stack.push({
+                name: "preset",
+                path: "/should-be-ignored/:id",
+                regexp: existing,
+            });
+            runMiddleware(app);
+            var inserted = stack[stack.length - 1];
+            (0, bun_test_1.expect)(inserted.regexp).toBe(existing);
+            (0, bun_test_1.expect)(inserted.keys).toBeUndefined();
+        });
+        (0, bun_test_1.it)("converts Express 5 string keys arrays into {name, optional} objects", function () {
+            var app = (0, express_1.default)();
+            (0, openApiCompat_1.patchAppUse)(app);
+            var stack = getRouterStack(app);
+            stack.push({
+                keys: ["userId", "postId"],
+                name: "boundDispatch",
+                path: "/users/:userId/posts/:postId",
+            });
+            runMiddleware(app);
+            var inserted = stack[stack.length - 1];
+            (0, bun_test_1.expect)(inserted.keys).toEqual([
+                { name: "userId", optional: false },
+                { name: "postId", optional: false },
+            ]);
+        });
+        (0, bun_test_1.it)("recurses into nested router stacks added via patchAppUse", function () {
+            var app = (0, express_1.default)();
+            (0, openApiCompat_1.patchAppUse)(app);
+            var inner = express_1.default.Router();
+            inner.get("/widgets/:widgetId", function (_req, res) { return res.send("widget"); });
+            app.use("/api", inner);
+            runMiddleware(app);
+            var stack = getRouterStack(app);
+            var widgetLayer = findLayer(stack, function (layer) { var _a; return ((_a = layer.route) === null || _a === void 0 ? void 0 : _a.path) === "/widgets/:widgetId"; });
+            (0, bun_test_1.expect)(widgetLayer).toBeDefined();
+            (0, bun_test_1.expect)(widgetLayer === null || widgetLayer === void 0 ? void 0 : widgetLayer.regexp).toBeInstanceOf(RegExp);
+            (0, bun_test_1.expect)((widgetLayer === null || widgetLayer === void 0 ? void 0 : widgetLayer.regexp).test("/widgets/42")).toBe(true);
+            (0, bun_test_1.expect)(widgetLayer === null || widgetLayer === void 0 ? void 0 : widgetLayer.keys).toEqual([{ name: "widgetId", optional: false }]);
+        });
+        (0, bun_test_1.it)("escapes regex metacharacters in static path segments", function () {
+            var app = (0, express_1.default)();
+            (0, openApiCompat_1.patchAppUse)(app);
+            var stack = getRouterStack(app);
+            stack.push({
+                name: "boundDispatch",
+                path: "/foo.bar/baz",
+            });
+            runMiddleware(app);
+            var inserted = stack[stack.length - 1];
+            var regexp = inserted.regexp;
+            (0, bun_test_1.expect)(regexp.test("/foo.bar/baz")).toBe(true);
+            (0, bun_test_1.expect)(regexp.test("/fooXbar/baz")).toBe(false);
+        });
+    });
+});

package/dist/githubAuth.js

@@ -40,6 +40,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.addGitHubAuthRoutes = exports.setupGitHubAuth = exports.githubUserPlugin = void 0;
+var express_1 = require("express");
 var passport_1 = __importDefault(require("passport"));
 var passport_github2_1 = require("passport-github2");
 var auth_1 = require("./auth");
@@ -178,7 +179,7 @@ exports.setupGitHubAuth = setupGitHubAuth;
  * - DELETE /auth/github/unlink - Unlinks GitHub account from authenticated user (requires JWT auth)
  */
 var addGitHubAuthRoutes = function (app, userModel, githubOptions, authOptions) {
-    var router = require("express").Router();
+    var router = (0, express_1.Router)();
     // Initiate GitHub OAuth flow
     router.get("/github", function (req, _res, next) {
         // Store the return URL in session or query for redirect after auth

package/dist/openApiCompat.d.ts

@@ -8,6 +8,7 @@
  *
  * @see https://github.com/wesleytodd/express-openapi/issues/70
  */
+import type { Application, NextFunction, Request, Response } from "express";
 /**
  * Wraps an Express app's `use` method to record the mount path on each
  * layer added to the router stack. This runs at setup time so that
@@ -15,9 +16,9 @@
  *
  * Must be called before any routes are registered.
  */
-export declare const patchAppUse: (app: any) => void;
+export declare const patchAppUse: (app: Application) => void;
 /**
  * Express middleware that patches the router stack before OpenAPI doc
  * generation. Must be mounted before the openapi middleware.
  */
-export declare const openApiCompatMiddleware: (req: any, _res: any, next: () => void) => void;
+export declare const openApiCompatMiddleware: (req: Request, _res: Response, next: NextFunction) => void;

package/dist/openApiCompat.js

@@ -1,14 +1,4 @@
 "use strict";
-/**
- * Patches the Express router stack to add `.regexp` on layers for
- * compatibility with @wesleytodd/openapi, which expects Express 4-style
- * layers with `.regexp.fast_slash`.
- *
- * In Express 5 (router@2.x), layers use `.slash` (boolean) and `.matchers`
- * (array of functions) instead of `.regexp`.
- *
- * @see https://github.com/wesleytodd/express-openapi/issues/70
- */
 var __values = (this && this.__values) || function(o) {
     var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
     if (m) return m.call(o);
@@ -157,19 +147,20 @@ var patchRouterStack = function (stack) {
  * Must be called before any routes are registered.
  */
 var patchAppUse = function (app) {
+    var internal = app;
     var originalUse = app.use.bind(app);
     var patchedUse = function () {
-        var _a, _b;
+        var _a, _b, _c, _d;
         var args = [];
         for (var _i = 0; _i < arguments.length; _i++) {
             args[_i] = arguments[_i];
         }
         // Track stack length before the call
-        var router = app._router || app.router;
-        var stackBefore = (_b = (_a = router === null || router === void 0 ? void 0 : router.stack) === null || _a === void 0 ? void 0 : _a.length) !== null && _b !== void 0 ? _b : 0;
+        var router = (_a = internal._router) !== null && _a !== void 0 ? _a : internal.router;
+        var stackBefore = (_c = (_b = router === null || router === void 0 ? void 0 : router.stack) === null || _b === void 0 ? void 0 : _b.length) !== null && _c !== void 0 ? _c : 0;
         var result = originalUse.apply(void 0, __spreadArray([], __read(args), false));
         // After use(), check if new layers were added and annotate them
-        var routerAfter = app._router || app.router;
+        var routerAfter = (_d = internal._router) !== null && _d !== void 0 ? _d : internal.router;
         if (routerAfter === null || routerAfter === void 0 ? void 0 : routerAfter.stack) {
             var stackAfter = routerAfter.stack.length;
             // The first arg is the mount path if it's a string
@@ -190,7 +181,9 @@ exports.patchAppUse = patchAppUse;
  * generation. Must be mounted before the openapi middleware.
  */
 var openApiCompatMiddleware = function (req, _res, next) {
-    var router = req.app._router || req.app.router;
+    var _a;
+    var internal = req.app;
+    var router = (_a = internal._router) !== null && _a !== void 0 ? _a : internal.router;
     if (router === null || router === void 0 ? void 0 : router.stack) {
         patchRouterStack(router.stack);
     }

package/dist/transformers.js

@@ -197,6 +197,7 @@ function serialize(req, options, data) {
  */
 function defaultResponseHandler(doc, method, request, options) {
     return __awaiter(this, void 0, void 0, function () {
+        var errorObj;
         return __generator(this, function (_a) {
             if (!doc) {
                 return [2 /*return*/, null];
@@ -205,10 +206,11 @@ function defaultResponseHandler(doc, method, request, options) {
                 return [2 /*return*/, serialize(request, options, doc)];
             }
             catch (error) {
+                errorObj = error;
                 throw new errors_1.APIError({
-                    error: error,
+                    error: errorObj,
                     status: 400,
-                    title: "Error serializing ".concat(method, " response: ").concat(error.message),
+                    title: "Error serializing ".concat(method, " response: ").concat(errorObj.message),
                 });
             }
             return [2 /*return*/];

package/package.json

@@ -104,5 +104,5 @@
     "updateSnapshot": "bun test --update-snapshots"
   },
   "types": "dist/index.d.ts",
-  "version": "0.11.9"
+  "version": "0.12.1"
 }

package/src/__tests__/openApiCompat.test.ts

@@ -0,0 +1,299 @@
+import {describe, expect, it} from "bun:test";
+import express, {type Application, type Request, type Response} from "express";
+import supertest from "supertest";
+
+import {openApiCompatMiddleware, patchAppUse} from "../openApiCompat";
+
+interface PatchedLayer {
+  name?: string;
+  regexp?: {fast_slash?: boolean} | RegExp;
+  slash?: boolean;
+  path?: string;
+  route?: {path?: string; stack?: PatchedLayer[]};
+  handle?: {stack?: PatchedLayer[]};
+  keys?: Array<{name: string; optional: boolean}> | string[];
+  __openApiMountPath?: string;
+}
+
+interface AppWithRouter {
+  _router?: {stack: PatchedLayer[]};
+  router?: {stack: PatchedLayer[]};
+}
+
+const getRouterStack = (app: Application): PatchedLayer[] => {
+  const internal = app as unknown as AppWithRouter;
+  const router = internal._router ?? internal.router;
+  if (!router) {
+    throw new Error("Express app has no router");
+  }
+  return router.stack as PatchedLayer[];
+};
+
+const findLayer = (
+  stack: PatchedLayer[],
+  predicate: (layer: PatchedLayer) => boolean
+): PatchedLayer | undefined => {
+  for (const layer of stack) {
+    if (predicate(layer)) {
+      return layer;
+    }
+    if (layer.handle?.stack) {
+      const nested = findLayer(layer.handle.stack, predicate);
+      if (nested) {
+        return nested;
+      }
+    }
+    if (layer.route?.stack) {
+      const nested = findLayer(layer.route.stack, predicate);
+      if (nested) {
+        return nested;
+      }
+    }
+  }
+  return undefined;
+};
+
+const runMiddleware = (app: Application): void => {
+  const middlewareReq = {app} as unknown as Request;
+  const middlewareRes = {} as Response;
+  let called = false;
+  openApiCompatMiddleware(middlewareReq, middlewareRes, () => {
+    called = true;
+  });
+  if (!called) {
+    throw new Error("next() was not called by openApiCompatMiddleware");
+  }
+};
+
+describe("openApiCompat", () => {
+  describe("patchAppUse", () => {
+    it("annotates layers added via app.use(mountPath, ...) with the mount path", () => {
+      const app = express();
+      patchAppUse(app);
+
+      const subRouter = express.Router();
+      subRouter.get("/list", (_req, res) => {
+        res.json({ok: true});
+      });
+      app.use("/sub", subRouter);
+
+      const stack = getRouterStack(app);
+      const mountedLayer = stack.find((layer) => layer.__openApiMountPath !== undefined) as
+        | PatchedLayer
+        | undefined;
+      expect(mountedLayer).toBeDefined();
+      expect(mountedLayer?.__openApiMountPath).toBe("/sub");
+    });
+
+    it("strips trailing slashes from the recorded mount path", () => {
+      const app = express();
+      patchAppUse(app);
+
+      const subRouter = express.Router();
+      subRouter.get("/", (_req, res) => {
+        res.send("ok");
+      });
+      app.use("/api/v1///", subRouter);
+
+      const stack = getRouterStack(app);
+      const mountedLayer = stack.find((layer) => layer.__openApiMountPath !== undefined) as
+        | PatchedLayer
+        | undefined;
+      expect(mountedLayer?.__openApiMountPath).toBe("/api/v1");
+    });
+
+    it("does not annotate layers when mount path is missing or '/'", () => {
+      const app = express();
+      patchAppUse(app);
+
+      app.use((_req, _res, next) => next());
+
+      const subRouter = express.Router();
+      subRouter.get("/x", (_req, res) => res.send("x"));
+      app.use("/", subRouter);
+
+      const stack = getRouterStack(app);
+      for (const layer of stack) {
+        expect(layer.__openApiMountPath).toBeUndefined();
+      }
+    });
+
+    it("returns the underlying use() return value", () => {
+      const app = express();
+      patchAppUse(app);
+      const result = app.use((_req, _res, next) => next());
+      expect(result).toBe(app);
+    });
+  });
+
+  describe("openApiCompatMiddleware", () => {
+    it("calls next() and is a no-op when the app has no router yet", () => {
+      const fakeReq = {app: {}} as unknown as Request;
+      const fakeRes = {} as Response;
+      let nextCalled = false;
+      openApiCompatMiddleware(fakeReq, fakeRes, () => {
+        nextCalled = true;
+      });
+      expect(nextCalled).toBe(true);
+    });
+
+    it("sets fast_slash regexp on layers that use Express 5 .slash", () => {
+      const app = express();
+      patchAppUse(app);
+      app.use((_req, _res, next) => next());
+
+      const stack = getRouterStack(app);
+      const slashLayer = stack.find((layer) => layer.slash === true) as PatchedLayer | undefined;
+      expect(slashLayer).toBeDefined();
+
+      runMiddleware(app);
+
+      const patchedRegexp = slashLayer?.regexp as {fast_slash?: boolean} | undefined;
+      expect(patchedRegexp?.fast_slash).toBe(true);
+    });
+
+    it("builds a regexp for sub-routers mounted at a non-root path", () => {
+      const app = express();
+      patchAppUse(app);
+
+      const subRouter = express.Router();
+      subRouter.get("/foo", (_req, res) => res.send("foo"));
+      app.use("/sub", subRouter);
+
+      runMiddleware(app);
+
+      const stack = getRouterStack(app);
+      const subLayer = stack.find((layer) => layer.__openApiMountPath === "/sub") as
+        | PatchedLayer
+        | undefined;
+      expect(subLayer).toBeDefined();
+      const regexp = subLayer?.regexp as RegExp;
+      expect(regexp).toBeInstanceOf(RegExp);
+      expect(regexp.test("/sub/foo")).toBe(true);
+    });
+
+    it("builds a regexp from layer.path and extracts :param keys", () => {
+      const app = express();
+      patchAppUse(app);
+
+      const stack = getRouterStack(app);
+      stack.push({
+        name: "boundDispatch",
+        path: "/users/:userId",
+      } as PatchedLayer);
+
+      runMiddleware(app);
+
+      const inserted = stack[stack.length - 1];
+      expect(inserted.regexp).toBeInstanceOf(RegExp);
+      expect((inserted.regexp as RegExp).test("/users/abc")).toBe(true);
+      expect(inserted.keys).toEqual([{name: "userId", optional: false}]);
+    });
+
+    it("builds a regexp from route.path for plain route layers", async () => {
+      const app = express();
+      patchAppUse(app);
+      app.get("/items/:itemId", (_req, res) => {
+        res.json({ok: true});
+      });
+
+      runMiddleware(app);
+
+      const stack = getRouterStack(app);
+      const routeLayer = findLayer(stack, (layer) => layer.route?.path === "/items/:itemId");
+      expect(routeLayer).toBeDefined();
+      expect(routeLayer?.regexp).toBeInstanceOf(RegExp);
+      expect((routeLayer?.regexp as RegExp).test("/items/123")).toBe(true);
+      expect(routeLayer?.keys).toEqual([{name: "itemId", optional: false}]);
+
+      const res = await supertest(app).get("/items/123").expect(200);
+      expect(res.body).toEqual({ok: true});
+    });
+
+    it("falls back to /^\\/?$/ when no path information is available", () => {
+      const app = express();
+      patchAppUse(app);
+      const stack = getRouterStack(app);
+      stack.push({name: "anonymous"} as PatchedLayer);
+
+      runMiddleware(app);
+
+      const inserted = stack[stack.length - 1];
+      expect(inserted.regexp).toBeInstanceOf(RegExp);
+      expect((inserted.regexp as RegExp).source).toBe("^\\/?$");
+      expect(inserted.keys).toEqual([]);
+    });
+
+    it("skips layers that already have a regexp set", () => {
+      const app = express();
+      patchAppUse(app);
+      const stack = getRouterStack(app);
+      const existing = /^prebuilt$/;
+      stack.push({
+        name: "preset",
+        path: "/should-be-ignored/:id",
+        regexp: existing,
+      } as PatchedLayer);
+
+      runMiddleware(app);
+
+      const inserted = stack[stack.length - 1];
+      expect(inserted.regexp).toBe(existing);
+      expect(inserted.keys).toBeUndefined();
+    });
+
+    it("converts Express 5 string keys arrays into {name, optional} objects", () => {
+      const app = express();
+      patchAppUse(app);
+      const stack = getRouterStack(app);
+      stack.push({
+        keys: ["userId", "postId"],
+        name: "boundDispatch",
+        path: "/users/:userId/posts/:postId",
+      } as PatchedLayer);
+
+      runMiddleware(app);
+
+      const inserted = stack[stack.length - 1];
+      expect(inserted.keys).toEqual([
+        {name: "userId", optional: false},
+        {name: "postId", optional: false},
+      ]);
+    });
+
+    it("recurses into nested router stacks added via patchAppUse", () => {
+      const app = express();
+      patchAppUse(app);
+
+      const inner = express.Router();
+      inner.get("/widgets/:widgetId", (_req, res) => res.send("widget"));
+      app.use("/api", inner);
+
+      runMiddleware(app);
+
+      const stack = getRouterStack(app);
+      const widgetLayer = findLayer(stack, (layer) => layer.route?.path === "/widgets/:widgetId");
+      expect(widgetLayer).toBeDefined();
+      expect(widgetLayer?.regexp).toBeInstanceOf(RegExp);
+      expect((widgetLayer?.regexp as RegExp).test("/widgets/42")).toBe(true);
+      expect(widgetLayer?.keys).toEqual([{name: "widgetId", optional: false}]);
+    });
+
+    it("escapes regex metacharacters in static path segments", () => {
+      const app = express();
+      patchAppUse(app);
+      const stack = getRouterStack(app);
+      stack.push({
+        name: "boundDispatch",
+        path: "/foo.bar/baz",
+      } as PatchedLayer);
+
+      runMiddleware(app);
+
+      const inserted = stack[stack.length - 1];
+      const regexp = inserted.regexp as RegExp;
+      expect(regexp.test("/foo.bar/baz")).toBe(true);
+      expect(regexp.test("/fooXbar/baz")).toBe(false);
+    });
+  });
+});

package/src/githubAuth.ts

@@ -1,4 +1,5 @@
 import type express from "express";
+import {Router} from "express";
 import passport from "passport";
 import {Strategy as GitHubStrategy, type Profile} from "passport-github2";
 import {generateTokens, type UserModel} from "./auth";
@@ -213,7 +214,7 @@ export const addGitHubAuthRoutes = (
   githubOptions: GitHubAuthOptions,
   authOptions?: AuthOptions
 ): void => {
-  const router = require("express").Router();
+  const router = Router();
 
   // Initiate GitHub OAuth flow
   router.get(

package/src/openApiCompat.ts

@@ -8,16 +8,38 @@
  *
  * @see https://github.com/wesleytodd/express-openapi/issues/70
  */
+import type {Application, NextFunction, Request, Response} from "express";
 
 const MOUNT_PATH_KEY = "__openApiMountPath";
 
+interface ExpressKey {
+  name: string;
+  optional: boolean;
+}
+
+interface PatchedLayer {
+  name?: string;
+  regexp?: {fast_slash?: boolean} | RegExp;
+  slash?: boolean;
+  path?: string;
+  route?: {path?: string; stack?: PatchedLayer[]};
+  handle?: {stack?: PatchedLayer[]};
+  keys?: ExpressKey[] | string[];
+  [MOUNT_PATH_KEY]?: string;
+}
+
+interface AppWithRouter {
+  _router?: {stack: PatchedLayer[]};
+  router?: {stack: PatchedLayer[]};
+}
+
 /**
  * Extract Express 4-style keys from a path string.
  * Parses `:paramName` and `*paramName` segments into `{name, optional}` objects
  * that @wesleytodd/openapi expects.
  */
-const extractKeysFromPath = (path: string): Array<{name: string; optional: boolean}> => {
-  const keys: Array<{name: string; optional: boolean}> = [];
+const extractKeysFromPath = (path: string): ExpressKey[] => {
+  const keys: ExpressKey[] = [];
   const paramRegex = /[:*](\w+)\??/g;
   let match: RegExpExecArray | null;
   // biome-ignore lint/suspicious/noAssignInExpressions: standard regex exec loop
@@ -52,7 +74,7 @@ const buildRegexpForPath = (pathStr: string, isMount: boolean): RegExp => {
   return new RegExp(`^${pattern}\\/?$`);
 };
 
-const patchRouterStack = (stack: any[]): void => {
+const patchRouterStack = (stack: PatchedLayer[]): void => {
   for (const layer of stack) {
     if (layer.regexp !== undefined) {
       continue;
@@ -66,13 +88,13 @@ const patchRouterStack = (stack: any[]): void => {
       // Express 5 layers use .slash instead of .regexp.fast_slash
       layer.regexp = {fast_slash: true};
     } else if (layer[MOUNT_PATH_KEY]) {
-      pathStr = layer[MOUNT_PATH_KEY] as string;
+      pathStr = layer[MOUNT_PATH_KEY];
       layer.regexp = buildRegexpForPath(pathStr, isMount);
     } else if (layer.path && typeof layer.path === "string") {
-      pathStr = layer.path as string;
+      pathStr = layer.path;
       layer.regexp = buildRegexpForPath(pathStr, false);
     } else if (layer.route?.path && typeof layer.route.path === "string") {
-      pathStr = layer.route.path as string;
+      pathStr = layer.route.path;
       layer.regexp = buildRegexpForPath(pathStr, false);
     } else {
       layer.regexp = /^\/?$/;
@@ -88,7 +110,7 @@ const patchRouterStack = (stack: any[]): void => {
       }
     } else if (Array.isArray(layer.keys) && typeof layer.keys[0] === "string") {
       // Express 5 stores keys as plain strings after match() — convert to objects
-      layer.keys = layer.keys.map((k: string) => ({name: k, optional: false}));
+      layer.keys = (layer.keys as string[]).map((k) => ({name: k, optional: false}));
     }
 
     // Recursively patch nested stacks
@@ -108,17 +130,18 @@ const patchRouterStack = (stack: any[]): void => {
  *
  * Must be called before any routes are registered.
  */
-export const patchAppUse = (app: any): void => {
+export const patchAppUse = (app: Application): void => {
+  const internal = app as unknown as AppWithRouter;
   const originalUse = app.use.bind(app);
-  const patchedUse = (...args: any[]): unknown => {
+  const patchedUse = (...args: unknown[]): unknown => {
     // Track stack length before the call
-    const router = app._router || app.router;
+    const router = internal._router ?? internal.router;
     const stackBefore = router?.stack?.length ?? 0;
 
-    const result = originalUse(...args);
+    const result = (originalUse as (...a: unknown[]) => unknown)(...args);
 
     // After use(), check if new layers were added and annotate them
-    const routerAfter = app._router || app.router;
+    const routerAfter = internal._router ?? internal.router;
     if (routerAfter?.stack) {
       const stackAfter = routerAfter.stack.length;
       // The first arg is the mount path if it's a string
@@ -132,15 +155,16 @@ export const patchAppUse = (app: any): void => {
 
     return result;
   };
-  app.use = patchedUse;
+  (app as unknown as {use: typeof patchedUse}).use = patchedUse;
 };
 
 /**
  * Express middleware that patches the router stack before OpenAPI doc
  * generation. Must be mounted before the openapi middleware.
  */
-export const openApiCompatMiddleware = (req: any, _res: any, next: () => void): void => {
-  const router = req.app._router || req.app.router;
+export const openApiCompatMiddleware = (req: Request, _res: Response, next: NextFunction): void => {
+  const internal = req.app as unknown as AppWithRouter;
+  const router = internal._router ?? internal.router;
   if (router?.stack) {
     patchRouterStack(router.stack);
   }

package/src/permissions.ts

@@ -150,9 +150,9 @@ export function permissionMiddleware<T>(
       let data;
       try {
         data = await populatedQuery.exec();
-      } catch (error: any) {
+      } catch (error: unknown) {
         throw new APIError({
-          error,
+          error: error as Error,
           status: 500,
           title: `GET failed on ${req.params.id}`,
         });

package/src/transformers.ts

@@ -160,11 +160,12 @@ export async function defaultResponseHandler<T>(
   }
   try {
     return serialize(request, options, doc);
-  } catch (error: any) {
+  } catch (error: unknown) {
+    const errorObj = error as Error;
     throw new APIError({
-      error,
+      error: errorObj,
       status: 400,
-      title: `Error serializing ${method} response: ${error.message}`,
+      title: `Error serializing ${method} response: ${errorObj.message}`,
     });
   }
 }