@theokit/http 1.2.0 → 2.1.0-next.0

package/README.md

@@ -31,11 +31,16 @@ form — `@Body(schema)` — works without it.
 ## Quick start
 
 ```typescript
-import { Controller, Get, Post, Body, Param } from '@theokit/http'
+import { Controller, Get, Post, Body, Param, Public } from '@theokit/http'
 import { z } from 'zod'
 
 // Convention: @Controller() on CatsController infers the prefix "api/cats".
 // Pass a string to override: @Controller('api/v2/cats').
+//
+// `@Public()` is the access decision "anyone may call this". Every route needs one — a guard or
+// this — because a route that declares neither is refused with 403 rather than served. See
+// "Every route declares who may call it" below.
+@Public()
 @Controller()
 export class CatsController {
   @Get()
@@ -55,6 +60,40 @@ export class CatsController {
 }
 ```
 
+## Every route declares who may call it
+
+A route says one of two things, and saying neither is not a third option:
+
+| | how it is said |
+|---|---|
+| anyone may call it | `@Public()` — on the method, or on the class to cover every route under it |
+| someone decides | `@UseGuards(SomeGuard)` — likewise on either |
+
+A route that declares neither is **refused with 403** at dispatch, in every dispatcher this package
+ships, and `theokit build` fails on it before that. The reason is that `guards: []` used to mean
+both *"open on purpose"* and *"nobody said"*, so the dispatcher took the permissive reading — and a
+route nobody thought about is the one that ships open.
+
+`undeclaredRoutes: 'warn'` restores the old behaviour while you migrate, with one warning per route:
+
+```typescript
+TheoApp.create({ controllers, undeclaredRoutes: 'warn' }) // also on createDecoratorHandler(...)
+```
+
+Guards still run on a `@Public()` route — the decorator answers *who may call it*, not *what else
+happens on the way in*. For "any signed-in caller", `theokit/server/auth` exports the guard rather
+than leaving every app to write it:
+
+```typescript
+import { createSessionManagerWeb, Authenticated } from 'theokit/server/auth'
+
+const sessions = createSessionManagerWeb<{ userId: string }>({ secret: process.env.SESSION_SECRET! })
+
+@Controller('api/tasks')
+@UseGuards(Authenticated(sessions))
+export class TasksController { … }
+```
+
 ## Validation — Zod is the single source of truth
 
 Pass the schema to `@Body` directly. The bridge validates the request against it and feeds the same

package/dist/app.d.ts

@@ -1,49 +1,5 @@
 import { S as ServerHandle } from './types-CGthbcon.js';
-
-/**
- * Whether a route DECLARED an access decision, or nobody said (usetheokit/theokit#576).
- *
- * ## The ambiguity this removes
- *
- * `guards: []` meant two different things and the dispatcher could not tell them apart:
- *
- * - *this route is open on purpose*, and
- * - *nobody said*.
- *
- * Faced with both readings it took the permissive one and served. For controllers that was safe
- * only because a separate build gate (#514) refuses an undeclared controller route — which makes
- * least privilege a property of the PIPELINE rather than of the system. Anything reaching the
- * dispatcher without having run that build is served, and `@theokit/http` is published on its own,
- * so "without having run that build" is an ordinary way to use it.
- *
- * Agent routes had neither. They are auto-wired — the app never wrote them, so there is no file for
- * a reviewer to read — dispatched BEFORE controllers and file routes, and covered by no gate at
- * all. An agent authored through capabilities has no class, so it takes no `@UseGuards`, so
- * `guards` was `undefined`, so `?? []`, so served.
- *
- * The fix is not a new guard. It is making absence REPRESENTABLE, so a decision can be told from
- * its residue.
- */
-/** What a route says about who may call it. */
-type AccessDecision = 
-/** Anyone may call it, on purpose. */
-'public'
-/** At least one guard decides. */
- | 'guarded'
-/** Nobody said — the state that used to be indistinguishable from `'public'`. */
- | 'undeclared';
-/**
- * How an app answers a route that declared nothing.
- *
- * `'warn'` is the default and serves the request after saying so once, loudly, at mount. `'deny'`
- * refuses with 403.
- *
- * The default is `'warn'` and not `'deny'` because flipping it silently would break every app whose
- * agent endpoints are open today — which is precisely the population #576 is about, and breaking
- * them inside a patch is how a security improvement becomes an outage. It becomes `'deny'` in the
- * next major; `'deny'` is available now for anyone who wants the property before then.
- */
-type UndeclaredRoutePolicy = 'warn' | 'deny';
+import { A as AccessDecision, U as UndeclaredRoutePolicy } from './route-access-Bq7eKXIc.js';
 
 /**
  * TheoApp — NestJS/Spring Boot-style application bootstrap.
@@ -142,12 +98,11 @@ interface TheoAppOptions {
     /**
      * What to do with a route that declared no access decision (#576).
      *
-     * `'warn'` (default) serves it after saying so once at mount. `'deny'` refuses with 403.
+     * `'deny'` (default) refuses with 403. `'warn'` serves it after saying so once — the migration
+     * escape for an app whose agent endpoints are open today, and nothing else.
      *
-     * The default is not `'deny'` because flipping it here would break every app whose agent
-     * endpoints are open today — the population #576 is about — inside a non-major release. It
-     * becomes `'deny'` in the next major; `'deny'` is available now for anyone who wants the property
-     * before then.
+     * The default was `'warn'` in 1.2.0 so the flip did not land inside a patch. This is the major
+     * that release bought.
      */
     undeclaredRoutes?: UndeclaredRoutePolicy;
     /**

package/dist/app.js

@@ -1,8 +1,8 @@
 import {
   TheoApp
-} from "./chunk-NFCIOKAI.js";
-import "./chunk-X7Q5HPLK.js";
-import "./chunk-AJOJXZRY.js";
+} from "./chunk-HN73QCHT.js";
+import "./chunk-ERQT6ZDN.js";
+import "./chunk-CRTEMKW2.js";
 import "./chunk-BSS3KPGY.js";
 import "./chunk-Z4QWC7IK.js";
 export {

package/dist/{chunk-HC47QXZV.js → chunk-2HJYLH4O.js}

@@ -1,8 +1,9 @@
 import {
   CATCH_EXCEPTIONS,
   HttpException,
-  getMeta
-} from "./chunk-AJOJXZRY.js";
+  getMeta,
+  httpExceptionToResponse
+} from "./chunk-CRTEMKW2.js";
 import {
   resolveOrNew
 } from "./chunk-JP4J23TV.js";
@@ -37,12 +38,7 @@ function matchesException(exception, catchTypes) {
 __name(matchesException, "matchesException");
 function builtInResponse(exception) {
   if (exception instanceof HttpException) {
-    return new Response(JSON.stringify(exception.toJSON()), {
-      status: exception.statusCode,
-      headers: {
-        "content-type": "application/json"
-      }
-    });
+    return httpExceptionToResponse(exception);
   }
   return globalFallback(exception);
 }
@@ -68,4 +64,4 @@ __name(globalFallback, "globalFallback");
 export {
   runExceptionFilters
 };
-//# sourceMappingURL=chunk-HC47QXZV.js.map
+//# sourceMappingURL=chunk-2HJYLH4O.js.map

package/dist/chunk-2HJYLH4O.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/bridge/exception-filter-chain.ts"],"mappings":";;;;;;;;;;;;;;AA0BA,eAAsBA,oBACpBC,WACAC,SACAC,SACAC,WAAuB;AAEvB,QAAMC,OAAsB;IAC1BC,YAAY,6BAAMH,SAAN;EACd;AAEA,aAAWI,cAAcL,SAAS;AAChC,UAAMM,aAAaC,QAAoBC,kBAAkBH,UAAAA,KAAe,CAAA;AACxE,QAAII,iBAAiBV,WAAWO,UAAAA,GAAa;AAC3C,YAAMI,SAASC,aAAaN,YAAYH,SAAAA;AACxC,UAAI;AACF,eAAO,MAAMQ,OAAOE,MAAMb,WAAWI,IAAAA;MACvC,SAASU,aAAa;AAEpBC,gBAAQC,MAAM,2CAA2CF,WAAAA;AACzD,eAAOG,eAAejB,SAAAA;MACxB;IACF;EACF;AAEA,SAAOkB,gBAAgBlB,SAAAA;AACzB;AAzBsBD;AA2BtB,SAASW,iBAAiBV,WAAoBO,YAAsB;AAClE,MAAIA,WAAWY,WAAW,EAAG,QAAO;AACpC,SAAOZ,WAAWa,KAAK,CAACC,SAASrB,qBAAqBqB,IAAAA;AACxD;AAHSX;AAKT,SAASQ,gBAAgBlB,WAAkB;AACzC,MAAIA,qBAAqBsB,eAAe;AAItC,WAAOC,wBAAwBvB,SAAAA;EACjC;AACA,SAAOiB,eAAejB,SAAAA;AACxB;AARSkB;AAUT,SAASD,eAAejB,WAAkB;AACxC,QAAMwB,UAAUxB,qBAAqByB,QAAQzB,UAAUwB,UAAU;AACjET,UAAQC,MAAM,wCAAwChB,SAAAA;AACtD,SAAO,IAAI0B,SACTC,KAAKC,UAAU;IAAEZ,OAAO;MAAEa,MAAM;MAAyBL;MAASM,YAAY;IAAI;EAAE,CAAA,GACpF;IAAEC,QAAQ;IAAKC,SAAS;MAAE,gBAAgB;IAAmB;EAAE,CAAA;AAEnE;AAPSf;","names":["runExceptionFilters","exception","filters","request","container","host","getRequest","FilterCtor","catchTypes","getMeta","CATCH_EXCEPTIONS","matchesException","filter","resolveOrNew","catch","filterError","console","error","globalFallback","builtInResponse","length","some","Type","HttpException","httpExceptionToResponse","message","Error","Response","JSON","stringify","code","statusCode","status","headers"]}

package/dist/{chunk-AJOJXZRY.js → chunk-CRTEMKW2.js}

@@ -2,37 +2,6 @@ import {
   __name
 } from "./chunk-Z4QWC7IK.js";
 
-// src/metadata/keys.ts
-var CONTROLLER_PREFIX = /* @__PURE__ */ Symbol.for("theokit:http-decorators:controller-prefix");
-var ROUTE_METHODS = /* @__PURE__ */ Symbol.for("theokit:http-decorators:route-methods");
-var ROUTE_PARAMS = /* @__PURE__ */ Symbol.for("theokit:http-decorators:route-params");
-var ROUTE_STATUS = /* @__PURE__ */ Symbol.for("theokit:http-decorators:route-status");
-var ROUTE_HEADERS = /* @__PURE__ */ Symbol.for("theokit:http-decorators:route-headers");
-var ROUTE_REDIRECT = /* @__PURE__ */ Symbol.for("theokit:http-decorators:route-redirect");
-var USE_GUARDS = /* @__PURE__ */ Symbol.for("theokit:http-decorators:use-guards");
-var USE_INTERCEPTORS = /* @__PURE__ */ Symbol.for("theokit:http-decorators:use-interceptors");
-var USE_FILTERS = /* @__PURE__ */ Symbol.for("theokit:http-decorators:use-filters");
-var CATCH_EXCEPTIONS = /* @__PURE__ */ Symbol.for("theokit:http-decorators:catch-exceptions");
-var EXPOSE_AGENT = /* @__PURE__ */ Symbol.for("theokit:http-decorators:expose-agent");
-
-// src/metadata/storage.ts
-import "reflect-metadata";
-function setMeta(key, target, value, propertyKey) {
-  if (propertyKey !== void 0) {
-    Reflect.defineMetadata(key, value, target, propertyKey);
-  } else {
-    Reflect.defineMetadata(key, value, target);
-  }
-}
-__name(setMeta, "setMeta");
-function getMeta(key, target, propertyKey) {
-  if (propertyKey !== void 0) {
-    return Reflect.getMetadata(key, target, propertyKey);
-  }
-  return Reflect.getMetadata(key, target);
-}
-__name(getMeta, "getMeta");
-
 // src/exceptions/http-exception.ts
 var STATUS_CODES = {
   400: "BAD_REQUEST",
@@ -64,6 +33,8 @@ var HttpException = class extends Error {
   statusCode;
   code;
   description;
+  /** Headers this refusal carries. Empty unless the thrower supplied some. See {@link HttpExceptionOptions.headers}. */
+  headers;
   constructor(message, statusCode, options) {
     super(message, options?.cause ? {
       cause: options.cause
@@ -72,6 +43,9 @@ var HttpException = class extends Error {
     this.statusCode = statusCode;
     this.code = STATUS_CODES[statusCode] ?? "INTERNAL_SERVER_ERROR";
     this.description = options?.description;
+    this.headers = Object.freeze({
+      ...options?.headers
+    });
   }
   toJSON() {
     return {
@@ -237,20 +211,53 @@ var HttpStatus = {
   GATEWAY_TIMEOUT: 504
 };
 
+// src/exceptions/to-response.ts
+function httpExceptionToResponse(exception) {
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(exception.headers)) {
+    if (name.toLowerCase() === "content-type") continue;
+    headers.set(name, value);
+  }
+  headers.set("content-type", "application/json");
+  return new Response(JSON.stringify(exception.toJSON()), {
+    status: exception.statusCode,
+    headers
+  });
+}
+__name(httpExceptionToResponse, "httpExceptionToResponse");
+
+// src/metadata/keys.ts
+var CONTROLLER_PREFIX = /* @__PURE__ */ Symbol.for("theokit:http-decorators:controller-prefix");
+var ROUTE_METHODS = /* @__PURE__ */ Symbol.for("theokit:http-decorators:route-methods");
+var ROUTE_PARAMS = /* @__PURE__ */ Symbol.for("theokit:http-decorators:route-params");
+var ROUTE_STATUS = /* @__PURE__ */ Symbol.for("theokit:http-decorators:route-status");
+var ROUTE_HEADERS = /* @__PURE__ */ Symbol.for("theokit:http-decorators:route-headers");
+var ROUTE_REDIRECT = /* @__PURE__ */ Symbol.for("theokit:http-decorators:route-redirect");
+var USE_GUARDS = /* @__PURE__ */ Symbol.for("theokit:http-decorators:use-guards");
+var USE_INTERCEPTORS = /* @__PURE__ */ Symbol.for("theokit:http-decorators:use-interceptors");
+var USE_FILTERS = /* @__PURE__ */ Symbol.for("theokit:http-decorators:use-filters");
+var CATCH_EXCEPTIONS = /* @__PURE__ */ Symbol.for("theokit:http-decorators:catch-exceptions");
+var EXPOSE_AGENT = /* @__PURE__ */ Symbol.for("theokit:http-decorators:expose-agent");
+
+// src/metadata/storage.ts
+import "reflect-metadata";
+function setMeta(key, target, value, propertyKey) {
+  if (propertyKey !== void 0) {
+    Reflect.defineMetadata(key, value, target, propertyKey);
+  } else {
+    Reflect.defineMetadata(key, value, target);
+  }
+}
+__name(setMeta, "setMeta");
+function getMeta(key, target, propertyKey) {
+  if (propertyKey !== void 0) {
+    return Reflect.getMetadata(key, target, propertyKey);
+  }
+  return Reflect.getMetadata(key, target);
+}
+__name(getMeta, "getMeta");
+
 export {
-  CONTROLLER_PREFIX,
-  ROUTE_METHODS,
-  ROUTE_PARAMS,
-  ROUTE_STATUS,
-  ROUTE_HEADERS,
-  ROUTE_REDIRECT,
-  USE_GUARDS,
-  USE_INTERCEPTORS,
-  USE_FILTERS,
-  CATCH_EXCEPTIONS,
-  EXPOSE_AGENT,
-  setMeta,
-  getMeta,
   HttpException,
   BadRequestException,
   UnauthorizedException,
@@ -273,6 +280,20 @@ export {
   GatewayTimeoutException,
   HttpVersionNotSupportedException,
   TooManyRequestsException,
-  HttpStatus
+  HttpStatus,
+  httpExceptionToResponse,
+  CONTROLLER_PREFIX,
+  ROUTE_METHODS,
+  ROUTE_PARAMS,
+  ROUTE_STATUS,
+  ROUTE_HEADERS,
+  ROUTE_REDIRECT,
+  USE_GUARDS,
+  USE_INTERCEPTORS,
+  USE_FILTERS,
+  CATCH_EXCEPTIONS,
+  EXPOSE_AGENT,
+  setMeta,
+  getMeta
 };
-//# sourceMappingURL=chunk-AJOJXZRY.js.map
+//# sourceMappingURL=chunk-CRTEMKW2.js.map

package/dist/chunk-CRTEMKW2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/exceptions/http-exception.ts","../src/exceptions/to-response.ts","../src/metadata/keys.ts","../src/metadata/storage.ts"],"mappings":";;;;;AAOA,IAAMA,eAAuC;EAC3C,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;AACP;AAyBO,IAAMC,gBAAN,cAA4BC,MAAAA;EAtDnC,OAsDmCA;;;EACjBC;EACAC;EACAC;;EAEAC;EAEhB,YAAYC,SAAiBJ,YAAoBK,SAAgC;AAC/E,UAAMD,SAASC,SAASC,QAAQ;MAAEA,OAAOD,QAAQC;IAAM,IAAIC,MAAAA;AAC3D,SAAKC,OAAO,KAAK,YAAYA;AAC7B,SAAKR,aAAaA;AAClB,SAAKC,OAAOJ,aAAaG,UAAAA,KAAe;AACxC,SAAKE,cAAcG,SAASH;AAG5B,SAAKC,UAAUM,OAAOC,OAAO;MAAE,GAAGL,SAASF;IAAQ,CAAA;EACrD;EAEAQ,SAAS;AACP,WAAO;MACLC,OAAO;QACLX,MAAM,KAAKA;QACXG,SAAS,KAAKA;QACdJ,YAAY,KAAKA;QACjB,GAAI,KAAKE,cAAc;UAAEA,aAAa,KAAKA;QAAY,IAAI,CAAC;MAC9D;IACF;EACF;AACF;AAkBA,SAASW,QAAQC,QAAgBC,YAAkB;AACjD,SAAO,cAAcjB,cAAAA;IACnB,YAAYM,UAAUW,YAAYV,SAAgC;AAChE,YAAMD,SAASU,QAAQT,OAAAA;AACvB,WAAKG,OAAO,KAAK,YAAYA;IAC/B;EACF;AACF;AAPSK;AASF,IAAMG,sBAAN,cAAkCH,QAAQ,KAAK,aAAA,EAAA;EA7GtD,OA6GsD;;;AAAgB;AAC/D,IAAMI,wBAAN,cAAoCJ,QAAQ,KAAK,cAAA,EAAA;EA9GxD,OA8GwD;;;AAAiB;AAClE,IAAMK,qBAAN,cAAiCL,QAAQ,KAAK,WAAA,EAAA;EA/GrD,OA+GqD;;;AAAc;AAC5D,IAAMM,oBAAN,cAAgCN,QAAQ,KAAK,WAAA,EAAA;EAhHpD,OAgHoD;;;AAAc;AAC3D,IAAMO,4BAAN,cAAwCP,QAAQ,KAAK,oBAAA,EAAA;EAjH5D,OAiH4D;;;AAAuB;AAC5E,IAAMQ,yBAAN,cAAqCR,QAAQ,KAAK,gBAAA,EAAA;EAlHzD,OAkHyD;;;AAAmB;AACrE,IAAMS,0BAAN,cAAsCT,QAAQ,KAAK,iBAAA,EAAA;EAnH1D,OAmH0D;;;AAAoB;AACvE,IAAMU,oBAAN,cAAgCV,QAAQ,KAAK,UAAA,EAAA;EApHpD,OAoHoD;;;AAAa;AAC1D,IAAMW,gBAAN,cAA4BX,QAAQ,KAAK,MAAA,EAAA;EArHhD,OAqHgD;;;AAAS;AAClD,IAAMY,8BAAN,cAA0CZ,QAAQ,KAAK,qBAAA,EAAA;EAtH9D,OAsH8D;;;AAAwB;AAC/E,IAAMa,2BAAN,cAAuCb,QAAQ,KAAK,mBAAA,EAAA;EAvH3D,OAuH2D;;;AAAsB;AAC1E,IAAMc,gCAAN,cAA4Cd,QAAQ,KAAK,wBAAA,EAAA;EAxHhE,OAwHgE;;;AAA2B;AACpF,IAAMe,qBAAN,cAAiCf,QAAQ,KAAK,cAAA,EAAA;EAzHrD,OAyHqD;;;AAAiB;AAC/D,IAAMgB,+BAAN,cAA2ChB,QAAQ,KAAK,sBAAA,EAAA;EA1H/D,OA0H+D;;;AAAyB;AACjF,IAAMiB,+BAAN,cAA2CjB,QAAQ,KAAK,uBAAA,EAAA;EA3H/D,OA2H+D;;;AAA0B;AAClF,IAAMkB,0BAAN,cAAsClB,QAAQ,KAAK,iBAAA,EAAA;EA5H1D,OA4H0D;;;AAAoB;AACvE,IAAMmB,sBAAN,cAAkCnB,QAAQ,KAAK,aAAA,EAAA;EA7HtD,OA6HsD;;;AAAgB;AAC/D,IAAMoB,8BAAN,cAA0CpB,QAAQ,KAAK,qBAAA,EAAA;EA9H9D,OA8H8D;;;AAAwB;AAC/E,IAAMqB,0BAAN,cAAsCrB,QAAQ,KAAK,iBAAA,EAAA;EA/H1D,OA+H0D;;;AAAoB;AACvE,IAAMsB,mCAAN,cAA+CtB,QAAQ,KAAK,4BAAA,EAAA;EAhInE,OAgImE;;;AAA+B;AAC3F,IAAMuB,2BAAN,cAAuCvB,QAAQ,KAAK,mBAAA,EAAA;EAjI3D,OAiI2D;;;AAAsB;AAgB1E,IAAMwB,aAAa;;EAExBC,IAAI;EACJC,SAAS;EACTC,UAAU;EACVC,YAAY;;EAGZC,mBAAmB;EACnBC,OAAO;EACPC,cAAc;EACdC,oBAAoB;EACpBC,oBAAoB;;EAGpBC,aAAa;EACbC,cAAc;EACdC,kBAAkB;EAClBC,WAAW;EACXC,WAAW;EACXC,oBAAoB;EACpBC,gBAAgB;EAChBC,iBAAiB;EACjBC,UAAU;EACVC,MAAM;EACNC,qBAAqB;EACrBC,mBAAmB;EACnBC,wBAAwB;EACxBC,aAAa;EACbC,sBAAsB;EACtBC,mBAAmB;;EAGnBC,uBAAuB;EACvBC,iBAAiB;EACjBC,aAAa;EACbC,qBAAqB;EACrBC,iBAAiB;AACnB;;;AC5JO,SAASC,wBAAwBC,WAAwB;AAC9D,QAAMC,UAAU,IAAIC,QAAAA;AACpB,aAAW,CAACC,MAAMC,KAAAA,KAAUC,OAAOC,QAAQN,UAAUC,OAAO,GAAG;AAG7D,QAAIE,KAAKI,YAAW,MAAO,eAAgB;AAG3CN,YAAQO,IAAIL,MAAMC,KAAAA;EACpB;AACAH,UAAQO,IAAI,gBAAgB,kBAAA;AAC5B,SAAO,IAAIC,SAASC,KAAKC,UAAUX,UAAUY,OAAM,CAAA,GAAK;IACtDC,QAAQb,UAAUc;IAClBb;EACF,CAAA;AACF;AAfgBF;;;ACfT,IAAMgB,oBAAoBC,uBAAOC,IAAI,2CAAA;AACrC,IAAMC,gBAAgBF,uBAAOC,IAAI,uCAAA;AACjC,IAAME,eAAeH,uBAAOC,IAAI,sCAAA;AAChC,IAAMG,eAAeJ,uBAAOC,IAAI,sCAAA;AAChC,IAAMI,gBAAgBL,uBAAOC,IAAI,uCAAA;AACjC,IAAMK,iBAAiBN,uBAAOC,IAAI,wCAAA;AAClC,IAAMM,aAAaP,uBAAOC,IAAI,oCAAA;AAC9B,IAAMO,mBAAmBR,uBAAOC,IAAI,0CAAA;AACpC,IAAMQ,cAAcT,uBAAOC,IAAI,qCAAA;AAC/B,IAAMS,mBAAmBV,uBAAOC,IAAI,0CAAA;AACpC,IAAMU,eAAeX,uBAAOC,IAAI,sCAAA;;;ACtBvC,OAAO;AAQA,SAASW,QACdC,KACAC,QACAC,OACAC,aAA6B;AAE7B,MAAIA,gBAAgBC,QAAW;AAC7BC,YAAQC,eAAeN,KAAKE,OAAOD,QAAQE,WAAAA;EAC7C,OAAO;AACLE,YAAQC,eAAeN,KAAKE,OAAOD,MAAAA;EACrC;AACF;AAXgBF;AAaT,SAASQ,QACdP,KACAC,QACAE,aAA6B;AAE7B,MAAIA,gBAAgBC,QAAW;AAC7B,WAAOC,QAAQG,YAAYR,KAAKC,QAAQE,WAAAA;EAC1C;AACA,SAAOE,QAAQG,YAAYR,KAAKC,MAAAA;AAClC;AATgBM;","names":["STATUS_CODES","HttpException","Error","statusCode","code","description","headers","message","options","cause","undefined","name","Object","freeze","toJSON","error","factory","status","defaultMsg","BadRequestException","UnauthorizedException","ForbiddenException","NotFoundException","MethodNotAllowedException","NotAcceptableException","RequestTimeoutException","ConflictException","GoneException","PreconditionFailedException","PayloadTooLargeException","UnsupportedMediaTypeException","ImATeapotException","UnprocessableEntityException","InternalServerErrorException","NotImplementedException","BadGatewayException","ServiceUnavailableException","GatewayTimeoutException","HttpVersionNotSupportedException","TooManyRequestsException","HttpStatus","OK","CREATED","ACCEPTED","NO_CONTENT","MOVED_PERMANENTLY","FOUND","NOT_MODIFIED","TEMPORARY_REDIRECT","PERMANENT_REDIRECT","BAD_REQUEST","UNAUTHORIZED","PAYMENT_REQUIRED","FORBIDDEN","NOT_FOUND","METHOD_NOT_ALLOWED","NOT_ACCEPTABLE","REQUEST_TIMEOUT","CONFLICT","GONE","PRECONDITION_FAILED","PAYLOAD_TOO_LARGE","UNSUPPORTED_MEDIA_TYPE","IM_A_TEAPOT","UNPROCESSABLE_ENTITY","TOO_MANY_REQUESTS","INTERNAL_SERVER_ERROR","NOT_IMPLEMENTED","BAD_GATEWAY","SERVICE_UNAVAILABLE","GATEWAY_TIMEOUT","httpExceptionToResponse","exception","headers","Headers","name","value","Object","entries","toLowerCase","set","Response","JSON","stringify","toJSON","status","statusCode","CONTROLLER_PREFIX","Symbol","for","ROUTE_METHODS","ROUTE_PARAMS","ROUTE_STATUS","ROUTE_HEADERS","ROUTE_REDIRECT","USE_GUARDS","USE_INTERCEPTORS","USE_FILTERS","CATCH_EXCEPTIONS","EXPOSE_AGENT","setMeta","key","target","value","propertyKey","undefined","Reflect","defineMetadata","getMeta","getMetadata"]}

package/dist/chunk-ERQT6ZDN.js

@@ -0,0 +1,337 @@
+import {
+  CONTROLLER_PREFIX,
+  EXPOSE_AGENT,
+  ForbiddenException,
+  ROUTE_HEADERS,
+  ROUTE_METHODS,
+  ROUTE_PARAMS,
+  ROUTE_REDIRECT,
+  ROUTE_STATUS,
+  USE_FILTERS,
+  USE_GUARDS,
+  USE_INTERCEPTORS,
+  getMeta,
+  httpExceptionToResponse
+} from "./chunk-CRTEMKW2.js";
+import {
+  __name
+} from "./chunk-Z4QWC7IK.js";
+
+// src/bridge/errors.ts
+var HttpDecoratorsConfigError = class extends Error {
+  static {
+    __name(this, "HttpDecoratorsConfigError");
+  }
+  name = "HttpDecoratorsConfigError";
+  constructor(message) {
+    super(message);
+  }
+};
+
+// src/bridge/execution-context.ts
+function createExecutionContext(request, controllerClass, methodName) {
+  const url = new URL(request.url);
+  return {
+    getRequest: /* @__PURE__ */ __name(() => request, "getRequest"),
+    getUrl: /* @__PURE__ */ __name(() => url, "getUrl"),
+    getClass: /* @__PURE__ */ __name(() => controllerClass, "getClass"),
+    getMethodName: /* @__PURE__ */ __name(() => methodName, "getMethodName")
+  };
+}
+__name(createExecutionContext, "createExecutionContext");
+
+// src/bridge/guard-chain.ts
+var constructGuard = /* @__PURE__ */ __name((Ctor) => new Ctor(), "constructGuard");
+async function runGuards(guards, context, resolve = constructGuard) {
+  for (const GuardCtor of guards) {
+    const guard = resolve(GuardCtor);
+    if (!await guard.canActivate(context)) {
+      return httpExceptionToResponse(new ForbiddenException("Forbidden resource"));
+    }
+  }
+  return null;
+}
+__name(runGuards, "runGuards");
+
+// src/decorators/set-metadata.ts
+import "reflect-metadata";
+var decoratorKeyCounter = 0;
+function createDecorator() {
+  const key = /* @__PURE__ */ Symbol.for(`theokit:custom:${++decoratorKeyCounter}`);
+  const decorator = /* @__PURE__ */ __name((value) => {
+    return (target, propertyKey) => {
+      const metaTarget = propertyKey !== void 0 ? target.constructor : target;
+      Reflect.defineMetadata(key, value, metaTarget, propertyKey);
+    };
+  }, "decorator");
+  decorator.key = key;
+  return decorator;
+}
+__name(createDecorator, "createDecorator");
+function SetMetadata(metaKey, value) {
+  return (target, propertyKey) => {
+    const metaTarget = propertyKey !== void 0 ? target.constructor : target;
+    Reflect.defineMetadata(metaKey, value, metaTarget, propertyKey);
+  };
+}
+__name(SetMetadata, "SetMetadata");
+var Reflector = class {
+  static {
+    __name(this, "Reflector");
+  }
+  /**
+  * Read metadata set by a typed decorator created via createDecorator<T>().
+  *
+  * @example
+  * ```ts
+  * const Roles = createDecorator<string[]>()
+  * const reflector = new Reflector()
+  * const roles = reflector.get(Roles, handlerFn) // string[] | undefined
+  * ```
+  */
+  get(decorator, target, propertyKey) {
+    const key = decorator.key;
+    if (!key) return void 0;
+    if (propertyKey !== void 0) {
+      return Reflect.getMetadata(key, target, propertyKey);
+    }
+    return Reflect.getMetadata(key, target);
+  }
+  /**
+  * Read metadata set by @SetMetadata(key, value).
+  */
+  getByKey(key, target, propertyKey) {
+    if (propertyKey !== void 0) {
+      return Reflect.getMetadata(key, target, propertyKey);
+    }
+    return Reflect.getMetadata(key, target);
+  }
+  /**
+  * Read metadata checking method-level first, then class-level.
+  * Returns the first non-undefined value found.
+  *
+  * NestJS equivalent: `reflector.getAllAndOverride(ROLES_KEY, [context.getHandler(), context.getClass()])`
+  *
+  * @example
+  * ```ts
+  * const Roles = createDecorator<string[]>()
+  * // In a guard:
+  * const roles = reflector.getAllAndOverride(Roles, context.getClass(), context.getMethodName())
+  * // Checks method-level @Roles first, falls back to class-level @Roles
+  * ```
+  */
+  getAllAndOverride(decorator, target, propertyKey) {
+    if (propertyKey !== void 0) {
+      const methodLevel = this.get(decorator, target, propertyKey);
+      if (methodLevel !== void 0) return methodLevel;
+    }
+    return this.get(decorator, target);
+  }
+  /**
+  * Read metadata checking method-level first, then class-level, by raw key.
+  * Returns the first non-undefined value found.
+  */
+  getAllAndOverrideByKey(key, target, propertyKey) {
+    if (propertyKey !== void 0) {
+      const methodLevel = this.getByKey(key, target, propertyKey);
+      if (methodLevel !== void 0) return methodLevel;
+    }
+    return this.getByKey(key, target);
+  }
+  /**
+  * Read metadata from both method-level and class-level, merging arrays.
+  * Returns all found values as a flat array.
+  *
+  * NestJS equivalent: `reflector.getAllAndMerge(ROLES_KEY, [context.getHandler(), context.getClass()])`
+  *
+  * @example
+  * ```ts
+  * const Tags = createDecorator<string[]>()
+  *
+  * @Tags(['api'])
+  * @Controller('cats')
+  * class CatsCtrl {
+  *   @Tags(['read'])
+  *   @Get()
+  *   findAll() {}
+  * }
+  *
+  * reflector.getAllAndMerge(Tags, CatsCtrl, 'findAll')
+  * // → ['read', 'api'] (method + class merged)
+  * ```
+  */
+  getAllAndMerge(decorator, target, propertyKey) {
+    const result = [];
+    if (propertyKey !== void 0) {
+      const methodLevel = this.get(decorator, target, propertyKey);
+      if (methodLevel !== void 0) {
+        if (Array.isArray(methodLevel)) result.push(...methodLevel);
+        else result.push(methodLevel);
+      }
+    }
+    const classLevel = this.get(decorator, target);
+    if (classLevel !== void 0) {
+      if (Array.isArray(classLevel)) result.push(...classLevel);
+      else result.push(classLevel);
+    }
+    return result;
+  }
+};
+
+// src/decorators/public.ts
+var PUBLIC_ROUTE_METADATA = "theokit:public";
+var Public = /* @__PURE__ */ __name(() => SetMetadata(PUBLIC_ROUTE_METADATA, true), "Public");
+
+// src/route-access.ts
+function classifyAccess(declared) {
+  if (declared.access !== void 0) return declared.access;
+  return declared.guards !== void 0 && declared.guards.length > 0 ? "guarded" : "undeclared";
+}
+__name(classifyAccess, "classifyAccess");
+var declareOpen = /* @__PURE__ */ __name((kind) => kind === "agent" ? "`access: 'public'`" : "`@Public()`", "declareOpen");
+function undeclaredRouteWarning(kind, route) {
+  return `[theokit] ${kind} route ${route} declares no access decision and is served to anyone because \`undeclaredRoutes: 'warn'\` is set. Declare one: attach a guard, or say it is open on purpose (${declareOpen(kind)}). Dropping the option refuses it with 403.`;
+}
+__name(undeclaredRouteWarning, "undeclaredRouteWarning");
+function undeclaredRouteRefusal(kind, route) {
+  return `${kind === "agent" ? "Agent" : "Controller"} route ${route} declares no access decision, so it is refused. Attach a guard, or say it is open on purpose (${declareOpen(kind)}). \`undeclaredRoutes: 'warn'\` serves it with a warning while you migrate.`;
+}
+__name(undeclaredRouteRefusal, "undeclaredRouteRefusal");
+
+// src/bridge/dto-zod.ts
+function resolveDtoSchema(dtoClass) {
+  if (typeof dtoClass !== "function") return void 0;
+  const maybe = dtoClass.schema;
+  if (maybe !== null && maybe !== void 0 && typeof maybe.safeParse === "function") {
+    return maybe;
+  }
+  return void 0;
+}
+__name(resolveDtoSchema, "resolveDtoSchema");
+
+// src/bridge/walk-metadata.ts
+import "reflect-metadata";
+function joinPath(prefix, path) {
+  return ("/" + prefix + "/" + path).replace(/\/+/g, "/").replace(/\/$/, "") || "/";
+}
+__name(joinPath, "joinPath");
+function resolveBodySchema(paramEntries, ControllerClass, propertyKey) {
+  const bodyParam = paramEntries.find((p) => p.source === "body" && !p.key);
+  if (!bodyParam) return void 0;
+  if (bodyParam.schema) return bodyParam.schema;
+  const paramTypes = Reflect.getMetadata("design:paramtypes", ControllerClass.prototype, propertyKey) ?? [];
+  if (paramTypes.length > 0) {
+    return resolveDtoSchema(paramTypes[bodyParam.index]);
+  }
+  console.warn(`[@theokit/http] method ${String(propertyKey)} on ${ControllerClass.name}: @Body() without explicit schema and emitDecoratorMetadata is not active. Body will be passed raw (no validation). Fix: use @Body(zodSchema) for validation without metadata emission.`);
+  return void 0;
+}
+__name(resolveBodySchema, "resolveBodySchema");
+function declaredAccess(ControllerClass, propertyKey, guards) {
+  const isPublic = Reflect.getMetadata(PUBLIC_ROUTE_METADATA, ControllerClass) === true || Reflect.getMetadata(PUBLIC_ROUTE_METADATA, ControllerClass, propertyKey) === true;
+  return classifyAccess({
+    access: isPublic ? "public" : void 0,
+    guards
+  });
+}
+__name(declaredAccess, "declaredAccess");
+var walkCache = /* @__PURE__ */ new WeakMap();
+function walkControllerMetadata(ControllerClass) {
+  const cached = walkCache.get(ControllerClass);
+  if (cached) return cached;
+  const controllerMeta = getMeta(CONTROLLER_PREFIX, ControllerClass);
+  if (!controllerMeta) {
+    throw new HttpDecoratorsConfigError(`Controller class ${ControllerClass.name} is missing @Controller() decorator. Add @Controller('prefix') to the class declaration.`);
+  }
+  const { prefix, host } = controllerMeta;
+  if (host) {
+    console.warn(`[@theokit/http] @Controller host '${host}' captured but enforcement deferred to v0.2.0`);
+  }
+  const methods = getMeta(ROUTE_METHODS, ControllerClass) ?? [];
+  const paramsMap = getMeta(ROUTE_PARAMS, ControllerClass) ?? /* @__PURE__ */ new Map();
+  const classGuards = getMeta(USE_GUARDS, ControllerClass) ?? [];
+  const classInterceptors = getMeta(USE_INTERCEPTORS, ControllerClass) ?? [];
+  const classFilters = getMeta(USE_FILTERS, ControllerClass) ?? [];
+  const result = methods.map((m) => {
+    const paramEntries = paramsMap.get(m.propertyKey) ?? [];
+    const bodySchema = resolveBodySchema(paramEntries, ControllerClass, m.propertyKey);
+    const methodGuards = getMeta(USE_GUARDS, ControllerClass, m.propertyKey) ?? [];
+    const methodInterceptors = getMeta(USE_INTERCEPTORS, ControllerClass, m.propertyKey) ?? [];
+    return {
+      verb: m.verb,
+      fullPath: joinPath(prefix, m.path),
+      propertyKey: m.propertyKey,
+      bodySchema,
+      paramEntries: [
+        ...paramEntries
+      ].sort((a, b) => a.index - b.index),
+      status: getMeta(ROUTE_STATUS, ControllerClass, m.propertyKey),
+      headers: getMeta(ROUTE_HEADERS, ControllerClass, m.propertyKey) ?? [],
+      redirect: getMeta(ROUTE_REDIRECT, ControllerClass, m.propertyKey),
+      guards: [
+        ...classGuards,
+        ...methodGuards
+      ],
+      interceptors: [
+        ...classInterceptors,
+        ...methodInterceptors
+      ],
+      filters: getMeta(USE_FILTERS, ControllerClass, m.propertyKey) ?? classFilters,
+      access: declaredAccess(ControllerClass, m.propertyKey, [
+        ...classGuards,
+        ...methodGuards
+      ])
+    };
+  });
+  const exposeEntries = getMeta(EXPOSE_AGENT, ControllerClass) ?? [];
+  const agentResults = exposeEntries.map((e) => {
+    const memberGuards = getMeta(USE_GUARDS, ControllerClass, e.propertyKey) ?? [];
+    const verb = "POST";
+    return {
+      verb,
+      fullPath: joinPath(prefix, String(e.propertyKey)),
+      propertyKey: e.propertyKey,
+      paramEntries: [],
+      headers: [],
+      guards: [
+        ...classGuards,
+        ...memberGuards
+      ],
+      interceptors: [],
+      filters: classFilters,
+      access: declaredAccess(ControllerClass, e.propertyKey, [
+        ...classGuards,
+        ...memberGuards
+      ]),
+      agent: {
+        module: e.agent,
+        opts: e.opts
+      }
+    };
+  });
+  const all = [
+    ...result,
+    ...agentResults
+  ];
+  walkCache.set(ControllerClass, all);
+  return all;
+}
+__name(walkControllerMetadata, "walkControllerMetadata");
+
+export {
+  HttpDecoratorsConfigError,
+  createExecutionContext,
+  runGuards,
+  createDecorator,
+  SetMetadata,
+  Reflector,
+  PUBLIC_ROUTE_METADATA,
+  Public,
+  classifyAccess,
+  undeclaredRouteWarning,
+  undeclaredRouteRefusal,
+  resolveDtoSchema,
+  joinPath,
+  walkControllerMetadata
+};
+//# sourceMappingURL=chunk-ERQT6ZDN.js.map