@walkeros/server-source-express 3.1.0 → 3.2.0-next-1775064795590

package/README.md

@@ -176,6 +176,34 @@ curl -X POST http://localhost:8080/collect \
 }
 ```
 
+### POST - Non-JSON Bodies (Raw Input)
+
+For non-JSON bodies (Base64, XML, form data), the source pushes an empty event
+`{}` to the collector. Use `source.before` transformers to decode raw input
+available via ingest:
+
+```json
+{
+  "sources": {
+    "http": {
+      "package": "@walkeros/server-source-express",
+      "before": "base64Decoder",
+      "config": {
+        "ingest": {
+          "map": {
+            "rawBody": "body",
+            "contentType": "headers.content-type"
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+The `base64Decoder` transformer reads `context.ingest.rawBody` and returns the
+decoded walkerOS event.
+
 ### GET - Pixel Tracking
 
 Send events as query parameters. Returns a 1x1 transparent GIF.

package/dist/index.js

@@ -1 +1 @@
-"use strict";var mod,__create=Object.create,__defProp=Object.defineProperty,__getOwnPropDesc=Object.getOwnPropertyDescriptor,__getOwnPropNames=Object.getOwnPropertyNames,__getProtoOf=Object.getPrototypeOf,__hasOwnProp=Object.prototype.hasOwnProperty,__copyProps=(to,from,except,desc)=>{if(from&&"object"==typeof from||"function"==typeof from)for(let key of __getOwnPropNames(from))__hasOwnProp.call(to,key)||key===except||__defProp(to,key,{get:()=>from[key],enumerable:!(desc=__getOwnPropDesc(from,key))||desc.enumerable});return to},__toESM=(mod,isNodeMode,target)=>(target=null!=mod?__create(__getProtoOf(mod)):{},__copyProps(!isNodeMode&&mod&&mod.__esModule?target:__defProp(target,"default",{value:mod,enumerable:!0}),mod)),index_exports={};((target,all)=>{for(var name in all)__defProp(target,name,{get:all[name],enumerable:!0})})(index_exports,{TRANSPARENT_GIF:()=>TRANSPARENT_GIF,default:()=>index_default,setCorsHeaders:()=>setCorsHeaders,sourceExpress:()=>sourceExpress}),module.exports=(mod=index_exports,__copyProps(__defProp({},"__esModule",{value:!0}),mod));var import_express=__toESM(require("express")),import_cors=__toESM(require("cors")),import_core=require("@walkeros/core"),import_dev3=require("@walkeros/core/dev"),import_dev2=require("@walkeros/core/dev"),import_dev=require("@walkeros/core/dev"),HttpMethod=import_dev.z.enum(["GET","POST","PUT","PATCH","DELETE","OPTIONS","HEAD"]),RouteMethod=import_dev.z.enum(["GET","POST"]),RouteConfigSchema=import_dev.z.object({path:import_dev.z.string().describe("Express route path (supports wildcards like /api/*)"),methods:import_dev.z.array(RouteMethod).min(1).describe("HTTP methods to register. OPTIONS always included for CORS.").optional()}),CorsOrigin=import_dev.z.union([import_dev.z.string(),import_dev.z.array(import_dev.z.string()),import_dev.z.literal("*")]),CorsOptionsSchema=import_dev.z.object({origin:CorsOrigin.describe("Allowed origins (* for all, URL string, or array of URLs)").optional(),methods:import_dev.z.array(HttpMethod).describe("Allowed HTTP methods").optional(),headers:import_dev.z.array(import_dev.z.string()).describe("Allowed request headers").optional(),credentials:import_dev.z.boolean().describe("Allow credentials (cookies, authorization headers)").optional(),maxAge:import_dev.z.number().int().positive().describe("Preflight cache duration in seconds").optional()}),SettingsSchema=import_dev2.z.object({port:import_dev2.z.number().int().min(0).max(65535).describe("HTTP server port to listen on. Use 0 for random available port. If not provided, server will not start (app only mode)").optional(),path:import_dev2.z.string().describe("Deprecated: use paths instead").optional(),paths:import_dev2.z.array(import_dev2.z.union([import_dev2.z.string(),RouteConfigSchema])).min(1).describe("Route paths to register. String shorthand registers GET+POST. RouteConfig allows per-route method control.").optional(),cors:import_dev2.z.union([import_dev2.z.boolean(),CorsOptionsSchema]).describe("CORS configuration: false = disabled, true = allow all origins (default), object = custom configuration").default(!0)});(0,import_dev3.zodToSchema)(SettingsSchema);function setCorsHeaders(res,corsConfig=!0){if(!1!==corsConfig)if(!0===corsConfig)res.set("Access-Control-Allow-Origin","*"),res.set("Access-Control-Allow-Methods","GET, POST, OPTIONS"),res.set("Access-Control-Allow-Headers","Content-Type");else{if(corsConfig.origin){const origin=Array.isArray(corsConfig.origin)?corsConfig.origin.join(", "):corsConfig.origin;res.set("Access-Control-Allow-Origin",origin)}corsConfig.methods&&res.set("Access-Control-Allow-Methods",corsConfig.methods.join(", ")),corsConfig.headers&&res.set("Access-Control-Allow-Headers",corsConfig.headers.join(", ")),corsConfig.credentials&&res.set("Access-Control-Allow-Credentials","true"),corsConfig.maxAge&&res.set("Access-Control-Max-Age",String(corsConfig.maxAge))}}var TRANSPARENT_GIF=Buffer.from("R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7","base64"),sourceExpress=async context=>{var _a,_b,_c;const{config:config={},env:env}=context,expressLib=null!=(_a=env.express)?_a:import_express.default,corsLib=null!=(_b=env.cors)?_b:import_cors.default,parsed=SettingsSchema.parse(config.settings||{}),settings2={...parsed,paths:null!=(_c=parsed.paths)?_c:parsed.path?[parsed.path]:["/collect"]},app=expressLib();if(app.use(expressLib.json({limit:"1mb"})),!1!==settings2.cors){const corsOptions=!0===settings2.cors?{}:settings2.cors;app.use(corsLib(corsOptions))}const push=async(req,res)=>{try{if("OPTIONS"===req.method)return setCorsHeaders(res,settings2.cors),void res.status(204).send();await context.setIngest(req);const respond=(0,import_core.createRespond)(options=>{var _a2;const status=null!=(_a2=options.status)?_a2:200;if(options.headers)for(const[key,value]of Object.entries(options.headers))res.set(key,value);res.status(status),"string"==typeof options.body||Buffer.isBuffer(options.body)?res.send(options.body):res.json(options.body)});if(context.setRespond(respond),"GET"===req.method){const parsedData=(0,import_core.requestToData)(req.url);return parsedData&&"object"==typeof parsedData&&await env.push(parsedData),void respond({body:TRANSPARENT_GIF,headers:{"Content-Type":"image/gif","Cache-Control":"no-cache, no-store, must-revalidate"}})}if("POST"===req.method){const eventData=req.body;return eventData&&"object"==typeof eventData?(await env.push(eventData),void respond({body:{success:!0,timestamp:Date.now()}})):void res.status(400).json({success:!1,error:"Invalid event: body must be an object"})}res.status(405).json({success:!1,error:"Method not allowed. Use POST, GET, or OPTIONS."})}catch(error){res.status(500).json({success:!1,error:error instanceof Error?error.message:"Internal server error"})}},resolvedPaths=settings2.paths.map(entry=>"string"==typeof entry?{path:entry,methods:["GET","POST"]}:{path:entry.path,methods:entry.methods||["GET","POST"]});for(const route of resolvedPaths)route.methods.includes("POST")&&app.post(route.path,push),route.methods.includes("GET")&&app.get(route.path,push),app.options(route.path,push);let server;void 0!==settings2.port&&(server=app.listen(settings2.port,()=>{const routeLines=resolvedPaths.map(r=>`   ${[...r.methods,"OPTIONS"].join(", ")} ${r.path}`).join("\n");env.logger.info(`Express source listening on port ${settings2.port}\n`+routeLines)}));return{type:"express",config:{...config,settings:settings2},push:push,httpHandler:app,app:app,server:server,destroy:_context=>new Promise((resolve,reject)=>{if(!server)return resolve();server.close(err=>err?reject(err):resolve())})}},index_default=sourceExpress;//# sourceMappingURL=index.js.map
+"use strict";var mod,__create=Object.create,__defProp=Object.defineProperty,__getOwnPropDesc=Object.getOwnPropertyDescriptor,__getOwnPropNames=Object.getOwnPropertyNames,__getProtoOf=Object.getPrototypeOf,__hasOwnProp=Object.prototype.hasOwnProperty,__copyProps=(to,from,except,desc)=>{if(from&&"object"==typeof from||"function"==typeof from)for(let key of __getOwnPropNames(from))__hasOwnProp.call(to,key)||key===except||__defProp(to,key,{get:()=>from[key],enumerable:!(desc=__getOwnPropDesc(from,key))||desc.enumerable});return to},__toESM=(mod,isNodeMode,target)=>(target=null!=mod?__create(__getProtoOf(mod)):{},__copyProps(!isNodeMode&&mod&&mod.__esModule?target:__defProp(target,"default",{value:mod,enumerable:!0}),mod)),index_exports={};((target,all)=>{for(var name in all)__defProp(target,name,{get:all[name],enumerable:!0})})(index_exports,{TRANSPARENT_GIF:()=>TRANSPARENT_GIF,default:()=>index_default,setCorsHeaders:()=>setCorsHeaders,sourceExpress:()=>sourceExpress}),module.exports=(mod=index_exports,__copyProps(__defProp({},"__esModule",{value:!0}),mod));var import_express=__toESM(require("express")),import_cors=__toESM(require("cors")),import_core=require("@walkeros/core"),import_dev3=require("@walkeros/core/dev"),import_dev2=require("@walkeros/core/dev"),import_dev=require("@walkeros/core/dev"),HttpMethod=import_dev.z.enum(["GET","POST","PUT","PATCH","DELETE","OPTIONS","HEAD"]),RouteMethod=import_dev.z.enum(["GET","POST"]),RouteConfigSchema=import_dev.z.object({path:import_dev.z.string().describe("Express route path (supports wildcards like /api/*)"),methods:import_dev.z.array(RouteMethod).min(1).describe("HTTP methods to register. OPTIONS always included for CORS.").optional()}),CorsOrigin=import_dev.z.union([import_dev.z.string(),import_dev.z.array(import_dev.z.string()),import_dev.z.literal("*")]),CorsOptionsSchema=import_dev.z.object({origin:CorsOrigin.describe("Allowed origins (* for all, URL string, or array of URLs)").optional(),methods:import_dev.z.array(HttpMethod).describe("Allowed HTTP methods").optional(),headers:import_dev.z.array(import_dev.z.string()).describe("Allowed request headers").optional(),credentials:import_dev.z.boolean().describe("Allow credentials (cookies, authorization headers)").optional(),maxAge:import_dev.z.number().int().positive().describe("Preflight cache duration in seconds").optional()}),SettingsSchema=import_dev2.z.object({port:import_dev2.z.number().int().min(0).max(65535).describe("HTTP server port to listen on. Use 0 for random available port. If not provided, server will not start (app only mode)").optional(),path:import_dev2.z.string().describe("Deprecated: use paths instead").optional(),paths:import_dev2.z.array(import_dev2.z.union([import_dev2.z.string(),RouteConfigSchema])).min(1).describe("Route paths to register. String shorthand registers GET+POST. RouteConfig allows per-route method control.").optional(),cors:import_dev2.z.union([import_dev2.z.boolean(),CorsOptionsSchema]).describe("CORS configuration: false = disabled, true = allow all origins (default), object = custom configuration").default(!0)});(0,import_dev3.zodToSchema)(SettingsSchema);function setCorsHeaders(res,corsConfig=!0){if(!1!==corsConfig)if(!0===corsConfig)res.set("Access-Control-Allow-Origin","*"),res.set("Access-Control-Allow-Methods","GET, POST, OPTIONS"),res.set("Access-Control-Allow-Headers","Content-Type");else{if(corsConfig.origin){const origin=Array.isArray(corsConfig.origin)?corsConfig.origin.join(", "):corsConfig.origin;res.set("Access-Control-Allow-Origin",origin)}corsConfig.methods&&res.set("Access-Control-Allow-Methods",corsConfig.methods.join(", ")),corsConfig.headers&&res.set("Access-Control-Allow-Headers",corsConfig.headers.join(", ")),corsConfig.credentials&&res.set("Access-Control-Allow-Credentials","true"),corsConfig.maxAge&&res.set("Access-Control-Max-Age",String(corsConfig.maxAge))}}var TRANSPARENT_GIF=Buffer.from("R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7","base64"),sourceExpress=async context=>{var _a,_b,_c;const{config:config={},env:env}=context,expressLib=null!=(_a=env.express)?_a:import_express.default,corsLib=null!=(_b=env.cors)?_b:import_cors.default,parsed=SettingsSchema.parse(config.settings||{}),settings2={...parsed,paths:null!=(_c=parsed.paths)?_c:parsed.path?[parsed.path]:["/collect"]},app=expressLib();if(app.use(expressLib.json({limit:"1mb"})),app.use(expressLib.text({limit:"1mb"})),!1!==settings2.cors){const corsOptions=!0===settings2.cors?{}:settings2.cors;app.use(corsLib(corsOptions))}const push=async(req,res)=>{try{if("OPTIONS"===req.method)return setCorsHeaders(res,settings2.cors),void res.status(204).send();await context.setIngest(req);const respond=(0,import_core.createRespond)(options=>{var _a2;const status=null!=(_a2=options.status)?_a2:200;if(options.headers)for(const[key,value]of Object.entries(options.headers))res.set(key,value);res.status(status),"string"==typeof options.body||Buffer.isBuffer(options.body)?res.send(options.body):res.json(options.body)});if(context.setRespond(respond),"GET"===req.method){const parsedData=(0,import_core.requestToData)(req.url);return parsedData&&"object"==typeof parsedData&&await env.push(parsedData),void respond({body:TRANSPARENT_GIF,headers:{"Content-Type":"image/gif","Cache-Control":"no-cache, no-store, must-revalidate"}})}if("POST"===req.method){const eventData=req.body&&"object"==typeof req.body?req.body:{};return await env.push(eventData),void respond({body:{success:!0,timestamp:Date.now()}})}res.status(405).json({success:!1,error:"Method not allowed. Use POST, GET, or OPTIONS."})}catch(error){res.status(500).json({success:!1,error:error instanceof Error?error.message:"Internal server error"})}},resolvedPaths=settings2.paths.map(entry=>"string"==typeof entry?{path:entry,methods:["GET","POST"]}:{path:entry.path,methods:entry.methods||["GET","POST"]});for(const route of resolvedPaths)route.methods.includes("POST")&&app.post(route.path,push),route.methods.includes("GET")&&app.get(route.path,push),app.options(route.path,push);let server;void 0!==settings2.port&&(server=app.listen(settings2.port,()=>{const routeLines=resolvedPaths.map(r=>`   ${[...r.methods,"OPTIONS"].join(", ")} ${r.path}`).join("\n");env.logger.info(`Express source listening on port ${settings2.port}\n`+routeLines)}));return{type:"express",config:{...config,settings:settings2},push:push,httpHandler:app,app:app,server:server,destroy:_context=>new Promise((resolve,reject)=>{if(!server)return resolve();server.close(err=>err?reject(err):resolve())})}},index_default=sourceExpress;//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/schemas/index.ts","../src/schemas/settings.ts","../src/schemas/primitives.ts","../src/utils.ts"],"sourcesContent":["import express, { type Request, type Response } from 'express';\nimport cors from 'cors';\nimport { requestToData, createRespond } from '@walkeros/core';\nimport type { Source } from '@walkeros/core';\nimport type { ExpressSource, Types, EventRequest } from './types';\nimport { SettingsSchema } from './schemas';\nimport { setCorsHeaders, TRANSPARENT_GIF } from './utils';\n\n/**\n * Express source initialization\n *\n * This source OWNS its HTTP server infrastructure:\n * - Creates Express application\n * - Sets up middleware (JSON parsing, CORS)\n * - Registers event collection endpoints (POST, GET, OPTIONS)\n * - Starts HTTP server (if port configured)\n * - Provides destroy() for graceful shutdown (called by runner)\n *\n * @param context Source context with config, env, logger, id\n * @returns Express source instance with app and push handler\n */\nexport const sourceExpress = async (\n  context: Source.Context<Types>,\n): Promise<ExpressSource> => {\n  const { config = {}, env } = context;\n  const expressLib = env.express ?? express;\n  const corsLib = env.cors ?? cors;\n\n  // Validate and apply default settings\n  const parsed = SettingsSchema.parse(config.settings || {});\n  const settings = {\n    ...parsed,\n    paths: parsed.paths ?? (parsed.path ? [parsed.path] : ['/collect']),\n  };\n\n  const app = expressLib();\n\n  // Middleware setup - JSON body parsing with 10mb default limit\n  app.use(expressLib.json({ limit: '1mb' }));\n\n  // CORS middleware (enabled by default)\n  if (settings.cors !== false) {\n    const corsOptions = settings.cors === true ? {} : settings.cors;\n    app.use(corsLib(corsOptions));\n  }\n\n  /**\n   * Request handler - transforms HTTP requests into walker events\n   * Supports POST (JSON body), GET (query params), and OPTIONS (CORS preflight)\n   */\n  const push = async (req: Request, res: Response): Promise<void> => {\n    try {\n      // Handle OPTIONS for CORS preflight\n      if (req.method === 'OPTIONS') {\n        setCorsHeaders(res, settings.cors);\n        res.status(204).send();\n        return;\n      }\n\n      // Extract ingest metadata from request (if config.ingest is defined)\n      await context.setIngest(req);\n\n      // Create per-request respond — first call wins (idempotent)\n      const respond = createRespond((options) => {\n        const status = options.status ?? 200;\n        if (options.headers) {\n          for (const [key, value] of Object.entries(options.headers)) {\n            res.set(key, value);\n          }\n        }\n        res.status(status);\n        if (typeof options.body === 'string' || Buffer.isBuffer(options.body)) {\n          res.send(options.body);\n        } else {\n          res.json(options.body);\n        }\n      });\n      context.setRespond(respond);\n\n      // Handle GET requests (pixel tracking)\n      if (req.method === 'GET') {\n        // Parse query parameters to event data using requestToData\n        const parsedData = requestToData(req.url);\n\n        // Send to collector\n        if (parsedData && typeof parsedData === 'object') {\n          await env.push(parsedData);\n        }\n\n        // Default: 1x1 GIF (skipped if a step already called respond)\n        respond({\n          body: TRANSPARENT_GIF,\n          headers: {\n            'Content-Type': 'image/gif',\n            'Cache-Control': 'no-cache, no-store, must-revalidate',\n          },\n        });\n        return;\n      }\n\n      // Handle POST requests (standard event ingestion)\n      if (req.method === 'POST') {\n        const eventData = req.body;\n\n        if (!eventData || typeof eventData !== 'object') {\n          res.status(400).json({\n            success: false,\n            error: 'Invalid event: body must be an object',\n          });\n          return;\n        }\n\n        // Send event to collector\n        await env.push(eventData);\n\n        // Default: JSON success (skipped if a step already called respond)\n        respond({ body: { success: true, timestamp: Date.now() } });\n        return;\n      }\n\n      // Unsupported method\n      res.status(405).json({\n        success: false,\n        error: 'Method not allowed. Use POST, GET, or OPTIONS.',\n      });\n    } catch (error) {\n      res.status(500).json({\n        success: false,\n        error: error instanceof Error ? error.message : 'Internal server error',\n      });\n    }\n  };\n\n  // Register handlers per route config\n  const resolvedPaths = settings.paths.map((entry) =>\n    typeof entry === 'string'\n      ? { path: entry, methods: ['GET', 'POST'] as const }\n      : {\n          path: entry.path,\n          methods: entry.methods || (['GET', 'POST'] as const),\n        },\n  );\n\n  for (const route of resolvedPaths) {\n    if (route.methods.includes('POST')) app.post(route.path, push);\n    if (route.methods.includes('GET')) app.get(route.path, push);\n    app.options(route.path, push); // Always register OPTIONS for CORS\n  }\n\n  // Source owns the HTTP server (if port configured)\n  let server: ReturnType<typeof app.listen> | undefined;\n\n  if (settings.port !== undefined) {\n    server = app.listen(settings.port, () => {\n      const routeLines = resolvedPaths\n        .map((r) => {\n          const methods = [...r.methods, 'OPTIONS'].join(', ');\n          return `   ${methods} ${r.path}`;\n        })\n        .join('\\n');\n      env.logger.info(\n        `Express source listening on port ${settings.port}\\n` + routeLines,\n      );\n    });\n  }\n\n  const instance: ExpressSource = {\n    type: 'express',\n    config: {\n      ...config,\n      settings,\n    },\n    push,\n    httpHandler: app,\n    app,\n    server,\n    destroy: (_context) =>\n      new Promise<void>((resolve, reject) => {\n        if (!server) return resolve();\n        server.close((err) => (err ? reject(err) : resolve()));\n      }),\n  };\n\n  return instance;\n};\n\n// Export types (avoid re-exporting duplicates from schemas)\nexport type {\n  ExpressSource,\n  Config,\n  PartialConfig,\n  Types,\n  EventRequest,\n  EventResponse,\n  RequestBody,\n  ResponseBody,\n  Push,\n  Env,\n  Mapping,\n  InitSettings,\n  Settings,\n  RouteConfig,\n  RouteMethod,\n} from './types';\n\n// Export utils\nexport { setCorsHeaders, TRANSPARENT_GIF } from './utils';\n\nexport default sourceExpress;\n","import { zodToSchema } from '@walkeros/core/dev';\nimport { SettingsSchema } from './settings';\n\nexport * from './primitives';\nexport { SettingsSchema, type Settings } from './settings';\n\n// JSON Schema\nexport const settings = zodToSchema(SettingsSchema);\n","import { z } from '@walkeros/core/dev';\nimport { CorsOptionsSchema, RouteConfigSchema } from './primitives';\n\n/**\n * Express source settings schema.\n */\nexport const SettingsSchema = z.object({\n  port: z\n    .number()\n    .int()\n    .min(0)\n    .max(65535)\n    .describe(\n      'HTTP server port to listen on. Use 0 for random available port. If not provided, server will not start (app only mode)',\n    )\n    .optional(),\n\n  /** @deprecated Use `paths` instead */\n  path: z.string().describe('Deprecated: use paths instead').optional(),\n\n  paths: z\n    .array(z.union([z.string(), RouteConfigSchema]))\n    .min(1)\n    .describe(\n      'Route paths to register. String shorthand registers GET+POST. RouteConfig allows per-route method control.',\n    )\n    .optional(),\n\n  cors: z\n    .union([z.boolean(), CorsOptionsSchema])\n    .describe(\n      'CORS configuration: false = disabled, true = allow all origins (default), object = custom configuration',\n    )\n    .default(true),\n});\n\nexport type Settings = z.infer<typeof SettingsSchema>;\n","import { z } from '@walkeros/core/dev';\n\n/**\n * HTTP methods enum\n */\nexport const HttpMethod = z.enum([\n  'GET',\n  'POST',\n  'PUT',\n  'PATCH',\n  'DELETE',\n  'OPTIONS',\n  'HEAD',\n]);\n\n/**\n * HTTP methods supported for route configuration.\n * OPTIONS is always registered for CORS (not user-configurable per route).\n */\nexport const RouteMethod = z.enum(['GET', 'POST']);\n\n/**\n * Route configuration for multi-path support.\n */\nexport const RouteConfigSchema = z.object({\n  path: z\n    .string()\n    .describe('Express route path (supports wildcards like /api/*)'),\n  methods: z\n    .array(RouteMethod)\n    .min(1)\n    .describe('HTTP methods to register. OPTIONS always included for CORS.')\n    .optional(),\n});\n\n/**\n * CORS origin configuration\n * Accepts:\n * - '*' for all origins\n * - Single URL string\n * - Array of URL strings\n */\nexport const CorsOrigin = z.union([\n  z.string(),\n  z.array(z.string()),\n  z.literal('*'),\n]);\n\n/**\n * CORS options schema\n * Configuration for Cross-Origin Resource Sharing\n */\nexport const CorsOptionsSchema = z.object({\n  origin: CorsOrigin.describe(\n    'Allowed origins (* for all, URL string, or array of URLs)',\n  ).optional(),\n\n  methods: z.array(HttpMethod).describe('Allowed HTTP methods').optional(),\n\n  headers: z.array(z.string()).describe('Allowed request headers').optional(),\n\n  credentials: z\n    .boolean()\n    .describe('Allow credentials (cookies, authorization headers)')\n    .optional(),\n\n  maxAge: z\n    .number()\n    .int()\n    .positive()\n    .describe('Preflight cache duration in seconds')\n    .optional(),\n});\n\nexport type CorsOptions = z.infer<typeof CorsOptionsSchema>;\n","import type { Response } from 'express';\nimport type { CorsOptions } from './schemas';\n\n/**\n * Set CORS headers on response\n *\n * @param res Express response object\n * @param corsConfig CORS configuration (false = disabled, true = allow all, object = custom)\n */\nexport function setCorsHeaders(\n  res: Response,\n  corsConfig: boolean | CorsOptions = true,\n): void {\n  if (corsConfig === false) return;\n\n  if (corsConfig === true) {\n    // Simple CORS - allow all\n    res.set('Access-Control-Allow-Origin', '*');\n    res.set('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');\n    res.set('Access-Control-Allow-Headers', 'Content-Type');\n  } else {\n    // Custom CORS configuration\n    if (corsConfig.origin) {\n      const origin = Array.isArray(corsConfig.origin)\n        ? corsConfig.origin.join(', ')\n        : corsConfig.origin;\n      res.set('Access-Control-Allow-Origin', origin);\n    }\n\n    if (corsConfig.methods) {\n      res.set('Access-Control-Allow-Methods', corsConfig.methods.join(', '));\n    }\n\n    if (corsConfig.headers) {\n      res.set('Access-Control-Allow-Headers', corsConfig.headers.join(', '));\n    }\n\n    if (corsConfig.credentials) {\n      res.set('Access-Control-Allow-Credentials', 'true');\n    }\n\n    if (corsConfig.maxAge) {\n      res.set('Access-Control-Max-Age', String(corsConfig.maxAge));\n    }\n  }\n}\n\n/**\n * 1x1 transparent GIF for pixel tracking\n * Base64-encoded GIF (43 bytes)\n */\nexport const TRANSPARENT_GIF = Buffer.from(\n  'R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7',\n  'base64',\n);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAAqD;AACrD,kBAAiB;AACjB,kBAA6C;;;ACF7C,IAAAA,cAA4B;;;ACA5B,IAAAC,cAAkB;;;ACAlB,iBAAkB;AAKX,IAAM,aAAa,aAAE,KAAK;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,cAAc,aAAE,KAAK,CAAC,OAAO,MAAM,CAAC;AAK1C,IAAM,oBAAoB,aAAE,OAAO;AAAA,EACxC,MAAM,aACH,OAAO,EACP,SAAS,qDAAqD;AAAA,EACjE,SAAS,aACN,MAAM,WAAW,EACjB,IAAI,CAAC,EACL,SAAS,6DAA6D,EACtE,SAAS;AACd,CAAC;AASM,IAAM,aAAa,aAAE,MAAM;AAAA,EAChC,aAAE,OAAO;AAAA,EACT,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,EAClB,aAAE,QAAQ,GAAG;AACf,CAAC;AAMM,IAAM,oBAAoB,aAAE,OAAO;AAAA,EACxC,QAAQ,WAAW;AAAA,IACjB;AAAA,EACF,EAAE,SAAS;AAAA,EAEX,SAAS,aAAE,MAAM,UAAU,EAAE,SAAS,sBAAsB,EAAE,SAAS;AAAA,EAEvE,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS,yBAAyB,EAAE,SAAS;AAAA,EAE1E,aAAa,aACV,QAAQ,EACR,SAAS,oDAAoD,EAC7D,SAAS;AAAA,EAEZ,QAAQ,aACL,OAAO,EACP,IAAI,EACJ,SAAS,EACT,SAAS,qCAAqC,EAC9C,SAAS;AACd,CAAC;;;ADlEM,IAAM,iBAAiB,cAAE,OAAO;AAAA,EACrC,MAAM,cACH,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,KAAK,EACT;AAAA,IACC;AAAA,EACF,EACC,SAAS;AAAA;AAAA,EAGZ,MAAM,cAAE,OAAO,EAAE,SAAS,+BAA+B,EAAE,SAAS;AAAA,EAEpE,OAAO,cACJ,MAAM,cAAE,MAAM,CAAC,cAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC,EAC9C,IAAI,CAAC,EACL;AAAA,IACC;AAAA,EACF,EACC,SAAS;AAAA,EAEZ,MAAM,cACH,MAAM,CAAC,cAAE,QAAQ,GAAG,iBAAiB,CAAC,EACtC;AAAA,IACC;AAAA,EACF,EACC,QAAQ,IAAI;AACjB,CAAC;;;AD3BM,IAAM,eAAW,yBAAY,cAAc;;;AGE3C,SAAS,eACd,KACA,aAAoC,MAC9B;AACN,MAAI,eAAe,MAAO;AAE1B,MAAI,eAAe,MAAM;AAEvB,QAAI,IAAI,+BAA+B,GAAG;AAC1C,QAAI,IAAI,gCAAgC,oBAAoB;AAC5D,QAAI,IAAI,gCAAgC,cAAc;AAAA,EACxD,OAAO;AAEL,QAAI,WAAW,QAAQ;AACrB,YAAM,SAAS,MAAM,QAAQ,WAAW,MAAM,IAC1C,WAAW,OAAO,KAAK,IAAI,IAC3B,WAAW;AACf,UAAI,IAAI,+BAA+B,MAAM;AAAA,IAC/C;AAEA,QAAI,WAAW,SAAS;AACtB,UAAI,IAAI,gCAAgC,WAAW,QAAQ,KAAK,IAAI,CAAC;AAAA,IACvE;AAEA,QAAI,WAAW,SAAS;AACtB,UAAI,IAAI,gCAAgC,WAAW,QAAQ,KAAK,IAAI,CAAC;AAAA,IACvE;AAEA,QAAI,WAAW,aAAa;AAC1B,UAAI,IAAI,oCAAoC,MAAM;AAAA,IACpD;AAEA,QAAI,WAAW,QAAQ;AACrB,UAAI,IAAI,0BAA0B,OAAO,WAAW,MAAM,CAAC;AAAA,IAC7D;AAAA,EACF;AACF;AAMO,IAAM,kBAAkB,OAAO;AAAA,EACpC;AAAA,EACA;AACF;;;AJjCO,IAAM,gBAAgB,OAC3B,YAC2B;AAvB7B;AAwBE,QAAM,EAAE,SAAS,CAAC,GAAG,IAAI,IAAI;AAC7B,QAAM,cAAa,SAAI,YAAJ,YAAe,eAAAC;AAClC,QAAM,WAAU,SAAI,SAAJ,YAAY,YAAAC;AAG5B,QAAM,SAAS,eAAe,MAAM,OAAO,YAAY,CAAC,CAAC;AACzD,QAAMC,YAAW;AAAA,IACf,GAAG;AAAA,IACH,QAAO,YAAO,UAAP,YAAiB,OAAO,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU;AAAA,EACnE;AAEA,QAAM,MAAM,WAAW;AAGvB,MAAI,IAAI,WAAW,KAAK,EAAE,OAAO,MAAM,CAAC,CAAC;AAGzC,MAAIA,UAAS,SAAS,OAAO;AAC3B,UAAM,cAAcA,UAAS,SAAS,OAAO,CAAC,IAAIA,UAAS;AAC3D,QAAI,IAAI,QAAQ,WAAW,CAAC;AAAA,EAC9B;AAMA,QAAM,OAAO,OAAO,KAAc,QAAiC;AACjE,QAAI;AAEF,UAAI,IAAI,WAAW,WAAW;AAC5B,uBAAe,KAAKA,UAAS,IAAI;AACjC,YAAI,OAAO,GAAG,EAAE,KAAK;AACrB;AAAA,MACF;AAGA,YAAM,QAAQ,UAAU,GAAG;AAG3B,YAAM,cAAU,2BAAc,CAAC,YAAY;AA/DjD,YAAAC;AAgEQ,cAAM,UAASA,MAAA,QAAQ,WAAR,OAAAA,MAAkB;AACjC,YAAI,QAAQ,SAAS;AACnB,qBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,gBAAI,IAAI,KAAK,KAAK;AAAA,UACpB;AAAA,QACF;AACA,YAAI,OAAO,MAAM;AACjB,YAAI,OAAO,QAAQ,SAAS,YAAY,OAAO,SAAS,QAAQ,IAAI,GAAG;AACrE,cAAI,KAAK,QAAQ,IAAI;AAAA,QACvB,OAAO;AACL,cAAI,KAAK,QAAQ,IAAI;AAAA,QACvB;AAAA,MACF,CAAC;AACD,cAAQ,WAAW,OAAO;AAG1B,UAAI,IAAI,WAAW,OAAO;AAExB,cAAM,iBAAa,2BAAc,IAAI,GAAG;AAGxC,YAAI,cAAc,OAAO,eAAe,UAAU;AAChD,gBAAM,IAAI,KAAK,UAAU;AAAA,QAC3B;AAGA,gBAAQ;AAAA,UACN,MAAM;AAAA,UACN,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,iBAAiB;AAAA,UACnB;AAAA,QACF,CAAC;AACD;AAAA,MACF;AAGA,UAAI,IAAI,WAAW,QAAQ;AACzB,cAAM,YAAY,IAAI;AAEtB,YAAI,CAAC,aAAa,OAAO,cAAc,UAAU;AAC/C,cAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACnB,SAAS;AAAA,YACT,OAAO;AAAA,UACT,CAAC;AACD;AAAA,QACF;AAGA,cAAM,IAAI,KAAK,SAAS;AAGxB,gBAAQ,EAAE,MAAM,EAAE,SAAS,MAAM,WAAW,KAAK,IAAI,EAAE,EAAE,CAAC;AAC1D;AAAA,MACF;AAGA,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,SAAS;AAAA,QACT,OAAO;AAAA,MACT,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,SAAS;AAAA,QACT,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MAClD,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,gBAAgBD,UAAS,MAAM;AAAA,IAAI,CAAC,UACxC,OAAO,UAAU,WACb,EAAE,MAAM,OAAO,SAAS,CAAC,OAAO,MAAM,EAAW,IACjD;AAAA,MACE,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM,WAAY,CAAC,OAAO,MAAM;AAAA,IAC3C;AAAA,EACN;AAEA,aAAW,SAAS,eAAe;AACjC,QAAI,MAAM,QAAQ,SAAS,MAAM,EAAG,KAAI,KAAK,MAAM,MAAM,IAAI;AAC7D,QAAI,MAAM,QAAQ,SAAS,KAAK,EAAG,KAAI,IAAI,MAAM,MAAM,IAAI;AAC3D,QAAI,QAAQ,MAAM,MAAM,IAAI;AAAA,EAC9B;AAGA,MAAI;AAEJ,MAAIA,UAAS,SAAS,QAAW;AAC/B,aAAS,IAAI,OAAOA,UAAS,MAAM,MAAM;AACvC,YAAM,aAAa,cAChB,IAAI,CAAC,MAAM;AACV,cAAM,UAAU,CAAC,GAAG,EAAE,SAAS,SAAS,EAAE,KAAK,IAAI;AACnD,eAAO,MAAM,OAAO,IAAI,EAAE,IAAI;AAAA,MAChC,CAAC,EACA,KAAK,IAAI;AACZ,UAAI,OAAO;AAAA,QACT,oCAAoCA,UAAS,IAAI;AAAA,IAAO;AAAA,MAC1D;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,WAA0B;AAAA,IAC9B,MAAM;AAAA,IACN,QAAQ;AAAA,MACN,GAAG;AAAA,MACH,UAAAA;AAAA,IACF;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA,SAAS,CAAC,aACR,IAAI,QAAc,CAAC,SAAS,WAAW;AACrC,UAAI,CAAC,OAAQ,QAAO,QAAQ;AAC5B,aAAO,MAAM,CAAC,QAAS,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAE;AAAA,IACvD,CAAC;AAAA,EACL;AAEA,SAAO;AACT;AAwBA,IAAO,gBAAQ;","names":["import_dev","import_dev","express","cors","settings","_a"]}
+{"version":3,"sources":["../src/index.ts","../src/schemas/index.ts","../src/schemas/settings.ts","../src/schemas/primitives.ts","../src/utils.ts"],"sourcesContent":["import express, { type Request, type Response } from 'express';\nimport cors from 'cors';\nimport { requestToData, createRespond } from '@walkeros/core';\nimport type { Source } from '@walkeros/core';\nimport type { ExpressSource, Types, EventRequest } from './types';\nimport { SettingsSchema } from './schemas';\nimport { setCorsHeaders, TRANSPARENT_GIF } from './utils';\n\n/**\n * Express source initialization\n *\n * This source OWNS its HTTP server infrastructure:\n * - Creates Express application\n * - Sets up middleware (JSON parsing, CORS)\n * - Registers event collection endpoints (POST, GET, OPTIONS)\n * - Starts HTTP server (if port configured)\n * - Provides destroy() for graceful shutdown (called by runner)\n *\n * @param context Source context with config, env, logger, id\n * @returns Express source instance with app and push handler\n */\nexport const sourceExpress = async (\n  context: Source.Context<Types>,\n): Promise<ExpressSource> => {\n  const { config = {}, env } = context;\n  const expressLib = env.express ?? express;\n  const corsLib = env.cors ?? cors;\n\n  // Validate and apply default settings\n  const parsed = SettingsSchema.parse(config.settings || {});\n  const settings = {\n    ...parsed,\n    paths: parsed.paths ?? (parsed.path ? [parsed.path] : ['/collect']),\n  };\n\n  const app = expressLib();\n\n  // Middleware setup - JSON body parsing with 10mb default limit\n  app.use(expressLib.json({ limit: '1mb' }));\n  app.use(expressLib.text({ limit: '1mb' }));\n\n  // CORS middleware (enabled by default)\n  if (settings.cors !== false) {\n    const corsOptions = settings.cors === true ? {} : settings.cors;\n    app.use(corsLib(corsOptions));\n  }\n\n  /**\n   * Request handler - transforms HTTP requests into walker events\n   * Supports POST (JSON body), GET (query params), and OPTIONS (CORS preflight)\n   */\n  const push = async (req: Request, res: Response): Promise<void> => {\n    try {\n      // Handle OPTIONS for CORS preflight\n      if (req.method === 'OPTIONS') {\n        setCorsHeaders(res, settings.cors);\n        res.status(204).send();\n        return;\n      }\n\n      // Extract ingest metadata from request (if config.ingest is defined)\n      await context.setIngest(req);\n\n      // Create per-request respond — first call wins (idempotent)\n      const respond = createRespond((options) => {\n        const status = options.status ?? 200;\n        if (options.headers) {\n          for (const [key, value] of Object.entries(options.headers)) {\n            res.set(key, value);\n          }\n        }\n        res.status(status);\n        if (typeof options.body === 'string' || Buffer.isBuffer(options.body)) {\n          res.send(options.body);\n        } else {\n          res.json(options.body);\n        }\n      });\n      context.setRespond(respond);\n\n      // Handle GET requests (pixel tracking)\n      if (req.method === 'GET') {\n        // Parse query parameters to event data using requestToData\n        const parsedData = requestToData(req.url);\n\n        // Send to collector\n        if (parsedData && typeof parsedData === 'object') {\n          await env.push(parsedData);\n        }\n\n        // Default: 1x1 GIF (skipped if a step already called respond)\n        respond({\n          body: TRANSPARENT_GIF,\n          headers: {\n            'Content-Type': 'image/gif',\n            'Cache-Control': 'no-cache, no-store, must-revalidate',\n          },\n        });\n        return;\n      }\n\n      // Handle POST requests (standard event ingestion)\n      if (req.method === 'POST') {\n        const eventData =\n          req.body && typeof req.body === 'object' ? req.body : {};\n\n        await env.push(eventData);\n\n        respond({ body: { success: true, timestamp: Date.now() } });\n        return;\n      }\n\n      // Unsupported method\n      res.status(405).json({\n        success: false,\n        error: 'Method not allowed. Use POST, GET, or OPTIONS.',\n      });\n    } catch (error) {\n      res.status(500).json({\n        success: false,\n        error: error instanceof Error ? error.message : 'Internal server error',\n      });\n    }\n  };\n\n  // Register handlers per route config\n  const resolvedPaths = settings.paths.map((entry) =>\n    typeof entry === 'string'\n      ? { path: entry, methods: ['GET', 'POST'] as const }\n      : {\n          path: entry.path,\n          methods: entry.methods || (['GET', 'POST'] as const),\n        },\n  );\n\n  for (const route of resolvedPaths) {\n    if (route.methods.includes('POST')) app.post(route.path, push);\n    if (route.methods.includes('GET')) app.get(route.path, push);\n    app.options(route.path, push); // Always register OPTIONS for CORS\n  }\n\n  // Source owns the HTTP server (if port configured)\n  let server: ReturnType<typeof app.listen> | undefined;\n\n  if (settings.port !== undefined) {\n    server = app.listen(settings.port, () => {\n      const routeLines = resolvedPaths\n        .map((r) => {\n          const methods = [...r.methods, 'OPTIONS'].join(', ');\n          return `   ${methods} ${r.path}`;\n        })\n        .join('\\n');\n      env.logger.info(\n        `Express source listening on port ${settings.port}\\n` + routeLines,\n      );\n    });\n  }\n\n  const instance: ExpressSource = {\n    type: 'express',\n    config: {\n      ...config,\n      settings,\n    },\n    push,\n    httpHandler: app,\n    app,\n    server,\n    destroy: (_context) =>\n      new Promise<void>((resolve, reject) => {\n        if (!server) return resolve();\n        server.close((err) => (err ? reject(err) : resolve()));\n      }),\n  };\n\n  return instance;\n};\n\n// Export types (avoid re-exporting duplicates from schemas)\nexport type {\n  ExpressSource,\n  Config,\n  PartialConfig,\n  Types,\n  EventRequest,\n  EventResponse,\n  RequestBody,\n  ResponseBody,\n  Push,\n  Env,\n  Mapping,\n  InitSettings,\n  Settings,\n  RouteConfig,\n  RouteMethod,\n} from './types';\n\n// Export utils\nexport { setCorsHeaders, TRANSPARENT_GIF } from './utils';\n\nexport default sourceExpress;\n","import { zodToSchema } from '@walkeros/core/dev';\nimport { SettingsSchema } from './settings';\n\nexport * from './primitives';\nexport { SettingsSchema, type Settings } from './settings';\n\n// JSON Schema\nexport const settings = zodToSchema(SettingsSchema);\n","import { z } from '@walkeros/core/dev';\nimport { CorsOptionsSchema, RouteConfigSchema } from './primitives';\n\n/**\n * Express source settings schema.\n */\nexport const SettingsSchema = z.object({\n  port: z\n    .number()\n    .int()\n    .min(0)\n    .max(65535)\n    .describe(\n      'HTTP server port to listen on. Use 0 for random available port. If not provided, server will not start (app only mode)',\n    )\n    .optional(),\n\n  /** @deprecated Use `paths` instead */\n  path: z.string().describe('Deprecated: use paths instead').optional(),\n\n  paths: z\n    .array(z.union([z.string(), RouteConfigSchema]))\n    .min(1)\n    .describe(\n      'Route paths to register. String shorthand registers GET+POST. RouteConfig allows per-route method control.',\n    )\n    .optional(),\n\n  cors: z\n    .union([z.boolean(), CorsOptionsSchema])\n    .describe(\n      'CORS configuration: false = disabled, true = allow all origins (default), object = custom configuration',\n    )\n    .default(true),\n});\n\nexport type Settings = z.infer<typeof SettingsSchema>;\n","import { z } from '@walkeros/core/dev';\n\n/**\n * HTTP methods enum\n */\nexport const HttpMethod = z.enum([\n  'GET',\n  'POST',\n  'PUT',\n  'PATCH',\n  'DELETE',\n  'OPTIONS',\n  'HEAD',\n]);\n\n/**\n * HTTP methods supported for route configuration.\n * OPTIONS is always registered for CORS (not user-configurable per route).\n */\nexport const RouteMethod = z.enum(['GET', 'POST']);\n\n/**\n * Route configuration for multi-path support.\n */\nexport const RouteConfigSchema = z.object({\n  path: z\n    .string()\n    .describe('Express route path (supports wildcards like /api/*)'),\n  methods: z\n    .array(RouteMethod)\n    .min(1)\n    .describe('HTTP methods to register. OPTIONS always included for CORS.')\n    .optional(),\n});\n\n/**\n * CORS origin configuration\n * Accepts:\n * - '*' for all origins\n * - Single URL string\n * - Array of URL strings\n */\nexport const CorsOrigin = z.union([\n  z.string(),\n  z.array(z.string()),\n  z.literal('*'),\n]);\n\n/**\n * CORS options schema\n * Configuration for Cross-Origin Resource Sharing\n */\nexport const CorsOptionsSchema = z.object({\n  origin: CorsOrigin.describe(\n    'Allowed origins (* for all, URL string, or array of URLs)',\n  ).optional(),\n\n  methods: z.array(HttpMethod).describe('Allowed HTTP methods').optional(),\n\n  headers: z.array(z.string()).describe('Allowed request headers').optional(),\n\n  credentials: z\n    .boolean()\n    .describe('Allow credentials (cookies, authorization headers)')\n    .optional(),\n\n  maxAge: z\n    .number()\n    .int()\n    .positive()\n    .describe('Preflight cache duration in seconds')\n    .optional(),\n});\n\nexport type CorsOptions = z.infer<typeof CorsOptionsSchema>;\n","import type { Response } from 'express';\nimport type { CorsOptions } from './schemas';\n\n/**\n * Set CORS headers on response\n *\n * @param res Express response object\n * @param corsConfig CORS configuration (false = disabled, true = allow all, object = custom)\n */\nexport function setCorsHeaders(\n  res: Response,\n  corsConfig: boolean | CorsOptions = true,\n): void {\n  if (corsConfig === false) return;\n\n  if (corsConfig === true) {\n    // Simple CORS - allow all\n    res.set('Access-Control-Allow-Origin', '*');\n    res.set('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');\n    res.set('Access-Control-Allow-Headers', 'Content-Type');\n  } else {\n    // Custom CORS configuration\n    if (corsConfig.origin) {\n      const origin = Array.isArray(corsConfig.origin)\n        ? corsConfig.origin.join(', ')\n        : corsConfig.origin;\n      res.set('Access-Control-Allow-Origin', origin);\n    }\n\n    if (corsConfig.methods) {\n      res.set('Access-Control-Allow-Methods', corsConfig.methods.join(', '));\n    }\n\n    if (corsConfig.headers) {\n      res.set('Access-Control-Allow-Headers', corsConfig.headers.join(', '));\n    }\n\n    if (corsConfig.credentials) {\n      res.set('Access-Control-Allow-Credentials', 'true');\n    }\n\n    if (corsConfig.maxAge) {\n      res.set('Access-Control-Max-Age', String(corsConfig.maxAge));\n    }\n  }\n}\n\n/**\n * 1x1 transparent GIF for pixel tracking\n * Base64-encoded GIF (43 bytes)\n */\nexport const TRANSPARENT_GIF = Buffer.from(\n  'R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7',\n  'base64',\n);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAAqD;AACrD,kBAAiB;AACjB,kBAA6C;;;ACF7C,IAAAA,cAA4B;;;ACA5B,IAAAC,cAAkB;;;ACAlB,iBAAkB;AAKX,IAAM,aAAa,aAAE,KAAK;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,cAAc,aAAE,KAAK,CAAC,OAAO,MAAM,CAAC;AAK1C,IAAM,oBAAoB,aAAE,OAAO;AAAA,EACxC,MAAM,aACH,OAAO,EACP,SAAS,qDAAqD;AAAA,EACjE,SAAS,aACN,MAAM,WAAW,EACjB,IAAI,CAAC,EACL,SAAS,6DAA6D,EACtE,SAAS;AACd,CAAC;AASM,IAAM,aAAa,aAAE,MAAM;AAAA,EAChC,aAAE,OAAO;AAAA,EACT,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,EAClB,aAAE,QAAQ,GAAG;AACf,CAAC;AAMM,IAAM,oBAAoB,aAAE,OAAO;AAAA,EACxC,QAAQ,WAAW;AAAA,IACjB;AAAA,EACF,EAAE,SAAS;AAAA,EAEX,SAAS,aAAE,MAAM,UAAU,EAAE,SAAS,sBAAsB,EAAE,SAAS;AAAA,EAEvE,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS,yBAAyB,EAAE,SAAS;AAAA,EAE1E,aAAa,aACV,QAAQ,EACR,SAAS,oDAAoD,EAC7D,SAAS;AAAA,EAEZ,QAAQ,aACL,OAAO,EACP,IAAI,EACJ,SAAS,EACT,SAAS,qCAAqC,EAC9C,SAAS;AACd,CAAC;;;ADlEM,IAAM,iBAAiB,cAAE,OAAO;AAAA,EACrC,MAAM,cACH,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,KAAK,EACT;AAAA,IACC;AAAA,EACF,EACC,SAAS;AAAA;AAAA,EAGZ,MAAM,cAAE,OAAO,EAAE,SAAS,+BAA+B,EAAE,SAAS;AAAA,EAEpE,OAAO,cACJ,MAAM,cAAE,MAAM,CAAC,cAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC,EAC9C,IAAI,CAAC,EACL;AAAA,IACC;AAAA,EACF,EACC,SAAS;AAAA,EAEZ,MAAM,cACH,MAAM,CAAC,cAAE,QAAQ,GAAG,iBAAiB,CAAC,EACtC;AAAA,IACC;AAAA,EACF,EACC,QAAQ,IAAI;AACjB,CAAC;;;AD3BM,IAAM,eAAW,yBAAY,cAAc;;;AGE3C,SAAS,eACd,KACA,aAAoC,MAC9B;AACN,MAAI,eAAe,MAAO;AAE1B,MAAI,eAAe,MAAM;AAEvB,QAAI,IAAI,+BAA+B,GAAG;AAC1C,QAAI,IAAI,gCAAgC,oBAAoB;AAC5D,QAAI,IAAI,gCAAgC,cAAc;AAAA,EACxD,OAAO;AAEL,QAAI,WAAW,QAAQ;AACrB,YAAM,SAAS,MAAM,QAAQ,WAAW,MAAM,IAC1C,WAAW,OAAO,KAAK,IAAI,IAC3B,WAAW;AACf,UAAI,IAAI,+BAA+B,MAAM;AAAA,IAC/C;AAEA,QAAI,WAAW,SAAS;AACtB,UAAI,IAAI,gCAAgC,WAAW,QAAQ,KAAK,IAAI,CAAC;AAAA,IACvE;AAEA,QAAI,WAAW,SAAS;AACtB,UAAI,IAAI,gCAAgC,WAAW,QAAQ,KAAK,IAAI,CAAC;AAAA,IACvE;AAEA,QAAI,WAAW,aAAa;AAC1B,UAAI,IAAI,oCAAoC,MAAM;AAAA,IACpD;AAEA,QAAI,WAAW,QAAQ;AACrB,UAAI,IAAI,0BAA0B,OAAO,WAAW,MAAM,CAAC;AAAA,IAC7D;AAAA,EACF;AACF;AAMO,IAAM,kBAAkB,OAAO;AAAA,EACpC;AAAA,EACA;AACF;;;AJjCO,IAAM,gBAAgB,OAC3B,YAC2B;AAvB7B;AAwBE,QAAM,EAAE,SAAS,CAAC,GAAG,IAAI,IAAI;AAC7B,QAAM,cAAa,SAAI,YAAJ,YAAe,eAAAC;AAClC,QAAM,WAAU,SAAI,SAAJ,YAAY,YAAAC;AAG5B,QAAM,SAAS,eAAe,MAAM,OAAO,YAAY,CAAC,CAAC;AACzD,QAAMC,YAAW;AAAA,IACf,GAAG;AAAA,IACH,QAAO,YAAO,UAAP,YAAiB,OAAO,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU;AAAA,EACnE;AAEA,QAAM,MAAM,WAAW;AAGvB,MAAI,IAAI,WAAW,KAAK,EAAE,OAAO,MAAM,CAAC,CAAC;AACzC,MAAI,IAAI,WAAW,KAAK,EAAE,OAAO,MAAM,CAAC,CAAC;AAGzC,MAAIA,UAAS,SAAS,OAAO;AAC3B,UAAM,cAAcA,UAAS,SAAS,OAAO,CAAC,IAAIA,UAAS;AAC3D,QAAI,IAAI,QAAQ,WAAW,CAAC;AAAA,EAC9B;AAMA,QAAM,OAAO,OAAO,KAAc,QAAiC;AACjE,QAAI;AAEF,UAAI,IAAI,WAAW,WAAW;AAC5B,uBAAe,KAAKA,UAAS,IAAI;AACjC,YAAI,OAAO,GAAG,EAAE,KAAK;AACrB;AAAA,MACF;AAGA,YAAM,QAAQ,UAAU,GAAG;AAG3B,YAAM,cAAU,2BAAc,CAAC,YAAY;AAhEjD,YAAAC;AAiEQ,cAAM,UAASA,MAAA,QAAQ,WAAR,OAAAA,MAAkB;AACjC,YAAI,QAAQ,SAAS;AACnB,qBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,gBAAI,IAAI,KAAK,KAAK;AAAA,UACpB;AAAA,QACF;AACA,YAAI,OAAO,MAAM;AACjB,YAAI,OAAO,QAAQ,SAAS,YAAY,OAAO,SAAS,QAAQ,IAAI,GAAG;AACrE,cAAI,KAAK,QAAQ,IAAI;AAAA,QACvB,OAAO;AACL,cAAI,KAAK,QAAQ,IAAI;AAAA,QACvB;AAAA,MACF,CAAC;AACD,cAAQ,WAAW,OAAO;AAG1B,UAAI,IAAI,WAAW,OAAO;AAExB,cAAM,iBAAa,2BAAc,IAAI,GAAG;AAGxC,YAAI,cAAc,OAAO,eAAe,UAAU;AAChD,gBAAM,IAAI,KAAK,UAAU;AAAA,QAC3B;AAGA,gBAAQ;AAAA,UACN,MAAM;AAAA,UACN,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,iBAAiB;AAAA,UACnB;AAAA,QACF,CAAC;AACD;AAAA,MACF;AAGA,UAAI,IAAI,WAAW,QAAQ;AACzB,cAAM,YACJ,IAAI,QAAQ,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,CAAC;AAEzD,cAAM,IAAI,KAAK,SAAS;AAExB,gBAAQ,EAAE,MAAM,EAAE,SAAS,MAAM,WAAW,KAAK,IAAI,EAAE,EAAE,CAAC;AAC1D;AAAA,MACF;AAGA,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,SAAS;AAAA,QACT,OAAO;AAAA,MACT,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,SAAS;AAAA,QACT,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MAClD,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,gBAAgBD,UAAS,MAAM;AAAA,IAAI,CAAC,UACxC,OAAO,UAAU,WACb,EAAE,MAAM,OAAO,SAAS,CAAC,OAAO,MAAM,EAAW,IACjD;AAAA,MACE,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM,WAAY,CAAC,OAAO,MAAM;AAAA,IAC3C;AAAA,EACN;AAEA,aAAW,SAAS,eAAe;AACjC,QAAI,MAAM,QAAQ,SAAS,MAAM,EAAG,KAAI,KAAK,MAAM,MAAM,IAAI;AAC7D,QAAI,MAAM,QAAQ,SAAS,KAAK,EAAG,KAAI,IAAI,MAAM,MAAM,IAAI;AAC3D,QAAI,QAAQ,MAAM,MAAM,IAAI;AAAA,EAC9B;AAGA,MAAI;AAEJ,MAAIA,UAAS,SAAS,QAAW;AAC/B,aAAS,IAAI,OAAOA,UAAS,MAAM,MAAM;AACvC,YAAM,aAAa,cAChB,IAAI,CAAC,MAAM;AACV,cAAM,UAAU,CAAC,GAAG,EAAE,SAAS,SAAS,EAAE,KAAK,IAAI;AACnD,eAAO,MAAM,OAAO,IAAI,EAAE,IAAI;AAAA,MAChC,CAAC,EACA,KAAK,IAAI;AACZ,UAAI,OAAO;AAAA,QACT,oCAAoCA,UAAS,IAAI;AAAA,IAAO;AAAA,MAC1D;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,WAA0B;AAAA,IAC9B,MAAM;AAAA,IACN,QAAQ;AAAA,MACN,GAAG;AAAA,MACH,UAAAA;AAAA,IACF;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA,SAAS,CAAC,aACR,IAAI,QAAc,CAAC,SAAS,WAAW;AACrC,UAAI,CAAC,OAAQ,QAAO,QAAQ;AAC5B,aAAO,MAAM,CAAC,QAAS,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAE;AAAA,IACvD,CAAC;AAAA,EACL;AAEA,SAAO;AACT;AAwBA,IAAO,gBAAQ;","names":["import_dev","import_dev","express","cors","settings","_a"]}

package/dist/index.mjs

@@ -1 +1 @@
-import express from"express";import cors from"cors";import{requestToData,createRespond}from"@walkeros/core";import{zodToSchema}from"@walkeros/core/dev";import{z as z2}from"@walkeros/core/dev";import{z}from"@walkeros/core/dev";var HttpMethod=z.enum(["GET","POST","PUT","PATCH","DELETE","OPTIONS","HEAD"]),RouteMethod=z.enum(["GET","POST"]),RouteConfigSchema=z.object({path:z.string().describe("Express route path (supports wildcards like /api/*)"),methods:z.array(RouteMethod).min(1).describe("HTTP methods to register. OPTIONS always included for CORS.").optional()}),CorsOrigin=z.union([z.string(),z.array(z.string()),z.literal("*")]),CorsOptionsSchema=z.object({origin:CorsOrigin.describe("Allowed origins (* for all, URL string, or array of URLs)").optional(),methods:z.array(HttpMethod).describe("Allowed HTTP methods").optional(),headers:z.array(z.string()).describe("Allowed request headers").optional(),credentials:z.boolean().describe("Allow credentials (cookies, authorization headers)").optional(),maxAge:z.number().int().positive().describe("Preflight cache duration in seconds").optional()}),SettingsSchema=z2.object({port:z2.number().int().min(0).max(65535).describe("HTTP server port to listen on. Use 0 for random available port. If not provided, server will not start (app only mode)").optional(),path:z2.string().describe("Deprecated: use paths instead").optional(),paths:z2.array(z2.union([z2.string(),RouteConfigSchema])).min(1).describe("Route paths to register. String shorthand registers GET+POST. RouteConfig allows per-route method control.").optional(),cors:z2.union([z2.boolean(),CorsOptionsSchema]).describe("CORS configuration: false = disabled, true = allow all origins (default), object = custom configuration").default(!0)});zodToSchema(SettingsSchema);function setCorsHeaders(res,corsConfig=!0){if(!1!==corsConfig)if(!0===corsConfig)res.set("Access-Control-Allow-Origin","*"),res.set("Access-Control-Allow-Methods","GET, POST, OPTIONS"),res.set("Access-Control-Allow-Headers","Content-Type");else{if(corsConfig.origin){const origin=Array.isArray(corsConfig.origin)?corsConfig.origin.join(", "):corsConfig.origin;res.set("Access-Control-Allow-Origin",origin)}corsConfig.methods&&res.set("Access-Control-Allow-Methods",corsConfig.methods.join(", ")),corsConfig.headers&&res.set("Access-Control-Allow-Headers",corsConfig.headers.join(", ")),corsConfig.credentials&&res.set("Access-Control-Allow-Credentials","true"),corsConfig.maxAge&&res.set("Access-Control-Max-Age",String(corsConfig.maxAge))}}var TRANSPARENT_GIF=Buffer.from("R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7","base64"),sourceExpress=async context=>{var _a,_b,_c;const{config:config={},env:env}=context,expressLib=null!=(_a=env.express)?_a:express,corsLib=null!=(_b=env.cors)?_b:cors,parsed=SettingsSchema.parse(config.settings||{}),settings2={...parsed,paths:null!=(_c=parsed.paths)?_c:parsed.path?[parsed.path]:["/collect"]},app=expressLib();if(app.use(expressLib.json({limit:"1mb"})),!1!==settings2.cors){const corsOptions=!0===settings2.cors?{}:settings2.cors;app.use(corsLib(corsOptions))}const push=async(req,res)=>{try{if("OPTIONS"===req.method)return setCorsHeaders(res,settings2.cors),void res.status(204).send();await context.setIngest(req);const respond=createRespond(options=>{var _a2;const status=null!=(_a2=options.status)?_a2:200;if(options.headers)for(const[key,value]of Object.entries(options.headers))res.set(key,value);res.status(status),"string"==typeof options.body||Buffer.isBuffer(options.body)?res.send(options.body):res.json(options.body)});if(context.setRespond(respond),"GET"===req.method){const parsedData=requestToData(req.url);return parsedData&&"object"==typeof parsedData&&await env.push(parsedData),void respond({body:TRANSPARENT_GIF,headers:{"Content-Type":"image/gif","Cache-Control":"no-cache, no-store, must-revalidate"}})}if("POST"===req.method){const eventData=req.body;return eventData&&"object"==typeof eventData?(await env.push(eventData),void respond({body:{success:!0,timestamp:Date.now()}})):void res.status(400).json({success:!1,error:"Invalid event: body must be an object"})}res.status(405).json({success:!1,error:"Method not allowed. Use POST, GET, or OPTIONS."})}catch(error){res.status(500).json({success:!1,error:error instanceof Error?error.message:"Internal server error"})}},resolvedPaths=settings2.paths.map(entry=>"string"==typeof entry?{path:entry,methods:["GET","POST"]}:{path:entry.path,methods:entry.methods||["GET","POST"]});for(const route of resolvedPaths)route.methods.includes("POST")&&app.post(route.path,push),route.methods.includes("GET")&&app.get(route.path,push),app.options(route.path,push);let server;void 0!==settings2.port&&(server=app.listen(settings2.port,()=>{const routeLines=resolvedPaths.map(r=>`   ${[...r.methods,"OPTIONS"].join(", ")} ${r.path}`).join("\n");env.logger.info(`Express source listening on port ${settings2.port}\n`+routeLines)}));return{type:"express",config:{...config,settings:settings2},push:push,httpHandler:app,app:app,server:server,destroy:_context=>new Promise((resolve,reject)=>{if(!server)return resolve();server.close(err=>err?reject(err):resolve())})}},index_default=sourceExpress;export{TRANSPARENT_GIF,index_default as default,setCorsHeaders,sourceExpress};//# sourceMappingURL=index.mjs.map
+import express from"express";import cors from"cors";import{requestToData,createRespond}from"@walkeros/core";import{zodToSchema}from"@walkeros/core/dev";import{z as z2}from"@walkeros/core/dev";import{z}from"@walkeros/core/dev";var HttpMethod=z.enum(["GET","POST","PUT","PATCH","DELETE","OPTIONS","HEAD"]),RouteMethod=z.enum(["GET","POST"]),RouteConfigSchema=z.object({path:z.string().describe("Express route path (supports wildcards like /api/*)"),methods:z.array(RouteMethod).min(1).describe("HTTP methods to register. OPTIONS always included for CORS.").optional()}),CorsOrigin=z.union([z.string(),z.array(z.string()),z.literal("*")]),CorsOptionsSchema=z.object({origin:CorsOrigin.describe("Allowed origins (* for all, URL string, or array of URLs)").optional(),methods:z.array(HttpMethod).describe("Allowed HTTP methods").optional(),headers:z.array(z.string()).describe("Allowed request headers").optional(),credentials:z.boolean().describe("Allow credentials (cookies, authorization headers)").optional(),maxAge:z.number().int().positive().describe("Preflight cache duration in seconds").optional()}),SettingsSchema=z2.object({port:z2.number().int().min(0).max(65535).describe("HTTP server port to listen on. Use 0 for random available port. If not provided, server will not start (app only mode)").optional(),path:z2.string().describe("Deprecated: use paths instead").optional(),paths:z2.array(z2.union([z2.string(),RouteConfigSchema])).min(1).describe("Route paths to register. String shorthand registers GET+POST. RouteConfig allows per-route method control.").optional(),cors:z2.union([z2.boolean(),CorsOptionsSchema]).describe("CORS configuration: false = disabled, true = allow all origins (default), object = custom configuration").default(!0)});zodToSchema(SettingsSchema);function setCorsHeaders(res,corsConfig=!0){if(!1!==corsConfig)if(!0===corsConfig)res.set("Access-Control-Allow-Origin","*"),res.set("Access-Control-Allow-Methods","GET, POST, OPTIONS"),res.set("Access-Control-Allow-Headers","Content-Type");else{if(corsConfig.origin){const origin=Array.isArray(corsConfig.origin)?corsConfig.origin.join(", "):corsConfig.origin;res.set("Access-Control-Allow-Origin",origin)}corsConfig.methods&&res.set("Access-Control-Allow-Methods",corsConfig.methods.join(", ")),corsConfig.headers&&res.set("Access-Control-Allow-Headers",corsConfig.headers.join(", ")),corsConfig.credentials&&res.set("Access-Control-Allow-Credentials","true"),corsConfig.maxAge&&res.set("Access-Control-Max-Age",String(corsConfig.maxAge))}}var TRANSPARENT_GIF=Buffer.from("R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7","base64"),sourceExpress=async context=>{var _a,_b,_c;const{config:config={},env:env}=context,expressLib=null!=(_a=env.express)?_a:express,corsLib=null!=(_b=env.cors)?_b:cors,parsed=SettingsSchema.parse(config.settings||{}),settings2={...parsed,paths:null!=(_c=parsed.paths)?_c:parsed.path?[parsed.path]:["/collect"]},app=expressLib();if(app.use(expressLib.json({limit:"1mb"})),app.use(expressLib.text({limit:"1mb"})),!1!==settings2.cors){const corsOptions=!0===settings2.cors?{}:settings2.cors;app.use(corsLib(corsOptions))}const push=async(req,res)=>{try{if("OPTIONS"===req.method)return setCorsHeaders(res,settings2.cors),void res.status(204).send();await context.setIngest(req);const respond=createRespond(options=>{var _a2;const status=null!=(_a2=options.status)?_a2:200;if(options.headers)for(const[key,value]of Object.entries(options.headers))res.set(key,value);res.status(status),"string"==typeof options.body||Buffer.isBuffer(options.body)?res.send(options.body):res.json(options.body)});if(context.setRespond(respond),"GET"===req.method){const parsedData=requestToData(req.url);return parsedData&&"object"==typeof parsedData&&await env.push(parsedData),void respond({body:TRANSPARENT_GIF,headers:{"Content-Type":"image/gif","Cache-Control":"no-cache, no-store, must-revalidate"}})}if("POST"===req.method){const eventData=req.body&&"object"==typeof req.body?req.body:{};return await env.push(eventData),void respond({body:{success:!0,timestamp:Date.now()}})}res.status(405).json({success:!1,error:"Method not allowed. Use POST, GET, or OPTIONS."})}catch(error){res.status(500).json({success:!1,error:error instanceof Error?error.message:"Internal server error"})}},resolvedPaths=settings2.paths.map(entry=>"string"==typeof entry?{path:entry,methods:["GET","POST"]}:{path:entry.path,methods:entry.methods||["GET","POST"]});for(const route of resolvedPaths)route.methods.includes("POST")&&app.post(route.path,push),route.methods.includes("GET")&&app.get(route.path,push),app.options(route.path,push);let server;void 0!==settings2.port&&(server=app.listen(settings2.port,()=>{const routeLines=resolvedPaths.map(r=>`   ${[...r.methods,"OPTIONS"].join(", ")} ${r.path}`).join("\n");env.logger.info(`Express source listening on port ${settings2.port}\n`+routeLines)}));return{type:"express",config:{...config,settings:settings2},push:push,httpHandler:app,app:app,server:server,destroy:_context=>new Promise((resolve,reject)=>{if(!server)return resolve();server.close(err=>err?reject(err):resolve())})}},index_default=sourceExpress;export{TRANSPARENT_GIF,index_default as default,setCorsHeaders,sourceExpress};//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/schemas/index.ts","../src/schemas/settings.ts","../src/schemas/primitives.ts","../src/utils.ts"],"sourcesContent":["import express, { type Request, type Response } from 'express';\nimport cors from 'cors';\nimport { requestToData, createRespond } from '@walkeros/core';\nimport type { Source } from '@walkeros/core';\nimport type { ExpressSource, Types, EventRequest } from './types';\nimport { SettingsSchema } from './schemas';\nimport { setCorsHeaders, TRANSPARENT_GIF } from './utils';\n\n/**\n * Express source initialization\n *\n * This source OWNS its HTTP server infrastructure:\n * - Creates Express application\n * - Sets up middleware (JSON parsing, CORS)\n * - Registers event collection endpoints (POST, GET, OPTIONS)\n * - Starts HTTP server (if port configured)\n * - Provides destroy() for graceful shutdown (called by runner)\n *\n * @param context Source context with config, env, logger, id\n * @returns Express source instance with app and push handler\n */\nexport const sourceExpress = async (\n  context: Source.Context<Types>,\n): Promise<ExpressSource> => {\n  const { config = {}, env } = context;\n  const expressLib = env.express ?? express;\n  const corsLib = env.cors ?? cors;\n\n  // Validate and apply default settings\n  const parsed = SettingsSchema.parse(config.settings || {});\n  const settings = {\n    ...parsed,\n    paths: parsed.paths ?? (parsed.path ? [parsed.path] : ['/collect']),\n  };\n\n  const app = expressLib();\n\n  // Middleware setup - JSON body parsing with 10mb default limit\n  app.use(expressLib.json({ limit: '1mb' }));\n\n  // CORS middleware (enabled by default)\n  if (settings.cors !== false) {\n    const corsOptions = settings.cors === true ? {} : settings.cors;\n    app.use(corsLib(corsOptions));\n  }\n\n  /**\n   * Request handler - transforms HTTP requests into walker events\n   * Supports POST (JSON body), GET (query params), and OPTIONS (CORS preflight)\n   */\n  const push = async (req: Request, res: Response): Promise<void> => {\n    try {\n      // Handle OPTIONS for CORS preflight\n      if (req.method === 'OPTIONS') {\n        setCorsHeaders(res, settings.cors);\n        res.status(204).send();\n        return;\n      }\n\n      // Extract ingest metadata from request (if config.ingest is defined)\n      await context.setIngest(req);\n\n      // Create per-request respond — first call wins (idempotent)\n      const respond = createRespond((options) => {\n        const status = options.status ?? 200;\n        if (options.headers) {\n          for (const [key, value] of Object.entries(options.headers)) {\n            res.set(key, value);\n          }\n        }\n        res.status(status);\n        if (typeof options.body === 'string' || Buffer.isBuffer(options.body)) {\n          res.send(options.body);\n        } else {\n          res.json(options.body);\n        }\n      });\n      context.setRespond(respond);\n\n      // Handle GET requests (pixel tracking)\n      if (req.method === 'GET') {\n        // Parse query parameters to event data using requestToData\n        const parsedData = requestToData(req.url);\n\n        // Send to collector\n        if (parsedData && typeof parsedData === 'object') {\n          await env.push(parsedData);\n        }\n\n        // Default: 1x1 GIF (skipped if a step already called respond)\n        respond({\n          body: TRANSPARENT_GIF,\n          headers: {\n            'Content-Type': 'image/gif',\n            'Cache-Control': 'no-cache, no-store, must-revalidate',\n          },\n        });\n        return;\n      }\n\n      // Handle POST requests (standard event ingestion)\n      if (req.method === 'POST') {\n        const eventData = req.body;\n\n        if (!eventData || typeof eventData !== 'object') {\n          res.status(400).json({\n            success: false,\n            error: 'Invalid event: body must be an object',\n          });\n          return;\n        }\n\n        // Send event to collector\n        await env.push(eventData);\n\n        // Default: JSON success (skipped if a step already called respond)\n        respond({ body: { success: true, timestamp: Date.now() } });\n        return;\n      }\n\n      // Unsupported method\n      res.status(405).json({\n        success: false,\n        error: 'Method not allowed. Use POST, GET, or OPTIONS.',\n      });\n    } catch (error) {\n      res.status(500).json({\n        success: false,\n        error: error instanceof Error ? error.message : 'Internal server error',\n      });\n    }\n  };\n\n  // Register handlers per route config\n  const resolvedPaths = settings.paths.map((entry) =>\n    typeof entry === 'string'\n      ? { path: entry, methods: ['GET', 'POST'] as const }\n      : {\n          path: entry.path,\n          methods: entry.methods || (['GET', 'POST'] as const),\n        },\n  );\n\n  for (const route of resolvedPaths) {\n    if (route.methods.includes('POST')) app.post(route.path, push);\n    if (route.methods.includes('GET')) app.get(route.path, push);\n    app.options(route.path, push); // Always register OPTIONS for CORS\n  }\n\n  // Source owns the HTTP server (if port configured)\n  let server: ReturnType<typeof app.listen> | undefined;\n\n  if (settings.port !== undefined) {\n    server = app.listen(settings.port, () => {\n      const routeLines = resolvedPaths\n        .map((r) => {\n          const methods = [...r.methods, 'OPTIONS'].join(', ');\n          return `   ${methods} ${r.path}`;\n        })\n        .join('\\n');\n      env.logger.info(\n        `Express source listening on port ${settings.port}\\n` + routeLines,\n      );\n    });\n  }\n\n  const instance: ExpressSource = {\n    type: 'express',\n    config: {\n      ...config,\n      settings,\n    },\n    push,\n    httpHandler: app,\n    app,\n    server,\n    destroy: (_context) =>\n      new Promise<void>((resolve, reject) => {\n        if (!server) return resolve();\n        server.close((err) => (err ? reject(err) : resolve()));\n      }),\n  };\n\n  return instance;\n};\n\n// Export types (avoid re-exporting duplicates from schemas)\nexport type {\n  ExpressSource,\n  Config,\n  PartialConfig,\n  Types,\n  EventRequest,\n  EventResponse,\n  RequestBody,\n  ResponseBody,\n  Push,\n  Env,\n  Mapping,\n  InitSettings,\n  Settings,\n  RouteConfig,\n  RouteMethod,\n} from './types';\n\n// Export utils\nexport { setCorsHeaders, TRANSPARENT_GIF } from './utils';\n\nexport default sourceExpress;\n","import { zodToSchema } from '@walkeros/core/dev';\nimport { SettingsSchema } from './settings';\n\nexport * from './primitives';\nexport { SettingsSchema, type Settings } from './settings';\n\n// JSON Schema\nexport const settings = zodToSchema(SettingsSchema);\n","import { z } from '@walkeros/core/dev';\nimport { CorsOptionsSchema, RouteConfigSchema } from './primitives';\n\n/**\n * Express source settings schema.\n */\nexport const SettingsSchema = z.object({\n  port: z\n    .number()\n    .int()\n    .min(0)\n    .max(65535)\n    .describe(\n      'HTTP server port to listen on. Use 0 for random available port. If not provided, server will not start (app only mode)',\n    )\n    .optional(),\n\n  /** @deprecated Use `paths` instead */\n  path: z.string().describe('Deprecated: use paths instead').optional(),\n\n  paths: z\n    .array(z.union([z.string(), RouteConfigSchema]))\n    .min(1)\n    .describe(\n      'Route paths to register. String shorthand registers GET+POST. RouteConfig allows per-route method control.',\n    )\n    .optional(),\n\n  cors: z\n    .union([z.boolean(), CorsOptionsSchema])\n    .describe(\n      'CORS configuration: false = disabled, true = allow all origins (default), object = custom configuration',\n    )\n    .default(true),\n});\n\nexport type Settings = z.infer<typeof SettingsSchema>;\n","import { z } from '@walkeros/core/dev';\n\n/**\n * HTTP methods enum\n */\nexport const HttpMethod = z.enum([\n  'GET',\n  'POST',\n  'PUT',\n  'PATCH',\n  'DELETE',\n  'OPTIONS',\n  'HEAD',\n]);\n\n/**\n * HTTP methods supported for route configuration.\n * OPTIONS is always registered for CORS (not user-configurable per route).\n */\nexport const RouteMethod = z.enum(['GET', 'POST']);\n\n/**\n * Route configuration for multi-path support.\n */\nexport const RouteConfigSchema = z.object({\n  path: z\n    .string()\n    .describe('Express route path (supports wildcards like /api/*)'),\n  methods: z\n    .array(RouteMethod)\n    .min(1)\n    .describe('HTTP methods to register. OPTIONS always included for CORS.')\n    .optional(),\n});\n\n/**\n * CORS origin configuration\n * Accepts:\n * - '*' for all origins\n * - Single URL string\n * - Array of URL strings\n */\nexport const CorsOrigin = z.union([\n  z.string(),\n  z.array(z.string()),\n  z.literal('*'),\n]);\n\n/**\n * CORS options schema\n * Configuration for Cross-Origin Resource Sharing\n */\nexport const CorsOptionsSchema = z.object({\n  origin: CorsOrigin.describe(\n    'Allowed origins (* for all, URL string, or array of URLs)',\n  ).optional(),\n\n  methods: z.array(HttpMethod).describe('Allowed HTTP methods').optional(),\n\n  headers: z.array(z.string()).describe('Allowed request headers').optional(),\n\n  credentials: z\n    .boolean()\n    .describe('Allow credentials (cookies, authorization headers)')\n    .optional(),\n\n  maxAge: z\n    .number()\n    .int()\n    .positive()\n    .describe('Preflight cache duration in seconds')\n    .optional(),\n});\n\nexport type CorsOptions = z.infer<typeof CorsOptionsSchema>;\n","import type { Response } from 'express';\nimport type { CorsOptions } from './schemas';\n\n/**\n * Set CORS headers on response\n *\n * @param res Express response object\n * @param corsConfig CORS configuration (false = disabled, true = allow all, object = custom)\n */\nexport function setCorsHeaders(\n  res: Response,\n  corsConfig: boolean | CorsOptions = true,\n): void {\n  if (corsConfig === false) return;\n\n  if (corsConfig === true) {\n    // Simple CORS - allow all\n    res.set('Access-Control-Allow-Origin', '*');\n    res.set('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');\n    res.set('Access-Control-Allow-Headers', 'Content-Type');\n  } else {\n    // Custom CORS configuration\n    if (corsConfig.origin) {\n      const origin = Array.isArray(corsConfig.origin)\n        ? corsConfig.origin.join(', ')\n        : corsConfig.origin;\n      res.set('Access-Control-Allow-Origin', origin);\n    }\n\n    if (corsConfig.methods) {\n      res.set('Access-Control-Allow-Methods', corsConfig.methods.join(', '));\n    }\n\n    if (corsConfig.headers) {\n      res.set('Access-Control-Allow-Headers', corsConfig.headers.join(', '));\n    }\n\n    if (corsConfig.credentials) {\n      res.set('Access-Control-Allow-Credentials', 'true');\n    }\n\n    if (corsConfig.maxAge) {\n      res.set('Access-Control-Max-Age', String(corsConfig.maxAge));\n    }\n  }\n}\n\n/**\n * 1x1 transparent GIF for pixel tracking\n * Base64-encoded GIF (43 bytes)\n */\nexport const TRANSPARENT_GIF = Buffer.from(\n  'R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7',\n  'base64',\n);\n"],"mappings":";AAAA,OAAO,aAA8C;AACrD,OAAO,UAAU;AACjB,SAAS,eAAe,qBAAqB;;;ACF7C,SAAS,mBAAmB;;;ACA5B,SAAS,KAAAA,UAAS;;;ACAlB,SAAS,SAAS;AAKX,IAAM,aAAa,EAAE,KAAK;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,cAAc,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC;AAK1C,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,MAAM,EACH,OAAO,EACP,SAAS,qDAAqD;AAAA,EACjE,SAAS,EACN,MAAM,WAAW,EACjB,IAAI,CAAC,EACL,SAAS,6DAA6D,EACtE,SAAS;AACd,CAAC;AASM,IAAM,aAAa,EAAE,MAAM;AAAA,EAChC,EAAE,OAAO;AAAA,EACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAClB,EAAE,QAAQ,GAAG;AACf,CAAC;AAMM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,QAAQ,WAAW;AAAA,IACjB;AAAA,EACF,EAAE,SAAS;AAAA,EAEX,SAAS,EAAE,MAAM,UAAU,EAAE,SAAS,sBAAsB,EAAE,SAAS;AAAA,EAEvE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,yBAAyB,EAAE,SAAS;AAAA,EAE1E,aAAa,EACV,QAAQ,EACR,SAAS,oDAAoD,EAC7D,SAAS;AAAA,EAEZ,QAAQ,EACL,OAAO,EACP,IAAI,EACJ,SAAS,EACT,SAAS,qCAAqC,EAC9C,SAAS;AACd,CAAC;;;ADlEM,IAAM,iBAAiBC,GAAE,OAAO;AAAA,EACrC,MAAMA,GACH,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,KAAK,EACT;AAAA,IACC;AAAA,EACF,EACC,SAAS;AAAA;AAAA,EAGZ,MAAMA,GAAE,OAAO,EAAE,SAAS,+BAA+B,EAAE,SAAS;AAAA,EAEpE,OAAOA,GACJ,MAAMA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC,EAC9C,IAAI,CAAC,EACL;AAAA,IACC;AAAA,EACF,EACC,SAAS;AAAA,EAEZ,MAAMA,GACH,MAAM,CAACA,GAAE,QAAQ,GAAG,iBAAiB,CAAC,EACtC;AAAA,IACC;AAAA,EACF,EACC,QAAQ,IAAI;AACjB,CAAC;;;AD3BM,IAAM,WAAW,YAAY,cAAc;;;AGE3C,SAAS,eACd,KACA,aAAoC,MAC9B;AACN,MAAI,eAAe,MAAO;AAE1B,MAAI,eAAe,MAAM;AAEvB,QAAI,IAAI,+BAA+B,GAAG;AAC1C,QAAI,IAAI,gCAAgC,oBAAoB;AAC5D,QAAI,IAAI,gCAAgC,cAAc;AAAA,EACxD,OAAO;AAEL,QAAI,WAAW,QAAQ;AACrB,YAAM,SAAS,MAAM,QAAQ,WAAW,MAAM,IAC1C,WAAW,OAAO,KAAK,IAAI,IAC3B,WAAW;AACf,UAAI,IAAI,+BAA+B,MAAM;AAAA,IAC/C;AAEA,QAAI,WAAW,SAAS;AACtB,UAAI,IAAI,gCAAgC,WAAW,QAAQ,KAAK,IAAI,CAAC;AAAA,IACvE;AAEA,QAAI,WAAW,SAAS;AACtB,UAAI,IAAI,gCAAgC,WAAW,QAAQ,KAAK,IAAI,CAAC;AAAA,IACvE;AAEA,QAAI,WAAW,aAAa;AAC1B,UAAI,IAAI,oCAAoC,MAAM;AAAA,IACpD;AAEA,QAAI,WAAW,QAAQ;AACrB,UAAI,IAAI,0BAA0B,OAAO,WAAW,MAAM,CAAC;AAAA,IAC7D;AAAA,EACF;AACF;AAMO,IAAM,kBAAkB,OAAO;AAAA,EACpC;AAAA,EACA;AACF;;;AJjCO,IAAM,gBAAgB,OAC3B,YAC2B;AAvB7B;AAwBE,QAAM,EAAE,SAAS,CAAC,GAAG,IAAI,IAAI;AAC7B,QAAM,cAAa,SAAI,YAAJ,YAAe;AAClC,QAAM,WAAU,SAAI,SAAJ,YAAY;AAG5B,QAAM,SAAS,eAAe,MAAM,OAAO,YAAY,CAAC,CAAC;AACzD,QAAMC,YAAW;AAAA,IACf,GAAG;AAAA,IACH,QAAO,YAAO,UAAP,YAAiB,OAAO,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU;AAAA,EACnE;AAEA,QAAM,MAAM,WAAW;AAGvB,MAAI,IAAI,WAAW,KAAK,EAAE,OAAO,MAAM,CAAC,CAAC;AAGzC,MAAIA,UAAS,SAAS,OAAO;AAC3B,UAAM,cAAcA,UAAS,SAAS,OAAO,CAAC,IAAIA,UAAS;AAC3D,QAAI,IAAI,QAAQ,WAAW,CAAC;AAAA,EAC9B;AAMA,QAAM,OAAO,OAAO,KAAc,QAAiC;AACjE,QAAI;AAEF,UAAI,IAAI,WAAW,WAAW;AAC5B,uBAAe,KAAKA,UAAS,IAAI;AACjC,YAAI,OAAO,GAAG,EAAE,KAAK;AACrB;AAAA,MACF;AAGA,YAAM,QAAQ,UAAU,GAAG;AAG3B,YAAM,UAAU,cAAc,CAAC,YAAY;AA/DjD,YAAAC;AAgEQ,cAAM,UAASA,MAAA,QAAQ,WAAR,OAAAA,MAAkB;AACjC,YAAI,QAAQ,SAAS;AACnB,qBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,gBAAI,IAAI,KAAK,KAAK;AAAA,UACpB;AAAA,QACF;AACA,YAAI,OAAO,MAAM;AACjB,YAAI,OAAO,QAAQ,SAAS,YAAY,OAAO,SAAS,QAAQ,IAAI,GAAG;AACrE,cAAI,KAAK,QAAQ,IAAI;AAAA,QACvB,OAAO;AACL,cAAI,KAAK,QAAQ,IAAI;AAAA,QACvB;AAAA,MACF,CAAC;AACD,cAAQ,WAAW,OAAO;AAG1B,UAAI,IAAI,WAAW,OAAO;AAExB,cAAM,aAAa,cAAc,IAAI,GAAG;AAGxC,YAAI,cAAc,OAAO,eAAe,UAAU;AAChD,gBAAM,IAAI,KAAK,UAAU;AAAA,QAC3B;AAGA,gBAAQ;AAAA,UACN,MAAM;AAAA,UACN,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,iBAAiB;AAAA,UACnB;AAAA,QACF,CAAC;AACD;AAAA,MACF;AAGA,UAAI,IAAI,WAAW,QAAQ;AACzB,cAAM,YAAY,IAAI;AAEtB,YAAI,CAAC,aAAa,OAAO,cAAc,UAAU;AAC/C,cAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACnB,SAAS;AAAA,YACT,OAAO;AAAA,UACT,CAAC;AACD;AAAA,QACF;AAGA,cAAM,IAAI,KAAK,SAAS;AAGxB,gBAAQ,EAAE,MAAM,EAAE,SAAS,MAAM,WAAW,KAAK,IAAI,EAAE,EAAE,CAAC;AAC1D;AAAA,MACF;AAGA,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,SAAS;AAAA,QACT,OAAO;AAAA,MACT,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,SAAS;AAAA,QACT,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MAClD,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,gBAAgBD,UAAS,MAAM;AAAA,IAAI,CAAC,UACxC,OAAO,UAAU,WACb,EAAE,MAAM,OAAO,SAAS,CAAC,OAAO,MAAM,EAAW,IACjD;AAAA,MACE,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM,WAAY,CAAC,OAAO,MAAM;AAAA,IAC3C;AAAA,EACN;AAEA,aAAW,SAAS,eAAe;AACjC,QAAI,MAAM,QAAQ,SAAS,MAAM,EAAG,KAAI,KAAK,MAAM,MAAM,IAAI;AAC7D,QAAI,MAAM,QAAQ,SAAS,KAAK,EAAG,KAAI,IAAI,MAAM,MAAM,IAAI;AAC3D,QAAI,QAAQ,MAAM,MAAM,IAAI;AAAA,EAC9B;AAGA,MAAI;AAEJ,MAAIA,UAAS,SAAS,QAAW;AAC/B,aAAS,IAAI,OAAOA,UAAS,MAAM,MAAM;AACvC,YAAM,aAAa,cAChB,IAAI,CAAC,MAAM;AACV,cAAM,UAAU,CAAC,GAAG,EAAE,SAAS,SAAS,EAAE,KAAK,IAAI;AACnD,eAAO,MAAM,OAAO,IAAI,EAAE,IAAI;AAAA,MAChC,CAAC,EACA,KAAK,IAAI;AACZ,UAAI,OAAO;AAAA,QACT,oCAAoCA,UAAS,IAAI;AAAA,IAAO;AAAA,MAC1D;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,WAA0B;AAAA,IAC9B,MAAM;AAAA,IACN,QAAQ;AAAA,MACN,GAAG;AAAA,MACH,UAAAA;AAAA,IACF;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA,SAAS,CAAC,aACR,IAAI,QAAc,CAAC,SAAS,WAAW;AACrC,UAAI,CAAC,OAAQ,QAAO,QAAQ;AAC5B,aAAO,MAAM,CAAC,QAAS,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAE;AAAA,IACvD,CAAC;AAAA,EACL;AAEA,SAAO;AACT;AAwBA,IAAO,gBAAQ;","names":["z","z","settings","_a"]}
+{"version":3,"sources":["../src/index.ts","../src/schemas/index.ts","../src/schemas/settings.ts","../src/schemas/primitives.ts","../src/utils.ts"],"sourcesContent":["import express, { type Request, type Response } from 'express';\nimport cors from 'cors';\nimport { requestToData, createRespond } from '@walkeros/core';\nimport type { Source } from '@walkeros/core';\nimport type { ExpressSource, Types, EventRequest } from './types';\nimport { SettingsSchema } from './schemas';\nimport { setCorsHeaders, TRANSPARENT_GIF } from './utils';\n\n/**\n * Express source initialization\n *\n * This source OWNS its HTTP server infrastructure:\n * - Creates Express application\n * - Sets up middleware (JSON parsing, CORS)\n * - Registers event collection endpoints (POST, GET, OPTIONS)\n * - Starts HTTP server (if port configured)\n * - Provides destroy() for graceful shutdown (called by runner)\n *\n * @param context Source context with config, env, logger, id\n * @returns Express source instance with app and push handler\n */\nexport const sourceExpress = async (\n  context: Source.Context<Types>,\n): Promise<ExpressSource> => {\n  const { config = {}, env } = context;\n  const expressLib = env.express ?? express;\n  const corsLib = env.cors ?? cors;\n\n  // Validate and apply default settings\n  const parsed = SettingsSchema.parse(config.settings || {});\n  const settings = {\n    ...parsed,\n    paths: parsed.paths ?? (parsed.path ? [parsed.path] : ['/collect']),\n  };\n\n  const app = expressLib();\n\n  // Middleware setup - JSON body parsing with 10mb default limit\n  app.use(expressLib.json({ limit: '1mb' }));\n  app.use(expressLib.text({ limit: '1mb' }));\n\n  // CORS middleware (enabled by default)\n  if (settings.cors !== false) {\n    const corsOptions = settings.cors === true ? {} : settings.cors;\n    app.use(corsLib(corsOptions));\n  }\n\n  /**\n   * Request handler - transforms HTTP requests into walker events\n   * Supports POST (JSON body), GET (query params), and OPTIONS (CORS preflight)\n   */\n  const push = async (req: Request, res: Response): Promise<void> => {\n    try {\n      // Handle OPTIONS for CORS preflight\n      if (req.method === 'OPTIONS') {\n        setCorsHeaders(res, settings.cors);\n        res.status(204).send();\n        return;\n      }\n\n      // Extract ingest metadata from request (if config.ingest is defined)\n      await context.setIngest(req);\n\n      // Create per-request respond — first call wins (idempotent)\n      const respond = createRespond((options) => {\n        const status = options.status ?? 200;\n        if (options.headers) {\n          for (const [key, value] of Object.entries(options.headers)) {\n            res.set(key, value);\n          }\n        }\n        res.status(status);\n        if (typeof options.body === 'string' || Buffer.isBuffer(options.body)) {\n          res.send(options.body);\n        } else {\n          res.json(options.body);\n        }\n      });\n      context.setRespond(respond);\n\n      // Handle GET requests (pixel tracking)\n      if (req.method === 'GET') {\n        // Parse query parameters to event data using requestToData\n        const parsedData = requestToData(req.url);\n\n        // Send to collector\n        if (parsedData && typeof parsedData === 'object') {\n          await env.push(parsedData);\n        }\n\n        // Default: 1x1 GIF (skipped if a step already called respond)\n        respond({\n          body: TRANSPARENT_GIF,\n          headers: {\n            'Content-Type': 'image/gif',\n            'Cache-Control': 'no-cache, no-store, must-revalidate',\n          },\n        });\n        return;\n      }\n\n      // Handle POST requests (standard event ingestion)\n      if (req.method === 'POST') {\n        const eventData =\n          req.body && typeof req.body === 'object' ? req.body : {};\n\n        await env.push(eventData);\n\n        respond({ body: { success: true, timestamp: Date.now() } });\n        return;\n      }\n\n      // Unsupported method\n      res.status(405).json({\n        success: false,\n        error: 'Method not allowed. Use POST, GET, or OPTIONS.',\n      });\n    } catch (error) {\n      res.status(500).json({\n        success: false,\n        error: error instanceof Error ? error.message : 'Internal server error',\n      });\n    }\n  };\n\n  // Register handlers per route config\n  const resolvedPaths = settings.paths.map((entry) =>\n    typeof entry === 'string'\n      ? { path: entry, methods: ['GET', 'POST'] as const }\n      : {\n          path: entry.path,\n          methods: entry.methods || (['GET', 'POST'] as const),\n        },\n  );\n\n  for (const route of resolvedPaths) {\n    if (route.methods.includes('POST')) app.post(route.path, push);\n    if (route.methods.includes('GET')) app.get(route.path, push);\n    app.options(route.path, push); // Always register OPTIONS for CORS\n  }\n\n  // Source owns the HTTP server (if port configured)\n  let server: ReturnType<typeof app.listen> | undefined;\n\n  if (settings.port !== undefined) {\n    server = app.listen(settings.port, () => {\n      const routeLines = resolvedPaths\n        .map((r) => {\n          const methods = [...r.methods, 'OPTIONS'].join(', ');\n          return `   ${methods} ${r.path}`;\n        })\n        .join('\\n');\n      env.logger.info(\n        `Express source listening on port ${settings.port}\\n` + routeLines,\n      );\n    });\n  }\n\n  const instance: ExpressSource = {\n    type: 'express',\n    config: {\n      ...config,\n      settings,\n    },\n    push,\n    httpHandler: app,\n    app,\n    server,\n    destroy: (_context) =>\n      new Promise<void>((resolve, reject) => {\n        if (!server) return resolve();\n        server.close((err) => (err ? reject(err) : resolve()));\n      }),\n  };\n\n  return instance;\n};\n\n// Export types (avoid re-exporting duplicates from schemas)\nexport type {\n  ExpressSource,\n  Config,\n  PartialConfig,\n  Types,\n  EventRequest,\n  EventResponse,\n  RequestBody,\n  ResponseBody,\n  Push,\n  Env,\n  Mapping,\n  InitSettings,\n  Settings,\n  RouteConfig,\n  RouteMethod,\n} from './types';\n\n// Export utils\nexport { setCorsHeaders, TRANSPARENT_GIF } from './utils';\n\nexport default sourceExpress;\n","import { zodToSchema } from '@walkeros/core/dev';\nimport { SettingsSchema } from './settings';\n\nexport * from './primitives';\nexport { SettingsSchema, type Settings } from './settings';\n\n// JSON Schema\nexport const settings = zodToSchema(SettingsSchema);\n","import { z } from '@walkeros/core/dev';\nimport { CorsOptionsSchema, RouteConfigSchema } from './primitives';\n\n/**\n * Express source settings schema.\n */\nexport const SettingsSchema = z.object({\n  port: z\n    .number()\n    .int()\n    .min(0)\n    .max(65535)\n    .describe(\n      'HTTP server port to listen on. Use 0 for random available port. If not provided, server will not start (app only mode)',\n    )\n    .optional(),\n\n  /** @deprecated Use `paths` instead */\n  path: z.string().describe('Deprecated: use paths instead').optional(),\n\n  paths: z\n    .array(z.union([z.string(), RouteConfigSchema]))\n    .min(1)\n    .describe(\n      'Route paths to register. String shorthand registers GET+POST. RouteConfig allows per-route method control.',\n    )\n    .optional(),\n\n  cors: z\n    .union([z.boolean(), CorsOptionsSchema])\n    .describe(\n      'CORS configuration: false = disabled, true = allow all origins (default), object = custom configuration',\n    )\n    .default(true),\n});\n\nexport type Settings = z.infer<typeof SettingsSchema>;\n","import { z } from '@walkeros/core/dev';\n\n/**\n * HTTP methods enum\n */\nexport const HttpMethod = z.enum([\n  'GET',\n  'POST',\n  'PUT',\n  'PATCH',\n  'DELETE',\n  'OPTIONS',\n  'HEAD',\n]);\n\n/**\n * HTTP methods supported for route configuration.\n * OPTIONS is always registered for CORS (not user-configurable per route).\n */\nexport const RouteMethod = z.enum(['GET', 'POST']);\n\n/**\n * Route configuration for multi-path support.\n */\nexport const RouteConfigSchema = z.object({\n  path: z\n    .string()\n    .describe('Express route path (supports wildcards like /api/*)'),\n  methods: z\n    .array(RouteMethod)\n    .min(1)\n    .describe('HTTP methods to register. OPTIONS always included for CORS.')\n    .optional(),\n});\n\n/**\n * CORS origin configuration\n * Accepts:\n * - '*' for all origins\n * - Single URL string\n * - Array of URL strings\n */\nexport const CorsOrigin = z.union([\n  z.string(),\n  z.array(z.string()),\n  z.literal('*'),\n]);\n\n/**\n * CORS options schema\n * Configuration for Cross-Origin Resource Sharing\n */\nexport const CorsOptionsSchema = z.object({\n  origin: CorsOrigin.describe(\n    'Allowed origins (* for all, URL string, or array of URLs)',\n  ).optional(),\n\n  methods: z.array(HttpMethod).describe('Allowed HTTP methods').optional(),\n\n  headers: z.array(z.string()).describe('Allowed request headers').optional(),\n\n  credentials: z\n    .boolean()\n    .describe('Allow credentials (cookies, authorization headers)')\n    .optional(),\n\n  maxAge: z\n    .number()\n    .int()\n    .positive()\n    .describe('Preflight cache duration in seconds')\n    .optional(),\n});\n\nexport type CorsOptions = z.infer<typeof CorsOptionsSchema>;\n","import type { Response } from 'express';\nimport type { CorsOptions } from './schemas';\n\n/**\n * Set CORS headers on response\n *\n * @param res Express response object\n * @param corsConfig CORS configuration (false = disabled, true = allow all, object = custom)\n */\nexport function setCorsHeaders(\n  res: Response,\n  corsConfig: boolean | CorsOptions = true,\n): void {\n  if (corsConfig === false) return;\n\n  if (corsConfig === true) {\n    // Simple CORS - allow all\n    res.set('Access-Control-Allow-Origin', '*');\n    res.set('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');\n    res.set('Access-Control-Allow-Headers', 'Content-Type');\n  } else {\n    // Custom CORS configuration\n    if (corsConfig.origin) {\n      const origin = Array.isArray(corsConfig.origin)\n        ? corsConfig.origin.join(', ')\n        : corsConfig.origin;\n      res.set('Access-Control-Allow-Origin', origin);\n    }\n\n    if (corsConfig.methods) {\n      res.set('Access-Control-Allow-Methods', corsConfig.methods.join(', '));\n    }\n\n    if (corsConfig.headers) {\n      res.set('Access-Control-Allow-Headers', corsConfig.headers.join(', '));\n    }\n\n    if (corsConfig.credentials) {\n      res.set('Access-Control-Allow-Credentials', 'true');\n    }\n\n    if (corsConfig.maxAge) {\n      res.set('Access-Control-Max-Age', String(corsConfig.maxAge));\n    }\n  }\n}\n\n/**\n * 1x1 transparent GIF for pixel tracking\n * Base64-encoded GIF (43 bytes)\n */\nexport const TRANSPARENT_GIF = Buffer.from(\n  'R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7',\n  'base64',\n);\n"],"mappings":";AAAA,OAAO,aAA8C;AACrD,OAAO,UAAU;AACjB,SAAS,eAAe,qBAAqB;;;ACF7C,SAAS,mBAAmB;;;ACA5B,SAAS,KAAAA,UAAS;;;ACAlB,SAAS,SAAS;AAKX,IAAM,aAAa,EAAE,KAAK;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,cAAc,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC;AAK1C,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,MAAM,EACH,OAAO,EACP,SAAS,qDAAqD;AAAA,EACjE,SAAS,EACN,MAAM,WAAW,EACjB,IAAI,CAAC,EACL,SAAS,6DAA6D,EACtE,SAAS;AACd,CAAC;AASM,IAAM,aAAa,EAAE,MAAM;AAAA,EAChC,EAAE,OAAO;AAAA,EACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAClB,EAAE,QAAQ,GAAG;AACf,CAAC;AAMM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,QAAQ,WAAW;AAAA,IACjB;AAAA,EACF,EAAE,SAAS;AAAA,EAEX,SAAS,EAAE,MAAM,UAAU,EAAE,SAAS,sBAAsB,EAAE,SAAS;AAAA,EAEvE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,yBAAyB,EAAE,SAAS;AAAA,EAE1E,aAAa,EACV,QAAQ,EACR,SAAS,oDAAoD,EAC7D,SAAS;AAAA,EAEZ,QAAQ,EACL,OAAO,EACP,IAAI,EACJ,SAAS,EACT,SAAS,qCAAqC,EAC9C,SAAS;AACd,CAAC;;;ADlEM,IAAM,iBAAiBC,GAAE,OAAO;AAAA,EACrC,MAAMA,GACH,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,KAAK,EACT;AAAA,IACC;AAAA,EACF,EACC,SAAS;AAAA;AAAA,EAGZ,MAAMA,GAAE,OAAO,EAAE,SAAS,+BAA+B,EAAE,SAAS;AAAA,EAEpE,OAAOA,GACJ,MAAMA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC,EAC9C,IAAI,CAAC,EACL;AAAA,IACC;AAAA,EACF,EACC,SAAS;AAAA,EAEZ,MAAMA,GACH,MAAM,CAACA,GAAE,QAAQ,GAAG,iBAAiB,CAAC,EACtC;AAAA,IACC;AAAA,EACF,EACC,QAAQ,IAAI;AACjB,CAAC;;;AD3BM,IAAM,WAAW,YAAY,cAAc;;;AGE3C,SAAS,eACd,KACA,aAAoC,MAC9B;AACN,MAAI,eAAe,MAAO;AAE1B,MAAI,eAAe,MAAM;AAEvB,QAAI,IAAI,+BAA+B,GAAG;AAC1C,QAAI,IAAI,gCAAgC,oBAAoB;AAC5D,QAAI,IAAI,gCAAgC,cAAc;AAAA,EACxD,OAAO;AAEL,QAAI,WAAW,QAAQ;AACrB,YAAM,SAAS,MAAM,QAAQ,WAAW,MAAM,IAC1C,WAAW,OAAO,KAAK,IAAI,IAC3B,WAAW;AACf,UAAI,IAAI,+BAA+B,MAAM;AAAA,IAC/C;AAEA,QAAI,WAAW,SAAS;AACtB,UAAI,IAAI,gCAAgC,WAAW,QAAQ,KAAK,IAAI,CAAC;AAAA,IACvE;AAEA,QAAI,WAAW,SAAS;AACtB,UAAI,IAAI,gCAAgC,WAAW,QAAQ,KAAK,IAAI,CAAC;AAAA,IACvE;AAEA,QAAI,WAAW,aAAa;AAC1B,UAAI,IAAI,oCAAoC,MAAM;AAAA,IACpD;AAEA,QAAI,WAAW,QAAQ;AACrB,UAAI,IAAI,0BAA0B,OAAO,WAAW,MAAM,CAAC;AAAA,IAC7D;AAAA,EACF;AACF;AAMO,IAAM,kBAAkB,OAAO;AAAA,EACpC;AAAA,EACA;AACF;;;AJjCO,IAAM,gBAAgB,OAC3B,YAC2B;AAvB7B;AAwBE,QAAM,EAAE,SAAS,CAAC,GAAG,IAAI,IAAI;AAC7B,QAAM,cAAa,SAAI,YAAJ,YAAe;AAClC,QAAM,WAAU,SAAI,SAAJ,YAAY;AAG5B,QAAM,SAAS,eAAe,MAAM,OAAO,YAAY,CAAC,CAAC;AACzD,QAAMC,YAAW;AAAA,IACf,GAAG;AAAA,IACH,QAAO,YAAO,UAAP,YAAiB,OAAO,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU;AAAA,EACnE;AAEA,QAAM,MAAM,WAAW;AAGvB,MAAI,IAAI,WAAW,KAAK,EAAE,OAAO,MAAM,CAAC,CAAC;AACzC,MAAI,IAAI,WAAW,KAAK,EAAE,OAAO,MAAM,CAAC,CAAC;AAGzC,MAAIA,UAAS,SAAS,OAAO;AAC3B,UAAM,cAAcA,UAAS,SAAS,OAAO,CAAC,IAAIA,UAAS;AAC3D,QAAI,IAAI,QAAQ,WAAW,CAAC;AAAA,EAC9B;AAMA,QAAM,OAAO,OAAO,KAAc,QAAiC;AACjE,QAAI;AAEF,UAAI,IAAI,WAAW,WAAW;AAC5B,uBAAe,KAAKA,UAAS,IAAI;AACjC,YAAI,OAAO,GAAG,EAAE,KAAK;AACrB;AAAA,MACF;AAGA,YAAM,QAAQ,UAAU,GAAG;AAG3B,YAAM,UAAU,cAAc,CAAC,YAAY;AAhEjD,YAAAC;AAiEQ,cAAM,UAASA,MAAA,QAAQ,WAAR,OAAAA,MAAkB;AACjC,YAAI,QAAQ,SAAS;AACnB,qBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,gBAAI,IAAI,KAAK,KAAK;AAAA,UACpB;AAAA,QACF;AACA,YAAI,OAAO,MAAM;AACjB,YAAI,OAAO,QAAQ,SAAS,YAAY,OAAO,SAAS,QAAQ,IAAI,GAAG;AACrE,cAAI,KAAK,QAAQ,IAAI;AAAA,QACvB,OAAO;AACL,cAAI,KAAK,QAAQ,IAAI;AAAA,QACvB;AAAA,MACF,CAAC;AACD,cAAQ,WAAW,OAAO;AAG1B,UAAI,IAAI,WAAW,OAAO;AAExB,cAAM,aAAa,cAAc,IAAI,GAAG;AAGxC,YAAI,cAAc,OAAO,eAAe,UAAU;AAChD,gBAAM,IAAI,KAAK,UAAU;AAAA,QAC3B;AAGA,gBAAQ;AAAA,UACN,MAAM;AAAA,UACN,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,iBAAiB;AAAA,UACnB;AAAA,QACF,CAAC;AACD;AAAA,MACF;AAGA,UAAI,IAAI,WAAW,QAAQ;AACzB,cAAM,YACJ,IAAI,QAAQ,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,CAAC;AAEzD,cAAM,IAAI,KAAK,SAAS;AAExB,gBAAQ,EAAE,MAAM,EAAE,SAAS,MAAM,WAAW,KAAK,IAAI,EAAE,EAAE,CAAC;AAC1D;AAAA,MACF;AAGA,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,SAAS;AAAA,QACT,OAAO;AAAA,MACT,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,SAAS;AAAA,QACT,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MAClD,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,gBAAgBD,UAAS,MAAM;AAAA,IAAI,CAAC,UACxC,OAAO,UAAU,WACb,EAAE,MAAM,OAAO,SAAS,CAAC,OAAO,MAAM,EAAW,IACjD;AAAA,MACE,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM,WAAY,CAAC,OAAO,MAAM;AAAA,IAC3C;AAAA,EACN;AAEA,aAAW,SAAS,eAAe;AACjC,QAAI,MAAM,QAAQ,SAAS,MAAM,EAAG,KAAI,KAAK,MAAM,MAAM,IAAI;AAC7D,QAAI,MAAM,QAAQ,SAAS,KAAK,EAAG,KAAI,IAAI,MAAM,MAAM,IAAI;AAC3D,QAAI,QAAQ,MAAM,MAAM,IAAI;AAAA,EAC9B;AAGA,MAAI;AAEJ,MAAIA,UAAS,SAAS,QAAW;AAC/B,aAAS,IAAI,OAAOA,UAAS,MAAM,MAAM;AACvC,YAAM,aAAa,cAChB,IAAI,CAAC,MAAM;AACV,cAAM,UAAU,CAAC,GAAG,EAAE,SAAS,SAAS,EAAE,KAAK,IAAI;AACnD,eAAO,MAAM,OAAO,IAAI,EAAE,IAAI;AAAA,MAChC,CAAC,EACA,KAAK,IAAI;AACZ,UAAI,OAAO;AAAA,QACT,oCAAoCA,UAAS,IAAI;AAAA,IAAO;AAAA,MAC1D;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,WAA0B;AAAA,IAC9B,MAAM;AAAA,IACN,QAAQ;AAAA,MACN,GAAG;AAAA,MACH,UAAAA;AAAA,IACF;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA,SAAS,CAAC,aACR,IAAI,QAAc,CAAC,SAAS,WAAW;AACrC,UAAI,CAAC,OAAQ,QAAO,QAAQ;AAC5B,aAAO,MAAM,CAAC,QAAS,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAE;AAAA,IACvD,CAAC;AAAA,EACL;AAEA,SAAO;AACT;AAwBA,IAAO,gBAAQ;","names":["z","z","settings","_a"]}

package/dist/walkerOS.json

@@ -1,7 +1,7 @@
 {
   "$meta": {
     "package": "@walkeros/server-source-express",
-    "version": "3.0.2",
+    "version": "3.1.1",
     "type": "source",
     "platform": [
       "server"

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@walkeros/server-source-express",
   "description": "Express server source for walkerOS",
-  "version": "3.1.0",
+  "version": "3.2.0-next-1775064795590",
   "license": "MIT",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -19,8 +19,8 @@
     "update": "npx npm-check-updates -u && npm update"
   },
   "dependencies": {
-    "@walkeros/collector": "^3.1.0",
-    "@walkeros/core": "^3.1.0",
+    "@walkeros/collector": "3.2.0-next-1775064795590",
+    "@walkeros/core": "3.2.0-next-1775064795590",
     "express": "^5.2.1",
     "cors": "^2.8.5"
   },