@zmdb/web 1.0.0-beta.1

package/dist/dto-pipes/index.js

@@ -0,0 +1,78 @@
+// @zmdb/web — DTO validation & serialization pipes (epic #297, spec ./SPEC.md).
+// Bind routes to schema-derived DTO validation (a Pipe) and entity serialization
+// (an Interceptor), built on the middleware chain. Zero runtime parser (consumer
+// supplies the AOT assert); no `as` on the consumer surface.
+import { parseMultipart } from '../upload/index.js';
+/**
+ * A validation pipe: runs `validator` (e.g. `assert<CreateDTO<S>>`) on the body,
+ * yielding the typed value. A throw becomes the chain's 400. The framework
+ * embeds no parser — validation is the consumer's AOT `assert`.
+ */
+export function validationPipe(validator) {
+    return {
+        transform(value) {
+            return validator(value);
+        },
+    };
+}
+/**
+ * A pipe that only converts: the wire→app decode at the boundary (plan D3).
+ *
+ * Separate from `validationPipe` because the two do different jobs and the order matters.
+ * `wireDecoder(Schema)` turns the ISO string JSON carries into the `Date` a `CreateDTO`
+ * asks for; the validator then checks the app type. Decoding after validation would mean
+ * validating the wrong layer, and doing both in one function is how a validator ends up
+ * accepting `Date | string` and checking neither.
+ */
+export function decodePipe(decode) {
+    return {
+        transform(value) {
+            return decode(value);
+        },
+    };
+}
+/**
+ * Parse the exact request bytes as multipart at the ordinary pipe boundary.
+ *
+ * The returned `Multipart` remains available to later validation pipes, so form
+ * fields use the same validation path as JSON bodies.
+ */
+export function multipartPipe(limits = {}) {
+    const configured = { ...limits };
+    return {
+        transform(value, ctx) {
+            return parseMultipart(value, ctx.headers['content-type'] ?? '', configured);
+        },
+    };
+}
+/**
+ * A serialization interceptor: transforms the handler's result via `serialize`
+ * (default: identity — the pipeline JSON-encodes downstream). Pass an entity
+ * serializer to shape the response from `Entity<S>`.
+ */
+export function serializationInterceptor(serialize = r => r) {
+    return {
+        async intercept(_ctx, next) {
+            const result = await next();
+            return serialize(result);
+        },
+    };
+}
+/**
+ * Compose a Chain with the validation pipe (+ optional decode pipe and
+ * serialization interceptor), so a route adopts DTO validation/serialization in
+ * one call.
+ */
+export function dtoChain(options) {
+    return {
+        guards: [],
+        // Decode first, then validate: the validator checks the app type, which is only what
+        // the body holds once the two types JSON cannot carry have been converted.
+        pipes: options.decode === undefined
+            ? [validationPipe(options.validate)]
+            : [decodePipe(options.decode), validationPipe(options.validate)],
+        interceptors: options.serialize === undefined ? [] : [serializationInterceptor(options.serialize)],
+        filters: [],
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/dto-pipes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/dto-pipes/index.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,6DAA6D;AAG7D,OAAO,EAAE,cAAc,EAAqC,MAAM,oBAAoB,CAAC;AAEvF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAI,SAA8B;IAC9D,OAAO;QACL,SAAS,CAAC,KAAc;YACtB,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAA8B,MAA0B;IAChF,OAAO;QACL,SAAS,CAAC,KAAS;YACjB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAM,GAA0B,EAAE;IAC9D,MAAM,UAAU,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IACjC,OAAO;QACL,SAAS,CAAC,KAAK,EAAE,GAAG;YAClB,OAAO,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;QAC9E,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAS,GAAiC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI;YACxB,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAI,OAA2B;IACrD,OAAO;QACL,MAAM,EAAE,EAAE;QACV,qFAAqF;QACrF,2EAA2E;QAC3E,KAAK,EACH,OAAO,CAAC,MAAM,KAAK,SAAS;YAC1B,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpE,YAAY,EAAE,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClG,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC"}

package/dist/gateways/index.d.ts

@@ -0,0 +1,31 @@
+import '@zmdb/app';
+/** The context a subscribed handler receives. */
+export interface MessageCtx<T = unknown> {
+    readonly event: string;
+    readonly data: T;
+}
+/** A recorded event subscription. */
+export interface Subscription {
+    readonly event: string;
+    readonly handlerName: string;
+}
+/** Stage-3 class decorator: mark a gateway with an optional namespace. */
+export declare function Gateway(namespace?: string): <T extends abstract new (...args: never[]) => unknown>(_target: T, context: ClassDecoratorContext<T>) => void;
+/** Stage-3 method decorator: subscribe the method to an event. */
+export declare function Subscribe(event: string): (_target: (...args: never[]) => unknown, context: ClassMethodDecoratorContext) => void;
+/** Read a gateway class's subscriptions (declaration order). No reflection. */
+export declare function getSubscriptions(gateway: abstract new (...args: never[]) => unknown): readonly Subscription[];
+/** A dispatcher routing an event+message to the gateway's matching handler. */
+export interface GatewayDispatcher {
+    dispatch(event: string, data: unknown): Promise<unknown>;
+}
+/** Build a dispatcher for a gateway instance. */
+export declare function createGatewayDispatcher(gateway: object): GatewayDispatcher;
+/** A Server-Sent-Events frame. */
+export interface SseFrame<T = unknown> {
+    readonly event?: string;
+    readonly data: T;
+}
+/** Turn an async iterable of frames into an SSE-framed byte stream. */
+export declare function sseStream(source: AsyncIterable<SseFrame>): ReadableStream<Uint8Array>;
+//# sourceMappingURL=index.d.ts.map

package/dist/gateways/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/gateways/index.ts"],"names":[],"mappings":"AAKA,OAAO,WAAW,CAAC;AAEnB,iDAAiD;AACjD,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,OAAO;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;CAClB;AAED,qCAAqC;AACrC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAgBD,0EAA0E;AAC1E,wBAAgB,OAAO,CAAC,SAAS,SAAK,IACnB,CAAC,SAAS,QAAQ,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,WAC1D,CAAC,WACD,qBAAqB,CAAC,CAAC,CAAC,KAChC,IAAI,CAGR;AAED,kEAAkE;AAClE,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,aACX,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,WAAW,2BAA2B,KAAG,IAAI,CAUrG;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,GAAG,SAAS,YAAY,EAAE,CAM7G;AAID,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1D;AAED,iDAAiD;AACjD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,CAoB1E;AAqBD,kCAAkC;AAClC,MAAM,WAAW,QAAQ,CAAC,CAAC,GAAG,OAAO;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;CAClB;AAED,uEAAuE;AACvE,wBAAgB,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,UAAU,CAAC,CAyDrF"}

package/dist/gateways/index.js

@@ -0,0 +1,138 @@
+// @zmdb/web — WebSocket & SSE gateways (epic #307, spec ./SPEC.md). @Gateway/
+// @Subscribe store handlers in context.metadata; a dispatcher routes events with
+// a typed message ctx; sseStream frames an async iterable as SSE. No ws
+// dependency, no reflection, no `as` on the consumer surface.
+import '@zmdb/app';
+const NAMESPACE = Symbol('zmdb.web.gateway.namespace');
+const SUBSCRIPTIONS = Symbol('zmdb.web.gateway.subscriptions');
+// boundary: our @Gateway/@Subscribe decorators are the only writers of these
+// slots, so viewing the record through GatewayMetadata is sound (§2.1).
+function gatewayView(metadata) {
+    return metadata;
+}
+/** Stage-3 class decorator: mark a gateway with an optional namespace. */
+export function Gateway(namespace = '') {
+    return function (_target, context) {
+        gatewayView(context.metadata)[NAMESPACE] = namespace;
+    };
+}
+/** Stage-3 method decorator: subscribe the method to an event. */
+export function Subscribe(event) {
+    return function (_target, context) {
+        const handlerName = typeof context.name === 'string' ? context.name : context.name.toString();
+        const view = gatewayView(context.metadata);
+        const existing = view[SUBSCRIPTIONS];
+        if (existing === undefined) {
+            view[SUBSCRIPTIONS] = [{ event, handlerName }];
+        }
+        else {
+            existing.push({ event, handlerName });
+        }
+    };
+}
+/** Read a gateway class's subscriptions (declaration order). No reflection. */
+export function getSubscriptions(gateway) {
+    const metadata = gateway[Symbol.metadata];
+    if (metadata === undefined || metadata === null) {
+        return [];
+    }
+    return gatewayView(metadata)[SUBSCRIPTIONS] ?? [];
+}
+/** Build a dispatcher for a gateway instance. */
+export function createGatewayDispatcher(gateway) {
+    const ctor = gateway.constructor;
+    const subs = typeof ctor === 'function' ? getSubscriptions(gatewayClass(ctor)) : [];
+    const byEvent = new Map();
+    for (const sub of subs) {
+        byEvent.set(sub.event, sub.handlerName);
+    }
+    return {
+        async dispatch(event, data) {
+            const handlerName = byEvent.get(event);
+            if (handlerName === undefined) {
+                return undefined;
+            }
+            const handler = readMessageHandler(gateway, handlerName);
+            if (handler === undefined) {
+                return undefined;
+            }
+            return handler({ event, data });
+        },
+    };
+}
+// boundary: an instance's `.constructor` carries the gateway metadata; narrowing
+// it for getSubscriptions is sound (§2.1).
+function gatewayClass(ctor) {
+    return ctor;
+}
+// boundary: @Subscribe only records names of the gateway's own methods; reading
+// one by name and calling it as a MessageHandler is sound (§2.1).
+function readMessageHandler(gateway, name) {
+    const value = Reflect.get(gateway, name);
+    if (typeof value !== 'function') {
+        return undefined;
+    }
+    const bound = value.bind(gateway);
+    return bound;
+}
+/** Turn an async iterable of frames into an SSE-framed byte stream. */
+export function sseStream(source) {
+    const encoder = new TextEncoder();
+    const iterator = source[Symbol.asyncIterator]();
+    let state = 'open';
+    let cancellation;
+    const cancel = (reason) => {
+        if (state === 'closed') {
+            return Promise.resolve();
+        }
+        if (cancellation !== undefined) {
+            return cancellation;
+        }
+        state = 'cancelling';
+        cancellation = (async () => {
+            try {
+                await iterator.return?.(reason);
+            }
+            catch {
+                // A client disconnect is normal teardown. This helper has no error
+                // reporter, so a cleanup rejection must not become a server failure;
+                // sources that need reporting own it inside return/finally.
+            }
+            finally {
+                state = 'closed';
+            }
+        })();
+        return cancellation;
+    };
+    return new ReadableStream({
+        async pull(controller) {
+            if (state !== 'open') {
+                return;
+            }
+            let next;
+            try {
+                next = await iterator.next();
+            }
+            catch (error) {
+                if (state !== 'open') {
+                    return;
+                }
+                state = 'closed';
+                throw error;
+            }
+            if (state !== 'open') {
+                return;
+            }
+            const { value, done } = next;
+            if (done) {
+                state = 'closed';
+                controller.close();
+                return;
+            }
+            const prefix = value.event === undefined ? '' : `event: ${value.event}\n`;
+            controller.enqueue(encoder.encode(`${prefix}data: ${JSON.stringify(value.data)}\n\n`));
+        },
+        cancel,
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/gateways/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/gateways/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,iFAAiF;AACjF,wEAAwE;AACxE,8DAA8D;AAE9D,OAAO,WAAW,CAAC;AAcnB,MAAM,SAAS,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AACvD,MAAM,aAAa,GAAG,MAAM,CAAC,gCAAgC,CAAC,CAAC;AAO/D,6EAA6E;AAC7E,wEAAwE;AACxE,SAAS,WAAW,CAAC,QAA2B;IAC9C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,OAAO,CAAC,SAAS,GAAG,EAAE;IACpC,OAAO,UACL,OAAU,EACV,OAAiC;QAEjC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IACvD,CAAC,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,OAAsC,EAAE,OAAoC;QAC3F,MAAM,WAAW,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9F,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,OAAmD;IAClF,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;AACpD,CAAC;AASD,iDAAiD;AACjD,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,IAAa;YACzC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC;AAID,iFAAiF;AACjF,2CAA2C;AAC3C,SAAS,YAAY,CAAC,IAAc;IAClC,OAAO,IAAoB,CAAC;AAC9B,CAAC;AAED,gFAAgF;AAChF,kEAAkE;AAClE,SAAS,kBAAkB,CAAC,OAAe,EAAE,IAAY;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,KAAuB,CAAC;AACjC,CAAC;AAQD,uEAAuE;AACvE,MAAM,UAAU,SAAS,CAAC,MAA+B;IACvD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IAChD,IAAI,KAAK,GAAqC,MAAM,CAAC;IACrD,IAAI,YAAuC,CAAC;IAE5C,MAAM,MAAM,GAAG,CAAC,MAAe,EAAiB,EAAE;QAChD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,KAAK,GAAG,YAAY,CAAC;QACrB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,qEAAqE;gBACrE,4DAA4D;YAC9D,CAAC;oBAAS,CAAC;gBACT,KAAK,GAAG,QAAQ,CAAC;YACnB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC;IAEF,OAAO,IAAI,cAAc,CAAa;QACpC,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,IAAI,IAA8B,CAAC;YACnC,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;oBACrB,OAAO;gBACT,CAAC;gBACD,KAAK,GAAG,QAAQ,CAAC;gBACjB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;YAC7B,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,GAAG,QAAQ,CAAC;gBACjB,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,KAAK,IAAI,CAAC;YAC1E,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACzF,CAAC;QACD,MAAM;KACP,CAAC,CAAC;AACL,CAAC"}

package/dist/health/index.d.ts

@@ -0,0 +1,20 @@
+import type { DetailedCheck, HealthChecks } from '@zmdb/app/health';
+import { type WebResponse } from '../pipeline/index.js';
+export interface HealthProbes {
+    readonly live: () => WebResponse;
+    readonly ready: () => Promise<WebResponse>;
+}
+export interface DetailedBody {
+    readonly status: 'ok' | 'error';
+    readonly checks: readonly DetailedCheck[];
+}
+/** Build the public liveness and readiness handlers from this application's explicit checks. */
+export declare function healthRoutes(checks: HealthChecks): HealthProbes;
+/**
+ * Build the opt-in detailed readiness handler.
+ *
+ * Mount this separate handler through the application's normal RouteOptions.guards composition.
+ * The public handlers returned by healthRoutes never expose names, details, or timings.
+ */
+export declare function detailedReadyRoute(checks: HealthChecks): () => Promise<WebResponse>;
+//# sourceMappingURL=index.d.ts.map

package/dist/health/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/health/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAe,aAAa,EAAE,YAAY,EAAiC,MAAM,kBAAkB,CAAC;AAEhH,OAAO,EAAQ,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAK9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,WAAW,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAC3C;AAwJD,gGAAgG;AAChG,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAU/D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAOnF"}

package/dist/health/index.js

@@ -0,0 +1,148 @@
+// @zmdb/web — HTTP liveness and readiness routes (#581, epic #578).
+// Liveness is synchronous by type. Readiness is concurrent, bounded, success-cached,
+// and coalesced while a probe invocation is still waiting.
+import { json } from '../pipeline/index.js';
+const DEFAULT_CACHE_MS = 1000;
+const DEADLINE_GRACE_MS = 50;
+function createCheckState() {
+    return {};
+}
+function publicResponse(ok) {
+    return json({ status: ok ? 'ok' : 'error' }, ok ? {} : { status: 503 });
+}
+function runLiveness(checks) {
+    for (const check of checks) {
+        try {
+            if (!check.run()) {
+                return false;
+            }
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
+function createReadinessRunner(checks) {
+    const entries = checks.map(check => ({ check, state: createCheckState() }));
+    return {
+        run: () => {
+            if (entries.length === 0) {
+                return Promise.resolve([]);
+            }
+            const completed = entries.map(() => undefined);
+            const running = entries.map(({ check, state }, index) => runReadinessCheck(check, state).then(result => {
+                completed[index] = result;
+                return result;
+            }));
+            const aggregateDeadline = Math.max(...entries.map(({ check }) => check.timeoutMs)) + DEADLINE_GRACE_MS;
+            const startedAt = Date.now();
+            return new Promise(resolve => {
+                let settled = false;
+                const finish = (results) => {
+                    if (settled) {
+                        return;
+                    }
+                    settled = true;
+                    clearTimeout(timer);
+                    resolve(results);
+                };
+                const timer = setTimeout(() => {
+                    finish(entries.map(({ check }, index) => completed[index] ?? {
+                        name: check.name,
+                        ok: false,
+                        detail: 'timeout',
+                        durationMs: Math.max(0, Date.now() - startedAt),
+                    }));
+                }, aggregateDeadline);
+                void Promise.all(running).then(finish);
+            });
+        },
+    };
+}
+function runReadinessCheck(check, state) {
+    const now = Date.now();
+    if (state.cached !== undefined) {
+        if (now < state.cached.expiresAt) {
+            return Promise.resolve(state.cached.result);
+        }
+        delete state.cached;
+    }
+    if (state.inFlight !== undefined) {
+        return state.inFlight;
+    }
+    const startedAt = now;
+    const controller = new AbortController();
+    const pending = new Promise(resolve => {
+        let settled = false;
+        let timedOut = false;
+        const finish = (result) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            clearTimeout(abortTimer);
+            clearTimeout(deadlineTimer);
+            const detailed = {
+                name: check.name,
+                ok: result.ok,
+                ...(result.detail === undefined ? {} : { detail: result.detail }),
+                durationMs: Math.max(0, Date.now() - startedAt),
+            };
+            if (result.ok) {
+                state.cached = {
+                    expiresAt: Date.now() + (check.cacheMs ?? DEFAULT_CACHE_MS),
+                    result: detailed,
+                };
+            }
+            resolve(detailed);
+        };
+        const abortTimer = setTimeout(() => {
+            timedOut = true;
+            controller.abort();
+        }, check.timeoutMs);
+        const deadlineTimer = setTimeout(() => {
+            finish({ ok: false, detail: 'timeout' });
+        }, check.timeoutMs + DEADLINE_GRACE_MS);
+        try {
+            void check.run(controller.signal).then(result => finish(timedOut ? { ok: false, detail: 'timeout' } : result), () => finish(timedOut ? { ok: false, detail: 'timeout' } : { ok: false }));
+        }
+        catch {
+            finish({ ok: false });
+        }
+    });
+    state.inFlight = pending;
+    void pending.finally(() => {
+        if (state.inFlight === pending) {
+            delete state.inFlight;
+        }
+    });
+    return pending;
+}
+/** Build the public liveness and readiness handlers from this application's explicit checks. */
+export function healthRoutes(checks) {
+    const liveness = checks.liveness ?? [];
+    const readiness = createReadinessRunner(checks.readiness ?? []);
+    return {
+        live: () => publicResponse(runLiveness(liveness)),
+        ready: async () => {
+            const results = await readiness.run();
+            return publicResponse(results.every(result => result.ok));
+        },
+    };
+}
+/**
+ * Build the opt-in detailed readiness handler.
+ *
+ * Mount this separate handler through the application's normal RouteOptions.guards composition.
+ * The public handlers returned by healthRoutes never expose names, details, or timings.
+ */
+export function detailedReadyRoute(checks) {
+    const readiness = createReadinessRunner(checks.readiness ?? []);
+    return async () => {
+        const results = await readiness.run();
+        const ok = results.every(result => result.ok);
+        return json({ status: ok ? 'ok' : 'error', checks: results }, ok ? {} : { status: 503 });
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/health/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/health/index.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,qFAAqF;AACrF,2DAA2D;AAI3D,OAAO,EAAE,IAAI,EAAoB,MAAM,sBAAsB,CAAC;AAE9D,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AA0B7B,SAAS,gBAAgB;IACvB,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,cAAc,CAAC,EAAW;IACjC,OAAO,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,WAAW,CAAC,MAAgC;IACnD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAiC;IAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC;IAE5E,OAAO;QACL,GAAG,EAAE,GAAG,EAAE;YACR,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC7B,CAAC;YAED,MAAM,SAAS,GAAkC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CACtD,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAC5C,SAAS,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;gBAC1B,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC,CACH,CAAC;YACF,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,iBAAiB,CAAC;YACvG,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE7B,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;gBAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,MAAM,MAAM,GAAG,CAAC,OAAiC,EAAQ,EAAE;oBACzD,IAAI,OAAO,EAAE,CAAC;wBACZ,OAAO;oBACT,CAAC;oBACD,OAAO,GAAG,IAAI,CAAC;oBACf,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,CAAC,OAAO,CAAC,CAAC;gBACnB,CAAC,CAAC;gBACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC5B,MAAM,CACJ,OAAO,CAAC,GAAG,CACT,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAiB,EAAE,CAClC,SAAS,CAAC,KAAK,CAAC,IAAI;wBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,SAAS;wBACjB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;qBAChD,CACJ,CACF,CAAC;gBACJ,CAAC,EAAE,iBAAiB,CAAC,CAAC;gBAEtB,KAAK,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAqB,EAAE,KAAiB;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,QAAQ,CAAC;IACxB,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC;IACtB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAgB,OAAO,CAAC,EAAE;QACnD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,MAAM,GAAG,CAAC,MAAmB,EAAQ,EAAE;YAC3C,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,UAAU,CAAC,CAAC;YACzB,YAAY,CAAC,aAAa,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG;gBACf,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;gBACjE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;aAChD,CAAC;YACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,KAAK,CAAC,MAAM,GAAG;oBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,gBAAgB,CAAC;oBAC3D,MAAM,EAAE,QAAQ;iBACjB,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC,CAAC;QAEF,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;YACjC,QAAQ,GAAG,IAAI,CAAC;YAChB,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACpB,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YACpC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3C,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAAC;QAExC,IAAI,CAAC;YACH,KAAK,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CACpC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EACtE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAC1E,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC;IACzB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;QACxB,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,QAAQ,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,YAAY,CAAC,MAAoB;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACjD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC;YACtC,OAAO,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC;AACJ,CAAC"}

package/dist/http-token.d.ts

@@ -0,0 +1,2 @@
+export declare function isHttpTokenCode(code: number): boolean;
+//# sourceMappingURL=http-token.d.ts.map

package/dist/http-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-token.d.ts","sourceRoot":"","sources":["../src/http-token.ts"],"names":[],"mappings":"AAAA,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAqBrD"}

package/dist/http-token.js

@@ -0,0 +1,21 @@
+export function isHttpTokenCode(code) {
+    return ((code >= 48 && code <= 57) ||
+        (code >= 65 && code <= 90) ||
+        (code >= 97 && code <= 122) ||
+        code === 33 ||
+        code === 35 ||
+        code === 36 ||
+        code === 37 ||
+        code === 38 ||
+        code === 39 ||
+        code === 42 ||
+        code === 43 ||
+        code === 45 ||
+        code === 46 ||
+        code === 94 ||
+        code === 95 ||
+        code === 96 ||
+        code === 124 ||
+        code === 126);
+}
+//# sourceMappingURL=http-token.js.map

package/dist/http-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-token.js","sourceRoot":"","sources":["../src/http-token.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,CACL,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;QAC1B,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;QAC1B,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,GAAG,CAAC;QAC3B,IAAI,KAAK,EAAE;QACX,IAAI,KAAK,EAAE;QACX,IAAI,KAAK,EAAE;QACX,IAAI,KAAK,EAAE;QACX,IAAI,KAAK,EAAE;QACX,IAAI,KAAK,EAAE;QACX,IAAI,KAAK,EAAE;QACX,IAAI,KAAK,EAAE;QACX,IAAI,KAAK,EAAE;QACX,IAAI,KAAK,EAAE;QACX,IAAI,KAAK,EAAE;QACX,IAAI,KAAK,EAAE;QACX,IAAI,KAAK,EAAE;QACX,IAAI,KAAK,GAAG;QACZ,IAAI,KAAK,GAAG,CACb,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+import '@zmdb/app';
+export { Controller, Get, Post, Put, Patch, Delete, Public, getRoutes, isPublic, type RouteDefinition, type ResolvedRoute, } from './routing/index.js';
+export { defineHttpContract, httpOperation, type AuthorizationCodeFlow, type ClientCredentialsFlow, type CompiledHttpContract, type CompiledHttpOperation, type HttpBodyDeclaration, type HttpBodyIR, type HttpBodyKind, type HttpContractDeclaration, type HttpContractIR, type HttpController, type HttpMethod, type HttpOperationDeclaration, type HttpOperationIR, type HttpOperationTypes, type HttpParameterDeclaration, type HttpParameterIR, type HttpRequestBodyDeclaration, type HttpRequestBodyIR, type HttpResponseDeclaration, type HttpResponseHeaderDeclaration, type HttpResponseHeaderIR, type HttpResponseIR, type HttpTypeIR, type HttpVersionDeclaration, type HttpVersionIR, type ImplicitFlow, type JsonValue, type OAuthFlow, type OAuthFlows, type PasswordFlow, type SecurityRequirement, type SecurityScheme, } from './contract/index.js';
+export { Version, VersionNeutral, versionsOf, type VersionStrategy } from './versioning/index.js';
+export { extractParams, compilePattern, countSegments, matchCompiled, type CompiledPattern, type PathParams, type QueryValues, type Ctx, type HandlerFor, } from './context/index.js';
+export { createRouter, toNodeHandler, toFetchHandler, json, text, respond, bytes, stream, file, bodyText, type Router, type WebRequest, type WebResponse, type ResponseBody, type RouteOptions, type GuardRegistry, type RouterOptions, type ResponseOptions, type StreamOptions, type FileResponseOptions, type AdapterOptions, } from './pipeline/index.js';
+export { createStaticHandler, type StaticHandler, type StaticOptions } from './static/index.js';
+export { compress, compressionInterceptor, type CompressionOptions, type ContentCoding } from './compression/index.js';
+export { createTracedRouter } from './traced-router.js';
+export { validateWith } from './data/index.js';
+export { runChain, ChainError, type AnyCtx, type Guard, type SecurityAwareGuard, type Pipe, type Interceptor, type ExceptionFilter, type Chain, type ChainHandler, } from './middleware/index.js';
+export { createApp, type WebApplication, type WebApplicationOptions } from './app/index.js';
+export { validationPipe, multipartPipe, serializationInterceptor, dtoChain, type DtoChainOptions, } from './dto-pipes/index.js';
+export { parseMultipart, UPLOAD_DEFAULTS, type Multipart, type UploadLimits, type UploadPart } from './upload/index.js';
+export { createCsrf, type Csrf, type CsrfOptions } from './csrf/index.js';
+export { toOpenApi, serveOpenApi, type JsonSchema, type OpenApiDocument, type OpenApiRenderOptions, } from './openapi/index.js';
+export { Gateway, Subscribe, getSubscriptions, createGatewayDispatcher, sseStream, type MessageCtx, type Subscription, type GatewayDispatcher, type SseFrame, } from './gateways/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,WAAW,CAAC;AAGnB,OAAO,EACL,UAAU,EACV,GAAG,EACH,IAAI,EACJ,GAAG,EACH,KAAK,EACL,MAAM,EACN,MAAM,EACN,SAAS,EACT,QAAQ,EACR,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,6BAA6B,EAClC,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,cAAc,GACpB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGlG,OAAO,EACL,aAAa,EACb,cAAc,EACd,aAAa,EACb,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,GAAG,EACR,KAAK,UAAU,GAChB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,KAAK,EACL,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,cAAc,GACpB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGhG,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,KAAK,kBAAkB,EAAE,KAAK,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAGvH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGxD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C,OAAO,EACL,QAAQ,EACR,UAAU,EACV,KAAK,MAAM,EACX,KAAK,KAAK,EACV,KAAK,kBAAkB,EACvB,KAAK,IAAI,EACT,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,KAAK,EACV,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAG5F,OAAO,EACL,cAAc,EACd,aAAa,EACb,wBAAwB,EACxB,QAAQ,EACR,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,KAAK,SAAS,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGxH,OAAO,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG1E,OAAO,EACL,SAAS,EACT,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,OAAO,EACP,SAAS,EACT,gBAAgB,EAChB,uBAAuB,EACvB,SAAS,EACT,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,QAAQ,GACd,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -0,0 +1,40 @@
+// @zmdb/web — the HTTP adapter for the zmdb application kernel.
+//
+// Stage-3 metadata, DI, modules and lifecycle are installed and owned by
+// @zmdb/app. Importing the web root activates that one metadata baseline before
+// any HTTP decorator is evaluated.
+import '@zmdb/app';
+// Controllers & routing (Stage-3 decorators → context.metadata). See ./routing.
+export { Controller, Get, Post, Put, Patch, Delete, Public, getRoutes, isPublic, } from './routing/index.js';
+// Inert HTTP declarations and serialisable operation IR. The compiler-backed
+// collector is intentionally available only from `@zmdb/web/contract/compiler`.
+export { defineHttpContract, httpOperation, } from './contract/index.js';
+// API version declarations and strategy types. See ./versioning.
+export { Version, VersionNeutral, versionsOf } from './versioning/index.js';
+// Typed request context + compile-time path-param derivation. See ./context.
+export { extractParams, compilePattern, countSegments, matchCompiled, } from './context/index.js';
+// Request pipeline & runtime adapters. See ./pipeline.
+export { createRouter, toNodeHandler, toFetchHandler, json, text, respond, bytes, stream, file, bodyText, } from './pipeline/index.js';
+// Confined static files with validators and single-range streaming. See ./static.
+export { createStaticHandler } from './static/index.js';
+// Incremental, cross-runtime gzip/deflate middleware. See ./compression.
+export { compress, compressionInterceptor } from './compression/index.js';
+// HTTP router construction over app-owned observability ports.
+export { createTracedRouter } from './traced-router.js';
+// HTTP validation and wire conversion. Repository DI tokens are app-owned.
+export { validateWith } from './data/index.js';
+// Guards, pipes, interceptors & exception filters. See ./middleware.
+export { runChain, ChainError, } from './middleware/index.js';
+// HTTP application bootstrap over one app-owned graph. See ./app.
+export { createApp } from './app/index.js';
+// DTO validation & serialization pipes. See ./dto-pipes.
+export { validationPipe, multipartPipe, serializationInterceptor, dtoChain, } from './dto-pipes/index.js';
+// Bounded multipart/form-data parsing. See ./upload.
+export { parseMultipart, UPLOAD_DEFAULTS } from './upload/index.js';
+// Stateless, session-bound CSRF protection. See ./csrf.
+export { createCsrf } from './csrf/index.js';
+// OpenAPI 3.1 projection from the shared HTTP contract IR. See ./openapi.
+export { toOpenApi, serveOpenApi, } from './openapi/index.js';
+// WebSocket & SSE gateways. See ./gateways.
+export { Gateway, Subscribe, getSubscriptions, createGatewayDispatcher, sseStream, } from './gateways/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,EAAE;AACF,yEAAyE;AACzE,gFAAgF;AAChF,mCAAmC;AACnC,OAAO,WAAW,CAAC;AAEnB,gFAAgF;AAChF,OAAO,EACL,UAAU,EACV,GAAG,EACH,IAAI,EACJ,GAAG,EACH,KAAK,EACL,MAAM,EACN,MAAM,EACN,SAAS,EACT,QAAQ,GAGT,MAAM,oBAAoB,CAAC;AAE5B,6EAA6E;AAC7E,gFAAgF;AAChF,OAAO,EACL,kBAAkB,EAClB,aAAa,GAiCd,MAAM,qBAAqB,CAAC;AAE7B,iEAAiE;AACjE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAwB,MAAM,uBAAuB,CAAC;AAElG,6EAA6E;AAC7E,OAAO,EACL,aAAa,EACb,cAAc,EACd,aAAa,EACb,aAAa,GAMd,MAAM,oBAAoB,CAAC;AAE5B,uDAAuD;AACvD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,KAAK,EACL,MAAM,EACN,IAAI,EACJ,QAAQ,GAYT,MAAM,qBAAqB,CAAC;AAE7B,kFAAkF;AAClF,OAAO,EAAE,mBAAmB,EAA0C,MAAM,mBAAmB,CAAC;AAEhG,yEAAyE;AACzE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAA+C,MAAM,wBAAwB,CAAC;AAEvH,+DAA+D;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,2EAA2E;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,qEAAqE;AACrE,OAAO,EACL,QAAQ,EACR,UAAU,GASX,MAAM,uBAAuB,CAAC;AAE/B,kEAAkE;AAClE,OAAO,EAAE,SAAS,EAAmD,MAAM,gBAAgB,CAAC;AAE5F,yDAAyD;AACzD,OAAO,EACL,cAAc,EACd,aAAa,EACb,wBAAwB,EACxB,QAAQ,GAET,MAAM,sBAAsB,CAAC;AAE9B,qDAAqD;AACrD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAsD,MAAM,mBAAmB,CAAC;AAExH,wDAAwD;AACxD,OAAO,EAAE,UAAU,EAA+B,MAAM,iBAAiB,CAAC;AAE1E,0EAA0E;AAC1E,OAAO,EACL,SAAS,EACT,YAAY,GAIb,MAAM,oBAAoB,CAAC;AAE5B,4CAA4C;AAC5C,OAAO,EACL,OAAO,EACP,SAAS,EACT,gBAAgB,EAChB,uBAAuB,EACvB,SAAS,GAKV,MAAM,qBAAqB,CAAC"}

package/dist/integrations/index.d.ts

@@ -0,0 +1,11 @@
+export interface Handler<In, Out> {
+    validate: (raw: unknown) => In;
+    handle: (input: In) => Promise<Out>;
+    serialize?: (out: Out) => string;
+}
+export interface EndpointResult {
+    status: number;
+    body: string;
+}
+export declare function makeEndpoint<In, Out>(h: Handler<In, Out>): (raw: unknown) => Promise<EndpointResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/integrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/integrations/index.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,OAAO,CAAC,EAAE,EAAE,GAAG;IAC9B,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,EAAE,CAAC;IAC/B,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,cAAc,CAAC,CA2BpG"}

package/dist/integrations/index.js

@@ -0,0 +1,39 @@
+// Framework-agnostic endpoint adapter — see ./SPEC.md.
+import { claimsValidationIssues, ValidationError, validationIssuesOf } from '@zmdb/validator';
+export function makeEndpoint(h) {
+    const serialize = h.serialize ?? ((o) => JSON.stringify(o));
+    return async (raw) => {
+        let input;
+        try {
+            input = h.validate(raw);
+        }
+        catch (err) {
+            const error = err instanceof Error ? err.message : 'invalid input';
+            const issues = validationIssuesOf(err);
+            return { status: 400, body: JSON.stringify(issues ? { error, issues } : { error }) };
+        }
+        try {
+            const out = await h.handle(input);
+            return { status: 200, body: serialize(out) };
+        }
+        catch (err) {
+            // A validation error from the *handler* is still the caller's fault — a write that
+            // failed its own schema check on the way to the driver — so it is a 400 and not a 500.
+            // Anything else is rethrown untouched: this adapter has no business deciding what an
+            // unexpected exception means.
+            if (err instanceof ValidationError || claimsValidationIssues(err)) {
+                const error = err instanceof Error ? err.message : 'invalid input';
+                const issues = validationIssuesOf(err);
+                return { status: 400, body: JSON.stringify(issues ? { error, issues } : { error }) };
+            }
+            throw err;
+        }
+    };
+}
+// --- Thin per-framework adapters (optional; no hard deps) ---
+// Hono:    app.post('/x', async (c) => { const r = await ep(await c.req.json()); return c.body(r.body, r.status); })
+// Express: app.post('/x', async (req,res) => { const r = await ep(req.body); res.status(r.status).send(r.body); })
+// tRPC:    procedure.input(z.unknown()).mutation(({input}) => ep(input))
+// NestJS:  @Post() async create(@Body() b){ return ep(b); }
+// Each is a 1–2 line wrapper over makeEndpoint — see docs/framework-integrations.
+//# sourceMappingURL=index.js.map

package/dist/integrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/integrations/index.ts"],"names":[],"mappings":"AAAA,uDAAuD;AAEvD,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAa9F,MAAM,UAAU,YAAY,CAAU,CAAmB;IACvD,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,KAAK,EAAE,GAAY,EAAE,EAAE;QAC5B,IAAI,KAAS,CAAC;QACd,IAAI,CAAC;YACH,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACnE,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACvF,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mFAAmF;YACnF,uFAAuF;YACvF,qFAAqF;YACrF,8BAA8B;YAC9B,IAAI,GAAG,YAAY,eAAe,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClE,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACnE,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBACvC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACvF,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,qHAAqH;AACrH,mHAAmH;AACnH,yEAAyE;AACzE,4DAA4D;AAC5D,kFAAkF"}

package/dist/middleware/errors.d.ts

@@ -0,0 +1,14 @@
+/** An error carrying an HTTP status, thrown when a middleware chain short-circuits. */
+export declare class ChainError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+/**
+ * Internal boundary error whose status is already the framework's decision.
+ *
+ * Ordinary user-thrown pipe errors still become ChainError(400). Built-in
+ * boundary parsers use this subclass when 400 and 413 have distinct meanings.
+ */
+export declare class BoundaryStatusError extends ChainError {
+}
+//# sourceMappingURL=errors.d.ts.map