flowingts 0.0.0 → 0.19.0

package/dist/middlewares/rate-limit.d.ts

@@ -0,0 +1,35 @@
+import type { Context } from '../core/context.ts';
+import type { Middleware } from '../core/compose.ts';
+export interface RateLimitStore {
+    /** Incrementa o contador da chave e retorna o total e quando a janela reinicia (epoch ms). */
+    hit(key: string, windowMs: number): {
+        count: number;
+        resetAt: number;
+    } | Promise<{
+        count: number;
+        resetAt: number;
+    }>;
+}
+export interface RateLimitOptions {
+    /** Máximo de requisições por janela. */
+    max: number;
+    /** Tamanho da janela em ms. Padrão: 60_000. */
+    windowMs?: number;
+    /** Chave de agrupamento. Padrão: IP do socket (`ctx.ip`). */
+    key?: (ctx: Context) => string;
+    /** Store plugável (Redis etc.). Padrão: memória local. */
+    store?: RateLimitStore;
+}
+/** Store em memória, janela fixa. Adequado para uma única instância. */
+export declare class MemoryRateLimitStore implements RateLimitStore {
+    private hits;
+    private sweeper;
+    constructor(sweepEveryMs?: number);
+    hit(key: string, windowMs: number): {
+        count: number;
+        resetAt: number;
+    };
+}
+/** Rate limiting por chave (S-06). Responde 429 com `Retry-After` ao exceder. */
+export declare function rateLimit(opts: RateLimitOptions): Middleware;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/middlewares/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/middlewares/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD,MAAM,WAAW,cAAc;IAC7B,8FAA8F;IAC9F,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtH;AAED,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IAC/B,0DAA0D;IAC1D,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,wEAAwE;AACxE,qBAAa,oBAAqB,YAAW,cAAc;IACzD,OAAO,CAAC,IAAI,CAAyD;IACrE,OAAO,CAAC,OAAO,CAAiB;IAEhC,YAAY,YAAY,SAAS,EAMhC;IAED,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;eAXO,MAAM;iBAAW,MAAM;MAoB9D;CACF;AAED,iFAAiF;AACjF,wBAAgB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,UAAU,CAkB5D"}

package/dist/middlewares/rate-limit.js

@@ -0,0 +1,45 @@
+import { HttpError } from '../core/errors.js';
+/** Store em memória, janela fixa. Adequado para uma única instância. */
+export class MemoryRateLimitStore {
+    hits = new Map();
+    sweeper;
+    constructor(sweepEveryMs = 60_000) {
+        this.sweeper = setInterval(() => {
+            const now = Date.now();
+            for (const [k, v] of this.hits)
+                if (v.resetAt <= now)
+                    this.hits.delete(k);
+        }, sweepEveryMs);
+        this.sweeper.unref();
+    }
+    hit(key, windowMs) {
+        const now = Date.now();
+        let entry = this.hits.get(key);
+        if (!entry || entry.resetAt <= now) {
+            entry = { count: 0, resetAt: now + windowMs };
+            this.hits.set(key, entry);
+        }
+        entry.count++;
+        return { ...entry };
+    }
+}
+/** Rate limiting por chave (S-06). Responde 429 com `Retry-After` ao exceder. */
+export function rateLimit(opts) {
+    const windowMs = opts.windowMs ?? 60_000;
+    const store = opts.store ?? new MemoryRateLimitStore();
+    const keyOf = opts.key ?? ((ctx) => ctx.ip);
+    return async (ctx, next) => {
+        const { count, resetAt } = await store.hit(keyOf(ctx), windowMs);
+        const remaining = Math.max(0, opts.max - count);
+        const resetSec = Math.max(0, Math.ceil((resetAt - Date.now()) / 1000));
+        ctx.res.setHeader('RateLimit-Limit', String(opts.max));
+        ctx.res.setHeader('RateLimit-Remaining', String(remaining));
+        ctx.res.setHeader('RateLimit-Reset', String(resetSec));
+        if (count > opts.max) {
+            ctx.res.setHeader('Retry-After', String(resetSec));
+            throw new HttpError(429, 'Too Many Requests', 'RATE_LIMITED');
+        }
+        await next();
+    };
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/middlewares/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/middlewares/rate-limit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAkB9C,wEAAwE;AACxE,MAAM,OAAO,oBAAoB;IACvB,IAAI,GAAG,IAAI,GAAG,EAA8C,CAAC;IAC7D,OAAO,CAAiB;IAEhC,YAAY,YAAY,GAAG,MAAM;QAC/B,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI;gBAAE,IAAI,CAAC,CAAC,OAAO,IAAI,GAAG;oBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC,EAAE,YAAY,CAAC,CAAC;QACjB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,QAAgB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YACnC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,UAAU,SAAS,CAAC,IAAsB;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,oBAAoB,EAAE,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAErD,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACvE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YACnD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,mBAAmB,EAAE,cAAc,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/middlewares/security-headers.d.ts

@@ -0,0 +1,28 @@
+import type { ServerResponse } from 'node:http';
+export interface SecurityHeadersOptions {
+    /** Padrão: `default-src 'none'; frame-ancestors 'none'` (adequado para APIs JSON). `false` desliga. */
+    contentSecurityPolicy?: string | false;
+    /** Padrão: `no-referrer`. */
+    referrerPolicy?: string | false;
+    /** Padrão: `DENY`. */
+    frameOptions?: 'DENY' | 'SAMEORIGIN' | false;
+    /** Padrão: `same-origin`. */
+    crossOriginResourcePolicy?: 'same-origin' | 'same-site' | 'cross-origin' | false;
+    /**
+     * HSTS é opt-in: só faz sentido atrás de HTTPS.
+     * `true` = `max-age=15552000; includeSubDomains` (180 dias).
+     */
+    strictTransportSecurity?: boolean | {
+        maxAge: number;
+        includeSubDomains?: boolean;
+        preload?: boolean;
+    };
+}
+/** `'api'`: restritivo, para APIs (padrão). `'web'`: permite recursos do próprio site (F-31). */
+export type SecurityPreset = 'api' | 'web';
+/**
+ * Headers de segurança padrão (S-04) e proteções contra XSS (S-02).
+ * Retorna uma função que aplica os headers pré-calculados na resposta.
+ */
+export declare function buildSecurityHeaders(input?: SecurityHeadersOptions | SecurityPreset): (res: ServerResponse) => void;
+//# sourceMappingURL=security-headers.d.ts.map

package/dist/middlewares/security-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../../src/middlewares/security-headers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD,MAAM,WAAW,sBAAsB;IACrC,uGAAuG;IACvG,qBAAqB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACvC,6BAA6B;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAChC,sBAAsB;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,KAAK,CAAC;IAC7C,6BAA6B;IAC7B,yBAAyB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,cAAc,GAAG,KAAK,CAAC;IACjF;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACxG;AAED,iGAAiG;AACjG,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,CAAC;AAU3C;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,GAAE,sBAAsB,GAAG,cAAmB,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,IAAI,CA4BvH"}

package/dist/middlewares/security-headers.js

@@ -0,0 +1,42 @@
+const PRESETS = {
+    api: {},
+    web: {
+        contentSecurityPolicy: "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'",
+        frameOptions: 'SAMEORIGIN',
+    },
+};
+/**
+ * Headers de segurança padrão (S-04) e proteções contra XSS (S-02).
+ * Retorna uma função que aplica os headers pré-calculados na resposta.
+ */
+export function buildSecurityHeaders(input = {}) {
+    const opts = typeof input === 'string' ? PRESETS[input] : input;
+    const headers = [['X-Content-Type-Options', 'nosniff']];
+    const csp = opts.contentSecurityPolicy ?? "default-src 'none'; frame-ancestors 'none'";
+    if (csp)
+        headers.push(['Content-Security-Policy', csp]);
+    const referrer = opts.referrerPolicy ?? 'no-referrer';
+    if (referrer)
+        headers.push(['Referrer-Policy', referrer]);
+    const frame = opts.frameOptions ?? 'DENY';
+    if (frame)
+        headers.push(['X-Frame-Options', frame]);
+    const corp = opts.crossOriginResourcePolicy ?? 'same-origin';
+    if (corp)
+        headers.push(['Cross-Origin-Resource-Policy', corp]);
+    const hsts = opts.strictTransportSecurity;
+    if (hsts) {
+        const cfg = hsts === true ? { maxAge: 15552000, includeSubDomains: true } : hsts;
+        let value = `max-age=${cfg.maxAge}`;
+        if (cfg.includeSubDomains)
+            value += '; includeSubDomains';
+        if ('preload' in cfg && cfg.preload)
+            value += '; preload';
+        headers.push(['Strict-Transport-Security', value]);
+    }
+    return (res) => {
+        for (const [name, value] of headers)
+            res.setHeader(name, value);
+    };
+}
+//# sourceMappingURL=security-headers.js.map

package/dist/middlewares/security-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../../src/middlewares/security-headers.ts"],"names":[],"mappings":"AAqBA,MAAM,OAAO,GAAmD;IAC9D,GAAG,EAAE,EAAE;IACP,GAAG,EAAE;QACH,qBAAqB,EAAE,iFAAiF;QACxG,YAAY,EAAE,YAAY;KAC3B;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAK,GAA4C,EAAE;IACtF,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChE,MAAM,OAAO,GAAuB,CAAC,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC,CAAC;IAE5E,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,IAAI,4CAA4C,CAAC;IACvF,IAAI,GAAG;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,IAAI,aAAa,CAAC;IACtD,IAAI,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE1D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC;IAC1C,IAAI,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC;IAEpD,MAAM,IAAI,GAAG,IAAI,CAAC,yBAAyB,IAAI,aAAa,CAAC;IAC7D,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC,CAAC;IAE/D,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,CAAC;IAC1C,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACjF,IAAI,KAAK,GAAG,WAAW,GAAG,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,iBAAiB;YAAE,KAAK,IAAI,qBAAqB,CAAC;QAC1D,IAAI,SAAS,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO;YAAE,KAAK,IAAI,WAAW,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC,CAAC;AACJ,CAAC"}

package/dist/openapi/generate.d.ts

@@ -0,0 +1,51 @@
+import type { CompiledRoute } from '../core/compiler.ts';
+import type { Middleware } from '../core/compose.ts';
+import type { Guard } from '../core/guard.ts';
+/** Opções de `app.openapi()` (F-16). */
+export interface OpenAPIOptions {
+    /** Padrão: `{ title: 'API', version: '0.0.0' }`. */
+    info?: {
+        title: string;
+        version: string;
+        description?: string;
+        [key: string]: unknown;
+    };
+    servers?: readonly {
+        url: string;
+        description?: string;
+    }[];
+    /**
+     * Só no `openapiDocument()`: documenta as rotas deste host (virtual hosts) mais as sem host (F-35).
+     * Sem `host`, entram só as rotas sem host. O `/openapi.json` servido usa o host da requisição.
+     */
+    host?: string;
+    /** Onde servir o documento JSON. Padrão: `'/openapi.json'`. */
+    path?: string;
+    /** Swagger UI. Desligado por padrão: `true` serve em `'/docs'`, uma string escolhe o path. */
+    docs?: string | boolean;
+    /** Rodam antes de servir o documento e a página, depois dos middlewares globais. */
+    middlewares?: readonly Middleware[];
+    /** Rodam depois dos `middlewares`, como nas rotas (401/403 antes de gerar o documento). */
+    guards?: readonly Guard[];
+}
+type Json = Record<string, unknown>;
+/** Converte um schema de contrato em JSON Schema (F-27); `undefined` quando o motor não sabe converter. */
+type ToJsonSchema = (schema: object) => object | undefined;
+/** `/:org/users/:id(^\\d+)` → `/{org}/users/{id}`; `::` → `:`; `*` → `{*}`; sem barra final (o roteador a ignora). */
+export declare function toOpenAPIPath(path: string): string;
+/**
+ * Gera o documento OpenAPI 3.1 a partir das rotas registradas (F-16). Os schemas TypeBox já são
+ * JSON Schema, então entram como estão. Com outro motor de contratos (F-27), `toJson` os converte; sem conversão,
+ * o schema sai como `{}` (qualquer valor).
+ */
+export declare function generateOpenAPI(routes: readonly CompiledRoute[], opts: OpenAPIOptions, problemErrors: boolean, toJson?: ToJsonSchema): Json;
+/**
+ * Página do Swagger UI (versão fixada, com SRI) e a CSP própria dela: scripts só do CDN e o inline com
+ * `nonce`, `connect-src 'self'` para buscar o documento.
+ */
+export declare function docsPage(specUrl: string, title: string, nonce: string): {
+    html: string;
+    csp: string;
+};
+export {};
+//# sourceMappingURL=generate.d.ts.map

package/dist/openapi/generate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/openapi/generate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C,wCAAwC;AACxC,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACxF,OAAO,CAAC,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC3D;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACxB,oFAAoF;IACpF,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACpC,2FAA2F;IAC3F,MAAM,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;CAC3B;AAED,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAKpC,2GAA2G;AAC3G,KAAK,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAQ3D,sHAAsH;AACtH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUlD;AA6FD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,IAAI,EAAE,cAAc,EACpB,aAAa,EAAE,OAAO,EACtB,MAAM,GAAE,YAAyB,GAChC,IAAI,CAqBN;AASD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CA2BrG"}

package/dist/openapi/generate.js

@@ -0,0 +1,175 @@
+import { STATUS_CODES } from 'node:http';
+import { isResponseContent } from '../core/metadata.js';
+/** Cópia em JSON puro: tira as chaves `Symbol` do TypeBox e qualquer coisa não serializável. */
+const plain = (schema) => JSON.parse(JSON.stringify(schema));
+const nativeJson = (schema) => schema;
+/** O schema em JSON puro, ou `{}` (qualquer valor) quando não há conversão. */
+const asJson = (schema, toJson) => {
+    const converted = toJson(schema);
+    return converted ? plain(converted) : {};
+};
+/** `/:org/users/:id(^\\d+)` → `/{org}/users/{id}`; `::` → `:`; `*` → `{*}`; sem barra final (o roteador a ignora). */
+export function toOpenAPIPath(path) {
+    return (path
+        .replace(/::/g, '\u0000')
+        .replace(/:([^/\-.(]+)(\((?:\\.|[^\\])*?\))?/g, '{$1}')
+        .replace(/\*$/, '{*}')
+        // biome-ignore lint/suspicious/noControlCharactersInRegex: desfaz o marcador acima.
+        .replace(/\u0000/g, ':')
+        .replace(/(.)\/$/, '$1'));
+}
+/** Problem Details (RFC 9457), o corpo padrão de todos os erros (F-15). */
+const PROBLEM_SCHEMA = {
+    type: 'object',
+    required: ['type', 'title', 'status'],
+    properties: {
+        type: { type: 'string' },
+        title: { type: 'string' },
+        status: { type: 'integer' },
+        detail: { type: 'string' },
+        code: { type: 'string' },
+        details: {},
+    },
+};
+function parameters(where, schema, toJson) {
+    const json = schema ? asJson(schema, toJson) : undefined;
+    const props = json?.properties;
+    if (!props)
+        return [];
+    const required = new Set(json.required ?? []);
+    return Object.entries(props).map(([name, s]) => ({
+        name,
+        in: where,
+        required: where === 'path' || required.has(name),
+        schema: s,
+    }));
+}
+function responseContent(entry, toJson) {
+    if (isResponseContent(entry)) {
+        const types = typeof entry.contentType === 'string' ? [entry.contentType] : entry.contentType;
+        return Object.fromEntries(types.map((t) => [t, entry.schema ? { schema: asJson(entry.schema, toJson) } : {}]));
+    }
+    return { 'application/json': { schema: asJson(entry, toJson) } };
+}
+function operation(route, problemErrors, toJson) {
+    const { schemas } = route;
+    const params = [
+        ...parameters('path', schemas.params, toJson),
+        ...parameters('query', schemas.query, toJson),
+        ...parameters('header', schemas.headers, toJson),
+    ];
+    const responses = {};
+    for (const [status, entry] of Object.entries(schemas.response ?? {})) {
+        const content = Number(status) === 204 ? undefined : responseContent(entry, toJson);
+        responses[status] = { description: STATUS_CODES[Number(status)] ?? 'Response', ...(content ? { content } : {}) };
+    }
+    if (Object.keys(responses).length === 0)
+        responses['200'] = { description: 'OK' };
+    responses.default = problemErrors
+        ? { description: 'Error', content: { 'application/problem+json': { schema: { $ref: '#/components/schemas/ProblemDetails' } } } }
+        : { description: 'Error' };
+    return {
+        operationId: `${route.owner}.${route.handlerName}`,
+        tags: [route.owner],
+        ...(params.length ? { parameters: params } : {}),
+        ...(schemas.files
+            ? {
+                requestBody: {
+                    required: true,
+                    content: { 'multipart/form-data': multipartSchema(schemas.files, schemas.body ? asJson(schemas.body, toJson) : undefined) },
+                },
+            }
+            : schemas.body
+                ? { requestBody: { required: true, content: { 'application/json': { schema: asJson(schemas.body, toJson) } } } }
+                : {}),
+        responses,
+    };
+}
+/**
+ * Upload (F-46): os campos de texto do `body` e os arquivos do `files` num único objeto, com `format: binary`.
+ * `maxCount` maior que 1 vira um array; os tipos aceitos vão no `encoding.contentType`.
+ */
+function multipartSchema(files, body) {
+    const properties = { ...(body?.properties ?? {}) };
+    const required = [...(body?.required ?? [])];
+    const encoding = {};
+    for (const [name, rule] of Object.entries(files)) {
+        const binary = { type: 'string', format: 'binary' };
+        const max = rule.maxCount ?? 1;
+        properties[name] = max > 1 ? { type: 'array', items: binary, maxItems: max } : binary;
+        if (rule.required)
+            required.push(name);
+        if (rule.types)
+            encoding[name] = { contentType: rule.types.join(', ') };
+    }
+    return {
+        schema: { type: 'object', properties, ...(required.length ? { required } : {}) },
+        ...(Object.keys(encoding).length ? { encoding } : {}),
+    };
+}
+/**
+ * Gera o documento OpenAPI 3.1 a partir das rotas registradas (F-16). Os schemas TypeBox já são
+ * JSON Schema, então entram como estão. Com outro motor de contratos (F-27), `toJson` os converte; sem conversão,
+ * o schema sai como `{}` (qualquer valor).
+ */
+export function generateOpenAPI(routes, opts, problemErrors, toJson = nativeJson) {
+    const paths = {};
+    const ids = new Map();
+    for (const route of routes) {
+        if (route.internal)
+            continue;
+        const path = toOpenAPIPath(route.path);
+        const op = operation(route, problemErrors, toJson);
+        // A mesma classe montada em dois prefixos gera o mesmo id; o OpenAPI exige ids únicos.
+        const base = op.operationId;
+        const n = (ids.get(base) ?? 0) + 1;
+        ids.set(base, n);
+        if (n > 1)
+            op.operationId = `${base}_${n}`;
+        (paths[path] ??= {})[route.method.toLowerCase()] = op;
+    }
+    return {
+        openapi: '3.1.0',
+        info: opts.info ?? { title: 'API', version: '0.0.0' },
+        ...(opts.servers ? { servers: opts.servers } : {}),
+        paths,
+        ...(problemErrors ? { components: { schemas: { ProblemDetails: PROBLEM_SCHEMA } } } : {}),
+    };
+}
+const SWAGGER = 'https://cdn.jsdelivr.net/npm/swagger-ui-dist@5.34.1';
+const SWAGGER_JS_SRI = 'sha384-XFYN47VzPiDY6qPtxYKg0nqUeW/upo20xf1j2SUE7gT/i35FJB4cuS/71Iegzk8Z';
+const SWAGGER_CSS_SRI = 'sha384-4c3vsE5f+trhFyHrFrLM1fFGUn531NIaC7dcqEWIJdoRQJ5CkJbSuSCwXLpaS1KF';
+const escapeHtml = (s) => s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+/**
+ * Página do Swagger UI (versão fixada, com SRI) e a CSP própria dela: scripts só do CDN e o inline com
+ * `nonce`, `connect-src 'self'` para buscar o documento.
+ */
+export function docsPage(specUrl, title, nonce) {
+    const html = `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)}</title>
+<link rel="stylesheet" href="${SWAGGER}/swagger-ui.css" integrity="${SWAGGER_CSS_SRI}" crossorigin="anonymous">
+</head>
+<body>
+<div id="swagger-ui"></div>
+<script src="${SWAGGER}/swagger-ui-bundle.js" integrity="${SWAGGER_JS_SRI}" crossorigin="anonymous"></script>
+<script nonce="${nonce}">SwaggerUIBundle({ url: ${JSON.stringify(specUrl).replace(/</g, '\\u003c')}, dom_id: '#swagger-ui' });</script>
+</body>
+</html>
+`;
+    const csp = [
+        "default-src 'none'",
+        `script-src https://cdn.jsdelivr.net 'nonce-${nonce}'`,
+        "style-src https://cdn.jsdelivr.net 'unsafe-inline'",
+        "img-src 'self' data: https:",
+        "connect-src 'self'",
+        "frame-ancestors 'none'",
+        "base-uri 'none'",
+        "form-action 'none'",
+    ].join('; ');
+    return { html, csp };
+}
+//# sourceMappingURL=generate.js.map

package/dist/openapi/generate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.js","sourceRoot":"","sources":["../../src/openapi/generate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAIzC,OAAO,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AAwB5E,gGAAgG;AAChG,MAAM,KAAK,GAAG,CAAC,MAAc,EAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAS,CAAC;AAInF,MAAM,UAAU,GAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC;AACpD,+EAA+E;AAC/E,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,MAAoB,EAAQ,EAAE;IAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC,CAAC;AAEF,sHAAsH;AACtH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,CACL,IAAI;SACD,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;SACxB,OAAO,CAAC,qCAAqC,EAAE,MAAM,CAAC;SACtD,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QACtB,oFAAoF;SACnF,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,cAAc,GAAS;IAC3B,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;IACrC,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,OAAO,EAAE,EAAE;KACZ;CACF,CAAC;AAEF,SAAS,UAAU,CAAC,KAAkC,EAAE,MAA0B,EAAE,MAAoB;IACtG,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,EAAE,UAA8C,CAAC;IACnE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAE,IAAK,CAAC,QAAiC,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI;QACJ,EAAE,EAAE,KAAK;QACT,QAAQ,EAAE,KAAK,KAAK,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAChD,MAAM,EAAE,CAAC;KACV,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,eAAe,CAAC,KAAoB,EAAE,MAAoB;IACjE,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;QAC9F,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,KAAoB,EAAE,aAAsB,EAAE,MAAoB;IACnF,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,MAAM,MAAM,GAAG;QACb,GAAG,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC;QAC7C,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;QAC7C,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC;KACjD,CAAC;IACF,MAAM,SAAS,GAAS,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACpF,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACnH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAClF,SAAS,CAAC,OAAO,GAAG,aAAa;QAC/B,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,0BAA0B,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,qCAAqC,EAAE,EAAE,EAAE,EAAE;QAChI,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IAE7B,OAAO;QACL,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE;QAClD,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QACnB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,OAAO,CAAC,KAAK;YACf,CAAC,CAAC;gBACE,WAAW,EAAE;oBACX,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE,EAAE,qBAAqB,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;iBAC5H;aACF;YACH,CAAC,CAAC,OAAO,CAAC,IAAI;gBACZ,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE;gBAChH,CAAC,CAAC,EAAE,CAAC;QACT,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,KAAgB,EAAE,IAAyC;IAClF,MAAM,UAAU,GAA4B,EAAE,GAAG,CAAE,IAAI,EAAE,UAAsC,IAAI,EAAE,CAAC,EAAE,CAAC;IACzG,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAE,IAAI,EAAE,QAAqB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAA4C,EAAE,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QAC/B,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACtF,IAAI,IAAI,CAAC,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO;QACL,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAChF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAgC,EAChC,IAAoB,EACpB,aAAsB,EACtB,MAAM,GAAiB,UAAU;IAEjC,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,QAAQ;YAAE,SAAS;QAC7B,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QACnD,uFAAuF;QACvF,MAAM,IAAI,GAAG,EAAE,CAAC,WAAqB,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,GAAG,CAAC;YAAE,EAAE,CAAC,WAAW,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3C,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,CAAC;IACxD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE;QACrD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,KAAK;QACL,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAG,qDAAqD,CAAC;AACtE,MAAM,cAAc,GAAG,yEAAyE,CAAC;AACjG,MAAM,eAAe,GAAG,yEAAyE,CAAC;AAElG,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAC/B,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;AAE9G;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,KAAa,EAAE,KAAa;IACpE,MAAM,IAAI,GAAG;;;;;SAKN,UAAU,CAAC,KAAK,CAAC;+BACK,OAAO,+BAA+B,eAAe;;;;eAIrE,OAAO,qCAAqC,cAAc;iBACxD,KAAK,4BAA4B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;;;CAGjG,CAAC;IACA,MAAM,GAAG,GAAG;QACV,oBAAoB;QACpB,8CAA8C,KAAK,GAAG;QACtD,oDAAoD;QACpD,6BAA6B;QAC7B,oBAAoB;QACpB,wBAAwB;QACxB,iBAAiB;QACjB,oBAAoB;KACrB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACvB,CAAC"}

package/dist/schema/serialization.d.ts

@@ -0,0 +1,2 @@
+export declare function serialize(schema: object, data: unknown): string;
+//# sourceMappingURL=serialization.d.ts.map

package/dist/schema/serialization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialization.d.ts","sourceRoot":"","sources":["../../src/schema/serialization.ts"],"names":[],"mappings":"AAIA,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAO/D"}

package/dist/schema/serialization.js

@@ -0,0 +1,11 @@
+import fastJson from 'fast-json-stringify';
+const cache = new WeakMap();
+export function serialize(schema, data) {
+    let fn = cache.get(schema);
+    if (!fn) {
+        fn = fastJson(schema);
+        cache.set(schema, fn);
+    }
+    return fn(data);
+}
+//# sourceMappingURL=serialization.js.map

package/dist/schema/serialization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialization.js","sourceRoot":"","sources":["../../src/schema/serialization.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,qBAAqB,CAAC;AAE3C,MAAM,KAAK,GAAG,IAAI,OAAO,EAAqC,CAAC;AAE/D,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,IAAa;IACrD,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,QAAQ,CAAC,MAAwC,CAAC,CAAC;QACxD,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;AAClB,CAAC"}

package/dist/schema/validation.d.ts

@@ -0,0 +1,22 @@
+import { type ErrorObject } from 'ajv';
+export type ValidationTarget = 'params' | 'query' | 'headers' | 'body';
+export interface ValidationIssue {
+    /** JSON Pointer do campo inválido (`/email`, `/items/0/id`). `/` = raiz. */
+    path: string;
+    message: string;
+}
+/**
+ * Valida `data` contra `schema` sobre uma cópia, removendo campos não declarados.
+ * Retorna a cópia filtrada, ou os problemas encontrados.
+ */
+export declare function stripToSchema(schema: object, data: unknown): {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    issues: ValidationIssue[];
+};
+/** Valida `data` contra `schema`. Retorna `null` se válido, ou a lista de problemas (B-02). */
+export declare function validate(schema: object, data: unknown, target: ValidationTarget): ValidationIssue[] | null;
+export declare function formatErrors(errors: ErrorObject[]): ValidationIssue[];
+//# sourceMappingURL=validation.d.ts.map

package/dist/schema/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/schema/validation.ts"],"names":[],"mappings":"AAAA,OAAkB,EAAE,KAAK,WAAW,EAAyB,MAAM,KAAK,CAAC;AAczE,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEvE,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAyBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,EAAE,CAAA;CAAE,CAQpI;AAkBD,+FAA+F;AAC/F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,GAAG,eAAe,EAAE,GAAG,IAAI,CAG1G;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAKrE"}

package/dist/schema/validation.js

@@ -0,0 +1,68 @@
+import AjvModule, {} from 'ajv';
+import addFormatsModule from 'ajv-formats';
+// Interop explícito: o TS em ESM + verbatimModuleSyntax resolve o default
+// como namespace; pegamos o `.default` real em runtime (que o Node injeta
+// via CJS interop) e caímos no próprio módulo se ele já for o valor.
+// biome-ignore lint/suspicious/noExplicitAny: interop CJS/ESM do ajv, resolvido em runtime.
+const Ajv = (AjvModule.default ?? AjvModule);
+// biome-ignore lint/suspicious/noExplicitAny: interop CJS/ESM do ajv-formats, resolvido em runtime.
+const addFormats = (addFormatsModule.default ?? addFormatsModule);
+function createAjv(coerceTypes) {
+    const ajv = new Ajv({ allErrors: true, coerceTypes, useDefaults: true, removeAdditional: false });
+    addFormats(ajv);
+    return ajv;
+}
+/**
+ * Duas instâncias (B-06):
+ * - `coercing`: params/query/headers chegam sempre como string, então convertemos
+ *   para o tipo declarado (`"5"` → `5`).
+ * - `strict`: o body já é JSON tipado; coerção mascararia erros do cliente
+ *   (`"30"` virar `30`, `""` virar `0`).
+ */
+// 'array' também converte valor único em array quando o schema pede array (`?tag=a` → `['a']`, B-07)
+const coercing = createAjv('array');
+const strict = createAjv(false);
+// F-31: para respostas em formatos não JSON, remove TODOS os campos não declarados (como o
+// fast-json-stringify faz no JSON) antes do serializador, sem alterar o objeto do handler.
+const stripper = new Ajv({ allErrors: true, coerceTypes: false, useDefaults: false, removeAdditional: 'all' });
+addFormats(stripper);
+const stripCache = new WeakMap();
+/**
+ * Valida `data` contra `schema` sobre uma cópia, removendo campos não declarados.
+ * Retorna a cópia filtrada, ou os problemas encontrados.
+ */
+export function stripToSchema(schema, data) {
+    let fn = stripCache.get(schema);
+    if (!fn) {
+        fn = stripper.compile(schema);
+        stripCache.set(schema, fn);
+    }
+    const copy = data === undefined ? undefined : JSON.parse(JSON.stringify(data));
+    return fn(copy) ? { ok: true, value: copy } : { ok: false, issues: formatErrors(fn.errors ?? []) };
+}
+const caches = new Map([
+    [coercing, new WeakMap()],
+    [strict, new WeakMap()],
+]);
+function compile(schema, target) {
+    const ajv = target === 'body' ? strict : coercing;
+    const cache = caches.get(ajv);
+    let fn = cache.get(schema);
+    if (!fn) {
+        fn = ajv.compile(schema);
+        cache.set(schema, fn);
+    }
+    return fn;
+}
+/** Valida `data` contra `schema`. Retorna `null` se válido, ou a lista de problemas (B-02). */
+export function validate(schema, data, target) {
+    const fn = compile(schema, target);
+    return fn(data) ? null : formatErrors(fn.errors ?? []);
+}
+export function formatErrors(errors) {
+    return errors.map((e) => {
+        const missing = e.keyword === 'required' ? `/${e.params.missingProperty}` : '';
+        return { path: `${e.instancePath}${missing}` || '/', message: e.message ?? 'invalid' };
+    });
+}
+//# sourceMappingURL=validation.js.map

package/dist/schema/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/schema/validation.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,EAAE,EAA2C,MAAM,KAAK,CAAC;AACzE,OAAO,gBAAgB,MAAM,aAAa,CAAC;AAE3C,0EAA0E;AAC1E,0EAA0E;AAC1E,qEAAqE;AACrE,4FAA4F;AAC5F,MAAM,GAAG,GAAG,CAAE,SAAiB,CAAC,OAAO,IAAI,SAAS,CAAiC,CAAC;AACtF,oGAAoG;AACpG,MAAM,UAAU,GAAG,CAAE,gBAAwB,CAAC,OAAO,IAAI,gBAAgB,CAGhE,CAAC;AAUV,SAAS,SAAS,CAAC,WAA8B;IAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;IAClG,UAAU,CAAC,GAAG,CAAC,CAAC;IAChB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,qGAAqG;AACrG,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;AACpC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;AAEhC,2FAA2F;AAC3F,2FAA2F;AAC3F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/G,UAAU,CAAC,QAAQ,CAAC,CAAC;AACrB,MAAM,UAAU,GAAG,IAAI,OAAO,EAA4B,CAAC;AAE3D;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,IAAa;IACzD,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,IAAI,GAAY,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;AACrG,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC;IACrB,CAAC,QAAQ,EAAE,IAAI,OAAO,EAA4B,CAAC;IACnD,CAAC,MAAM,EAAE,IAAI,OAAO,EAA4B,CAAC;CAClD,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,MAAc,EAAE,MAAwB;IACvD,MAAM,GAAG,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;IAC/B,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzB,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,IAAa,EAAE,MAAwB;IAC9E,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAqB;IAChD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,MAAsC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChH,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,YAAY,GAAG,OAAO,EAAE,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;IACzF,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/static.d.ts

@@ -0,0 +1,45 @@
+import { type Stats } from 'node:fs';
+import type { Context } from '../core/context.ts';
+/** Opções comuns a `app.static()` e `ctx.sendFile()` (F-13). */
+export interface FileOptions {
+    /** `Cache-Control: max-age`, em segundos ou como `'7d'`, `'12h'`, `'30m'`, `'10s'`. Padrão: 0 (revalida sempre). */
+    maxAge?: number | string;
+    /** Acrescenta `immutable` ao `Cache-Control`, para arquivos com hash no nome. */
+    immutable?: boolean;
+    /** `ETag` fraco (tamanho + data de modificação), com 304 para `If-None-Match`. Padrão: `true`. */
+    etag?: boolean;
+    /** `Last-Modified`, com 304 para `If-Modified-Since`. Padrão: `true`. */
+    lastModified?: boolean;
+    /** Tipos por extensão, somados à tabela interna: `{ glb: 'model/gltf-binary' }`. */
+    mimeTypes?: Readonly<Record<string, string>>;
+}
+export interface StaticOptions extends FileOptions {
+    /** Arquivo servido para um diretório. Padrão: `'index.html'`; `false` desliga. Diretórios nunca são listados. */
+    index?: string | false;
+    /**
+     * SPA: arquivo (relativo à raiz) servido quando o path pedido não existe **e não tem extensão**
+     * (`/pedidos/42` → `index.html`, mas `/app.js` inexistente continua 404). Sai com `no-cache`.
+     */
+    fallback?: string;
+    /** Arquivos e pastas que começam com `.` (`.env`, `.git`): `'deny'` responde 404 (padrão) ou `'allow'`. */
+    dotfiles?: 'deny' | 'allow';
+}
+export interface SendFileOptions extends FileOptions {
+    /** Raiz que contém o arquivo; com ela, o path é relativo e não pode sair dela. Sem `root`, o path precisa ser absoluto. */
+    root?: string;
+    /** `Content-Disposition: attachment`. `true` usa o nome do arquivo; uma string define o nome do download. */
+    download?: boolean | string;
+}
+export declare function parseMaxAge(value: number | string | undefined): number;
+/** Raiz real (symlinks resolvidos), conferida na configuração: um diretório que não existe falha cedo. */
+export declare function resolveRoot(root: string): string;
+/** Envia um arquivo já resolvido e conferido, com cache condicional e `Range` (F-13). */
+export declare function sendResolvedFile(ctx: Context, path: string, s: Stats, opts: FileOptions & {
+    download?: boolean | string;
+    noCache?: boolean;
+}): Promise<void>;
+/** `ctx.sendFile()`: confere o caminho e envia (F-13). */
+export declare function sendFile(ctx: Context, path: string, opts?: SendFileOptions): Promise<void>;
+/** Handler de `app.static()`: resolve o resto do path dentro da raiz, com índice e fallback de SPA. */
+export declare function staticHandler(rootInput: string, opts: StaticOptions): (ctx: Context) => Promise<void>;
+//# sourceMappingURL=static.d.ts.map

package/dist/server/static.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.d.ts","sourceRoot":"","sources":["../../src/server/static.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkC,KAAK,KAAK,EAAY,MAAM,SAAS,CAAC;AAG/E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAKlD,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,oHAAoH;IACpH,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,iFAAiF;IACjF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kGAAkG;IAClG,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,yEAAyE;IACzE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,oFAAoF;IACpF,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD,iHAAiH;IACjH,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2GAA2G;IAC3G,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,2HAA2H;IAC3H,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6GAA6G;IAC7G,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC7B;AAID,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAStE;AAED,0GAA0G;AAC1G,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAShD;AAgED,yFAAyF;AACzF,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,EACZ,CAAC,EAAE,KAAK,EACR,IAAI,EAAE,WAAW,GAAG;IAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GACrE,OAAO,CAAC,IAAI,CAAC,CA0Df;AAED,0DAA0D;AAC1D,wBAAsB,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAapG;AAED,uGAAuG;AACvG,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAwBrG"}