oakbun 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 René (SchildW3rk)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/README.md

@@ -0,0 +1,53 @@
+# oakbun
+
+Bun-native backend framework — No Magic, just code.
+
+## Installation
+
+```bash
+bun add oakbun zod
+```
+
+## Quick Start
+
+```ts
+import { createApp, defineModule, column, defineTable } from 'oakbun'
+import { SQLiteAdapter } from 'oakbun/adapter/sqlite'
+
+const db = new SQLiteAdapter({ filename: 'app.db' })
+
+const users = defineTable('users', {
+  id:    column.integer().primaryKey(),
+  name:  column.text().notNull(),
+  email: column.text().notNull().unique(),
+})
+
+const app = createApp({ adapter: db })
+
+app.use(defineModule('users')
+  .get('/', async (ctx) => ctx.json(await ctx.db.select(users)))
+  .post('/', async (ctx) => {
+    const body = await ctx.req.json()
+    await ctx.db.insert(users).values(body)
+    return ctx.json({ ok: true }, 201)
+  })
+)
+
+app.listen({ port: 3000 })
+```
+
+## Adapters
+
+```ts
+import { SQLiteAdapter }  from 'oakbun/adapter/sqlite'
+import { PostgresAdapter } from 'oakbun/adapter/postgres'
+import { MySQLAdapter }   from 'oakbun/adapter/mysql'
+```
+
+## Documentation
+
+Full docs at [oakbun.dev](https://oakbun.dev).
+
+## License
+
+MIT

package/dist/adapter/mysql.d.ts

@@ -0,0 +1,21 @@
+import type { VelnAdapter, BindingValue, ExecuteResult, QueryLogEntry } from './types';
+export interface MySQLConfig {
+    url?: string;
+    hostname?: string;
+    port?: number;
+    database?: string;
+    username?: string;
+    password?: string;
+    max?: number;
+    idleTimeout?: number;
+}
+export declare class MySQLAdapter implements VelnAdapter {
+    private readonly sql;
+    onQuery?: (entry: QueryLogEntry) => void;
+    constructor(config: MySQLConfig);
+    query<T>(sql: string, params?: BindingValue[]): Promise<T[]>;
+    execute(sql: string, params?: BindingValue[]): Promise<ExecuteResult>;
+    transaction<T>(fn: (tx: VelnAdapter) => Promise<T>): Promise<T>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=mysql.d.ts.map

package/dist/adapter/mysql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mysql.d.ts","sourceRoot":"","sources":["../../src/adapter/mysql.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAEtF,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,qBAAa,YAAa,YAAW,WAAW;IAI9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAK;IACzB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAA;gBAE5B,MAAM,EAAE,WAAW;IAiBzB,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAE,YAAY,EAAO,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAQhE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,GAAE,YAAY,EAAO,GAAG,OAAO,CAAC,aAAa,CAAC;IAQzE,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAgB/D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/dist/adapter/mysql.js

@@ -0,0 +1,10 @@
+import {
+  MySQLAdapter,
+  init_mysql
+} from "../chunk-7PGCL2E7.js";
+import "../chunk-Z6ZWNWWR.js";
+init_mysql();
+export {
+  MySQLAdapter
+};
+//# sourceMappingURL=mysql.js.map

package/dist/adapter/mysql.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/adapter/postgres.d.ts

@@ -0,0 +1,16 @@
+import type { VelnAdapter, BindingValue, ExecuteResult, QueryLogEntry } from './types';
+export interface PostgresConfig {
+    url: string;
+    max?: number;
+    idleTimeout?: number;
+}
+export declare class PostgresAdapter implements VelnAdapter {
+    private readonly sql;
+    onQuery?: (entry: QueryLogEntry) => void;
+    constructor(config: PostgresConfig);
+    query<T>(sql: string, params?: BindingValue[]): Promise<T[]>;
+    execute(sql: string, params?: BindingValue[]): Promise<ExecuteResult>;
+    transaction<T>(fn: (tx: VelnAdapter) => Promise<T>): Promise<T>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=postgres.d.ts.map

package/dist/adapter/postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../src/adapter/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAEtF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,qBAAa,eAAgB,YAAW,WAAW;IAIjD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAK;IACzB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAA;gBAE5B,MAAM,EAAE,cAAc;IAe5B,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAE,YAAY,EAAO,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAQhE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,GAAE,YAAY,EAAO,GAAG,OAAO,CAAC,aAAa,CAAC;IASzE,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAgB/D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/dist/adapter/postgres.js

@@ -0,0 +1,10 @@
+import {
+  PostgresAdapter,
+  init_postgres
+} from "../chunk-32M77PK3.js";
+import "../chunk-Z6ZWNWWR.js";
+init_postgres();
+export {
+  PostgresAdapter
+};
+//# sourceMappingURL=postgres.js.map

package/dist/adapter/postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/adapter/resolve.d.ts

@@ -0,0 +1,16 @@
+import type { VelnAdapter } from './types';
+export type AdapterConfig = {
+    adapter: 'sqlite';
+    path?: string;
+} | {
+    adapter: 'postgres';
+    connectionString: string;
+    maxConnections?: number;
+} | {
+    adapter: 'mysql';
+    connectionString: string;
+    maxConnections?: number;
+};
+export declare function isVelnAdapter(value: unknown): value is VelnAdapter;
+export declare function resolveAdapter(config: AdapterConfig | VelnAdapter): VelnAdapter;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/adapter/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/adapter/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAE1C,MAAM,MAAM,aAAa,GACrB;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAG,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1E;IAAE,OAAO,EAAE,OAAO,CAAC;IAAI,gBAAgB,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAE9E,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAOlE;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,WAAW,GAAG,WAAW,CAwB/E"}

package/dist/adapter/sqlite.d.ts

@@ -0,0 +1,17 @@
+import type { VelnAdapter, BindingValue, ExecuteResult, QueryLogEntry } from './types';
+export interface SQLiteConfig {
+    path?: string;
+    wal?: boolean;
+}
+export declare class SQLiteAdapter implements VelnAdapter {
+    private readonly db;
+    private readonly _stmtCache;
+    onQuery?: (entry: QueryLogEntry) => void;
+    constructor(config?: SQLiteConfig | string);
+    private _prepare;
+    query<T>(sql: string, params?: BindingValue[]): Promise<T[]>;
+    execute(sql: string, params?: BindingValue[]): Promise<ExecuteResult>;
+    transaction<T>(fn: (tx: VelnAdapter) => Promise<T>): Promise<T>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=sqlite.d.ts.map

package/dist/adapter/sqlite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../../src/adapter/sqlite.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAEtF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,OAAO,CAAA;CACd;AAMD,qBAAa,aAAc,YAAW,WAAW;IAC/C,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAU;IAI7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqD;IAChF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAA;gBAE5B,MAAM,GAAE,YAAY,GAAG,MAAW;IAS9C,OAAO,CAAC,QAAQ;IAkBV,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAE,YAAY,EAAO,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAQhE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,GAAE,YAAY,EAAO,GAAG,OAAO,CAAC,aAAa,CAAC;IAezE,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAc/D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/dist/adapter/sqlite.js

@@ -0,0 +1,10 @@
+import {
+  SQLiteAdapter,
+  init_sqlite
+} from "../chunk-7C6SKWY7.js";
+import "../chunk-Z6ZWNWWR.js";
+init_sqlite();
+export {
+  SQLiteAdapter
+};
+//# sourceMappingURL=sqlite.js.map

package/dist/adapter/sqlite.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/adapter/types.d.ts

@@ -0,0 +1,29 @@
+export type BindingValue = string | number | bigint | boolean | null | Uint8Array;
+export interface ExecuteResult {
+    rowsAffected: number;
+    lastInsertId?: number | bigint;
+}
+/** Emitted by the adapter after every query() or execute() call. */
+export interface QueryLogEntry {
+    /** The SQL string that was executed. */
+    sql: string;
+    /** The bound parameter values. */
+    params: BindingValue[];
+    /** Wall-clock duration in milliseconds (performance.now() resolution). */
+    durationMs: number;
+    /** Whether the call was query() (returns rows) or execute() (DML/DDL). */
+    type: 'query' | 'execute';
+}
+export interface VelnAdapter {
+    query<T = Record<string, unknown>>(sql: string, params?: BindingValue[]): Promise<T[]>;
+    execute(sql: string, params?: BindingValue[]): Promise<ExecuteResult>;
+    transaction<T>(fn: (tx: VelnAdapter) => Promise<T>): Promise<T>;
+    close(): Promise<void>;
+    /**
+     * Optional query observer. When set, the adapter calls this after every
+     * query() and execute() with timing and SQL details.
+     * Set by dbPlugin when query logging is enabled — do not call directly.
+     */
+    onQuery?: (entry: QueryLogEntry) => void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/adapter/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/adapter/types.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,YAAY,GACpB,MAAM,GACN,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,UAAU,CAAA;AAEd,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAA;IAGpB,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAC/B;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,GAAG,EAAS,MAAM,CAAA;IAClB,kCAAkC;IAClC,MAAM,EAAM,YAAY,EAAE,CAAA;IAC1B,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAA;IAClB,0EAA0E;IAC1E,IAAI,EAAQ,OAAO,GAAG,SAAS,CAAA;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;IACtF,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IACrE,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAC/D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACtB;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAA;CACzC"}

package/dist/app/audit-wiring.d.ts

@@ -0,0 +1,6 @@
+import type { VelnAdapter } from '../adapter/types';
+import type { SchemaMap } from '../schema/table';
+import type { ModuleHookHandlers } from '../hooks/types';
+import type { AuditDeclaration } from './module';
+export declare function buildAuditHooks<T extends Record<string, unknown>, TCtx, S extends SchemaMap>(decl: AuditDeclaration<T, TCtx, S>, adapter: VelnAdapter): ModuleHookHandlers<T, unknown>;
+//# sourceMappingURL=audit-wiring.d.ts.map

package/dist/app/audit-wiring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-wiring.d.ts","sourceRoot":"","sources":["../../src/app/audit-wiring.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAkBhD,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,SAAS,SAAS,EAC1F,IAAI,EAAE,gBAAgB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAClC,OAAO,EAAE,WAAW,GACnB,kBAAkB,CAAC,CAAC,EAAE,OAAO,CAAC,CAoEhC"}

package/dist/app/body-size-limit.d.ts

@@ -0,0 +1,29 @@
+import type { OnRequestHook } from './types';
+export interface BodySizeLimitOptions {
+    /**
+     * Maximum allowed body size in bytes.
+     * Default: 1_048_576 (1 MB)
+     */
+    maxSize?: number;
+    /** Response message when limit is exceeded. Default: 'Payload too large' */
+    message?: string;
+}
+/**
+ * bodySizeLimitPlugin — rejects requests whose Content-Length exceeds maxSize.
+ *
+ * Returns an OnRequestHook — pass it to app.onRequest():
+ *   app.onRequest(bodySizeLimitPlugin())                      // 1MB default
+ *   app.onRequest(bodySizeLimitPlugin({ maxSize: 512_000 }))  // 512KB
+ *
+ * Checks the Content-Length header only — does not buffer or read the body.
+ * Requests without Content-Length are passed through (streaming / chunked).
+ * Returns 413 Payload Too Large on violation.
+ *
+ * @remarks
+ * This plugin enforces limits based on the Content-Length header only.
+ * Chunked transfer-encoding bypasses this check entirely.
+ * For production deployments, configure body size limits at the reverse proxy level:
+ * nginx: `client_max_body_size`, Caddy: `request_body { max_size }`.
+ */
+export declare function bodySizeLimitPlugin(options?: BodySizeLimitOptions): OnRequestHook;
+//# sourceMappingURL=body-size-limit.d.ts.map

package/dist/app/body-size-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-size-limit.d.ts","sourceRoot":"","sources":["../../src/app/body-size-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAG5C,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,oBAAyB,GAAG,aAAa,CAqBrF"}

package/dist/app/compression.d.ts

@@ -0,0 +1,25 @@
+import type { OnResponseHook } from './types';
+export interface CompressionOptions {
+    /**
+     * Compression algorithms to offer, in preference order.
+     * Default: `['gzip', 'deflate']`
+     *
+     * Bun 1.x provides `Bun.gzipSync` and `Bun.deflateSync` natively.
+     */
+    encodings?: Array<'gzip' | 'deflate'>;
+    /**
+     * Minimum response body size in bytes before compression is applied.
+     * Responses smaller than this are sent uncompressed.
+     * Default: `1024` (1 KB)
+     */
+    threshold?: number;
+    /**
+     * Maximum response body size in bytes to attempt compression.
+     * Responses larger than this are passed through uncompressed to avoid
+     * excessive memory usage when buffering very large responses.
+     * Default: `10485760` (10 MB)
+     */
+    maxSize?: number;
+}
+export declare function compressionPlugin(options?: CompressionOptions): OnResponseHook;
+//# sourceMappingURL=compression.d.ts.map

package/dist/app/compression.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compression.d.ts","sourceRoot":"","sources":["../../src/app/compression.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAK7C,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAErC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAmDD,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,kBAAuB,GAAG,cAAc,CA4ClF"}

package/dist/app/cookies.d.ts

@@ -0,0 +1,17 @@
+export interface CookieOptions {
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: 'Strict' | 'Lax' | 'None';
+    maxAge?: number;
+    path?: string;
+    domain?: string;
+}
+export interface CookieJar {
+    get(name: string): string | undefined;
+    set(name: string, value: string, options?: CookieOptions): void;
+    delete(name: string): void;
+    /** Framework-internal: returns all pending Set-Cookie header values */
+    _pending(): string[];
+}
+export declare function createCookieJar(req: Request): CookieJar;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/app/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/app/cookies.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAI,OAAO,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;IACpC,MAAM,CAAC,EAAI,MAAM,CAAA;IACjB,IAAI,CAAC,EAAM,MAAM,CAAA;IACjB,MAAM,CAAC,EAAI,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IACrC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IAC/D,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,uEAAuE;IACvE,QAAQ,IAAI,MAAM,EAAE,CAAA;CACrB;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,CAqDvD"}

package/dist/app/cors.d.ts

@@ -0,0 +1,65 @@
+import type { OnRequestHook, OnResponseHook } from './types';
+export interface CorsOptions {
+    /**
+     * Allowed origins. Can be:
+     * - `'*'`                  → any origin (not usable with credentials)
+     * - `string`               → single allowed origin
+     * - `string[]`             → list of allowed origins (matched against request Origin header)
+     * - `(origin: string) => boolean` → custom predicate
+     *
+     * Default: `'*'`
+     */
+    origin?: '*' | string | string[] | ((origin: string) => boolean);
+    /**
+     * HTTP methods allowed in CORS requests.
+     * Default: `['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS']`
+     */
+    methods?: string[];
+    /**
+     * Request headers the client is allowed to send.
+     * Default: `['Content-Type', 'Authorization', 'x-csrf-token']`
+     */
+    allowHeaders?: string[];
+    /**
+     * Response headers that the browser may expose to the client-side script.
+     * Default: `[]` (none exposed beyond the CORS-safelisted headers)
+     */
+    exposeHeaders?: string[];
+    /**
+     * Whether cross-origin requests may include credentials (cookies, auth headers).
+     * When true, `origin` must not be `'*'`.
+     * Default: `false`
+     */
+    credentials?: boolean;
+    /**
+     * How long (in seconds) the preflight result may be cached.
+     * Default: `86400` (24h)
+     */
+    maxAge?: number;
+}
+export interface CorsPlugin {
+    /**
+     * Register on `app.onRequest()`.
+     * Handles OPTIONS preflight requests — returns a 204 with CORS headers directly,
+     * short-circuiting the pipeline (no route handler runs for OPTIONS).
+     */
+    onRequest: OnRequestHook;
+    /**
+     * Register on `app.onResponse()`.
+     * Appends CORS headers to every response.
+     */
+    onResponse: OnResponseHook;
+}
+/**
+ * corsPlugin — adds CORS headers to responses and handles preflight OPTIONS requests.
+ *
+ * Usage:
+ *   const cors = corsPlugin({ origin: 'https://app.example.com', credentials: true })
+ *   app.onRequest(cors.onRequest)
+ *   app.onResponse(cors.onResponse)
+ *
+ * Preflight (OPTIONS) requests are short-circuited with a 204 — no route handler
+ * runs. All other requests receive CORS headers in onResponse.
+ */
+export declare function corsPlugin(options?: CorsOptions): CorsPlugin;
+//# sourceMappingURL=cors.d.ts.map

package/dist/app/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/app/cors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAK5D,MAAM,WAAW,WAAW;IAC1B;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAA;IAEhE;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAElB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IAEvB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IAExB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAID,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,SAAS,EAAE,aAAa,CAAA;IACxB;;;OAGG;IACH,UAAU,EAAE,cAAc,CAAA;CAC3B;AAyBD;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,OAAO,GAAE,WAAgB,GAAG,UAAU,CAsEhE"}

package/dist/app/csrf.d.ts

@@ -0,0 +1,52 @@
+import type { OnRequestHook, OnResponseHook } from './types';
+/**
+ * Constant-time string comparison to prevent timing attacks.
+ * Returns false immediately on length mismatch (length is not secret).
+ * XORs all character codes and accumulates into a single result so the
+ * comparison time is proportional to the string length, not the first mismatch.
+ */
+export declare function timingSafeEqual(a: string, b: string): boolean;
+export interface CsrfOptions {
+    /** Cookie name that holds the CSRF token. Default: 'csrf_token' */
+    cookieName?: string;
+    /** Request header that must carry the token on state-changing requests. Default: 'x-csrf-token' */
+    headerName?: string;
+    /** Cookie Max-Age in seconds. Default: 86400 (24h) */
+    maxAge?: number;
+    /** Restrict cookie to HTTPS. Default: true (set false for local development) */
+    secure?: boolean;
+}
+export interface CsrfPlugin {
+    /**
+     * Register on app.onRequest() or module.onRequest().
+     * Validates the CSRF token on state-changing methods (POST/PUT/PATCH/DELETE).
+     * Returns a 403 response on mismatch — short-circuits the request lifecycle.
+     */
+    onRequest: OnRequestHook;
+    /**
+     * Register on app.onResponse() or module.onResponse().
+     * Sets a new CSRF token cookie on responses to safe methods (GET/HEAD/OPTIONS)
+     * when no valid token cookie exists yet.
+     */
+    onResponse: OnResponseHook;
+}
+/**
+ * csrfPlugin — Double-Submit Cookie pattern. Stateless, no store required.
+ *
+ * Usage:
+ *   const csrf = csrfPlugin()
+ *   app.onRequest(csrf.onRequest)
+ *   app.onResponse(csrf.onResponse)
+ *
+ * How it works:
+ *   1. On GET/HEAD/OPTIONS — onResponse sets a readable cookie (httpOnly: false)
+ *      so the client-side JS can read the token.
+ *   2. On POST/PUT/PATCH/DELETE — onRequest reads the cookie value and compares
+ *      it to the x-csrf-token request header. Mismatch or missing → 403.
+ *
+ * The Double-Submit Cookie pattern is stateless: the server never stores tokens.
+ * Security relies on the same-origin policy: a cross-origin attacker can read
+ * neither the cookie nor the custom header value.
+ */
+export declare function csrfPlugin(options?: CsrfOptions): CsrfPlugin;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/app/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/app/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,aAAa,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAUrE;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAO7D;AAaD,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,mGAAmG;IACnG,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gFAAgF;IAChF,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAID,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,SAAS,EAAE,aAAa,CAAA;IACxB;;;;OAIG;IACH,UAAU,EAAE,cAAc,CAAA;CAC3B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CAAC,OAAO,GAAE,WAAgB,GAAG,UAAU,CAiDhE"}

package/dist/app/health.d.ts

@@ -0,0 +1,36 @@
+import type { OnRequestHook } from './types';
+export interface HealthCheck {
+    (): Promise<{
+        ok: boolean;
+        details?: Record<string, unknown>;
+    }>;
+}
+export interface HealthPluginOptions {
+    /** Path for the liveness endpoint. Default: '/health' */
+    path?: string;
+    /** Path for the readiness endpoint. Default: '/ready' */
+    readyPath?: string;
+    /** Named checks to run for the readiness endpoint. */
+    checks?: Record<string, HealthCheck>;
+}
+/**
+ * healthPlugin — adds /health and /ready endpoints for Kubernetes/load balancers.
+ *
+ * Usage:
+ *   const health = healthPlugin({ checks: { db: async () => ({ ok: true }) } })
+ *   app.onRequest(health.onRequest)
+ *
+ * GET /health  → 200 { status: 'ok', uptime: number }
+ *   Always returns 200. Use for liveness probes (is the process alive?).
+ *
+ * GET /ready   → 200 { status: 'ready', checks: { db: { ok: true } } }
+ *               → 503 { status: 'not_ready', checks: { db: { ok: false, error: '...' } } }
+ *   Runs all checks. Use for readiness probes (is the service ready to serve traffic?).
+ *
+ * The health endpoints are intercepted in the onRequest phase — before auth plugins run.
+ */
+export interface HealthPlugin {
+    onRequest: OnRequestHook;
+}
+export declare function healthPlugin(options?: HealthPluginOptions): HealthPlugin;
+//# sourceMappingURL=health.d.ts.map

package/dist/app/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/app/health.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAK5C,MAAM,WAAW,WAAW;IAC1B,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAA;CAChE;AAED,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;CACrC;AAID;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,aAAa,CAAA;CACzB;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,YAAY,CA4C5E"}