typespec-hono 0.1.0

package/dist/src/security.d.ts

@@ -0,0 +1,29 @@
+import { type HttpOperation } from "@typespec/http";
+import type { Program } from "@typespec/compiler";
+import type { SecurityRequirement } from "./runtime.js";
+/**
+ * What the DOCUMENT says a caller must satisfy, in the shape the document says it.
+ *
+ * ⚠️ **The scheme was being thrown away, and only "is a caller needed" survived.** `@useAuth(BearerAuth)`
+ * reaches OpenAPI as `security: [{ "BearerAuth": [] }]`, and this emitter reduced that to
+ * `deps.context(c, "required")`. A gate was emitted ONLY when the scheme carried scopes — so for
+ * bearer, api-key and basic, which is the common case, nothing carried which scheme at all. An
+ * application whose `context` read a cookie would happily serve a route the document says needs a
+ * bearer token, and nothing anywhere would notice.
+ *
+ * ⚠️ **Passed through, never enforced here.** Which credentials satisfy a scheme is the application's
+ * business and could not be anything else; which schemes an operation ACCEPTS is a contract fact and
+ * is now generated. That is the same split as `context` and `respond`, applied to the half that was
+ * missing.
+ */
+export type { SecurityRequirement } from "./runtime.js";
+/**
+ * The requirements an operation declares. Satisfying **any one** of them authorises the caller —
+ * which is what an array of `security` objects means in OpenAPI, and why this is a list of lists
+ * rather than a flat set of scopes.
+ *
+ * Empty when the operation declares `@useAuth(NoAuth)` or no authentication at all.
+ */
+export declare function securityFor(program: Program, operation: HttpOperation): SecurityRequirement[];
+/** The requirements as a TypeScript literal, for the generated call site. */
+export declare function renderSecurity(requirements: readonly SecurityRequirement[]): string;

package/dist/src/security.js

@@ -0,0 +1,48 @@
+import { getAuthenticationForOperation } from "@typespec/http";
+/**
+ * The requirements an operation declares. Satisfying **any one** of them authorises the caller —
+ * which is what an array of `security` objects means in OpenAPI, and why this is a list of lists
+ * rather than a flat set of scopes.
+ *
+ * Empty when the operation declares `@useAuth(NoAuth)` or no authentication at all.
+ */
+export function securityFor(program, operation) {
+    const authentication = getAuthenticationForOperation(program, operation.operation);
+    const requirements = [];
+    for (const option of authentication?.options ?? []) {
+        const requirement = {};
+        let anonymous = false;
+        for (const scheme of option.schemes) {
+            /**
+             * ⚠️ **`NoAuth` inside an option means that option needs nothing**, which is how a spec says
+             * "authentication is optional here". It is not a scheme to demand, and emitting it as one
+             * would refuse every anonymous caller the document permits.
+             */
+            if (scheme.type === "noAuth") {
+                anonymous = true;
+                continue;
+            }
+            /**
+             * Scopes belong to the flows of an OAuth2 scheme; every other kind has none. Read from the
+             * scheme rather than assumed, and de-duplicated because two flows may name the same scope.
+             */
+            const scopes = scheme.type === "oauth2"
+                ? [...new Set(scheme.flows.flatMap((flow) => flow.scopes.map((scope) => scope.value)))]
+                : [];
+            requirement[scheme.id] = scopes;
+        }
+        if (anonymous && Object.keys(requirement).length === 0)
+            continue;
+        if (Object.keys(requirement).length > 0)
+            requirements.push(requirement);
+    }
+    return requirements;
+}
+/** The requirements as a TypeScript literal, for the generated call site. */
+export function renderSecurity(requirements) {
+    return `[${requirements
+        .map((requirement) => `{ ${Object.entries(requirement)
+        .map(([scheme, scopes]) => `${JSON.stringify(scheme)}: [${scopes.map((s) => JSON.stringify(s)).join(", ")}]`)
+        .join(", ")} }`)
+        .join(", ")}]`;
+}

package/dist/src/tsp-index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * What TypeSpec's compiler loads for this library.
+ *
+ * ⚠️ **There is deliberately no `$decorators` export**, here or in `typespec-http-zod`. Four once
+ * existed and every one let a spec state something `@typespec/openapi3` could not publish, so the
+ * emitted validator enforced a rule no caller reading the contract could see. A decorator is not a
+ * convenience; it is a second contract.
+ */
+export { $lib } from "./lib.js";

package/dist/src/tsp-index.js

@@ -0,0 +1,9 @@
+/**
+ * What TypeSpec's compiler loads for this library.
+ *
+ * ⚠️ **There is deliberately no `$decorators` export**, here or in `typespec-http-zod`. Four once
+ * existed and every one let a spec state something `@typespec/openapi3` could not publish, so the
+ * emitted validator enforced a rule no caller reading the contract could see. A decorator is not a
+ * convenience; it is a second contract.
+ */
+export { $lib } from "./lib.js";

package/lib/main.tsp

@@ -0,0 +1,3 @@
+// The emitter library itself — one diagnostic and its options schema. There are no decorators; see
+// `src/tsp-index.ts` for why, and `typespec-http-zod` for the rest of the options this accepts.
+import "../dist/src/tsp-index.js";

package/package.json

@@ -0,0 +1,90 @@
+{
+  "name": "typespec-hono",
+  "version": "0.1.0",
+  "description": "TypeSpec emitter: generate a Hono server, and the Zod validators it enforces, from an HTTP service definition — agreeing with the OpenAPI document @typespec/openapi3 publishes from the same source.",
+  "keywords": [
+    "cloudflare-workers",
+    "codegen",
+    "hono",
+    "openapi",
+    "typespec",
+    "typespec-emitter",
+    "zod"
+  ],
+  "homepage": "https://github.com/bison-digital/typespec-hono#readme",
+  "bugs": {
+    "url": "https://github.com/bison-digital/typespec-hono/issues"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/bison-digital/typespec-hono.git"
+  },
+  "files": [
+    "lib/*.tsp",
+    "dist/**",
+    "!dist/test/**"
+  ],
+  "type": "module",
+  "main": "dist/src/index.js",
+  "exports": {
+    ".": {
+      "typespec": "./lib/main.tsp",
+      "types": "./dist/src/index.d.ts",
+      "default": "./dist/src/index.js"
+    },
+    "./runtime": {
+      "types": "./dist/src/runtime.d.ts",
+      "default": "./dist/src/runtime.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "dependencies": {
+    "typespec-http-zod": "^0.1.0"
+  },
+  "devDependencies": {
+    "@hono/zod-openapi": "^1.4.0",
+    "@hono/zod-validator": "^0.8.0",
+    "@types/node": "^26.0.0",
+    "@typespec/compiler": "1.15.0",
+    "@typespec/events": "0.85.0",
+    "@typespec/http": "1.15.0",
+    "@typespec/http-specs": "0.1.0-alpha.41",
+    "@typespec/openapi": "1.15.0",
+    "@typespec/openapi3": "1.15.0",
+    "@typespec/rest": "0.85.0",
+    "@typespec/sse": "0.85.0",
+    "@typespec/streams": "0.85.0",
+    "@typespec/versioning": "0.85.0",
+    "@typespec/xml": "0.85.0",
+    "hono": "^4.12.26",
+    "oxfmt": "^0.63.0",
+    "oxlint": "^1.78.0",
+    "typescript": "~7.0.2",
+    "typespec-hono": "link:.",
+    "vitest": "^4.1.9",
+    "zod": "^4.4.3"
+  },
+  "peerDependencies": {
+    "@hono/zod-validator": "^0.8.0",
+    "@typespec/compiler": "^1.15.0",
+    "@typespec/http": "^1.15.0",
+    "hono": "^4.12.0",
+    "zod": "^4.0.0"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "tspMain": "lib/main.tsp",
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "test": "tsc -p tsconfig.build.json && vitest run",
+    "typecheck": "tsc -p tsconfig.json",
+    "lint": "oxlint src/ test/",
+    "format": "oxfmt",
+    "format:check": "oxfmt --check"
+  }
+}