import { d as ParameterObject, S as SchemaOrBoolean, l as HttpRequest, c as OperationObject, O as OpenAPIDocument, h as ReferenceObject } from './types-Dzi0PpYX.cjs';
export { F as FetchRequestOptions, b as RouteMatch, c as Router, d as createRouter, h as httpRequestFromFetch, a as httpResponseFromFetch, r as readBodyFromFetch } from './from-fetch-CVVYXL_T.cjs';
import { V as ValidationError } from './errors-BahYESV_.cjs';
import { V as ValidationResult, T as TreeValidationResult } from './compiler-Cudx5OYj.cjs';
import './runtime-BXoST4J7.cjs';

/**
 * Deserialize a raw parameter string (from URL/header/cookie) into the
 * typed value implied by the parameter's schema + style/explode options.
 *
 * @remarks
 * Supported styles:
 * - path: `simple` (default), `label`, `matrix`
 * - query: `form` (default), `deepObject` (limited), `spaceDelimited`, `pipeDelimited`
 * - header: `simple` (default)
 * - cookie: `form` (default)
 *
 * @param raw - The raw value(s) provided for this parameter (string, array, or undefined).
 * @param parameter - The parameter definition.
 * @returns The deserialized value, ready for schema validation.
 *
 * @example
 * ```ts
 * deserialize("1,2,3", { name: "ids", in: "query", schema: { type: "array" } });
 * // [1, 2, 3]
 * ```
 *
 * @public
 */
declare function deserialize(raw: string | string[] | undefined, parameter: ParameterObject): unknown;
/**
 * Match a concrete `Content-Type` header against a set of OpenAPI media-type
 * patterns (which may use wildcards like `application/*` or `*\/*`). Returns
 * the most-specific match, or `undefined`.
 *
 * Media-type parameters (the bits after `;`) are honored on both sides:
 * a pattern like `application/json; version=1` only matches a concrete
 * `application/json; version=1` (extra parameters on the concrete side
 * are allowed). A pattern with no parameters matches any concrete type
 * that shares its type/subtype. Patterns with parameters win ties over
 * bare patterns, so a spec declaring both `application/json` and
 * `application/json; version=1` routes a versioned request to the
 * versioned entry.
 *
 * @param contentType - The concrete type (e.g. `"application/json; charset=utf-8"`).
 * @param patterns - Iterable of patterns from `content` keys.
 * @returns The matched pattern, or `undefined`.
 *
 * @public
 */
declare function matchMediaType(contentType: string | undefined, patterns: Iterable<string>): string | undefined;
/**
 * Parsed, spec-derived media-type pattern. Callers that match the same
 * OpenAPI `content` keys repeatedly can precompute these once and avoid
 * reparsing declarations on every request.
 *
 * @internal
 */
interface ParsedMediaTypePattern {
    pattern: string;
    type: string;
    subtype: string;
    params: Record<string, string>;
    paramEntries: Array<[string, string]>;
    specificity: number;
}
/**
 * Parse OpenAPI media-type patterns once for repeated matching.
 *
 * @internal
 */
declare function compileMediaTypePatterns(patterns: Iterable<string>): ParsedMediaTypePattern[];
/**
 * Match a concrete Content-Type against pre-parsed OpenAPI media-type
 * patterns. Ties preserve declaration order, matching {@link matchMediaType}.
 *
 * @internal
 */
declare function matchParsedMediaType(contentType: string | undefined, patterns: readonly ParsedMediaTypePattern[]): string | undefined;
/**
 * Find the response entry that matches a given status code, honoring the
 * OpenAPI precedence: exact status > `NXX` class > `default`.
 *
 * @param status - The response status.
 * @param responses - The operation's responses, as either a keyed
 *   object or a `Map` (the validator holds responses in a `Map`, so
 *   accepting it directly avoids an `Object.fromEntries` per call).
 * @returns The matched response key, or `undefined`.
 *
 * @public
 */
declare function matchResponseKey(status: number, responses: Record<string, unknown> | Map<string, unknown>): string | undefined;

/**
 * Query-parameter assembly helpers. OpenAPI allows a single
 * object-typed query parameter to be spread across multiple top-level
 * query keys (`style: form + explode: true` default, or `style:
 * deepObject`). Before the schema compiler can validate such a
 * parameter, the pieces have to be re-assembled into a single object.
 *
 * Extracted from validator.ts so the rules are unit-testable in
 * isolation; the end-to-end validator tests only ever see the
 * reassembled value through the schema error leaves, so edge cases
 * in the assembly logic were invisible to structural assertions.
 *
 * @packageDocumentation
 */

/**
 * Coerce a raw query-string scalar into the JS type a numeric or
 * boolean schema expects. Strings and unknown types pass through.
 *
 * @internal
 */
declare function coerceQueryScalar(value: string | undefined, schema: SchemaOrBoolean): unknown;
/**
 * Gather `name[key]=value` pairs from the top-level query into an
 * object: the `style: deepObject` assembly. Single-level only:
 * OpenAPI 3.0–3.2 do not define nested semantics, so `obj[a][b]=v`
 * yields a property literally named `a][b`.
 *
 * @internal
 */
declare function assembleDeepObject(name: string, query: Record<string, string | string[]> | undefined): Record<string, unknown> | undefined;
/**
 * Reassemble a `style: form + explode: true` object query param:
 * each declared property appears as its own top-level key.
 *
 * @internal
 */
declare function assembleFormExplodedObject(schema: SchemaOrBoolean | undefined, query: Record<string, string | string[]> | undefined): Record<string, unknown> | undefined;
/**
 * Dispatch an object-typed query parameter to the appropriate
 * assembler (`deepObject` or `form+explode`). Returns `undefined`
 * when the parameter isn't object-typed; caller should fall through
 * to the standard scalar/array deserialization path.
 *
 * When the parameter IS object-typed but no matching query keys are
 * present, returns `{ value: undefined }` so the caller can treat it
 * as absent.
 *
 * @internal
 */
declare function assembleObjectQueryParam(p: ParameterObject, query: Record<string, string | string[]> | undefined): {
    value: unknown;
} | undefined;

/**
 * Shape-only security check precompiled from a single OpenAPI security
 * scheme definition. Returns `null` when the request carries the
 * declared credential (presence + structural shape only); returns a
 * short human-readable reason when it doesn't. Credential verification
 * (token validity, API key lookup, password match) is outside scope;
 * that's the app's auth middleware.
 *
 * @internal
 */
interface CompiledSchemeCheck {
    scheme: string;
    check: (req: HttpRequest) => string | null;
}
/**
 * One security requirement: an AND of `CompiledSchemeCheck`s. All must
 * return `null` for the requirement to be satisfied.
 *
 * @internal
 */
interface CompiledSecurityRequirement {
    schemes: CompiledSchemeCheck[];
}
/**
 * A pre-compiled, operation-level security check. An OR across one or
 * more `CompiledSecurityRequirement`s; at least one must fully satisfy
 * for the request to pass. `null` (stored as `undefined` on
 * `OperationCache`) means "no security required" and skips the check.
 *
 * @internal
 */
type CompiledSecurity = CompiledSecurityRequirement[];
/**
 * Strictness toggle for shape-only security validation. `"shape"`
 * checks recognized schemes (`bearer`, `basic`, `apiKey`) and silently
 * passes on everything else (oauth2, openIdConnect, mutualTLS, HTTP
 * non-bearer/non-basic). `"strict"` checks recognized schemes and
 * fails the request on any unrecognized scheme. Mirrors the `"shape"`
 * / `"strict"` values of {@link ValidatorOptions.validateSecurity}.
 *
 * @internal
 */
type SecurityMode = "shape" | "strict";
/**
 * Compile the effective security for one operation. Applies OAS
 * precedence: operation-level `security` (including an explicit empty
 * array opt-out) overrides `document.security`. Unknown scheme names
 * compile to always-failing checks so a typo produces a 401 rather
 * than silently passing.
 *
 * Returns `undefined` when no requirement applies (no check emitted at
 * request time): distinct from an empty array, which is never returned
 * here: empty means "no security" and we fold that into `undefined`.
 *
 * @internal
 */
declare function compileOperationSecurity(operation: OperationObject, document: OpenAPIDocument, resolveRef: <T>(v: T | ReferenceObject | undefined) => T | undefined, mode?: SecurityMode): CompiledSecurity | undefined;
/**
 * Evaluate a compiled security plan against a request. OR across
 * requirements: the first passing requirement short-circuits to `null`
 * (success). If all fail, returns a single leaf `security` error
 * describing the declared alternatives.
 *
 * @internal
 */
declare function checkSecurity(compiled: CompiledSecurity, req: HttpRequest): ValidationError | null;

/**
 * Resolve an operation-level `$ref` (requestBody / response / parameter /
 * header) against the spec. Returns the target object with any siblings
 * on the reference itself dropped: per OAS, siblings of a Reference
 * are ignored. Follows chains with a depth guard to catch cycles.
 * External refs must be inlined upstream by `@oav/spec.resolveSpec()`.
 *
 * Lifted to module scope so it can be exercised independently of
 * `createValidator`.
 *
 * @internal
 */
declare function resolveOperationRef<T>(spec: unknown, value: T | ReferenceObject | undefined): T | undefined;

/**
 * Result reshaping, factored out of `validator.ts` so it can be
 * re-exported through `@oav/validator/internals` without dragging the
 * validator's full module graph (`@oav/spec` -> `node:fs`, etc.) into
 * `oav compile-spec`'s standalone esbuild bundle. The only runtime
 * dependency here is `@oav/core`'s `collectLeaves`.
 *
 * The validator builds a nested error tree internally and reshapes it to
 * the requested `output` / `maxErrors` at its public boundary; the emitted
 * standalone module reuses these same functions so its AOT output's result
 * shape stays identical to `createValidator`.
 */

/**
 * Reshape the validator's internal error tree (`ValidationError | null`)
 * into the requested output, applying the per-call `maxErrors` total.
 * `truncated` reports that the cap was reached (more problems may exist).
 *
 * Exported through `@oav/validator/internals` so `oav compile-spec`'s
 * emitted standalone module reshapes its hand-built tree the same way,
 * keeping the AOT output's result shape identical to this validator's.
 *
 * @internal
 */
declare function reshapeResult(tree: ValidationError | null, output: "flat" | "tree" | "predicate", maxErrors: number): ValidationResult | TreeValidationResult | boolean;
/**
 * Map a reshaped validation result onto the Fetch-wrapper return shape:
 * `{ ok: true, body }` on success, or `{ ok: false }` plus the failure
 * fields (`errors`/`error` + `truncated`, or nothing in predicate mode).
 *
 * Exported through `@oav/validator/internals` for the `oav compile-spec`
 * emitted module's `validateFetch*` wrappers (same reason as
 * {@link reshapeResult}).
 *
 * @internal
 */
declare function toFetchResult<T>(result: ValidationResult | TreeValidationResult | boolean, body: unknown): {
    ok: boolean;
    body?: T;
    errors?: ValidationError[];
    error?: ValidationError;
    truncated?: boolean;
};

export { type ParsedMediaTypePattern, assembleDeepObject, assembleFormExplodedObject, assembleObjectQueryParam, checkSecurity, coerceQueryScalar, compileMediaTypePatterns, compileOperationSecurity, deserialize, matchMediaType, matchParsedMediaType, matchResponseKey, reshapeResult, resolveOperationRef, toFetchResult };