Websocket gateway
@Gateway('/chat') on the same Bun.serve as
the routes. The broadcast goes through Bun's native pub/sub, so
every open tab on this page receives it.
Rate limit
@Throttle({ limit: 3, windowSeconds: 60 }) on
/api/limits/burst. The fourth call in a window is a 429
carrying retry-after. Your window is keyed on your own
address.
Image pipeline
Bun.Image behind /api/images/render. The
source is generated at runtime from a 4x4 seed, so no binary is
committed to the repository.
Queue
POST /api/jobs/thumbnails enqueues on bullmq over
Bun.RedisClient, and the handler runs in a forked
process. This polls the job until it leaves waiting.
Session
No sign-up. better-auth's anonymous plugin issues every
visitor a guest account and a seven-day session on arrival, and
SessionGuard is what /api/profile is
behind.
Validation
The route's zod schema is both the validator and the source of the
OpenAPI document. This posts a deliberately wrong body to
/api/users and shows the issues it returns.
Trace context
/api/trace adopts an inbound W3C
traceparent or starts one. Every log line the request
writes carries the same trace id.