API Overview

@mountsqli/api turns your queries into HTTP APIs. You define named routes from QueryPlans, then serve them as REST, generate OpenAPI, or expose them as RPC — all from one Router.

The Router

import { createRouter, crudRoutes } from "@mountsqli/api";
import { users } from "./tables";

const router = createRouter();
router.get("/users", { plan: db.from(users)._plan });
router.use(crudRoutes(users.def)); // auto GET/POST/PUT/DELETE

What you get

Capability	Function
REST handler	createRestHandler(router)
OpenAPI JSON	toOpenApi(router) / generateOpenApi
RPC (tRPC-style)	toTrpc(router)
CRUD scaffolding	crudRoutes(tableDef)
Query parsing	parseFilterQuery, paginationMeta

Auth is awaited

createRestHandler is async. It awaits the route’s auth middleware and returns 403 on failure. Callers MUST await it — earlier versions fired auth and let requests through unauthenticated (fixed in the hardening pass).

const out = await ctx.rest(restReq, /* db */);
// out is { route, plan, params } or a RestResponse (403 on auth failure)

Why codegen from plans?

Because routes are QueryPlans, they are type-checked and injection-safe by construction — the same guarantees as the builder. The AI package can emit the same plans.

Best practices

• Name every route; OpenAPI uses the name as the operationId.
• Use crudRoutes for standard table endpoints, custom routes for logic.
• Always await the REST handler.

Common mistakes

• Not awaiting createRestHandler — auth bypass returns.
• Building SQL strings in handlers instead of passing a plan.

Related

• REST Handler — serve routes over HTTP.
• OpenAPI & Codegen — emit the spec.
• Auth Middleware — the awaited guard.