@agilesyndrome/cf-genai-base 5.0.1 → 6.0.0

package/dist/admin/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/admin/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAQ7D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAK5C,OAAgB,EAChB,GAAQ,EACR,GAAQ,EACR,KAAY,EACZ,QAA8C;IAE9C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,IAAI,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEhF,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAgB,CAAC;QACpD,IAAI,CAAC,IAAI;YAAE,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC;YACvC,CAAC,CAAC,KAAK,CAAC,IAAI;YACZ,CAAC,CAAC,QAAQ;gBACR,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;gBACtC,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC,IAAI;YAAE,OAAO,2BAA2B,CAAC,GAAG,CAAC,CAAC;QACnD,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,2BAA2B,EAAE;QAC/C,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAgB,EAAE,GAAQ;IAClE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5F,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,IAAI,MAAM,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IACD,OAAO,SAAS,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAmB;IAC1C,OAAO,IAAI,CAAC,aAAa,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAwB;IAC9D,OAAO,KAAK,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AACpI,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAQ;IAC5C,OAAO,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC,mCAAmC,EAAE,GAAG,CAAC;QACrD,CAAC,CAAC,IAAI,QAAQ,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,OAAO,GAAG,EAAE,GAAG,gBAAgB,EAAE,kBAAkB,EAAE,sCAAsC,EAAE,CAAC;IACpG,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QACtD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QACnF,CAAC,CAAC,IAAI,QAAQ,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAQ;IAClD,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAC3F,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,MAAM,yBAAyB,kBAAkB,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AACrI,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;AACvG,CAAC;AAED,SAAS,SAAS,CAAC,OAAgB,EAAE,GAAkB;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5D,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtJ,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;AACzG,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,UAAU,GAAG,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;IACvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC;QAAE,UAAU,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1H,OAAO,UAAU,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAIrC,GAAQ,EAAE,IAAU,EAAE,KAAY;IAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAChF,KAAK,CAAC,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC"}

package/dist/admin/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./router.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/admin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC"}

package/dist/admin/index.js

@@ -0,0 +1,2 @@
+export * from "./router.js";
+//# sourceMappingURL=index.js.map

package/dist/admin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC"}

package/dist/admin/router.d.ts

@@ -0,0 +1,4 @@
+import type { AdminBindings, AdminBoundaryOptions, AdminIdentity, AdminRequestState, AdminNext } from "./types.js";
+export declare const ADMIN_API_PREFIX = "/api/admin";
+export declare function adminBoundary<Env extends AdminBindings, User extends AdminIdentity, State extends AdminRequestState<User>, Feature extends object = object>(request: Request, env: Env, ctx: ExecutionContext, next: AdminNext, state: State, options: AdminBoundaryOptions<Env, User, State, Feature>): Promise<Response>;
+//# sourceMappingURL=router.d.ts.map

package/dist/admin/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/admin/router.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,iBAAiB,EACjB,SAAS,EACV,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C,wBAAsB,aAAa,CACjC,GAAG,SAAS,aAAa,EACzB,IAAI,SAAS,aAAa,EAC1B,KAAK,SAAS,iBAAiB,CAAC,IAAI,CAAC,EACrC,OAAO,SAAS,MAAM,GAAG,MAAM,EAE/B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,GACvD,OAAO,CAAC,QAAQ,CAAC,CAmBnB"}

package/dist/admin/router.js

@@ -0,0 +1,24 @@
+import { authenticateAdminRequest, authenticationRequired, administratorRequired, isAdminPath, prepareAdminState, requireSameOriginMutation, } from "./auth.js";
+export const ADMIN_API_PREFIX = "/api/admin";
+export async function adminBoundary(request, env, ctx, next, state, options) {
+    const url = new URL(request.url);
+    if (!isAdminPath(url.pathname))
+        return next(request);
+    const authenticationFailure = await authenticateAdminRequest(request, env, url, state, options.provider);
+    if (authenticationFailure)
+        return authenticationFailure;
+    const originFailure = requireSameOriginMutation(request, url);
+    if (originFailure)
+        return originFailure;
+    const user = state.user;
+    if (!user)
+        return authenticationRequired(request);
+    await prepareAdminState(env, user, state);
+    const policyAllowed = !options.authorize || user.auth_strategy === "http_basic" || (await options.authorize({ request, url, user, env, ctx, state }));
+    if (!policyAllowed)
+        return administratorRequired(url);
+    // Domain routes own dispatch. This boundary only establishes identity and
+    // application-wide admin policy before the request reaches Hono.
+    return next(request);
+}
+//# sourceMappingURL=router.js.map

package/dist/admin/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/admin/router.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,WAAW,CAAC;AASnB,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C,MAAM,CAAC,KAAK,UAAU,aAAa,CAMjC,OAAgB,EAChB,GAAQ,EACR,GAAqB,EACrB,IAAe,EACf,KAAY,EACZ,OAAwD;IAExD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IAErD,MAAM,qBAAqB,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzG,IAAI,qBAAqB;QAAE,OAAO,qBAAqB,CAAC;IACxD,MAAM,aAAa,GAAG,yBAAyB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IAAI,CAAC,IAAI;QAAE,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAE1C,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,YAAY,IAAI,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACtJ,IAAI,CAAC,aAAa;QAAE,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAEtD,0EAA0E;IAC1E,iEAAiE;IACjE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;AACvB,CAAC"}

package/dist/admin/types.d.ts

@@ -0,0 +1,43 @@
+/** The small binding contract used by the reusable admin boundary. */
+export interface AdminBindings {
+    AUTH_STRATEGY?: string;
+    ADMIN_TOKEN?: string;
+    DB?: D1Database;
+}
+export interface AdminAuthorizationUser {
+    id: string;
+    email?: string | null;
+    display_name?: string | null;
+    is_admin?: boolean | number;
+}
+export interface AdminIdentity {
+    sub: string;
+    email?: string;
+    name?: string;
+    roles?: readonly string[];
+    auth_strategy?: string;
+    authUser?: AdminAuthorizationUser | null;
+}
+export interface AdminRequestState<User extends AdminIdentity = AdminIdentity> {
+    user?: User | null;
+    authUser?: AdminAuthorizationUser | null;
+    requestedBy?: string;
+}
+export interface AdminUserProvider<Env extends AdminBindings, User extends AdminIdentity> {
+    getUser(request: Request, env: Env): User | null | Promise<User | null>;
+}
+export interface AdminAuthorizationContext<Env extends AdminBindings, User extends AdminIdentity, State extends AdminRequestState<User>> {
+    request: Request;
+    url: URL;
+    user: User;
+    env: Env;
+    ctx: ExecutionContext;
+    state: State;
+}
+export interface AdminBoundaryOptions<Env extends AdminBindings, User extends AdminIdentity, State extends AdminRequestState<User>, Feature extends object = object> {
+    provider?: AdminUserProvider<Env, User> | null;
+    authorize?: (context: AdminAuthorizationContext<Env, User, State>) => boolean | Promise<boolean>;
+    features?: readonly Feature[];
+}
+export type AdminNext = (request: Request) => Response | Promise<Response>;
+//# sourceMappingURL=types.d.ts.map

package/dist/admin/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/admin/types.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,EAAE,CAAC,EAAE,UAAU,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,iBAAiB,CAAC,IAAI,SAAS,aAAa,GAAG,aAAa;IAC3E,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACnB,QAAQ,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB,CAAC,GAAG,SAAS,aAAa,EAAE,IAAI,SAAS,aAAa;IACtF,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;CACzE;AAED,MAAM,WAAW,yBAAyB,CACxC,GAAG,SAAS,aAAa,EACzB,IAAI,SAAS,aAAa,EAC1B,KAAK,SAAS,iBAAiB,CAAC,IAAI,CAAC;IAErC,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,IAAI,EAAE,IAAI,CAAC;IACX,GAAG,EAAE,GAAG,CAAC;IACT,GAAG,EAAE,gBAAgB,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB,CACnC,GAAG,SAAS,aAAa,EACzB,IAAI,SAAS,aAAa,EAC1B,KAAK,SAAS,iBAAiB,CAAC,IAAI,CAAC,EACrC,OAAO,SAAS,MAAM,GAAG,MAAM;IAE/B,QAAQ,CAAC,EAAE,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC;IAC/C,SAAS,CAAC,EAAE,CACV,OAAO,EAAE,yBAAyB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,KACjD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC/B;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC"}

package/dist/admin/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/admin/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/admin/types.ts"],"names":[],"mappings":""}

package/dist/api/client.d.ts

@@ -0,0 +1,34 @@
+export type JsonPrimitive = string | number | boolean | null;
+export interface JsonObject {
+    readonly [key: string]: JsonValue;
+}
+export type JsonValue = JsonPrimitive | JsonObject | readonly JsonValue[];
+export type JsonCompatible<Value> = Value extends JsonPrimitive ? Value : Value extends readonly (infer Element)[] ? readonly JsonCompatible<Element>[] : Value extends object ? {
+    readonly [Key in keyof Value]: JsonCompatible<Value[Key]>;
+} : never;
+export type JsonErrorEnvelope = JsonObject & {
+    readonly error: string;
+};
+export type ApiRequestInput = Parameters<typeof fetch>[0];
+export interface ApiRequestOptions extends RequestInit {
+    validateJson?: never;
+}
+export type JsonValidator<Result> = (value: unknown) => value is Result;
+export interface TypedApiRequestOptions<Result> extends RequestInit {
+    validateJson: JsonValidator<Result>;
+}
+export type ApiJsonRequestOptions = Omit<ApiRequestOptions, "body">;
+export type TypedApiJsonRequestOptions<Result> = Omit<TypedApiRequestOptions<Result>, "body">;
+export type ApiSuccessResult<Result = JsonValue> = Result | Response;
+export declare class ApiError extends Error {
+    readonly status: number;
+    readonly requestId: string | null;
+    constructor(message: string, status: number, requestId: string | null);
+}
+export declare function isJsonErrorEnvelope(value: unknown): value is JsonErrorEnvelope;
+export declare function apiFetch<Result>(input: ApiRequestInput, options: TypedApiRequestOptions<Result>): Promise<ApiSuccessResult<Result>>;
+export declare function apiFetch(input: ApiRequestInput, options?: ApiRequestOptions): Promise<ApiSuccessResult>;
+export declare function apiJson<Result, Payload>(input: ApiRequestInput, payload: Payload & JsonCompatible<Payload>, options: TypedApiJsonRequestOptions<Result>): Promise<ApiSuccessResult<Result>>;
+export declare function apiJson<Payload>(input: ApiRequestInput, payload: Payload & JsonCompatible<Payload>, options?: ApiJsonRequestOptions): Promise<ApiSuccessResult>;
+export { isJsonObject, isJsonValue } from "../input.js";
+//# sourceMappingURL=client.d.ts.map

package/dist/api/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAE7D,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,SAAS,EAAE,CAAC;AAE1E,MAAM,MAAM,cAAc,CAAC,KAAK,IAC9B,KAAK,SAAS,aAAa,GAAG,KAAK,GAC/B,KAAK,SAAS,SAAS,CAAC,MAAM,OAAO,CAAC,EAAE,GAAG,SAAS,cAAc,CAAC,OAAO,CAAC,EAAE,GAC7E,KAAK,SAAS,MAAM,GAAG;IAAE,QAAQ,EAAE,GAAG,IAAI,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;CAAE,GACpF,KAAK,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1D,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,MAAM,aAAa,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC;AAExE,MAAM,WAAW,sBAAsB,CAAC,MAAM,CAAE,SAAQ,WAAW;IACjE,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;AAEpE,MAAM,MAAM,0BAA0B,CAAC,MAAM,IAAI,IAAI,CACnD,sBAAsB,CAAC,MAAM,CAAC,EAC9B,MAAM,CACP,CAAC;AAEF,MAAM,MAAM,gBAAgB,CAAC,MAAM,GAAG,SAAS,IAAI,MAAM,GAAG,QAAQ,CAAC;AAErE,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAElC,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,EAKpE;CACF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAE9E;AAaD,wBAAgB,QAAQ,CAAC,MAAM,EAC7B,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,sBAAsB,CAAC,MAAM,CAAC,GACtC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;AACrC,wBAAgB,QAAQ,CACtB,KAAK,EAAE,eAAe,EACtB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAuC7B,wBAAgB,OAAO,CAAC,MAAM,EAAE,OAAO,EACrC,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,EAC1C,OAAO,EAAE,0BAA0B,CAAC,MAAM,CAAC,GAC1C,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;AACrC,wBAAgB,OAAO,CAAC,OAAO,EAC7B,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,EAC1C,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAc7B,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/api/client.js

@@ -0,0 +1,59 @@
+export class ApiError extends Error {
+    status;
+    requestId;
+    constructor(message, status, requestId) {
+        super(message);
+        this.name = "ApiError";
+        this.status = status;
+        this.requestId = requestId;
+    }
+}
+export function isJsonErrorEnvelope(value) {
+    return isJsonObject(value) && typeof value.error === "string" && value.error.length > 0;
+}
+function requestHeaders(options) {
+    const headers = new Headers({ Accept: "application/json" });
+    if (options.body !== undefined && options.body !== null) {
+        headers.set("Content-Type", "application/json");
+    }
+    if (options.headers) {
+        new Headers(options.headers).forEach((value, name) => headers.set(name, value));
+    }
+    return headers;
+}
+export async function apiFetch(input, options = {}) {
+    return performApiFetch(input, options);
+}
+async function performApiFetch(input, options) {
+    const { validateJson, ...requestOptions } = options;
+    const response = await fetch(input, {
+        credentials: "same-origin",
+        ...requestOptions,
+        headers: requestHeaders(requestOptions),
+    });
+    const payload = await response.clone().json().catch(() => null);
+    if (!response.ok) {
+        const message = isJsonErrorEnvelope(payload)
+            ? payload.error
+            : `Request failed (${response.status})`;
+        throw new ApiError(message, response.status, response.headers.get("X-Request-ID") || null);
+    }
+    if (payload === null)
+        return response;
+    if (validateJson) {
+        if (!validateJson(payload))
+            throw new TypeError("API response did not match the expected JSON shape");
+        return payload;
+    }
+    return isJsonValue(payload) ? payload : response;
+}
+export function apiJson(input, payload, options = {}) {
+    return performApiFetch(input, {
+        ...options,
+        method: options.method || "POST",
+        body: JSON.stringify(payload),
+    });
+}
+import { isJsonObject, isJsonValue } from "../input.js";
+export { isJsonObject, isJsonValue } from "../input.js";
+//# sourceMappingURL=client.js.map

package/dist/api/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAuCA,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,MAAM,CAAS;IACf,SAAS,CAAgB;IAElC,YAAY,OAAe,EAAE,MAAc,EAAE,SAAwB;QACnE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,cAAc,CAAC,OAAoB;IAC1C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,KAAsB,EACtB,OAAO,GAAuD,EAAE;IAEhE,OAAO,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAAsB,EACtB,OAA2D;IAE3D,MAAM,EAAE,YAAY,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE;QAClC,WAAW,EAAE,aAAa;QAC1B,GAAG,cAAc;QACjB,OAAO,EAAE,cAAc,CAAC,cAAc,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAEzE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC;YAC1C,CAAC,CAAC,OAAO,CAAC,KAAK;YACf,CAAC,CAAC,mBAAmB,QAAQ,CAAC,MAAM,GAAG,CAAC;QAC1C,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAC7C,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACtC,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;QACtG,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnD,CAAC;AAYD,MAAM,UAAU,OAAO,CACrB,KAAsB,EACtB,OAA0C,EAC1C,OAAO,GAA+D,EAAE;IAExE,OAAO,eAAe,CAAC,KAAK,EAAE;QAC5B,GAAG,OAAO;QACV,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,MAAM;QAChC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC;AACD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/api/contracts.d.ts

@@ -0,0 +1,31 @@
+import type { IdentityState, RequestIdentity } from "../auth/identity/index.js";
+import type { DomainAuth } from "../domain/index.js";
+export interface RouteRequestContext<Env = unknown, State = IdentityState> {
+    request: Request;
+    env: Env;
+    ctx: ExecutionContext;
+    state: State;
+    route: ApiRoute<Env, State>;
+    identity: RequestIdentity;
+    params: Readonly<Record<string, string>>;
+}
+export interface ApiRoute<Env = unknown, State = IdentityState> {
+    method: string | readonly string[];
+    path: string | ((pathname: string, request: Request) => boolean);
+    auth?: DomainAuth;
+    scope?: string | null;
+    scopes?: readonly string[];
+    scopeMode?: "all" | "any";
+    csrf?: boolean;
+    authorize?: (context: RouteRequestContext<Env, State>) => boolean | Response | Promise<boolean | Response>;
+    handler: (context: RouteRequestContext<Env, State>) => Response | Promise<Response>;
+}
+export interface RouteInput<Env = unknown, State = IdentityState> extends Omit<ApiRoute<Env, State>, "method"> {
+    method?: string | readonly string[];
+}
+export declare function defineRoute<Env = unknown, State = IdentityState>({ method, path, auth, scope, csrf, handler, ...rest }: RouteInput<Env, State>): ApiRoute<Env, State>;
+/** Compatibility predicate for callers that need to inspect a route directly. */
+export declare function matchRoute(request: Request, route: Pick<ApiRoute<never, never>, "method" | "path">): boolean;
+export declare function createRouteDispatcher<Env extends object, State extends IdentityState>(routes?: readonly ApiRoute<Env, State>[]): (request: Request, env: Env, ctx: ExecutionContext, state: State) => Promise<Response | null>;
+export declare function dispatchRoutes<Env extends object, State extends IdentityState>(request: Request, env: Env, ctx: ExecutionContext, state: State, routes?: readonly ApiRoute<Env, State>[]): Promise<Response | null>;
+//# sourceMappingURL=contracts.d.ts.map

package/dist/api/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../src/api/contracts.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEhF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAIrD,MAAM,WAAW,mBAAmB,CAAC,GAAG,GAAG,OAAO,EAAE,KAAK,GAAG,aAAa;IACvE,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,GAAG,EAAE,gBAAgB,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,QAAQ,CAAC,GAAG,GAAG,OAAO,EAAE,KAAK,GAAG,aAAa;IAC5D,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACnC,IAAI,EAAE,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC;IACjE,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,CACV,OAAO,EAAE,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,KACrC,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC;IACtD,OAAO,EAAE,CAAC,OAAO,EAAE,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACrF;AAED,MAAM,WAAW,UAAU,CAAC,GAAG,GAAG,OAAO,EAAE,KAAK,GAAG,aAAa,CAC9D,SAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;CACrC;AAaD,wBAAgB,WAAW,CAAC,GAAG,GAAG,OAAO,EAAE,KAAK,GAAG,aAAa,EAC9D,EACE,MAAc,EACd,IAAI,EACJ,IAAe,EACf,KAAY,EACZ,IAAY,EACZ,OAAO,EACP,GAAG,IAAI,EACR,EAAE,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GACxB,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAQtB;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CACxB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC,GACrD,OAAO,CAUT;AAoED,wBAAgB,qBAAqB,CAAC,GAAG,SAAS,MAAM,EAAE,KAAK,SAAS,aAAa,EACnF,MAAM,GAAE,SAAS,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,EAAO,aAIjC,OAAO,OACX,GAAG,OACH,gBAAgB,SACd,KAAK,KACX,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAU5B;AAED,wBAAsB,cAAc,CAAC,GAAG,SAAS,MAAM,EAAE,KAAK,SAAS,aAAa,EAClF,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,KAAK,EACZ,MAAM,GAAE,SAAS,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,EAAO,GAC3C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAG1B"}

package/dist/api/contracts.js

@@ -0,0 +1,101 @@
+import { Hono } from "hono";
+import { hasScope, requestIdentity } from "../auth/index.js";
+import { json, sameOrigin } from "../core/security/index.js";
+const ROUTER_CONTEXT = "__cfgenai_api_context";
+export function defineRoute({ method = "GET", path, auth = "public", scope = null, csrf = false, handler, ...rest }) {
+    if (!path || typeof handler !== "function") {
+        throw new TypeError("API routes require path and handler");
+    }
+    const normalizedMethod = Array.isArray(method)
+        ? method.map((value) => String(value).toUpperCase())
+        : String(method).toUpperCase();
+    return { ...rest, method: normalizedMethod, path, auth, scope, csrf, handler };
+}
+/** Compatibility predicate for callers that need to inspect a route directly. */
+export function matchRoute(request, route) {
+    const url = new URL(request.url);
+    const methods = Array.isArray(route.method) ? route.method : [route.method];
+    const methodMatches = methods
+        .map((method) => String(method).toUpperCase())
+        .includes(request.method.toUpperCase());
+    const pathMatches = typeof route.path === "function"
+        ? route.path(url.pathname, request)
+        : route.path === url.pathname;
+    return methodMatches && pathMatches;
+}
+function createRouteRouter(routes) {
+    const app = new Hono();
+    // Nested dispatch must not turn typed errors into Hono's generic 500 response.
+    app.onError((error) => { throw error; });
+    for (const route of routes) {
+        const methods = (Array.isArray(route.method) ? route.method : [route.method])
+            .map((method) => String(method).toUpperCase());
+        const path = typeof route.path === "string" ? route.path : "*";
+        for (const method of methods)
+            app.on(method, path, async (context, next) => {
+                if (typeof route.path === "function"
+                    && !route.path(new URL(context.req.url).pathname, context.req.raw))
+                    return next();
+                const runtime = context.env[ROUTER_CONTEXT];
+                if (!runtime)
+                    return context.json({ error: "API router context is missing." }, 500);
+                runtime.matched = true;
+                const identity = requestIdentity(runtime.state);
+                if (route.auth === "user" && !identity.isAuthenticated) {
+                    return json({ error: "Authentication is required." }, 401);
+                }
+                if (route.auth === "admin" && !identity.isAdmin) {
+                    return json({ error: "Administrator access is required." }, 403);
+                }
+                if (route.csrf && !sameOrigin(context.req.raw)) {
+                    return json({ error: "A same-origin request is required." }, 403);
+                }
+                const scopes = route.scopes || (route.scope ? [route.scope] : []);
+                if (scopes.length) {
+                    const checks = await Promise.all(scopes.map((scope) => hasScope(runtime.env, runtime.state.user
+                        ?? (runtime.state.authUser ? { authUser: runtime.state.authUser } : null), scope, { who: identity.who })));
+                    const allowed = route.scopeMode === "any" ? checks.some(Boolean) : checks.every(Boolean);
+                    if (!allowed)
+                        return json({ error: "Required scope is missing." }, 403);
+                }
+                const routeContext = {
+                    request: context.req.raw,
+                    env: runtime.env,
+                    ctx: runtime.ctx,
+                    state: runtime.state,
+                    route,
+                    identity,
+                    params: context.req.param(),
+                };
+                if (route.authorize) {
+                    const verdict = await route.authorize(routeContext);
+                    if (verdict instanceof Response)
+                        return verdict;
+                    if (!verdict)
+                        return json({ error: "Access is not permitted." }, 403);
+                }
+                return route.handler(routeContext);
+            });
+    }
+    return app;
+}
+export function createRouteDispatcher(routes = []) {
+    const router = createRouteRouter(routes);
+    return async function dispatch(request, env, ctx, state) {
+        if (!routes.length)
+            return null;
+        const routerContext = { env, ctx, state, matched: false };
+        const requestEnv = {
+            ...env,
+            [ROUTER_CONTEXT]: routerContext,
+        };
+        const response = await router.fetch(request, requestEnv, ctx);
+        return !routerContext.matched && response.status === 404 ? null : response;
+    };
+}
+export async function dispatchRoutes(request, env, ctx, state, routes = []) {
+    if (!routes.length)
+        return null;
+    return createRouteDispatcher(routes)(request, env, ctx, state);
+}
+//# sourceMappingURL=contracts.js.map

package/dist/api/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../src/api/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAG7D,MAAM,cAAc,GAAG,uBAAuB,CAAC;AA0C/C,MAAM,UAAU,WAAW,CACzB,EACE,MAAM,GAAG,KAAK,EACd,IAAI,EACJ,IAAI,GAAG,QAAQ,EACf,KAAK,GAAG,IAAI,EACZ,IAAI,GAAG,KAAK,EACZ,OAAO,EACP,GAAG,IAAI,EACgB;IAEzB,IAAI,CAAC,IAAI,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5C,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACjF,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,UAAU,CACxB,OAAgB,EAChB,KAAsD;IAEtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5E,MAAM,aAAa,GAAG,OAAO;SAC1B,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;SAC7C,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU;QAClD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC;QACnC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,QAAQ,CAAC;IAChC,OAAO,aAAa,IAAI,WAAW,CAAC;AACtC,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAuC;IAEvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAA4C,CAAC;IACjE,+EAA+E;IAC/E,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;aAC1E,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/D,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;gBACzE,IACE,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU;uBAC7B,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;oBAClE,OAAO,IAAI,EAAE,CAAC;gBAEhB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC5C,IAAI,CAAC,OAAO;oBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,GAAG,CAAC,CAAC;gBACpF,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBACvB,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAChD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;oBACvD,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC7D,CAAC;gBACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBAChD,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAAE,GAAG,CAAC,CAAC;gBACnE,CAAC;gBACD,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/C,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,EAAE,GAAG,CAAC,CAAC;gBACpE,CAAC;gBAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAClE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBAClB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACpD,QAAQ,CACN,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,KAAK,CAAC,IAAI;2BACb,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAC3E,KAAK,EACL,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CACtB,CACF,CAAC,CAAC;oBACH,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACzF,IAAI,CAAC,OAAO;wBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,YAAY,GAAoC;oBACpD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG;oBACxB,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,KAAK;oBACL,QAAQ;oBACR,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE;iBAC5B,CAAC;gBACF,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;oBACpB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;oBACpD,IAAI,OAAO,YAAY,QAAQ;wBAAE,OAAO,OAAO,CAAC;oBAChD,IAAI,CAAC,OAAO;wBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACrC,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAM,GAAoC,EAAE;IAE5C,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,KAAK,UAAU,QAAQ,CAC5B,OAAgB,EAChB,GAAQ,EACR,GAAqB,EACrB,KAAY;QAEZ,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,aAAa,GAA8B,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACrF,MAAM,UAAU,GAA+B;YAC7C,GAAG,GAAG;YACN,CAAC,cAAc,CAAC,EAAE,aAAa;SAChC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QAC9D,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7E,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,GAAQ,EACR,GAAqB,EACrB,KAAY,EACZ,MAAM,GAAoC,EAAE;IAE5C,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AACjE,CAAC"}

package/dist/api/http.d.ts

@@ -0,0 +1,12 @@
+export declare const NO_STORE_HEADERS: {
+    readonly "Cache-Control": "no-store";
+};
+export declare function readJsonObject(request: Request): Promise<Record<string, unknown> | null>;
+export declare function stringField(body: Record<string, unknown> | null, field: string): string | null;
+export declare function stringArrayField(body: Record<string, unknown> | null, field: string): string[] | null;
+export declare function jsonError(error: string, status: number): Response;
+export declare function badRequest(error: string): Response;
+export declare function notFound(error: string): Response;
+export declare function jsonWithCookie(body: object, cookie: string): Response;
+export declare function errorMessage(error: unknown): string;
+//# sourceMappingURL=http.d.ts.map

package/dist/api/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/api/http.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB;aAAK,eAAe,EAAE,UAAU;CAAW,CAAC;AAGzE,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAE9F;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG9F;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAKrG;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CAEjE;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAElD;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAEhD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CAOrE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEnD"}

package/dist/api/http.js

@@ -0,0 +1,36 @@
+export const NO_STORE_HEADERS = { "Cache-Control": "no-store" };
+import { readJson } from "../core/security/index.js";
+export async function readJsonObject(request) {
+    return readJson(request);
+}
+export function stringField(body, field) {
+    const value = body?.[field];
+    return typeof value === "string" && value.length > 0 ? value : null;
+}
+export function stringArrayField(body, field) {
+    const value = body?.[field];
+    return Array.isArray(value) && value.every((entry) => typeof entry === "string")
+        ? value
+        : null;
+}
+export function jsonError(error, status) {
+    return Response.json({ error }, { status, headers: NO_STORE_HEADERS });
+}
+export function badRequest(error) {
+    return Response.json({ error }, { status: 400 });
+}
+export function notFound(error) {
+    return Response.json({ error }, { status: 404 });
+}
+export function jsonWithCookie(body, cookie) {
+    return new Response(JSON.stringify(body), {
+        headers: {
+            "content-type": "application/json; charset=utf-8",
+            "Set-Cookie": cookie,
+        },
+    });
+}
+export function errorMessage(error) {
+    return error instanceof Error ? error.message : "Unable to complete the request";
+}
+//# sourceMappingURL=http.js.map

package/dist/api/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/api/http.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,eAAe,EAAE,UAAU,EAAW,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB;IACnD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAoC,EAAE,KAAa;IAC7E,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAoC,EAAE,KAAa;IAClF,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAC/F,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,MAAc;IACrD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,MAAc;IACzD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,OAAO,EAAE;YACP,cAAc,EAAE,iCAAiC;YACjD,YAAY,EAAE,MAAM;SACrB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC,CAAC;AACnF,CAAC"}

package/dist/api/index.d.ts

@@ -0,0 +1,14 @@
+export { requestContext, requestIdentity, userId } from "../auth/identity/index.js";
+export { requireFeatureCircuit } from "../core/circuits/index.js";
+export { Event, emitEvent } from "../core/events/index.js";
+export { json, readJson, readJsonClone, requireAdmin, requireUser, sameOrigin, secureJson, secureText } from "../core/security/index.js";
+export type { AllowedOriginInput, IdentityLike, JsonObjectBody, ReadJsonCloneResult, ResponseHeaders, SecurityRequestError, } from "../core/security/index.js";
+export { defineRepository, createRepositories, RepositoryError } from "../repository.js";
+export { defineRoute, matchRoute, dispatchRoutes } from "./contracts.js";
+export { ApiError, apiFetch, apiJson, isJsonErrorEnvelope } from "./client.js";
+export type { ApiJsonRequestOptions, ApiRequestInput, ApiRequestOptions, ApiSuccessResult, JsonCompatible, JsonErrorEnvelope, JsonObject, JsonPrimitive, JsonValidator, JsonValue, TypedApiJsonRequestOptions, TypedApiRequestOptions, } from "./client.js";
+export { defineApp } from "../app.js";
+export { SECURITY_HEADER_NAMES, assertSecurityHeaders, assertJsonError } from "./testing.js";
+export type { JsonErrorAssertionInput, JsonErrorAssertionResult, SecurityHeaderAssertionInput, SecurityHeaderAssertionResult, SecurityHeaderName, } from "./testing.js";
+export * from "./http.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACzI,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC/E,YAAY,EACV,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,UAAU,EACV,aAAa,EACb,aAAa,EACb,SAAS,EACT,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7F,YAAY,EACV,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,EAC5B,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,cAAc,WAAW,CAAC"}

package/dist/api/index.js

@@ -0,0 +1,11 @@
+export { requestContext, requestIdentity, userId } from "../auth/identity/index.js";
+export { requireFeatureCircuit } from "../core/circuits/index.js";
+export { Event, emitEvent } from "../core/events/index.js";
+export { json, readJson, readJsonClone, requireAdmin, requireUser, sameOrigin, secureJson, secureText } from "../core/security/index.js";
+export { defineRepository, createRepositories, RepositoryError } from "../repository.js";
+export { defineRoute, matchRoute, dispatchRoutes } from "./contracts.js";
+export { ApiError, apiFetch, apiJson, isJsonErrorEnvelope } from "./client.js";
+export { defineApp } from "../app.js";
+export { SECURITY_HEADER_NAMES, assertSecurityHeaders, assertJsonError } from "./testing.js";
+export * from "./http.js";
+//# sourceMappingURL=index.js.map

package/dist/api/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AASzI,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAe/E,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAQ7F,cAAc,WAAW,CAAC"}

package/dist/api/testing.d.ts

@@ -0,0 +1,10 @@
+import type { JsonErrorEnvelope } from "./client.js";
+export declare const SECURITY_HEADER_NAMES: readonly ["Content-Security-Policy", "X-Content-Type-Options", "X-Frame-Options", "Referrer-Policy", "Permissions-Policy", "Strict-Transport-Security"];
+export type SecurityHeaderName = (typeof SECURITY_HEADER_NAMES)[number];
+export type SecurityHeaderAssertionInput = Pick<Response, "headers">;
+export type SecurityHeaderAssertionResult<ResponseType extends SecurityHeaderAssertionInput> = ResponseType;
+export type JsonErrorAssertionInput = readonly [response: Response, status: number];
+export type JsonErrorAssertionResult = JsonErrorEnvelope;
+export declare function assertSecurityHeaders<ResponseType extends SecurityHeaderAssertionInput>(response: ResponseType): SecurityHeaderAssertionResult<ResponseType>;
+export declare function assertJsonError(...[response, status]: JsonErrorAssertionInput): Promise<JsonErrorAssertionResult>;
+//# sourceMappingURL=testing.d.ts.map

package/dist/api/testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../src/api/testing.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,eAAO,MAAM,qBAAqB,YAChC,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,CACnB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AACxE,MAAM,MAAM,4BAA4B,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACrE,MAAM,MAAM,6BAA6B,CAAC,YAAY,SAAS,4BAA4B,IACzF,YAAY,CAAC;AAEf,MAAM,MAAM,uBAAuB,GAAG,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAEpF,MAAM,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;AAEzD,wBAAgB,qBAAqB,CAAC,YAAY,SAAS,4BAA4B,EACrF,QAAQ,EAAE,YAAY,GACrB,6BAA6B,CAAC,YAAY,CAAC,CAK7C;AAED,wBAAsB,eAAe,CACnC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,uBAAuB,GAC7C,OAAO,CAAC,wBAAwB,CAAC,CAOnC"}

package/dist/api/testing.js

@@ -0,0 +1,26 @@
+import { isJsonErrorEnvelope } from "./client.js";
+export const SECURITY_HEADER_NAMES = [
+    "Content-Security-Policy",
+    "X-Content-Type-Options",
+    "X-Frame-Options",
+    "Referrer-Policy",
+    "Permissions-Policy",
+    "Strict-Transport-Security",
+];
+export function assertSecurityHeaders(response) {
+    for (const header of SECURITY_HEADER_NAMES) {
+        if (!response?.headers?.get(header))
+            throw new Error(`Missing security header: ${header}`);
+    }
+    return response;
+}
+export async function assertJsonError(...[response, status]) {
+    if (response.status !== status) {
+        throw new Error(`Expected ${status}, received ${response.status}`);
+    }
+    const payload = await response.clone().json().catch(() => null);
+    if (!isJsonErrorEnvelope(payload))
+        throw new Error("Expected a JSON error envelope");
+    return payload;
+}
+//# sourceMappingURL=testing.js.map

package/dist/api/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../../src/api/testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGlD,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,yBAAyB;IACzB,wBAAwB;IACxB,iBAAiB;IACjB,iBAAiB;IACjB,oBAAoB;IACpB,2BAA2B;CACnB,CAAC;AAWX,MAAM,UAAU,qBAAqB,CACnC,QAAsB;IAEtB,KAAK,MAAM,MAAM,IAAI,qBAAqB,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAA0B;IAE9C,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,YAAY,MAAM,cAAc,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACzE,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACrF,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/app.d.ts

@@ -0,0 +1,21 @@
+import type { AppDomain } from "./domain/index.js";
+export type AnyAppDomain = AppDomain<unknown, unknown, unknown>;
+export interface AppDefinitionInput<Feature = unknown, Domain extends AnyAppDomain = AnyAppDomain> {
+    name: string;
+    ui?: boolean;
+    api?: boolean;
+    admin?: boolean;
+    features?: readonly Feature[];
+    domains?: readonly Domain[];
+}
+export interface AppDefinition<Feature = unknown, Domain extends AnyAppDomain = AnyAppDomain> {
+    readonly name: string;
+    readonly ui: boolean;
+    readonly api: boolean;
+    readonly admin: boolean;
+    readonly features: readonly Feature[];
+    readonly domains: readonly Domain[];
+}
+/** Register all application-owned capabilities in one deployable manifest. */
+export declare function defineApp<const Feature = unknown, const Domain extends AnyAppDomain = AnyAppDomain>(input: AppDefinitionInput<Feature, Domain>): Readonly<AppDefinition<Feature, Domain>>;
+//# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEhE,MAAM,WAAW,kBAAkB,CACjC,OAAO,GAAG,OAAO,EACjB,MAAM,SAAS,YAAY,GAAG,YAAY;IAE1C,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa,CAC5B,OAAO,GAAG,OAAO,EACjB,MAAM,SAAS,YAAY,GAAG,YAAY;IAE1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,CACvB,KAAK,CAAC,OAAO,GAAG,OAAO,EACvB,KAAK,CAAC,MAAM,SAAS,YAAY,GAAG,YAAY,EAChD,KAAK,EAAE,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAiBtF"}

package/dist/app.js

@@ -0,0 +1,23 @@
+/** Register all application-owned capabilities in one deployable manifest. */
+export function defineApp(input) {
+    if ("repositories" in input) {
+        throw new TypeError("Repositories belong to an AppDomain, not directly to an app");
+    }
+    const { name, ui = true, api = true, admin = true, features = [], domains = [] } = input;
+    if (!/^[a-z][a-z0-9-]*$/.test(String(name || "")))
+        throw new TypeError("Apps require a safe name");
+    if (!ui && !api)
+        throw new TypeError("An app must expose ui or api");
+    const names = domains.map((domain) => domain.name);
+    if (new Set(names).size !== names.length)
+        throw new TypeError("Apps cannot register a domain twice");
+    return Object.freeze({
+        name: String(name),
+        ui: Boolean(ui),
+        api: Boolean(api),
+        admin: Boolean(admin),
+        features: Object.freeze([...features]),
+        domains: Object.freeze([...domains]),
+    });
+}
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AA4BA,8EAA8E;AAC9E,MAAM,UAAU,SAAS,CAGvB,KAA0C;IAC1C,IAAI,cAAc,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,QAAQ,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC;IACzF,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACnG,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IACrG,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;QAClB,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;QACf,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;QACjB,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;QACtC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;KACrC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/constants.d.ts

@@ -0,0 +1,9 @@
+export declare const AUTH_USER_TABLE = "auth_users";
+export declare const AUTH_SCOPE_TABLE = "auth_scopes";
+export declare const AUTH_GRANT_TABLE = "auth_user_scopes";
+export declare const DEFAULT_TENANT_ID = "easley-family";
+export declare const DEFAULT_TENANT_NAME = "Easley Family";
+export declare class SubscriptionError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=constants.d.ts.map

package/dist/auth/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/auth/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,eAAe,CAAC;AAC5C,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAC9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AACjD,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AAEnD,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAO,EAAE,MAAM,EAAsD;CAClF"}