@awsmbiz/inbis-api 0.0.0-stage → 0.2.0

package/README.md

@@ -1,3 +1,53 @@
-# Temporary Holding Version
+# @awsmbiz/inbis-api
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+App factory for Inbis Workers: an OpenAPI-enabled Hono app with the platform's
+request pipeline built in. Peer dependencies: `hono`, `@hono/zod-openapi`, `zod` (v4).
+
+```ts
+import { createRoute, z } from "@hono/zod-openapi";
+import { createApi, createRouter } from "@awsmbiz/inbis-api";
+import { requireVar } from "@awsmbiz/inbis-cloudflare";
+
+const getWidget = createRoute({
+  method: "get",
+  path: "/widgets/{id}",
+  request: { params: z.object({ id: z.string().uuid() }) },
+  responses: { 200: { description: "Widget", content: { "application/json": { schema: WidgetSchema } } } },
+});
+
+const v1 = createRouter<Env>().openapi(getWidget, async (c) => {
+  c.var.logger.info("widget.read", { id: c.req.valid("param").id });
+  return c.json(await widgets.get(c.req.valid("param").id), 200);
+});
+
+export default createApi<Env>({
+  info: { title: "Billing", version: "1.0.0" },
+  trustedOrigins: (env) => requireVar(env, "TRUSTED_ORIGINS").split(","),
+  readiness: { database: (c) => c.env.DB.prepare("select 1").run() },
+  v1,
+});
+```
+
+## What every app gets
+
+| Concern | Behaviour |
+|---|---|
+| Request IDs | Every response gets a fresh UUIDv7 `x-request-id`. An incoming `x-request-id` is ignored. |
+| Correlation IDs | A well-formed incoming `x-correlation-id` (`[A-Za-z0-9._:-]{1,128}`) is propagated; otherwise the request ID is used. Both are echoed. |
+| Logging | `c.var.logger` carries both IDs. One `request.completed` record per request (method, path, status, durationMs), redacted by `@awsmbiz/inbis-core`. 5xx errors are logged as `request.failed`. |
+| Error envelope | Every error is `{ error: { code, message, requestId, details? } }`. `AppError` renders its status, code, message and details. Hono 4xx `HTTPException`s are mapped (malformed JSON is `400 BAD_REQUEST`). Unknown routes give `404 NOT_FOUND`. Anything else gives `500 INTERNAL_ERROR` without leaking the message. |
+| Validation | Routes registered with `.openapi()` on `createRouter()` reject invalid input with `422 VALIDATION_FAILED` and `details: { target, issues: [{ path, code, message }] }`. Submitted values are never echoed. |
+| CORS | Only `trustedOrigins` get `Access-Control-Allow-Origin`, with credentials. `x-request-id` and `x-correlation-id` are exposed. |
+| Trusted origins | `POST`/`PUT`/`PATCH`/`DELETE` with an `Origin` that is neither the API's own nor trusted give `403 FORBIDDEN_ORIGIN` (CSRF defence). Requests without `Origin` (non-browser clients) pass. |
+| Health | `GET /health` gives `{ status: "ok" }`. `GET /health/ready` runs the `readiness` checks: `200 { status: "ok", checks }` or `503 { status: "unavailable", checks }`. Check errors are logged, not returned. |
+| Versioning | The `v1` router is mounted under `/v1`. |
+| OpenAPI | `GET /openapi.json` serves an OpenAPI 3.1 document of all `.openapi()` routes, including the `ErrorEnvelope` schema, `422` for routes that validate input, and a `default` error response. |
+
+The returned app keeps the `v1` router's route types, so `hc<typeof app>()` (Hono RPC) works.
+
+Layering convention: route, then validation, then service, then repository, then database.
+No business logic in route handlers.
+
+Exports: `createApi`, `createRouter`, `ErrorEnvelopeSchema`, and the types `ApiEnv`,
+`ApiVariables`, `CreateApiOptions`, `ErrorEnvelope`, `ReadinessCheck`, `TrustedOrigins`
+and `ValidationIssue`.

package/dist/index.d.ts

@@ -0,0 +1,74 @@
+import { Logger } from "@awsmbiz/inbis-core";
+import { OpenAPIHono, z } from "@hono/zod-openapi";
+import { Context, Hono, Schema } from "hono";
+import { MergeSchemaPath } from "hono/types";
+import "hono/utils/http-status";
+/** Per-request values `createApi` puts on the Hono context (`c.var`). */
+interface ApiVariables {
+  /** Fresh UUIDv7 for this request; echoed as `x-request-id`. */
+  requestId: string;
+  /** Caller-supplied `x-correlation-id` when well-formed, else the request ID. */
+  correlationId: string;
+  /** Logger carrying `requestId` and `correlationId`. */
+  logger: Logger;
+}
+/** Hono environment for apps built with `createApi`; `B` is the Worker `env` type. */
+interface ApiEnv<B extends object = object> {
+  Bindings: B;
+  Variables: ApiVariables;
+}
+/** A readiness check: resolve when the dependency is usable, throw when it is not. */
+type ReadinessCheck<B extends object = object> = (c: Context<ApiEnv<B>>) => unknown;
+type TrustedOrigins<B extends object> = readonly string[] | ((env: B) => readonly string[]);
+interface CreateApiOptions<B extends object = object, S extends Schema = Schema> {
+  /** OpenAPI `info` for `/openapi.json`. */
+  info: {
+    title: string;
+    version: string;
+    description?: string;
+  };
+  /**
+   * Browser origins allowed to call the API with credentials. Either a fixed
+   * list or a function of the Worker `env` (e.g. read from a variable).
+   */
+  trustedOrigins?: TrustedOrigins<B>;
+  /** Version 1 routes, mounted under `/v1`. Build with `createRouter()`. */
+  v1?: Hono<ApiEnv<B>, S>;
+  /**
+   * Named dependency checks for `/health/ready` (e.g. `{ database: (c) => ... }`).
+   * Each passes by returning and fails by throwing; errors are logged, not returned.
+   */
+  readiness?: Record<string, ReadinessCheck<B>>;
+  /** Base logger. Defaults to a console JSON logger (Workers Logs). */
+  logger?: Logger;
+}
+/**
+ * Creates the Hono app for an Inbis Worker. Export it as the Worker's default
+ * export (`export default app`).
+ */
+export declare function createApi<B extends object = object, S extends Schema = Schema>(options: CreateApiOptions<B, S>): OpenAPIHono<ApiEnv<B>, MergeSchemaPath<S, "/v1">>;
+/** The body of every error response: `{ error: { code, message, requestId, details? } }`. */
+export declare const ErrorEnvelopeSchema: z.ZodObject<{
+  error: z.ZodObject<{
+    code: z.ZodString;
+    message: z.ZodString;
+    requestId: z.ZodString;
+    details: z.ZodOptional<z.ZodUnknown>;
+  }, z.core.$strip>;
+}, z.core.$strip>;
+type ErrorEnvelope = z.infer<typeof ErrorEnvelopeSchema>;
+/**
+ * Creates a router for a versioned API section (e.g. `/v1`). Register routes
+ * with `.openapi(createRoute(...), handler)` so they are validated (invalid
+ * input becomes a 422 `VALIDATION_FAILED` envelope) and documented, then pass
+ * it to `createApi({ v1 })`.
+ */
+export declare function createRouter<B extends object = object>(): OpenAPIHono<ApiEnv<B>>;
+/** One failed check, safe to return to the caller (never includes the submitted value). */
+interface ValidationIssue {
+  path: (string | number)[];
+  code: string;
+  message: string;
+}
+export type { ApiEnv, ApiVariables, CreateApiOptions, ErrorEnvelope, ReadinessCheck, TrustedOrigins, ValidationIssue };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,320 @@
+import { REDACTED, createId, createLogger, isAppError, isSensitiveKey, validationFailed } from "@awsmbiz/inbis-core";
+import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
+import { HTTPException } from "hono/http-exception";
+import { cors } from "hono/cors";
+// src/errors.ts
+/** The body of every error response: `{ error: { code, message, requestId, details? } }`. */
+const ErrorEnvelopeSchema = z.object({ error: z.object({
+	code: z.string().openapi({ example: "NOT_FOUND" }),
+	message: z.string(),
+	requestId: z.string(),
+	details: z.unknown().optional()
+}) }).openapi("ErrorEnvelope");
+const HTTP_CODES = {
+	400: "BAD_REQUEST",
+	401: "UNAUTHORIZED",
+	403: "FORBIDDEN",
+	404: "NOT_FOUND",
+	405: "METHOD_NOT_ALLOWED",
+	409: "CONFLICT",
+	413: "PAYLOAD_TOO_LARGE",
+	415: "UNSUPPORTED_MEDIA_TYPE",
+	422: "VALIDATION_FAILED",
+	429: "RATE_LIMITED"
+};
+/** Renders the standard error envelope with the current request ID. */
+function renderError(c, error) {
+	const body = { error: {
+		code: error.code,
+		message: error.message,
+		requestId: c.var.requestId,
+		...error.details === void 0 ? {} : { details: error.details }
+	} };
+	return c.json(body, error.status);
+}
+function classify(error) {
+	if (isAppError(error)) return {
+		status: error.status,
+		code: error.code,
+		message: error.message,
+		details: error.details
+	};
+	if (error instanceof HTTPException && error.status < 500) return {
+		status: error.status,
+		code: HTTP_CODES[error.status] ?? "BAD_REQUEST",
+		message: error.message || "The request could not be processed."
+	};
+	return {
+		status: 500,
+		code: "INTERNAL_ERROR",
+		message: "An unexpected error occurred."
+	};
+}
+/** `app.onError` handler: renders every thrown error as the envelope. */
+function onError(error, c) {
+	const rendered = classify(error);
+	if (rendered.status >= 500) c.var.logger.error("request.failed", { error });
+	else c.var.logger.info("request.rejected", {
+		errorCode: rendered.code,
+		status: rendered.status
+	});
+	return renderError(c, rendered);
+}
+/** `app.notFound` handler. */
+function onNotFound(c) {
+	return renderError(c, {
+		status: 404,
+		code: "NOT_FOUND",
+		message: "The requested resource was not found."
+	});
+}
+// src/health.ts
+const LivenessSchema = z.object({ status: z.literal("ok") }).openapi("Liveness");
+const ReadinessSchema = z.object({
+	status: z.enum(["ok", "unavailable"]),
+	checks: z.record(z.string(), z.enum(["ok", "failed"]))
+}).openapi("Readiness");
+const liveness = createRoute({
+	method: "get",
+	path: "/health",
+	tags: ["health"],
+	summary: "Liveness: the Worker is running",
+	responses: { 200: {
+		description: "Alive",
+		content: { "application/json": { schema: LivenessSchema } }
+	} }
+});
+const readiness = createRoute({
+	method: "get",
+	path: "/health/ready",
+	tags: ["health"],
+	summary: "Readiness: every dependency check passes",
+	responses: {
+		200: {
+			description: "Ready",
+			content: { "application/json": { schema: ReadinessSchema } }
+		},
+		503: {
+			description: "Not ready",
+			content: { "application/json": { schema: ReadinessSchema } }
+		}
+	}
+});
+/** Registers `/health` and `/health/ready`. Check failures are logged, never returned. */
+function registerHealth(app, checks) {
+	app.openapi(liveness, (c) => c.json({ status: "ok" }, 200));
+	app.openapi(readiness, async (c) => {
+		const entries = await Promise.all(Object.entries(checks).map(async ([name, check]) => {
+			try {
+				await check(c);
+				return [name, "ok"];
+			} catch (error) {
+				c.var.logger.error("readiness.check_failed", {
+					check: name,
+					error
+				});
+				return [name, "failed"];
+			}
+		}));
+		const results = Object.fromEntries(entries);
+		return entries.every(([, result]) => result === "ok") ? c.json({
+			status: "ok",
+			checks: results
+		}, 200) : c.json({
+			status: "unavailable",
+			checks: results
+		}, 503);
+	});
+}
+// src/openapi.ts
+const METHODS = [
+	"get",
+	"put",
+	"post",
+	"delete",
+	"options",
+	"head",
+	"patch",
+	"trace"
+];
+const ERROR_CONTENT = { "application/json": { schema: { $ref: "#/components/schemas/ErrorEnvelope" } } };
+/** Adds the error envelope responses every route can return: `422` when it validates input, and `default`. */
+function withErrorResponses(doc) {
+	for (const item of Object.values(doc.paths ?? {})) for (const method of METHODS) {
+		const operation = item[method];
+		if (operation === void 0) continue;
+		const responses = operation.responses ??= {};
+		if (operation.requestBody !== void 0 || (operation.parameters?.length ?? 0) > 0) responses["422"] ??= {
+			description: "The request is invalid.",
+			content: ERROR_CONTENT
+		};
+		responses["default"] ??= {
+			description: "Error",
+			content: ERROR_CONTENT
+		};
+	}
+	return doc;
+}
+/** Serves the generated OpenAPI 3.1 document at `/openapi.json`. */
+function registerOpenApi(app, info) {
+	app.openAPIRegistry.register("ErrorEnvelope", ErrorEnvelopeSchema);
+	let cached;
+	app.get("/openapi.json", (c) => {
+		cached ??= withErrorResponses(app.getOpenAPI31Document({
+			openapi: "3.1.0",
+			info
+		}));
+		return c.json(cached);
+	});
+}
+// src/origins.ts
+const SAFE_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]);
+function normalise(origin) {
+	try {
+		return new URL(origin).origin;
+	} catch {
+		return;
+	}
+}
+function trustedSet(option, c) {
+	const list = typeof option === "function" ? option(c.env) : option ?? [];
+	return new Set(list.map(normalise).filter((o) => o !== void 0));
+}
+/**
+* CORS for trusted origins only, with credentials. Untrusted origins get no
+* `Access-Control-Allow-Origin`, so browsers cannot read the response.
+*/
+function corsForTrustedOrigins(option) {
+	return cors({
+		origin: (origin, c) => trustedSet(option, c).has(origin) ? origin : null,
+		credentials: true,
+		allowMethods: [
+			"GET",
+			"HEAD",
+			"POST",
+			"PUT",
+			"PATCH",
+			"DELETE",
+			"OPTIONS"
+		],
+		allowHeaders: [
+			"Content-Type",
+			"Authorization",
+			"X-Correlation-Id",
+			"X-Captcha-Response"
+		],
+		exposeHeaders: ["X-Request-Id", "X-Correlation-Id"],
+		maxAge: 600
+	});
+}
+/**
+* Rejects state-changing requests whose `Origin` is neither this API's own
+* origin nor trusted, with 403 `FORBIDDEN_ORIGIN` (CSRF defence). Requests
+* without an `Origin` header (non-browser clients) pass.
+*/
+function rejectUntrustedOrigins(option) {
+	return async (c, next) => {
+		const origin = c.req.header("origin");
+		if (SAFE_METHODS.has(c.req.method) || origin === void 0) return next();
+		if (!(origin === new URL(c.req.url).origin || trustedSet(option, c).has(origin))) {
+			c.var.logger.warn("request.untrusted_origin", {
+				origin,
+				method: c.req.method,
+				path: c.req.path
+			});
+			return renderError(c, {
+				status: 403,
+				code: "FORBIDDEN_ORIGIN",
+				message: "Requests from this origin are not allowed."
+			});
+		}
+		return next();
+	};
+}
+// src/request-context.ts
+const CORRELATION_ID = /^[A-Za-z0-9._:-]{1,128}$/;
+/**
+* The path as logged: a segment that follows a credential-named segment
+* (e.g. the token in `/reset-password/<token>`) is replaced with `[REDACTED]`.
+*/
+function redactPath(path) {
+	const segments = path.split("/");
+	return segments.map((segment, i) => i > 0 && isSensitiveKey(segments[i - 1] ?? "") ? REDACTED : segment).join("/");
+}
+/**
+* Assigns request/correlation IDs, a per-request logger, and logs one
+* `request.completed` record per request.
+*/
+function requestContext(baseLogger) {
+	return async (c, next) => {
+		const started = Date.now();
+		const requestId = createId();
+		const incoming = c.req.header("x-correlation-id");
+		const correlationId = incoming !== void 0 && CORRELATION_ID.test(incoming) ? incoming : requestId;
+		const logger = baseLogger.child({
+			requestId,
+			correlationId
+		});
+		c.set("requestId", requestId);
+		c.set("correlationId", correlationId);
+		c.set("logger", logger);
+		await next();
+		c.res.headers.set("x-request-id", requestId);
+		c.res.headers.set("x-correlation-id", correlationId);
+		logger.info("request.completed", {
+			method: c.req.method,
+			path: redactPath(c.req.path),
+			status: c.res.status,
+			durationMs: Date.now() - started
+		});
+	};
+}
+// src/validation.ts
+/**
+* Default hook for every OpenAPI route: turns a failed Zod validation into a
+* 422 `VALIDATION_FAILED` error rendered as the standard envelope, with
+* `details: { target, issues }`.
+*/
+function validationHook(result) {
+	if (result.success) return void 0;
+	const issues = result.error.issues.map((issue) => ({
+		path: issue.path.map((key) => typeof key === "number" ? key : String(key)),
+		code: issue.code,
+		message: issue.message
+	}));
+	throw validationFailed(issues, { target: result.target });
+}
+// src/router.ts
+/**
+* Creates a router for a versioned API section (e.g. `/v1`). Register routes
+* with `.openapi(createRoute(...), handler)` so they are validated (invalid
+* input becomes a 422 `VALIDATION_FAILED` envelope) and documented, then pass
+* it to `createApi({ v1 })`.
+*/
+function createRouter() {
+	return new OpenAPIHono({ defaultHook: validationHook });
+}
+// src/create-api.ts
+/**
+* Creates the Hono app for an Inbis Worker. Export it as the Worker's default
+* export (`export default app`).
+*/
+function createApi(options) {
+	const app = createRouter();
+	app.use(requestContext(options.logger ?? createLogger()));
+	app.onError(onError);
+	app.notFound(onNotFound);
+	app.use(rejectUntrustedOrigins(options.trustedOrigins));
+	app.use(corsForTrustedOrigins(options.trustedOrigins));
+	registerHealth(app, options.readiness ?? {});
+	registerOpenApi(app, options.info);
+	if (options.v1 !== void 0) app.route("/v1", options.v1);
+	return app;
+}
+export { ErrorEnvelopeSchema, createApi, createRouter };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/errors.ts","../src/health.ts","../src/openapi.ts","../src/origins.ts","../src/request-context.ts","../src/validation.ts","../src/router.ts","../src/create-api.ts"],"sourcesContent":["import { z } from \"@hono/zod-openapi\";\nimport { isAppError } from \"@awsmbiz/inbis-core\";\nimport type { Context } from \"hono\";\nimport { HTTPException } from \"hono/http-exception\";\nimport type { ContentfulStatusCode } from \"hono/utils/http-status\";\nimport type { ApiEnv } from \"./types.js\";\n\n/** The body of every error response: `{ error: { code, message, requestId, details? } }`. */\nexport const ErrorEnvelopeSchema = z\n  .object({\n    error: z.object({\n      code: z.string().openapi({ example: \"NOT_FOUND\" }),\n      message: z.string(),\n      requestId: z.string(),\n      details: z.unknown().optional(),\n    }),\n  })\n  .openapi(\"ErrorEnvelope\");\n\nexport type ErrorEnvelope = z.infer<typeof ErrorEnvelopeSchema>;\n\nconst HTTP_CODES: Partial<Record<number, string>> = {\n  400: \"BAD_REQUEST\",\n  401: \"UNAUTHORIZED\",\n  403: \"FORBIDDEN\",\n  404: \"NOT_FOUND\",\n  405: \"METHOD_NOT_ALLOWED\",\n  409: \"CONFLICT\",\n  413: \"PAYLOAD_TOO_LARGE\",\n  415: \"UNSUPPORTED_MEDIA_TYPE\",\n  422: \"VALIDATION_FAILED\",\n  429: \"RATE_LIMITED\",\n};\n\ninterface Rendered {\n  status: ContentfulStatusCode;\n  code: string;\n  message: string;\n  details?: unknown;\n}\n\n/** Renders the standard error envelope with the current request ID. */\nexport function renderError<B extends object>(c: Context<ApiEnv<B>>, error: Rendered): Response {\n  const body: ErrorEnvelope = {\n    error: {\n      code: error.code,\n      message: error.message,\n      requestId: c.var.requestId,\n      ...(error.details === undefined ? {} : { details: error.details }),\n    },\n  };\n  return c.json(body, error.status);\n}\n\nfunction classify(error: unknown): Rendered {\n  if (isAppError(error)) {\n    return {\n      status: error.status as ContentfulStatusCode,\n      code: error.code,\n      message: error.message,\n      details: error.details,\n    };\n  }\n  if (error instanceof HTTPException && error.status < 500) {\n    return {\n      status: error.status,\n      code: HTTP_CODES[error.status] ?? \"BAD_REQUEST\",\n      message: error.message || \"The request could not be processed.\",\n    };\n  }\n  return { status: 500, code: \"INTERNAL_ERROR\", message: \"An unexpected error occurred.\" };\n}\n\n/** `app.onError` handler: renders every thrown error as the envelope. */\nexport function onError<B extends object>(error: Error, c: Context<ApiEnv<B>>): Response {\n  const rendered = classify(error);\n  if (rendered.status >= 500) {\n    c.var.logger.error(\"request.failed\", { error });\n  } else {\n    c.var.logger.info(\"request.rejected\", { errorCode: rendered.code, status: rendered.status });\n  }\n  return renderError(c, rendered);\n}\n\n/** `app.notFound` handler. */\nexport function onNotFound<B extends object>(c: Context<ApiEnv<B>>): Response {\n  return renderError(c, {\n    status: 404,\n    code: \"NOT_FOUND\",\n    message: \"The requested resource was not found.\",\n  });\n}\n","import { createRoute, z, type OpenAPIHono } from \"@hono/zod-openapi\";\nimport type { Context } from \"hono\";\nimport type { ApiEnv } from \"./types.js\";\n\n/** A readiness check: resolve when the dependency is usable, throw when it is not. */\nexport type ReadinessCheck<B extends object = object> = (c: Context<ApiEnv<B>>) => unknown;\n\nconst LivenessSchema = z.object({ status: z.literal(\"ok\") }).openapi(\"Liveness\");\n\nconst ReadinessSchema = z\n  .object({\n    status: z.enum([\"ok\", \"unavailable\"]),\n    checks: z.record(z.string(), z.enum([\"ok\", \"failed\"])),\n  })\n  .openapi(\"Readiness\");\n\nconst liveness = createRoute({\n  method: \"get\",\n  path: \"/health\",\n  tags: [\"health\"],\n  summary: \"Liveness: the Worker is running\",\n  responses: {\n    200: { description: \"Alive\", content: { \"application/json\": { schema: LivenessSchema } } },\n  },\n});\n\nconst readiness = createRoute({\n  method: \"get\",\n  path: \"/health/ready\",\n  tags: [\"health\"],\n  summary: \"Readiness: every dependency check passes\",\n  responses: {\n    200: { description: \"Ready\", content: { \"application/json\": { schema: ReadinessSchema } } },\n    503: { description: \"Not ready\", content: { \"application/json\": { schema: ReadinessSchema } } },\n  },\n});\n\n/** Registers `/health` and `/health/ready`. Check failures are logged, never returned. */\nexport function registerHealth<B extends object>(\n  app: OpenAPIHono<ApiEnv<B>>,\n  checks: Record<string, ReadinessCheck<B>>,\n): void {\n  app.openapi(liveness, (c) => c.json({ status: \"ok\" as const }, 200));\n\n  app.openapi(readiness, async (c) => {\n    const entries = await Promise.all(\n      Object.entries(checks).map(async ([name, check]) => {\n        try {\n          await check(c);\n          return [name, \"ok\"] as const;\n        } catch (error) {\n          c.var.logger.error(\"readiness.check_failed\", { check: name, error });\n          return [name, \"failed\"] as const;\n        }\n      }),\n    );\n    const results = Object.fromEntries(entries);\n    const ready = entries.every(([, result]) => result === \"ok\");\n    return ready\n      ? c.json({ status: \"ok\" as const, checks: results }, 200)\n      : c.json({ status: \"unavailable\" as const, checks: results }, 503);\n  });\n}\n","import type { OpenAPIHono } from \"@hono/zod-openapi\";\nimport { ErrorEnvelopeSchema } from \"./errors.js\";\nimport type { ApiEnv } from \"./types.js\";\n\ntype Document = ReturnType<OpenAPIHono[\"getOpenAPI31Document\"]>;\ninterface Operation { requestBody?: unknown; parameters?: unknown[]; responses?: Record<string, unknown> }\n\nconst METHODS = [\"get\", \"put\", \"post\", \"delete\", \"options\", \"head\", \"patch\", \"trace\"] as const;\nconst ERROR_CONTENT = {\n  \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorEnvelope\" } },\n};\n\n/** Adds the error envelope responses every route can return: `422` when it validates input, and `default`. */\nfunction withErrorResponses(doc: Document): Document {\n  for (const item of Object.values(doc.paths ?? {})) {\n    for (const method of METHODS) {\n      const operation = (item as Partial<Record<string, Operation>>)[method];\n      if (operation === undefined) continue;\n      const responses = (operation.responses ??= {});\n      const validates = operation.requestBody !== undefined || (operation.parameters?.length ?? 0) > 0;\n      if (validates) {\n        responses[\"422\"] ??= { description: \"The request is invalid.\", content: ERROR_CONTENT };\n      }\n      responses[\"default\"] ??= { description: \"Error\", content: ERROR_CONTENT };\n    }\n  }\n  return doc;\n}\n\n/** Serves the generated OpenAPI 3.1 document at `/openapi.json`. */\nexport function registerOpenApi<B extends object>(\n  app: OpenAPIHono<ApiEnv<B>>,\n  info: { title: string; version: string; description?: string },\n): void {\n  app.openAPIRegistry.register(\"ErrorEnvelope\", ErrorEnvelopeSchema);\n  let cached: Document | undefined;\n  app.get(\"/openapi.json\", (c) => {\n    cached ??= withErrorResponses(app.getOpenAPI31Document({ openapi: \"3.1.0\", info }));\n    return c.json(cached);\n  });\n}\n","import type { Context, MiddlewareHandler } from \"hono\";\nimport { cors } from \"hono/cors\";\nimport { renderError } from \"./errors.js\";\nimport type { ApiEnv } from \"./types.js\";\n\nexport type TrustedOrigins<B extends object> = readonly string[] | ((env: B) => readonly string[]);\n\nconst SAFE_METHODS = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\nfunction normalise(origin: string): string | undefined {\n  try {\n    return new URL(origin).origin;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction trustedSet<B extends object>(option: TrustedOrigins<B> | undefined, c: Context<ApiEnv<B>>) {\n  const list = typeof option === \"function\" ? option(c.env) : (option ?? []);\n  return new Set(list.map(normalise).filter((o): o is string => o !== undefined));\n}\n\n/**\n * CORS for trusted origins only, with credentials. Untrusted origins get no\n * `Access-Control-Allow-Origin`, so browsers cannot read the response.\n */\nexport function corsForTrustedOrigins<B extends object>(\n  option: TrustedOrigins<B> | undefined,\n): MiddlewareHandler<ApiEnv<B>> {\n  return cors({\n    origin: (origin, c) => (trustedSet(option, c as Context<ApiEnv<B>>).has(origin) ? origin : null),\n    credentials: true,\n    allowMethods: [\"GET\", \"HEAD\", \"POST\", \"PUT\", \"PATCH\", \"DELETE\", \"OPTIONS\"],\n    allowHeaders: [\"Content-Type\", \"Authorization\", \"X-Correlation-Id\", \"X-Captcha-Response\"],\n    exposeHeaders: [\"X-Request-Id\", \"X-Correlation-Id\"],\n    maxAge: 600,\n  });\n}\n\n/**\n * Rejects state-changing requests whose `Origin` is neither this API's own\n * origin nor trusted, with 403 `FORBIDDEN_ORIGIN` (CSRF defence). Requests\n * without an `Origin` header (non-browser clients) pass.\n */\nexport function rejectUntrustedOrigins<B extends object>(\n  option: TrustedOrigins<B> | undefined,\n): MiddlewareHandler<ApiEnv<B>> {\n  return async (c, next) => {\n    const origin = c.req.header(\"origin\");\n    if (SAFE_METHODS.has(c.req.method) || origin === undefined) return next();\n\n    const allowed = origin === new URL(c.req.url).origin || trustedSet(option, c).has(origin);\n    if (!allowed) {\n      c.var.logger.warn(\"request.untrusted_origin\", { origin, method: c.req.method, path: c.req.path });\n      return renderError(c, {\n        status: 403,\n        code: \"FORBIDDEN_ORIGIN\",\n        message: \"Requests from this origin are not allowed.\",\n      });\n    }\n    return next();\n  };\n}\n","import { createId, isSensitiveKey, REDACTED, type Logger } from \"@awsmbiz/inbis-core\";\nimport type { MiddlewareHandler } from \"hono\";\nimport type { ApiEnv } from \"./types.js\";\n\nconst CORRELATION_ID = /^[A-Za-z0-9._:-]{1,128}$/;\n\n/**\n * The path as logged: a segment that follows a credential-named segment\n * (e.g. the token in `/reset-password/<token>`) is replaced with `[REDACTED]`.\n */\nexport function redactPath(path: string): string {\n  const segments = path.split(\"/\");\n  return segments.map((segment, i) => (i > 0 && isSensitiveKey(segments[i - 1] ?? \"\") ? REDACTED : segment)).join(\"/\");\n}\n\n/**\n * Assigns request/correlation IDs, a per-request logger, and logs one\n * `request.completed` record per request.\n */\nexport function requestContext<B extends object>(baseLogger: Logger): MiddlewareHandler<ApiEnv<B>> {\n  return async (c, next) => {\n    const started = Date.now();\n    const requestId = createId();\n    const incoming = c.req.header(\"x-correlation-id\");\n    const correlationId = incoming !== undefined && CORRELATION_ID.test(incoming) ? incoming : requestId;\n    const logger = baseLogger.child({ requestId, correlationId });\n\n    c.set(\"requestId\", requestId);\n    c.set(\"correlationId\", correlationId);\n    c.set(\"logger\", logger);\n\n    await next();\n\n    c.res.headers.set(\"x-request-id\", requestId);\n    c.res.headers.set(\"x-correlation-id\", correlationId);\n    logger.info(\"request.completed\", {\n      method: c.req.method,\n      path: redactPath(c.req.path),\n      status: c.res.status,\n      durationMs: Date.now() - started,\n    });\n  };\n}\n","import type { z } from \"@hono/zod-openapi\";\nimport { validationFailed } from \"@awsmbiz/inbis-core\";\nimport type { ValidationTargets } from \"hono\";\n\n/** One failed check, safe to return to the caller (never includes the submitted value). */\nexport interface ValidationIssue {\n  path: (string | number)[];\n  code: string;\n  message: string;\n}\n\n/**\n * Default hook for every OpenAPI route: turns a failed Zod validation into a\n * 422 `VALIDATION_FAILED` error rendered as the standard envelope, with\n * `details: { target, issues }`.\n */\nexport function validationHook(\n  result: { target: keyof ValidationTargets } & ({ success: true } | { success: false; error: z.ZodError }),\n): undefined {\n  if (result.success) return undefined;\n  const issues: ValidationIssue[] = result.error.issues.map((issue) => ({\n    path: issue.path.map((key) => (typeof key === \"number\" ? key : String(key))),\n    code: issue.code,\n    message: issue.message,\n  }));\n  throw validationFailed(issues, { target: result.target });\n}\n","import { OpenAPIHono } from \"@hono/zod-openapi\";\nimport type { ApiEnv } from \"./types.js\";\nimport { validationHook } from \"./validation.js\";\n\n/**\n * Creates a router for a versioned API section (e.g. `/v1`). Register routes\n * with `.openapi(createRoute(...), handler)` so they are validated (invalid\n * input becomes a 422 `VALIDATION_FAILED` envelope) and documented, then pass\n * it to `createApi({ v1 })`.\n */\nexport function createRouter<B extends object = object>(): OpenAPIHono<ApiEnv<B>> {\n  return new OpenAPIHono<ApiEnv<B>>({ defaultHook: validationHook });\n}\n","import type { OpenAPIHono } from \"@hono/zod-openapi\";\nimport { createLogger, type Logger } from \"@awsmbiz/inbis-core\";\nimport type { Hono, Schema } from \"hono\";\nimport type { MergeSchemaPath } from \"hono/types\";\nimport { onError, onNotFound } from \"./errors.js\";\nimport { registerHealth, type ReadinessCheck } from \"./health.js\";\nimport { registerOpenApi } from \"./openapi.js\";\nimport { corsForTrustedOrigins, rejectUntrustedOrigins, type TrustedOrigins } from \"./origins.js\";\nimport { requestContext } from \"./request-context.js\";\nimport { createRouter } from \"./router.js\";\nimport type { ApiEnv } from \"./types.js\";\n\nexport interface CreateApiOptions<B extends object = object, S extends Schema = Schema> {\n  /** OpenAPI `info` for `/openapi.json`. */\n  info: { title: string; version: string; description?: string };\n  /**\n   * Browser origins allowed to call the API with credentials. Either a fixed\n   * list or a function of the Worker `env` (e.g. read from a variable).\n   */\n  trustedOrigins?: TrustedOrigins<B>;\n  /** Version 1 routes, mounted under `/v1`. Build with `createRouter()`. */\n  v1?: Hono<ApiEnv<B>, S>;\n  /**\n   * Named dependency checks for `/health/ready` (e.g. `{ database: (c) => ... }`).\n   * Each passes by returning and fails by throwing; errors are logged, not returned.\n   */\n  readiness?: Record<string, ReadinessCheck<B>>;\n  /** Base logger. Defaults to a console JSON logger (Workers Logs). */\n  logger?: Logger;\n}\n\n/**\n * Creates the Hono app for an Inbis Worker. Export it as the Worker's default\n * export (`export default app`).\n */\nexport function createApi<B extends object = object, S extends Schema = Schema>(\n  options: CreateApiOptions<B, S>,\n): OpenAPIHono<ApiEnv<B>, MergeSchemaPath<S, \"/v1\">> {\n  const app = createRouter<B>();\n  app.use(requestContext(options.logger ?? createLogger()));\n  app.onError(onError);\n  app.notFound(onNotFound);\n  app.use(rejectUntrustedOrigins(options.trustedOrigins));\n  app.use(corsForTrustedOrigins(options.trustedOrigins));\n\n  registerHealth(app, options.readiness ?? {});\n  registerOpenApi(app, options.info);\n\n  if (options.v1 !== undefined) app.route(\"/v1\", options.v1);\n  return app;\n}\n"],"mappings":";;;;;;AAQA,MAAa,sBAAsB,EAChC,OAAO,EACN,OAAO,EAAE,OAAO;CACd,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,YAAY,CAAC;CACjD,SAAS,EAAE,OAAO;CAClB,WAAW,EAAE,OAAO;CACpB,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS;AAChC,CAAC,EACH,CAAC,CAAC,CACD,QAAQ,eAAe;AAI1B,MAAM,aAA8C;CAClD,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;AACP;;AAUA,SAAgB,YAA8B,GAAuB,OAA2B;CAC9F,MAAM,OAAsB,EAC1B,OAAO;EACL,MAAM,MAAM;EACZ,SAAS,MAAM;EACf,WAAW,EAAE,IAAI;EACjB,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;CAClE,EACF;CACA,OAAO,EAAE,KAAK,MAAM,MAAM,MAAM;AAClC;AAEA,SAAS,SAAS,OAA0B;CAC1C,IAAI,WAAW,KAAK,GAClB,OAAO;EACL,QAAQ,MAAM;EACd,MAAM,MAAM;EACZ,SAAS,MAAM;EACf,SAAS,MAAM;CACjB;CAEF,IAAI,iBAAiB,iBAAiB,MAAM,SAAS,KACnD,OAAO;EACL,QAAQ,MAAM;EACd,MAAM,WAAW,MAAM,WAAW;EAClC,SAAS,MAAM,WAAW;CAC5B;CAEF,OAAO;EAAE,QAAQ;EAAK,MAAM;EAAkB,SAAS;CAAgC;AACzF;;AAGA,SAAgB,QAA0B,OAAc,GAAiC;CACvF,MAAM,WAAW,SAAS,KAAK;CAC/B,IAAI,SAAS,UAAU,KACrB,EAAE,IAAI,OAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC;MAE9C,EAAE,IAAI,OAAO,KAAK,oBAAoB;EAAE,WAAW,SAAS;EAAM,QAAQ,SAAS;CAAO,CAAC;CAE7F,OAAO,YAAY,GAAG,QAAQ;AAChC;;AAGA,SAAgB,WAA6B,GAAiC;CAC5E,OAAO,YAAY,GAAG;EACpB,QAAQ;EACR,MAAM;EACN,SAAS;CACX,CAAC;AACH;;ACpFA,MAAM,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,UAAU;AAE/E,MAAM,kBAAkB,EACrB,OAAO;CACN,QAAQ,EAAE,KAAK,CAAC,MAAM,aAAa,CAAC;CACpC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC;AACvD,CAAC,CAAC,CACD,QAAQ,WAAW;AAEtB,MAAM,WAAW,YAAY;CAC3B,QAAQ;CACR,MAAM;CACN,MAAM,CAAC,QAAQ;CACf,SAAS;CACT,WAAW,EACT,KAAK;EAAE,aAAa;EAAS,SAAS,EAAE,oBAAoB,EAAE,QAAQ,eAAe,EAAE;CAAE,EAC3F;AACF,CAAC;AAED,MAAM,YAAY,YAAY;CAC5B,QAAQ;CACR,MAAM;CACN,MAAM,CAAC,QAAQ;CACf,SAAS;CACT,WAAW;EACT,KAAK;GAAE,aAAa;GAAS,SAAS,EAAE,oBAAoB,EAAE,QAAQ,gBAAgB,EAAE;EAAE;EAC1F,KAAK;GAAE,aAAa;GAAa,SAAS,EAAE,oBAAoB,EAAE,QAAQ,gBAAgB,EAAE;EAAE;CAChG;AACF,CAAC;;AAGD,SAAgB,eACd,KACA,QACM;CACN,IAAI,QAAQ,WAAW,MAAM,EAAE,KAAK,EAAE,QAAQ,KAAc,GAAG,GAAG,CAAC;CAEnE,IAAI,QAAQ,WAAW,OAAO,MAAM;EAClC,MAAM,UAAU,MAAM,QAAQ,IAC5B,OAAO,QAAQ,MAAM,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,WAAW;GAClD,IAAI;IACF,MAAM,MAAM,CAAC;IACb,OAAO,CAAC,MAAM,IAAI;GACpB,SAAS,OAAO;IACd,EAAE,IAAI,OAAO,MAAM,0BAA0B;KAAE,OAAO;KAAM;IAAM,CAAC;IACnE,OAAO,CAAC,MAAM,QAAQ;GACxB;EACF,CAAC,CACH;EACA,MAAM,UAAU,OAAO,YAAY,OAAO;EAE1C,OADc,QAAQ,OAAO,GAAG,YAAY,WAAW,IAC5C,IACP,EAAE,KAAK;GAAE,QAAQ;GAAe,QAAQ;EAAQ,GAAG,GAAG,IACtD,EAAE,KAAK;GAAE,QAAQ;GAAwB,QAAQ;EAAQ,GAAG,GAAG;CACrE,CAAC;AACH;;ACvDA,MAAM,UAAU;CAAC;CAAO;CAAO;CAAQ;CAAU;CAAW;CAAQ;CAAS;AAAO;AACpF,MAAM,gBAAgB,EACpB,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAC/E;;AAGA,SAAS,mBAAmB,KAAyB;CACnD,KAAK,MAAM,QAAQ,OAAO,OAAO,IAAI,SAAS,CAAC,CAAC,GAC9C,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,YAAa,KAA4C;EAC/D,IAAI,cAAc,KAAA,GAAW;EAC7B,MAAM,YAAa,UAAU,cAAc,CAAC;EAE5C,IADkB,UAAU,gBAAgB,KAAA,MAAc,UAAU,YAAY,UAAU,KAAK,GAE7F,UAAU,WAAW;GAAE,aAAa;GAA2B,SAAS;EAAc;EAExF,UAAU,eAAe;GAAE,aAAa;GAAS,SAAS;EAAc;CAC1E;CAEF,OAAO;AACT;;AAGA,SAAgB,gBACd,KACA,MACM;CACN,IAAI,gBAAgB,SAAS,iBAAiB,mBAAmB;CACjE,IAAI;CACJ,IAAI,IAAI,kBAAkB,MAAM;EAC9B,WAAW,mBAAmB,IAAI,qBAAqB;GAAE,SAAS;GAAS;EAAK,CAAC,CAAC;EAClF,OAAO,EAAE,KAAK,MAAM;CACtB,CAAC;AACH;;ACjCA,MAAM,+BAAe,IAAI,IAAI;CAAC;CAAO;CAAQ;AAAS,CAAC;AAEvD,SAAS,UAAU,QAAoC;CACrD,IAAI;EACF,OAAO,IAAI,IAAI,MAAM,CAAC,CAAC;CACzB,QAAQ;EACN;CACF;AACF;AAEA,SAAS,WAA6B,QAAuC,GAAuB;CAClG,MAAM,OAAO,OAAO,WAAW,aAAa,OAAO,EAAE,GAAG,IAAK,UAAU,CAAC;CACxE,OAAO,IAAI,IAAI,KAAK,IAAI,SAAS,CAAC,CAAC,QAAQ,MAAmB,MAAM,KAAA,CAAS,CAAC;AAChF;;;;;AAMA,SAAgB,sBACd,QAC8B;CAC9B,OAAO,KAAK;EACV,SAAS,QAAQ,MAAO,WAAW,QAAQ,CAAuB,CAAC,CAAC,IAAI,MAAM,IAAI,SAAS;EAC3F,aAAa;EACb,cAAc;GAAC;GAAO;GAAQ;GAAQ;GAAO;GAAS;GAAU;EAAS;EACzE,cAAc;GAAC;GAAgB;GAAiB;GAAoB;EAAoB;EACxF,eAAe,CAAC,gBAAgB,kBAAkB;EAClD,QAAQ;CACV,CAAC;AACH;;;;;;AAOA,SAAgB,uBACd,QAC8B;CAC9B,OAAO,OAAO,GAAG,SAAS;EACxB,MAAM,SAAS,EAAE,IAAI,OAAO,QAAQ;EACpC,IAAI,aAAa,IAAI,EAAE,IAAI,MAAM,KAAK,WAAW,KAAA,GAAW,OAAO,KAAK;EAGxE,IAAI,EADY,WAAW,IAAI,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,WAAW,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,IAC1E;GACZ,EAAE,IAAI,OAAO,KAAK,4BAA4B;IAAE;IAAQ,QAAQ,EAAE,IAAI;IAAQ,MAAM,EAAE,IAAI;GAAK,CAAC;GAChG,OAAO,YAAY,GAAG;IACpB,QAAQ;IACR,MAAM;IACN,SAAS;GACX,CAAC;EACH;EACA,OAAO,KAAK;CACd;AACF;;AC1DA,MAAM,iBAAiB;;;;;AAMvB,SAAgB,WAAW,MAAsB;CAC/C,MAAM,WAAW,KAAK,MAAM,GAAG;CAC/B,OAAO,SAAS,KAAK,SAAS,MAAO,IAAI,KAAK,eAAe,SAAS,IAAI,MAAM,EAAE,IAAI,WAAW,OAAQ,CAAC,CAAC,KAAK,GAAG;AACrH;;;;;AAMA,SAAgB,eAAiC,YAAkD;CACjG,OAAO,OAAO,GAAG,SAAS;EACxB,MAAM,UAAU,KAAK,IAAI;EACzB,MAAM,YAAY,SAAS;EAC3B,MAAM,WAAW,EAAE,IAAI,OAAO,kBAAkB;EAChD,MAAM,gBAAgB,aAAa,KAAA,KAAa,eAAe,KAAK,QAAQ,IAAI,WAAW;EAC3F,MAAM,SAAS,WAAW,MAAM;GAAE;GAAW;EAAc,CAAC;EAE5D,EAAE,IAAI,aAAa,SAAS;EAC5B,EAAE,IAAI,iBAAiB,aAAa;EACpC,EAAE,IAAI,UAAU,MAAM;EAEtB,MAAM,KAAK;EAEX,EAAE,IAAI,QAAQ,IAAI,gBAAgB,SAAS;EAC3C,EAAE,IAAI,QAAQ,IAAI,oBAAoB,aAAa;EACnD,OAAO,KAAK,qBAAqB;GAC/B,QAAQ,EAAE,IAAI;GACd,MAAM,WAAW,EAAE,IAAI,IAAI;GAC3B,QAAQ,EAAE,IAAI;GACd,YAAY,KAAK,IAAI,IAAI;EAC3B,CAAC;CACH;AACF;;;;;;;AC1BA,SAAgB,eACd,QACW;CACX,IAAI,OAAO,SAAS,OAAO,KAAA;CAC3B,MAAM,SAA4B,OAAO,MAAM,OAAO,KAAK,WAAW;EACpE,MAAM,MAAM,KAAK,KAAK,QAAS,OAAO,QAAQ,WAAW,MAAM,OAAO,GAAG,CAAE;EAC3E,MAAM,MAAM;EACZ,SAAS,MAAM;CACjB,EAAE;CACF,MAAM,iBAAiB,QAAQ,EAAE,QAAQ,OAAO,OAAO,CAAC;AAC1D;;;;;;;;AChBA,SAAgB,eAAkE;CAChF,OAAO,IAAI,YAAuB,EAAE,aAAa,eAAe,CAAC;AACnE;;;;;;ACuBA,SAAgB,UACd,SACmD;CACnD,MAAM,MAAM,aAAgB;CAC5B,IAAI,IAAI,eAAe,QAAQ,UAAU,aAAa,CAAC,CAAC;CACxD,IAAI,QAAQ,OAAO;CACnB,IAAI,SAAS,UAAU;CACvB,IAAI,IAAI,uBAAuB,QAAQ,cAAc,CAAC;CACtD,IAAI,IAAI,sBAAsB,QAAQ,cAAc,CAAC;CAErD,eAAe,KAAK,QAAQ,aAAa,CAAC,CAAC;CAC3C,gBAAgB,KAAK,QAAQ,IAAI;CAEjC,IAAI,QAAQ,OAAO,KAAA,GAAW,IAAI,MAAM,OAAO,QAAQ,EAAE;CACzD,OAAO;AACT"}

package/package.json

@@ -1,6 +1,57 @@
 {
   "name": "@awsmbiz/inbis-api",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "OpenAPI-enabled Hono app factory for Inbis Workers: request IDs, logging, error envelope, validation, CORS, health and OpenAPI.",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/awsmbiz/inbis-platform.git",
+    "directory": "packages/api"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@awsmbiz/inbis-core": "0.2.0"
+  },
+  "peerDependencies": {
+    "@hono/zod-openapi": "^1.6.3",
+    "hono": "^4.13.14",
+    "zod": "^4.6.7"
+  },
+  "devDependencies": {
+    "@arethetypeswrong/cli": "0.18.5",
+    "@cloudflare/vitest-plugin": "1.4.11",
+    "@cloudflare/workers-types": "5.20261030.1",
+    "@hono/zod-openapi": "1.6.3",
+    "@awsmbiz/inbis-eslint-config": "0.2.0",
+    "@awsmbiz/inbis-tsconfig": "0.2.0",
+    "eslint": "10.14.0",
+    "hono": "4.13.14",
+    "publint": "0.3.25",
+    "tsdown": "0.23.4",
+    "typescript": "6.0.3",
+    "vitest": "5.0.5",
+    "zod": "4.6.7"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "tsc",
+    "lint": "eslint . --max-warnings 0",
+    "test": "vitest run",
+    "check:exports": "publint --strict && attw --pack . --profile esm-only"
+  }
 }