@bajustone/fortress 1.0.0-rc.1

package/dist/hono.cjs

@@ -0,0 +1,1530 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/hono/index.ts
+var hono_exports = {};
+__export(hono_exports, {
+  buildRouteDefinition: () => buildRouteDefinition,
+  convertRoutes: () => convertRoutes,
+  createCsrfMiddleware: () => createCsrfMiddleware,
+  createHonoMiddleware: () => createHonoMiddleware,
+  createPluginMiddleware: () => createPluginMiddleware,
+  createSecurityHeadersMiddleware: () => createSecurityHeadersMiddleware,
+  fetcherSchemaConverter: () => fetcherSchemaConverter,
+  getClaims: () => getClaims,
+  getDb: () => getDb,
+  getFortressRoutes: () => getFortressRoutes,
+  getScopedDb: () => getScopedDb,
+  getSubject: () => getSubject,
+  getUserId: () => getUserId,
+  identitySchemaConverter: () => identitySchemaConverter,
+  mountFortress: () => mountFortress,
+  mountFortressOpenAPI: () => mountFortressOpenAPI,
+  protectedRoute: () => protectedRoute,
+  toJSONSchemaConverter: () => toJSONSchemaConverter,
+  vBody: () => vBody,
+  vParam: () => vParam,
+  vQuery: () => vQuery
+});
+module.exports = __toCommonJS(hono_exports);
+
+// src/core/errors.ts
+var FortressError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  /** RFC 6749 §5.2 / §4.1.2.1 machine code. Set by `Errors.oauth()`. */
+  oauthError;
+  /** Human-readable description for the OAuth `error_description` field. */
+  oauthDescription;
+  /** Optional URI for the OAuth `error_uri` field (§5.2). */
+  oauthErrorUri;
+  constructor(code, message, statusCode, options) {
+    super(message, { cause: options?.cause });
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = options?.retryAfter;
+    this.details = options?.details;
+    this.oauthError = options?.oauthError;
+    this.oauthDescription = options?.oauthDescription;
+    this.oauthErrorUri = options?.oauthErrorUri;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      ...this.details !== void 0 && { details: this.details }
+    };
+  }
+};
+var Errors = {
+  unauthorized: (message = "Unauthorized") => new FortressError("UNAUTHORIZED", message, 401),
+  tokenReuse: () => new FortressError("TOKEN_REUSE", "Token reuse detected", 401),
+  sessionIdleTimeout: () => new FortressError("SESSION_IDLE_TIMEOUT", "Session idle timeout exceeded", 401),
+  sessionAbsoluteTimeout: () => new FortressError("SESSION_ABSOLUTE_TIMEOUT", "Session absolute timeout exceeded", 401),
+  forbidden: (message = "Forbidden") => new FortressError("FORBIDDEN", message, 403),
+  badRequest: (message = "Bad request") => new FortressError("BAD_REQUEST", message, 400),
+  notFound: (message = "Not found") => new FortressError("NOT_FOUND", message, 404),
+  conflict: (message = "Conflict", options) => new FortressError("CONFLICT", message, 409, options),
+  unprocessable: (message = "Unprocessable entity", options) => new FortressError("UNPROCESSABLE_ENTITY", message, 422, options),
+  rateLimited: (retryAfter) => new FortressError("RATE_LIMITED", "Too many requests", 429, { retryAfter }),
+  database: (message = "Database error", cause) => new FortressError("DATABASE_ERROR", message, 500, { cause }),
+  serviceUnavailable: (message = "Service unavailable", options) => new FortressError("SERVICE_UNAVAILABLE", message, 503, options),
+  validationError: (issues) => new FortressError("VALIDATION_ERROR", "Validation failed", 422, { details: issues }),
+  /**
+   * RFC 6749 §5.2 / §4.1.2.1 OAuth error.
+   *
+   * The HTTP error mapper detects `oauthError` and emits the OAuth-spec
+   * JSON body `{ error, error_description, error_uri? }` instead of the
+   * default fortress `{ code, message }` shape, so strict OAuth clients
+   * (Moodle, openid-client, Spring Security, etc.) can switch behaviour
+   * on the machine-readable `error` field.
+   *
+   * Status is inferred from the OAuth code per the spec table:
+   * - `invalid_client` → 401
+   * - everything else → 400
+   */
+  oauth: (error, description, options) => {
+    const status = options?.status ?? (error === "invalid_client" ? 401 : 400);
+    const code = status === 401 ? "UNAUTHORIZED" : "BAD_REQUEST";
+    return new FortressError(code, description ?? error, status, {
+      oauthError: error,
+      oauthDescription: description,
+      oauthErrorUri: options?.errorUri,
+      cause: options?.cause
+    });
+  },
+  /**
+   * Reconstruct a {@link FortressError} from a JSON error body emitted by
+   * `errorToResponse`. Used by the in-process `fortress.call.*` client to
+   * convert non-2xx responses into typed throws that mirror what a direct
+   * service-method call would produce.
+   *
+   * Maps by HTTP status when the body doesn't carry a recognizable
+   * `{ code, message }` payload, so network errors and opaque upstream
+   * failures still become structured `FortressError`s.
+   */
+  fromHttpResponse: (status, body) => {
+    const payload = body && typeof body === "object" ? body : {};
+    const message = typeof payload.message === "string" ? payload.message : `HTTP ${status}`;
+    const code = typeof payload.code === "string" && isFortressErrorCode(payload.code) ? payload.code : statusToErrorCode(status);
+    return new FortressError(code, message, status, { details: payload.details });
+  }
+};
+function isFortressErrorCode(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_REUSE" || code === "SESSION_IDLE_TIMEOUT" || code === "SESSION_ABSOLUTE_TIMEOUT" || code === "FORBIDDEN" || code === "BAD_REQUEST" || code === "NOT_FOUND" || code === "CONFLICT" || code === "UNPROCESSABLE_ENTITY" || code === "RATE_LIMITED" || code === "DATABASE_ERROR" || code === "VALIDATION_ERROR" || code === "SERVICE_UNAVAILABLE";
+}
+function statusToErrorCode(status) {
+  if (status === 401)
+    return "UNAUTHORIZED";
+  if (status === 403)
+    return "FORBIDDEN";
+  if (status === 404)
+    return "NOT_FOUND";
+  if (status === 409)
+    return "CONFLICT";
+  if (status === 422)
+    return "UNPROCESSABLE_ENTITY";
+  if (status === 429)
+    return "RATE_LIMITED";
+  if (status === 503)
+    return "SERVICE_UNAVAILABLE";
+  if (status >= 500)
+    return "DATABASE_ERROR";
+  return "BAD_REQUEST";
+}
+
+// src/core/http/match.ts
+function segmentSpecificity(segment) {
+  if (segment === "*")
+    return 0;
+  if (segment.startsWith(":"))
+    return 1;
+  return 2;
+}
+function canonicalizePath(pathname) {
+  const segments = pathname.split("/").filter(Boolean);
+  return segments.length === 0 ? "/" : `/${segments.join("/")}`;
+}
+function buildRouteTable(endpoints) {
+  const table = endpoints.map((ep) => {
+    const segments = canonicalizePath(ep.path).split("/").filter(Boolean);
+    const paramNames = [];
+    for (const seg of segments) {
+      if (seg.startsWith(":"))
+        paramNames.push(seg.slice(1));
+    }
+    return {
+      endpoint: ep,
+      method: ep.method.toUpperCase(),
+      segments,
+      paramNames
+    };
+  });
+  return table.map((route, index) => ({ route, index })).sort((a, b) => {
+    const length = Math.max(a.route.segments.length, b.route.segments.length);
+    for (let i = 0; i < length; i++) {
+      const difference = segmentSpecificity(b.route.segments[i] ?? "") - segmentSpecificity(a.route.segments[i] ?? "");
+      if (difference !== 0)
+        return difference;
+    }
+    return a.index - b.index;
+  }).map(({ route }) => route);
+}
+function matchRoute(table, method, pathname) {
+  const upperMethod = method.toUpperCase();
+  const pathSegments = canonicalizePath(pathname).split("/").filter(Boolean);
+  for (const route of table) {
+    if (route.method !== upperMethod)
+      continue;
+    if (route.segments.length !== pathSegments.length)
+      continue;
+    const params = {};
+    let matched = true;
+    for (let i = 0; i < route.segments.length; i++) {
+      const routeSeg = route.segments[i];
+      const pathSeg = pathSegments[i];
+      if (routeSeg.startsWith(":")) {
+        params[routeSeg.slice(1)] = decodeURIComponent(pathSeg);
+      } else if (routeSeg !== "*" && routeSeg !== pathSeg) {
+        matched = false;
+        break;
+      }
+    }
+    if (matched)
+      return { endpoint: route.endpoint, params };
+  }
+  return null;
+}
+
+// src/core/plugin-runner.ts
+function chainAdapterWrappers(plugins, baseAdapter, requestContext) {
+  let adapter = baseAdapter;
+  for (const plugin of plugins) {
+    if (plugin.wrapAdapter) {
+      adapter = plugin.wrapAdapter(adapter, requestContext);
+    }
+  }
+  return adapter;
+}
+async function collectScopeRules(plugins, userId, model, ctx) {
+  const allFilters = [];
+  const allDefaults = {};
+  for (const plugin of plugins) {
+    if (!plugin.scopeRules) {
+      continue;
+    }
+    const rule = await plugin.scopeRules(userId, model, ctx);
+    if (!rule) {
+      continue;
+    }
+    allFilters.push(...rule.filters);
+    Object.assign(allDefaults, rule.defaults);
+  }
+  if (allFilters.length === 0 && Object.keys(allDefaults).length === 0) {
+    return null;
+  }
+  return { filters: allFilters, defaults: allDefaults };
+}
+function wrapAdapterWithScopeRules(adapter, scopeRule) {
+  const { filters, defaults } = scopeRule;
+  return {
+    ...adapter,
+    create: (params) => adapter.create({
+      ...params,
+      data: { ...params.data, ...defaults }
+    }),
+    findOne: (params) => adapter.findOne({
+      ...params,
+      where: [...params.where, ...filters]
+    }),
+    findMany: (params) => adapter.findMany({
+      ...params,
+      where: [...params.where ?? [], ...filters]
+    }),
+    update: (params) => Promise.resolve().then(() => {
+      for (const key of Object.keys(defaults)) {
+        if (Object.hasOwn(params.data, key))
+          throw Errors.forbidden(`Cannot update scoped field '${key}'`);
+      }
+      return adapter.update({
+        ...params,
+        where: [...params.where, ...filters]
+      });
+    }),
+    delete: (params) => adapter.delete({
+      ...params,
+      where: [...params.where, ...filters]
+    }),
+    count: (params) => adapter.count({
+      ...params,
+      where: [...params.where ?? [], ...filters]
+    }),
+    transaction: (fn) => adapter.transaction((tx) => fn(wrapAdapterWithScopeRules(tx, scopeRule)))
+  };
+}
+function middlewarePathToRegex(pattern) {
+  const regexStr = canonicalizePath(pattern).replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/:[^/]+/g, "[^/]+").replace(/\\\*/g, ".*").replace(/\//g, "\\/");
+  return new RegExp(`^${regexStr}$`);
+}
+function collectPluginMiddleware(plugins, position) {
+  const result = [];
+  for (const plugin of plugins) {
+    if (!plugin.middleware)
+      continue;
+    for (const mw of plugin.middleware) {
+      if (mw.position === position) {
+        result.push({ plugin, middleware: mw });
+      }
+    }
+  }
+  return result;
+}
+async function executePluginMiddleware(plugins, position, requestPath, ctx, request) {
+  const canonicalRequestPath = canonicalizePath(requestPath);
+  const matching = collectPluginMiddleware(plugins, position).filter(({ middleware: mw }) => middlewarePathToRegex(mw.path).test(canonicalRequestPath));
+  if (matching.length === 0)
+    return;
+  let index = 0;
+  async function runNext() {
+    if (index >= matching.length)
+      return;
+    const current = matching[index++];
+    await current.middleware.handler(ctx, request, runNext);
+  }
+  await runNext();
+}
+
+// src/hono/middleware/auth.ts
+function createAuthMiddleware(fortress) {
+  return async (c, next) => {
+    const resolved = await fortress.resolvePrincipal(c.req.raw);
+    if (!resolved) {
+      throw new FortressError(
+        "UNAUTHORIZED",
+        "Missing or invalid credentials",
+        401
+      );
+    }
+    const { subject, claims, scopes } = resolved;
+    c.set("fortressSubject", subject);
+    if (subject.type === "USER")
+      c.set("fortressUserId", subject.id);
+    if (claims)
+      c.set("fortressClaims", claims);
+    if (scopes !== void 0)
+      c.set("fortressScopes", scopes);
+    const plugins = fortress.config.plugins ?? [];
+    const requestContext = {
+      tenantId: claims?.customClaims?.tenantId,
+      ipAddress: c.req.header("X-Forwarded-For") ?? c.req.header("X-Real-IP"),
+      userAgent: c.req.header("User-Agent")
+    };
+    const wrappedAdapter = chainAdapterWrappers(
+      plugins,
+      fortress.config.database,
+      requestContext
+    );
+    c.set("fortressDb", wrappedAdapter);
+    const pluginCtx = {
+      db: wrappedAdapter,
+      config: fortress.config
+    };
+    c.set(
+      "fortressGetScopedDb",
+      async (model) => {
+        const scopeRule = await collectScopeRules(
+          plugins,
+          subject.id,
+          model,
+          pluginCtx
+        );
+        if (!scopeRule)
+          return wrappedAdapter;
+        return wrapAdapterWithScopeRules(wrappedAdapter, scopeRule);
+      }
+    );
+    await next();
+  };
+}
+function getSubject(c) {
+  const subject = c.get("fortressSubject");
+  if (!subject) {
+    throw new FortressError("UNAUTHORIZED", "Not authenticated", 401);
+  }
+  return subject;
+}
+function getUserId(c) {
+  const subject = c.get("fortressSubject");
+  if (!subject || subject.type !== "USER") {
+    throw new FortressError("UNAUTHORIZED", "User not authenticated", 401);
+  }
+  return subject.id;
+}
+function getClaims(c) {
+  const claims = c.get("fortressClaims");
+  if (!claims) {
+    throw new FortressError("UNAUTHORIZED", "No JWT claims on this request", 401);
+  }
+  return claims;
+}
+function getDb(c) {
+  const db = c.get("fortressDb");
+  if (!db) {
+    throw new FortressError("UNAUTHORIZED", "Not authenticated", 401);
+  }
+  return db;
+}
+function getScopedDb(c, model) {
+  const fn = c.get("fortressGetScopedDb");
+  if (!fn) {
+    throw new FortressError("UNAUTHORIZED", "Not authenticated", 401);
+  }
+  return fn(model);
+}
+
+// src/core/http/error-response.ts
+function errorToResponse(err, logger) {
+  if (err instanceof FortressError) {
+    const headers = { "Content-Type": "application/json" };
+    if (err.code === "RATE_LIMITED" && err.retryAfter !== void 0) {
+      headers["Retry-After"] = String(err.retryAfter);
+    }
+    if (err.oauthError) {
+      const body2 = { error: err.oauthError };
+      if (err.oauthDescription)
+        body2.error_description = err.oauthDescription;
+      if (err.oauthErrorUri)
+        body2.error_uri = err.oauthErrorUri;
+      return new Response(JSON.stringify(body2), {
+        status: err.statusCode,
+        headers
+      });
+    }
+    return new Response(JSON.stringify(err.toJSON()), {
+      status: err.statusCode,
+      headers
+    });
+  }
+  logger?.error(
+    { err, message: err instanceof Error ? err.message : "Unknown error" },
+    "unhandled error in fortress.handleRequest"
+  );
+  const body = {
+    code: "INTERNAL_ERROR",
+    message: "Internal server error",
+    statusCode: 500
+  };
+  return new Response(JSON.stringify(body), {
+    status: 500,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function withCookies(response, setCookies) {
+  if (setCookies.length === 0)
+    return response;
+  const headers = new Headers(response.headers);
+  for (const cookie of setCookies) {
+    headers.append("set-cookie", cookie);
+  }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
+// src/hono/middleware/error-handler.ts
+function createErrorHandler() {
+  return (err) => errorToResponse(err);
+}
+
+// src/hono/middleware/plugin-middleware.ts
+function createPluginMiddleware(fortress, position) {
+  const plugins = fortress.config.plugins ?? [];
+  return async (c, next) => {
+    const path = c.req.path;
+    const ctx = { db: fortress.config.database, config: fortress.config };
+    const requestContext = {
+      request: c.req.raw,
+      fortressSubject: c.get("fortressSubject"),
+      fortressUserId: c.get("fortressUserId"),
+      fortressClaims: c.get("fortressClaims"),
+      fortressScopes: c.get("fortressScopes")
+    };
+    await executePluginMiddleware(plugins, position, path, ctx, requestContext);
+    await next();
+  };
+}
+
+// src/hono/middleware/rbac.ts
+function createRbacMiddleware(fortress, options) {
+  const routeMap = options?.routeMap ?? {};
+  const skipPaths = options?.skipPaths ?? [];
+  const skipPatterns = skipPaths.map((p) => pathToRegex(p));
+  const unmappedRoutes = options?.unmappedRoutes ?? (options?.defaultDeny ? "deny" : "allow");
+  return async (c, next) => {
+    const path = c.req.path;
+    const method = c.req.method;
+    if (skipPatterns.some((pattern) => pattern.test(path))) {
+      await next();
+      return;
+    }
+    const key = `${method} ${path}`;
+    let mapping = routeMap[key] ?? null;
+    if (!mapping) {
+      mapping = findRouteMapMatch(method, path, routeMap);
+    }
+    if (!mapping && options?.mapRequest) {
+      mapping = options.mapRequest(method, path);
+    }
+    if (!mapping) {
+      if (unmappedRoutes === "deny") {
+        throw new FortressError("FORBIDDEN", "No permission mapping for this route", 403);
+      }
+      await next();
+      return;
+    }
+    const subject = c.get("fortressSubject");
+    if (!subject) {
+      throw new FortressError("UNAUTHORIZED", "Not authenticated", 401);
+    }
+    const allowed = await fortress.iam.checkPermission(subject, mapping.resource, mapping.action, {
+      credentialScopes: c.get("fortressScopes")
+    });
+    if (!allowed) {
+      throw new FortressError("FORBIDDEN", "Insufficient permissions", 403);
+    }
+    await next();
+  };
+}
+function findRouteMapMatch(method, path, routeMap) {
+  for (const [pattern, mapping] of Object.entries(routeMap)) {
+    const [patternMethod, patternPath] = pattern.split(" ", 2);
+    if (patternMethod !== method)
+      continue;
+    const regex = pathToRegex(patternPath);
+    if (regex.test(path))
+      return mapping;
+  }
+  return null;
+}
+function pathToRegex(pattern) {
+  const regexStr = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/:[^/]+/g, "[^/]+").replace(/\\\*/g, ".*").replace(/\//g, "\\/");
+  return new RegExp(`^${regexStr}$`);
+}
+
+// src/hono/convert-routes.ts
+var TRAILING_SLASH_REGEX = /\/$/;
+var RE_LEADING_SLASH = /^\//;
+var RE_PARAM_BRACE = /\{(\w+)\}/g;
+var RE_SLASH = /\//g;
+var RE_NON_WORD = /\W/g;
+function fromOpenAPIPath(path) {
+  return path.replace(RE_PARAM_BRACE, ":$1");
+}
+function toOperationId(method, path) {
+  const normalized = path.replace(RE_LEADING_SLASH, "").replace(RE_PARAM_BRACE, "$1").replace(RE_SLASH, "_").replace(RE_NON_WORD, "_");
+  return `${method.toLowerCase()}_${normalized}`;
+}
+var VALID_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "DELETE", "PATCH"]);
+var SECURITY_REVERSE = {
+  bearer: "bearer",
+  bearerauth: "bearer",
+  basic: "basic",
+  basicauth: "basic",
+  apikey: "apiKey",
+  apikeyauth: "apiKey"
+};
+function mapSecurity(security) {
+  const result = [];
+  for (const entry of security) {
+    const keys = Object.keys(entry);
+    if (keys.length === 0) {
+      result.push("none");
+      continue;
+    }
+    for (const key of keys) {
+      const mapped = SECURITY_REVERSE[key.toLowerCase()];
+      if (mapped && !result.includes(mapped)) {
+        result.push(mapped);
+      }
+    }
+  }
+  return result;
+}
+function convertRoutes(routes, options) {
+  const { schemaConverter, prefix } = options;
+  const result = [];
+  for (const route of routes) {
+    const method = route.method.toUpperCase();
+    if (!VALID_METHODS.has(method))
+      continue;
+    const rawPath = prefix ? `${prefix.replace(TRAILING_SLASH_REGEX, "")}${route.path}` : route.path;
+    const path = fromOpenAPIPath(rawPath);
+    const handler = toOperationId(method, rawPath);
+    const meta = {
+      summary: route.summary ?? ""
+    };
+    if (route.tags)
+      meta.tags = route.tags;
+    if (route.description)
+      meta.description = route.description;
+    if (route.deprecated)
+      meta.deprecated = true;
+    if (route.security) {
+      const mapped = mapSecurity(route.security);
+      if (mapped.length > 0)
+        meta.security = mapped;
+    }
+    const input = {};
+    let hasInput = false;
+    if (route.request?.body?.content?.["application/json"]?.schema) {
+      input.body = schemaConverter(route.request.body.content["application/json"].schema);
+      hasInput = true;
+    }
+    if (route.request?.params) {
+      input.params = schemaConverter(route.request.params);
+      hasInput = true;
+    }
+    if (route.request?.query) {
+      input.query = schemaConverter(route.request.query);
+      hasInput = true;
+    }
+    const responses = {};
+    let hasResponses = false;
+    for (const [status, resp] of Object.entries(route.responses)) {
+      const entry = { description: resp.description };
+      if (resp.content?.["application/json"]?.schema) {
+        entry.schema = schemaConverter(resp.content["application/json"].schema);
+      }
+      responses[Number(status)] = entry;
+      hasResponses = true;
+    }
+    const endpoint = {
+      method,
+      path,
+      handler,
+      meta
+    };
+    if (hasInput)
+      endpoint.input = input;
+    if (hasResponses)
+      endpoint.responses = responses;
+    result.push(endpoint);
+  }
+  return result;
+}
+
+// src/hono/converters.ts
+var import_openapi2 = require("@bajustone/fetcher/openapi");
+
+// src/core/schema-builder.ts
+var import_openapi = require("@bajustone/fetcher/openapi");
+var import_schema = require("@bajustone/fetcher/schema");
+function collectRefNames(schema, acc) {
+  if (!schema || typeof schema !== "object")
+    return acc;
+  if (typeof schema.$ref === "string") {
+    const i = schema.$ref.lastIndexOf("/");
+    acc.add(i >= 0 ? schema.$ref.slice(i + 1) : schema.$ref);
+  }
+  if (schema.properties) {
+    for (const key of Object.keys(schema.properties))
+      collectRefNames(schema.properties[key], acc);
+  }
+  collectRefNames(schema.items, acc);
+  for (const key of ["oneOf", "anyOf", "allOf"]) {
+    const variants = schema[key];
+    if (variants) {
+      for (const variant of variants)
+        collectRefNames(variant, acc);
+    }
+  }
+  if (schema.additionalProperties && typeof schema.additionalProperties === "object")
+    collectRefNames(schema.additionalProperties, acc);
+  return acc;
+}
+var refDefinitionContexts = /* @__PURE__ */ new WeakMap();
+function refName(refPath) {
+  const i = refPath.lastIndexOf("/");
+  return i >= 0 ? refPath.slice(i + 1) : refPath;
+}
+function resolveRefDefs(schema) {
+  if (collectRefNames(schema, /* @__PURE__ */ new Set()).size === 0)
+    return void 0;
+  const defs = /* @__PURE__ */ Object.create(null);
+  const unresolved = /* @__PURE__ */ new Set();
+  const hasOwn = (value, key) => Object.hasOwn(value, key);
+  const visit = (node, inherited) => {
+    if (!node || typeof node !== "object")
+      return;
+    const context = refDefinitionContexts.get(node) ?? inherited;
+    if (typeof node.$ref === "string") {
+      const name = refName(node.$ref);
+      const component = context && hasOwn(context, name) ? context[name] : void 0;
+      if (component) {
+        if (hasOwn(defs, name) && !unresolved.has(name) && defs[name] !== component) {
+          throw new Error(`Conflicting component definitions for $ref '${name}'`);
+        }
+        const firstResolution = !hasOwn(defs, name) || unresolved.delete(name);
+        defs[name] = component;
+        if (firstResolution)
+          visit(component, context);
+      } else if (!hasOwn(defs, name)) {
+        defs[name] = {};
+        unresolved.add(name);
+      }
+    }
+    if (node.properties) {
+      for (const child of Object.values(node.properties))
+        visit(child, context);
+    }
+    visit(node.items, context);
+    for (const key of ["oneOf", "anyOf", "allOf"]) {
+      for (const child of node[key] ?? [])
+        visit(child, context);
+    }
+    if (node.additionalProperties && typeof node.additionalProperties === "object")
+      visit(node.additionalProperties, context);
+  };
+  visit(schema);
+  return defs;
+}
+function createStandardProps(schema) {
+  let validateFn;
+  return {
+    version: 1,
+    vendor: "fortress",
+    validate(value) {
+      if (!validateFn) {
+        const defs = resolveRefDefs(schema);
+        validateFn = (0, import_openapi.fromJSONSchema)(schema, defs)["~standard"].validate;
+      }
+      return validateFn(value);
+    }
+  };
+}
+function toFortressSchema(schema, refDefinitions, standardProps) {
+  if (refDefinitions)
+    refDefinitionContexts.set(schema, refDefinitions);
+  return Object.assign(schema, {
+    "~standard": standardProps ?? createStandardProps(schema)
+  });
+}
+function str(opts) {
+  const o = typeof opts === "string" ? { description: opts } : opts ?? {};
+  const s = { type: "string" };
+  if (o.description)
+    s.description = o.description;
+  if (o.min !== void 0)
+    s.minLength = o.min;
+  if (o.max !== void 0)
+    s.maxLength = o.max;
+  if (o.pattern !== void 0)
+    s.pattern = o.pattern;
+  if (o.format !== void 0)
+    s.format = o.format;
+  return toFortressSchema(s);
+}
+function int(opts) {
+  const o = typeof opts === "string" ? { description: opts } : opts ?? {};
+  const s = { type: "integer" };
+  if (o.description)
+    s.description = o.description;
+  if (o.min !== void 0)
+    s.minimum = o.min;
+  if (o.max !== void 0)
+    s.maximum = o.max;
+  return toFortressSchema(s);
+}
+function obj(properties, ...required) {
+  const s = { type: "object", properties };
+  if (required.length > 0)
+    s.required = required;
+  return toFortressSchema(s);
+}
+function makeFormatBuilder(factory) {
+  const f = factory();
+  return (description) => {
+    const s = { type: "string" };
+    if (f.format)
+      s.format = f.format;
+    if (f.pattern)
+      s.pattern = f.pattern;
+    if (description)
+      s.description = description;
+    return toFortressSchema(s);
+  };
+}
+var email = makeFormatBuilder(import_schema.email);
+var uuid = makeFormatBuilder(import_schema.uuid);
+var url = makeFormatBuilder(import_schema.url);
+var datetime = makeFormatBuilder(import_schema.datetime);
+var date = makeFormatBuilder(import_schema.date);
+var time = makeFormatBuilder(import_schema.time);
+function isStandardSchema(value) {
+  return typeof value === "object" && value !== null && "~standard" in value && typeof value["~standard"]?.validate === "function";
+}
+function isFortressSchema(value) {
+  return isStandardSchema(value) && value["~standard"].vendor === "fortress" && ("type" in value || "$ref" in value || "oneOf" in value || "anyOf" in value);
+}
+var JSON_SCHEMA_TYPES = /* @__PURE__ */ new Set(["string", "number", "integer", "boolean", "object", "array", "null"]);
+function hasJsonSchemaShape(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const v = value;
+  if ("$ref" in v || "oneOf" in v || "anyOf" in v || "allOf" in v)
+    return true;
+  if (typeof v.type === "string" && JSON_SCHEMA_TYPES.has(v.type))
+    return true;
+  if (Array.isArray(v.type) && v.type.every((t) => typeof t === "string" && JSON_SCHEMA_TYPES.has(t)))
+    return true;
+  return false;
+}
+function extractJsonSchema(schema) {
+  if (isFortressSchema(schema)) {
+    return schema;
+  }
+  if (isStandardSchema(schema)) {
+    const std = schema["~standard"];
+    if (std?.jsonSchema?.input) {
+      return std.jsonSchema.input({ target: "draft-2020-12" });
+    }
+    if (hasJsonSchemaShape(schema)) {
+      return schema;
+    }
+  }
+  return {};
+}
+var ErrorEnvelope = obj({
+  code: str("Machine-readable error code"),
+  message: str("Human-readable error message"),
+  statusCode: int("HTTP status code"),
+  details: toFortressSchema({ description: "Optional structured error details" })
+}, "code", "message", "statusCode");
+
+// src/hono/converters.ts
+var identitySchemaConverter = (jsonSchema) => jsonSchema;
+var fetcherSchemaConverter = (jsonSchema) => (0, import_openapi2.fromJSONSchema)(jsonSchema);
+var toJSONSchemaConverter = (schema) => extractJsonSchema(schema);
+
+// src/hono/handle.ts
+function mountFortress(app, fortress, options = {}) {
+  const prefix = options.prefix ?? "";
+  const routeTable = buildRouteTable(fortress.manifest.filter((route) => route.mounted));
+  app.use("*", async (c, next) => {
+    const url2 = new URL(c.req.url);
+    let pathname = url2.pathname;
+    if (prefix && pathname.startsWith(prefix)) {
+      pathname = pathname.slice(prefix.length) || "/";
+    } else if (prefix) {
+      await next();
+      return;
+    }
+    if (!matchRoute(routeTable, c.req.method, pathname)) {
+      await next();
+      return;
+    }
+    const rewritten = new Request(`${url2.origin}${pathname}${url2.search}`, c.req.raw);
+    return fortress.handleRequest(rewritten);
+  });
+}
+
+// src/hono/middleware/csrf.ts
+function createCsrfMiddleware(config) {
+  const headerName = config?.headerName ?? "X-Fortress-CSRF";
+  const skipPaths = config?.skipPaths ?? [];
+  const safeMethods = config?.safeMethods ?? ["GET", "HEAD", "OPTIONS"];
+  return async (c, next) => {
+    const method = c.req.method.toUpperCase();
+    if (safeMethods.includes(method)) {
+      await next();
+      return;
+    }
+    const path = new URL(c.req.url).pathname;
+    if (matchesSkipPath(path, skipPaths)) {
+      await next();
+      return;
+    }
+    const fetchSite = c.req.header("Sec-Fetch-Site");
+    if (fetchSite === "cross-site") {
+      return c.json({ error: "CSRF_REJECTED", message: "Cross-site requests are not allowed" }, 403);
+    }
+    const csrfHeader = c.req.header(headerName);
+    if (!csrfHeader) {
+      return c.json({ error: "CSRF_MISSING", message: "Missing CSRF header" }, 403);
+    }
+    await next();
+  };
+}
+function matchesSkipPath(path, skipPaths) {
+  return skipPaths.some((configured) => {
+    const withoutWildcard = configured.endsWith("/*") ? configured.slice(0, -2) : configured;
+    const base = withoutWildcard.length > 1 && withoutWildcard.endsWith("/") ? withoutWildcard.slice(0, -1) : withoutWildcard;
+    return path === base || path.startsWith(`${base}/`);
+  });
+}
+
+// src/hono/middleware/security-headers.ts
+function createSecurityHeadersMiddleware(config = {}) {
+  const hstsMaxAge = config.hstsMaxAge ?? 63072e3;
+  const hstsIncludeSubdomains = config.hstsIncludeSubdomains ?? true;
+  const hstsPreload = config.hstsPreload ?? false;
+  const frameOptions = config.frameOptions ?? "DENY";
+  const noSniff = config.noSniff ?? true;
+  const csp = config.contentSecurityPolicy ?? "default-src 'self'";
+  const referrerPolicy = config.referrerPolicy ?? "strict-origin-when-cross-origin";
+  const crossDomain = config.permittedCrossDomainPolicies ?? "none";
+  let hstsValue = null;
+  if (hstsMaxAge > 0) {
+    hstsValue = `max-age=${hstsMaxAge}`;
+    if (hstsIncludeSubdomains)
+      hstsValue += "; includeSubDomains";
+    if (hstsPreload)
+      hstsValue += "; preload";
+  }
+  return async (c, next) => {
+    try {
+      await next();
+    } finally {
+      if (hstsValue)
+        c.header("Strict-Transport-Security", hstsValue);
+      if (frameOptions)
+        c.header("X-Frame-Options", frameOptions);
+      if (noSniff)
+        c.header("X-Content-Type-Options", "nosniff");
+      if (csp)
+        c.header("Content-Security-Policy", csp);
+      if (referrerPolicy)
+        c.header("Referrer-Policy", referrerPolicy);
+      if (crossDomain)
+        c.header("X-Permitted-Cross-Domain-Policies", crossDomain);
+    }
+  };
+}
+
+// src/hono/openapi.ts
+function toOpenAPIPath(path) {
+  return path.replace(/:(\w+)/g, "{$1}");
+}
+function buildRouteDefinition(ep, schemaConverter) {
+  const openAPIPath = toOpenAPIPath(ep.path);
+  const method = ep.method.toLowerCase();
+  const routeDef = {
+    method,
+    path: openAPIPath,
+    operationId: ep.handler,
+    responses: {}
+  };
+  if (ep.meta?.summary)
+    routeDef.summary = ep.meta.summary;
+  if (ep.meta?.description)
+    routeDef.description = ep.meta.description;
+  if (ep.meta?.tags)
+    routeDef.tags = ep.meta.tags;
+  if (ep.meta?.deprecated)
+    routeDef.deprecated = true;
+  if (ep.meta?.security) {
+    const sec = [];
+    for (const s of ep.meta.security) {
+      if (s === "none")
+        sec.push({});
+      else if (s === "bearer")
+        sec.push({ bearerAuth: [] });
+      else if (s === "basic")
+        sec.push({ basicAuth: [] });
+      else if (s === "apiKey")
+        sec.push({ apiKeyAuth: [] });
+    }
+    routeDef.security = sec;
+  }
+  const request = {};
+  if (ep.input?.body) {
+    request.body = {
+      content: {
+        "application/json": { schema: schemaConverter(ep.input.body) }
+      }
+    };
+  }
+  if (ep.input?.params?.properties) {
+    const shape = {};
+    const required = new Set(ep.input.params.required ?? []);
+    for (const [key, schema] of Object.entries(ep.input.params.properties)) {
+      const converted = schemaConverter({ ...schema, type: schema.type ?? "string" });
+      shape[key] = required.has(key) ? converted : converted;
+    }
+    request.params = schemaConverter({
+      type: "object",
+      properties: ep.input.params.properties,
+      required: ep.input.params.required
+    });
+  }
+  if (ep.input?.query?.properties) {
+    request.query = schemaConverter(ep.input.query);
+  }
+  if (Object.keys(request).length > 0) {
+    routeDef.request = request;
+  }
+  const responses = {};
+  if (ep.responses) {
+    for (const [status, resp] of Object.entries(ep.responses)) {
+      const entry = {
+        description: resp.description
+      };
+      if (resp.schema) {
+        entry.content = {
+          "application/json": { schema: schemaConverter(resp.schema) }
+        };
+      }
+      responses[Number(status)] = entry;
+    }
+  } else {
+    responses[200] = { description: "Success" };
+  }
+  routeDef.responses = responses;
+  return routeDef;
+}
+function mountFortressOpenAPI(app, fortress, options) {
+  const skipPaths = new Set(options.skipPaths ?? []);
+  if (app.openAPIRegistry) {
+    app.openAPIRegistry.registerComponent("securitySchemes", "bearerAuth", {
+      type: "http",
+      scheme: "bearer",
+      bearerFormat: "JWT"
+    });
+    app.openAPIRegistry.registerComponent("securitySchemes", "basicAuth", {
+      type: "http",
+      scheme: "basic"
+    });
+    app.openAPIRegistry.registerComponent("securitySchemes", "apiKeyAuth", {
+      type: "apiKey",
+      name: "X-API-Key",
+      in: "header"
+    });
+  }
+  options.registerSecuritySchemes?.(app);
+  for (const ep of fortress.endpoints) {
+    if (skipPaths.has(ep.path))
+      continue;
+    const routeDef = buildRouteDefinition(ep, options.schemaConverter);
+    const route = options.createRoute(routeDef);
+    const handler = createAutoHandler(fortress, ep);
+    app.openapi(route, handler);
+  }
+}
+function getFortressRoutes(fortress, schemaConverter, createRoute) {
+  const result = {};
+  for (const ep of fortress.endpoints) {
+    const routeDef = buildRouteDefinition(ep, schemaConverter);
+    result[ep.handler] = createRoute(routeDef);
+  }
+  return result;
+}
+function createAutoHandler(fortress, _ep) {
+  return async (c) => {
+    const raw = c.req?.raw;
+    if (raw)
+      return fortress.handleRequest(raw);
+    const request = new Request(c.req.url, {
+      method: c.req.method,
+      headers: c.req.raw?.headers ?? void 0,
+      body: ["GET", "HEAD"].includes(c.req.method) ? void 0 : await c.req.text()
+    });
+    return fortress.handleRequest(request);
+  };
+}
+
+// src/core/validation.ts
+var import_openapi3 = require("@bajustone/fetcher/openapi");
+var DECIMAL_INTEGER_RE = /^-?\d+$/;
+var DECIMAL_NUMBER_RE = /^-?\d+(?:\.\d+)?$/;
+var rawSchemaValidators = /* @__PURE__ */ new WeakMap();
+function standardSchemaFor(schema) {
+  if ("~standard" in schema)
+    return schema;
+  let compiled = rawSchemaValidators.get(schema);
+  if (!compiled) {
+    compiled = (0, import_openapi3.fromJSONSchema)(schema);
+    rawSchemaValidators.set(schema, compiled);
+  }
+  return compiled;
+}
+function coerceBySchema(schema, data) {
+  if (!schema || !data || schema.type !== "object" || !schema.properties)
+    return data;
+  const out = { ...data };
+  for (const [key, propSchema] of Object.entries(schema.properties)) {
+    const value = out[key];
+    if (typeof value !== "string")
+      continue;
+    const coerced = coerceScalar(propSchema, value);
+    if (coerced !== void 0)
+      out[key] = coerced;
+  }
+  return out;
+}
+function coerceScalar(schema, value) {
+  const type = schema.type ?? numericConstraintType(schema);
+  switch (type) {
+    case "integer": {
+      if (!DECIMAL_INTEGER_RE.test(value))
+        return void 0;
+      const n = Number(value);
+      if (Number.isFinite(n) && Number.isSafeInteger(n) && String(n) === value)
+        return n;
+      return void 0;
+    }
+    case "number": {
+      if (!DECIMAL_NUMBER_RE.test(value))
+        return void 0;
+      const n = Number(value);
+      if (Number.isFinite(n) && (!Number.isInteger(n) || Number.isSafeInteger(n)) && String(n) === value)
+        return n;
+      return void 0;
+    }
+    case "boolean": {
+      if (value === "true")
+        return true;
+      if (value === "false")
+        return false;
+      return void 0;
+    }
+    default:
+      return void 0;
+  }
+}
+function numericConstraintType(schema) {
+  if (typeof schema.const === "number")
+    return Number.isInteger(schema.const) ? "integer" : "number";
+  if (schema.enum && schema.enum.length > 0 && schema.enum.every((value) => typeof value === "number"))
+    return schema.enum.every((value) => Number.isInteger(value)) ? "integer" : "number";
+  return void 0;
+}
+async function validateRequest(input, data) {
+  if (!input)
+    return;
+  const allIssues = [];
+  if (input.bodySchema || input.body) {
+    const issues = await validateSchema(input.bodySchema ?? input.body, data.body, "body");
+    allIssues.push(...issues);
+  }
+  if (input.querySchema || input.query) {
+    const issues = await validateSchema(input.querySchema ?? input.query, data.query, "query");
+    allIssues.push(...issues);
+  }
+  if (input.paramsSchema || input.params) {
+    const issues = await validateSchema(input.paramsSchema ?? input.params, data.params, "params");
+    allIssues.push(...issues);
+  }
+  if (allIssues.length > 0) {
+    throw Errors.validationError(allIssues);
+  }
+}
+async function validateSchema(schema, data, location) {
+  const result = await standardSchemaFor(schema)["~standard"].validate(data);
+  if (result.issues) {
+    return result.issues.map((issue) => ({
+      path: issue.path,
+      message: issue.message,
+      location
+    }));
+  }
+  return [];
+}
+async function validateValue(schema, data, location) {
+  const result = await schema["~standard"].validate(data);
+  if (result.issues) {
+    throw Errors.validationError(
+      result.issues.map((issue) => ({
+        path: issue.path,
+        message: issue.message,
+        location
+      }))
+    );
+  }
+  return result.value;
+}
+
+// src/core/http/cookie-serialize.ts
+function parseCookieHeader(header) {
+  if (!header)
+    return {};
+  const out = {};
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1)
+      continue;
+    const name = part.slice(0, eq).trim();
+    if (!name)
+      continue;
+    const raw = part.slice(eq + 1).trim();
+    try {
+      out[name] = decodeURIComponent(raw);
+    } catch {
+      out[name] = raw;
+    }
+  }
+  return out;
+}
+
+// src/core/http/csrf.ts
+function resolveCsrfConfig(config) {
+  return {
+    enabled: config?.enabled ?? true,
+    headerName: config?.headerName ?? "X-Fortress-CSRF",
+    skipPaths: config?.skipPaths ?? [],
+    rejectSameSite: config?.rejectSameSite ?? false
+  };
+}
+var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function matchesSkipPath2(path, skipPaths) {
+  for (const skip of skipPaths) {
+    if (path === skip)
+      return true;
+    if (path.startsWith(`${skip}/`))
+      return true;
+  }
+  return false;
+}
+function isCookieAuthenticated(request, cookies) {
+  const jar = parseCookieHeader(request.headers.get("cookie"));
+  const hasCookie = (name) => typeof jar[name] === "string" && jar[name].length > 0;
+  return hasCookie(cookies.accessName) || hasCookie(cookies.refreshName);
+}
+function enforceCsrf(request, pathname, csrf, cookies) {
+  if (!csrf.enabled)
+    return;
+  if (SAFE_METHODS.has(request.method.toUpperCase()))
+    return;
+  if (matchesSkipPath2(pathname, csrf.skipPaths))
+    return;
+  const fetchSite = request.headers.get("sec-fetch-site");
+  const cookieAuthenticated = isCookieAuthenticated(request, cookies);
+  if (!cookieAuthenticated) {
+    if (request.headers.has("authorization") || request.headers.has("x-api-key"))
+      return;
+    if (fetchSite === "cross-site")
+      throw Errors.forbidden("CSRF: cross-site request rejected");
+    const origin = request.headers.get("origin");
+    if (origin) {
+      try {
+        if (new URL(origin).origin !== new URL(request.url).origin)
+          throw Errors.forbidden("CSRF: cross-origin request rejected");
+      } catch (error) {
+        if (error instanceof Error && "code" in error)
+          throw error;
+        throw Errors.forbidden("CSRF: invalid Origin header");
+      }
+    }
+    return;
+  }
+  if (fetchSite === "cross-site")
+    throw Errors.forbidden("CSRF: cross-site request rejected");
+  if (csrf.rejectSameSite && fetchSite === "same-site")
+    throw Errors.forbidden("CSRF: same-site request rejected");
+  const tokenHeader = request.headers.get(csrf.headerName);
+  if (!tokenHeader)
+    throw Errors.forbidden(`CSRF: missing ${csrf.headerName} header`);
+}
+
+// src/core/http/fortress-rbac.ts
+async function enforceFortressPermission(endpoint, subject, enforcement, scopes) {
+  const security = endpoint.meta?.security;
+  if (endpoint.meta?.permission) {
+    if (!subject)
+      throw Errors.unauthorized("Not authenticated");
+    const allowed = await enforcement.checkPermission(
+      subject,
+      endpoint.meta.permission.resource,
+      endpoint.meta.permission.action,
+      scopes
+    );
+    if (!allowed)
+      throw Errors.forbidden("Insufficient permissions");
+    return;
+  }
+  if (security?.includes("none") || security?.includes("basic"))
+    return;
+  if (security?.includes("bearer")) {
+    if (!subject)
+      throw Errors.unauthorized("Not authenticated");
+    return;
+  }
+  throw Errors.forbidden("No permission mapping for this route");
+}
+
+// src/core/http/plugin-middleware.ts
+async function runPluginMiddleware(plugins, config, phase, ctx) {
+  if (plugins.length === 0)
+    return;
+  const pluginCtx = { db: config.database, config };
+  const path = new URL(ctx.request.url).pathname;
+  await executePluginMiddleware(plugins, phase, path, pluginCtx, ctx);
+}
+
+// src/core/http/principal.ts
+async function tryPluginPrincipal(fortress, request) {
+  const plugins = fortress.config.plugins ?? [];
+  for (const plugin of plugins) {
+    if (!plugin.resolvePrincipal)
+      continue;
+    const resolved = await plugin.resolvePrincipal(request, {
+      db: fortress.config.database,
+      config: fortress.config,
+      auth: fortress.auth,
+      iam: fortress.iam
+    });
+    if (resolved)
+      return { subject: resolved.subject, claims: resolved.claims, scopes: resolved.scopes };
+  }
+  return null;
+}
+
+// src/core/http/protect.ts
+function routeKey(route) {
+  return `${route.method.toUpperCase()} ${route.path}`;
+}
+function findEndpoint(fortress, target, method) {
+  if (typeof target !== "string") {
+    return target;
+  }
+  const matches = fortress.endpoints.filter((endpoint) => endpoint.handler === target);
+  if (matches.length === 0)
+    throw Errors.notFound(`No endpoint found for handler '${target}'`);
+  if (method) {
+    const byMethod = matches.find((endpoint) => endpoint.method.toUpperCase() === method.toUpperCase());
+    if (byMethod)
+      return byMethod;
+  }
+  if (matches.length > 1) {
+    throw Errors.badRequest(
+      `Handler '${target}' maps to multiple endpoints; pass the EndpointDefinition or ProtectOptions.method.`
+    );
+  }
+  return matches[0];
+}
+function findManifestEntry(fortress, endpoint) {
+  const key = routeKey(endpoint);
+  const entry = fortress.manifest.find((route) => `${route.method.toUpperCase()} ${route.path}` === key);
+  if (!entry)
+    throw Errors.notFound(`No route manifest entry found for ${key}`);
+  return entry;
+}
+function rewriteRequestPath(request, pathname) {
+  const current = new URL(request.url);
+  if (current.pathname === pathname)
+    return request;
+  const rewritten = new URL(request.url);
+  rewritten.pathname = pathname;
+  return new Request(rewritten, request);
+}
+async function parseJsonBody(request) {
+  if (request.method === "GET" || request.method === "HEAD")
+    return void 0;
+  if (!(request.headers.get("content-type") ?? "").includes("json"))
+    return void 0;
+  return request.clone().json().catch(() => void 0);
+}
+function objectOrEmpty(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
+}
+function successStatus(endpoint) {
+  const status = Object.keys(endpoint.responses ?? {}).map(Number).find((code) => code >= 200 && code < 300);
+  return status ?? 200;
+}
+function jsonResponse(body, status) {
+  return new Response(JSON.stringify(body ?? { ok: true }), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function maybeAttachAuthCookies(fortress, result, response) {
+  if (result instanceof Response)
+    return response;
+  const obj2 = result;
+  if (typeof obj2?.accessToken !== "string")
+    return response;
+  return withCookies(response, fortress.serializeAuthCookies({
+    accessToken: obj2.accessToken,
+    refreshToken: typeof obj2.refreshToken === "string" ? obj2.refreshToken : null
+  }));
+}
+function protect(fortress, target, handler, options = {}) {
+  const endpoint = findEndpoint(fortress, target, options.method);
+  const manifest = findManifestEntry(fortress, endpoint);
+  const endpointRouteTable = buildRouteTable([endpoint]);
+  const csrfConfig = resolveCsrfConfig(fortress.config.csrf);
+  const plugins = fortress.config.plugins ?? [];
+  return async function protectedRequestHandler(request) {
+    let response;
+    try {
+      const url2 = new URL(request.url);
+      const pipelinePath = options.path ?? url2.pathname;
+      const pipelineRequest = rewriteRequestPath(request, pipelinePath);
+      await runPluginMiddleware(plugins, fortress.config, "before-auth", { request: pipelineRequest });
+      enforceCsrf(pipelineRequest, pipelinePath, csrfConfig, fortress.cookies);
+      let subject;
+      let userId;
+      let claims;
+      let scopes;
+      const selfManagedBearer = endpoint.meta?.bearerKind === "oauth";
+      if (!selfManagedBearer) {
+        const pluginResolved = await tryPluginPrincipal(fortress, pipelineRequest);
+        if (pluginResolved) {
+          subject = pluginResolved.subject;
+          claims = pluginResolved.claims;
+          scopes = pluginResolved.scopes;
+        }
+      }
+      const requiresBearer = !selfManagedBearer && ((endpoint.meta?.security?.includes("bearer") ?? false) || !!endpoint.meta?.permission);
+      if (!subject && requiresBearer) {
+        const token = fortress.extractAccessToken(pipelineRequest);
+        if (!token)
+          throw Errors.unauthorized("Missing access token");
+        try {
+          claims = await fortress.auth.verifyToken(token);
+          subject = { type: claims.subjectType, id: claims.sub };
+        } catch (err) {
+          if (err instanceof FortressError)
+            throw err;
+          throw Errors.unauthorized("Invalid access token");
+        }
+      }
+      if (subject?.type === "USER")
+        userId = subject.id;
+      await runPluginMiddleware(plugins, fortress.config, "after-auth", {
+        request: pipelineRequest,
+        fortressSubject: subject,
+        fortressUserId: userId,
+        fortressClaims: claims,
+        fortressScopes: scopes
+      });
+      if (!selfManagedBearer) {
+        await enforceFortressPermission(endpoint, subject, {
+          checkPermission: (subj, resource, action, credentialScopes) => fortress.iam.checkPermission(subj, resource, action, { credentialScopes })
+        }, scopes);
+      }
+      await runPluginMiddleware(plugins, fortress.config, "after-rbac", {
+        request: pipelineRequest,
+        fortressSubject: subject,
+        fortressUserId: userId,
+        fortressClaims: claims,
+        fortressScopes: scopes
+      });
+      const body = await parseJsonBody(request);
+      const rawQuery = Object.fromEntries(url2.searchParams);
+      const match = matchRoute(endpointRouteTable, endpoint.method, options.path ?? url2.pathname);
+      const rawParams = options.params ?? match?.params ?? {};
+      const query = coerceBySchema(endpoint.input?.query, rawQuery) ?? rawQuery;
+      const params = coerceBySchema(endpoint.input?.params, rawParams) ?? rawParams;
+      await validateRequest(endpoint.input, { body, query, params });
+      const input = { ...objectOrEmpty(body), ...query, ...params };
+      const result = await handler({
+        request,
+        endpoint,
+        manifest,
+        subject,
+        userId,
+        claims,
+        scopes,
+        params,
+        query,
+        body,
+        input,
+        respond: (status, responseBody) => jsonResponse(responseBody, status)
+        // Cast: the runtime values are untyped records; the generic context
+        // type narrows them for the caller, but the impl signature uses the
+        // loose `ProtectedRouteContext<EndpointDefinition>`.
+      });
+      response = result instanceof Response ? result : jsonResponse(result, successStatus(endpoint));
+      if (options.attachAuthCookies ?? true)
+        response = maybeAttachAuthCookies(fortress, result, response);
+      return response;
+    } catch (err) {
+      response = errorToResponse(err, fortress.logger);
+      return response;
+    }
+  };
+}
+
+// src/hono/protect.ts
+function protectedRoute(fortress, target, handler, options = {}) {
+  return async (c) => {
+    const protectedHandler = protect(
+      fortress,
+      target,
+      (ctx) => handler(c, ctx),
+      { ...options, method: options.method ?? c.req.method }
+    );
+    return protectedHandler(c.req.raw);
+  };
+}
+
+// src/hono/validated.ts
+async function vBody(c, schema) {
+  const body = await c.req.json().catch(() => void 0);
+  return validateValue(schema, body, "body");
+}
+async function vParam(c, schema) {
+  return validateValue(schema, c.req.param(), "params");
+}
+async function vQuery(c, schema) {
+  return validateValue(schema, c.req.query(), "query");
+}
+
+// src/hono/index.ts
+function createHonoMiddleware(fortress, options) {
+  return {
+    authMiddleware: createAuthMiddleware(fortress),
+    rbacMiddleware: createRbacMiddleware(fortress, options),
+    errorHandler: createErrorHandler(),
+    pluginMiddleware: {
+      beforeAuth: createPluginMiddleware(fortress, "before-auth"),
+      afterAuth: createPluginMiddleware(fortress, "after-auth"),
+      afterRbac: createPluginMiddleware(fortress, "after-rbac")
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  buildRouteDefinition,
+  convertRoutes,
+  createCsrfMiddleware,
+  createHonoMiddleware,
+  createPluginMiddleware,
+  createSecurityHeadersMiddleware,
+  fetcherSchemaConverter,
+  getClaims,
+  getDb,
+  getFortressRoutes,
+  getScopedDb,
+  getSubject,
+  getUserId,
+  identitySchemaConverter,
+  mountFortress,
+  mountFortressOpenAPI,
+  protectedRoute,
+  toJSONSchemaConverter,
+  vBody,
+  vParam,
+  vQuery
+});