@cosmicdrift/kumiko-framework 0.387.0 → 0.389.0

package/dist/api/server-extra-routes.js

@@ -0,0 +1,206 @@
+import { ROLES } from "../auth/roles.js";
+import { createSystemUser } from "../engine/system-user.js";
+import { createFallbackLogger } from "../logging/index.js";
+import { assertUnreachable } from "../utils/index.js";
+import { NON_PUBLIC_API_PATHS, PUBLIC_API_PATHS } from "./api-constants.js";
+import { getUser } from "./auth-middleware.js";
+import { clientIpSourceFromHonoContext } from "./client-ip.js";
+import { ExtraRouteEntries, ExtraRouteRejection, } from "./extra-route.js";
+import { bodyLimitForRoutePath, DEFAULT_MAX_REQUEST_BYTES } from "./route-registrars.js";
+import { isMissingOrAnonymousUser, makeSystemQuery, mountHonoRoute, unauthenticatedResponse, } from "./server-routes.js";
+// Only entry:"signature" bypasses jwtGuard (verify() authenticates
+// itself); entry:"anonymous" still needs the anonymousAccess fallthrough
+// (tenant-by-host), entry:"user" needs c.get("user") populated.
+export function compilePublicApiRequestMatcher(extraRoutes) {
+    const matchers = (extraRoutes ?? [])
+        .filter((route) => route.entry === ExtraRouteEntries.signature)
+        .map((route) => ({ method: route.method, pattern: honoPathToRegex(route.path) }));
+    return (c) => PUBLIC_API_PATHS.has(c.req.path) ||
+        matchers.some((m) => m.method === c.req.method && m.pattern.test(c.req.path));
+}
+export function mountExtraRoutes(app, wiring) {
+    const { options, dispatcher, context, clientIpResolver } = wiring;
+    // extraRoutes — declarative HTTP-routes with a
+    // required `entry` tier. Mounted after r.httpRoute: an
+    // extraRoute dispatching through `dispatcher` builds Hono's matcher, so
+    // this must run before any seed that also dispatches (runProdApp/
+    // createKumikoServer call buildServer before seeding).
+    if (options.extraRoutes) {
+        // Boot-time validation for the whole list BEFORE mounting anything —
+        // an app with one bad route should fail loud at boot, not mount N-1
+        // routes and then throw on route N.
+        for (const route of options.extraRoutes) {
+            assertValidExtraRoute(route);
+        }
+        const dispatchSystemWrite = makeDispatchSystemWrite(dispatcher);
+        const dispatchSystemQuery = makeDispatchSystemQuery(dispatcher);
+        const dispatchWriteAs = makeDispatchWriteAs(dispatcher);
+        for (const route of options.extraRoutes) {
+            const honoHandler = buildExtraRouteHonoHandler(route, {
+                app,
+                dispatcher,
+                registry: options.registry,
+                secrets: context.secrets,
+                dispatchSystemWrite,
+                dispatchSystemQuery,
+                dispatchWriteAs,
+                clientIpResolver,
+            });
+            mountHonoRoute(app, route.method, route.path, honoHandler, bodyLimitForRoutePath(route.path, options.maxRequestBytes ?? DEFAULT_MAX_REQUEST_BYTES));
+        }
+    }
+}
+function assertValidExtraRoute(route) {
+    if (!isKnownExtraRouteEntry(route.entry)) {
+        throw new Error(`[kumiko] extraRoutes: unknown entry "${String(route.entry)}" on ` +
+            `"${route.method} ${route.path}" — expected "anonymous" | "user" | "signature". ` +
+            "A JS caller without the ExtraRouteDefinition type can hit this at boot.");
+    }
+    if (route.entry === ExtraRouteEntries.user && !route.path.startsWith("/api/")) {
+        throw new Error(`[kumiko] extraRoutes: entry:"user" route "${route.method} ${route.path}" must be ` +
+            "mounted under \"/api/\" — that's the only path prefix that rides the framework's " +
+            "jwtGuard chain, which is what populates deps.user.");
+    }
+    // A signature route under /api/ skips jwtGuard/origin/csrf for every
+    // path its pattern matches — a wildcard would switch off auth for
+    // unrelated /api/* handlers (e.g. "/api/*" swallows /api/write).
+    if (route.entry === ExtraRouteEntries.signature &&
+        route.path.startsWith("/api/") &&
+        route.path.includes("*")) {
+        throw new Error(`[kumiko] extraRoutes: entry:"signature" route "${route.method} ${route.path}" must not ` +
+            'use a wildcard under "/api/" — it would bypass the auth chain for every matching path.');
+    }
+    // A `:param` segment is as broad as a wildcard, and the public matchers test
+    // the bare request path: "/:seg/write" and "/api/:hook" both match /api/write.
+    if (route.entry === ExtraRouteEntries.signature) {
+        const routePattern = honoPathToRegex(route.path);
+        const shadowedFrameworkPath = [...PUBLIC_API_PATHS, ...NON_PUBLIC_API_PATHS].find((path) => routePattern.test(path));
+        if (shadowedFrameworkPath !== undefined) {
+            throw new Error(`[kumiko] extraRoutes: entry:"signature" route "${route.method} ${route.path}" must not ` +
+                `match the framework path "${shadowedFrameworkPath}" — it would bypass the auth chain for it.`);
+        }
+    }
+}
+// SystemAdmin write/query builders shared by mountExtraRoutes
+// and server-runtime's `wire` hook (runProdApp/createKumikoServer,
+// after buildServer). Privilege-scope: SystemAdmin is the highest
+// non-tenant-scoped role — reaches ANY SystemAdmin-gated handler on ANY
+// tenant. Only safe for callers that already proved their own authenticity
+// (signature verify(), HMAC state, ...), never exposed to a raw request.
+export function makeDispatchSystemWrite(dispatcher) {
+    return ({ handlerQn, payload, tenantId }) => dispatcher.write(handlerQn, payload, createSystemUser(tenantId, [ROLES.SystemAdmin]));
+}
+// Privilege-scope: the system user gets exactly the roles the caller names —
+// no implicit SystemAdmin — so a seed can write data gated on app roles.
+// Same trust requirement as makeDispatchSystemWrite: never expose to a raw
+// request, only to code that already proved its own authenticity.
+export function makeDispatchWriteAs(dispatcher) {
+    return ({ handlerQn, payload, tenantId, roles }) => dispatcher.write(handlerQn, payload, createSystemUser(tenantId, roles));
+}
+export function makeDispatchSystemQuery(dispatcher) {
+    return ({ handlerQn, payload, tenantId }) => dispatcher.query(handlerQn, payload, createSystemUser(tenantId, [ROLES.SystemAdmin]));
+}
+// Same dispatcher.write(...) as entry:"user", but the user is getUser(c) —
+// see AnonymousExtraRouteDeps.write for the privilege/tenant contract.
+function makeAnonymousWrite(
+// biome-ignore lint/suspicious/noExplicitAny: Hono context generics are invisible at the framework boundary
+c, dispatcher) {
+    return (type, payload) => {
+        const user = getUser(c);
+        if (!user) {
+            throw new Error('[kumiko] extraRoutes: entry:"anonymous" deps.write requires this route to be mounted ' +
+                'under "/api/" with anonymousAccess wired — no request-resolved session user was found.');
+        }
+        return dispatcher.write(type, payload, user);
+    };
+}
+const extraRouteLog = createFallbackLogger("extra-route");
+function isKnownExtraRouteEntry(entry) {
+    return (entry === ExtraRouteEntries.anonymous ||
+        entry === ExtraRouteEntries.user ||
+        entry === ExtraRouteEntries.signature);
+}
+// Hono path pattern ("/api/foo/:bar", "/api/foo/*") → RegExp. Only the
+// subset extraRoutes actually uses (static segments, `:param`, trailing
+// `*`) — no inline `:param{regex}` constraints, no optional `:param?`.
+function honoPathToRegex(path) {
+    const segments = path
+        .split("/")
+        .map((segment) => {
+        if (segment.startsWith(":"))
+            return "[^/]+";
+        if (segment === "*")
+            return ".*";
+        return segment.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    })
+        .join("/");
+    return new RegExp(`^${segments}$`);
+}
+function buildExtraRouteHonoHandler(route, shared) {
+    switch (route.entry) {
+        case ExtraRouteEntries.anonymous:
+            return async (c) => route.handler(c, {
+                app: shared.app,
+                registry: shared.registry,
+                systemQuery: makeSystemQuery(c, shared.dispatcher, shared.clientIpResolver),
+                write: makeAnonymousWrite(c, shared.dispatcher),
+                clientIp: shared.clientIpResolver.resolve(clientIpSourceFromHonoContext(c)),
+            });
+        case ExtraRouteEntries.user:
+            return async (c) => {
+                const user = getUser(c);
+                if (isMissingOrAnonymousUser(user)) {
+                    return unauthenticatedResponse(c);
+                }
+                return route.handler(c, {
+                    app: shared.app,
+                    registry: shared.registry,
+                    user,
+                    query: (type, payload) => shared.dispatcher.query(type, payload, user),
+                    write: (type, payload) => shared.dispatcher.write(type, payload, user),
+                });
+            };
+        case ExtraRouteEntries.signature:
+            return async (c) => {
+                const rawBody = await c.req.text();
+                const headers = {};
+                c.req.raw.headers.forEach((value, key) => {
+                    headers[key.toLowerCase()] = value;
+                });
+                let verified;
+                try {
+                    verified = await route.verify({ rawBody, headers, params: c.req.param(), query: c.req.query() }, { registry: shared.registry, secrets: shared.secrets });
+                }
+                catch (e) {
+                    if (e instanceof ExtraRouteRejection) {
+                        if (e.retryAfterSeconds !== undefined) {
+                            return c.json(e.body, e.status, { "Retry-After": String(e.retryAfterSeconds) });
+                        }
+                        return c.json(e.body, e.status);
+                    }
+                    // The body goes to unauthenticated callers; infra errors thrown by
+                    // verify() (secrets, DB) must not leak, so the detail stays in the log.
+                    extraRouteLog.error(`signature verify() threw on ${c.req.path}`, {
+                        error: e instanceof Error ? e.message : String(e),
+                    });
+                    return c.json({
+                        error: {
+                            code: "extra_route_signature_invalid",
+                            message: "signature verification failed",
+                        },
+                    }, 401);
+                }
+                return route.handler(c, verified, {
+                    app: shared.app,
+                    registry: shared.registry,
+                    secrets: shared.secrets,
+                    systemQuery: makeSystemQuery(c, shared.dispatcher, shared.clientIpResolver),
+                    dispatchSystemWrite: shared.dispatchSystemWrite,
+                    dispatchSystemQuery: shared.dispatchSystemQuery,
+                    dispatchWriteAs: shared.dispatchWriteAs,
+                });
+            };
+        default:
+            return assertUnreachable(route, "extra route entry");
+    }
+}

package/dist/api/server-middleware.d.ts

@@ -0,0 +1,20 @@
+import type { Hono, MiddlewareHandler } from "hono";
+import type { ObservabilityProvider } from "../observability/index.ts";
+import { type TenantLifecycleStatusResolver } from "./auth-middleware.ts";
+import type { ServerOptions } from "./server.ts";
+import type { PublicApiRequestMatcher } from "./server-extra-routes.ts";
+import type { ServerWiring } from "./server-wiring.ts";
+import { type ResolvedSessionCookies } from "./session-cookies.ts";
+export declare function installSessionCookies(app: Hono, auth: ServerOptions["auth"]): ResolvedSessionCookies;
+export declare function installRequestId(app: Hono, wiring: Pick<ServerWiring, "options" | "clientIpResolver">): void;
+export declare function installRateLimitMiddleware(app: Hono, wiring: Pick<ServerWiring, "options" | "rateLimitResolver" | "rateLimitMiddlewareRequested" | "clientIpResolver" | "observability">): MiddlewareHandler | undefined;
+export declare function installObservability(app: Hono, observability: ObservabilityProvider): void;
+export declare function installPiiLeakGuard(app: Hono): void;
+export type AuthGuardChain = {
+    readonly tenantLifecycleResolver: TenantLifecycleStatusResolver | undefined;
+    readonly sessionOnlyHttpRouteGuards: readonly MiddlewareHandler[];
+};
+export declare function installAuthGuardChain(app: Hono, wiring: Pick<ServerWiring, "options" | "jwt" | "baseDb">, scope: {
+    readonly isPublicApiRequest: PublicApiRequestMatcher;
+    readonly globalRateLimitGuard: MiddlewareHandler | undefined;
+}): AuthGuardChain;

package/dist/api/server-middleware.js

@@ -0,0 +1,211 @@
+import { resolveTenantLifecyclePlugin } from "../pipeline/active-membership.js";
+import { authEndpointRateLimit, globalIpRateLimit } from "../rate-limit/index.js";
+import { authMiddleware, getUser } from "./auth-middleware.js";
+import { assertSessionCallbacksPaired } from "./auth-routes.js";
+import { csrfMiddleware } from "./csrf-middleware.js";
+import { observabilityMiddleware } from "./observability-middleware.js";
+import { assertOriginGuardConfig, normalizeOrigin, resolveOriginGuard, } from "./origin-middleware.js";
+import { patRouteGuard } from "./pat-route-guard.js";
+import { piiCiphertextResponseGuard } from "./pii-leak-guard.js";
+import { requestIdMiddleware } from "./request-id-middleware.js";
+import { resolveSessionCookies, sessionCookiesMiddleware, } from "./session-cookies.js";
+export function installSessionCookies(app, auth) {
+    // Resolved once; auth routes, auth/csrf middleware and the tenant-cookie
+    // helpers read the cookie names from the request context.
+    const sessionCookies = resolveSessionCookies({
+        secureCookies: auth?.secureCookies,
+        cookieDomain: auth?.cookieDomain,
+        retiredCookieDomains: auth?.retiredCookieDomains,
+    });
+    app.use("*", sessionCookiesMiddleware(sessionCookies));
+    return sessionCookies;
+}
+export function installRequestId(app, wiring) {
+    const { options, clientIpResolver } = wiring;
+    app.use("/api/*", requestIdMiddleware({
+        resolver: clientIpResolver,
+        ...(options.errorDocs && { errorDocs: options.errorDocs }),
+    }));
+}
+export function installRateLimitMiddleware(app, wiring) {
+    const { options, rateLimitResolver, clientIpResolver, observability } = wiring;
+    // L1/L2 rate-limit middleware run BEFORE auth so an unauthenticated
+    // flood can't even reach the JWT-verify code path. Wired only when
+    // the caller passed `rateLimit.global` or `rateLimit.auth`. The
+    // resolver is the auto-wired one (or `context.rateLimit` if set);
+    // boot-fails loudly when the caller asked for middleware without a
+    // working Redis to back it.
+    let globalRateLimitGuard;
+    if (wiring.rateLimitMiddlewareRequested) {
+        if (!rateLimitResolver) {
+            throw new Error("rateLimit middleware requested but no resolver available — pass `context.redis` " +
+                "or `context.rateLimit` so the resolver can be built.");
+        }
+        if (options.rateLimit?.global) {
+            globalRateLimitGuard = globalIpRateLimit({
+                ...options.rateLimit.global,
+                resolver: rateLimitResolver,
+                clientIpResolver,
+                meter: observability.meter,
+            });
+            app.use("/api/*", globalRateLimitGuard);
+        }
+        if (options.rateLimit?.auth) {
+            const { path: l2Path = "/api/auth/*", ...l2Opts } = options.rateLimit.auth;
+            app.use(l2Path, authEndpointRateLimit({ ...l2Opts, resolver: rateLimitResolver, clientIpResolver }));
+        }
+    }
+    return globalRateLimitGuard;
+}
+export function installObservability(app, observability) {
+    // Observability span wraps everything that follows (auth, routes).
+    // Must come AFTER request-id (so span can carry the id) and BEFORE auth
+    // (so auth-verify can be a child span once we instrument it in v2).
+    app.use("/api/*", observabilityMiddleware({
+        tracer: observability.tracer,
+        meter: observability.meter,
+    }));
+}
+export function installPiiLeakGuard(app) {
+    // Tripwire: a kumiko-pii: ciphertext in a JSON response is always a bug
+    // (raw read leaked past a decrypt) — dev fails loud, prod redacts.
+    app.use("/api/*", piiCiphertextResponseGuard());
+}
+export function installAuthGuardChain(app, wiring, scope) {
+    const { options, jwt, baseDb } = wiring;
+    const { isPublicApiRequest, globalRateLimitGuard } = scope;
+    // Auth middleware skips public paths (login, health) — those routes need
+    // to be callable without a valid JWT. Every other /api/* request requires
+    // a token (or, when anonymousAccess is wired, falls through as anonymous).
+    // A session-checker is forwarded when the auth-config wires one, so the
+    // middleware can reject revoked sids on every request.
+    // Mounting a tenantLifecycleStatus provider is what turns the 410 on, so no
+    // entrypoint can forget the wiring; `??` short-circuits, so an explicit
+    // auth.resolveTenantLifecycleStatus remains the override.
+    const tenantLifecycleResolver = options.auth?.resolveTenantLifecycleStatus ??
+        deriveTenantLifecycleResolver(options.registry, baseDb);
+    // sessionOnlyGuard deliberately does NOT get this — its callers have no
+    // anonymousAccess fallback, so a foreign-origin cookie there must keep
+    // failing through the sibling originMiddleware 403.
+    const normalizedForeignCookieOrigins = options.auth?.allowedOrigins?.length
+        ? new Set(options.auth.allowedOrigins.map(normalizeOrigin))
+        : undefined;
+    const jwtGuard = buildJwtGuard(options, jwt, tenantLifecycleResolver, normalizedForeignCookieOrigins);
+    useOnProtectedApiPaths(app, isPublicApiRequest, jwtGuard);
+    // Fail-closed PAT scoping: a PAT-authenticated caller (user.pat set by
+    // jwtGuard's tokenVerifier above) may only reach the dispatcher routes —
+    // everywhere else on /api/* is off-limits regardless of granted scopes.
+    const patRouteGuardMiddleware = patRouteGuard();
+    useOnProtectedApiPaths(app, isPublicApiRequest, patRouteGuardMiddleware);
+    // Without anonymousAccess a missing token 401s instead of falling through as anonymous.
+    const sessionOnlyGuard = buildSessionOnlyGuard(options, jwt, tenantLifecycleResolver);
+    // PAT rate limiting — runs AFTER the auth guard so the resolved principal is
+    // available. Only PAT-authenticated requests are counted (keyed by token id);
+    // cookie/JWT users pass through untouched. In-memory limiter is per-instance
+    // (see run-prod-app) — a multi-node deployment wanting a shared counter swaps
+    // in a Redis-backed LoginRateLimiter.
+    const patRateLimiter = options.auth?.patRateLimiter;
+    const patRateLimitGuard = patRateLimiter ? buildPatRateLimitGuard(patRateLimiter) : undefined;
+    if (patRateLimitGuard) {
+        useOnProtectedApiPaths(app, isPublicApiRequest, patRateLimitGuard);
+    }
+    // Origin-allowlist guard — additional CSRF-hardening for deployments that
+    // widen the auth cookie across subdomains (auth.cookieDomain). Registered
+    // when allowedOrigins is non-empty, or with host-only cookies when
+    // auth.publicOrigin is known (see resolveOriginGuard), with the same /api/* + public-skip
+    // scope as the CSRF guard and BEFORE it, so a disallowed cross-site POST
+    // surfaces as `origin_not_allowed` rather than `csrf_token_mismatch`. Fails
+    // closed (assertOriginGuardConfig throws) when a wide cookieDomain is set
+    // without an allowlist and without an explicit opt-out — that config is the
+    // unguarded-subdomain-XSS footgun, not a warn-and-continue case.
+    assertOriginGuardConfig(options.auth);
+    assertSessionCallbacksPaired(options.auth);
+    const originGuard = resolveOriginGuard(options.auth);
+    if (originGuard) {
+        useOnProtectedApiPaths(app, isPublicApiRequest, originGuard);
+    }
+    // Double-submit CSRF guard — runs only on cookie-authenticated,
+    // state-changing requests (POST/PUT/PATCH/DELETE). The guard reads the
+    // authTransport flag set by authMiddleware, so public paths (no auth)
+    // and bearer-authenticated paths (no cookie vector) fall straight
+    // through. Must be registered AFTER the auth middleware above so the
+    // flag is populated; registered for the same scope so /api/* routes
+    // are covered uniformly.
+    const csrfGuard = csrfMiddleware();
+    useOnProtectedApiPaths(app, isPublicApiRequest, csrfGuard);
+    // No PAT rate-limit here: patRouteGuardMiddleware rejects every PAT on httpRoutes before it could count.
+    // httpRoutes sit outside /api/*, so the pre-auth /api/* middlewares do not run for them: the
+    // global IP limit (an unauthenticated flood must not reach JWT verify / session checks) and the
+    // PII ciphertext tripwire are re-attached here. requestId, body limit and observability are not.
+    const sessionOnlyHttpRouteGuards = [
+        ...(globalRateLimitGuard ? [globalRateLimitGuard] : []),
+        piiCiphertextResponseGuard(),
+        sessionOnlyGuard,
+        patRouteGuardMiddleware,
+        ...(originGuard ? [originGuard] : []),
+        csrfGuard,
+    ];
+    return { tenantLifecycleResolver, sessionOnlyHttpRouteGuards };
+}
+function useOnProtectedApiPaths(app, isPublicApiRequest, guard) {
+    app.use("/api/*", async (c, next) => {
+        if (isPublicApiRequest(c))
+            return next();
+        return guard(c, next);
+    });
+}
+function collectTenantlessAnonymousWriteQns(registry) {
+    return new Set([...registry.getAllWriteHandlers()]
+        .filter(([, handler]) => handler.tenantlessAnonymous === true)
+        .map(([qn]) => qn));
+}
+function buildJwtGuard(options, jwt, tenantLifecycleResolver, normalizedForeignCookieOrigins) {
+    const tenantlessAnonymousQns = collectTenantlessAnonymousWriteQns(options.registry);
+    return authMiddleware(jwt, {
+        ...(tenantlessAnonymousQns.size > 0
+            ? { isTenantlessAnonymousWrite: (qn) => tenantlessAnonymousQns.has(qn) }
+            : {}),
+        ...(options.auth?.sessionChecker ? { sessionChecker: options.auth.sessionChecker } : {}),
+        ...(options.auth?.tokenVerifier ? { tokenVerifier: options.auth.tokenVerifier } : {}),
+        ...(tenantLifecycleResolver ? { resolveTenantLifecycleStatus: tenantLifecycleResolver } : {}),
+        ...(options.anonymousAccess ? { anonymousAccess: options.anonymousAccess } : {}),
+        ...(normalizedForeignCookieOrigins
+            ? { foreignCookieOrigins: normalizedForeignCookieOrigins }
+            : {}),
+    });
+}
+function buildSessionOnlyGuard(options, jwt, tenantLifecycleResolver) {
+    return authMiddleware(jwt, {
+        ...(options.auth?.sessionChecker ? { sessionChecker: options.auth.sessionChecker } : {}),
+        ...(options.auth?.tokenVerifier ? { tokenVerifier: options.auth.tokenVerifier } : {}),
+        ...(tenantLifecycleResolver ? { resolveTenantLifecycleStatus: tenantLifecycleResolver } : {}),
+    });
+}
+// Must run after the auth guard so getUser(c) carries the PAT.
+function buildPatRateLimitGuard(patRateLimiter) {
+    return async (c, next) => {
+        const pat = getUser(c)?.pat;
+        if (pat && !(await patRateLimiter.check(pat.tokenId))) {
+            return c.json({
+                error: {
+                    code: "pat_rate_limited",
+                    httpStatus: 429,
+                    message: "personal access token rate limit exceeded",
+                    i18nKey: "auth.errors.patRateLimited",
+                },
+            }, 429);
+        }
+        return next();
+    };
+}
+function deriveTenantLifecycleResolver(registry, db) {
+    const plugin = resolveTenantLifecyclePlugin(registry, "buildServer");
+    if (!plugin)
+        return undefined;
+    if (!db) {
+        throw new Error("[kumiko] a tenantLifecycleStatus provider is mounted (tenant-lifecycle) but context.db is " +
+            "missing — the request-level teardown gate needs a DbConnection. Pass context.db, or wire " +
+            "auth.resolveTenantLifecycleStatus explicitly.");
+    }
+    return (tenantId) => plugin.resolveStatus(tenantId, { db });
+}

package/dist/api/server-routes.d.ts

@@ -0,0 +1,19 @@
+import type { Hono, MiddlewareHandler } from "hono";
+import type { HttpRouteMethod, SessionUser, TenantId } from "../engine/types/index.ts";
+import type { Dispatcher } from "../pipeline/dispatcher.ts";
+import { type ClientIpResolver } from "./client-ip.ts";
+import type { ServerOptions } from "./server.ts";
+import type { ServerWiring } from "./server-wiring.ts";
+import type { ResolvedSessionCookies } from "./session-cookies.ts";
+export declare function mountOperationalRoutes(app: Hono, wiring: Pick<ServerWiring, "options" | "baseDb" | "eventConsumers" | "observability" | "bootLog">): void;
+export declare function mountAuthRoutes(app: Hono, wiring: Pick<ServerWiring, "options" | "dispatcher" | "jwt" | "clientIpResolver">, sessionCookies: ResolvedSessionCookies): void;
+export declare function mountClientErrorRoute(app: Hono, wiring: Pick<ServerWiring, "rateLimitResolver" | "tracedRedis" | "clientIpResolver" | "observability" | "jwt">): void;
+export declare function mountDispatcherRoutes(app: Hono, wiring: Pick<ServerWiring, "options" | "dispatcher" | "sseBroker">): void;
+export declare function mountSchemaRoute(app: Hono, options: Pick<ServerOptions, "registry" | "dispatcherOptions" | "context">): void;
+export declare function mountFileRoutes(app: Hono, wiring: Pick<ServerWiring, "options" | "dispatcher" | "fileProviderResolver" | "rateLimitResolver" | "tracedRedis">): void;
+export declare function mountFeatureHttpRoutes(app: Hono, wiring: Pick<ServerWiring, "options" | "dispatcher" | "clientIpResolver" | "rateLimitResolver" | "observability">, sessionOnlyHttpRouteGuards: readonly MiddlewareHandler[]): void;
+export declare function installNoRouteMatchMarker(app: Hono): void;
+export declare function mountHonoRoute(app: Hono, method: HttpRouteMethod, path: string, handler: (c: import("hono").Context<any, any>) => Response | Promise<Response>, middlewares?: readonly MiddlewareHandler[]): void;
+export declare function makeSystemQuery(c: import("hono").Context<any, any>, dispatcher: Dispatcher, clientIpResolver?: ClientIpResolver): (type: string, payload: unknown, tenantId: TenantId) => Promise<unknown>;
+export declare function isMissingOrAnonymousUser(user: SessionUser | undefined): boolean;
+export declare function unauthenticatedResponse(c: import("hono").Context): Response;