@fragno-dev/api-fragment 0.0.0-stage → 0.0.1

package/dist/node/routes.js

@@ -0,0 +1,1100 @@
+import { apiSchema } from "./schema.js";
+import { sha256Base64Url, utf8Bytes } from "./crypto.js";
+import { getSensitiveWebhookAuthValues, getWebhookAuthSecretRefs, verifyWebhookAuth } from "./webhooks/auth.js";
+import { createWebhookRequestValues, evaluateWebhookVerification } from "./webhooks/verification.js";
+import { API_OAUTH_REDIRECT_URI_QUERY_PARAMETER, apiAuthStatusSchema, apiConnectionOutputSchema, apiConnectionSlugSchema, apiConnectionsPageSchema, apiOAuthPendingSchema, apiRequestInputSchema, apiRequestOutputSchema, createApiConnectionInputSchema, createWebhookEndpointInputSchema, oauthRedirectUriSchema, oauthStartInputSchema, tokenAuthInputSchema, updateWebhookEndpointInputSchema, webhookEndpointOutputSchema, webhookRejectionCodeSchema } from "./api-types.js";
+import { assertAllowedBaseUrl, isApiAuthReady, pendingOAuthLink, projectApiAuthStatus } from "./services.js";
+import { apiFragmentDefinition } from "./definition.js";
+import { defineRoutes } from "@fragno-dev/core";
+import { isUniqueConstraintError } from "@fragno-dev/db";
+import { z } from "zod";
+import { decodeCursor } from "@fragno-dev/db/cursor";
+//#region src/routes.ts
+const CONNECTIONS_PAGE_SIZE = 50;
+const webhookEndpointsOutputSchema = z.object({ endpoints: z.array(webhookEndpointOutputSchema) });
+const oauthStartOutputSchema = z.object({
+	authorizationUrl: z.string(),
+	state: z.string()
+});
+const oauthCallbackOutputSchema = z.object({
+	authenticated: z.boolean(),
+	mode: z.string()
+});
+const logApiRouteError = (message, err) => {
+	const detail = err instanceof Error ? err.message : String(err);
+	console.error(message, detail, err);
+};
+function publicConnection(connection) {
+	return {
+		slug: connection.id.toString(),
+		name: connection.name ?? null,
+		baseUrl: connection.baseUrl,
+		authMode: connection.authMode,
+		status: connection.status,
+		createdAt: connection.createdAt,
+		updatedAt: connection.updatedAt
+	};
+}
+function connectionHookSnapshot(connection) {
+	return {
+		slug: connection.id.toString(),
+		name: connection.name ?? null,
+		baseUrl: connection.baseUrl,
+		authMode: connection.authMode,
+		status: connection.status
+	};
+}
+function webhookSecretId(endpointId, ref) {
+	return `${endpointId}:${ref}`;
+}
+function webhookEndpointAuthStorage(auth) {
+	if (auth.type === "none") return {
+		authConfig: { type: "none" },
+		secrets: []
+	};
+	if (auth.type === "bearer") return {
+		authConfig: {
+			type: "bearer",
+			tokenRef: "token"
+		},
+		secrets: [{
+			ref: "token",
+			payload: auth.token
+		}]
+	};
+	if (auth.type === "apiKey") return {
+		authConfig: {
+			type: "apiKey",
+			location: auth.location,
+			name: auth.name,
+			secretRef: "secret"
+		},
+		secrets: [{
+			ref: "secret",
+			payload: auth.secret
+		}]
+	};
+	if (auth.type === "basic") return {
+		authConfig: {
+			type: "basic",
+			usernameRef: "username",
+			passwordRef: "password"
+		},
+		secrets: [{
+			ref: "username",
+			payload: auth.username
+		}, {
+			ref: "password",
+			payload: auth.password
+		}]
+	};
+	return {
+		authConfig: {
+			type: "hmac",
+			secretRef: "secret",
+			algorithm: auth.algorithm,
+			signature: auth.signature,
+			signedPayload: auth.signedPayload
+		},
+		secrets: [{
+			ref: "secret",
+			payload: auth.secret
+		}]
+	};
+}
+function parseWebhookEndpointStatus(status) {
+	if (status === "draft" || status === "active" || status === "disabled") return status;
+	throw new Error(`Unexpected webhook endpoint status: ${status}`);
+}
+function webhookEndpointHookSnapshot(endpoint) {
+	return {
+		name: endpoint.name,
+		status: parseWebhookEndpointStatus(endpoint.status),
+		authConfig: endpoint.authConfig,
+		verification: endpoint.verification,
+		deliveryIdentity: endpoint.deliveryIdentity,
+		secretRefs: [...getWebhookAuthSecretRefs(endpoint.authConfig)]
+	};
+}
+function recordFromSearchParams(query, sensitiveQueryNames) {
+	const result = {};
+	for (const [name, value] of query.entries()) result[name] = sensitiveQueryNames.has(name) ? "[redacted]" : value;
+	return result;
+}
+function recordFromHeaders(headers, sensitiveHeaderNames) {
+	const result = {};
+	for (const [name, value] of headers.entries()) result[name] = sensitiveHeaderNames.has(name.toLowerCase()) ? "[redacted]" : value;
+	return result;
+}
+function extractWebhookDeliveryId(input) {
+	const value = input.requestValues.read(input.identity);
+	if (!value.ok) return {
+		ok: false,
+		reason: value.reason === "missing" ? "missing" : "invalid_value"
+	};
+	return normalizeWebhookDeliveryId(value.value);
+}
+function normalizeWebhookDeliveryId(value) {
+	if (typeof value !== "string" && typeof value !== "number") return value == null ? {
+		ok: false,
+		reason: "missing"
+	} : {
+		ok: false,
+		reason: "invalid_value"
+	};
+	const deliveryId = `${value}`.trim();
+	if (!deliveryId) return {
+		ok: false,
+		reason: "missing"
+	};
+	return {
+		ok: true,
+		deliveryId
+	};
+}
+async function webhookHookId(endpointId, deliveryId) {
+	return `webhook_${await sha256Base64Url(`${endpointId}\0${deliveryId}`)}`;
+}
+function webhookVerificationResponse(body) {
+	const bytes = utf8Bytes(body);
+	return new Response(bytes, {
+		status: 200,
+		headers: {
+			"content-type": "text/plain; charset=utf-8",
+			"content-length": `${bytes.byteLength}`,
+			"x-content-type-options": "nosniff"
+		}
+	});
+}
+/** Configuration writes reset delivery evidence, which then covers only the new configuration. */
+const noWebhookDeliveryEvidence = {
+	lastAcceptedAt: null,
+	lastRejectedAt: null,
+	lastRejectionCode: null
+};
+function publicWebhookEndpoint(endpoint) {
+	return {
+		id: endpoint.id.toString(),
+		name: endpoint.name,
+		status: parseWebhookEndpointStatus(endpoint.status),
+		authConfig: endpoint.authConfig,
+		verification: endpoint.verification,
+		deliveryIdentity: endpoint.deliveryIdentity,
+		secretRefs: [...getWebhookAuthSecretRefs(endpoint.authConfig)],
+		deliveries: {
+			lastAcceptedAt: endpoint.lastAcceptedAt?.toISOString() ?? null,
+			lastRejection: endpoint.lastRejectedAt === null ? null : {
+				receivedAt: endpoint.lastRejectedAt.toISOString(),
+				code: webhookRejectionCodeSchema.parse(endpoint.lastRejectionCode)
+			}
+		},
+		createdAt: endpoint.createdAt,
+		updatedAt: endpoint.updatedAt
+	};
+}
+/**
+* Records the outcome of a receive request; unknown endpoints have no row to record on. Writes skip
+* the version check, so concurrent deliveries never conflict and the last one wins.
+*/
+function recordWebhookRequestOutcome(uow, endpointId, rejection) {
+	if (rejection === "WEBHOOK_ENDPOINT_NOT_FOUND") return;
+	uow.update("webhookEndpoint", endpointId, (b) => rejection === null ? b.set({ lastAcceptedAt: b.now() }) : b.set({
+		lastRejectedAt: b.now(),
+		lastRejectionCode: rejection
+	}));
+}
+const apiRoutesFactory = defineRoutes(apiFragmentDefinition).create(({ services, defineRoute, config }) => [
+	defineRoute({
+		method: "PUT",
+		path: "/webhooks/endpoints/:endpointId",
+		inputSchema: createWebhookEndpointInputSchema,
+		outputSchema: webhookEndpointOutputSchema,
+		handler: async function({ input, pathParams }, { json }) {
+			const body = await input.valid();
+			const authStorage = webhookEndpointAuthStorage(body.auth);
+			const result = await this.handlerTx().retrieve(({ forSchema }) => forSchema(apiSchema).findFirst("webhookEndpoint", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.endpointId))).find("webhookSecret", (b) => b.whereIndex("idx_webhook_secret_endpoint_ref", (eb) => eb("endpointId", "=", pathParams.endpointId)))).mutate(({ forSchema, retrieveResult: [existing, existingSecrets] }) => {
+				const uow = forSchema(apiSchema);
+				const endpoint = {
+					id: pathParams.endpointId,
+					name: body.name,
+					status: body.status,
+					authConfig: authStorage.authConfig,
+					verification: body.verification,
+					deliveryIdentity: body.deliveryIdentity,
+					...noWebhookDeliveryEvidence,
+					createdAt: existing?.createdAt
+				};
+				if (existing) uow.update("webhookEndpoint", existing.id, (b) => b.set({
+					name: endpoint.name,
+					status: endpoint.status,
+					authConfig: endpoint.authConfig,
+					verification: endpoint.verification,
+					deliveryIdentity: endpoint.deliveryIdentity,
+					...noWebhookDeliveryEvidence,
+					updatedAt: b.now()
+				}).check());
+				else uow.create("webhookEndpoint", {
+					id: endpoint.id,
+					name: endpoint.name,
+					status: endpoint.status,
+					authConfig: endpoint.authConfig,
+					verification: endpoint.verification,
+					deliveryIdentity: endpoint.deliveryIdentity
+				});
+				const nextSecretRefs = new Set(authStorage.secrets.map((secret) => secret.ref));
+				const existingSecretsByRef = new Map(existingSecrets.map((secret) => [secret.ref, secret]));
+				for (const secret of existingSecrets) if (!nextSecretRefs.has(secret.ref)) uow.delete("webhookSecret", secret.id);
+				for (const secret of authStorage.secrets) {
+					const existingSecret = existingSecretsByRef.get(secret.ref);
+					if (existingSecret) uow.update("webhookSecret", existingSecret.id, (b) => b.set({
+						payload: secret.payload,
+						updatedAt: b.now()
+					}).check());
+					else uow.create("webhookSecret", {
+						id: webhookSecretId(pathParams.endpointId, secret.ref),
+						endpointId: pathParams.endpointId,
+						ref: secret.ref,
+						payload: secret.payload
+					});
+				}
+				uow.triggerHook("onWebhookEndpointChanged", existing ? {
+					change: "updated",
+					endpointId: pathParams.endpointId,
+					endpoint: webhookEndpointHookSnapshot(endpoint),
+					previousStatus: parseWebhookEndpointStatus(existing.status)
+				} : {
+					change: "created",
+					endpointId: pathParams.endpointId,
+					endpoint: webhookEndpointHookSnapshot(endpoint)
+				});
+				return {
+					created: !existing,
+					endpoint
+				};
+			}).execute();
+			return json(publicWebhookEndpoint(result.endpoint), result.created ? 201 : 200);
+		}
+	}),
+	defineRoute({
+		method: "GET",
+		path: "/webhooks/endpoints",
+		outputSchema: webhookEndpointsOutputSchema,
+		handler: async function(_, { json }) {
+			const [endpoints] = await this.handlerTx().retrieve(({ forSchema }) => forSchema(apiSchema).find("webhookEndpoint", (b) => b.whereIndex("primary"))).execute();
+			return json({ endpoints: endpoints.map(publicWebhookEndpoint) });
+		}
+	}),
+	defineRoute({
+		method: "GET",
+		path: "/webhooks/endpoints/:endpointId",
+		outputSchema: webhookEndpointOutputSchema,
+		errorCodes: ["WEBHOOK_ENDPOINT_NOT_FOUND"],
+		handler: async function({ pathParams }, { json, error }) {
+			const [endpoint] = await this.handlerTx().retrieve(({ forSchema }) => forSchema(apiSchema).findFirst("webhookEndpoint", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.endpointId)))).execute();
+			if (!endpoint) return error({
+				code: "WEBHOOK_ENDPOINT_NOT_FOUND",
+				message: "Webhook endpoint not found"
+			}, 404);
+			return json(publicWebhookEndpoint(endpoint));
+		}
+	}),
+	defineRoute({
+		method: "GET",
+		path: "/webhooks/endpoints/:endpointId/events",
+		errorCodes: [
+			"WEBHOOK_ENDPOINT_NOT_FOUND",
+			"WEBHOOK_ENDPOINT_DISABLED",
+			"WEBHOOK_ENDPOINT_DRAFT",
+			"WEBHOOK_AUTH_FAILED",
+			"WEBHOOK_VERIFICATION_NOT_MATCHED",
+			"WEBHOOK_VERIFICATION_RESPONSE_INVALID"
+		],
+		handler: async function({ pathParams, headers, query, rawBody, request }, { error }) {
+			const result = await this.handlerTx().retrieve(({ forSchema }) => forSchema(apiSchema).findFirst("webhookEndpoint", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.endpointId))).find("webhookSecret", (b) => b.whereIndex("idx_webhook_secret_endpoint_ref", (eb) => eb("endpointId", "=", pathParams.endpointId)))).transformRetrieve(async ([endpoint, secrets]) => {
+				if (!endpoint) return {
+					ok: false,
+					code: "WEBHOOK_ENDPOINT_NOT_FOUND"
+				};
+				if (endpoint.status === "draft") return {
+					ok: false,
+					code: "WEBHOOK_ENDPOINT_DRAFT"
+				};
+				if (endpoint.status !== "active") return {
+					ok: false,
+					code: "WEBHOOK_ENDPOINT_DISABLED"
+				};
+				if (!request) throw new Error("Webhook receive route requires a web-standard Request");
+				const secretValues = new Map(secrets.map((secret) => [secret.ref, secret.payload]));
+				if (!(await verifyWebhookAuth({
+					config: endpoint.authConfig,
+					request,
+					secrets: { get: async (ref) => secretValues.get(ref) }
+				})).ok) return {
+					ok: false,
+					code: "WEBHOOK_AUTH_FAILED"
+				};
+				const verification = evaluateWebhookVerification({
+					config: endpoint.verification,
+					method: "GET",
+					requestValues: createWebhookRequestValues({
+						headers,
+						query,
+						rawBody
+					})
+				});
+				if (verification.type === "not_verification") return {
+					ok: false,
+					code: "WEBHOOK_VERIFICATION_NOT_MATCHED"
+				};
+				if (verification.type === "invalid_response") return {
+					ok: false,
+					code: "WEBHOOK_VERIFICATION_RESPONSE_INVALID"
+				};
+				return {
+					ok: true,
+					body: verification.body
+				};
+			}).mutate(({ forSchema, retrieveResult }) => {
+				recordWebhookRequestOutcome(forSchema(apiSchema), pathParams.endpointId, retrieveResult.ok ? null : retrieveResult.code);
+				return retrieveResult;
+			}).execute();
+			if (!result.ok) {
+				if (result.code === "WEBHOOK_ENDPOINT_NOT_FOUND") return error({
+					code: result.code,
+					message: "Webhook endpoint not found"
+				}, 404);
+				if (result.code === "WEBHOOK_ENDPOINT_DISABLED") return error({
+					code: result.code,
+					message: "Webhook endpoint is disabled"
+				}, 409);
+				if (result.code === "WEBHOOK_ENDPOINT_DRAFT") return error({
+					code: result.code,
+					message: "Webhook endpoint is not configured yet"
+				}, 409);
+				if (result.code === "WEBHOOK_AUTH_FAILED") return error({
+					code: result.code,
+					message: "Webhook authentication failed"
+				}, 401);
+				if (result.code === "WEBHOOK_VERIFICATION_RESPONSE_INVALID") return error({
+					code: result.code,
+					message: "Webhook challenge is invalid"
+				}, 400);
+				return error({
+					code: result.code,
+					message: "Webhook verification request not found"
+				}, 404);
+			}
+			return webhookVerificationResponse(result.body);
+		}
+	}),
+	defineRoute({
+		method: "POST",
+		path: "/webhooks/endpoints/:endpointId/events",
+		errorCodes: [
+			"WEBHOOK_ENDPOINT_NOT_FOUND",
+			"WEBHOOK_ENDPOINT_DISABLED",
+			"WEBHOOK_ENDPOINT_DRAFT",
+			"WEBHOOK_AUTH_FAILED",
+			"WEBHOOK_VERIFICATION_RESPONSE_INVALID",
+			"WEBHOOK_BODY_INVALID",
+			"WEBHOOK_DELIVERY_ID_MISSING",
+			"WEBHOOK_DELIVERY_ID_INVALID"
+		],
+		handler: async function({ pathParams, headers, query, rawBody, request }, { json, error }) {
+			let result;
+			try {
+				result = await this.handlerTx().retrieve(({ forSchema }) => forSchema(apiSchema).findFirst("webhookEndpoint", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.endpointId))).find("webhookSecret", (b) => b.whereIndex("idx_webhook_secret_endpoint_ref", (eb) => eb("endpointId", "=", pathParams.endpointId)))).transformRetrieve(async ([endpoint, secrets]) => {
+					if (!endpoint) return {
+						ok: false,
+						code: "WEBHOOK_ENDPOINT_NOT_FOUND"
+					};
+					if (endpoint.status === "draft") return {
+						ok: false,
+						code: "WEBHOOK_ENDPOINT_DRAFT"
+					};
+					if (endpoint.status !== "active") return {
+						ok: false,
+						code: "WEBHOOK_ENDPOINT_DISABLED"
+					};
+					if (!request) throw new Error("Webhook receive route requires a web-standard Request");
+					const authConfig = endpoint.authConfig;
+					const secretValues = new Map(secrets.map((secret) => [secret.ref, secret.payload]));
+					if (!(await verifyWebhookAuth({
+						config: authConfig,
+						request,
+						secrets: { get: async (ref) => secretValues.get(ref) }
+					})).ok) return {
+						ok: false,
+						code: "WEBHOOK_AUTH_FAILED"
+					};
+					const requestValues = createWebhookRequestValues({
+						headers,
+						query,
+						rawBody
+					});
+					const verification = evaluateWebhookVerification({
+						config: endpoint.verification,
+						method: "POST",
+						requestValues
+					});
+					if (verification.type === "invalid_response") return {
+						ok: false,
+						code: "WEBHOOK_VERIFICATION_RESPONSE_INVALID"
+					};
+					if (verification.type === "response") return {
+						ok: true,
+						type: "verification",
+						body: verification.body
+					};
+					const body = requestValues.jsonBody();
+					if (!body.ok) return {
+						ok: false,
+						code: "WEBHOOK_BODY_INVALID"
+					};
+					const deliveryId = extractWebhookDeliveryId({
+						identity: endpoint.deliveryIdentity,
+						requestValues
+					});
+					if (!deliveryId.ok) return {
+						ok: false,
+						code: deliveryId.reason === "missing" ? "WEBHOOK_DELIVERY_ID_MISSING" : "WEBHOOK_DELIVERY_ID_INVALID"
+					};
+					return {
+						ok: true,
+						type: "delivery",
+						authConfig,
+						deliveryId: deliveryId.deliveryId,
+						hookId: await webhookHookId(pathParams.endpointId, deliveryId.deliveryId),
+						body: body.body
+					};
+				}).mutate(({ forSchema, retrieveResult }) => {
+					const uow = forSchema(apiSchema);
+					recordWebhookRequestOutcome(uow, pathParams.endpointId, retrieveResult.ok ? null : retrieveResult.code);
+					if (!retrieveResult.ok || retrieveResult.type === "verification") return retrieveResult;
+					const sensitiveValues = getSensitiveWebhookAuthValues(retrieveResult.authConfig);
+					const sensitiveHeaderNames = new Set(sensitiveValues.flatMap((value) => value.location === "header" ? [value.name.toLowerCase()] : []));
+					const sensitiveQueryNames = new Set(sensitiveValues.flatMap((value) => value.location === "query" ? [value.name] : []));
+					uow.triggerHook("onWebhookReceived", {
+						endpointId: pathParams.endpointId,
+						deliveryId: retrieveResult.deliveryId,
+						hookId: retrieveResult.hookId,
+						receivedAt: (/* @__PURE__ */ new Date()).toISOString(),
+						headers: recordFromHeaders(headers, sensitiveHeaderNames),
+						query: recordFromSearchParams(query, sensitiveQueryNames),
+						rawBody: rawBody ?? "",
+						body: retrieveResult.body,
+						contentType: headers.get("content-type")
+					}, { id: retrieveResult.hookId });
+					return {
+						ok: true,
+						type: "delivery"
+					};
+				}).execute();
+			} catch (err) {
+				if (isUniqueConstraintError(err)) return json({ accepted: true }, 202);
+				throw err;
+			}
+			if (!result.ok) {
+				if (result.code === "WEBHOOK_ENDPOINT_NOT_FOUND") return error({
+					code: result.code,
+					message: "Webhook endpoint not found"
+				}, 404);
+				if (result.code === "WEBHOOK_ENDPOINT_DISABLED") return error({
+					code: result.code,
+					message: "Webhook endpoint is disabled"
+				}, 409);
+				if (result.code === "WEBHOOK_ENDPOINT_DRAFT") return error({
+					code: result.code,
+					message: "Webhook endpoint is not configured yet"
+				}, 409);
+				if (result.code === "WEBHOOK_VERIFICATION_RESPONSE_INVALID") return error({
+					code: result.code,
+					message: "Webhook challenge is invalid"
+				}, 400);
+				if (result.code === "WEBHOOK_BODY_INVALID") return error({
+					code: result.code,
+					message: "Webhook body must be a JSON object"
+				}, 400);
+				if (result.code === "WEBHOOK_DELIVERY_ID_MISSING") return error({
+					code: result.code,
+					message: "Webhook delivery ID is missing"
+				}, 400);
+				if (result.code === "WEBHOOK_DELIVERY_ID_INVALID") return error({
+					code: result.code,
+					message: "Webhook delivery ID is invalid"
+				}, 400);
+				return error({
+					code: result.code,
+					message: "Webhook authentication failed"
+				}, 401);
+			}
+			if (result.type === "verification") return webhookVerificationResponse(result.body);
+			return json({ accepted: true }, 202);
+		}
+	}),
+	defineRoute({
+		method: "PATCH",
+		path: "/webhooks/endpoints/:endpointId",
+		inputSchema: updateWebhookEndpointInputSchema,
+		outputSchema: webhookEndpointOutputSchema,
+		errorCodes: ["WEBHOOK_ENDPOINT_NOT_FOUND"],
+		handler: async function({ input, pathParams }, { json, error }) {
+			const body = await input.valid();
+			const authStorage = body.auth ? webhookEndpointAuthStorage(body.auth) : null;
+			const result = await this.handlerTx().retrieve(({ forSchema }) => forSchema(apiSchema).findFirst("webhookEndpoint", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.endpointId))).find("webhookSecret", (b) => b.whereIndex("idx_webhook_secret_endpoint_ref", (eb) => eb("endpointId", "=", pathParams.endpointId)))).mutate(({ forSchema, retrieveResult: [endpoint, secrets] }) => {
+				if (!endpoint) return { found: false };
+				const uow = forSchema(apiSchema);
+				const authConfig = authStorage?.authConfig ?? endpoint.authConfig;
+				const verification = body.verification ?? endpoint.verification;
+				const deliveryIdentity = body.deliveryIdentity ?? endpoint.deliveryIdentity;
+				const next = {
+					id: endpoint.id,
+					name: body.name ?? endpoint.name,
+					status: body.status ?? endpoint.status,
+					authConfig,
+					verification,
+					deliveryIdentity,
+					...noWebhookDeliveryEvidence,
+					createdAt: endpoint.createdAt
+				};
+				uow.update("webhookEndpoint", endpoint.id, (b) => b.set({
+					name: next.name,
+					status: next.status,
+					authConfig,
+					verification,
+					deliveryIdentity,
+					...noWebhookDeliveryEvidence,
+					updatedAt: b.now()
+				}).check());
+				if (authStorage) {
+					for (const secret of secrets) uow.delete("webhookSecret", secret.id);
+					for (const secret of authStorage.secrets) uow.create("webhookSecret", {
+						id: webhookSecretId(pathParams.endpointId, secret.ref),
+						endpointId: pathParams.endpointId,
+						ref: secret.ref,
+						payload: secret.payload
+					});
+				}
+				uow.triggerHook("onWebhookEndpointChanged", {
+					change: "updated",
+					endpointId: pathParams.endpointId,
+					endpoint: webhookEndpointHookSnapshot(next),
+					previousStatus: parseWebhookEndpointStatus(endpoint.status)
+				});
+				return {
+					found: true,
+					endpoint: next
+				};
+			}).execute();
+			if (!result.found) return error({
+				code: "WEBHOOK_ENDPOINT_NOT_FOUND",
+				message: "Webhook endpoint not found"
+			}, 404);
+			return json(publicWebhookEndpoint(result.endpoint));
+		}
+	}),
+	defineRoute({
+		method: "DELETE",
+		path: "/webhooks/endpoints/:endpointId",
+		handler: async function({ pathParams }, { empty }) {
+			await this.handlerTx().retrieve(({ forSchema }) => forSchema(apiSchema).findFirst("webhookEndpoint", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.endpointId))).find("webhookSecret", (b) => b.whereIndex("idx_webhook_secret_endpoint_ref", (eb) => eb("endpointId", "=", pathParams.endpointId)))).mutate(({ forSchema, retrieveResult: [endpoint, secrets] }) => {
+				if (!endpoint) return { deleted: false };
+				const uow = forSchema(apiSchema);
+				for (const secret of secrets) uow.delete("webhookSecret", secret.id);
+				uow.delete("webhookEndpoint", endpoint.id);
+				uow.triggerHook("onWebhookEndpointChanged", {
+					change: "deleted",
+					endpointId: pathParams.endpointId
+				});
+				return { deleted: true };
+			}).execute();
+			return empty(204);
+		}
+	}),
+	defineRoute({
+		method: "PUT",
+		path: "/connections/:slug",
+		inputSchema: createApiConnectionInputSchema,
+		outputSchema: apiConnectionOutputSchema,
+		errorCodes: [
+			"CONNECTION_EXISTS",
+			"BASE_URL_NOT_ALLOWED",
+			"INVALID_SLUG"
+		],
+		handler: async function({ input, pathParams }, { json, error }) {
+			const slug = apiConnectionSlugSchema.safeParse(pathParams.slug);
+			if (!slug.success) return error({
+				code: "INVALID_SLUG",
+				message: slug.error.issues[0].message
+			}, 400);
+			const body = await input.valid();
+			try {
+				assertAllowedBaseUrl(body.baseUrl, config);
+			} catch (err) {
+				logApiRouteError("API connection base URL rejected", err);
+				return error({
+					code: "BASE_URL_NOT_ALLOWED",
+					message: "API base URL is not allowed"
+				}, 400);
+			}
+			const payload = body.auth.type === "none" ? void 0 : JSON.stringify(body.auth);
+			if ((await this.handlerTx().retrieve(({ forSchema }) => forSchema(apiSchema).findFirst("api_connection", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug)))).mutate(({ forSchema, retrieveResult: [existing] }) => {
+				if (existing) return { exists: true };
+				const uow = forSchema(apiSchema);
+				uow.create("api_connection", {
+					id: pathParams.slug,
+					name: body.name ?? null,
+					baseUrl: body.baseUrl,
+					authMode: body.auth.type,
+					status: "active"
+				});
+				if (payload) uow.create("secret", {
+					id: `${pathParams.slug}:auth`,
+					connectionId: pathParams.slug,
+					kind: "auth",
+					payload,
+					expiresAt: null
+				});
+				uow.triggerHook("onConnectionChanged", {
+					connectionId: pathParams.slug,
+					connection: connectionHookSnapshot({
+						id: pathParams.slug,
+						name: body.name ?? null,
+						baseUrl: body.baseUrl,
+						authMode: body.auth.type,
+						status: "active"
+					})
+				});
+				uow.triggerHook("onConnectionReadinessChanged", {
+					connectionId: pathParams.slug,
+					ready: isApiAuthReady(body.auth.type, payload === void 0 ? void 0 : {
+						payload,
+						expiresAt: null
+					})
+				});
+				return { exists: false };
+			}).execute()).exists) return error({
+				code: "CONNECTION_EXISTS",
+				message: "API connection already exists"
+			}, 409);
+			return json(publicConnection({
+				id: pathParams.slug,
+				name: body.name ?? null,
+				baseUrl: body.baseUrl,
+				authMode: body.auth.type,
+				status: "active"
+			}), 201);
+		}
+	}),
+	defineRoute({
+		method: "GET",
+		path: "/connections",
+		queryParameters: ["cursor"],
+		outputSchema: apiConnectionsPageSchema,
+		errorCodes: ["INVALID_CURSOR"],
+		handler: async function({ query }, { json, error }) {
+			let cursor = null;
+			const rawCursor = query.get("cursor");
+			if (rawCursor) try {
+				cursor = decodeCursor(rawCursor);
+				if (cursor.indexName !== "_primary" || cursor.orderDirection !== "asc" || cursor.pageSize !== CONNECTIONS_PAGE_SIZE || typeof cursor.indexValues["id"] !== "string") throw new Error("Connection cursor does not match this listing");
+			} catch {
+				return error({
+					code: "INVALID_CURSOR",
+					message: "Invalid connection cursor"
+				}, 400);
+			}
+			const [page] = await this.handlerTx().retrieve(({ forSchema }) => forSchema(apiSchema).findWithCursor("api_connection", (b) => {
+				const ordered = b.whereIndex("primary").orderByIndex("primary", "asc").pageSize(CONNECTIONS_PAGE_SIZE);
+				return cursor ? ordered.after(cursor) : ordered;
+			})).execute();
+			return json({
+				connections: page.items.map(publicConnection),
+				cursor: page.cursor?.encode() ?? null
+			});
+		}
+	}),
+	defineRoute({
+		method: "GET",
+		path: "/connections/:slug",
+		outputSchema: apiConnectionOutputSchema,
+		errorCodes: ["CONNECTION_NOT_FOUND"],
+		handler: async function({ pathParams }, { json, error }) {
+			const [connection] = await this.handlerTx().retrieve(({ forSchema }) => forSchema(apiSchema).findFirst("api_connection", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug)))).execute();
+			if (!connection) return error({
+				code: "CONNECTION_NOT_FOUND",
+				message: "API connection not found"
+			}, 404);
+			return json(publicConnection(connection));
+		}
+	}),
+	defineRoute({
+		method: "PUT",
+		path: "/connections/:slug/configuration",
+		inputSchema: createApiConnectionInputSchema,
+		outputSchema: apiConnectionOutputSchema,
+		errorCodes: ["CONNECTION_NOT_FOUND", "BASE_URL_NOT_ALLOWED"],
+		handler: async function({ input, pathParams }, { json, error }) {
+			const body = await input.valid();
+			try {
+				assertAllowedBaseUrl(body.baseUrl, config);
+			} catch (err) {
+				logApiRouteError("API connection base URL rejected", err);
+				return error({
+					code: "BASE_URL_NOT_ALLOWED",
+					message: "API base URL is not allowed"
+				}, 400);
+			}
+			const payload = body.auth.type === "none" ? null : JSON.stringify(body.auth);
+			const result = await this.handlerTx().retrieve(({ forSchema }) => forSchema(apiSchema).findFirst("api_connection", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug))).find("secret", (b) => b.whereIndex("idx_secret_connection_kind", (eb) => eb("connectionId", "=", pathParams.slug))).find("oauthState", (b) => b.whereIndex("idx_oauth_state_connection", (eb) => eb("connectionId", "=", pathParams.slug)))).mutate(({ forSchema, retrieveResult: [connection, secrets, states] }) => {
+				if (!connection) return { connection: null };
+				const uow = forSchema(apiSchema);
+				const replaced = {
+					...connection,
+					name: body.name ?? null,
+					baseUrl: body.baseUrl,
+					authMode: body.auth.type
+				};
+				uow.update("api_connection", connection.id, (b) => b.set({
+					name: replaced.name,
+					baseUrl: replaced.baseUrl,
+					authMode: replaced.authMode,
+					updatedAt: b.now()
+				}).check());
+				const authSecret = secrets.find((secret) => secret.kind === "auth");
+				for (const secret of secrets) if (secret !== authSecret || payload === null) uow.delete("secret", secret.id);
+				if (payload !== null) if (authSecret) uow.update("secret", authSecret.id, (b) => b.set({
+					payload,
+					expiresAt: null,
+					updatedAt: b.now()
+				}).check());
+				else uow.create("secret", {
+					id: `${pathParams.slug}:auth`,
+					connectionId: pathParams.slug,
+					kind: "auth",
+					payload,
+					expiresAt: null
+				});
+				for (const state of states) uow.delete("oauthState", state.id);
+				uow.triggerHook("onConnectionChanged", {
+					connectionId: pathParams.slug,
+					connection: connectionHookSnapshot(replaced)
+				});
+				const ready = isApiAuthReady(replaced.authMode, payload === null ? void 0 : {
+					payload,
+					expiresAt: null
+				});
+				if (ready !== isApiAuthReady(connection.authMode, authSecret)) uow.triggerHook("onConnectionReadinessChanged", {
+					connectionId: pathParams.slug,
+					ready
+				});
+				return { connection: replaced };
+			}).execute();
+			if (!result.connection) return error({
+				code: "CONNECTION_NOT_FOUND",
+				message: "API connection not found"
+			}, 404);
+			return json(publicConnection(result.connection));
+		}
+	}),
+	defineRoute({
+		method: "DELETE",
+		path: "/connections/:slug",
+		errorCodes: ["CONNECTION_NOT_FOUND"],
+		handler: async function({ pathParams }, { empty, error }) {
+			if (!(await this.handlerTx().retrieve(({ forSchema }) => forSchema(apiSchema).findFirst("api_connection", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug))).find("secret", (b) => b.whereIndex("idx_secret_connection_kind", (eb) => eb("connectionId", "=", pathParams.slug))).find("oauthState", (b) => b.whereIndex("idx_oauth_state_connection", (eb) => eb("connectionId", "=", pathParams.slug)))).mutate(({ forSchema, retrieveResult: [connection, secrets, states] }) => {
+				if (!connection) return { deleted: false };
+				const uow = forSchema(apiSchema);
+				for (const secret of secrets) uow.delete("secret", secret.id);
+				for (const state of states) uow.delete("oauthState", state.id);
+				uow.delete("api_connection", connection.id);
+				uow.triggerHook("onConnectionDeleted", {
+					connectionId: pathParams.slug,
+					previous: connectionHookSnapshot(connection)
+				});
+				return { deleted: true };
+			}).execute()).deleted) return error({
+				code: "CONNECTION_NOT_FOUND",
+				message: "API connection not found"
+			}, 404);
+			return empty(204);
+		}
+	}),
+	defineRoute({
+		method: "GET",
+		path: "/connections/:slug/auth/status",
+		outputSchema: apiAuthStatusSchema,
+		errorCodes: ["CONNECTION_NOT_FOUND"],
+		handler: async function({ pathParams }, { json, error }) {
+			const [connection, secret, pendingState] = await this.handlerTx().retrieve(({ forSchema }) => forSchema(apiSchema).findFirst("api_connection", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug))).findFirst("secret", (b) => b.whereIndex("idx_secret_connection_kind", (eb) => eb.and(eb("connectionId", "=", pathParams.slug), eb("kind", "=", "auth")))).findFirst("oauthState", (b) => b.whereIndex("idx_oauth_state_pending", (eb) => eb.and(eb("connectionId", "=", pathParams.slug), eb.isNull("consumedAt"), eb("expiresAt", ">", eb.now()))).orderByIndex("idx_oauth_state_pending", "desc"))).execute();
+			if (!connection) return error({
+				code: "CONNECTION_NOT_FOUND",
+				message: "API connection not found"
+			}, 404);
+			return json(projectApiAuthStatus({
+				authMode: connection.authMode,
+				authSecret: secret ?? void 0,
+				hasPendingOAuth: pendingOAuthLink(pendingState) !== null
+			}));
+		}
+	}),
+	defineRoute({
+		method: "GET",
+		path: "/connections/:slug/auth/oauth/pending",
+		outputSchema: apiOAuthPendingSchema,
+		errorCodes: ["CONNECTION_NOT_FOUND"],
+		handler: async function({ pathParams }, { json, error }) {
+			const [connection, pendingState] = await this.handlerTx().retrieve(({ forSchema }) => forSchema(apiSchema).findFirst("api_connection", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug))).findFirst("oauthState", (b) => b.whereIndex("idx_oauth_state_pending", (eb) => eb.and(eb("connectionId", "=", pathParams.slug), eb.isNull("consumedAt"), eb("expiresAt", ">", eb.now()))).orderByIndex("idx_oauth_state_pending", "desc"))).execute();
+			if (!connection) return error({
+				code: "CONNECTION_NOT_FOUND",
+				message: "API connection not found"
+			}, 404);
+			return json({ pending: pendingOAuthLink(pendingState) });
+		}
+	}),
+	defineRoute({
+		method: "POST",
+		path: "/connections/:slug/auth/token",
+		inputSchema: tokenAuthInputSchema,
+		outputSchema: apiAuthStatusSchema,
+		errorCodes: ["CONNECTION_NOT_FOUND"],
+		handler: async function({ input, pathParams }, { json, error }) {
+			const { token } = await input.valid();
+			const payload = JSON.stringify({
+				type: "bearer",
+				token
+			});
+			if (!(await this.handlerTx().retrieve(({ forSchema }) => forSchema(apiSchema).findFirst("api_connection", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug))).findFirst("secret", (b) => b.whereIndex("idx_secret_connection_kind", (eb) => eb.and(eb("connectionId", "=", pathParams.slug), eb("kind", "=", "auth"))))).mutate(({ forSchema, retrieveResult: [connection, secret] }) => {
+				if (!connection) return { found: false };
+				const uow = forSchema(apiSchema);
+				uow.update("api_connection", connection.id, (b) => b.set({
+					authMode: "bearer",
+					updatedAt: b.now()
+				}).check());
+				if (secret) uow.update("secret", secret.id, (b) => b.set({
+					payload,
+					expiresAt: null,
+					updatedAt: b.now()
+				}).check());
+				else uow.create("secret", {
+					id: `${pathParams.slug}:auth`,
+					connectionId: pathParams.slug,
+					kind: "auth",
+					payload,
+					expiresAt: null
+				});
+				const changedConnection = connectionHookSnapshot({
+					...connection,
+					authMode: "bearer"
+				});
+				uow.triggerHook("onConnectionChanged", {
+					connectionId: pathParams.slug,
+					connection: changedConnection
+				});
+				if (!isApiAuthReady(connection.authMode, secret ?? void 0)) uow.triggerHook("onConnectionReadinessChanged", {
+					connectionId: pathParams.slug,
+					ready: true
+				});
+				return { found: true };
+			}).execute()).found) return error({
+				code: "CONNECTION_NOT_FOUND",
+				message: "API connection not found"
+			}, 404);
+			return json({
+				mode: "bearer",
+				credentials: "present"
+			});
+		}
+	}),
+	defineRoute({
+		method: "POST",
+		path: "/connections/:slug/auth/oauth/start",
+		inputSchema: oauthStartInputSchema,
+		outputSchema: oauthStartOutputSchema,
+		queryParameters: [API_OAUTH_REDIRECT_URI_QUERY_PARAMETER],
+		errorCodes: [
+			"INVALID_OAUTH_REDIRECT_URI",
+			"OAUTH_REDIRECT_URI_NOT_ALLOWED",
+			"CONNECTION_NOT_FOUND",
+			"AUTH_NOT_CONFIGURED",
+			"AUTH_NOT_OAUTH",
+			"OAUTH_ERROR"
+		],
+		handler: async function({ input, pathParams, query }, { json, error }) {
+			const body = await input.valid();
+			const redirectUri = oauthRedirectUriSchema.safeParse(query.get(API_OAUTH_REDIRECT_URI_QUERY_PARAMETER));
+			if (!redirectUri.success) return error({
+				code: "INVALID_OAUTH_REDIRECT_URI",
+				message: "OAuth redirect URI must be an HTTP or HTTPS URL"
+			}, 400);
+			const oauthRedirectUri = new URL(redirectUri.data);
+			if (!config.allowedOAuthRedirectUris?.(oauthRedirectUri)) return error({
+				code: "OAUTH_REDIRECT_URI_NOT_ALLOWED",
+				message: "OAuth redirect URI is not allowed by the fragment configuration"
+			}, 400);
+			const state = `${pathParams.slug}:${crypto.randomUUID()}`;
+			try {
+				const [result] = await this.handlerTx().withServiceCalls(() => [services.startOAuth({
+					connectionId: pathParams.slug,
+					stateId: state,
+					redirectUri: oauthRedirectUri.toString(),
+					scopes: body.scopes,
+					extraAuthorizationParams: body.extraAuthorizationParams,
+					discardTokens: body.discardTokens
+				})]).execute();
+				if (!result.found) {
+					if (result.reason === "connection_not_found") return error({
+						code: "CONNECTION_NOT_FOUND",
+						message: "API connection not found"
+					}, 404);
+					if (result.reason === "auth_not_configured") return error({
+						code: "AUTH_NOT_CONFIGURED",
+						message: "API connection auth is not configured"
+					}, 400);
+					return error({
+						code: "AUTH_NOT_OAUTH",
+						message: "API connection auth is not OAuth"
+					}, 400);
+				}
+				return json({
+					authorizationUrl: result.authorizationUrl,
+					state
+				});
+			} catch (err) {
+				logApiRouteError("API OAuth start failed", err);
+				return error({
+					code: "OAUTH_ERROR",
+					message: "An authentication error occurred"
+				}, 502);
+			}
+		}
+	}),
+	defineRoute({
+		method: "GET",
+		path: "/oauth/callback",
+		outputSchema: oauthCallbackOutputSchema,
+		errorCodes: [
+			"CONNECTION_NOT_FOUND",
+			"AUTH_NOT_CONFIGURED",
+			"AUTH_NOT_OAUTH",
+			"OAUTH_ERROR",
+			"INVALID_OAUTH_STATE"
+		],
+		handler: async function({ query }, { json, error }) {
+			const code = query.get("code");
+			const stateId = query.get("state");
+			if (!code || !stateId) return error({
+				code: "INVALID_OAUTH_STATE",
+				message: "Missing OAuth code or state"
+			}, 400);
+			try {
+				const [result] = await this.handlerTx().withServiceCalls(() => [services.completeOAuthCallback({
+					stateId,
+					code
+				})]).execute();
+				if (!result.found) {
+					if (result.reason === "connection_not_found") return error({
+						code: "CONNECTION_NOT_FOUND",
+						message: "API connection not found"
+					}, 404);
+					if (result.reason === "auth_not_configured") return error({
+						code: "AUTH_NOT_CONFIGURED",
+						message: "API connection auth is not configured"
+					}, 400);
+					if (result.reason === "auth_not_oauth") return error({
+						code: "AUTH_NOT_OAUTH",
+						message: "API connection auth is not OAuth"
+					}, 400);
+					return error({
+						code: "INVALID_OAUTH_STATE",
+						message: "Invalid OAuth state"
+					}, 400);
+				}
+				return json({
+					authenticated: true,
+					mode: "oauth"
+				});
+			} catch (err) {
+				logApiRouteError("API OAuth callback failed", err);
+				return error({
+					code: "OAUTH_ERROR",
+					message: "An authentication error occurred"
+				}, 502);
+			}
+		}
+	}),
+	defineRoute({
+		method: "DELETE",
+		path: "/connections/:slug/auth",
+		outputSchema: apiAuthStatusSchema,
+		errorCodes: ["CONNECTION_NOT_FOUND"],
+		handler: async function({ pathParams }, { json, error }) {
+			const result = await this.handlerTx().retrieve(({ forSchema }) => forSchema(apiSchema).findFirst("api_connection", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug))).find("secret", (b) => b.whereIndex("idx_secret_connection_kind", (eb) => eb("connectionId", "=", pathParams.slug))).find("oauthState", (b) => b.whereIndex("idx_oauth_state_connection", (eb) => eb("connectionId", "=", pathParams.slug)))).mutate(({ forSchema, retrieveResult: [connection, secrets, states] }) => {
+				if (!connection) return { found: false };
+				const uow = forSchema(apiSchema);
+				for (const secret of secrets) uow.delete("secret", secret.id);
+				for (const state of states) uow.delete("oauthState", state.id);
+				uow.update("api_connection", connection.id, (b) => b.set({ updatedAt: b.now() }).check());
+				uow.triggerHook("onConnectionChanged", {
+					connectionId: pathParams.slug,
+					connection: connectionHookSnapshot(connection)
+				});
+				const authSecret = secrets.find((secret) => secret.kind === "auth");
+				const ready = isApiAuthReady(connection.authMode, void 0);
+				if (ready !== isApiAuthReady(connection.authMode, authSecret)) uow.triggerHook("onConnectionReadinessChanged", {
+					connectionId: pathParams.slug,
+					ready
+				});
+				return {
+					found: true,
+					status: projectApiAuthStatus({
+						authMode: connection.authMode,
+						authSecret: void 0,
+						hasPendingOAuth: false
+					})
+				};
+			}).execute();
+			if (!result.found) return error({
+				code: "CONNECTION_NOT_FOUND",
+				message: "API connection not found"
+			}, 404);
+			return json(result.status);
+		}
+	}),
+	defineRoute({
+		method: "POST",
+		path: "/connections/:slug/request",
+		inputSchema: apiRequestInputSchema,
+		outputSchema: apiRequestOutputSchema,
+		handler: async function({ input, pathParams }, { json }) {
+			const request = await input.valid();
+			const [result] = await this.handlerTx().withServiceCalls(() => [services.executeApiRequest({
+				connectionId: pathParams.slug,
+				request
+			})]).execute();
+			if (!result.found) {
+				if (result.reason === "connection_disabled") return json({
+					ok: false,
+					response: null,
+					error: {
+						code: "CONNECTION_DISABLED",
+						message: "API connection is disabled"
+					}
+				});
+				return json({
+					ok: false,
+					response: null,
+					error: {
+						code: "CONNECTION_NOT_FOUND",
+						message: "API connection not found"
+					}
+				});
+			}
+			return json(result.response);
+		}
+	})
+]);
+//#endregion
+export { apiRoutesFactory };
+
+//# sourceMappingURL=routes.js.map