@geekmidas/constructs 0.0.22 → 0.2.0

package/dist/{EndpointFactory-B27nfeiE.mjs → EndpointFactory-KJAjBWmO.mjs}

@@ -1,4 +1,4 @@
-import { EndpointBuilder } from "./EndpointBuilder-W5fdXxYQ.mjs";
+import { EndpointBuilder } from "./EndpointBuilder-FyyoFTJ5.mjs";
 import { ConsoleLogger } from "@geekmidas/logger/console";
 import uniqBy from "lodash.uniqby";
 
@@ -16,7 +16,9 @@ var EndpointFactory = class EndpointFactory {
 	defaultAuditorStorage;
 	defaultDatabaseService;
 	defaultActorExtractor;
-	constructor({ basePath, defaultAuthorizeFn, defaultLogger, defaultSessionExtractor, defaultServices = [], defaultEventPublisher, availableAuthorizers = [], defaultAuthorizerName, defaultAuditorStorage, defaultDatabaseService, defaultActorExtractor } = {}) {
+	customSecuritySchemes = {};
+	defaultRlsConfig;
+	constructor({ basePath, defaultAuthorizeFn, defaultLogger, defaultSessionExtractor, defaultServices = [], defaultEventPublisher, availableAuthorizers = [], defaultAuthorizerName, defaultAuditorStorage, defaultDatabaseService, defaultActorExtractor, customSecuritySchemes = {}, defaultRlsConfig } = {}) {
 		this.defaultServices = uniqBy(defaultServices, (s) => s.serviceName);
 		this.basePath = basePath || "";
 		this.defaultAuthorizeFn = defaultAuthorizeFn;
@@ -28,6 +30,8 @@ var EndpointFactory = class EndpointFactory {
 		this.defaultAuditorStorage = defaultAuditorStorage;
 		this.defaultDatabaseService = defaultDatabaseService;
 		this.defaultActorExtractor = defaultActorExtractor;
+		this.customSecuritySchemes = customSecuritySchemes;
+		this.defaultRlsConfig = defaultRlsConfig;
 	}
 	static joinPaths(path, basePath = "") {
 		if (!basePath && !path) return "/";
@@ -54,13 +58,55 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
 			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			defaultRlsConfig: this.defaultRlsConfig
+		});
+	}
+	/**
+	* Define custom security schemes for this factory.
+	* These extend the built-in schemes (jwt, bearer, apiKey, oauth2, oidc).
+	*
+	* @example
+	* ```typescript
+	* const router = e.securitySchemes({
+	*   awsIamSigV4: {
+	*     type: 'apiKey',
+	*     in: 'header',
+	*     name: 'Authorization',
+	*     'x-amazon-apigateway-authtype': 'awsSigv4',
+	*   },
+	* });
+	* ```
+	*/
+	securitySchemes(schemes) {
+		return new EndpointFactory({
+			defaultServices: this.defaultServices,
+			basePath: this.basePath,
+			defaultAuthorizeFn: this.defaultAuthorizeFn,
+			defaultLogger: this.defaultLogger,
+			defaultSessionExtractor: this.defaultSessionExtractor,
+			defaultEventPublisher: this.defaultEventPublisher,
+			availableAuthorizers: this.availableAuthorizers,
+			defaultAuthorizerName: this.defaultAuthorizerName,
+			defaultAuditorStorage: this.defaultAuditorStorage,
+			defaultDatabaseService: this.defaultDatabaseService,
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: {
+				...this.customSecuritySchemes,
+				...schemes
+			}
 		});
 	}
 	/**
 	* Set the default authorizer for all endpoints created from this factory.
 	* Individual endpoints can override this by calling `.authorizer()` on the builder.
 	* Use `'none'` to explicitly disable authorization for all endpoints.
+	*
+	* Accepts:
+	* - Built-in security scheme names: 'jwt', 'bearer', 'apiKey', 'oauth2', 'oidc'
+	* - Custom security scheme names defined via `.securitySchemes()`
+	* - 'none' to disable authorization
 	*/
 	authorizer(name) {
 		if (name !== "none" && this.availableAuthorizers.length > 0) {
@@ -81,7 +127,9 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizerName: name === "none" ? void 0 : name,
 			defaultAuditorStorage: this.defaultAuditorStorage,
 			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			defaultRlsConfig: this.defaultRlsConfig
 		});
 	}
 	route(path) {
@@ -97,7 +145,9 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
 			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			defaultRlsConfig: this.defaultRlsConfig
 		});
 	}
 	authorize(fn) {
@@ -112,7 +162,9 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
 			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			defaultRlsConfig: this.defaultRlsConfig
 		});
 	}
 	services(services) {
@@ -127,7 +179,9 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
 			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			defaultRlsConfig: this.defaultRlsConfig
 		});
 	}
 	logger(logger) {
@@ -142,7 +196,9 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
 			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			defaultRlsConfig: this.defaultRlsConfig
 		});
 	}
 	publisher(publisher) {
@@ -157,7 +213,9 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
 			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			defaultRlsConfig: this.defaultRlsConfig
 		});
 	}
 	session(session) {
@@ -172,7 +230,9 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
 			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			defaultRlsConfig: this.defaultRlsConfig
 		});
 	}
 	/**
@@ -190,7 +250,9 @@ var EndpointFactory = class EndpointFactory {
 			availableAuthorizers: this.availableAuthorizers,
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
-			defaultDatabaseService: service
+			defaultDatabaseService: service,
+			customSecuritySchemes: this.customSecuritySchemes,
+			defaultRlsConfig: this.defaultRlsConfig
 		});
 	}
 	/**
@@ -210,7 +272,9 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: storage,
 			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			defaultRlsConfig: this.defaultRlsConfig
 		});
 	}
 	/**
@@ -229,7 +293,44 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
 			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: extractor
+			defaultActorExtractor: extractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			defaultRlsConfig: this.defaultRlsConfig
+		});
+	}
+	/**
+	* Set the RLS (Row-Level Security) configuration for endpoints created from this factory.
+	* This enables automatic PostgreSQL session variable setting for RLS policies.
+	*
+	* @example
+	* ```typescript
+	* const api = new EndpointFactory()
+	*   .database(databaseService)
+	*   .session(extractSession)
+	*   .rls({
+	*     extractor: ({ session }) => ({
+	*       user_id: session.userId,
+	*       tenant_id: session.tenantId,
+	*     }),
+	*     prefix: 'app',
+	*   });
+	* ```
+	*/
+	rls(config) {
+		return new EndpointFactory({
+			defaultServices: this.defaultServices,
+			basePath: this.basePath,
+			defaultAuthorizeFn: this.defaultAuthorizeFn,
+			defaultLogger: this.defaultLogger,
+			defaultSessionExtractor: this.defaultSessionExtractor,
+			defaultEventPublisher: this.defaultEventPublisher,
+			availableAuthorizers: this.availableAuthorizers,
+			defaultAuthorizerName: this.defaultAuthorizerName,
+			defaultAuditorStorage: this.defaultAuditorStorage,
+			defaultDatabaseService: this.defaultDatabaseService,
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			defaultRlsConfig: config
 		});
 	}
 	createBuilder(method, path) {
@@ -245,6 +346,8 @@ var EndpointFactory = class EndpointFactory {
 		if (this.defaultAuditorStorage) builder._setAuditorStorage(this.defaultAuditorStorage);
 		if (this.defaultDatabaseService) builder._setDatabaseService(this.defaultDatabaseService);
 		if (this.defaultActorExtractor) builder._actorExtractor = this.defaultActorExtractor;
+		builder._customSecuritySchemes = this.customSecuritySchemes;
+		if (this.defaultRlsConfig) builder._rlsConfig = this.defaultRlsConfig;
 		return builder;
 	}
 	post(path) {
@@ -270,4 +373,4 @@ const e = new EndpointFactory();
 
 //#endregion
 export { EndpointFactory, e };
-//# sourceMappingURL=EndpointFactory-B27nfeiE.mjs.map
+//# sourceMappingURL=EndpointFactory-KJAjBWmO.mjs.map

package/dist/EndpointFactory-KJAjBWmO.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"EndpointFactory-KJAjBWmO.mjs","names":["DEFAULT_LOGGER","path: P","basePath: TBasePath","authorizers: T","schemes: T","name:\n      | BuiltInSecuritySchemeId\n      | keyof TSecuritySchemes\n      | TAuthorizers[number]\n      | 'none'","path: TPath","fn: AuthorizeFn<TServices, TLogger, TSession>","services: S","logger: L","publisher: Service<TServiceName, T>","session: SessionFn<TServices, TLogger, T, TDatabase>","service: Service<TName, T>","storage: Service<TName, T>","extractor: ActorExtractor<TServices, TSession, TLogger>","config: TConfig","method: TMethod"],"sources":["../src/endpoints/EndpointFactory.ts"],"sourcesContent":["import type {\n  AuditStorage,\n  AuditableAction,\n  ExtractStorageAuditAction,\n} from '@geekmidas/audit';\nimport type { EventPublisher, MappedEvent } from '@geekmidas/events';\nimport type { Logger } from '@geekmidas/logger';\nimport { ConsoleLogger } from '@geekmidas/logger/console';\nimport type { Service } from '@geekmidas/services';\nimport uniqBy from 'lodash.uniqby';\nimport type { HttpMethod } from '../types';\nimport type {\n  Authorizer,\n  BuiltInSecuritySchemeId,\n  SecurityScheme,\n} from './Authorizer';\nimport type { AuthorizeFn, SessionFn } from './Endpoint';\nimport { EndpointBuilder } from './EndpointBuilder';\nimport type { ActorExtractor } from './audit';\nimport type { RlsConfig } from './rls';\n\nconst DEFAULT_LOGGER = new ConsoleLogger() as any;\n\nexport class EndpointFactory<\n  TServices extends Service[] = [],\n  TBasePath extends string = '',\n  TLogger extends Logger = Logger,\n  TSession = unknown,\n  TEventPublisher extends EventPublisher<any> | undefined = undefined,\n  TEventPublisherServiceName extends string = string,\n  TAuthorizers extends readonly string[] = readonly string[],\n  TAuditStorage extends AuditStorage<any> | undefined = undefined,\n  TAuditStorageServiceName extends string = string,\n  TAuditAction extends AuditableAction<\n    string,\n    unknown\n  > = ExtractStorageAuditAction<NonNullable<TAuditStorage>>,\n  TDatabase = undefined,\n  TDatabaseServiceName extends string = string,\n  TSecuritySchemes extends Record<string, SecurityScheme> = Record<\n    string,\n    SecurityScheme\n  >,\n  TRlsConfig extends\n    | RlsConfig<TServices, TSession, TLogger>\n    | undefined = undefined,\n> {\n  // @ts-ignore\n  private defaultServices: TServices;\n  private basePath: TBasePath = '' as TBasePath;\n  private defaultAuthorizeFn?: AuthorizeFn<TServices, TLogger, TSession>;\n  private defaultEventPublisher:\n    | Service<TEventPublisherServiceName, TEventPublisher>\n    | undefined;\n  private defaultSessionExtractor?: SessionFn<\n    TServices,\n    TLogger,\n    TSession,\n    TDatabase\n  >;\n  private defaultLogger: TLogger = DEFAULT_LOGGER;\n  private availableAuthorizers: Authorizer[] = [];\n  private defaultAuthorizerName?: TAuthorizers[number];\n  private defaultAuditorStorage:\n    | Service<TAuditStorageServiceName, TAuditStorage>\n    | undefined;\n  private defaultDatabaseService:\n    | Service<TDatabaseServiceName, TDatabase>\n    | undefined;\n  private defaultActorExtractor?: ActorExtractor<TServices, TSession, TLogger>;\n  private customSecuritySchemes: TSecuritySchemes = {} as TSecuritySchemes;\n  private defaultRlsConfig?: TRlsConfig;\n\n  constructor({\n    basePath,\n    defaultAuthorizeFn,\n    defaultLogger,\n    defaultSessionExtractor,\n    // @ts-ignore\n    defaultServices = [] as TServices,\n    defaultEventPublisher,\n    availableAuthorizers = [],\n    defaultAuthorizerName,\n    defaultAuditorStorage,\n    defaultDatabaseService,\n    defaultActorExtractor,\n    customSecuritySchemes = {} as TSecuritySchemes,\n    defaultRlsConfig,\n  }: EndpointFactoryOptions<\n    TServices,\n    TBasePath,\n    TLogger,\n    TSession,\n    TEventPublisher,\n    TEventPublisherServiceName,\n    TAuthorizers,\n    TAuditStorage,\n    TAuditStorageServiceName,\n    TDatabase,\n    TDatabaseServiceName,\n    TSecuritySchemes,\n    TRlsConfig\n  > = {}) {\n    // Initialize default services\n    this.defaultServices = uniqBy(\n      defaultServices,\n      (s) => s.serviceName,\n    ) as TServices;\n\n    this.basePath = basePath || ('' as TBasePath);\n    this.defaultAuthorizeFn = defaultAuthorizeFn;\n    this.defaultLogger = defaultLogger || (DEFAULT_LOGGER as TLogger);\n    this.defaultSessionExtractor = defaultSessionExtractor;\n    this.defaultEventPublisher = defaultEventPublisher;\n    this.availableAuthorizers = availableAuthorizers;\n    this.defaultAuthorizerName = defaultAuthorizerName;\n    this.defaultAuditorStorage = defaultAuditorStorage;\n    this.defaultDatabaseService = defaultDatabaseService;\n    this.defaultActorExtractor = defaultActorExtractor;\n    this.customSecuritySchemes = customSecuritySchemes;\n    this.defaultRlsConfig = defaultRlsConfig;\n  }\n\n  static joinPaths<TBasePath extends string, P extends string>(\n    path: P,\n    basePath: TBasePath = '' as TBasePath,\n  ): JoinPaths<TBasePath, P> {\n    // Handle empty cases\n    if (!basePath && !path) return '/' as JoinPaths<TBasePath, P>;\n    if (!basePath)\n      return (path.startsWith('/') ? path : '/' + path) as JoinPaths<\n        TBasePath,\n        P\n      >;\n    if (!path)\n      return (\n        basePath.startsWith('/') ? basePath : '/' + basePath\n      ) as JoinPaths<TBasePath, P>;\n\n    const base = basePath.endsWith('/') ? basePath.slice(0, -1) : basePath;\n    const segment = path.startsWith('/') ? path : '/' + path;\n\n    let result = base + segment;\n\n    // Ensure leading slash\n    if (!result.startsWith('/')) {\n      result = '/' + result;\n    }\n\n    // Normalize multiple slashes (except in the middle of the path where they might be intentional)\n    result = result.replace(/^\\/+/g, '/');\n\n    // Remove trailing slash unless it's the root path \"/\"\n    if (result.length > 1 && result.endsWith('/')) {\n      result = result.slice(0, -1);\n    }\n\n    return result as JoinPaths<TBasePath, P>;\n  }\n\n  // Configure available authorizers\n  authorizers<const T extends readonly string[]>(\n    authorizers: T,\n  ): EndpointFactory<\n    TServices,\n    TBasePath,\n    TLogger,\n    TSession,\n    TEventPublisher,\n    TEventPublisherServiceName,\n    T,\n    TAuditStorage,\n    TAuditStorageServiceName,\n    TAuditAction,\n    TDatabase,\n    TDatabaseServiceName,\n    TSecuritySchemes\n  > {\n    const authorizerConfigs = authorizers.map((name) => ({\n      name,\n    }));\n    return new EndpointFactory<\n      TServices,\n      TBasePath,\n      TLogger,\n      TSession,\n      TEventPublisher,\n      TEventPublisherServiceName,\n      T,\n      TAuditStorage,\n      TAuditStorageServiceName,\n      TAuditAction,\n      TDatabase,\n      TDatabaseServiceName,\n      TSecuritySchemes,\n      TRlsConfig\n    >({\n      defaultServices: this.defaultServices,\n      basePath: this.basePath,\n      defaultAuthorizeFn: this.defaultAuthorizeFn,\n      defaultLogger: this.defaultLogger,\n      defaultSessionExtractor: this.defaultSessionExtractor,\n      defaultEventPublisher: this.defaultEventPublisher,\n      availableAuthorizers: authorizerConfigs,\n      defaultAuthorizerName: this.defaultAuthorizerName,\n      defaultAuditorStorage: this.defaultAuditorStorage,\n      defaultDatabaseService: this.defaultDatabaseService,\n      defaultActorExtractor: this.defaultActorExtractor,\n      customSecuritySchemes: this.customSecuritySchemes,\n      defaultRlsConfig: this.defaultRlsConfig,\n    });\n  }\n\n  /**\n   * Define custom security schemes for this factory.\n   * These extend the built-in schemes (jwt, bearer, apiKey, oauth2, oidc).\n   *\n   * @example\n   * ```typescript\n   * const router = e.securitySchemes({\n   *   awsIamSigV4: {\n   *     type: 'apiKey',\n   *     in: 'header',\n   *     name: 'Authorization',\n   *     'x-amazon-apigateway-authtype': 'awsSigv4',\n   *   },\n   * });\n   * ```\n   */\n  securitySchemes<T extends Record<string, SecurityScheme>>(\n    schemes: T,\n  ): EndpointFactory<\n    TServices,\n    TBasePath,\n    TLogger,\n    TSession,\n    TEventPublisher,\n    TEventPublisherServiceName,\n    TAuthorizers,\n    TAuditStorage,\n    TAuditStorageServiceName,\n    TAuditAction,\n    TDatabase,\n    TDatabaseServiceName,\n    TSecuritySchemes & T\n  > {\n    return new EndpointFactory<\n      TServices,\n      TBasePath,\n      TLogger,\n      TSession,\n      TEventPublisher,\n      TEventPublisherServiceName,\n      TAuthorizers,\n      TAuditStorage,\n      TAuditStorageServiceName,\n      TAuditAction,\n      TDatabase,\n      TDatabaseServiceName,\n      TSecuritySchemes & T\n    >({\n      defaultServices: this.defaultServices,\n      basePath: this.basePath,\n      defaultAuthorizeFn: this.defaultAuthorizeFn,\n      defaultLogger: this.defaultLogger,\n      defaultSessionExtractor: this.defaultSessionExtractor,\n      defaultEventPublisher: this.defaultEventPublisher,\n      availableAuthorizers: this.availableAuthorizers,\n      defaultAuthorizerName: this.defaultAuthorizerName,\n      defaultAuditorStorage: this.defaultAuditorStorage,\n      defaultDatabaseService: this.defaultDatabaseService,\n      defaultActorExtractor: this.defaultActorExtractor,\n      customSecuritySchemes: {\n        ...this.customSecuritySchemes,\n        ...schemes,\n      } as TSecuritySchemes & T,\n    });\n  }\n\n  /**\n   * Set the default authorizer for all endpoints created from this factory.\n   * Individual endpoints can override this by calling `.authorizer()` on the builder.\n   * Use `'none'` to explicitly disable authorization for all endpoints.\n   *\n   * Accepts:\n   * - Built-in security scheme names: 'jwt', 'bearer', 'apiKey', 'oauth2', 'oidc'\n   * - Custom security scheme names defined via `.securitySchemes()`\n   * - 'none' to disable authorization\n   */\n  authorizer(\n    name:\n      | BuiltInSecuritySchemeId\n      | keyof TSecuritySchemes\n      | TAuthorizers[number]\n      | 'none',\n  ): EndpointFactory<\n    TServices,\n    TBasePath,\n    TLogger,\n    TSession,\n    TEventPublisher,\n    TEventPublisherServiceName,\n    TAuthorizers,\n    TAuditStorage,\n    TAuditStorageServiceName,\n    TAuditAction,\n    TDatabase,\n    TDatabaseServiceName,\n    TSecuritySchemes\n  > {\n    // Validate that the authorizer exists in available authorizers (if authorizers() was called)\n    if (name !== 'none' && this.availableAuthorizers.length > 0) {\n      const authorizerExists = this.availableAuthorizers.some(\n        (a) => a.name === name,\n      );\n      if (!authorizerExists) {\n        const available = this.availableAuthorizers\n          .map((a) => a.name)\n          .join(', ');\n        throw new Error(\n          `Authorizer \"${name as string}\" not found in available authorizers: ${available}`,\n        );\n      }\n    }\n\n    return new EndpointFactory<\n      TServices,\n      TBasePath,\n      TLogger,\n      TSession,\n      TEventPublisher,\n      TEventPublisherServiceName,\n      TAuthorizers,\n      TAuditStorage,\n      TAuditStorageServiceName,\n      TAuditAction,\n      TDatabase,\n      TDatabaseServiceName,\n      TSecuritySchemes,\n      TRlsConfig\n    >({\n      defaultServices: this.defaultServices,\n      basePath: this.basePath,\n      defaultAuthorizeFn: this.defaultAuthorizeFn,\n      defaultLogger: this.defaultLogger,\n      defaultSessionExtractor: this.defaultSessionExtractor,\n      defaultEventPublisher: this.defaultEventPublisher,\n      availableAuthorizers: this.availableAuthorizers,\n      defaultAuthorizerName:\n        name === 'none' ? undefined : (name as TAuthorizers[number]),\n      defaultAuditorStorage: this.defaultAuditorStorage,\n      defaultDatabaseService: this.defaultDatabaseService,\n      defaultActorExtractor: this.defaultActorExtractor,\n      customSecuritySchemes: this.customSecuritySchemes,\n      defaultRlsConfig: this.defaultRlsConfig,\n    });\n  }\n\n  // Create a sub-router with a path prefix\n  route<TPath extends string>(\n    path: TPath,\n  ): EndpointFactory<\n    TServices,\n    JoinPaths<TBasePath, TPath>,\n    TLogger,\n    TSession,\n    TEventPublisher,\n    TEventPublisherServiceName,\n    TAuthorizers,\n    TAuditStorage,\n    TAuditStorageServiceName,\n    TAuditAction,\n    TDatabase,\n    TDatabaseServiceName,\n    TSecuritySchemes\n  > {\n    const newBasePath = EndpointFactory.joinPaths(path, this.basePath);\n    return new EndpointFactory<\n      TServices,\n      JoinPaths<TBasePath, TPath>,\n      TLogger,\n      TSession,\n      TEventPublisher,\n      TEventPublisherServiceName,\n      TAuthorizers,\n      TAuditStorage,\n      TAuditStorageServiceName,\n      TAuditAction,\n      TDatabase,\n      TDatabaseServiceName,\n      TSecuritySchemes,\n      TRlsConfig\n    >({\n      defaultServices: this.defaultServices,\n      basePath: newBasePath,\n      defaultAuthorizeFn: this.defaultAuthorizeFn,\n      defaultLogger: this.defaultLogger,\n      defaultSessionExtractor: this.defaultSessionExtractor,\n      defaultEventPublisher: this.defaultEventPublisher,\n      availableAuthorizers: this.availableAuthorizers,\n      defaultAuthorizerName: this.defaultAuthorizerName,\n      defaultAuditorStorage: this.defaultAuditorStorage,\n      defaultDatabaseService: this.defaultDatabaseService,\n      defaultActorExtractor: this.defaultActorExtractor,\n      customSecuritySchemes: this.customSecuritySchemes,\n      defaultRlsConfig: this.defaultRlsConfig,\n    });\n  }\n\n  // Create a new factory with authorization\n  authorize(\n    fn: AuthorizeFn<TServices, TLogger, TSession>,\n  ): EndpointFactory<\n    TServices,\n    TBasePath,\n    TLogger,\n    TSession,\n    TEventPublisher,\n    TEventPublisherServiceName,\n    TAuthorizers,\n    TAuditStorage,\n    TAuditStorageServiceName,\n    TAuditAction,\n    TDatabase,\n    TDatabaseServiceName,\n    TSecuritySchemes\n  > {\n    return new EndpointFactory<\n      TServices,\n      TBasePath,\n      TLogger,\n      TSession,\n      TEventPublisher,\n      TEventPublisherServiceName,\n      TAuthorizers,\n      TAuditStorage,\n      TAuditStorageServiceName,\n      TAuditAction,\n      TDatabase,\n      TDatabaseServiceName,\n      TSecuritySchemes,\n      TRlsConfig\n    >({\n      defaultServices: this.defaultServices,\n      basePath: this.basePath,\n      defaultAuthorizeFn: fn,\n      defaultLogger: this.defaultLogger,\n      defaultSessionExtractor: this.defaultSessionExtractor,\n      defaultEventPublisher: this.defaultEventPublisher,\n      availableAuthorizers: this.availableAuthorizers,\n      defaultAuthorizerName: this.defaultAuthorizerName,\n      defaultAuditorStorage: this.defaultAuditorStorage,\n      defaultDatabaseService: this.defaultDatabaseService,\n      defaultActorExtractor: this.defaultActorExtractor,\n      customSecuritySchemes: this.customSecuritySchemes,\n      defaultRlsConfig: this.defaultRlsConfig,\n    });\n  }\n\n  // Create a new factory with services\n  services<S extends Service[]>(\n    services: S,\n  ): EndpointFactory<\n    [...S, ...TServices],\n    TBasePath,\n    TLogger,\n    TSession,\n    TEventPublisher,\n    TEventPublisherServiceName,\n    TAuthorizers,\n    TAuditStorage,\n    TAuditStorageServiceName,\n    TAuditAction,\n    TDatabase,\n    TDatabaseServiceName,\n    TSecuritySchemes\n  > {\n    return new EndpointFactory<\n      [...S, ...TServices],\n      TBasePath,\n      TLogger,\n      TSession,\n      TEventPublisher,\n      TEventPublisherServiceName,\n      TAuthorizers,\n      TAuditStorage,\n      TAuditStorageServiceName,\n      TAuditAction,\n      TDatabase,\n      TDatabaseServiceName,\n      TSecuritySchemes,\n      TRlsConfig\n    >({\n      defaultServices: [...services, ...this.defaultServices],\n      basePath: this.basePath,\n      defaultAuthorizeFn: this.defaultAuthorizeFn,\n      defaultLogger: this.defaultLogger,\n      defaultSessionExtractor: this.defaultSessionExtractor,\n      defaultEventPublisher: this.defaultEventPublisher,\n      availableAuthorizers: this.availableAuthorizers,\n      defaultAuthorizerName: this.defaultAuthorizerName,\n      defaultAuditorStorage: this.defaultAuditorStorage,\n      defaultDatabaseService: this.defaultDatabaseService,\n      defaultActorExtractor: this.defaultActorExtractor,\n      customSecuritySchemes: this.customSecuritySchemes,\n      defaultRlsConfig: this.defaultRlsConfig,\n    });\n  }\n\n  logger<L extends Logger>(\n    logger: L,\n  ): EndpointFactory<\n    TServices,\n    TBasePath,\n    L,\n    TSession,\n    TEventPublisher,\n    TEventPublisherServiceName,\n    TAuthorizers,\n    TAuditStorage,\n    TAuditStorageServiceName,\n    TAuditAction,\n    TDatabase,\n    TDatabaseServiceName,\n    TSecuritySchemes\n  > {\n    return new EndpointFactory<\n      TServices,\n      TBasePath,\n      L,\n      TSession,\n      TEventPublisher,\n      TEventPublisherServiceName,\n      TAuthorizers,\n      TAuditStorage,\n      TAuditStorageServiceName,\n      TAuditAction,\n      TDatabase,\n      TDatabaseServiceName,\n      TSecuritySchemes,\n      TRlsConfig\n    >({\n      defaultServices: this.defaultServices,\n      basePath: this.basePath,\n      defaultAuthorizeFn: this.defaultAuthorizeFn as unknown as AuthorizeFn<\n        TServices,\n        L,\n        TSession\n      >,\n      defaultLogger: logger,\n      defaultSessionExtractor: this\n        .defaultSessionExtractor as unknown as SessionFn<\n        TServices,\n        L,\n        TSession\n      >,\n      defaultEventPublisher: this.defaultEventPublisher,\n      availableAuthorizers: this.availableAuthorizers,\n      defaultAuthorizerName: this.defaultAuthorizerName,\n      defaultAuditorStorage: this.defaultAuditorStorage,\n      defaultDatabaseService: this.defaultDatabaseService,\n      defaultActorExtractor: this\n        .defaultActorExtractor as unknown as ActorExtractor<\n        TServices,\n        TSession,\n        L\n      >,\n      customSecuritySchemes: this.customSecuritySchemes,\n      defaultRlsConfig: this.defaultRlsConfig,\n    });\n  }\n\n  publisher<\n    T extends EventPublisher<any>,\n    TServiceName extends string = string,\n  >(\n    publisher: Service<TServiceName, T>,\n  ): EndpointFactory<\n    TServices,\n    TBasePath,\n    TLogger,\n    TSession,\n    T,\n    TServiceName,\n    TAuthorizers,\n    TAuditStorage,\n    TAuditStorageServiceName,\n    TAuditAction,\n    TDatabase,\n    TDatabaseServiceName,\n    TSecuritySchemes\n  > {\n    return new EndpointFactory<\n      TServices,\n      TBasePath,\n      TLogger,\n      TSession,\n      T,\n      TServiceName,\n      TAuthorizers,\n      TAuditStorage,\n      TAuditStorageServiceName,\n      TAuditAction,\n      TDatabase,\n      TDatabaseServiceName,\n      TSecuritySchemes,\n      TRlsConfig\n    >({\n      defaultServices: this.defaultServices,\n      basePath: this.basePath,\n      defaultAuthorizeFn: this.defaultAuthorizeFn,\n      defaultLogger: this.defaultLogger,\n      defaultSessionExtractor: this.defaultSessionExtractor,\n      defaultEventPublisher: publisher,\n      availableAuthorizers: this.availableAuthorizers,\n      defaultAuthorizerName: this.defaultAuthorizerName,\n      defaultAuditorStorage: this.defaultAuditorStorage,\n      defaultDatabaseService: this.defaultDatabaseService,\n      defaultActorExtractor: this.defaultActorExtractor,\n      customSecuritySchemes: this.customSecuritySchemes,\n      defaultRlsConfig: this.defaultRlsConfig,\n    });\n  }\n\n  session<T>(\n    session: SessionFn<TServices, TLogger, T, TDatabase>,\n  ): EndpointFactory<\n    TServices,\n    TBasePath,\n    TLogger,\n    T,\n    TEventPublisher,\n    TEventPublisherServiceName,\n    TAuthorizers,\n    TAuditStorage,\n    TAuditStorageServiceName,\n    TAuditAction,\n    TDatabase,\n    TDatabaseServiceName,\n    TSecuritySchemes\n  > {\n    return new EndpointFactory<\n      TServices,\n      TBasePath,\n      TLogger,\n      T,\n      TEventPublisher,\n      TEventPublisherServiceName,\n      TAuthorizers,\n      TAuditStorage,\n      TAuditStorageServiceName,\n      TAuditAction,\n      TDatabase,\n      TDatabaseServiceName,\n      TSecuritySchemes,\n      TRlsConfig\n    >({\n      defaultServices: this.defaultServices,\n      basePath: this.basePath,\n      defaultAuthorizeFn: this.defaultAuthorizeFn as unknown as AuthorizeFn<\n        TServices,\n        TLogger,\n        T\n      >,\n      defaultLogger: this.defaultLogger,\n      defaultSessionExtractor: session,\n      defaultEventPublisher: this.defaultEventPublisher,\n      availableAuthorizers: this.availableAuthorizers,\n      defaultAuthorizerName: this.defaultAuthorizerName,\n      defaultAuditorStorage: this.defaultAuditorStorage,\n      defaultDatabaseService: this.defaultDatabaseService,\n      defaultActorExtractor: this\n        .defaultActorExtractor as unknown as ActorExtractor<\n        TServices,\n        T,\n        TLogger\n      >,\n      customSecuritySchemes: this.customSecuritySchemes,\n      defaultRlsConfig: this.defaultRlsConfig,\n    });\n  }\n\n  /**\n   * Set the database service for endpoints created from this factory.\n   * The database will be available in handler context as `db`.\n   */\n  database<T, TName extends string>(\n    service: Service<TName, T>,\n  ): EndpointFactory<\n    TServices,\n    TBasePath,\n    TLogger,\n    TSession,\n    TEventPublisher,\n    TEventPublisherServiceName,\n    TAuthorizers,\n    TAuditStorage,\n    TAuditStorageServiceName,\n    TAuditAction,\n    T,\n    TName,\n    TSecuritySchemes\n  > {\n    return new EndpointFactory<\n      TServices,\n      TBasePath,\n      TLogger,\n      TSession,\n      TEventPublisher,\n      TEventPublisherServiceName,\n      TAuthorizers,\n      TAuditStorage,\n      TAuditStorageServiceName,\n      TAuditAction,\n      T,\n      TName,\n      TSecuritySchemes,\n      TRlsConfig\n    >({\n      defaultServices: this.defaultServices,\n      basePath: this.basePath,\n      defaultAuthorizeFn: this.defaultAuthorizeFn,\n      defaultLogger: this.defaultLogger,\n      // Reset session extractor when database changes - user should call .session() after .database()\n      // to get proper type inference for the new database type\n      defaultSessionExtractor: this.defaultSessionExtractor as unknown as\n        | SessionFn<TServices, TLogger, TSession, T>\n        | undefined,\n      defaultEventPublisher: this.defaultEventPublisher,\n      availableAuthorizers: this.availableAuthorizers,\n      defaultAuthorizerName: this.defaultAuthorizerName,\n      defaultAuditorStorage: this.defaultAuditorStorage,\n      defaultDatabaseService: service,\n      customSecuritySchemes: this.customSecuritySchemes,\n      defaultRlsConfig: this.defaultRlsConfig,\n    });\n  }\n\n  /**\n   * Set the auditor storage service for endpoints created from this factory.\n   * This enables audit functionality and makes `auditor` available in handler context.\n   * The audit action type is automatically inferred from the storage's generic parameter.\n   */\n  auditor<T extends AuditStorage<any>, TName extends string>(\n    storage: Service<TName, T>,\n  ): EndpointFactory<\n    TServices,\n    TBasePath,\n    TLogger,\n    TSession,\n    TEventPublisher,\n    TEventPublisherServiceName,\n    TAuthorizers,\n    T,\n    TName,\n    ExtractStorageAuditAction<T>,\n    TDatabase,\n    TDatabaseServiceName,\n    TSecuritySchemes\n  > {\n    return new EndpointFactory<\n      TServices,\n      TBasePath,\n      TLogger,\n      TSession,\n      TEventPublisher,\n      TEventPublisherServiceName,\n      TAuthorizers,\n      T,\n      TName,\n      ExtractStorageAuditAction<T>,\n      TDatabase,\n      TDatabaseServiceName,\n      TSecuritySchemes,\n      TRlsConfig\n    >({\n      defaultServices: this.defaultServices,\n      basePath: this.basePath,\n      defaultAuthorizeFn: this.defaultAuthorizeFn,\n      defaultLogger: this.defaultLogger,\n      defaultSessionExtractor: this.defaultSessionExtractor,\n      defaultEventPublisher: this.defaultEventPublisher,\n      availableAuthorizers: this.availableAuthorizers,\n      defaultAuthorizerName: this.defaultAuthorizerName,\n      defaultAuditorStorage: storage,\n      defaultDatabaseService: this.defaultDatabaseService,\n      defaultActorExtractor: this\n        .defaultActorExtractor as unknown as ActorExtractor<\n        TServices,\n        TSession,\n        TLogger\n      >,\n      customSecuritySchemes: this.customSecuritySchemes,\n      defaultRlsConfig: this.defaultRlsConfig,\n    });\n  }\n\n  /**\n   * Set the actor extractor function for endpoints created from this factory.\n   * The actor is extracted from the request context and attached to all audits.\n   */\n  actor(\n    extractor: ActorExtractor<TServices, TSession, TLogger>,\n  ): EndpointFactory<\n    TServices,\n    TBasePath,\n    TLogger,\n    TSession,\n    TEventPublisher,\n    TEventPublisherServiceName,\n    TAuthorizers,\n    TAuditStorage,\n    TAuditStorageServiceName,\n    TAuditAction,\n    TDatabase,\n    TDatabaseServiceName,\n    TSecuritySchemes\n  > {\n    return new EndpointFactory<\n      TServices,\n      TBasePath,\n      TLogger,\n      TSession,\n      TEventPublisher,\n      TEventPublisherServiceName,\n      TAuthorizers,\n      TAuditStorage,\n      TAuditStorageServiceName,\n      TAuditAction,\n      TDatabase,\n      TDatabaseServiceName,\n      TSecuritySchemes,\n      TRlsConfig\n    >({\n      defaultServices: this.defaultServices,\n      basePath: this.basePath,\n      defaultAuthorizeFn: this.defaultAuthorizeFn,\n      defaultLogger: this.defaultLogger,\n      defaultSessionExtractor: this.defaultSessionExtractor,\n      defaultEventPublisher: this.defaultEventPublisher,\n      availableAuthorizers: this.availableAuthorizers,\n      defaultAuthorizerName: this.defaultAuthorizerName,\n      defaultAuditorStorage: this.defaultAuditorStorage,\n      defaultDatabaseService: this.defaultDatabaseService,\n      defaultActorExtractor: extractor,\n      customSecuritySchemes: this.customSecuritySchemes,\n      defaultRlsConfig: this.defaultRlsConfig,\n    });\n  }\n\n  /**\n   * Set the RLS (Row-Level Security) configuration for endpoints created from this factory.\n   * This enables automatic PostgreSQL session variable setting for RLS policies.\n   *\n   * @example\n   * ```typescript\n   * const api = new EndpointFactory()\n   *   .database(databaseService)\n   *   .session(extractSession)\n   *   .rls({\n   *     extractor: ({ session }) => ({\n   *       user_id: session.userId,\n   *       tenant_id: session.tenantId,\n   *     }),\n   *     prefix: 'app',\n   *   });\n   * ```\n   */\n  rls<TConfig extends RlsConfig<TServices, TSession, TLogger>>(\n    config: TConfig,\n  ): EndpointFactory<\n    TServices,\n    TBasePath,\n    TLogger,\n    TSession,\n    TEventPublisher,\n    TEventPublisherServiceName,\n    TAuthorizers,\n    TAuditStorage,\n    TAuditStorageServiceName,\n    TAuditAction,\n    TDatabase,\n    TDatabaseServiceName,\n    TSecuritySchemes,\n    TConfig\n  > {\n    return new EndpointFactory<\n      TServices,\n      TBasePath,\n      TLogger,\n      TSession,\n      TEventPublisher,\n      TEventPublisherServiceName,\n      TAuthorizers,\n      TAuditStorage,\n      TAuditStorageServiceName,\n      TAuditAction,\n      TDatabase,\n      TDatabaseServiceName,\n      TSecuritySchemes,\n      TConfig\n    >({\n      defaultServices: this.defaultServices,\n      basePath: this.basePath,\n      defaultAuthorizeFn: this.defaultAuthorizeFn,\n      defaultLogger: this.defaultLogger,\n      defaultSessionExtractor: this.defaultSessionExtractor,\n      defaultEventPublisher: this.defaultEventPublisher,\n      availableAuthorizers: this.availableAuthorizers,\n      defaultAuthorizerName: this.defaultAuthorizerName,\n      defaultAuditorStorage: this.defaultAuditorStorage,\n      defaultDatabaseService: this.defaultDatabaseService,\n      defaultActorExtractor: this.defaultActorExtractor,\n      customSecuritySchemes: this.customSecuritySchemes,\n      defaultRlsConfig: config,\n    });\n  }\n\n  private createBuilder<TMethod extends HttpMethod, TPath extends string>(\n    method: TMethod,\n    path: TPath,\n  ): EndpointBuilder<\n    JoinPaths<TBasePath, TPath>,\n    TMethod,\n    {},\n    TServices,\n    TLogger,\n    undefined,\n    TSession,\n    TEventPublisher,\n    TEventPublisherServiceName,\n    TAuthorizers,\n    TAuditStorage,\n    TAuditStorageServiceName,\n    TAuditAction,\n    TDatabase,\n    TDatabaseServiceName\n  > {\n    const fullPath = EndpointFactory.joinPaths(path, this.basePath);\n    const builder = new EndpointBuilder<\n      JoinPaths<TBasePath, TPath>,\n      TMethod,\n      {},\n      TServices,\n      TLogger,\n      undefined,\n      TSession,\n      TEventPublisher,\n      TEventPublisherServiceName,\n      TAuthorizers,\n      TAuditStorage,\n      TAuditStorageServiceName,\n      TAuditAction,\n      TDatabase,\n      TDatabaseServiceName\n    >(fullPath, method);\n\n    if (this.defaultAuthorizeFn) {\n      // @ts-ignore\n      builder._authorize = this.defaultAuthorizeFn;\n    }\n    if (this.defaultServices.length) {\n      // Create a copy to avoid sharing references between builders\n      builder._services = [...this.defaultServices] as TServices;\n    }\n\n    if (this.defaultLogger) {\n      builder._logger = this.defaultLogger as TLogger;\n    }\n\n    if (this.defaultSessionExtractor) {\n      builder._getSession = this.defaultSessionExtractor as SessionFn<\n        TServices,\n        TLogger,\n        TSession\n      >;\n    }\n\n    if (this.defaultEventPublisher) {\n      builder._setPublisher(this.defaultEventPublisher);\n    }\n\n    // Set available authorizers and default\n    builder._availableAuthorizers = this.availableAuthorizers;\n    if (this.defaultAuthorizerName) {\n      builder._authorizerName = this.defaultAuthorizerName;\n    }\n\n    // Set auditor storage if configured\n    if (this.defaultAuditorStorage) {\n      builder._setAuditorStorage(this.defaultAuditorStorage as any);\n    }\n\n    // Set database service if configured\n    if (this.defaultDatabaseService) {\n      builder._setDatabaseService(this.defaultDatabaseService as any);\n    }\n\n    // Set actor extractor if configured\n    if (this.defaultActorExtractor) {\n      builder._actorExtractor = this.defaultActorExtractor;\n    }\n\n    // Set custom security schemes\n    builder._customSecuritySchemes = this.customSecuritySchemes;\n\n    // Set RLS config if configured\n    if (this.defaultRlsConfig) {\n      builder._rlsConfig = this.defaultRlsConfig as any;\n    }\n\n    return builder;\n  }\n\n  post<TPath extends string>(path: TPath) {\n    return this.createBuilder('POST', path);\n  }\n\n  get<TPath extends string>(path: TPath) {\n    return this.createBuilder('GET', path);\n  }\n\n  put<TPath extends string>(path: TPath) {\n    return this.createBuilder('PUT', path);\n  }\n\n  delete<TPath extends string>(path: TPath) {\n    return this.createBuilder('DELETE', path);\n  }\n\n  patch<TPath extends string>(path: TPath) {\n    return this.createBuilder('PATCH', path);\n  }\n\n  options<TPath extends string>(path: TPath) {\n    return this.createBuilder('OPTIONS', path);\n  }\n}\n\nexport type RemoveTrailingSlash<T extends string> = T extends `${infer Rest}/`\n  ? Rest extends ''\n    ? T // Keep \"/\" as is\n    : Rest\n  : T;\n\nexport type JoinPaths<\n  TBasePath extends string,\n  TPath extends string,\n> = RemoveTrailingSlash<\n  TBasePath extends ''\n    ? TPath\n    : TPath extends ''\n      ? TBasePath\n      : TBasePath extends '/'\n        ? TPath extends `/${string}`\n          ? TPath\n          : `/${TPath}`\n        : TBasePath extends `${infer Base}/`\n          ? TPath extends `/${infer Rest}`\n            ? `${Base}/${Rest}`\n            : `${Base}/${TPath}`\n          : TPath extends `/${infer Rest}`\n            ? `${TBasePath}/${Rest}`\n            : `${TBasePath}/${TPath}`\n>;\n\nexport interface EndpointFactoryOptions<\n  TServices extends Service[] = [],\n  TBasePath extends string = '',\n  TLogger extends Logger = Logger,\n  TSession = unknown,\n  TEventPublisher extends EventPublisher<any> | undefined = undefined,\n  TEventPublisherServiceName extends string = string,\n  TAuthorizers extends readonly string[] = readonly string[],\n  TAuditStorage extends AuditStorage | undefined = undefined,\n  TAuditStorageServiceName extends string = string,\n  TDatabase = undefined,\n  TDatabaseServiceName extends string = string,\n  TSecuritySchemes extends Record<string, SecurityScheme> = Record<\n    string,\n    SecurityScheme\n  >,\n  TRlsConfig extends\n    | RlsConfig<TServices, TSession, TLogger>\n    | undefined = undefined,\n> {\n  defaultServices?: TServices;\n  basePath?: TBasePath;\n  defaultAuthorizeFn?: AuthorizeFn<TServices, TLogger, TSession>;\n  defaultLogger?: TLogger;\n  defaultSessionExtractor?: SessionFn<TServices, TLogger, TSession, TDatabase>;\n  defaultEventPublisher?: Service<TEventPublisherServiceName, TEventPublisher>;\n  defaultEvents?: MappedEvent<TEventPublisher, undefined>[];\n  availableAuthorizers?: Authorizer[];\n  defaultAuthorizerName?: TAuthorizers[number];\n  defaultAuditorStorage?: Service<TAuditStorageServiceName, TAuditStorage>;\n  defaultDatabaseService?: Service<TDatabaseServiceName, TDatabase>;\n  defaultActorExtractor?: ActorExtractor<TServices, TSession, TLogger>;\n  customSecuritySchemes?: TSecuritySchemes;\n  defaultRlsConfig?: TRlsConfig;\n}\n\nexport const e = new EndpointFactory();\n"],"mappings":";;;;;AAqBA,MAAMA,mBAAiB,IAAI;AAE3B,IAAa,kBAAb,MAAa,gBAuBX;CAEA,AAAQ;CACR,AAAQ,WAAsB;CAC9B,AAAQ;CACR,AAAQ;CAGR,AAAQ;CAMR,AAAQ,gBAAyBA;CACjC,AAAQ,uBAAqC,CAAE;CAC/C,AAAQ;CACR,AAAQ;CAGR,AAAQ;CAGR,AAAQ;CACR,AAAQ,wBAA0C,CAAE;CACpD,AAAQ;CAER,YAAY,EACV,UACA,oBACA,eACA,yBAEA,kBAAkB,CAAE,GACpB,uBACA,uBAAuB,CAAE,GACzB,uBACA,uBACA,wBACA,uBACA,wBAAwB,CAAE,GAC1B,kBAeD,GAAG,CAAE,GAAE;AAEN,OAAK,kBAAkB,OACrB,iBACA,CAAC,MAAM,EAAE,YACV;AAED,OAAK,WAAW,YAAa;AAC7B,OAAK,qBAAqB;AAC1B,OAAK,gBAAgB,iBAAkBA;AACvC,OAAK,0BAA0B;AAC/B,OAAK,wBAAwB;AAC7B,OAAK,uBAAuB;AAC5B,OAAK,wBAAwB;AAC7B,OAAK,wBAAwB;AAC7B,OAAK,yBAAyB;AAC9B,OAAK,wBAAwB;AAC7B,OAAK,wBAAwB;AAC7B,OAAK,mBAAmB;CACzB;CAED,OAAO,UACLC,MACAC,WAAsB,IACG;AAEzB,OAAK,aAAa,KAAM,QAAO;AAC/B,OAAK,SACH,QAAQ,KAAK,WAAW,IAAI,GAAG,OAAO,MAAM;AAI9C,OAAK,KACH,QACE,SAAS,WAAW,IAAI,GAAG,WAAW,MAAM;EAGhD,MAAM,OAAO,SAAS,SAAS,IAAI,GAAG,SAAS,MAAM,GAAG,GAAG,GAAG;EAC9D,MAAM,UAAU,KAAK,WAAW,IAAI,GAAG,OAAO,MAAM;EAEpD,IAAI,SAAS,OAAO;AAGpB,OAAK,OAAO,WAAW,IAAI,CACzB,UAAS,MAAM;AAIjB,WAAS,OAAO,QAAQ,SAAS,IAAI;AAGrC,MAAI,OAAO,SAAS,KAAK,OAAO,SAAS,IAAI,CAC3C,UAAS,OAAO,MAAM,GAAG,GAAG;AAG9B,SAAO;CACR;CAGD,YACEC,aAeA;EACA,MAAM,oBAAoB,YAAY,IAAI,CAAC,UAAU,EACnD,KACD,GAAE;AACH,SAAO,IAAI,gBAeT;GACA,iBAAiB,KAAK;GACtB,UAAU,KAAK;GACf,oBAAoB,KAAK;GACzB,eAAe,KAAK;GACpB,yBAAyB,KAAK;GAC9B,uBAAuB,KAAK;GAC5B,sBAAsB;GACtB,uBAAuB,KAAK;GAC5B,uBAAuB,KAAK;GAC5B,wBAAwB,KAAK;GAC7B,uBAAuB,KAAK;GAC5B,uBAAuB,KAAK;GAC5B,kBAAkB,KAAK;EACxB;CACF;;;;;;;;;;;;;;;;;CAkBD,gBACEC,SAeA;AACA,SAAO,IAAI,gBAcT;GACA,iBAAiB,KAAK;GACtB,UAAU,KAAK;GACf,oBAAoB,KAAK;GACzB,eAAe,KAAK;GACpB,yBAAyB,KAAK;GAC9B,uBAAuB,KAAK;GAC5B,sBAAsB,KAAK;GAC3B,uBAAuB,KAAK;GAC5B,uBAAuB,KAAK;GAC5B,wBAAwB,KAAK;GAC7B,uBAAuB,KAAK;GAC5B,uBAAuB;IACrB,GAAG,KAAK;IACR,GAAG;GACJ;EACF;CACF;;;;;;;;;;;CAYD,WACEC,MAmBA;AAEA,MAAI,SAAS,UAAU,KAAK,qBAAqB,SAAS,GAAG;GAC3D,MAAM,mBAAmB,KAAK,qBAAqB,KACjD,CAAC,MAAM,EAAE,SAAS,KACnB;AACD,QAAK,kBAAkB;IACrB,MAAM,YAAY,KAAK,qBACpB,IAAI,CAAC,MAAM,EAAE,KAAK,CAClB,KAAK,KAAK;AACb,UAAM,IAAI,OACP,cAAc,KAAe,wCAAwC,UAAU;GAEnF;EACF;AAED,SAAO,IAAI,gBAeT;GACA,iBAAiB,KAAK;GACtB,UAAU,KAAK;GACf,oBAAoB,KAAK;GACzB,eAAe,KAAK;GACpB,yBAAyB,KAAK;GAC9B,uBAAuB,KAAK;GAC5B,sBAAsB,KAAK;GAC3B,uBACE,SAAS,kBAAsB;GACjC,uBAAuB,KAAK;GAC5B,wBAAwB,KAAK;GAC7B,uBAAuB,KAAK;GAC5B,uBAAuB,KAAK;GAC5B,kBAAkB,KAAK;EACxB;CACF;CAGD,MACEC,MAeA;EACA,MAAM,cAAc,gBAAgB,UAAU,MAAM,KAAK,SAAS;AAClE,SAAO,IAAI,gBAeT;GACA,iBAAiB,KAAK;GACtB,UAAU;GACV,oBAAoB,KAAK;GACzB,eAAe,KAAK;GACpB,yBAAyB,KAAK;GAC9B,uBAAuB,KAAK;GAC5B,sBAAsB,KAAK;GAC3B,uBAAuB,KAAK;GAC5B,uBAAuB,KAAK;GAC5B,wBAAwB,KAAK;GAC7B,uBAAuB,KAAK;GAC5B,uBAAuB,KAAK;GAC5B,kBAAkB,KAAK;EACxB;CACF;CAGD,UACEC,IAeA;AACA,SAAO,IAAI,gBAeT;GACA,iBAAiB,KAAK;GACtB,UAAU,KAAK;GACf,oBAAoB;GACpB,eAAe,KAAK;GACpB,yBAAyB,KAAK;GAC9B,uBAAuB,KAAK;GAC5B,sBAAsB,KAAK;GAC3B,uBAAuB,KAAK;GAC5B,uBAAuB,KAAK;GAC5B,wBAAwB,KAAK;GAC7B,uBAAuB,KAAK;GAC5B,uBAAuB,KAAK;GAC5B,kBAAkB,KAAK;EACxB;CACF;CAGD,SACEC,UAeA;AACA,SAAO,IAAI,gBAeT;GACA,iBAAiB,CAAC,GAAG,UAAU,GAAG,KAAK,eAAgB;GACvD,UAAU,KAAK;GACf,oBAAoB,KAAK;GACzB,eAAe,KAAK;GACpB,yBAAyB,KAAK;GAC9B,uBAAuB,KAAK;GAC5B,sBAAsB,KAAK;GAC3B,uBAAuB,KAAK;GAC5B,uBAAuB,KAAK;GAC5B,wBAAwB,KAAK;GAC7B,uBAAuB,KAAK;GAC5B,uBAAuB,KAAK;GAC5B,kBAAkB,KAAK;EACxB;CACF;CAED,OACEC,QAeA;AACA,SAAO,IAAI,gBAeT;GACA,iBAAiB,KAAK;GACtB,UAAU,KAAK;GACf,oBAAoB,KAAK;GAKzB,eAAe;GACf,yBAAyB,KACtB;GAKH,uBAAuB,KAAK;GAC5B,sBAAsB,KAAK;GAC3B,uBAAuB,KAAK;GAC5B,uBAAuB,KAAK;GAC5B,wBAAwB,KAAK;GAC7B,uBAAuB,KACpB;GAKH,uBAAuB,KAAK;GAC5B,kBAAkB,KAAK;EACxB;CACF;CAED,UAIEC,WAeA;AACA,SAAO,IAAI,gBAeT;GACA,iBAAiB,KAAK;GACtB,UAAU,KAAK;GACf,oBAAoB,KAAK;GACzB,eAAe,KAAK;GACpB,yBAAyB,KAAK;GAC9B,uBAAuB;GACvB,sBAAsB,KAAK;GAC3B,uBAAuB,KAAK;GAC5B,uBAAuB,KAAK;GAC5B,wBAAwB,KAAK;GAC7B,uBAAuB,KAAK;GAC5B,uBAAuB,KAAK;GAC5B,kBAAkB,KAAK;EACxB;CACF;CAED,QACEC,SAeA;AACA,SAAO,IAAI,gBAeT;GACA,iBAAiB,KAAK;GACtB,UAAU,KAAK;GACf,oBAAoB,KAAK;GAKzB,eAAe,KAAK;GACpB,yBAAyB;GACzB,uBAAuB,KAAK;GAC5B,sBAAsB,KAAK;GAC3B,uBAAuB,KAAK;GAC5B,uBAAuB,KAAK;GAC5B,wBAAwB,KAAK;GAC7B,uBAAuB,KACpB;GAKH,uBAAuB,KAAK;GAC5B,kBAAkB,KAAK;EACxB;CACF;;;;;CAMD,SACEC,SAeA;AACA,SAAO,IAAI,gBAeT;GACA,iBAAiB,KAAK;GACtB,UAAU,KAAK;GACf,oBAAoB,KAAK;GACzB,eAAe,KAAK;GAGpB,yBAAyB,KAAK;GAG9B,uBAAuB,KAAK;GAC5B,sBAAsB,KAAK;GAC3B,uBAAuB,KAAK;GAC5B,uBAAuB,KAAK;GAC5B,wBAAwB;GACxB,uBAAuB,KAAK;GAC5B,kBAAkB,KAAK;EACxB;CACF;;;;;;CAOD,QACEC,SAeA;AACA,SAAO,IAAI,gBAeT;GACA,iBAAiB,KAAK;GACtB,UAAU,KAAK;GACf,oBAAoB,KAAK;GACzB,eAAe,KAAK;GACpB,yBAAyB,KAAK;GAC9B,uBAAuB,KAAK;GAC5B,sBAAsB,KAAK;GAC3B,uBAAuB,KAAK;GAC5B,uBAAuB;GACvB,wBAAwB,KAAK;GAC7B,uBAAuB,KACpB;GAKH,uBAAuB,KAAK;GAC5B,kBAAkB,KAAK;EACxB;CACF;;;;;CAMD,MACEC,WAeA;AACA,SAAO,IAAI,gBAeT;GACA,iBAAiB,KAAK;GACtB,UAAU,KAAK;GACf,oBAAoB,KAAK;GACzB,eAAe,KAAK;GACpB,yBAAyB,KAAK;GAC9B,uBAAuB,KAAK;GAC5B,sBAAsB,KAAK;GAC3B,uBAAuB,KAAK;GAC5B,uBAAuB,KAAK;GAC5B,wBAAwB,KAAK;GAC7B,uBAAuB;GACvB,uBAAuB,KAAK;GAC5B,kBAAkB,KAAK;EACxB;CACF;;;;;;;;;;;;;;;;;;;CAoBD,IACEC,QAgBA;AACA,SAAO,IAAI,gBAeT;GACA,iBAAiB,KAAK;GACtB,UAAU,KAAK;GACf,oBAAoB,KAAK;GACzB,eAAe,KAAK;GACpB,yBAAyB,KAAK;GAC9B,uBAAuB,KAAK;GAC5B,sBAAsB,KAAK;GAC3B,uBAAuB,KAAK;GAC5B,uBAAuB,KAAK;GAC5B,wBAAwB,KAAK;GAC7B,uBAAuB,KAAK;GAC5B,uBAAuB,KAAK;GAC5B,kBAAkB;EACnB;CACF;CAED,AAAQ,cACNC,QACAV,MAiBA;EACA,MAAM,WAAW,gBAAgB,UAAU,MAAM,KAAK,SAAS;EAC/D,MAAM,UAAU,IAAI,gBAgBlB,UAAU;AAEZ,MAAI,KAAK,mBAEP,SAAQ,aAAa,KAAK;AAE5B,MAAI,KAAK,gBAAgB,OAEvB,SAAQ,YAAY,CAAC,GAAG,KAAK,eAAgB;AAG/C,MAAI,KAAK,cACP,SAAQ,UAAU,KAAK;AAGzB,MAAI,KAAK,wBACP,SAAQ,cAAc,KAAK;AAO7B,MAAI,KAAK,sBACP,SAAQ,cAAc,KAAK,sBAAsB;AAInD,UAAQ,wBAAwB,KAAK;AACrC,MAAI,KAAK,sBACP,SAAQ,kBAAkB,KAAK;AAIjC,MAAI,KAAK,sBACP,SAAQ,mBAAmB,KAAK,sBAA6B;AAI/D,MAAI,KAAK,uBACP,SAAQ,oBAAoB,KAAK,uBAA8B;AAIjE,MAAI,KAAK,sBACP,SAAQ,kBAAkB,KAAK;AAIjC,UAAQ,yBAAyB,KAAK;AAGtC,MAAI,KAAK,iBACP,SAAQ,aAAa,KAAK;AAG5B,SAAO;CACR;CAED,KAA2BA,MAAa;AACtC,SAAO,KAAK,cAAc,QAAQ,KAAK;CACxC;CAED,IAA0BA,MAAa;AACrC,SAAO,KAAK,cAAc,OAAO,KAAK;CACvC;CAED,IAA0BA,MAAa;AACrC,SAAO,KAAK,cAAc,OAAO,KAAK;CACvC;CAED,OAA6BA,MAAa;AACxC,SAAO,KAAK,cAAc,UAAU,KAAK;CAC1C;CAED,MAA4BA,MAAa;AACvC,SAAO,KAAK,cAAc,SAAS,KAAK;CACzC;CAED,QAA8BA,MAAa;AACzC,SAAO,KAAK,cAAc,WAAW,KAAK;CAC3C;AACF;AAiED,MAAa,IAAI,IAAI"}

package/dist/{Function-CD3rXWfa.d.mts → Function-Vh1t-Qjj.d.mts}

@@ -1,4 +1,4 @@
-import { Construct, ConstructType } from "./Construct-DDR0295I.mjs";
+import { Construct, ConstructType } from "./Construct-jBKqb-Zi.mjs";
 import { Service, ServiceRecord } from "@geekmidas/services";
 import { AuditStorage, AuditableAction, Auditor } from "@geekmidas/audit";
 import { EventPublisher, MappedEvent } from "@geekmidas/events";
@@ -73,4 +73,4 @@ type FunctionContext<Input extends ComposableStandardSchema | undefined = undefi
 } & DatabaseContext<TDatabase> & AuditorContext<TAuditAction, TAuditStorage>;
 //#endregion
 export { Function, FunctionContext, FunctionFactory, FunctionHandler };
-//# sourceMappingURL=Function-CD3rXWfa.d.mts.map
+//# sourceMappingURL=Function-Vh1t-Qjj.d.mts.map

package/dist/{FunctionBuilder-j2VkwuGf.d.mts → FunctionBuilder-3jsoFffg.d.mts}

@@ -1,6 +1,6 @@
-import { ConstructType } from "./Construct-DDR0295I.mjs";
-import { Function, FunctionHandler } from "./Function-CD3rXWfa.mjs";
-import { BaseFunctionBuilder } from "./BaseFunctionBuilder-Ct6zY6Jq.mjs";
+import { ConstructType } from "./Construct-jBKqb-Zi.mjs";
+import { Function, FunctionHandler } from "./Function-Vh1t-Qjj.mjs";
+import { BaseFunctionBuilder } from "./BaseFunctionBuilder-CoV7J45W.mjs";
 import { Service } from "@geekmidas/services";
 import { AuditStorage, AuditableAction } from "@geekmidas/audit";
 import { EventPublisher } from "@geekmidas/events";
@@ -35,4 +35,4 @@ declare class FunctionBuilder<TInput extends ComposableStandardSchema, OutSchema
 }
 //#endregion
 export { FunctionBuilder };
-//# sourceMappingURL=FunctionBuilder-j2VkwuGf.d.mts.map
+//# sourceMappingURL=FunctionBuilder-3jsoFffg.d.mts.map

package/dist/{FunctionExecutionWrapper-B0WP-Vec.d.mts → FunctionExecutionWrapper-CI3CaoCo.d.mts}

@@ -1,4 +1,4 @@
-import { Function, FunctionHandler } from "./Function-CD3rXWfa.mjs";
+import { Function, FunctionHandler } from "./Function-Vh1t-Qjj.mjs";
 import { Service, ServiceDiscovery, ServiceRecord } from "@geekmidas/services";
 import { AuditStorage, AuditableAction, Auditor } from "@geekmidas/audit";
 import { EnvironmentParser } from "@geekmidas/envkit";
@@ -45,4 +45,4 @@ declare abstract class FunctionExecutionWrapper<TInput extends ComposableStandar
 }
 //#endregion
 export { FunctionExecutionWrapper };
-//# sourceMappingURL=FunctionExecutionWrapper-B0WP-Vec.d.mts.map
+//# sourceMappingURL=FunctionExecutionWrapper-CI3CaoCo.d.mts.map

package/dist/{HonoEndpointAdaptor-CLOpobdq.d.cts → HonoEndpointAdaptor-BJh4J-J9.d.cts}

@@ -1,12 +1,12 @@
 import { HttpMethod } from "./types-Bp9ysFXd.cjs";
-import { Endpoint, EndpointSchemas } from "./Endpoint-D2Imgihs.cjs";
+import { Endpoint, EndpointSchemas } from "./Endpoint-CC2RGjkl.cjs";
 import { AuditStorage, AuditableAction } from "@geekmidas/audit";
 import { EventPublisher } from "@geekmidas/events";
 import { Logger } from "@geekmidas/logger";
 import { Service, ServiceDiscovery, ServiceRecord } from "@geekmidas/services";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 import { EnvironmentParser } from "@geekmidas/envkit";
-import * as hono_types5 from "hono/types";
+import * as hono_types0 from "hono/types";
 import { Context, Hono } from "hono";
 
 //#region src/endpoints/HonoEndpointAdaptor.d.ts
@@ -33,11 +33,11 @@ declare class HonoEndpoint<TRoute extends string, TMethod extends HttpMethod, TI
   static validate<T extends StandardSchemaV1>(c: Context<any, string, {}>, data: unknown, schema?: T): Promise<any>;
   addRoute(serviceDiscovery: ServiceDiscovery<ServiceRecord<TServices>, TLogger>, app: Hono): void;
   static applyEventMiddleware(app: Hono, serviceDiscovery: ServiceDiscovery<any, any>): void;
-  static fromRoutes<TLogger extends Logger, TServices extends Service[]>(routes: string[], envParser: EnvironmentParser<{}>, app: Hono<hono_types5.BlankEnv, hono_types5.BlankSchema, "/">, logger: TLogger, cwd?: string, options?: HonoEndpointOptions): Promise<Hono>;
+  static fromRoutes<TLogger extends Logger, TServices extends Service[]>(routes: string[], envParser: EnvironmentParser<{}>, app: Hono<hono_types0.BlankEnv, hono_types0.BlankSchema, "/">, logger: TLogger, cwd?: string, options?: HonoEndpointOptions): Promise<Hono>;
   static addRoutes<TServices extends Service[] = [], TLogger extends Logger = Logger>(endpoints: Endpoint<string, HttpMethod, any, any, TServices, TLogger>[], serviceDiscovery: ServiceDiscovery<ServiceRecord<TServices>, TLogger>, app: Hono, options?: HonoEndpointOptions): void;
   static addRoute<TRoute extends string, TMethod extends HttpMethod, TInput extends EndpointSchemas = {}, TOutSchema extends StandardSchemaV1 | undefined = undefined, TServices extends Service[] = [], TLogger extends Logger = Logger, TSession = unknown, TEventPublisher extends EventPublisher<any> | undefined = undefined, TEventPublisherServiceName extends string = string, TAuditStorage extends AuditStorage | undefined = undefined, TAuditStorageServiceName extends string = string, TAuditAction extends AuditableAction<string, unknown> = AuditableAction<string, unknown>, TDatabase = undefined, TDatabaseServiceName extends string = string>(endpoint: Endpoint<TRoute, TMethod, TInput, TOutSchema, TServices, TLogger, TSession, TEventPublisher, TEventPublisherServiceName, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>, serviceDiscovery: ServiceDiscovery<ServiceRecord<TServices>, TLogger>, app: Hono): void;
   static addDocsRoute<TServices extends Service[] = [], TLogger extends Logger = Logger>(endpoints: Endpoint<string, HttpMethod, any, any, TServices, TLogger>[], app: Hono, docsPath: string, openApiOptions?: HonoEndpointOptions['openApiOptions']): void;
 }
 //#endregion
 export { HonoEndpoint, HonoEndpointOptions };
-//# sourceMappingURL=HonoEndpointAdaptor-CLOpobdq.d.cts.map
+//# sourceMappingURL=HonoEndpointAdaptor-BJh4J-J9.d.cts.map

package/dist/{HonoEndpointAdaptor-Bg_vTyA5.mjs → HonoEndpointAdaptor-CcvXzoYV.mjs}

@@ -1,8 +1,9 @@
 import { publishConstructEvents } from "./publisher-Bw4770Hi.mjs";
-import { Endpoint, ResponseBuilder } from "./Endpoint-DbPsw13b.mjs";
-import { createAuditContext, executeWithAuditTransaction } from "./processAudits-DfcB-X-4.mjs";
-import { getEndpointsFromRoutes } from "./helpers-CrrdyA04.mjs";
+import { Endpoint, ResponseBuilder } from "./Endpoint-B70_KKhu.mjs";
+import { createAuditContext, executeWithAuditTransaction } from "./processAudits-Dj8UGqcW.mjs";
+import { getEndpointsFromRoutes } from "./helpers-C3B2lVrM.mjs";
 import { parseHonoQuery } from "./parseHonoQuery-CwFKw2ua.mjs";
+import { withRlsContext } from "@geekmidas/db/rls";
 import { wrapError } from "@geekmidas/errors";
 import { ServiceDiscovery } from "@geekmidas/services";
 import { checkRateLimit, getRateLimitHeaders } from "@geekmidas/rate-limit";
@@ -122,34 +123,46 @@ var HonoEndpoint = class HonoEndpoint {
 				});
 				const audits = endpoint.audits;
 				if (!auditContext && audits?.length) logger$1.warn("No auditor storage service available");
+				const rlsActive = endpoint.rlsConfig && !endpoint.rlsBypass && rawDb !== void 0;
+				const rlsContext = rlsActive ? await endpoint.rlsConfig.extractor({
+					services,
+					session,
+					header,
+					cookie,
+					logger: logger$1
+				}) : void 0;
 				const result = await executeWithAuditTransaction(auditContext, async (auditor) => {
 					const sameDatabase = auditContext?.storage?.databaseServiceName && auditContext.storage.databaseServiceName === endpoint.databaseService?.serviceName;
-					const db = sameDatabase ? auditor?.getTransaction?.() ?? rawDb : rawDb;
-					const responseBuilder = new ResponseBuilder();
-					const response = await endpoint.handler({
-						services,
-						logger: logger$1,
-						body: c.req.valid("json"),
-						query: c.req.valid("query"),
-						params: c.req.valid("param"),
-						session,
-						header,
-						cookie,
-						auditor,
-						db
-					}, responseBuilder);
-					let data = response;
-					let metadata$1 = responseBuilder.getMetadata();
-					if (Endpoint.hasMetadata(response)) {
-						data = response.data;
-						metadata$1 = response.metadata;
-					}
-					const output$1 = endpoint.outputSchema ? await endpoint.parseOutput(data) : void 0;
-					return {
-						output: output$1,
-						metadata: metadata$1,
-						responseBuilder
+					const baseDb = sameDatabase ? auditor?.getTransaction?.() ?? rawDb : rawDb;
+					const executeHandler = async (db) => {
+						const responseBuilder = new ResponseBuilder();
+						const response = await endpoint.handler({
+							services,
+							logger: logger$1,
+							body: c.req.valid("json"),
+							query: c.req.valid("query"),
+							params: c.req.valid("param"),
+							session,
+							header,
+							cookie,
+							auditor,
+							db
+						}, responseBuilder);
+						let data = response;
+						let metadata$1 = responseBuilder.getMetadata();
+						if (Endpoint.hasMetadata(response)) {
+							data = response.data;
+							metadata$1 = response.metadata;
+						}
+						const output$1 = endpoint.outputSchema ? await endpoint.parseOutput(data) : void 0;
+						return {
+							output: output$1,
+							metadata: metadata$1,
+							responseBuilder
+						};
 					};
+					if (rlsActive && rlsContext && baseDb) return withRlsContext(baseDb, rlsContext, async (trx) => executeHandler(trx), { prefix: endpoint.rlsConfig.prefix });
+					return executeHandler(baseDb);
 				}, async (result$1, auditor) => {
 					if (!audits?.length) return;
 					for (const audit of audits) {
@@ -161,7 +174,7 @@ var HonoEndpoint = class HonoEndpoint {
 							entityId
 						});
 					}
-				});
+				}, { db: rawDb });
 				const { output, metadata } = result;
 				try {
 					let status = endpoint.status;
@@ -213,4 +226,4 @@ var HonoEndpoint = class HonoEndpoint {
 
 //#endregion
 export { HonoEndpoint };
-//# sourceMappingURL=HonoEndpointAdaptor-Bg_vTyA5.mjs.map
+//# sourceMappingURL=HonoEndpointAdaptor-CcvXzoYV.mjs.map

package/dist/HonoEndpointAdaptor-CcvXzoYV.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"HonoEndpointAdaptor-CcvXzoYV.mjs","names":["endpoint: Endpoint<\n      TRoute,\n      TMethod,\n      TInput,\n      TOutSchema,\n      TServices,\n      TLogger,\n      TSession,\n      TEventPublisher,\n      TEventPublisherServiceName,\n      TAuditStorage,\n      TAuditStorageServiceName,\n      TAuditAction,\n      TDatabase,\n      TDatabaseServiceName\n    >","c: Context<any, string, {}>","data: unknown","schema?: T","serviceDiscovery: ServiceDiscovery<ServiceRecord<TServices>, TLogger>","app: Hono","serviceDiscovery: ServiceDiscovery<any, any>","logger","routes: string[]","envParser: EnvironmentParser<{}>","logger: TLogger","options?: HonoEndpointOptions","endpoints: Endpoint<string, HttpMethod, any, any, TServices, TLogger>[]","db: TDatabase | undefined","metadata","output","result","validationError: any","e: any","docsPath: string","openApiOptions?: HonoEndpointOptions['openApiOptions']"],"sources":["../src/endpoints/HonoEndpointAdaptor.ts"],"sourcesContent":["import type { AuditStorage, AuditableAction } from '@geekmidas/audit';\nimport type { EnvironmentParser } from '@geekmidas/envkit';\nimport type { EventPublisher } from '@geekmidas/events';\nimport type { Logger } from '@geekmidas/logger';\nimport { checkRateLimit, getRateLimitHeaders } from '@geekmidas/rate-limit';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport { type Context, Hono } from 'hono';\nimport { setCookie } from 'hono/cookie';\nimport { logger as honoLogger } from 'hono/logger';\nimport { timing } from 'hono/timing';\nimport { validator } from 'hono/validator';\nimport type { HttpMethod, LowerHttpMethod } from '../types';\nimport {\n  Endpoint,\n  type EndpointContext,\n  type EndpointSchemas,\n  ResponseBuilder,\n} from './Endpoint';\nimport { getEndpointsFromRoutes } from './helpers';\nimport { parseHonoQuery } from './parseHonoQuery';\n\nimport { withRlsContext } from '@geekmidas/db/rls';\nimport { wrapError } from '@geekmidas/errors';\nimport {\n  type Service,\n  ServiceDiscovery,\n  type ServiceRecord,\n} from '@geekmidas/services';\nimport type { ContentfulStatusCode } from 'hono/utils/http-status';\nimport { publishConstructEvents } from '../publisher';\nimport type { MappedAudit } from './audit';\nimport {\n  createAuditContext,\n  executeWithAuditTransaction,\n} from './processAudits';\n\nexport interface HonoEndpointOptions {\n  /**\n   * Path where OpenAPI documentation will be served.\n   * Set to false to disable docs route.\n   * @default '/docs'\n   */\n  docsPath?: string | false;\n  /**\n   * OpenAPI schema options\n   */\n  openApiOptions?: {\n    title?: string;\n    version?: string;\n    description?: string;\n  };\n}\n\nexport class HonoEndpoint<\n  TRoute extends string,\n  TMethod extends HttpMethod,\n  TInput extends EndpointSchemas = {},\n  TOutSchema extends StandardSchemaV1 | undefined = undefined,\n  TServices extends Service[] = [],\n  TLogger extends Logger = Logger,\n  TSession = unknown,\n  TEventPublisher extends EventPublisher<any> | undefined = undefined,\n  TEventPublisherServiceName extends string = string,\n  TAuditStorage extends AuditStorage | undefined = undefined,\n  TAuditStorageServiceName extends string = string,\n  TAuditAction extends AuditableAction<string, unknown> = AuditableAction<\n    string,\n    unknown\n  >,\n  TDatabase = undefined,\n  TDatabaseServiceName extends string = string,\n> {\n  constructor(\n    private readonly endpoint: Endpoint<\n      TRoute,\n      TMethod,\n      TInput,\n      TOutSchema,\n      TServices,\n      TLogger,\n      TSession,\n      TEventPublisher,\n      TEventPublisherServiceName,\n      TAuditStorage,\n      TAuditStorageServiceName,\n      TAuditAction,\n      TDatabase,\n      TDatabaseServiceName\n    >,\n  ) {}\n\n  static isDev = process.env.NODE_ENV === 'development';\n\n  static async validate<T extends StandardSchemaV1>(\n    c: Context<any, string, {}>,\n    data: unknown,\n    schema?: T,\n  ) {\n    if (!schema) {\n      return undefined;\n    }\n\n    const parsed = await Endpoint.validate(schema, data);\n\n    if (parsed.issues) {\n      return c.json(parsed.issues, 422);\n    }\n\n    return parsed.value;\n  }\n  addRoute(\n    serviceDiscovery: ServiceDiscovery<ServiceRecord<TServices>, TLogger>,\n    app: Hono,\n  ): void {\n    HonoEndpoint.addRoute(this.endpoint, serviceDiscovery, app);\n  }\n\n  static applyEventMiddleware(\n    app: Hono,\n    serviceDiscovery: ServiceDiscovery<any, any>,\n  ) {\n    app.use(async (c, next) => {\n      await next();\n      // @ts-ignore\n      const endpoint = c.get('__endpoint') as Endpoint<\n        any,\n        any,\n        any,\n        any,\n        any,\n        any,\n        any,\n        any\n      >;\n      // @ts-ignore\n      const response = c.get('__response');\n      // @ts-ignore\n      const logger = c.get('__logger') as Logger;\n\n      if (Endpoint.isSuccessStatus(c.res.status) && endpoint) {\n        // Process events (audits are handled in the handler with transaction support)\n        await publishConstructEvents<any, any>(\n          endpoint,\n          response,\n          serviceDiscovery,\n          logger,\n        );\n      }\n    });\n  }\n\n  static async fromRoutes<TLogger extends Logger, TServices extends Service[]>(\n    routes: string[],\n    envParser: EnvironmentParser<{}>,\n    app = new Hono(),\n    logger: TLogger,\n    cwd = process.cwd(),\n    options?: HonoEndpointOptions,\n  ): Promise<Hono> {\n    const endpoints = await getEndpointsFromRoutes<TServices>(routes, cwd);\n    const serviceDiscovery = ServiceDiscovery.getInstance<\n      ServiceRecord<TServices>,\n      TLogger\n    >(logger, envParser);\n\n    HonoEndpoint.addRoutes(endpoints, serviceDiscovery, app, options);\n\n    return app;\n  }\n\n  static addRoutes<\n    TServices extends Service[] = [],\n    TLogger extends Logger = Logger,\n  >(\n    endpoints: Endpoint<string, HttpMethod, any, any, TServices, TLogger>[],\n    serviceDiscovery: ServiceDiscovery<ServiceRecord<TServices>, TLogger>,\n    app: Hono,\n    options?: HonoEndpointOptions,\n  ): void {\n    // Add timing middleware (always enabled)\n    app.use('*', timing());\n\n    // Add logger middleware in development mode\n\n    if (HonoEndpoint.isDev) {\n      app.use('*', honoLogger());\n    }\n\n    // Add docs route if not disabled\n    const docsPath =\n      options?.docsPath !== false ? options?.docsPath || '/docs' : null;\n    if (docsPath) {\n      HonoEndpoint.addDocsRoute(\n        endpoints,\n        app,\n        docsPath,\n        options?.openApiOptions,\n      );\n    }\n\n    // Sort endpoints to ensure static routes come before dynamic ones\n    const sortedEndpoints = endpoints.sort((a, b) => {\n      const aSegments = a.route.split('/');\n      const bSegments = b.route.split('/');\n\n      // Compare each segment\n      for (let i = 0; i < Math.max(aSegments.length, bSegments.length); i++) {\n        const aSegment = aSegments[i] || '';\n        const bSegment = bSegments[i] || '';\n\n        // If one is dynamic and the other is not, static comes first\n        const aIsDynamic = aSegment.startsWith(':');\n        const bIsDynamic = bSegment.startsWith(':');\n\n        if (!aIsDynamic && bIsDynamic) return -1;\n        if (aIsDynamic && !bIsDynamic) return 1;\n\n        // If both are the same type, compare alphabetically\n        if (aSegment !== bSegment) {\n          return aSegment.localeCompare(bSegment);\n        }\n      }\n\n      return 0;\n    });\n    HonoEndpoint.applyEventMiddleware(app, serviceDiscovery);\n    for (const endpoint of sortedEndpoints) {\n      HonoEndpoint.addRoute(endpoint, serviceDiscovery, app);\n    }\n  }\n\n  static addRoute<\n    TRoute extends string,\n    TMethod extends HttpMethod,\n    TInput extends EndpointSchemas = {},\n    TOutSchema extends StandardSchemaV1 | undefined = undefined,\n    TServices extends Service[] = [],\n    TLogger extends Logger = Logger,\n    TSession = unknown,\n    TEventPublisher extends EventPublisher<any> | undefined = undefined,\n    TEventPublisherServiceName extends string = string,\n    TAuditStorage extends AuditStorage | undefined = undefined,\n    TAuditStorageServiceName extends string = string,\n    TAuditAction extends AuditableAction<string, unknown> = AuditableAction<\n      string,\n      unknown\n    >,\n    TDatabase = undefined,\n    TDatabaseServiceName extends string = string,\n  >(\n    endpoint: Endpoint<\n      TRoute,\n      TMethod,\n      TInput,\n      TOutSchema,\n      TServices,\n      TLogger,\n      TSession,\n      TEventPublisher,\n      TEventPublisherServiceName,\n      TAuditStorage,\n      TAuditStorageServiceName,\n      TAuditAction,\n      TDatabase,\n      TDatabaseServiceName\n    >,\n    serviceDiscovery: ServiceDiscovery<ServiceRecord<TServices>, TLogger>,\n    app: Hono,\n  ): void {\n    const { route } = endpoint;\n    const method = endpoint.method.toLowerCase() as LowerHttpMethod<TMethod>;\n\n    app[method](\n      route,\n      validator('json', (value, c) =>\n        HonoEndpoint.validate(c, value, endpoint.input?.body),\n      ),\n      validator('query', (_, c) => {\n        const parsedQuery = parseHonoQuery(c);\n        return HonoEndpoint.validate(c, parsedQuery, endpoint.input?.query);\n      }),\n      validator('param', (params, c) =>\n        HonoEndpoint.validate(c, params, endpoint.input?.params),\n      ),\n      async (c) => {\n        const logger = endpoint.logger.child({\n          endpoint: endpoint.fullPath,\n          route: endpoint.route,\n          host: c.header('host'),\n          method: endpoint.method,\n          path: c.req.path,\n        }) as TLogger;\n\n        try {\n          const headerValues = c.req.header();\n\n          const header = Endpoint.createHeaders(headerValues);\n          const cookie = Endpoint.createCookies(headerValues.cookie);\n\n          const services = await serviceDiscovery.register(endpoint.services);\n\n          // Resolve database service early so it's available for session extraction\n          const rawDb = endpoint.databaseService\n            ? await serviceDiscovery\n                .register([endpoint.databaseService])\n                .then(\n                  (s) =>\n                    s[endpoint.databaseService!.serviceName as keyof typeof s],\n                )\n            : undefined;\n\n          const session = await endpoint.getSession({\n            services,\n            logger,\n            header,\n            cookie,\n            ...(rawDb !== undefined && { db: rawDb }),\n          } as any);\n\n          const isAuthorized = await endpoint.authorize({\n            header,\n            cookie,\n            services,\n            logger,\n            session,\n          });\n\n          if (!isAuthorized) {\n            logger.warn('Unauthorized access attempt');\n            return c.json({ error: 'Unauthorized' }, 401);\n          }\n\n          // Check rate limit if configured\n          if (endpoint.rateLimit) {\n            const rateLimitInfo = await checkRateLimit(endpoint.rateLimit, {\n              header,\n              services,\n              logger,\n              session,\n              path: c.req.path,\n              method: endpoint.method,\n            });\n\n            // Set rate limit headers\n            const rateLimitHeaders = getRateLimitHeaders(\n              rateLimitInfo,\n              endpoint.rateLimit,\n            );\n            for (const [key, value] of Object.entries(rateLimitHeaders)) {\n              if (value) {\n                c.header(key, value);\n              }\n            }\n          }\n\n          // Create audit context if audit storage is configured\n          const auditContext = await createAuditContext(\n            endpoint,\n            serviceDiscovery,\n            logger,\n            {\n              session,\n              header,\n              cookie,\n              services: services as Record<string, unknown>,\n            },\n          );\n\n          // Warn if declarative audits are configured but no audit storage\n          const audits = endpoint.audits as MappedAudit<\n            TAuditAction,\n            TOutSchema\n          >[];\n          if (!auditContext && audits?.length) {\n            logger.warn('No auditor storage service available');\n          }\n\n          // Extract RLS context if configured and not bypassed\n          const rlsActive =\n            endpoint.rlsConfig && !endpoint.rlsBypass && rawDb !== undefined;\n          const rlsContext = rlsActive\n            ? await endpoint.rlsConfig!.extractor({\n                services,\n                session,\n                header,\n                cookie,\n                logger,\n              })\n            : undefined;\n\n          // Execute handler with automatic audit transaction support\n          const result = await executeWithAuditTransaction(\n            auditContext,\n            async (auditor) => {\n              // Use audit transaction as db only if the storage uses the same database service\n              const sameDatabase =\n                auditContext?.storage?.databaseServiceName &&\n                auditContext.storage.databaseServiceName ===\n                  endpoint.databaseService?.serviceName;\n              const baseDb = sameDatabase\n                ? (auditor?.getTransaction?.() ?? rawDb)\n                : rawDb;\n\n              // Helper to execute handler with given db\n              const executeHandler = async (db: TDatabase | undefined) => {\n                const responseBuilder = new ResponseBuilder();\n                const response = await endpoint.handler(\n                  {\n                    services,\n                    logger,\n                    body: c.req.valid('json'),\n                    query: c.req.valid('query'),\n                    params: c.req.valid('param'),\n                    session,\n                    header,\n                    cookie,\n                    auditor,\n                    db,\n                  } as unknown as EndpointContext<\n                    TInput,\n                    TServices,\n                    TLogger,\n                    TSession,\n                    TAuditAction,\n                    TDatabase,\n                    TAuditStorage\n                  >,\n                  responseBuilder,\n                );\n\n                // Check if response has metadata\n                let data = response;\n                let metadata = responseBuilder.getMetadata();\n\n                if (Endpoint.hasMetadata(response)) {\n                  data = response.data;\n                  metadata = response.metadata;\n                }\n\n                const output = endpoint.outputSchema\n                  ? await endpoint.parseOutput(data)\n                  : undefined;\n\n                return { output, metadata, responseBuilder };\n              };\n\n              // If RLS is active, wrap handler with RLS context\n              if (rlsActive && rlsContext && baseDb) {\n                return withRlsContext(\n                  baseDb as any,\n                  rlsContext,\n                  async (trx) => executeHandler(trx as TDatabase),\n                  { prefix: endpoint.rlsConfig!.prefix },\n                );\n              }\n\n              return executeHandler(baseDb as TDatabase | undefined);\n            },\n            // Process declarative audits after handler (inside transaction)\n            async (result, auditor) => {\n              if (!audits?.length) return;\n\n              for (const audit of audits) {\n                if (audit.when && !audit.when(result.output as any)) {\n                  continue;\n                }\n                const payload = audit.payload(result.output as any);\n                const entityId = audit.entityId?.(result.output as any);\n                auditor.audit(audit.type as any, payload as any, {\n                  table: audit.table,\n                  entityId,\n                });\n              }\n            },\n            // Pass rawDb so storage can reuse existing transactions\n            { db: rawDb },\n          );\n\n          const { output, metadata } = result;\n\n          try {\n            let status = endpoint.status as ContentfulStatusCode;\n\n            // Apply response metadata\n            if (metadata.status) {\n              status = metadata.status as ContentfulStatusCode;\n            }\n\n            if (metadata.headers) {\n              for (const [key, value] of Object.entries(metadata.headers)) {\n                c.header(key, value);\n              }\n            }\n\n            if (metadata.cookies) {\n              for (const [name, { value, options }] of metadata.cookies) {\n                setCookie(c, name, value, options);\n              }\n            }\n\n            // @ts-ignore\n            c.set('__response', output);\n            // @ts-ignore\n            c.set('__endpoint', endpoint);\n            // @ts-ignore\n            c.set('__logger', logger);\n            // @ts-ignore\n            c.set('__session', session);\n            // @ts-ignore\n            c.set('__services', services);\n\n            if (HonoEndpoint.isDev) {\n              logger.info({ status, body: output }, 'Outgoing response');\n            }\n            // @ts-ignore\n            return c.json(output, status);\n          } catch (validationError: any) {\n            logger.error(validationError, 'Output validation failed');\n            const error = wrapError(\n              validationError,\n              422,\n              'Response validation failed',\n            );\n            if (HonoEndpoint.isDev) {\n              logger.info(\n                { status: error.statusCode, body: error },\n                'Outgoing response',\n              );\n            }\n            return c.json(error, error.statusCode as ContentfulStatusCode);\n          }\n        } catch (e: any) {\n          logger.error(e, 'Error processing endpoint request');\n          const error = wrapError(e, 500, 'Internal Server Error');\n          if (HonoEndpoint.isDev) {\n            logger.info(\n              { status: error.statusCode, body: error },\n              'Outgoing response',\n            );\n          }\n          return c.json(error, error.statusCode as ContentfulStatusCode);\n        }\n      },\n    );\n  }\n\n  static addDocsRoute<\n    TServices extends Service[] = [],\n    TLogger extends Logger = Logger,\n  >(\n    endpoints: Endpoint<string, HttpMethod, any, any, TServices, TLogger>[],\n    app: Hono,\n    docsPath: string,\n    openApiOptions?: HonoEndpointOptions['openApiOptions'],\n  ): void {\n    app.get(docsPath, async (c) => {\n      try {\n        const openApiSchema = await Endpoint.buildOpenApiSchema(\n          endpoints,\n          openApiOptions,\n        );\n\n        return c.json(openApiSchema);\n      } catch (error) {\n        console.error('Error generating OpenAPI schema:', error);\n        return c.json(\n          { error: 'Failed to generate OpenAPI documentation' },\n          500,\n        );\n      }\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAqDA,IAAa,eAAb,MAAa,aAkBX;CACA,YACmBA,UAgBjB;EAhBiB;CAgBf;CAEJ,OAAO,QAAQ,QAAQ,IAAI,aAAa;CAExC,aAAa,SACXC,GACAC,MACAC,QACA;AACA,OAAK,OACH;EAGF,MAAM,SAAS,MAAM,SAAS,SAAS,QAAQ,KAAK;AAEpD,MAAI,OAAO,OACT,QAAO,EAAE,KAAK,OAAO,QAAQ,IAAI;AAGnC,SAAO,OAAO;CACf;CACD,SACEC,kBACAC,KACM;AACN,eAAa,SAAS,KAAK,UAAU,kBAAkB,IAAI;CAC5D;CAED,OAAO,qBACLA,KACAC,kBACA;AACA,MAAI,IAAI,OAAO,GAAG,SAAS;AACzB,SAAM,MAAM;GAEZ,MAAM,WAAW,EAAE,IAAI,aAAa;GAWpC,MAAM,WAAW,EAAE,IAAI,aAAa;GAEpC,MAAMC,WAAS,EAAE,IAAI,WAAW;AAEhC,OAAI,SAAS,gBAAgB,EAAE,IAAI,OAAO,IAAI,SAE5C,OAAM,uBACJ,UACA,UACA,kBACAA,SACD;EAEJ,EAAC;CACH;CAED,aAAa,WACXC,QACAC,WACA,MAAM,IAAI,QACVC,UACA,MAAM,QAAQ,KAAK,EACnBC,SACe;EACf,MAAM,YAAY,MAAM,uBAAkC,QAAQ,IAAI;EACtE,MAAM,mBAAmB,iBAAiB,YAGxCJ,UAAQ,UAAU;AAEpB,eAAa,UAAU,WAAW,kBAAkB,KAAK,QAAQ;AAEjE,SAAO;CACR;CAED,OAAO,UAILK,WACAR,kBACAC,KACAM,SACM;AAEN,MAAI,IAAI,KAAK,QAAQ,CAAC;AAItB,MAAI,aAAa,MACf,KAAI,IAAI,KAAK,QAAY,CAAC;EAI5B,MAAM,WACJ,SAAS,aAAa,QAAQ,SAAS,YAAY,UAAU;AAC/D,MAAI,SACF,cAAa,aACX,WACA,KACA,UACA,SAAS,eACV;EAIH,MAAM,kBAAkB,UAAU,KAAK,CAAC,GAAG,MAAM;GAC/C,MAAM,YAAY,EAAE,MAAM,MAAM,IAAI;GACpC,MAAM,YAAY,EAAE,MAAM,MAAM,IAAI;AAGpC,QAAK,IAAI,IAAI,GAAG,IAAI,KAAK,IAAI,UAAU,QAAQ,UAAU,OAAO,EAAE,KAAK;IACrE,MAAM,WAAW,UAAU,MAAM;IACjC,MAAM,WAAW,UAAU,MAAM;IAGjC,MAAM,aAAa,SAAS,WAAW,IAAI;IAC3C,MAAM,aAAa,SAAS,WAAW,IAAI;AAE3C,SAAK,cAAc,WAAY,QAAO;AACtC,QAAI,eAAe,WAAY,QAAO;AAGtC,QAAI,aAAa,SACf,QAAO,SAAS,cAAc,SAAS;GAE1C;AAED,UAAO;EACR,EAAC;AACF,eAAa,qBAAqB,KAAK,iBAAiB;AACxD,OAAK,MAAM,YAAY,gBACrB,cAAa,SAAS,UAAU,kBAAkB,IAAI;CAEzD;CAED,OAAO,SAmBLX,UAgBAI,kBACAC,KACM;EACN,MAAM,EAAE,OAAO,GAAG;EAClB,MAAM,SAAS,SAAS,OAAO,aAAa;AAE5C,MAAI,QACF,OACA,UAAU,QAAQ,CAAC,OAAO,MACxB,aAAa,SAAS,GAAG,OAAO,SAAS,OAAO,KAAK,CACtD,EACD,UAAU,SAAS,CAAC,GAAG,MAAM;GAC3B,MAAM,cAAc,eAAe,EAAE;AACrC,UAAO,aAAa,SAAS,GAAG,aAAa,SAAS,OAAO,MAAM;EACpE,EAAC,EACF,UAAU,SAAS,CAAC,QAAQ,MAC1B,aAAa,SAAS,GAAG,QAAQ,SAAS,OAAO,OAAO,CACzD,EACD,OAAO,MAAM;GACX,MAAME,WAAS,SAAS,OAAO,MAAM;IACnC,UAAU,SAAS;IACnB,OAAO,SAAS;IAChB,MAAM,EAAE,OAAO,OAAO;IACtB,QAAQ,SAAS;IACjB,MAAM,EAAE,IAAI;GACb,EAAC;AAEF,OAAI;IACF,MAAM,eAAe,EAAE,IAAI,QAAQ;IAEnC,MAAM,SAAS,SAAS,cAAc,aAAa;IACnD,MAAM,SAAS,SAAS,cAAc,aAAa,OAAO;IAE1D,MAAM,WAAW,MAAM,iBAAiB,SAAS,SAAS,SAAS;IAGnE,MAAM,QAAQ,SAAS,kBACnB,MAAM,iBACH,SAAS,CAAC,SAAS,eAAgB,EAAC,CACpC,KACC,CAAC,MACC,EAAE,SAAS,gBAAiB,aAC/B;IAGP,MAAM,UAAU,MAAM,SAAS,WAAW;KACxC;KACA;KACA;KACA;KACA,GAAI,oBAAuB,EAAE,IAAI,MAAO;IACzC,EAAQ;IAET,MAAM,eAAe,MAAM,SAAS,UAAU;KAC5C;KACA;KACA;KACA;KACA;IACD,EAAC;AAEF,SAAK,cAAc;AACjB,cAAO,KAAK,8BAA8B;AAC1C,YAAO,EAAE,KAAK,EAAE,OAAO,eAAgB,GAAE,IAAI;IAC9C;AAGD,QAAI,SAAS,WAAW;KACtB,MAAM,gBAAgB,MAAM,eAAe,SAAS,WAAW;MAC7D;MACA;MACA;MACA;MACA,MAAM,EAAE,IAAI;MACZ,QAAQ,SAAS;KAClB,EAAC;KAGF,MAAM,mBAAmB,oBACvB,eACA,SAAS,UACV;AACD,UAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,iBAAiB,CACzD,KAAI,MACF,GAAE,OAAO,KAAK,MAAM;IAGzB;IAGD,MAAM,eAAe,MAAM,mBACzB,UACA,kBACAA,UACA;KACE;KACA;KACA;KACU;IACX,EACF;IAGD,MAAM,SAAS,SAAS;AAIxB,SAAK,gBAAgB,QAAQ,OAC3B,UAAO,KAAK,uCAAuC;IAIrD,MAAM,YACJ,SAAS,cAAc,SAAS,aAAa;IAC/C,MAAM,aAAa,YACf,MAAM,SAAS,UAAW,UAAU;KAClC;KACA;KACA;KACA;KACA;IACD,EAAC;IAIN,MAAM,SAAS,MAAM,4BACnB,cACA,OAAO,YAAY;KAEjB,MAAM,eACJ,cAAc,SAAS,uBACvB,aAAa,QAAQ,wBACnB,SAAS,iBAAiB;KAC9B,MAAM,SAAS,eACV,SAAS,kBAAkB,IAAI,QAChC;KAGJ,MAAM,iBAAiB,OAAOM,OAA8B;MAC1D,MAAM,kBAAkB,IAAI;MAC5B,MAAM,WAAW,MAAM,SAAS,QAC9B;OACE;OACA;OACA,MAAM,EAAE,IAAI,MAAM,OAAO;OACzB,OAAO,EAAE,IAAI,MAAM,QAAQ;OAC3B,QAAQ,EAAE,IAAI,MAAM,QAAQ;OAC5B;OACA;OACA;OACA;OACA;MACD,GASD,gBACD;MAGD,IAAI,OAAO;MACX,IAAIC,aAAW,gBAAgB,aAAa;AAE5C,UAAI,SAAS,YAAY,SAAS,EAAE;AAClC,cAAO,SAAS;AAChB,oBAAW,SAAS;MACrB;MAED,MAAMC,WAAS,SAAS,eACpB,MAAM,SAAS,YAAY,KAAK;AAGpC,aAAO;OAAE;OAAQ;OAAU;MAAiB;KAC7C;AAGD,SAAI,aAAa,cAAc,OAC7B,QAAO,eACL,QACA,YACA,OAAO,QAAQ,eAAe,IAAiB,EAC/C,EAAE,QAAQ,SAAS,UAAW,OAAQ,EACvC;AAGH,YAAO,eAAe,OAAgC;IACvD,GAED,OAAOC,UAAQ,YAAY;AACzB,UAAK,QAAQ,OAAQ;AAErB,UAAK,MAAM,SAAS,QAAQ;AAC1B,UAAI,MAAM,SAAS,MAAM,KAAKA,SAAO,OAAc,CACjD;MAEF,MAAM,UAAU,MAAM,QAAQA,SAAO,OAAc;MACnD,MAAM,WAAW,MAAM,WAAWA,SAAO,OAAc;AACvD,cAAQ,MAAM,MAAM,MAAa,SAAgB;OAC/C,OAAO,MAAM;OACb;MACD,EAAC;KACH;IACF,GAED,EAAE,IAAI,MAAO,EACd;IAED,MAAM,EAAE,QAAQ,UAAU,GAAG;AAE7B,QAAI;KACF,IAAI,SAAS,SAAS;AAGtB,SAAI,SAAS,OACX,UAAS,SAAS;AAGpB,SAAI,SAAS,QACX,MAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,SAAS,QAAQ,CACzD,GAAE,OAAO,KAAK,MAAM;AAIxB,SAAI,SAAS,QACX,MAAK,MAAM,CAAC,MAAM,EAAE,OAAO,SAAS,CAAC,IAAI,SAAS,QAChD,WAAU,GAAG,MAAM,OAAO,QAAQ;AAKtC,OAAE,IAAI,cAAc,OAAO;AAE3B,OAAE,IAAI,cAAc,SAAS;AAE7B,OAAE,IAAI,YAAYT,SAAO;AAEzB,OAAE,IAAI,aAAa,QAAQ;AAE3B,OAAE,IAAI,cAAc,SAAS;AAE7B,SAAI,aAAa,MACf,UAAO,KAAK;MAAE;MAAQ,MAAM;KAAQ,GAAE,oBAAoB;AAG5D,YAAO,EAAE,KAAK,QAAQ,OAAO;IAC9B,SAAQU,iBAAsB;AAC7B,cAAO,MAAM,iBAAiB,2BAA2B;KACzD,MAAM,QAAQ,UACZ,iBACA,KACA,6BACD;AACD,SAAI,aAAa,MACf,UAAO,KACL;MAAE,QAAQ,MAAM;MAAY,MAAM;KAAO,GACzC,oBACD;AAEH,YAAO,EAAE,KAAK,OAAO,MAAM,WAAmC;IAC/D;GACF,SAAQC,GAAQ;AACf,aAAO,MAAM,GAAG,oCAAoC;IACpD,MAAM,QAAQ,UAAU,GAAG,KAAK,wBAAwB;AACxD,QAAI,aAAa,MACf,UAAO,KACL;KAAE,QAAQ,MAAM;KAAY,MAAM;IAAO,GACzC,oBACD;AAEH,WAAO,EAAE,KAAK,OAAO,MAAM,WAAmC;GAC/D;EACF,EACF;CACF;CAED,OAAO,aAILN,WACAP,KACAc,UACAC,gBACM;AACN,MAAI,IAAI,UAAU,OAAO,MAAM;AAC7B,OAAI;IACF,MAAM,gBAAgB,MAAM,SAAS,mBACnC,WACA,eACD;AAED,WAAO,EAAE,KAAK,cAAc;GAC7B,SAAQ,OAAO;AACd,YAAQ,MAAM,oCAAoC,MAAM;AACxD,WAAO,EAAE,KACP,EAAE,OAAO,2CAA4C,GACrD,IACD;GACF;EACF,EAAC;CACH;AACF"}