@geekmidas/constructs 10.0.0-alpha.101 → 10.0.0-alpha.103

package/dist/credential.cjs

@@ -1,156 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-let _geekmidas_manifest = require("@geekmidas/manifest");
-let _geekmidas_schema_parser = require("@geekmidas/schema/parser");
-//#region src/credential.ts
-/**
-* `Credential` — a third-party credential with a shape.
-*
-* The answer to the design's first open question, "where does `Secret` sit?".
-* It sits beside a secret rather than replacing it, because the two differ by
-* *lifecycle* and that is the only difference worth two kinds for: a secret is
-* generated and rotated by the platform and is one opaque string, while a
-* credential is issued by someone else, arrives with several fields, and is
-* worth validating on the way in.
-*
-* ```ts
-* export const stripe = new Credential('Stripe', {
-*   schema: z.object({ secretKey: z.string(), webhookSecret: z.string() }),
-* });
-*
-* // in a handler — no await, already parsed and validated
-* services.stripe.secretKey
-* ```
-*
-* **Nothing about it is async at the call site**, which is the part that looks
-* like it should be hard and is not. `Service.register()` may return a promise
-* and `ServiceDiscovery` awaits every one before a handler runs, so fetching a
-* value and validating it — including when a StandardSchema's `~standard.validate`
-* returns a promise of its own — both happen inside that existing seam.
-*
-* **One key holding JSON, not one key per field.** That is the shape a secret
-* manager stores, and it is the only shape that works with an arbitrary
-* StandardSchema: the spec has no introspection API, so enumerating a schema's
-* fields means reaching into one library's internals (`.shape`) and being wrong
-* for every other.
-*/
-var Credential = class {
-	options;
-	id;
-	service;
-	/**
-	* Declared once and read by both `declare()` and `connect()`, so the key the
-	* target publishes and the key the client reads cannot drift.
-	*/
-	keys;
-	/**
-	* The resolved value, held as the *promise* rather than the value.
-	*
-	* Caching the promise is what makes two concurrent registrations share one
-	* resolution: caching the value would let both start before either finished,
-	* which is a duplicated fetch every cold start rather than never.
-	*/
-	resolved;
-	constructor(id, options) {
-		this.options = options;
-		const canonical = (0, _geekmidas_manifest.canonicalId)(id);
-		this.id = canonical;
-		this.keys = { credentials: (0, _geekmidas_manifest.provideKey)(canonical, "credentials") };
-		this.service = {
-			serviceName: (0, _geekmidas_manifest.serviceKey)(canonical),
-			register: (registerOptions) => this.connect(registerOptions)
-		};
-	}
-	/**
-	* What the stage's `<ID>_CREDENTIALS` must look like — the schema the value
-	* is validated against where it is read. Public so a tool setting the value
-	* (`gkm secrets:add`) can check it, and describe its fields, before it is
-	* stored rather than at the first request.
-	*/
-	get credentialsSchema() {
-		return this.options.schema;
-	}
-	declare() {
-		return [{
-			kind: "credential",
-			id: this.id,
-			provides: [this.keys.credentials]
-		}];
-	}
-	connect(options) {
-		if (this.options.refresh) return this.resolve(options);
-		this.resolved ??= this.resolve(options);
-		return this.resolved;
-	}
-	resolve(options) {
-		return readCredentials(this.id, this.keys.credentials, this.options.schema, options.envParser);
-	}
-};
-/**
-* A credentials key, read and validated against its schema.
-*
-* Shared with every construct that holds a third party's credentials — an
-* `ExternalApi` reads its own the same way — so the shape a stage stores and
-* the error a bad value raises are the same everywhere.
-*
-* @throws {MalformedCredential} when the value is not what the schema says.
-*/
-async function readCredentials(id, key, schema, envParser) {
-	const { raw } = envParser.create((get) => ({ raw: get(key).string() })).parse();
-	try {
-		return await (0, _geekmidas_schema_parser.parseSchema)(schema, decodeCredentials(raw));
-	} catch (issues) {
-		throw new MalformedCredential(id, key, issues);
-	}
-}
-/**
-* The raw environment value as the thing the schema should see.
-*
-* JSON when it is JSON, and the string itself when it is not — a credential
-* with a single opaque field is ordinary, and requiring `"…"` around it would
-* be ceremony that every operator setting one by hand would get wrong once.
-*
-* Exported so a tool checking a value before it is stored reads it exactly as
-* the process that uses it will.
-*/
-function decodeCredentials(raw) {
-	const value = raw.startsWith(JSON_SCHEME) ? raw.slice(JSON_SCHEME.length) : raw;
-	try {
-		return JSON.parse(value);
-	} catch {
-		return value;
-	}
-}
-/**
-* The explicit form, for the case a credential legitimately *is* a JSON string
-* and must not be parsed into an object. Rare, and cheaper to support than to
-* explain.
-*/
-const JSON_SCHEME = "json:";
-/** A credential was set, and is not what its schema says it should be. */
-var MalformedCredential = class extends Error {
-	id;
-	key;
-	issues;
-	constructor(id, key, issues) {
-		super(`${key} is not a valid ${id} credential. It is validated where it is read, so this is the value that is set rather than the code that uses it: ${describe(issues)}`);
-		this.id = id;
-		this.key = key;
-		this.issues = issues;
-		this.name = "MalformedCredential";
-	}
-};
-/** StandardSchema issues as one line. */
-function describe(issues) {
-	if (!Array.isArray(issues)) return String(issues);
-	return issues.map((issue) => {
-		const path = issue.path?.map((segment) => typeof segment === "object" ? String(segment.key) : String(segment)).join(".");
-		return path ? `${path}: ${issue.message}` : issue.message;
-	}).join("; ");
-}
-//#endregion
-exports.Credential = Credential;
-exports.MalformedCredential = MalformedCredential;
-exports.decodeCredentials = decodeCredentials;
-exports.readCredentials = readCredentials;
-
-//# sourceMappingURL=credential.cjs.map
+const require_credential = require("./credential-DYymbp_7.cjs");
+exports.Credential = require_credential.Credential;
+exports.MalformedCredential = require_credential.MalformedCredential;
+exports.decodeCredentials = require_credential.decodeCredentials;
+exports.fake = require_credential.fake;
+exports.isFake = require_credential.isFake;
+exports.readCredentials = require_credential.readCredentials;

package/dist/credential.d.cts

@@ -1,86 +1,2 @@
-import { t as StandardSchemaV1 } from "./index-CeEtxDmK.cjs";
-import { r as Consumable } from "./construct-interface-B1AfqRl4.cjs";
-import { Service, ServiceRegisterOptions } from "@geekmidas/services";
-import { ConstructName, Declaration } from "@geekmidas/manifest";
-//#region src/credential.d.ts
-/** What a credential's schema yields. */
-type Value<TSchema extends StandardSchemaV1> = StandardSchemaV1.InferOutput<TSchema>;
-export interface CredentialOptions<TSchema extends StandardSchemaV1> {
-  /**
-   * What the credential must look like.
-   *
-   * Validated at registration, so a malformed or half-set credential fails
-   * when the process starts rather than on the first request that needs the
-   * one field somebody forgot.
-   */
-  schema: TSchema;
-  /**
-   * Re-resolve on every registration instead of once per process.
-   *
-   * Off by default: a credential is resolved once and reused, because the
-   * alternative is a fetch on every request. The cost of that default is that
-   * a rotated credential needs a restart, which is the right trade for a value
-   * that changes a few times a year — and this is the escape hatch for when it
-   * is not.
-   */
-  refresh?: boolean;
-}
-export declare class Credential<TName extends string = string, TSchema extends StandardSchemaV1 = StandardSchemaV1> implements Consumable<TName, Value<TSchema>> {
-  private readonly options;
-  readonly id: TName;
-  readonly service: Service<Uncapitalize<TName>, Value<TSchema>>;
-  /**
-   * Declared once and read by both `declare()` and `connect()`, so the key the
-   * target publishes and the key the client reads cannot drift.
-   */
-  private readonly keys;
-  /**
-   * The resolved value, held as the *promise* rather than the value.
-   *
-   * Caching the promise is what makes two concurrent registrations share one
-   * resolution: caching the value would let both start before either finished,
-   * which is a duplicated fetch every cold start rather than never.
-   */
-  private resolved?;
-  constructor(id: ConstructName<TName>, options: CredentialOptions<TSchema>);
-  /**
-   * What the stage's `<ID>_CREDENTIALS` must look like — the schema the value
-   * is validated against where it is read. Public so a tool setting the value
-   * (`gkm secrets:add`) can check it, and describe its fields, before it is
-   * stored rather than at the first request.
-   */
-  get credentialsSchema(): TSchema;
-  declare(): Declaration[];
-  private connect;
-  private resolve;
-}
-/**
- * A credentials key, read and validated against its schema.
- *
- * Shared with every construct that holds a third party's credentials — an
- * `ExternalApi` reads its own the same way — so the shape a stage stores and
- * the error a bad value raises are the same everywhere.
- *
- * @throws {MalformedCredential} when the value is not what the schema says.
- */
-export declare function readCredentials<TSchema extends StandardSchemaV1>(id: string, key: string, schema: TSchema, envParser: ServiceRegisterOptions['envParser']): Promise<Value<TSchema>>;
-/**
- * The raw environment value as the thing the schema should see.
- *
- * JSON when it is JSON, and the string itself when it is not — a credential
- * with a single opaque field is ordinary, and requiring `"…"` around it would
- * be ceremony that every operator setting one by hand would get wrong once.
- *
- * Exported so a tool checking a value before it is stored reads it exactly as
- * the process that uses it will.
- */
-export declare function decodeCredentials(raw: string): unknown;
-/** A credential was set, and is not what its schema says it should be. */
-export declare class MalformedCredential extends Error {
-  readonly id: string;
-  readonly key: string;
-  readonly issues: unknown;
-  constructor(id: string, key: string, issues: unknown);
-}
-//#endregion
-//# sourceMappingURL=credential.d.cts.map
+import { c as Credential, d as decodeCredentials, f as readCredentials, i as isFake, l as CredentialOptions, r as fake, t as Fake, u as MalformedCredential } from "./fake-Dvion_Fh.cjs";
+export { Credential, CredentialOptions, type Fake, MalformedCredential, decodeCredentials, fake, isFake, readCredentials };

package/dist/credential.d.mts

@@ -1,86 +1,2 @@
-import { t as StandardSchemaV1 } from "./index-CeEtxDmK.mjs";
-import { r as Consumable } from "./construct-interface-DluK3_da.mjs";
-import { ConstructName, Declaration } from "@geekmidas/manifest";
-import { Service, ServiceRegisterOptions } from "@geekmidas/services";
-//#region src/credential.d.ts
-/** What a credential's schema yields. */
-type Value<TSchema extends StandardSchemaV1> = StandardSchemaV1.InferOutput<TSchema>;
-export interface CredentialOptions<TSchema extends StandardSchemaV1> {
-  /**
-   * What the credential must look like.
-   *
-   * Validated at registration, so a malformed or half-set credential fails
-   * when the process starts rather than on the first request that needs the
-   * one field somebody forgot.
-   */
-  schema: TSchema;
-  /**
-   * Re-resolve on every registration instead of once per process.
-   *
-   * Off by default: a credential is resolved once and reused, because the
-   * alternative is a fetch on every request. The cost of that default is that
-   * a rotated credential needs a restart, which is the right trade for a value
-   * that changes a few times a year — and this is the escape hatch for when it
-   * is not.
-   */
-  refresh?: boolean;
-}
-export declare class Credential<TName extends string = string, TSchema extends StandardSchemaV1 = StandardSchemaV1> implements Consumable<TName, Value<TSchema>> {
-  private readonly options;
-  readonly id: TName;
-  readonly service: Service<Uncapitalize<TName>, Value<TSchema>>;
-  /**
-   * Declared once and read by both `declare()` and `connect()`, so the key the
-   * target publishes and the key the client reads cannot drift.
-   */
-  private readonly keys;
-  /**
-   * The resolved value, held as the *promise* rather than the value.
-   *
-   * Caching the promise is what makes two concurrent registrations share one
-   * resolution: caching the value would let both start before either finished,
-   * which is a duplicated fetch every cold start rather than never.
-   */
-  private resolved?;
-  constructor(id: ConstructName<TName>, options: CredentialOptions<TSchema>);
-  /**
-   * What the stage's `<ID>_CREDENTIALS` must look like — the schema the value
-   * is validated against where it is read. Public so a tool setting the value
-   * (`gkm secrets:add`) can check it, and describe its fields, before it is
-   * stored rather than at the first request.
-   */
-  get credentialsSchema(): TSchema;
-  declare(): Declaration[];
-  private connect;
-  private resolve;
-}
-/**
- * A credentials key, read and validated against its schema.
- *
- * Shared with every construct that holds a third party's credentials — an
- * `ExternalApi` reads its own the same way — so the shape a stage stores and
- * the error a bad value raises are the same everywhere.
- *
- * @throws {MalformedCredential} when the value is not what the schema says.
- */
-export declare function readCredentials<TSchema extends StandardSchemaV1>(id: string, key: string, schema: TSchema, envParser: ServiceRegisterOptions['envParser']): Promise<Value<TSchema>>;
-/**
- * The raw environment value as the thing the schema should see.
- *
- * JSON when it is JSON, and the string itself when it is not — a credential
- * with a single opaque field is ordinary, and requiring `"…"` around it would
- * be ceremony that every operator setting one by hand would get wrong once.
- *
- * Exported so a tool checking a value before it is stored reads it exactly as
- * the process that uses it will.
- */
-export declare function decodeCredentials(raw: string): unknown;
-/** A credential was set, and is not what its schema says it should be. */
-export declare class MalformedCredential extends Error {
-  readonly id: string;
-  readonly key: string;
-  readonly issues: unknown;
-  constructor(id: string, key: string, issues: unknown);
-}
-//#endregion
-//# sourceMappingURL=credential.d.mts.map
+import { c as Credential, d as decodeCredentials, f as readCredentials, i as isFake, l as CredentialOptions, r as fake, t as Fake, u as MalformedCredential } from "./fake-BcHTPz7N.mjs";
+export { Credential, CredentialOptions, type Fake, MalformedCredential, decodeCredentials, fake, isFake, readCredentials };

package/dist/credential.mjs

@@ -1,152 +1,2 @@
-import { canonicalId, provideKey, serviceKey } from "@geekmidas/manifest";
-import { parseSchema } from "@geekmidas/schema/parser";
-//#region src/credential.ts
-/**
-* `Credential` — a third-party credential with a shape.
-*
-* The answer to the design's first open question, "where does `Secret` sit?".
-* It sits beside a secret rather than replacing it, because the two differ by
-* *lifecycle* and that is the only difference worth two kinds for: a secret is
-* generated and rotated by the platform and is one opaque string, while a
-* credential is issued by someone else, arrives with several fields, and is
-* worth validating on the way in.
-*
-* ```ts
-* export const stripe = new Credential('Stripe', {
-*   schema: z.object({ secretKey: z.string(), webhookSecret: z.string() }),
-* });
-*
-* // in a handler — no await, already parsed and validated
-* services.stripe.secretKey
-* ```
-*
-* **Nothing about it is async at the call site**, which is the part that looks
-* like it should be hard and is not. `Service.register()` may return a promise
-* and `ServiceDiscovery` awaits every one before a handler runs, so fetching a
-* value and validating it — including when a StandardSchema's `~standard.validate`
-* returns a promise of its own — both happen inside that existing seam.
-*
-* **One key holding JSON, not one key per field.** That is the shape a secret
-* manager stores, and it is the only shape that works with an arbitrary
-* StandardSchema: the spec has no introspection API, so enumerating a schema's
-* fields means reaching into one library's internals (`.shape`) and being wrong
-* for every other.
-*/
-var Credential = class {
-	options;
-	id;
-	service;
-	/**
-	* Declared once and read by both `declare()` and `connect()`, so the key the
-	* target publishes and the key the client reads cannot drift.
-	*/
-	keys;
-	/**
-	* The resolved value, held as the *promise* rather than the value.
-	*
-	* Caching the promise is what makes two concurrent registrations share one
-	* resolution: caching the value would let both start before either finished,
-	* which is a duplicated fetch every cold start rather than never.
-	*/
-	resolved;
-	constructor(id, options) {
-		this.options = options;
-		const canonical = canonicalId(id);
-		this.id = canonical;
-		this.keys = { credentials: provideKey(canonical, "credentials") };
-		this.service = {
-			serviceName: serviceKey(canonical),
-			register: (registerOptions) => this.connect(registerOptions)
-		};
-	}
-	/**
-	* What the stage's `<ID>_CREDENTIALS` must look like — the schema the value
-	* is validated against where it is read. Public so a tool setting the value
-	* (`gkm secrets:add`) can check it, and describe its fields, before it is
-	* stored rather than at the first request.
-	*/
-	get credentialsSchema() {
-		return this.options.schema;
-	}
-	declare() {
-		return [{
-			kind: "credential",
-			id: this.id,
-			provides: [this.keys.credentials]
-		}];
-	}
-	connect(options) {
-		if (this.options.refresh) return this.resolve(options);
-		this.resolved ??= this.resolve(options);
-		return this.resolved;
-	}
-	resolve(options) {
-		return readCredentials(this.id, this.keys.credentials, this.options.schema, options.envParser);
-	}
-};
-/**
-* A credentials key, read and validated against its schema.
-*
-* Shared with every construct that holds a third party's credentials — an
-* `ExternalApi` reads its own the same way — so the shape a stage stores and
-* the error a bad value raises are the same everywhere.
-*
-* @throws {MalformedCredential} when the value is not what the schema says.
-*/
-async function readCredentials(id, key, schema, envParser) {
-	const { raw } = envParser.create((get) => ({ raw: get(key).string() })).parse();
-	try {
-		return await parseSchema(schema, decodeCredentials(raw));
-	} catch (issues) {
-		throw new MalformedCredential(id, key, issues);
-	}
-}
-/**
-* The raw environment value as the thing the schema should see.
-*
-* JSON when it is JSON, and the string itself when it is not — a credential
-* with a single opaque field is ordinary, and requiring `"…"` around it would
-* be ceremony that every operator setting one by hand would get wrong once.
-*
-* Exported so a tool checking a value before it is stored reads it exactly as
-* the process that uses it will.
-*/
-function decodeCredentials(raw) {
-	const value = raw.startsWith(JSON_SCHEME) ? raw.slice(JSON_SCHEME.length) : raw;
-	try {
-		return JSON.parse(value);
-	} catch {
-		return value;
-	}
-}
-/**
-* The explicit form, for the case a credential legitimately *is* a JSON string
-* and must not be parsed into an object. Rare, and cheaper to support than to
-* explain.
-*/
-const JSON_SCHEME = "json:";
-/** A credential was set, and is not what its schema says it should be. */
-var MalformedCredential = class extends Error {
-	id;
-	key;
-	issues;
-	constructor(id, key, issues) {
-		super(`${key} is not a valid ${id} credential. It is validated where it is read, so this is the value that is set rather than the code that uses it: ${describe(issues)}`);
-		this.id = id;
-		this.key = key;
-		this.issues = issues;
-		this.name = "MalformedCredential";
-	}
-};
-/** StandardSchema issues as one line. */
-function describe(issues) {
-	if (!Array.isArray(issues)) return String(issues);
-	return issues.map((issue) => {
-		const path = issue.path?.map((segment) => typeof segment === "object" ? String(segment.key) : String(segment)).join(".");
-		return path ? `${path}: ${issue.message}` : issue.message;
-	}).join("; ");
-}
-//#endregion
-export { Credential, MalformedCredential, decodeCredentials, readCredentials };
-
-//# sourceMappingURL=credential.mjs.map
+import { a as fake, i as readCredentials, n as MalformedCredential, o as isFake, r as decodeCredentials, t as Credential } from "./credential-DfSAOOdY.mjs";
+export { Credential, MalformedCredential, decodeCredentials, fake, isFake, readCredentials };

package/dist/endpoints/index.cjs

@@ -1,25 +1,31 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_EndpointFactory = require("../EndpointFactory-DJ7gXLpR.cjs");
+const require_EndpointFactory = require("../EndpointFactory-DeZTvDjU.cjs");
 const require_functions = require("../functions-CfzJG9hK.cjs");
-const require_Endpoint = require("../Endpoint-BoUg8ocM.cjs");
+const require_Endpoint = require("../Endpoint-B_UHlLxv.cjs");
 const require_surfaceEnv = require("../surfaceEnv-CNimK76p.cjs");
-const require_lazyAccessors = require("../lazyAccessors-hJKGv8Ay.cjs");
+const require_readRequestBody = require("../readRequestBody-Dej_L3c4.cjs");
 exports.BUILT_IN_SECURITY_SCHEMES = require_EndpointFactory.BUILT_IN_SECURITY_SCHEMES;
 exports.Endpoint = require_Endpoint.Endpoint;
 exports.EndpointBuilder = require_EndpointFactory.EndpointBuilder;
 exports.EndpointFactory = require_EndpointFactory.EndpointFactory;
+exports.MalformedRequestBody = require_readRequestBody.MalformedRequestBody;
 exports.NoAuthenticator = require_Endpoint.NoAuthenticator;
 exports.RLS_BYPASS = require_EndpointFactory.RLS_BYPASS;
+exports.RedirectStatus = require_Endpoint.RedirectStatus;
 exports.ResponseBuilder = require_Endpoint.ResponseBuilder;
-exports.createApiGatewayCookies = require_lazyAccessors.createApiGatewayCookies;
-exports.createApiGatewayHeaders = require_lazyAccessors.createApiGatewayHeaders;
+exports.SUPPORTED_BODY_TYPES = require_readRequestBody.SUPPORTED_BODY_TYPES;
+exports.SuccessStatus = require_Endpoint.SuccessStatus;
+exports.UnsupportedRequestContentType = require_readRequestBody.UnsupportedRequestContentType;
+exports.createApiGatewayCookies = require_readRequestBody.createApiGatewayCookies;
+exports.createApiGatewayHeaders = require_readRequestBody.createApiGatewayHeaders;
 exports.createAuthorizer = require_EndpointFactory.createAuthorizer;
-exports.createHonoCookies = require_lazyAccessors.createHonoCookies;
-exports.createHonoHeaders = require_lazyAccessors.createHonoHeaders;
-exports.createNoopCookies = require_lazyAccessors.createNoopCookies;
-exports.createNoopHeaders = require_lazyAccessors.createNoopHeaders;
+exports.createHonoCookies = require_readRequestBody.createHonoCookies;
+exports.createHonoHeaders = require_readRequestBody.createHonoHeaders;
+exports.createNoopCookies = require_readRequestBody.createNoopCookies;
+exports.createNoopHeaders = require_readRequestBody.createNoopHeaders;
 exports.defaultEnvParser = require_surfaceEnv.defaultEnvParser;
 exports.envParserFor = require_surfaceEnv.envParserFor;
 exports.getSecurityScheme = require_EndpointFactory.getSecurityScheme;
 exports.isBuiltInSecurityScheme = require_EndpointFactory.isBuiltInSecurityScheme;
 exports.publishConstructEvents = require_functions.publishConstructEvents;
+exports.readRequestBody = require_readRequestBody.readRequestBody;

package/dist/endpoints/index.d.cts

@@ -1,8 +1,9 @@
 import { s as publishConstructEvents } from "../Construct-BQALFCh2.cjs";
-import { A as getSecurityScheme, C as Authorizer, D as OAuthFlows, E as OAuthFlow, O as SecurityScheme, S as MappedAudit, T as BuiltInSecuritySchemeId, _ as RlsBypass, a as EndpointContext, b as RlsContextExtractor, c as EndpointSchemas, d as ResponseBuilder, g as RLS_BYPASS, h as SessionAuth, i as Endpoint, j as isBuiltInSecurityScheme, k as createAuthorizer, l as EndpointSurface, m as NoAuthenticator, n as ConvertRouteParams, o as EndpointHandler, r as CookieFn, s as EndpointOutput, u as HeaderFn, v as RlsConfig, w as BUILT_IN_SECURITY_SCHEMES, x as ActorExtractor, y as RlsContext } from "../Endpoint-aCvBMPoH.cjs";
-import { n as EndpointBuilder, t as EndpointFactory } from "../EndpointFactory-I7s1co3Y.cjs";
+import { A as SecurityScheme, C as ActorExtractor, D as BuiltInSecuritySchemeId, E as BUILT_IN_SECURITY_SCHEMES, M as getSecurityScheme, N as isBuiltInSecurityScheme, O as OAuthFlow, S as RlsContextExtractor, T as Authorizer, _ as SessionAuth, a as EndpointContext, b as RlsConfig, c as EndpointSchemas, d as HeaderFn, f as RedirectStatus, g as NoAuthenticator, h as SuccessStatus, i as Endpoint, j as createAuthorizer, k as OAuthFlows, l as EndpointStatus, n as ConvertRouteParams, o as EndpointHandler, p as ResponseBuilder, r as CookieFn, s as EndpointOutput, u as EndpointSurface, v as RLS_BYPASS, w as MappedAudit, x as RlsContext, y as RlsBypass } from "../Endpoint-BWyKCa2x.cjs";
+import { n as EndpointBuilder, t as EndpointFactory } from "../EndpointFactory-C1-IBwm4.cjs";
 import { EnvironmentParser } from "@geekmidas/envkit";
 import { Context } from "hono";
+import { HttpError } from "@geekmidas/errors";
 //#region src/endpoints/lazyAccessors.d.ts
 /**
  * Create a lazy header accessor for Hono.
@@ -35,6 +36,59 @@ export declare function createNoopHeaders(): HeaderFn;
  */
 export declare function createNoopCookies(): CookieFn;
 //#endregion
+//#region src/endpoints/readRequestBody.d.ts
+/**
+ * The media types an endpoint's `.body()` schema can be handed — as written
+ * in the 415 a request in any other type is answered with.
+ */
+export declare const SUPPORTED_BODY_TYPES: readonly ['application/json', 'application/x-www-form-urlencoded', 'multipart/form-data', 'text/*'];
+/**
+ * A request whose body is in a media type no endpoint reads — XML, a bare
+ * octet stream. Answered with a 415, before the body schema runs.
+ */
+export declare class UnsupportedRequestContentType extends HttpError {
+  readonly contentType: string;
+  constructor(contentType: string);
+}
+/**
+ * A body that says it is JSON and is not. Answered with a 400 — the request
+ * is broken, not merely invalid against the schema.
+ */
+export declare class MalformedRequestBody extends HttpError {
+  readonly contentType: string;
+  constructor(contentType: string, cause?: Error);
+}
+/**
+ * What a body is read from: a `Request`, or Hono's request — which caches
+ * what it read, so a later reader is not handed a spent stream.
+ */
+interface RequestBodySource {
+  json(): Promise<unknown>;
+  text(): Promise<string>;
+  formData(): Promise<FormData>;
+}
+interface ReadRequestBodyOptions {
+  /**
+   * A body with no Content-Type: read as JSON (`'json'`, what API Gateway
+   * has always done), or not read at all and handed to the schema as `{}`
+   * (`'empty'`, what a Hono server has always done).
+   */
+  untyped: 'json' | 'empty';
+}
+/**
+ * A request body, read by its Content-Type into what an endpoint's `.body()`
+ * schema validates — the one place every adaptor reads a body:
+ *
+ * - `application/json` (and `application/*+json`) — the parsed JSON.
+ * - `application/x-www-form-urlencoded` and `multipart/form-data` — a plain
+ *   object of fields, as an HTML form posts them. A repeated field, or one
+ *   named `field[]`, is an array; a file part is a `File`.
+ * - `text/*` — the text.
+ *
+ * Anything else is an {@link UnsupportedRequestContentType}.
+ */
+export declare function readRequestBody(source: RequestBodySource, contentType: string | null | undefined, options: ReadRequestBodyOptions): Promise<unknown>;
+//#endregion
 //#region src/endpoints/surfaceEnv.d.ts
 /**
  * The default parser, built once.
@@ -47,5 +101,5 @@ export declare function defaultEnvParser(): EnvironmentParser<{}>;
 /** The parser for an endpoint, from its surface or the default. */
 export declare function envParserFor(surface: EndpointSurface | undefined): EnvironmentParser<{}>;
 //#endregion
-export { type ActorExtractor, type Authorizer, BUILT_IN_SECURITY_SCHEMES, type BuiltInSecuritySchemeId, type ConvertRouteParams, Endpoint, EndpointBuilder, type EndpointContext, EndpointFactory, type EndpointHandler, type EndpointOutput, type EndpointSchemas, type MappedAudit, NoAuthenticator, type OAuthFlow, type OAuthFlows, RLS_BYPASS, ResponseBuilder, type RlsBypass, type RlsConfig, type RlsContext, type RlsContextExtractor, type SecurityScheme, type SessionAuth, createAuthorizer, getSecurityScheme, isBuiltInSecurityScheme, publishConstructEvents };
+export { type ActorExtractor, type Authorizer, BUILT_IN_SECURITY_SCHEMES, type BuiltInSecuritySchemeId, type ConvertRouteParams, Endpoint, EndpointBuilder, type EndpointContext, EndpointFactory, type EndpointHandler, type EndpointOutput, type EndpointSchemas, type EndpointStatus, type MappedAudit, NoAuthenticator, type OAuthFlow, type OAuthFlows, RLS_BYPASS, RedirectStatus, type RequestBodySource, ResponseBuilder, type RlsBypass, type RlsConfig, type RlsContext, type RlsContextExtractor, type SecurityScheme, type SessionAuth, SuccessStatus, createAuthorizer, getSecurityScheme, isBuiltInSecurityScheme, publishConstructEvents };
 //# sourceMappingURL=index.d.cts.map

package/dist/endpoints/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/endpoints/lazyAccessors.ts","../../src/endpoints/surfaceEnv.ts"],"mappings":";;;;;;;;;;;wBAgBgB,kBAAkB,GAAG,UAAU;;;;;;wBAqB/B,kBAAkB,GAAG,UAAU;;;;;wBAgC/B,wBACf,SAAS,wDACP;;;;;wBAoCa,wBACf,+BACA,mCACE;;;;wBAmHa,qBAAqB;;;;wBAUrB,qBAAqB;;;;;;;;;;wBC1MrB,oBAAoB;;wBASpB,aACf,SAAS,8BACP"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/endpoints/lazyAccessors.ts","../../src/endpoints/readRequestBody.ts","../../src/endpoints/surfaceEnv.ts"],"mappings":";;;;;;;;;;;;wBAgBgB,kBAAkB,GAAG,UAAU;;;;;;wBAqB/B,kBAAkB,GAAG,UAAU;;;;;wBAgC/B,wBACf,SAAS,wDACP;;;;;wBAoCa,wBACf,+BACA,mCACE;;;;wBAmHa,qBAAqB;;;;wBAUrB,qBAAqB;;;;;;;qBCrOxB;;;;;qBAWA,sCAAsC;WAC7B;EAArB,YAAqB;;;;;;qBAiBT,6BAA6B;WAE/B;EADV,YACU,qBACT,QAAQ;;;;;;UAeO;EAChB,QAAQ;EACR,QAAQ;EACR,YAAY,QAAQ;;UAGJ;;;;;;EAMhB;;;;;;;;;;;;;;wBAeqB,gBACrB,QAAQ,mBACR,wCACA,SAAS,yBACP;;;;;;;;;;wBCnDa,oBAAoB;;wBASpB,aACf,SAAS,8BACP"}