@geekmidas/constructs 10.0.0-alpha.12 → 10.0.0-alpha.120

package/dist/{index-lAO9egTb.d.mts → EndpointFactory-Cc863XJS.d.cts}

@@ -1,34 +1,86 @@
-import { Construct } from "./Construct-Ct8nalEi.mjs";
-import { BaseFunctionBuilder } from "./index-_ajboYxK.mjs";
-import { Consumable, ServicesOf } from "./construct-interface-g5GM5pwR.mjs";
-import { HttpMethod } from "./types-aKksMEWL.mjs";
-import { ActorExtractor, AuthorizeFn, Authorizer, BuiltInSecuritySchemeId, CookieFn, Endpoint, EndpointHandler, EndpointSchemas, EndpointSurface, HeaderFn, MappedAudit, RlsBypass, RlsConfig, SecurityScheme, SessionFn, SuccessStatus } from "./Endpoint-BjWKinFA.mjs";
-import { EnvironmentParser } from "@geekmidas/envkit";
-import { Service, ServiceDiscovery } from "@geekmidas/services";
-import { AuditStorage, AuditableAction, ExtractStorageAuditAction } from "@geekmidas/audit";
-import { RateLimitConfig } from "@geekmidas/rate-limit";
-import { Context } from "hono";
-import { EventPublisher, MappedEvent } from "@geekmidas/events";
+import { n as StandardSchemaV1, t as StandardJSONSchemaV1 } from "./index-DdRjYhiJ.cjs";
+import { a as EventFor, c as Topic } from "./Construct-CFW0zjdD.cjs";
+import { c as ServicesOf, r as Consumable } from "./construct-interface-B1AfqRl4.cjs";
+import { n as BaseFunctionBuilder } from "./index-Cd2w-DRL.cjs";
+import { t as HttpMethod } from "./types-DMuSQeLL.cjs";
+import { t as EndpointTelemetry } from "./telemetry-B48RLjyk.cjs";
+import { A as SecurityScheme, C as ActorExtractor, D as BuiltInSecuritySchemeId, T as Authorizer, a as EndpointContext, b as RlsConfig, c as EndpointSchemas, i as Endpoint, l as EndpointStatus, m as SessionFn, o as EndpointHandler, t as AuthorizeFn, u as EndpointSurface, w as MappedAudit, y as RlsBypass } from "./Endpoint-DgrpG15P.cjs";
 import { Logger } from "@geekmidas/logger";
 import { InferStandardSchema } from "@geekmidas/schema";
-import { StandardSchemaV1 } from "@standard-schema/spec";
-
-//#region src/publisher.d.ts
-declare function publishConstructEvents<T extends EventPublisher<any> | undefined, OutSchema extends StandardSchemaV1 | undefined = undefined, TServiceName extends string = string, TServices extends Service[] = [], TAuditStorageServiceName extends string = string, TAuditStorage extends AuditStorage | undefined = undefined>(construct: Construct<Logger, TServiceName, T, OutSchema, TServices, TAuditStorageServiceName, TAuditStorage>, response: InferStandardSchema<OutSchema>, serviceDiscovery: ServiceDiscovery<any>, logger?: Logger): Promise<void>;
-//# sourceMappingURL=publisher.d.ts.map
-
+import { Service } from "@geekmidas/services";
+import { AuditStorage, AuditableAction, ExtractStorageAuditAction } from "@geekmidas/audit";
+import { RateLimitConfig } from "@geekmidas/rate-limit";
+import { StorageClient, UploadPost } from "@geekmidas/storage";
+import { HttpError } from "@geekmidas/errors";
+//#region src/endpoints/upload.d.ts
+/** What an endpoint's `.upload(bucket, …)` allows. */
+interface UploadOptions<TContext> {
+  /** Where the object lands, from what the handler would be given. */
+  key: (ctx: TContext) => string | Promise<string>;
+  /** The largest file the storage accepts, in bytes. */
+  maxSize: number;
+  /**
+   * The types the file may be: `image/png`, or `image/*` for any image.
+   * Absent, any type is accepted.
+   *
+   * A storage policy fixes one type, or one prefix, and cannot say "either of
+   * these". So with more than one, `contentType` says which this upload is
+   * — and it must be one of them.
+   */
+  accept?: readonly string[];
+  /** The type this upload is sent as — required when `accept` lists several. */
+  contentType?: (ctx: TContext) => string | Promise<string>;
+  /** How long the form is valid, in seconds. Defaults to 300. */
+  expiresIn?: number;
+}
+/** An upload's `maxSize` that is not a positive whole number of bytes. */
+declare class UploadMaxSizeInvalid extends Error {
+  readonly maxSize: number;
+  constructor(maxSize: number);
+}
+/** An upload's `expiresIn` outside what a signature can be valid for. */
+declare class UploadExpiryInvalid extends Error {
+  readonly expiresIn: number;
+  constructor(expiresIn: number);
+}
+/** An entry in `accept` that is not a media type. */
+declare class UploadAcceptInvalid extends Error {
+  readonly entry: string;
+  constructor(entry: string);
+}
+/** Several accepted types, and nothing saying which one an upload is. */
+declare class UploadContentTypeUnresolved extends Error {
+  readonly accept: readonly string[];
+  constructor(accept: readonly string[]);
+}
+/** A request for an upload of a type the endpoint does not accept. */
+declare class UploadContentTypeRefused extends HttpError {
+  readonly contentType: string;
+  readonly accept: readonly string[];
+  constructor(contentType: string, accept: readonly string[]);
+}
+/**
+ * An upload endpoint's output, when it declares none of its own: the signed
+ * form, as the handler is given it.
+ *
+ * Written by hand rather than with a schema library, so the endpoint runtime
+ * imports none — the Standard Schema and Standard JSON Schema interfaces are
+ * the whole of what validation and OpenAPI need.
+ */
+declare const UPLOAD_POST_SCHEMA: StandardSchemaV1<UploadPost> & StandardJSONSchemaV1<UploadPost>;
 //#endregion
 //#region src/endpoints/EndpointBuilder.d.ts
-declare class EndpointBuilder<TRoute extends string, TMethod extends HttpMethod, TInput extends EndpointSchemas = {}, TServices extends Service[] = [], TLogger extends Logger = Logger, OutSchema extends StandardSchemaV1 | undefined = undefined, TSession = unknown, TEventPublisher extends EventPublisher<any> | undefined = undefined, TEventPublisherServiceName extends string = string, TAuthorizers extends readonly string[] = readonly string[], TAuditStorage extends AuditStorage | undefined = undefined, TAuditStorageServiceName extends string = string, TAuditAction extends AuditableAction<string, unknown> = AuditableAction<string, unknown>, TDatabase = undefined, TDatabaseServiceName extends string = string> extends BaseFunctionBuilder<TInput, OutSchema, TServices, TLogger, TEventPublisher, TEventPublisherServiceName, TAuditStorage, TAuditStorageServiceName, TDatabase, TDatabaseServiceName> {
+declare class EndpointBuilder<TRoute extends string, TMethod extends HttpMethod, TInput extends EndpointSchemas = {}, TServices extends Service[] = [], TLogger extends Logger = Logger, OutSchema extends StandardSchemaV1 | undefined = undefined, TSession = unknown, TAuthorizers extends readonly string[] = readonly string[], TAuditStorage extends AuditStorage | undefined = undefined, TAuditStorageServiceName extends string = string, TAuditAction extends AuditableAction<string, unknown> = AuditableAction<string, unknown>, TDatabase = undefined, TDatabaseServiceName extends string = string> extends BaseFunctionBuilder<TInput, OutSchema, TServices, TLogger, TAuditStorage, TAuditStorageServiceName, TDatabase, TDatabaseServiceName> {
   readonly route: TRoute;
   readonly method: TMethod;
   protected schemas: TInput;
   protected _description?: string;
-  protected _status?: SuccessStatus;
+  protected _status?: EndpointStatus;
   protected _tags?: string[];
   protected _memorySize?: number;
   protected _responseType: string;
-  _getSession: SessionFn<TServices, TLogger, TSession, TDatabase>;
+  /** Set by a factory's `.session()`; absent, the endpoint reads none. */
+  _getSession?: SessionFn<TServices, TLogger, TSession, TDatabase>;
   _authorize: AuthorizeFn<TServices, TLogger, TSession, TInput, TDatabase>;
   _rateLimit?: RateLimitConfig;
   _availableAuthorizers: Authorizer[];
@@ -45,15 +97,46 @@ declare class EndpointBuilder<TRoute extends string, TMethod extends HttpMethod,
   _customSecuritySchemes: Record<string, SecurityScheme>;
   _rlsConfig?: RlsConfig<TServices, TSession, TLogger>;
   _rlsBypass?: boolean;
+  _telemetry?: EndpointTelemetry;
   constructor(route: TRoute, method: TMethod);
-  _setPublisher(publisher: Service<TEventPublisherServiceName, TEventPublisher>): void;
   _setAuditorStorage(storage: Service<TAuditStorageServiceName, TAuditStorage>): void;
   _setDatabaseService(service: Service<TDatabaseServiceName, TDatabase>): void;
   description(description: string): this;
-  status(status: SuccessStatus): this;
-  event<TEvent extends MappedEvent<TEventPublisher, OutSchema>>(event: TEvent): this;
+  /**
+   * The status a successful request is answered with — a 2xx, or a 3xx for
+   * an endpoint that always redirects (with a `Location` header). One that
+   * sometimes redirects returns `response.redirect(url)` instead.
+   */
+  status(status: EndpointStatus): this;
+  /**
+   * Publish `event` to `topic` once the handler has succeeded — repeatable,
+   * one call per event, to as many topics as the endpoint names. The topic
+   * becomes a dependency as with `.dependsOn([topic])`, so `services.<topic>`
+   * is there for events the handler decides on itself.
+   *
+   * @example
+   * ```ts
+   * router.post('/users')
+   *   .event(users, {
+   *     type: 'user.created',
+   *     payload: (user) => ({ userId: user.id, email: user.email }),
+   *   })
+   * ```
+   */
+  event<TTopic extends Topic<any, any>>(topic: TTopic, event: EventFor<TTopic, InferStandardSchema<OutSchema>>): EndpointBuilder<TRoute, TMethod, TInput, [...TServices, TTopic['service']], TLogger, OutSchema, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
   tags(tags: string[]): this;
   memorySize(memorySize: number): this;
+  /**
+   * This route's telemetry, beside what its surface's `Telemetry` says for
+   * every route: `{ ignore: true }` records no span for it — a health check,
+   * a probe — and `attributes` are set on its request span.
+   *
+   * @example
+   * ```ts
+   * router.get('/health').telemetry({ ignore: true }).handle(() => 'ok');
+   * ```
+   */
+  telemetry(options: EndpointTelemetry): this;
   /**
    * Set the response content type for this endpoint.
    *
@@ -73,22 +156,21 @@ declare class EndpointBuilder<TRoute extends string, TMethod extends HttpMethod,
    * ```
    */
   responseType(type: string): this;
-  publisher<T extends EventPublisher<any>, TName extends string>(publisher: Service<TName, T>): EndpointBuilder<TRoute, TMethod, TInput, TServices, TLogger, OutSchema, TSession, T, TName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
   body<T extends StandardSchemaV1>(schema: T): EndpointBuilder<TRoute, TMethod, Omit<TInput, 'body'> & {
     body: T;
-  }, TServices, TLogger, OutSchema, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+  }, TServices, TLogger, OutSchema, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
   search<T extends StandardSchemaV1>(schema: T): EndpointBuilder<TRoute, TMethod, Omit<TInput, 'query'> & {
     query: T;
-  }, TServices, TLogger, OutSchema, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+  }, TServices, TLogger, OutSchema, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
   query<T extends StandardSchemaV1>(schema: T): EndpointBuilder<TRoute, TMethod, Omit<TInput, 'query'> & {
     query: T;
-  }, TServices, TLogger, OutSchema, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+  }, TServices, TLogger, OutSchema, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
   params<T extends StandardSchemaV1>(schema: T): EndpointBuilder<TRoute, TMethod, Omit<TInput, 'params'> & {
     params: T;
-  }, TServices, TLogger, OutSchema, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+  }, TServices, TLogger, OutSchema, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
   authorize(fn: AuthorizeFn<TServices, TLogger, TSession, TInput, TDatabase>): this;
   rateLimit(config: RateLimitConfig): this;
-  authorizer(name: TAuthorizers[number] | 'none'): EndpointBuilder<TRoute, TMethod, TInput, TServices, TLogger, OutSchema, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+  authorizer(name: TAuthorizers[number] | 'none'): EndpointBuilder<TRoute, TMethod, TInput, TServices, TLogger, OutSchema, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
   /**
    * Depend on constructs — a database, a bucket, a mail sender, a queue, a
    * topic.
@@ -100,21 +182,48 @@ declare class EndpointBuilder<TRoute extends string, TMethod extends HttpMethod,
    * Constructs only. A `Service` does not match the shape, which is what keeps
    * env sniffing confined to `.services()` and the explicit lift.
    */
-  dependsOn<const T extends readonly Consumable[]>(constructs: T): EndpointBuilder<TRoute, TMethod, TInput, [...TServices, ...ServicesOf<T>], TLogger, OutSchema, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
-  services<T extends Service[]>(services: T): EndpointBuilder<TRoute, TMethod, TInput, [...TServices, ...T], TLogger, OutSchema, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
-  logger<T extends Logger>(logger: T): EndpointBuilder<TRoute, TMethod, TInput, TServices, T, OutSchema, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
-  output<T extends StandardSchemaV1>(schema: T): EndpointBuilder<TRoute, TMethod, TInput, TServices, TLogger, T, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+  dependsOn<const T extends readonly Consumable[]>(constructs: T): EndpointBuilder<TRoute, TMethod, TInput, [...TServices, ...ServicesOf<T>], TLogger, OutSchema, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+  /**
+   * Hand the browser a signed form that uploads one file straight to
+   * `bucket` — the file never passes through this server.
+   *
+   * The endpoint decides where (`key`, from what the handler is given) and
+   * the form's policy decides what: the storage refuses a file over
+   * `maxSize`, or of a type `accept` does not allow. The handler receives
+   * the form as `upload`, and returns it unless it has more to say — it is
+   * the endpoint's output when no `.output()` came first. The bucket
+   * becomes a dependency, as with `.dependsOn([bucket])`.
+   *
+   * The last step before `.handle()`: the key is resolved from the body,
+   * params and session, so they are declared first.
+   *
+   * @example
+   * ```ts
+   * router
+   *   .post('/me/avatar')
+   *   .upload(uploads, {
+   *     key: ({ session }) => `avatars/${session.userId}.png`,
+   *     maxSize: 5 * 1024 * 1024,
+   *     accept: ['image/png'],
+   *   })
+   *   .handle(async ({ upload }) => upload);
+   * ```
+   */
+  upload<TBucket extends Consumable<string, StorageClient>>(bucket: TBucket, options: UploadOptions<EndpointContext<TInput, [...TServices, TBucket['service']], TLogger, TSession, TAuditAction, TDatabase, TAuditStorage>>): UploadEndpointBuilder<TRoute, TMethod, TInput, [...TServices, TBucket['service']], TLogger, [OutSchema] extends [undefined] ? typeof UPLOAD_POST_SCHEMA : OutSchema, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+  services<T extends Service[]>(services: T): EndpointBuilder<TRoute, TMethod, TInput, [...TServices, ...T], TLogger, OutSchema, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+  logger<T extends Logger>(logger: T): EndpointBuilder<TRoute, TMethod, TInput, TServices, T, OutSchema, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+  output<T extends StandardSchemaV1>(schema: T): EndpointBuilder<TRoute, TMethod, TInput, TServices, TLogger, T, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
   /**
    * Set the auditor storage service for this endpoint.
    * This enables audit functionality and makes `auditor` available in the handler context.
    * The audit action type is automatically inferred from the storage's generic parameter.
    */
-  auditor<T extends AuditStorage<any>, TName extends string>(storage: Service<TName, T>): EndpointBuilder<TRoute, TMethod, TInput, TServices, TLogger, OutSchema, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, T, TName, ExtractStorageAuditAction<T>, TDatabase, TDatabaseServiceName>;
+  auditor<T extends AuditStorage<any>, TName extends string>(storage: Service<TName, T>): EndpointBuilder<TRoute, TMethod, TInput, TServices, TLogger, OutSchema, TSession, TAuthorizers, T, TName, ExtractStorageAuditAction<T>, TDatabase, TDatabaseServiceName>;
   /**
    * Set the actor extractor function for audit records.
    * The actor is extracted from the request context and attached to all audits.
    */
-  actor(extractor: ActorExtractor<TServices, TSession, TLogger>): EndpointBuilder<TRoute, TMethod, TInput, TServices, TLogger, OutSchema, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+  actor(extractor: ActorExtractor<TServices, TSession, TLogger>): EndpointBuilder<TRoute, TMethod, TInput, TServices, TLogger, OutSchema, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
   /**
    * Add declarative audit definitions that are processed after the handler executes.
    * Similar to `.event()` for events, but for audits.
@@ -148,7 +257,7 @@ declare class EndpointBuilder<TRoute extends string, TMethod extends HttpMethod,
    * })
    * ```
    */
-  database<T, TName extends string>(source: Consumable<TName, T> | Service<TName, T>): EndpointBuilder<TRoute, TMethod, TInput, TServices, TLogger, OutSchema, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, T, TName>;
+  database<T, TName extends string>(source: Consumable<TName, T> | Service<TName, T>): EndpointBuilder<TRoute, TMethod, TInput, TServices, TLogger, OutSchema, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, T, TName>;
   /**
    * Configure RLS (Row-Level Security) context for this endpoint.
    * Pass `false` or `RLS_BYPASS` to explicitly bypass RLS for this endpoint.
@@ -184,12 +293,30 @@ declare class EndpointBuilder<TRoute extends string, TMethod extends HttpMethod,
    */
   rlsBypass(): this;
   input(_schema: any): any;
-  handle(fn: EndpointHandler<TInput, TServices, TLogger, OutSchema, TSession, TDatabase, TAuditStorage, TAuditAction>): Endpoint<TRoute, TMethod, TInput, OutSchema, TServices, TLogger, TSession, TEventPublisher, TEventPublisherServiceName, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+  handle(fn: EndpointHandler<TInput, TServices, TLogger, OutSchema, TSession, TDatabase, TAuditStorage, TAuditAction>): Endpoint<TRoute, TMethod, TInput, OutSchema, TServices, TLogger, TSession, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+}
+/**
+ * A handler given an upload's signed form beside everything else: the
+ * context `H` receives, with `upload`.
+ */
+type UploadHandler<H extends (...args: any[]) => any> = (ctx: Parameters<H>[0] & {
+  upload: UploadPost;
+}, response: Parameters<H>[1]) => ReturnType<H>;
+/**
+ * What `.upload(bucket, …)` returns: the same builder, whose handler is also
+ * given the signed form.
+ */
+declare class UploadEndpointBuilder<TRoute extends string, TMethod extends HttpMethod, TInput extends EndpointSchemas = {}, TServices extends Service[] = [], TLogger extends Logger = Logger, OutSchema extends StandardSchemaV1 | undefined = undefined, TSession = unknown, TAuthorizers extends readonly string[] = readonly string[], TAuditStorage extends AuditStorage | undefined = undefined, TAuditStorageServiceName extends string = string, TAuditAction extends AuditableAction<string, unknown> = AuditableAction<string, unknown>, TDatabase = undefined, TDatabaseServiceName extends string = string> extends EndpointBuilder<TRoute, TMethod, TInput, TServices, TLogger, OutSchema, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName> {
+  /** The bucket's service, and what an upload to it allows. */
+  _upload: {
+    serviceName: string;
+    options: UploadOptions<any>;
+  };
+  handle(fn: UploadHandler<EndpointHandler<TInput, TServices, TLogger, OutSchema, TSession, TDatabase, TAuditStorage, TAuditAction>>): Endpoint<TRoute, TMethod, TInput, OutSchema, TServices, TLogger, TSession, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
 }
-//# sourceMappingURL=EndpointBuilder.d.ts.map
 //#endregion
 //#region src/endpoints/EndpointFactory.d.ts
-declare class EndpointFactory<TServices extends Service[] = [], TBasePath extends string = '', TLogger extends Logger = Logger, TSession = unknown, TEventPublisher extends EventPublisher<any> | undefined = undefined, TEventPublisherServiceName extends string = string, TAuthorizers extends readonly string[] = readonly string[], TAuditStorage extends AuditStorage<any> | undefined = undefined, TAuditStorageServiceName extends string = string, TAuditAction extends AuditableAction<string, unknown> = ExtractStorageAuditAction<NonNullable<TAuditStorage>>, TDatabase = undefined, TDatabaseServiceName extends string = string, TSecuritySchemes extends Record<string, SecurityScheme> = Record<string, SecurityScheme>, TRlsConfig extends RlsConfig<TServices, TSession, TLogger> | undefined = undefined> {
+declare class EndpointFactory<TServices extends Service[] = [], TBasePath extends string = '', TLogger extends Logger = Logger, TSession = unknown, TAuthorizers extends readonly string[] = readonly string[], TAuditStorage extends AuditStorage<any> | undefined = undefined, TAuditStorageServiceName extends string = string, TAuditAction extends AuditableAction<string, unknown> = ExtractStorageAuditAction<NonNullable<TAuditStorage>>, TDatabase = undefined, TDatabaseServiceName extends string = string, TSecuritySchemes extends Record<string, SecurityScheme> = Record<string, SecurityScheme>, TRlsConfig extends RlsConfig<TServices, TSession, TLogger> | undefined = undefined> {
   private defaultServices;
   /**
    * The constructs `.dependsOn()` was given, kept alongside the services they
@@ -204,7 +331,6 @@ declare class EndpointFactory<TServices extends Service[] = [], TBasePath extend
   private defaultConstructs;
   private basePath;
   private defaultAuthorizeFn?;
-  private defaultEventPublisher;
   private defaultSessionExtractor?;
   private defaultLogger;
   /**
@@ -222,25 +348,9 @@ declare class EndpointFactory<TServices extends Service[] = [], TBasePath extend
   private defaultActorExtractor?;
   private customSecuritySchemes;
   private defaultRlsConfig?;
-  constructor({
-    basePath,
-    defaultAuthorizeFn,
-    defaultLogger,
-    defaultSessionExtractor,
-    defaultServices,
-    defaultConstructs,
-    defaultEventPublisher,
-    availableAuthorizers,
-    defaultAuthorizerName,
-    defaultAuditorStorage,
-    defaultDatabaseService,
-    defaultActorExtractor,
-    customSecuritySchemes,
-    defaultRlsConfig,
-    surface
-  }: EndpointFactoryOptions<TServices, TBasePath, TLogger, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TDatabase, TDatabaseServiceName, TSecuritySchemes, TRlsConfig>);
+  constructor({ basePath, defaultAuthorizeFn, defaultLogger, defaultSessionExtractor, defaultServices, defaultConstructs, availableAuthorizers, defaultAuthorizerName, defaultAuditorStorage, defaultDatabaseService, defaultActorExtractor, customSecuritySchemes, defaultRlsConfig, surface }: EndpointFactoryOptions<TServices, TBasePath, TLogger, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TDatabase, TDatabaseServiceName, TSecuritySchemes, TRlsConfig>);
   static joinPaths<TBasePath extends string, P extends string>(path: P, basePath?: TBasePath): JoinPaths<TBasePath, P>;
-  authorizers<const T extends readonly string[]>(authorizers: T): EndpointFactory<TServices, TBasePath, TLogger, TSession, TEventPublisher, TEventPublisherServiceName, T, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, TRlsConfig>;
+  authorizers<const T extends readonly string[]>(authorizers: T): EndpointFactory<TServices, TBasePath, TLogger, TSession, T, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, TRlsConfig>;
   /**
    * Define custom security schemes for this factory.
    * These extend the built-in schemes (jwt, bearer, apiKey, oauth2, oidc).
@@ -257,7 +367,7 @@ declare class EndpointFactory<TServices extends Service[] = [], TBasePath extend
    * });
    * ```
    */
-  securitySchemes<T extends Record<string, SecurityScheme>>(schemes: T): EndpointFactory<TServices, TBasePath, TLogger, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes & T, TRlsConfig>;
+  securitySchemes<T extends Record<string, SecurityScheme>>(schemes: T): EndpointFactory<TServices, TBasePath, TLogger, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes & T, TRlsConfig>;
   /**
    * Set the default authorizer for all endpoints created from this factory.
    * Individual endpoints can override this by calling `.authorizer()` on the builder.
@@ -268,9 +378,9 @@ declare class EndpointFactory<TServices extends Service[] = [], TBasePath extend
    * - Custom security scheme names defined via `.securitySchemes()`
    * - 'none' to disable authorization
    */
-  authorizer(name: BuiltInSecuritySchemeId | keyof TSecuritySchemes | TAuthorizers[number] | 'none'): EndpointFactory<TServices, TBasePath, TLogger, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, TRlsConfig>;
-  route<TPath extends string>(path: TPath): EndpointFactory<TServices, JoinPaths<TBasePath, TPath>, TLogger, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, TRlsConfig>;
-  authorize(fn: AuthorizeFn<TServices, TLogger, TSession, undefined, TDatabase>): EndpointFactory<TServices, TBasePath, TLogger, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, TRlsConfig>;
+  authorizer(name: BuiltInSecuritySchemeId | keyof TSecuritySchemes | TAuthorizers[number] | 'none'): EndpointFactory<TServices, TBasePath, TLogger, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, TRlsConfig>;
+  route<TPath extends string>(path: TPath): EndpointFactory<TServices, JoinPaths<TBasePath, TPath>, TLogger, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, TRlsConfig>;
+  authorize(fn: AuthorizeFn<TServices, TLogger, TSession, undefined, TDatabase>): EndpointFactory<TServices, TBasePath, TLogger, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, TRlsConfig>;
   /**
    * Depend on constructs — a database, a bucket, a mail sender, a queue, a
    * topic.
@@ -282,27 +392,26 @@ declare class EndpointFactory<TServices extends Service[] = [], TBasePath extend
    * Constructs only. A `Service` does not match the shape, which is what keeps
    * env sniffing confined to `.services()` and the explicit lift.
    */
-  dependsOn<const S extends readonly Consumable[]>(constructs: S): EndpointFactory<[...ServicesOf<S>, ...TServices], TBasePath, TLogger, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, RlsConfig<[...ServicesOf<S>, ...TServices], TSession, TLogger> | undefined>;
-  services<S extends Service[]>(services: S): EndpointFactory<[...S, ...TServices], TBasePath, TLogger, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, RlsConfig<[...S, ...TServices], TSession, TLogger> | undefined>;
-  logger<L extends Logger>(logger: L): EndpointFactory<TServices, TBasePath, L, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, RlsConfig<TServices, TSession, L> | undefined>;
-  publisher<T extends EventPublisher<any>, TServiceName extends string = string>(publisher: Service<TServiceName, T>): EndpointFactory<TServices, TBasePath, TLogger, TSession, T, TServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, TRlsConfig>;
-  session<T>(session: SessionFn<TServices, TLogger, T, TDatabase>): EndpointFactory<TServices, TBasePath, TLogger, T, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, RlsConfig<TServices, T, TLogger> | undefined>;
+  dependsOn<const S extends readonly Consumable[]>(constructs: S): EndpointFactory<[...ServicesOf<S>, ...TServices], TBasePath, TLogger, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, RlsConfig<[...ServicesOf<S>, ...TServices], TSession, TLogger> | undefined>;
+  services<S extends Service[]>(services: S): EndpointFactory<[...S, ...TServices], TBasePath, TLogger, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, RlsConfig<[...S, ...TServices], TSession, TLogger> | undefined>;
+  logger<L extends Logger>(logger: L): EndpointFactory<TServices, TBasePath, L, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, RlsConfig<TServices, TSession, L> | undefined>;
+  session<T>(session: SessionFn<TServices, TLogger, T, TDatabase>): EndpointFactory<TServices, TBasePath, TLogger, T, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, RlsConfig<TServices, T, TLogger> | undefined>;
   /**
    * Set the database service for endpoints created from this factory.
    * The database will be available in handler context as `db`.
    */
-  database<T, TName extends string>(source: Consumable<TName, T> | Service<TName, T>): EndpointFactory<TServices, TBasePath, TLogger, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, T, TName, TSecuritySchemes, TRlsConfig>;
+  database<T, TName extends string>(source: Consumable<TName, T> | Service<TName, T>): EndpointFactory<TServices, TBasePath, TLogger, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, T, TName, TSecuritySchemes, TRlsConfig>;
   /**
    * Set the auditor storage service for endpoints created from this factory.
    * This enables audit functionality and makes `auditor` available in handler context.
    * The audit action type is automatically inferred from the storage's generic parameter.
    */
-  auditor<T extends AuditStorage<any>, TName extends string>(storage: Service<TName, T>): EndpointFactory<TServices, TBasePath, TLogger, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, T, TName, ExtractStorageAuditAction<T>, TDatabase, TDatabaseServiceName, TSecuritySchemes, TRlsConfig>;
+  auditor<T extends AuditStorage<any>, TName extends string>(storage: Service<TName, T>): EndpointFactory<TServices, TBasePath, TLogger, TSession, TAuthorizers, T, TName, ExtractStorageAuditAction<T>, TDatabase, TDatabaseServiceName, TSecuritySchemes, TRlsConfig>;
   /**
    * Set the actor extractor function for endpoints created from this factory.
    * The actor is extracted from the request context and attached to all audits.
    */
-  actor(extractor: ActorExtractor<TServices, TSession, TLogger>): EndpointFactory<TServices, TBasePath, TLogger, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, TRlsConfig>;
+  actor(extractor: ActorExtractor<TServices, TSession, TLogger>): EndpointFactory<TServices, TBasePath, TLogger, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, TRlsConfig>;
   /**
    * Set the RLS (Row-Level Security) configuration for endpoints created from this factory.
    * This enables automatic PostgreSQL session variable setting for RLS policies.
@@ -321,18 +430,18 @@ declare class EndpointFactory<TServices extends Service[] = [], TBasePath extend
    *   });
    * ```
    */
-  rls<TConfig extends RlsConfig<TServices, TSession, TLogger>>(config: TConfig): EndpointFactory<TServices, TBasePath, TLogger, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, TConfig>;
+  rls<TConfig extends RlsConfig<TServices, TSession, TLogger>>(config: TConfig): EndpointFactory<TServices, TBasePath, TLogger, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName, TSecuritySchemes, TConfig>;
   private createBuilder;
-  post<TPath extends string>(path: TPath): EndpointBuilder<RemoveTrailingSlash<TBasePath extends "" ? TPath : TPath extends "" ? TBasePath : TBasePath extends "/" ? TPath extends `/${string}` ? TPath : `/${TPath}` : TBasePath extends `${infer Base}/` ? TPath extends `/${infer Rest}` ? `${Base}/${Rest}` : `${Base}/${TPath}` : TPath extends `/${infer Rest_1}` ? `${TBasePath}/${Rest_1}` : `${TBasePath}/${TPath}`>, "POST", {}, TServices, TLogger, undefined, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
-  get<TPath extends string>(path: TPath): EndpointBuilder<RemoveTrailingSlash<TBasePath extends "" ? TPath : TPath extends "" ? TBasePath : TBasePath extends "/" ? TPath extends `/${string}` ? TPath : `/${TPath}` : TBasePath extends `${infer Base}/` ? TPath extends `/${infer Rest}` ? `${Base}/${Rest}` : `${Base}/${TPath}` : TPath extends `/${infer Rest_1}` ? `${TBasePath}/${Rest_1}` : `${TBasePath}/${TPath}`>, "GET", {}, TServices, TLogger, undefined, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
-  put<TPath extends string>(path: TPath): EndpointBuilder<RemoveTrailingSlash<TBasePath extends "" ? TPath : TPath extends "" ? TBasePath : TBasePath extends "/" ? TPath extends `/${string}` ? TPath : `/${TPath}` : TBasePath extends `${infer Base}/` ? TPath extends `/${infer Rest}` ? `${Base}/${Rest}` : `${Base}/${TPath}` : TPath extends `/${infer Rest_1}` ? `${TBasePath}/${Rest_1}` : `${TBasePath}/${TPath}`>, "PUT", {}, TServices, TLogger, undefined, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
-  delete<TPath extends string>(path: TPath): EndpointBuilder<RemoveTrailingSlash<TBasePath extends "" ? TPath : TPath extends "" ? TBasePath : TBasePath extends "/" ? TPath extends `/${string}` ? TPath : `/${TPath}` : TBasePath extends `${infer Base}/` ? TPath extends `/${infer Rest}` ? `${Base}/${Rest}` : `${Base}/${TPath}` : TPath extends `/${infer Rest_1}` ? `${TBasePath}/${Rest_1}` : `${TBasePath}/${TPath}`>, "DELETE", {}, TServices, TLogger, undefined, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
-  patch<TPath extends string>(path: TPath): EndpointBuilder<RemoveTrailingSlash<TBasePath extends "" ? TPath : TPath extends "" ? TBasePath : TBasePath extends "/" ? TPath extends `/${string}` ? TPath : `/${TPath}` : TBasePath extends `${infer Base}/` ? TPath extends `/${infer Rest}` ? `${Base}/${Rest}` : `${Base}/${TPath}` : TPath extends `/${infer Rest_1}` ? `${TBasePath}/${Rest_1}` : `${TBasePath}/${TPath}`>, "PATCH", {}, TServices, TLogger, undefined, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
-  options<TPath extends string>(path: TPath): EndpointBuilder<RemoveTrailingSlash<TBasePath extends "" ? TPath : TPath extends "" ? TBasePath : TBasePath extends "/" ? TPath extends `/${string}` ? TPath : `/${TPath}` : TBasePath extends `${infer Base}/` ? TPath extends `/${infer Rest}` ? `${Base}/${Rest}` : `${Base}/${TPath}` : TPath extends `/${infer Rest_1}` ? `${TBasePath}/${Rest_1}` : `${TBasePath}/${TPath}`>, "OPTIONS", {}, TServices, TLogger, undefined, TSession, TEventPublisher, TEventPublisherServiceName, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+  post<TPath extends string>(path: TPath): EndpointBuilder<RemoveTrailingSlash<TBasePath extends "" ? TPath : TPath extends "" ? TBasePath : TBasePath extends "/" ? TPath extends `/${string}` ? TPath : `/${TPath}` : TBasePath extends `${infer Base}/` ? TPath extends `/${infer Rest}` ? `${Base}/${Rest}` : `${Base}/${TPath}` : TPath extends `/${infer Rest_1}` ? `${TBasePath}/${Rest_1}` : `${TBasePath}/${TPath}`>, "POST", {}, TServices, TLogger, undefined, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+  get<TPath extends string>(path: TPath): EndpointBuilder<RemoveTrailingSlash<TBasePath extends "" ? TPath : TPath extends "" ? TBasePath : TBasePath extends "/" ? TPath extends `/${string}` ? TPath : `/${TPath}` : TBasePath extends `${infer Base}/` ? TPath extends `/${infer Rest}` ? `${Base}/${Rest}` : `${Base}/${TPath}` : TPath extends `/${infer Rest_1}` ? `${TBasePath}/${Rest_1}` : `${TBasePath}/${TPath}`>, "GET", {}, TServices, TLogger, undefined, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+  put<TPath extends string>(path: TPath): EndpointBuilder<RemoveTrailingSlash<TBasePath extends "" ? TPath : TPath extends "" ? TBasePath : TBasePath extends "/" ? TPath extends `/${string}` ? TPath : `/${TPath}` : TBasePath extends `${infer Base}/` ? TPath extends `/${infer Rest}` ? `${Base}/${Rest}` : `${Base}/${TPath}` : TPath extends `/${infer Rest_1}` ? `${TBasePath}/${Rest_1}` : `${TBasePath}/${TPath}`>, "PUT", {}, TServices, TLogger, undefined, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+  delete<TPath extends string>(path: TPath): EndpointBuilder<RemoveTrailingSlash<TBasePath extends "" ? TPath : TPath extends "" ? TBasePath : TBasePath extends "/" ? TPath extends `/${string}` ? TPath : `/${TPath}` : TBasePath extends `${infer Base}/` ? TPath extends `/${infer Rest}` ? `${Base}/${Rest}` : `${Base}/${TPath}` : TPath extends `/${infer Rest_1}` ? `${TBasePath}/${Rest_1}` : `${TBasePath}/${TPath}`>, "DELETE", {}, TServices, TLogger, undefined, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+  patch<TPath extends string>(path: TPath): EndpointBuilder<RemoveTrailingSlash<TBasePath extends "" ? TPath : TPath extends "" ? TBasePath : TBasePath extends "/" ? TPath extends `/${string}` ? TPath : `/${TPath}` : TBasePath extends `${infer Base}/` ? TPath extends `/${infer Rest}` ? `${Base}/${Rest}` : `${Base}/${TPath}` : TPath extends `/${infer Rest_1}` ? `${TBasePath}/${Rest_1}` : `${TBasePath}/${TPath}`>, "PATCH", {}, TServices, TLogger, undefined, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
+  options<TPath extends string>(path: TPath): EndpointBuilder<RemoveTrailingSlash<TBasePath extends "" ? TPath : TPath extends "" ? TBasePath : TBasePath extends "/" ? TPath extends `/${string}` ? TPath : `/${TPath}` : TBasePath extends `${infer Base}/` ? TPath extends `/${infer Rest}` ? `${Base}/${Rest}` : `${Base}/${TPath}` : TPath extends `/${infer Rest_1}` ? `${TBasePath}/${Rest_1}` : `${TBasePath}/${TPath}`>, "OPTIONS", {}, TServices, TLogger, undefined, TSession, TAuthorizers, TAuditStorage, TAuditStorageServiceName, TAuditAction, TDatabase, TDatabaseServiceName>;
 }
 type RemoveTrailingSlash<T extends string> = T extends `${infer Rest}/` ? Rest extends '' ? T : Rest : T;
 type JoinPaths<TBasePath extends string, TPath extends string> = RemoveTrailingSlash<TBasePath extends '' ? TPath : TPath extends '' ? TBasePath : TBasePath extends '/' ? TPath extends `/${string}` ? TPath : `/${TPath}` : TBasePath extends `${infer Base}/` ? TPath extends `/${infer Rest}` ? `${Base}/${Rest}` : `${Base}/${TPath}` : TPath extends `/${infer Rest}` ? `${TBasePath}/${Rest}` : `${TBasePath}/${TPath}`>;
-interface EndpointFactoryOptions<TServices extends Service[] = [], TBasePath extends string = '', TLogger extends Logger = Logger, TSession = unknown, TEventPublisher extends EventPublisher<any> | undefined = undefined, TEventPublisherServiceName extends string = string, TAuthorizers extends readonly string[] = readonly string[], TAuditStorage extends AuditStorage | undefined = undefined, TAuditStorageServiceName extends string = string, TDatabase = undefined, TDatabaseServiceName extends string = string, TSecuritySchemes extends Record<string, SecurityScheme> = Record<string, SecurityScheme>, TRlsConfig extends RlsConfig<TServices, TSession, TLogger> | undefined = undefined> {
+interface EndpointFactoryOptions<TServices extends Service[] = [], TBasePath extends string = '', TLogger extends Logger = Logger, TSession = unknown, TAuthorizers extends readonly string[] = readonly string[], TAuditStorage extends AuditStorage | undefined = undefined, TAuditStorageServiceName extends string = string, TDatabase = undefined, TDatabaseServiceName extends string = string, TSecuritySchemes extends Record<string, SecurityScheme> = Record<string, SecurityScheme>, TRlsConfig extends RlsConfig<TServices, TSession, TLogger> | undefined = undefined> {
   defaultServices?: TServices;
   /** Construct ids from `.dependsOn()`, carried so a route can declare edges. */
   defaultConstructs?: string[];
@@ -340,8 +449,6 @@ interface EndpointFactoryOptions<TServices extends Service[] = [], TBasePath ext
   defaultAuthorizeFn?: AuthorizeFn<TServices, TLogger, TSession, undefined, TDatabase>;
   defaultLogger?: TLogger;
   defaultSessionExtractor?: SessionFn<TServices, TLogger, TSession, TDatabase>;
-  defaultEventPublisher?: Service<TEventPublisherServiceName, TEventPublisher>;
-  defaultEvents?: MappedEvent<TEventPublisher, undefined>[];
   availableAuthorizers?: Authorizer[];
   defaultAuthorizerName?: TAuthorizers[number];
   defaultAuditorStorage?: Service<TAuditStorageServiceName, TAuditStorage>;
@@ -356,64 +463,11 @@ interface EndpointFactoryOptions<TServices extends Service[] = [], TBasePath ext
    * endpoint without one has no logger, no env parser and nothing to
    * attribute its traffic to — which was survivable only while `e` existed.
    *
-   * Carried through every derived factory, so `api.endpoints.database(db)`
+   * Carried through every derived factory, so `api.database(db)`
    * still produces endpoints that know which API serves them.
    */
   surface: EndpointSurface;
 }
-//# sourceMappingURL=EndpointFactory.d.ts.map
-//#endregion
-//#region src/endpoints/lazyAccessors.d.ts
-/**
- * Create a lazy header accessor for Hono.
- * Uses `c.req.header(name)` for single lookups (native, case-insensitive).
- * Only calls `c.req.header()` to get all headers when needed.
- */
-declare function createHonoHeaders(c: Context): HeaderFn;
-/**
- * Create a lazy cookie accessor for Hono.
- * Uses `getCookie(c, name)` for single lookups (native).
- * Only parses the cookie header when all cookies are requested.
- */
-declare function createHonoCookies(c: Context): CookieFn;
-/**
- * Create a lazy header accessor for API Gateway events.
- * Handles case-insensitive lookups.
- */
-declare function createApiGatewayHeaders(headers: Record<string, string | undefined> | null | undefined): HeaderFn;
-/**
- * Create a lazy cookie accessor for API Gateway events.
- * Decodes URL-encoded values to match browser behavior.
- */
-declare function createApiGatewayCookies(cookies: string[] | undefined, cookieHeader: string | undefined): CookieFn;
-/**
- * Create a lazy header accessor for plain object headers (test adaptor, etc).
- * Headers are already available as an object, just provide lazy access.
- */
-
-/**
- * Create a no-op header accessor (for minimal endpoints that don't use headers).
- */
-declare function createNoopHeaders(): HeaderFn;
-/**
- * Create a no-op cookie accessor (for minimal endpoints that don't use cookies).
- */
-declare function createNoopCookies(): CookieFn;
-//# sourceMappingURL=lazyAccessors.d.ts.map
-//#endregion
-//#region src/endpoints/surfaceEnv.d.ts
-/**
- * The default parser, built once.
- *
- * Once because `Credentials` resolves through `globalThis` and decryption is
- * not free, and because two parsers over the same environment are two caches of
- * the same answer.
- */
-declare function defaultEnvParser(): EnvironmentParser<{}>;
-/** The parser for an endpoint, from its surface or the default. */
-declare function envParserFor(surface: EndpointSurface | undefined): EnvironmentParser<{}>;
-//# sourceMappingURL=surfaceEnv.d.ts.map
-
 //#endregion
-export { EndpointBuilder, EndpointFactory, RemoveTrailingSlash, createApiGatewayCookies, createApiGatewayHeaders, createHonoCookies, createHonoHeaders, createNoopCookies, createNoopHeaders, defaultEnvParser, envParserFor, publishConstructEvents };
-//# sourceMappingURL=index-lAO9egTb.d.mts.map
+export { UPLOAD_POST_SCHEMA as a, UploadContentTypeUnresolved as c, UploadOptions as d, UploadPost as f, UploadHandler as i, UploadExpiryInvalid as l, EndpointBuilder as n, UploadAcceptInvalid as o, UploadEndpointBuilder as r, UploadContentTypeRefused as s, EndpointFactory as t, UploadMaxSizeInvalid as u };
+//# sourceMappingURL=EndpointFactory-Cc863XJS.d.cts.map

package/dist/EndpointFactory-Cc863XJS.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EndpointFactory-Cc863XJS.d.cts","names":[],"sources":["../src/endpoints/upload.ts","../src/endpoints/EndpointBuilder.ts","../src/endpoints/EndpointFactory.ts"],"mappings":";;;;;;;;;;;;;;;;UAqBiB,cAAc;;EAE9B,MAAM,KAAK,sBAAsB;;EAEjC;;;;;;;;;EASA;;EAEA,eAAe,KAAK,sBAAsB;;EAE1C;;;cAWY,6BAA6B;WACpB;EAArB,YAAqB;;;cAUT,4BAA4B;WACnB;EAArB,YAAqB;;;cAWT,4BAA4B;WACnB;EAArB,YAAqB;;;cAUT,oCAAoC;WAC3B;EAArB,YAAqB;;;cAWT,iCAAiC;WAEnC;WACA;EAFV,YACU,qBACA;;;;;;;;;;cA0HE,oBAAoB,iBAAiB,cACjD,qBAAqB;;;cC1KT,gBACZ,uBACA,gBAAgB,YAChB,eAAe,sBACf,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,kBAAkB,0CAClB,oBACA,4DACA,sBAAsB,sCACtB,kDACA,qBAAqB,mCAAmC,kCAIxD,uBACA,sDACS,oBACT,QACA,WACA,WACA,SACA,eACA,0BACA,WACA;WA8BU,OAAO;WACP,QAAQ;YA7BR,SAAS;YACT;YACA,UAAU;YACV;YACA;YACA;;EAEV,cAAc,UAAU,WAAW,SAAS,UAAU;EACtD,YAAY,YAAY,WAAW,SAAS,UAAU,QAAQ;EAE9D,aAAa;EACb,uBAAuB;EACvB,kBAAkB;EAClB,kBAAkB,eAAe,WAAW,UAAU;EACtD,SAAS,YAAY,cAAc;;;;;;;EAOnC,UAAW;EACX,wBAAwB,eAAe;EACvC,aAAa,UAAU,WAAW,UAAU;EAC5C;EACA,aAAa;EAEb,YACU,OAAO,QACP,QAAQ;EAMlB,mBACC,SAAS,QAAQ,0BAA0B;EAM5C,oBAAoB,SAAS,QAAQ,sBAAsB;EAI3D,YAAY;;;;;;EASZ,OAAO,QAAQ;;;;;;;;;;;;;;;;EAmBf,MAAM,eAAe,iBACpB,OAAO,QACP,OAAO,SAAS,QAAQ,oBAAoB,cAC1C,gBACF,QACA,SACA,YACI,WAAW,oBACf,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAmBD,KAAK;EAIL,WAAW;;;;;;;;;;;EAcX,UAAU,SAAS;;;;;;;;;;;;;;;;;;;EAsBnB,aAAa;EAIb,KAAK,UAAU,kBACd,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAoB,MAAM;KAC/B,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAOD,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAqB,OAAO;KACjC,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAOD,MAAM,UAAU,kBACf,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAqB,OAAO;KACjC,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAKD,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAsB,QAAQ;KACnC,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAOD,UACC,IAAI,YAAY,WAAW,SAAS,UAAU,QAAQ;EAKvD,UAAU,QAAQ;EAIlB,WACC,MAAM,gCACJ,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;;;;;;;;;;;;EAkCD,gBAAgB,mBAAmB,cAClC,YAAY,IACV,gBACF,QACA,SACA,YACI,cAAc,WAAW,KAC7B,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4DD,OAAO,gBAAgB,mBAAmB,gBACzC,QAAQ,SACR,SAAS,cACR,gBACC,YACI,WAAW,qBACf,SACA,UACA,cACA,WACA,kBAGA,sBACF,QACA,SACA,YACI,WAAW,qBACf,UACC,wCAAwC,qBAAqB,WAC9D,UACA,cACA,eACA,0BACA,cACA,WACA;EAiBD,SAAS,UAAU,WAClB,UAAU,IACR,gBACF,QACA,SACA,YACI,cAAc,IAClB,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAwBD,OAAO,UAAU,QAChB,QAAQ,IACN,gBACF,QACA,SACA,QACA,WACA,GACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAqBD,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,SACA,QACA,WACA,SACA,GACA,UACA,cACA,eACA,0BACA,cACA,WACA;;;;;;EA0BQ,QAAQ,UAAU,mBAAmB,sBAC7C,SAAS,QAAQ,OAAO,KACtB,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,GACA,OACA,0BAA0B,IAC1B,WACA;;;;;EA4BD,MACC,WAAW,eAAe,WAAW,UAAU,WAC7C,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;;;;;;;;;;;;;;;;;;EAsBD,MAAM,QAAQ,YAAY,cAAc;;;;;;;;;;;;;;;;EAmB/B,SAAS,GAAG,sBACpB,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,GACA;;;;;;;;;;;;;;;;;;;;EA6CD,IACC,QAAQ,UAAU,WAAW,UAAU,mBAAmB;;;;;;;;;;;;;;EAyB3D;EAKA,MAAM;EAMN,OACC,IAAI,gBACH,QACA,WACA,SACA,WACA,UACA,WACA,eACA,gBAEC,SACF,QACA,SACA,QACA,WACA,WACA,SACA,UACA,eACA,0BACA,cACA,WACA;;;;;;KAoEU,cAAc,cAAc,wBACvC,KAAK,WAAW;EAAU,QAAQ;GAClC,UAAU,WAAW,UACjB,WAAW;;;;;cAMH,sBACZ,uBACA,gBAAgB,YAChB,eAAe,sBACf,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,kBAAkB,0CAClB,oBACA,4DACA,sBAAsB,sCACtB,kDACA,qBAAqB,mCAAmC,kCAIxD,uBACA,sDACS,gBACT,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;;EAGA;IACC;IACA,SAAS;;EAGD,OACR,IAAI,cACH,gBACC,QACA,WACA,SACA,WACA,UACA,WACA,eACA,iBAGA,SACF,QACA,SACA,QACA,WACA,WACA,SACA,UACA,eACA,0BACA,cACA,WACA;;;;cCz6BW,gBACZ,kBAAkB,gBAClB,+BACA,gBAAgB,SAAS,QACzB,oBACA,4DACA,sBAAsB,2CACtB,kDACA,qBAAqB,mCAGjB,0BAA0B,YAAY,iBAC1C,uBACA,8CACA,yBAAyB,eAAe,kBAAkB,eAEzD,iBAED,mBACG,UAAU,WAAW,UAAU;UAG1B;;;;;;;;;;;UAWA;UACA;UACA;UAOA;UAMA;;;;;;;;UAQA;UACA;UACA;UACA;UAGA;UAGA;UACA;UACA;EAER,cACC,UACA,oBACA,eACA,yBAEA,iBACA,mBACA,sBACA,uBACA,uBACA,wBACA,uBACA,uBACA,kBACA,WACE,uBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,WACA,sBACA,kBACA;SAuBM,UAAU,0BAA0B,kBAC1C,MAAM,GACN,WAAU,YACR,UAAU,WAAW;EAmCxB,kBAAkB,6BACjB,aAAa,IACX,gBACF,WACA,WACA,SACA,UACA,GACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;;;;;;;;;;;;;;;;;EAqDD,gBAAgB,UAAU,eAAe,iBACxC,SAAS,IACP,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,mBAAmB,GACnB;;;;;;;;;;;EA8CD,WACC,MACG,gCACM,mBACN,gCAED,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;EAkDD,MAAM,sBACL,MAAM,QACJ,gBACF,WACA,UAAU,WAAW,QACrB,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;EAmCD,UACC,IAAI,YAAY,WAAW,SAAS,qBAAqB,aACvD,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;;;;;;;;;;;;EA6CD,gBAAgB,mBAAmB,cAClC,YAAY,IACV,oBACE,WAAW,OAAO,YACtB,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,cAAc,WAAW,OAAO,YAAY,UAAU;EA6BvD,SAAS,UAAU,WAClB,UAAU,IACR,oBACE,MAAM,YACV,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,cAAc,MAAM,YAAY,UAAU;EA2C3C,OAAO,UAAU,QAChB,QAAQ,IACN,gBACF,WACA,WACA,GACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,UAAU,WAAW,UAAU;EAiDhC,QAAQ,GACP,SAAS,UAAU,WAAW,SAAS,GAAG,aACxC,gBACF,WACA,WACA,SACA,GACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,UAAU,WAAW,GAAG;;;;;EAgDzB,SAAS,GAAG,sBACX,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,GACA,OACA,kBACA;;;;;;EAmDD,QAAQ,UAAU,mBAAmB,sBACpC,SAAS,QAAQ,OAAO,KACtB,gBACF,WACA,WACA,SACA,UACA,cACA,GACA,OACA,0BAA0B,IAC1B,WACA,sBACA,kBACA;;;;;EA0CD,MACC,WAAW,eAAe,WAAW,UAAU,WAC7C,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;;;;;;;;;;;;;;;;;;;EAmDD,IAAI,gBAAgB,UAAU,WAAW,UAAU,UAClD,QAAQ,UACN,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;UAiCO;EA8FR,KAAK,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BA2CN,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,sBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EAxClC,IAAI,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BAuCL,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,qBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EApClC,IAAI,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BAmCL,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,qBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EAhClC,OAAO,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BA+BR,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,wBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EA5BlC,MAAM,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BA2BP,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,uBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EAxBlC,QAAQ,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BAuBT,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,yBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;;KAnBvB,oBAAoB,oBAAoB,mBAAmB,UACpE,kBACC,IACA,OACD;KAES,UACX,0BACA,wBACG,oBACH,uBACG,QACA,mBACC,YACA,wBACC,6BACC,YACI,UACL,2BAA2B,UAC1B,wBAAwB,YACpB,QAAQ,YACR,QAAQ,UACZ,wBAAwB,YACpB,aAAa,YACb,aAAa;UAGP,uBAChB,kBAAkB,gBAClB,+BACA,gBAAgB,SAAS,QACzB,oBACA,4DACA,sBAAsB,sCACtB,kDACA,uBACA,8CACA,yBAAyB,eAAe,kBAAkB,eAEzD,iBAED,mBACG,UAAU,WAAW,UAAU;EAGlC,kBAAkB;;EAElB;EACA,WAAW;EACX,qBAAqB,YACpB,WACA,SACA,qBAEA;EAED,gBAAgB;EAChB,0BAA0B,UAAU,WAAW,SAAS,UAAU;EAClE,uBAAuB;EACvB,wBAAwB;EACxB,wBAAwB,QAAQ,0BAA0B;EAC1D,yBAAyB,QAAQ,sBAAsB;EACvD,wBAAwB,eAAe,WAAW,UAAU;EAC5D,wBAAwB;EACxB,mBAAmB;;;;;;;;;;;EAWnB,SAAS"}