@geekmidas/constructs 10.0.0-alpha.12 → 10.0.0-alpha.120

package/dist/{EndpointFactory-CjV8F_lJ.mjs → EndpointFactory-c2ZugGig.mjs}

@@ -1,10 +1,10 @@
-import { ConstructType, __toESM } from "./Construct-BD5neF7w.mjs";
-import { idsOf, serviceOf, servicesOf } from "./construct-interface-Z4CpS8tK.mjs";
-import { BaseFunctionBuilder, require_lodash } from "./functions-14lpEFL4.mjs";
-import { cloneWith } from "./clone-DblgEZZa.mjs";
-import { Endpoint } from "./Endpoint-DCQPMdUX.mjs";
+import { o as __toESM } from "./Construct-CKUA-CTA.mjs";
+import { idsOf, isConsumable, serviceOf, servicesOf } from "./construct-interface.mjs";
+import { o as require_lodash_uniqby, r as BaseFunctionBuilder } from "./functions-CTI-hDem.mjs";
+import { t as cloneWith } from "./clone-EKNovYHu.mjs";
+import { t as Endpoint } from "./Endpoint-gPXhHKhJ.mjs";
 import { DEFAULT_LOGGER } from "@geekmidas/logger/console";
-
+import { HttpError } from "@geekmidas/errors";
 //#region src/endpoints/Authorizer.ts
 /**
 * Built-in security schemes available by default.
@@ -67,27 +67,186 @@ function isBuiltInSecurityScheme(name) {
 function getSecurityScheme(name, customSchemes) {
 	if (customSchemes && name in customSchemes) return customSchemes[name];
 	if (isBuiltInSecurityScheme(name)) return BUILT_IN_SECURITY_SCHEMES[name];
-	return void 0;
 }
-
 //#endregion
 //#region src/endpoints/rls.ts
+var import_lodash_uniqby = /* @__PURE__ */ __toESM(require_lodash_uniqby(), 1);
 /**
 * Symbol used to bypass RLS for an endpoint.
 */
 const RLS_BYPASS = Symbol.for("geekmidas.rls.bypass");
-
+//#endregion
+//#region src/endpoints/upload.ts
+/**
+* Direct uploads: an endpoint that hands the browser a signed form, so the
+* file goes straight to the bucket and never through the server.
+*
+* The endpoint decides *where* — the key, from the session and the body — and
+* the form's policy decides *what*: the storage itself refuses a file larger
+* than `maxSize`, or of a type `accept` does not allow. Nothing the client
+* sends after this request is trusted to the server that issued it. That the
+* upload finished arrives as the bucket's `object.created` event.
+*/
+/** The longest a signature may be valid for: S3's limit, seven days. */
+const MAX_EXPIRES_IN = 604800;
+/** A media type, or a whole top-level type: `image/png`, `image/*`. */
+const MEDIA_TYPE = /^[a-z0-9][a-z0-9!#$&^_.+-]*\/(\*|[a-z0-9][a-z0-9!#$&^_.+-]*)$/i;
+/** An upload's `maxSize` that is not a positive whole number of bytes. */
+var UploadMaxSizeInvalid = class extends Error {
+	maxSize;
+	constructor(maxSize) {
+		super(`An upload's maxSize is ${maxSize}, and it has to be a positive whole number of bytes — 5 * 1024 * 1024 for 5 MiB.`);
+		this.maxSize = maxSize;
+		this.name = "UploadMaxSizeInvalid";
+	}
+};
+/** An upload's `expiresIn` outside what a signature can be valid for. */
+var UploadExpiryInvalid = class extends Error {
+	expiresIn;
+	constructor(expiresIn) {
+		super(`An upload's expiresIn is ${expiresIn}, and it has to be a whole number of seconds from 1 to ${MAX_EXPIRES_IN} (seven days, the longest S3 signs for). The default, 300, is usually right.`);
+		this.expiresIn = expiresIn;
+		this.name = "UploadExpiryInvalid";
+	}
+};
+/** An entry in `accept` that is not a media type. */
+var UploadAcceptInvalid = class extends Error {
+	entry;
+	constructor(entry) {
+		super(`'${entry}' in an upload's accept is not a media type. Name one ('image/png') or a whole type ('image/*').`);
+		this.entry = entry;
+		this.name = "UploadAcceptInvalid";
+	}
+};
+/** Several accepted types, and nothing saying which one an upload is. */
+var UploadContentTypeUnresolved = class extends Error {
+	accept;
+	constructor(accept) {
+		super(`An upload accepts ${accept.join(", ")}, and a signed form can fix only one type. Add contentType: ({ body }) => body.contentType, with the body naming which of them this file is.`);
+		this.accept = accept;
+		this.name = "UploadContentTypeUnresolved";
+	}
+};
+/** A request for an upload of a type the endpoint does not accept. */
+var UploadContentTypeRefused = class extends HttpError {
+	contentType;
+	accept;
+	constructor(contentType, accept) {
+		super(415, `'${contentType}' is not accepted here. Upload one of: ${accept.join(", ")}.`, { details: {
+			contentType,
+			accept
+		} });
+		this.contentType = contentType;
+		this.accept = accept;
+		this.name = "UploadContentTypeRefused";
+	}
+};
+/**
+* Check an upload's options when the endpoint is built, so a mistake fails at
+* startup rather than on the first request.
+*/
+function checkUploadOptions(options) {
+	if (!Number.isInteger(options.maxSize) || options.maxSize <= 0) throw new UploadMaxSizeInvalid(options.maxSize);
+	const { expiresIn } = options;
+	if (expiresIn !== void 0 && (!Number.isInteger(expiresIn) || expiresIn < 1 || expiresIn > MAX_EXPIRES_IN)) throw new UploadExpiryInvalid(expiresIn);
+	for (const entry of options.accept ?? []) if (!MEDIA_TYPE.test(entry)) throw new UploadAcceptInvalid(entry);
+	if ((options.accept?.length ?? 0) > 1 && !options.contentType) throw new UploadContentTypeUnresolved(options.accept);
+}
+/** Whether `type` is one `accept` allows — exactly, or under a `type/*`. */
+function accepts(accept, type) {
+	const wanted = type.toLowerCase();
+	return accept.some((entry) => {
+		const allowed = entry.toLowerCase();
+		return allowed.endsWith("/*") ? wanted.startsWith(allowed.slice(0, -1)) : allowed === wanted;
+	});
+}
+/**
+* The signed form for one request: the key and type resolved from the
+* handler's context, and the policy the storage enforces.
+*
+* @throws {UploadContentTypeRefused} when the resolved type is not accepted
+*/
+async function issueUpload(storage, ctx, options) {
+	const key = await options.key(ctx);
+	const accept = options.accept ?? [];
+	const resolved = options.contentType ? await options.contentType(ctx) : void 0;
+	let contentType;
+	if (resolved !== void 0) {
+		if (accept.length > 0 && !accepts(accept, resolved)) throw new UploadContentTypeRefused(resolved, accept);
+		contentType = resolved;
+	} else if (accept.length === 1) {
+		const only = accept[0];
+		contentType = only.endsWith("/*") ? { startsWith: only.slice(0, -1) } : only;
+	}
+	return storage.getUploadPost({
+		key,
+		maxSize: options.maxSize,
+		...contentType ? { contentType } : {},
+		...options.expiresIn !== void 0 ? { expiresIn: options.expiresIn } : {}
+	});
+}
+/** The JSON Schema of an {@link UploadPost}, for the endpoint's OpenAPI. */
+const UPLOAD_POST_JSON_SCHEMA = {
+	type: "object",
+	properties: {
+		url: {
+			type: "string",
+			format: "uri"
+		},
+		fields: {
+			type: "object",
+			additionalProperties: { type: "string" }
+		},
+		key: { type: "string" },
+		expiresAt: {
+			type: "string",
+			format: "date-time"
+		}
+	},
+	required: [
+		"url",
+		"fields",
+		"key",
+		"expiresAt"
+	],
+	additionalProperties: false
+};
+/** Whether `value` is an {@link UploadPost}. */
+function isUploadPost(value) {
+	if (!value || typeof value !== "object") return false;
+	const { url, fields, key, expiresAt } = value;
+	return typeof url === "string" && typeof key === "string" && typeof expiresAt === "string" && !!fields && typeof fields === "object" && Object.values(fields).every((field) => typeof field === "string");
+}
+/**
+* An upload endpoint's output, when it declares none of its own: the signed
+* form, as the handler is given it.
+*
+* Written by hand rather than with a schema library, so the endpoint runtime
+* imports none — the Standard Schema and Standard JSON Schema interfaces are
+* the whole of what validation and OpenAPI need.
+*/
+const UPLOAD_POST_SCHEMA = { "~standard": {
+	version: 1,
+	vendor: "geekmidas",
+	validate: (value) => isUploadPost(value) ? { value } : { issues: [{ message: "Expected an upload form" }] },
+	jsonSchema: {
+		input: () => structuredClone(UPLOAD_POST_JSON_SCHEMA),
+		output: () => structuredClone(UPLOAD_POST_JSON_SCHEMA)
+	}
+} };
 //#endregion
 //#region src/endpoints/EndpointBuilder.ts
-var import_lodash$1 = __toESM(require_lodash(), 1);
 var EndpointBuilder = class extends BaseFunctionBuilder {
+	route;
+	method;
 	schemas = {};
 	_description;
 	_status;
 	_tags;
 	_memorySize;
 	_responseType = "application/json";
-	_getSession = () => ({});
+	/** Set by a factory's `.session()`; absent, the endpoint reads none. */
+	_getSession;
 	_authorize = () => true;
 	_rateLimit;
 	_availableAuthorizers = [];
@@ -104,14 +263,12 @@ var EndpointBuilder = class extends BaseFunctionBuilder {
 	_customSecuritySchemes = {};
 	_rlsConfig;
 	_rlsBypass;
+	_telemetry;
 	constructor(route, method) {
-		super(ConstructType.Endpoint);
+		super("dev.geekmidas.function.endpoint");
 		this.route = route;
 		this.method = method;
 	}
-	_setPublisher(publisher) {
-		this._publisher = publisher;
-	}
 	_setAuditorStorage(storage) {
 		this._auditorStorage = storage;
 	}
@@ -121,11 +278,31 @@ var EndpointBuilder = class extends BaseFunctionBuilder {
 	description(description) {
 		return cloneWith(this, { _description: description });
 	}
+	/**
+	* The status a successful request is answered with — a 2xx, or a 3xx for
+	* an endpoint that always redirects (with a `Location` header). One that
+	* sometimes redirects returns `response.redirect(url)` instead.
+	*/
 	status(status) {
 		return cloneWith(this, { _status: status });
 	}
-	event(event) {
-		return cloneWith(this, { _events: [...this._events, event] });
+	/**
+	* Publish `event` to `topic` once the handler has succeeded — repeatable,
+	* one call per event, to as many topics as the endpoint names. The topic
+	* becomes a dependency as with `.dependsOn([topic])`, so `services.<topic>`
+	* is there for events the handler decides on itself.
+	*
+	* @example
+	* ```ts
+	* router.post('/users')
+	*   .event(users, {
+	*     type: 'user.created',
+	*     payload: (user) => ({ userId: user.id, email: user.email }),
+	*   })
+	* ```
+	*/
+	event(topic, event) {
+		return this.withEvent(topic, event);
 	}
 	tags(tags) {
 		return cloneWith(this, { _tags: tags });
@@ -134,6 +311,19 @@ var EndpointBuilder = class extends BaseFunctionBuilder {
 		return cloneWith(this, { _memorySize: memorySize });
 	}
 	/**
+	* This route's telemetry, beside what its surface's `Telemetry` says for
+	* every route: `{ ignore: true }` records no span for it — a health check,
+	* a probe — and `attributes` are set on its request span.
+	*
+	* @example
+	* ```ts
+	* router.get('/health').telemetry({ ignore: true }).handle(() => 'ok');
+	* ```
+	*/
+	telemetry(options) {
+		return cloneWith(this, { _telemetry: { ...options } });
+	}
+	/**
 	* Set the response content type for this endpoint.
 	*
 	* Defaults to `'application/json'`. When set to any other value
@@ -154,9 +344,6 @@ var EndpointBuilder = class extends BaseFunctionBuilder {
 	responseType(type) {
 		return cloneWith(this, { _responseType: type });
 	}
-	publisher(publisher) {
-		return cloneWith(this, { _publisher: publisher });
-	}
 	body(schema) {
 		this.schemas.body = schema;
 		return this;
@@ -180,8 +367,7 @@ var EndpointBuilder = class extends BaseFunctionBuilder {
 	}
 	authorizer(name) {
 		if (name === "none") return cloneWith(this, { _authorizerName: void 0 });
-		const authorizerExists = this._availableAuthorizers.some((a) => a.name === name);
-		if (!authorizerExists && this._availableAuthorizers.length > 0) {
+		if (!this._availableAuthorizers.some((a) => a.name === name) && this._availableAuthorizers.length > 0) {
 			const available = this._availableAuthorizers.map((a) => a.name).join(", ");
 			throw new Error(`Authorizer "${name}" not found in available authorizers: ${available}`);
 		}
@@ -201,12 +387,52 @@ var EndpointBuilder = class extends BaseFunctionBuilder {
 	dependsOn(constructs) {
 		const services = servicesOf(constructs);
 		return cloneWith(this, {
-			_services: (0, import_lodash$1.default)([...this._services, ...services], (service) => service.serviceName),
+			_services: (0, import_lodash_uniqby.default)([...this._services, ...services], (service) => service.serviceName),
 			_constructs: idsOf(constructs, this._constructs)
 		});
 	}
+	/**
+	* Hand the browser a signed form that uploads one file straight to
+	* `bucket` — the file never passes through this server.
+	*
+	* The endpoint decides where (`key`, from what the handler is given) and
+	* the form's policy decides what: the storage refuses a file over
+	* `maxSize`, or of a type `accept` does not allow. The handler receives
+	* the form as `upload`, and returns it unless it has more to say — it is
+	* the endpoint's output when no `.output()` came first. The bucket
+	* becomes a dependency, as with `.dependsOn([bucket])`.
+	*
+	* The last step before `.handle()`: the key is resolved from the body,
+	* params and session, so they are declared first.
+	*
+	* @example
+	* ```ts
+	* router
+	*   .post('/me/avatar')
+	*   .upload(uploads, {
+	*     key: ({ session }) => `avatars/${session.userId}.png`,
+	*     maxSize: 5 * 1024 * 1024,
+	*     accept: ['image/png'],
+	*   })
+	*   .handle(async ({ upload }) => upload);
+	* ```
+	*/
+	upload(bucket, options) {
+		checkUploadOptions(options);
+		const [service] = servicesOf([bucket]);
+		const next = Object.create(UploadEndpointBuilder.prototype);
+		return Object.assign(next, this, {
+			_services: (0, import_lodash_uniqby.default)([...this._services, service], (s) => s.serviceName),
+			_constructs: idsOf([bucket], this._constructs),
+			outputSchema: this.outputSchema ?? UPLOAD_POST_SCHEMA,
+			_upload: {
+				serviceName: service.serviceName,
+				options
+			}
+		});
+	}
 	services(services) {
-		return cloneWith(this, { _services: (0, import_lodash$1.default)([...this._services, ...services], (s) => s.serviceName) });
+		return cloneWith(this, { _services: (0, import_lodash_uniqby.default)([...this._services, ...services], (s) => s.serviceName) });
 	}
 	logger(logger) {
 		return cloneWith(this, { _logger: logger });
@@ -349,7 +575,6 @@ var EndpointBuilder = class extends BaseFunctionBuilder {
 			status: this._status,
 			getSession: this._getSession,
 			rateLimit: this._rateLimit,
-			publisherService: this._publisher,
 			events: this._events,
 			authorizer,
 			surface: this._surface,
@@ -359,16 +584,36 @@ var EndpointBuilder = class extends BaseFunctionBuilder {
 			databaseService: this._databaseService,
 			rlsConfig: this._rlsConfig,
 			rlsBypass: this._rlsBypass,
-			responseType: this._responseType
+			responseType: this._responseType,
+			...this._telemetry ? { telemetry: this._telemetry } : {}
 		});
 		endpoint.owner = this._surface?.id;
 		return endpoint;
 	}
 };
-
+/**
+* What `.upload(bucket, …)` returns: the same builder, whose handler is also
+* given the signed form.
+*/
+var UploadEndpointBuilder = class extends EndpointBuilder {
+	/** The bucket's service, and what an upload to it allows. */
+	_upload;
+	handle(fn) {
+		const { serviceName, options } = this._upload;
+		const handler = (async (ctx, response) => {
+			const storage = ctx.services[serviceName];
+			const upload = await issueUpload(storage, ctx, options);
+			Object.defineProperty(ctx, "upload", {
+				value: upload,
+				enumerable: true
+			});
+			return fn(ctx, response);
+		});
+		return super.handle(handler);
+	}
+};
 //#endregion
 //#region src/endpoints/EndpointFactory.ts
-var import_lodash = __toESM(require_lodash(), 1);
 var EndpointFactory = class EndpointFactory {
 	defaultServices = [];
 	/**
@@ -384,7 +629,6 @@ var EndpointFactory = class EndpointFactory {
 	defaultConstructs = [];
 	basePath = "";
 	defaultAuthorizeFn;
-	defaultEventPublisher;
 	defaultSessionExtractor;
 	defaultLogger;
 	/**
@@ -402,14 +646,13 @@ var EndpointFactory = class EndpointFactory {
 	defaultActorExtractor;
 	customSecuritySchemes;
 	defaultRlsConfig;
-	constructor({ basePath, defaultAuthorizeFn, defaultLogger = DEFAULT_LOGGER, defaultSessionExtractor, defaultServices = [], defaultConstructs = [], defaultEventPublisher, availableAuthorizers = [], defaultAuthorizerName, defaultAuditorStorage, defaultDatabaseService, defaultActorExtractor, customSecuritySchemes = {}, defaultRlsConfig, surface }) {
+	constructor({ basePath, defaultAuthorizeFn, defaultLogger = DEFAULT_LOGGER, defaultSessionExtractor, defaultServices = [], defaultConstructs = [], availableAuthorizers = [], defaultAuthorizerName, defaultAuditorStorage, defaultDatabaseService, defaultActorExtractor, customSecuritySchemes = {}, defaultRlsConfig, surface }) {
 		this.defaultConstructs = [...new Set(defaultConstructs)];
-		this.defaultServices = (0, import_lodash.default)(defaultServices, (s) => s.serviceName);
+		this.defaultServices = (0, import_lodash_uniqby.default)(defaultServices, (s) => s.serviceName);
 		this.basePath = basePath || "";
 		this.defaultAuthorizeFn = defaultAuthorizeFn;
 		this.defaultLogger = defaultLogger;
 		this.defaultSessionExtractor = defaultSessionExtractor;
-		this.defaultEventPublisher = defaultEventPublisher;
 		this.availableAuthorizers = availableAuthorizers;
 		this.defaultAuthorizerName = defaultAuthorizerName;
 		this.defaultAuditorStorage = defaultAuditorStorage;
@@ -423,9 +666,7 @@ var EndpointFactory = class EndpointFactory {
 		if (!basePath && !path) return "/";
 		if (!basePath) return path.startsWith("/") ? path : `/${path}`;
 		if (!path) return basePath.startsWith("/") ? basePath : `/${basePath}`;
-		const base = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
-		const segment = path.startsWith("/") ? path : `/${path}`;
-		let result = base + segment;
+		let result = (basePath.endsWith("/") ? basePath.slice(0, -1) : basePath) + (path.startsWith("/") ? path : `/${path}`);
 		if (!result.startsWith("/")) result = `/${result}`;
 		result = result.replace(/^\/+/g, "/");
 		if (result.length > 1 && result.endsWith("/")) result = result.slice(0, -1);
@@ -443,7 +684,6 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizeFn: this.defaultAuthorizeFn,
 			defaultLogger: this.defaultLogger,
 			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
 			availableAuthorizers: authorizerConfigs,
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
@@ -478,7 +718,6 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizeFn: this.defaultAuthorizeFn,
 			defaultLogger: this.defaultLogger,
 			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
 			availableAuthorizers: this.availableAuthorizers,
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
@@ -504,8 +743,7 @@ var EndpointFactory = class EndpointFactory {
 	*/
 	authorizer(name) {
 		if (name !== "none" && this.availableAuthorizers.length > 0) {
-			const authorizerExists = this.availableAuthorizers.some((a) => a.name === name);
-			if (!authorizerExists) {
+			if (!this.availableAuthorizers.some((a) => a.name === name)) {
 				const available = this.availableAuthorizers.map((a) => a.name).join(", ");
 				throw new Error(`Authorizer "${name}" not found in available authorizers: ${available}`);
 			}
@@ -517,7 +755,6 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizeFn: this.defaultAuthorizeFn,
 			defaultLogger: this.defaultLogger,
 			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
 			availableAuthorizers: this.availableAuthorizers,
 			defaultAuthorizerName: name === "none" ? void 0 : name,
 			defaultAuditorStorage: this.defaultAuditorStorage,
@@ -537,7 +774,6 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizeFn: this.defaultAuthorizeFn,
 			defaultLogger: this.defaultLogger,
 			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
 			availableAuthorizers: this.availableAuthorizers,
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
@@ -556,7 +792,6 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizeFn: fn,
 			defaultLogger: this.defaultLogger,
 			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
 			availableAuthorizers: this.availableAuthorizers,
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
@@ -580,7 +815,7 @@ var EndpointFactory = class EndpointFactory {
 	*/
 	dependsOn(constructs) {
 		const next = this.services(servicesOf(constructs));
-		next.defaultConstructs = [...new Set([...this.defaultConstructs, ...constructs.map((construct) => construct.id)])];
+		next.defaultConstructs = [.../* @__PURE__ */ new Set([...this.defaultConstructs, ...constructs.map((construct) => construct.id)])];
 		return next;
 	}
 	services(services) {
@@ -591,7 +826,6 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizeFn: this.defaultAuthorizeFn,
 			defaultLogger: this.defaultLogger,
 			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
 			availableAuthorizers: this.availableAuthorizers,
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
@@ -610,26 +844,6 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizeFn: this.defaultAuthorizeFn,
 			defaultLogger: logger,
 			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
-			availableAuthorizers: this.availableAuthorizers,
-			defaultAuthorizerName: this.defaultAuthorizerName,
-			defaultAuditorStorage: this.defaultAuditorStorage,
-			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor,
-			customSecuritySchemes: this.customSecuritySchemes,
-			surface: this.surface,
-			defaultRlsConfig: this.defaultRlsConfig
-		});
-	}
-	publisher(publisher) {
-		return new EndpointFactory({
-			defaultServices: this.defaultServices,
-			defaultConstructs: this.defaultConstructs,
-			basePath: this.basePath,
-			defaultAuthorizeFn: this.defaultAuthorizeFn,
-			defaultLogger: this.defaultLogger,
-			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: publisher,
 			availableAuthorizers: this.availableAuthorizers,
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
@@ -648,7 +862,6 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizeFn: this.defaultAuthorizeFn,
 			defaultLogger: this.defaultLogger,
 			defaultSessionExtractor: session,
-			defaultEventPublisher: this.defaultEventPublisher,
 			availableAuthorizers: this.availableAuthorizers,
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
@@ -667,12 +880,11 @@ var EndpointFactory = class EndpointFactory {
 		const service = serviceOf(source);
 		return new EndpointFactory({
 			defaultServices: this.defaultServices,
-			defaultConstructs: this.defaultConstructs,
+			defaultConstructs: isConsumable(source) ? idsOf([source], this.defaultConstructs) : this.defaultConstructs,
 			basePath: this.basePath,
 			defaultAuthorizeFn: this.defaultAuthorizeFn,
 			defaultLogger: this.defaultLogger,
 			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
 			availableAuthorizers: this.availableAuthorizers,
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
@@ -695,7 +907,6 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizeFn: this.defaultAuthorizeFn,
 			defaultLogger: this.defaultLogger,
 			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
 			availableAuthorizers: this.availableAuthorizers,
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: storage,
@@ -718,7 +929,6 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizeFn: this.defaultAuthorizeFn,
 			defaultLogger: this.defaultLogger,
 			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
 			availableAuthorizers: this.availableAuthorizers,
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
@@ -755,7 +965,6 @@ var EndpointFactory = class EndpointFactory {
 			defaultAuthorizeFn: this.defaultAuthorizeFn,
 			defaultLogger: this.defaultLogger,
 			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
 			availableAuthorizers: this.availableAuthorizers,
 			defaultAuthorizerName: this.defaultAuthorizerName,
 			defaultAuditorStorage: this.defaultAuditorStorage,
@@ -767,15 +976,13 @@ var EndpointFactory = class EndpointFactory {
 		});
 	}
 	createBuilder(method, path) {
-		const fullPath = EndpointFactory.joinPaths(path, this.basePath);
-		const builder = new EndpointBuilder(fullPath, method);
+		const builder = new EndpointBuilder(EndpointFactory.joinPaths(path, this.basePath), method);
 		if (this.defaultAuthorizeFn) builder._authorize = this.defaultAuthorizeFn;
 		if (this.defaultServices.length) builder._services = [...this.defaultServices];
 		if (this.defaultConstructs.length) builder._constructs = [...this.defaultConstructs];
 		if (this.defaultLogger) builder._logger = this.defaultLogger;
 		builder._surface = this.surface;
 		if (this.defaultSessionExtractor) builder._getSession = this.defaultSessionExtractor;
-		if (this.defaultEventPublisher) builder._setPublisher(this.defaultEventPublisher);
 		builder._availableAuthorizers = this.availableAuthorizers;
 		if (this.defaultAuthorizerName) builder._authorizerName = this.defaultAuthorizerName;
 		if (this.defaultAuditorStorage) builder._setAuditorStorage(this.defaultAuditorStorage);
@@ -804,7 +1011,7 @@ var EndpointFactory = class EndpointFactory {
 		return this.createBuilder("OPTIONS", path);
 	}
 };
-
 //#endregion
-export { BUILT_IN_SECURITY_SCHEMES, EndpointBuilder, EndpointFactory, RLS_BYPASS, createAuthorizer, getSecurityScheme, isBuiltInSecurityScheme };
-//# sourceMappingURL=EndpointFactory-CjV8F_lJ.mjs.map
+export { UploadAcceptInvalid as a, UploadExpiryInvalid as c, BUILT_IN_SECURITY_SCHEMES as d, createAuthorizer as f, UPLOAD_POST_SCHEMA as i, UploadMaxSizeInvalid as l, isBuiltInSecurityScheme as m, EndpointBuilder as n, UploadContentTypeRefused as o, getSecurityScheme as p, UploadEndpointBuilder as r, UploadContentTypeUnresolved as s, EndpointFactory as t, RLS_BYPASS as u };
+
+//# sourceMappingURL=EndpointFactory-c2ZugGig.mjs.map