@geekmidas/constructs 10.0.0-alpha.12 → 10.0.0-alpha.120

package/dist/readRequestBody-Dej_L3c4.cjs

@@ -0,0 +1,342 @@
+let _geekmidas_errors = require("@geekmidas/errors");
+let hono_cookie = require("hono/cookie");
+//#region src/endpoints/lazyAccessors.ts
+/**
+* Create a lazy header accessor for Hono.
+* Uses `c.req.header(name)` for single lookups (native, case-insensitive).
+* Only calls `c.req.header()` to get all headers when needed.
+*/
+function createHonoHeaders(c) {
+	let allHeaders = null;
+	return ((key) => {
+		if (key !== void 0) return c.req.header(key);
+		if (!allHeaders) allHeaders = c.req.header();
+		return allHeaders;
+	});
+}
+/**
+* Create a lazy cookie accessor for Hono.
+* Uses `getCookie(c, name)` for single lookups (native).
+* Only parses the cookie header when all cookies are requested.
+*/
+function createHonoCookies(c) {
+	let allCookies = null;
+	return ((name) => {
+		if (name !== void 0) return (0, hono_cookie.getCookie)(c, name);
+		if (!allCookies) {
+			allCookies = {};
+			const cookieHeader = c.req.header("cookie");
+			if (cookieHeader) for (const part of cookieHeader.split(";")) {
+				const trimmed = part.trim();
+				const eqIndex = trimmed.indexOf("=");
+				if (eqIndex > 0) {
+					const key = trimmed.slice(0, eqIndex);
+					const value = trimmed.slice(eqIndex + 1);
+					allCookies[key] = value;
+				}
+			}
+		}
+		return allCookies;
+	});
+}
+/**
+* Create a lazy header accessor for API Gateway events.
+* Handles case-insensitive lookups.
+*/
+function createApiGatewayHeaders(headers) {
+	let normalizedHeaders = null;
+	const normalize = () => {
+		if (!normalizedHeaders) {
+			normalizedHeaders = {};
+			if (headers) {
+				for (const [k, v] of Object.entries(headers)) if (v !== void 0) normalizedHeaders[k.toLowerCase()] = v;
+			}
+		}
+		return normalizedHeaders;
+	};
+	return ((key) => {
+		if (key !== void 0) {
+			if (headers) {
+				const direct = headers[key] ?? headers[key.toLowerCase()];
+				if (direct !== void 0) return direct;
+				return normalize()[key.toLowerCase()];
+			}
+			return;
+		}
+		return normalize();
+	});
+}
+/**
+* Create a lazy cookie accessor for API Gateway events.
+* Decodes URL-encoded values to match browser behavior.
+*/
+function createApiGatewayCookies(cookies, cookieHeader) {
+	let parsed = null;
+	const parse = () => {
+		if (!parsed) {
+			parsed = {};
+			if (cookies) for (const cookie of cookies) {
+				const eqIndex = cookie.indexOf("=");
+				if (eqIndex > 0) {
+					const key = cookie.slice(0, eqIndex);
+					const value = cookie.slice(eqIndex + 1);
+					parsed[key] = decodeURIComponent(value);
+				}
+			}
+			else if (cookieHeader) for (const part of cookieHeader.split(";")) {
+				const trimmed = part.trim();
+				const eqIndex = trimmed.indexOf("=");
+				if (eqIndex > 0) {
+					const key = trimmed.slice(0, eqIndex);
+					const value = trimmed.slice(eqIndex + 1);
+					parsed[key] = decodeURIComponent(value);
+				}
+			}
+		}
+		return parsed;
+	};
+	return ((name) => {
+		if (name !== void 0) return parse()[name];
+		return parse();
+	});
+}
+/**
+* Create a lazy header accessor for plain object headers (test adaptor, etc).
+* Headers are already available as an object, just provide lazy access.
+*/
+function createObjectHeaders(headers) {
+	let normalized = null;
+	return ((key) => {
+		if (key !== void 0) {
+			if (headers) {
+				const direct = headers[key] ?? headers[key.toLowerCase()];
+				if (direct !== void 0) return direct;
+			}
+			if (!normalized && headers) {
+				normalized = {};
+				for (const [k, v] of Object.entries(headers)) normalized[k.toLowerCase()] = v;
+			}
+			return normalized?.[key.toLowerCase()];
+		}
+		if (!normalized && headers) {
+			normalized = {};
+			for (const [k, v] of Object.entries(headers)) normalized[k.toLowerCase()] = v;
+		}
+		return normalized ?? {};
+	});
+}
+/**
+* Create a lazy cookie accessor from a cookie header string.
+* Decodes URL-encoded values to match browser behavior.
+*/
+function createCookieHeaderAccessor(cookieHeader) {
+	let parsed = null;
+	const parse = () => {
+		if (!parsed) {
+			parsed = {};
+			if (cookieHeader) for (const part of cookieHeader.split(";")) {
+				const trimmed = part.trim();
+				const eqIndex = trimmed.indexOf("=");
+				if (eqIndex > 0) {
+					const key = trimmed.slice(0, eqIndex);
+					const value = trimmed.slice(eqIndex + 1);
+					parsed[key] = decodeURIComponent(value);
+				}
+			}
+		}
+		return parsed;
+	};
+	return ((name) => {
+		if (name !== void 0) return parse()[name];
+		return parse();
+	});
+}
+/**
+* Create a no-op header accessor (for minimal endpoints that don't use headers).
+*/
+function createNoopHeaders() {
+	return ((key) => {
+		if (key !== void 0) return void 0;
+		return {};
+	});
+}
+/**
+* Create a no-op cookie accessor (for minimal endpoints that don't use cookies).
+*/
+function createNoopCookies() {
+	return ((name) => {
+		if (name !== void 0) return void 0;
+		return {};
+	});
+}
+//#endregion
+//#region src/endpoints/readRequestBody.ts
+/**
+* The media types an endpoint's `.body()` schema can be handed — as written
+* in the 415 a request in any other type is answered with.
+*/
+const SUPPORTED_BODY_TYPES = [
+	"application/json",
+	"application/x-www-form-urlencoded",
+	"multipart/form-data",
+	"text/*"
+];
+/**
+* A request whose body is in a media type no endpoint reads — XML, a bare
+* octet stream. Answered with a 415, before the body schema runs.
+*/
+var UnsupportedRequestContentType = class extends _geekmidas_errors.HttpError {
+	contentType;
+	constructor(contentType) {
+		super(415, `A body sent as '${contentType}' can't be read. Send it as ${SUPPORTED_BODY_TYPES.join(", ")}.`, {
+			statusMessage: "Unsupported Media Type",
+			details: {
+				contentType,
+				supported: [...SUPPORTED_BODY_TYPES]
+			}
+		});
+		this.contentType = contentType;
+		this.name = "UnsupportedRequestContentType";
+	}
+};
+/**
+* A body that says it is JSON and is not. Answered with a 400 — the request
+* is broken, not merely invalid against the schema.
+*/
+var MalformedRequestBody = class extends _geekmidas_errors.HttpError {
+	contentType;
+	constructor(contentType, cause) {
+		super(400, `The body says it is '${contentType}' but can't be parsed as that. Send a well-formed body, with the Content-Type it is written in.`, { cause });
+		this.contentType = contentType;
+		this.name = "MalformedRequestBody";
+	}
+};
+/**
+* A request body, read by its Content-Type into what an endpoint's `.body()`
+* schema validates — the one place every adaptor reads a body:
+*
+* - `application/json` (and `application/*+json`) — the parsed JSON.
+* - `application/x-www-form-urlencoded` and `multipart/form-data` — a plain
+*   object of fields, as an HTML form posts them. A repeated field, or one
+*   named `field[]`, is an array; a file part is a `File`.
+* - `text/*` — the text.
+*
+* Anything else is an {@link UnsupportedRequestContentType}.
+*/
+async function readRequestBody(source, contentType, options) {
+	const mediaType = contentType?.split(";")[0]?.trim().toLowerCase();
+	if (!mediaType) {
+		if (options.untyped === "empty") return {};
+		return readJson(source, "application/json");
+	}
+	if (isJson(mediaType)) return readJson(source, mediaType);
+	if (mediaType === "application/x-www-form-urlencoded" || mediaType === "multipart/form-data") return formFields(await readForm(source, mediaType));
+	if (mediaType.startsWith("text/")) return source.text();
+	throw new UnsupportedRequestContentType(mediaType);
+}
+function isJson(mediaType) {
+	return mediaType === "application/json" || mediaType.startsWith("application/") && mediaType.endsWith("+json");
+}
+async function readJson(source, mediaType) {
+	try {
+		return await source.json();
+	} catch (error) {
+		throw new MalformedRequestBody(mediaType, error);
+	}
+}
+async function readForm(source, mediaType) {
+	try {
+		return await source.formData();
+	} catch (error) {
+		throw new MalformedRequestBody(mediaType, error);
+	}
+}
+/**
+* A form's fields as an object, the way Hono's `parseBody({ all: true })`
+* reads them. Without a prototype, so a field named `__proto__` is a field.
+*/
+function formFields(form) {
+	const fields = Object.create(null);
+	for (const [key, value] of form.entries()) {
+		const existing = fields[key];
+		if (existing === void 0) fields[key] = key.endsWith("[]") ? [value] : value;
+		else if (Array.isArray(existing)) existing.push(value);
+		else fields[key] = [existing, value];
+	}
+	return fields;
+}
+//#endregion
+Object.defineProperty(exports, "MalformedRequestBody", {
+	enumerable: true,
+	get: function() {
+		return MalformedRequestBody;
+	}
+});
+Object.defineProperty(exports, "SUPPORTED_BODY_TYPES", {
+	enumerable: true,
+	get: function() {
+		return SUPPORTED_BODY_TYPES;
+	}
+});
+Object.defineProperty(exports, "UnsupportedRequestContentType", {
+	enumerable: true,
+	get: function() {
+		return UnsupportedRequestContentType;
+	}
+});
+Object.defineProperty(exports, "createApiGatewayCookies", {
+	enumerable: true,
+	get: function() {
+		return createApiGatewayCookies;
+	}
+});
+Object.defineProperty(exports, "createApiGatewayHeaders", {
+	enumerable: true,
+	get: function() {
+		return createApiGatewayHeaders;
+	}
+});
+Object.defineProperty(exports, "createCookieHeaderAccessor", {
+	enumerable: true,
+	get: function() {
+		return createCookieHeaderAccessor;
+	}
+});
+Object.defineProperty(exports, "createHonoCookies", {
+	enumerable: true,
+	get: function() {
+		return createHonoCookies;
+	}
+});
+Object.defineProperty(exports, "createHonoHeaders", {
+	enumerable: true,
+	get: function() {
+		return createHonoHeaders;
+	}
+});
+Object.defineProperty(exports, "createNoopCookies", {
+	enumerable: true,
+	get: function() {
+		return createNoopCookies;
+	}
+});
+Object.defineProperty(exports, "createNoopHeaders", {
+	enumerable: true,
+	get: function() {
+		return createNoopHeaders;
+	}
+});
+Object.defineProperty(exports, "createObjectHeaders", {
+	enumerable: true,
+	get: function() {
+		return createObjectHeaders;
+	}
+});
+Object.defineProperty(exports, "readRequestBody", {
+	enumerable: true,
+	get: function() {
+		return readRequestBody;
+	}
+});
+
+//# sourceMappingURL=readRequestBody-Dej_L3c4.cjs.map

package/dist/readRequestBody-Dej_L3c4.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"readRequestBody-Dej_L3c4.cjs","names":["getCookie","HttpError"],"sources":["../src/endpoints/lazyAccessors.ts","../src/endpoints/readRequestBody.ts"],"sourcesContent":["/**\n * Lazy header and cookie accessors for different adaptors.\n *\n * Instead of parsing all headers/cookies upfront, these accessors\n * use native adaptor methods for single lookups and only parse\n * everything when `header()` or `cookie()` is called without arguments.\n */\nimport type { Context } from 'hono';\nimport { getCookie } from 'hono/cookie';\nimport type { CookieFn, HeaderFn } from './Endpoint';\n\n/**\n * Create a lazy header accessor for Hono.\n * Uses `c.req.header(name)` for single lookups (native, case-insensitive).\n * Only calls `c.req.header()` to get all headers when needed.\n */\nexport function createHonoHeaders(c: Context): HeaderFn {\n\tlet allHeaders: Record<string, string> | null = null;\n\n\treturn ((key?: string) => {\n\t\tif (key !== undefined) {\n\t\t\t// Single header lookup - use native Hono method (case-insensitive)\n\t\t\treturn c.req.header(key);\n\t\t}\n\t\t// Get all headers - cache the result\n\t\tif (!allHeaders) {\n\t\t\tallHeaders = c.req.header();\n\t\t}\n\t\treturn allHeaders;\n\t}) as HeaderFn;\n}\n\n/**\n * Create a lazy cookie accessor for Hono.\n * Uses `getCookie(c, name)` for single lookups (native).\n * Only parses the cookie header when all cookies are requested.\n */\nexport function createHonoCookies(c: Context): CookieFn {\n\tlet allCookies: Record<string, string> | null = null;\n\n\treturn ((name?: string) => {\n\t\tif (name !== undefined) {\n\t\t\t// Single cookie lookup - use native Hono method\n\t\t\treturn getCookie(c, name);\n\t\t}\n\t\t// Get all cookies - parse and cache\n\t\tif (!allCookies) {\n\t\t\tallCookies = {};\n\t\t\tconst cookieHeader = c.req.header('cookie');\n\t\t\tif (cookieHeader) {\n\t\t\t\tfor (const part of cookieHeader.split(';')) {\n\t\t\t\t\tconst trimmed = part.trim();\n\t\t\t\t\tconst eqIndex = trimmed.indexOf('=');\n\t\t\t\t\tif (eqIndex > 0) {\n\t\t\t\t\t\tconst key = trimmed.slice(0, eqIndex);\n\t\t\t\t\t\tconst value = trimmed.slice(eqIndex + 1);\n\t\t\t\t\t\tallCookies[key] = value;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn allCookies;\n\t}) as CookieFn;\n}\n\n/**\n * Create a lazy header accessor for API Gateway events.\n * Handles case-insensitive lookups.\n */\nexport function createApiGatewayHeaders(\n\theaders: Record<string, string | undefined> | null | undefined,\n): HeaderFn {\n\tlet normalizedHeaders: Record<string, string> | null = null;\n\n\tconst normalize = () => {\n\t\tif (!normalizedHeaders) {\n\t\t\tnormalizedHeaders = {};\n\t\t\tif (headers) {\n\t\t\t\tfor (const [k, v] of Object.entries(headers)) {\n\t\t\t\t\tif (v !== undefined) {\n\t\t\t\t\t\tnormalizedHeaders[k.toLowerCase()] = v;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn normalizedHeaders;\n\t};\n\n\treturn ((key?: string) => {\n\t\tif (key !== undefined) {\n\t\t\t// Try direct lookup first (common case: headers already lowercase)\n\t\t\tif (headers) {\n\t\t\t\tconst direct = headers[key] ?? headers[key.toLowerCase()];\n\t\t\t\tif (direct !== undefined) return direct;\n\t\t\t\t// Fall back to normalized lookup\n\t\t\t\treturn normalize()[key.toLowerCase()];\n\t\t\t}\n\t\t\treturn undefined;\n\t\t}\n\t\treturn normalize();\n\t}) as HeaderFn;\n}\n\n/**\n * Create a lazy cookie accessor for API Gateway events.\n * Decodes URL-encoded values to match browser behavior.\n */\nexport function createApiGatewayCookies(\n\tcookies: string[] | undefined,\n\tcookieHeader: string | undefined,\n): CookieFn {\n\tlet parsed: Record<string, string> | null = null;\n\n\tconst parse = () => {\n\t\tif (!parsed) {\n\t\t\tparsed = {};\n\t\t\t// API Gateway v2 provides cookies as array\n\t\t\tif (cookies) {\n\t\t\t\tfor (const cookie of cookies) {\n\t\t\t\t\tconst eqIndex = cookie.indexOf('=');\n\t\t\t\t\tif (eqIndex > 0) {\n\t\t\t\t\t\tconst key = cookie.slice(0, eqIndex);\n\t\t\t\t\t\tconst value = cookie.slice(eqIndex + 1);\n\t\t\t\t\t\tparsed[key] = decodeURIComponent(value);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t} else if (cookieHeader) {\n\t\t\t\t// Fall back to parsing cookie header\n\t\t\t\tfor (const part of cookieHeader.split(';')) {\n\t\t\t\t\tconst trimmed = part.trim();\n\t\t\t\t\tconst eqIndex = trimmed.indexOf('=');\n\t\t\t\t\tif (eqIndex > 0) {\n\t\t\t\t\t\tconst key = trimmed.slice(0, eqIndex);\n\t\t\t\t\t\tconst value = trimmed.slice(eqIndex + 1);\n\t\t\t\t\t\tparsed[key] = decodeURIComponent(value);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn parsed;\n\t};\n\n\treturn ((name?: string) => {\n\t\tif (name !== undefined) {\n\t\t\treturn parse()[name];\n\t\t}\n\t\treturn parse();\n\t}) as CookieFn;\n}\n\n/**\n * Create a lazy header accessor for plain object headers (test adaptor, etc).\n * Headers are already available as an object, just provide lazy access.\n */\nexport function createObjectHeaders(\n\theaders: Record<string, string> | undefined,\n): HeaderFn {\n\tlet normalized: Record<string, string> | null = null;\n\n\treturn ((key?: string) => {\n\t\tif (key !== undefined) {\n\t\t\t// Try direct lookup first (common case)\n\t\t\tif (headers) {\n\t\t\t\tconst direct = headers[key] ?? headers[key.toLowerCase()];\n\t\t\t\tif (direct !== undefined) return direct;\n\t\t\t}\n\t\t\t// Fall back to normalized lookup for case-insensitivity\n\t\t\tif (!normalized && headers) {\n\t\t\t\tnormalized = {};\n\t\t\t\tfor (const [k, v] of Object.entries(headers)) {\n\t\t\t\t\tnormalized[k.toLowerCase()] = v;\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn normalized?.[key.toLowerCase()];\n\t\t}\n\t\t// Return all headers\n\t\tif (!normalized && headers) {\n\t\t\tnormalized = {};\n\t\t\tfor (const [k, v] of Object.entries(headers)) {\n\t\t\t\tnormalized[k.toLowerCase()] = v;\n\t\t\t}\n\t\t}\n\t\treturn normalized ?? {};\n\t}) as HeaderFn;\n}\n\n/**\n * Create a lazy cookie accessor from a cookie header string.\n * Decodes URL-encoded values to match browser behavior.\n */\nexport function createCookieHeaderAccessor(\n\tcookieHeader: string | undefined,\n): CookieFn {\n\tlet parsed: Record<string, string> | null = null;\n\n\tconst parse = () => {\n\t\tif (!parsed) {\n\t\t\tparsed = {};\n\t\t\tif (cookieHeader) {\n\t\t\t\tfor (const part of cookieHeader.split(';')) {\n\t\t\t\t\tconst trimmed = part.trim();\n\t\t\t\t\tconst eqIndex = trimmed.indexOf('=');\n\t\t\t\t\tif (eqIndex > 0) {\n\t\t\t\t\t\tconst key = trimmed.slice(0, eqIndex);\n\t\t\t\t\t\tconst value = trimmed.slice(eqIndex + 1);\n\t\t\t\t\t\t// Decode URL-encoded values to match Endpoint.createCookies behavior\n\t\t\t\t\t\tparsed[key] = decodeURIComponent(value);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn parsed;\n\t};\n\n\treturn ((name?: string) => {\n\t\tif (name !== undefined) {\n\t\t\treturn parse()[name];\n\t\t}\n\t\treturn parse();\n\t}) as CookieFn;\n}\n\n/**\n * Create a no-op header accessor (for minimal endpoints that don't use headers).\n */\nexport function createNoopHeaders(): HeaderFn {\n\treturn ((key?: string) => {\n\t\tif (key !== undefined) return undefined;\n\t\treturn {};\n\t}) as HeaderFn;\n}\n\n/**\n * Create a no-op cookie accessor (for minimal endpoints that don't use cookies).\n */\nexport function createNoopCookies(): CookieFn {\n\treturn ((name?: string) => {\n\t\tif (name !== undefined) return undefined;\n\t\treturn {};\n\t}) as CookieFn;\n}\n","import { HttpError } from '@geekmidas/errors';\n\n/**\n * The media types an endpoint's `.body()` schema can be handed — as written\n * in the 415 a request in any other type is answered with.\n */\nexport const SUPPORTED_BODY_TYPES = [\n\t'application/json',\n\t'application/x-www-form-urlencoded',\n\t'multipart/form-data',\n\t'text/*',\n] as const;\n\n/**\n * A request whose body is in a media type no endpoint reads — XML, a bare\n * octet stream. Answered with a 415, before the body schema runs.\n */\nexport class UnsupportedRequestContentType extends HttpError {\n\tconstructor(readonly contentType: string) {\n\t\tsuper(\n\t\t\t415,\n\t\t\t`A body sent as '${contentType}' can't be read. Send it as ${SUPPORTED_BODY_TYPES.join(', ')}.`,\n\t\t\t{\n\t\t\t\tstatusMessage: 'Unsupported Media Type',\n\t\t\t\tdetails: { contentType, supported: [...SUPPORTED_BODY_TYPES] },\n\t\t\t},\n\t\t);\n\t\tthis.name = 'UnsupportedRequestContentType';\n\t}\n}\n\n/**\n * A body that says it is JSON and is not. Answered with a 400 — the request\n * is broken, not merely invalid against the schema.\n */\nexport class MalformedRequestBody extends HttpError {\n\tconstructor(\n\t\treadonly contentType: string,\n\t\tcause?: Error,\n\t) {\n\t\tsuper(\n\t\t\t400,\n\t\t\t`The body says it is '${contentType}' but can't be parsed as that. Send a well-formed body, with the Content-Type it is written in.`,\n\t\t\t{ cause },\n\t\t);\n\t\tthis.name = 'MalformedRequestBody';\n\t}\n}\n\n/**\n * What a body is read from: a `Request`, or Hono's request — which caches\n * what it read, so a later reader is not handed a spent stream.\n */\nexport interface RequestBodySource {\n\tjson(): Promise<unknown>;\n\ttext(): Promise<string>;\n\tformData(): Promise<FormData>;\n}\n\nexport interface ReadRequestBodyOptions {\n\t/**\n\t * A body with no Content-Type: read as JSON (`'json'`, what API Gateway\n\t * has always done), or not read at all and handed to the schema as `{}`\n\t * (`'empty'`, what a Hono server has always done).\n\t */\n\tuntyped: 'json' | 'empty';\n}\n\n/**\n * A request body, read by its Content-Type into what an endpoint's `.body()`\n * schema validates — the one place every adaptor reads a body:\n *\n * - `application/json` (and `application/*+json`) — the parsed JSON.\n * - `application/x-www-form-urlencoded` and `multipart/form-data` — a plain\n *   object of fields, as an HTML form posts them. A repeated field, or one\n *   named `field[]`, is an array; a file part is a `File`.\n * - `text/*` — the text.\n *\n * Anything else is an {@link UnsupportedRequestContentType}.\n */\nexport async function readRequestBody(\n\tsource: RequestBodySource,\n\tcontentType: string | null | undefined,\n\toptions: ReadRequestBodyOptions,\n): Promise<unknown> {\n\tconst mediaType = contentType?.split(';')[0]?.trim().toLowerCase();\n\n\tif (!mediaType) {\n\t\tif (options.untyped === 'empty') return {};\n\t\treturn readJson(source, 'application/json');\n\t}\n\n\tif (isJson(mediaType)) return readJson(source, mediaType);\n\n\tif (\n\t\tmediaType === 'application/x-www-form-urlencoded' ||\n\t\tmediaType === 'multipart/form-data'\n\t) {\n\t\treturn formFields(await readForm(source, mediaType));\n\t}\n\n\tif (mediaType.startsWith('text/')) return source.text();\n\n\tthrow new UnsupportedRequestContentType(mediaType);\n}\n\nfunction isJson(mediaType: string): boolean {\n\treturn (\n\t\tmediaType === 'application/json' ||\n\t\t(mediaType.startsWith('application/') && mediaType.endsWith('+json'))\n\t);\n}\n\nasync function readJson(\n\tsource: RequestBodySource,\n\tmediaType: string,\n): Promise<unknown> {\n\ttry {\n\t\treturn await source.json();\n\t} catch (error) {\n\t\tthrow new MalformedRequestBody(mediaType, error as Error);\n\t}\n}\n\nasync function readForm(\n\tsource: RequestBodySource,\n\tmediaType: string,\n): Promise<FormData> {\n\ttry {\n\t\treturn await source.formData();\n\t} catch (error) {\n\t\tthrow new MalformedRequestBody(mediaType, error as Error);\n\t}\n}\n\n/** A form field's value: its text, or a `File` for a file part. */\ntype FormValue = NonNullable<ReturnType<FormData['get']>>;\n\n/**\n * A form's fields as an object, the way Hono's `parseBody({ all: true })`\n * reads them. Without a prototype, so a field named `__proto__` is a field.\n */\nfunction formFields(form: FormData): Record<string, FormValue | FormValue[]> {\n\tconst fields: Record<string, FormValue | FormValue[]> = Object.create(null);\n\n\tfor (const [key, value] of form.entries()) {\n\t\tconst existing = fields[key];\n\t\tif (existing === undefined) {\n\t\t\tfields[key] = key.endsWith('[]') ? [value] : value;\n\t\t} else if (Array.isArray(existing)) {\n\t\t\texisting.push(value);\n\t\t} else {\n\t\t\tfields[key] = [existing, value];\n\t\t}\n\t}\n\n\treturn fields;\n}\n"],"mappings":";;;;;;;;AAgBA,SAAgB,kBAAkB,GAAsB;CACvD,IAAI,aAA4C;CAEhD,SAAS,QAAiB;EACzB,IAAI,QAAQ,KAAA,GAEX,OAAO,EAAE,IAAI,OAAO,GAAG;EAGxB,IAAI,CAAC,YACJ,aAAa,EAAE,IAAI,OAAO;EAE3B,OAAO;CACR;AACD;;;;;;AAOA,SAAgB,kBAAkB,GAAsB;CACvD,IAAI,aAA4C;CAEhD,SAAS,SAAkB;EAC1B,IAAI,SAAS,KAAA,GAEZ,QAAA,GAAOA,YAAAA,UAAAA,CAAU,GAAG,IAAI;EAGzB,IAAI,CAAC,YAAY;GAChB,aAAa,CAAC;GACd,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ;GAC1C,IAAI,cACH,KAAK,MAAM,QAAQ,aAAa,MAAM,GAAG,GAAG;IAC3C,MAAM,UAAU,KAAK,KAAK;IAC1B,MAAM,UAAU,QAAQ,QAAQ,GAAG;IACnC,IAAI,UAAU,GAAG;KAChB,MAAM,MAAM,QAAQ,MAAM,GAAG,OAAO;KACpC,MAAM,QAAQ,QAAQ,MAAM,UAAU,CAAC;KACvC,WAAW,OAAO;IACnB;GACD;EAEF;EACA,OAAO;CACR;AACD;;;;;AAMA,SAAgB,wBACf,SACW;CACX,IAAI,oBAAmD;CAEvD,MAAM,kBAAkB;EACvB,IAAI,CAAC,mBAAmB;GACvB,oBAAoB,CAAC;GACrB,IAAI,SACE;SAAA,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,GAC1C,IAAI,MAAM,KAAA,GACT,kBAAkB,EAAE,YAAY,KAAK;GAAA;EAIzC;EACA,OAAO;CACR;CAEA,SAAS,QAAiB;EACzB,IAAI,QAAQ,KAAA,GAAW;GAEtB,IAAI,SAAS;IACZ,MAAM,SAAS,QAAQ,QAAQ,QAAQ,IAAI,YAAY;IACvD,IAAI,WAAW,KAAA,GAAW,OAAO;IAEjC,OAAO,UAAU,CAAC,CAAC,IAAI,YAAY;GACpC;GACA;EACD;EACA,OAAO,UAAU;CAClB;AACD;;;;;AAMA,SAAgB,wBACf,SACA,cACW;CACX,IAAI,SAAwC;CAE5C,MAAM,cAAc;EACnB,IAAI,CAAC,QAAQ;GACZ,SAAS,CAAC;GAEV,IAAI,SACH,KAAK,MAAM,UAAU,SAAS;IAC7B,MAAM,UAAU,OAAO,QAAQ,GAAG;IAClC,IAAI,UAAU,GAAG;KAChB,MAAM,MAAM,OAAO,MAAM,GAAG,OAAO;KACnC,MAAM,QAAQ,OAAO,MAAM,UAAU,CAAC;KACtC,OAAO,OAAO,mBAAmB,KAAK;IACvC;GACD;QACM,IAAI,cAEV,KAAK,MAAM,QAAQ,aAAa,MAAM,GAAG,GAAG;IAC3C,MAAM,UAAU,KAAK,KAAK;IAC1B,MAAM,UAAU,QAAQ,QAAQ,GAAG;IACnC,IAAI,UAAU,GAAG;KAChB,MAAM,MAAM,QAAQ,MAAM,GAAG,OAAO;KACpC,MAAM,QAAQ,QAAQ,MAAM,UAAU,CAAC;KACvC,OAAO,OAAO,mBAAmB,KAAK;IACvC;GACD;EAEF;EACA,OAAO;CACR;CAEA,SAAS,SAAkB;EAC1B,IAAI,SAAS,KAAA,GACZ,OAAO,MAAM,CAAC,CAAC;EAEhB,OAAO,MAAM;CACd;AACD;;;;;AAMA,SAAgB,oBACf,SACW;CACX,IAAI,aAA4C;CAEhD,SAAS,QAAiB;EACzB,IAAI,QAAQ,KAAA,GAAW;GAEtB,IAAI,SAAS;IACZ,MAAM,SAAS,QAAQ,QAAQ,QAAQ,IAAI,YAAY;IACvD,IAAI,WAAW,KAAA,GAAW,OAAO;GAClC;GAEA,IAAI,CAAC,cAAc,SAAS;IAC3B,aAAa,CAAC;IACd,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,GAC1C,WAAW,EAAE,YAAY,KAAK;GAEhC;GACA,OAAO,aAAa,IAAI,YAAY;EACrC;EAEA,IAAI,CAAC,cAAc,SAAS;GAC3B,aAAa,CAAC;GACd,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,GAC1C,WAAW,EAAE,YAAY,KAAK;EAEhC;EACA,OAAO,cAAc,CAAC;CACvB;AACD;;;;;AAMA,SAAgB,2BACf,cACW;CACX,IAAI,SAAwC;CAE5C,MAAM,cAAc;EACnB,IAAI,CAAC,QAAQ;GACZ,SAAS,CAAC;GACV,IAAI,cACH,KAAK,MAAM,QAAQ,aAAa,MAAM,GAAG,GAAG;IAC3C,MAAM,UAAU,KAAK,KAAK;IAC1B,MAAM,UAAU,QAAQ,QAAQ,GAAG;IACnC,IAAI,UAAU,GAAG;KAChB,MAAM,MAAM,QAAQ,MAAM,GAAG,OAAO;KACpC,MAAM,QAAQ,QAAQ,MAAM,UAAU,CAAC;KAEvC,OAAO,OAAO,mBAAmB,KAAK;IACvC;GACD;EAEF;EACA,OAAO;CACR;CAEA,SAAS,SAAkB;EAC1B,IAAI,SAAS,KAAA,GACZ,OAAO,MAAM,CAAC,CAAC;EAEhB,OAAO,MAAM;CACd;AACD;;;;AAKA,SAAgB,oBAA8B;CAC7C,SAAS,QAAiB;EACzB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;EAC9B,OAAO,CAAC;CACT;AACD;;;;AAKA,SAAgB,oBAA8B;CAC7C,SAAS,SAAkB;EAC1B,IAAI,SAAS,KAAA,GAAW,OAAO,KAAA;EAC/B,OAAO,CAAC;CACT;AACD;;;;;;;AC1OA,MAAa,uBAAuB;CACnC;CACA;CACA;CACA;AACD;;;;;AAMA,IAAa,gCAAb,cAAmDC,kBAAAA,UAAU;CACvC;CAArB,YAAY,aAA8B;EACzC,MACC,KACA,mBAAmB,YAAY,8BAA8B,qBAAqB,KAAK,IAAI,EAAE,IAC7F;GACC,eAAe;GACf,SAAS;IAAE;IAAa,WAAW,CAAC,GAAG,oBAAoB;GAAE;EAC9D,CACD;EARoB,KAAA,cAAA;EASpB,KAAK,OAAO;CACb;AACD;;;;;AAMA,IAAa,uBAAb,cAA0CA,kBAAAA,UAAU;CAEzC;CADV,YACC,aACA,OACC;EACD,MACC,KACA,wBAAwB,YAAY,kGACpC,EAAE,MAAM,CACT;EAPS,KAAA,cAAA;EAQT,KAAK,OAAO;CACb;AACD;;;;;;;;;;;;;AAiCA,eAAsB,gBACrB,QACA,aACA,SACmB;CACnB,MAAM,YAAY,aAAa,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY;CAEjE,IAAI,CAAC,WAAW;EACf,IAAI,QAAQ,YAAY,SAAS,OAAO,CAAC;EACzC,OAAO,SAAS,QAAQ,kBAAkB;CAC3C;CAEA,IAAI,OAAO,SAAS,GAAG,OAAO,SAAS,QAAQ,SAAS;CAExD,IACC,cAAc,uCACd,cAAc,uBAEd,OAAO,WAAW,MAAM,SAAS,QAAQ,SAAS,CAAC;CAGpD,IAAI,UAAU,WAAW,OAAO,GAAG,OAAO,OAAO,KAAK;CAEtD,MAAM,IAAI,8BAA8B,SAAS;AAClD;AAEA,SAAS,OAAO,WAA4B;CAC3C,OACC,cAAc,sBACb,UAAU,WAAW,cAAc,KAAK,UAAU,SAAS,OAAO;AAErE;AAEA,eAAe,SACd,QACA,WACmB;CACnB,IAAI;EACH,OAAO,MAAM,OAAO,KAAK;CAC1B,SAAS,OAAO;EACf,MAAM,IAAI,qBAAqB,WAAW,KAAc;CACzD;AACD;AAEA,eAAe,SACd,QACA,WACoB;CACpB,IAAI;EACH,OAAO,MAAM,OAAO,SAAS;CAC9B,SAAS,OAAO;EACf,MAAM,IAAI,qBAAqB,WAAW,KAAc;CACzD;AACD;;;;;AASA,SAAS,WAAW,MAAyD;CAC5E,MAAM,SAAkD,OAAO,OAAO,IAAI;CAE1E,KAAK,MAAM,CAAC,KAAK,UAAU,KAAK,QAAQ,GAAG;EAC1C,MAAM,WAAW,OAAO;EACxB,IAAI,aAAa,KAAA,GAChB,OAAO,OAAO,IAAI,SAAS,IAAI,IAAI,CAAC,KAAK,IAAI;OACvC,IAAI,MAAM,QAAQ,QAAQ,GAChC,SAAS,KAAK,KAAK;OAEnB,OAAO,OAAO,CAAC,UAAU,KAAK;CAEhC;CAEA,OAAO;AACR"}

package/dist/requestLogger-BZcXwdBs.cjs

@@ -0,0 +1,207 @@
+//#region src/endpoints/optionalPeers.ts
+/**
+* The optional peers an endpoint needs only for a feature it opted into.
+*
+* `@geekmidas/audit`, `@geekmidas/rate-limit` and `@geekmidas/db` are optional
+* peers of this package: an app that audits nothing, limits nothing and sets
+* no row-level security need not install them. The adaptor every endpoint is
+* served by used to import them at the top, so serving any endpoint needed
+* them all — and a production bundle of an app without them failed to build.
+* They are loaded here, when an endpoint that uses one is served, which is
+* also when the app declaring that endpoint has installed it: an auditor's
+* storage, a rate limit's store and an RLS policy's database come from these
+* packages.
+*
+* The `try` is load-bearing beyond the error it names: a bundler leaves an
+* import it cannot resolve to run time when the import is guarded, and fails
+* the build when it is not.
+*/
+/** An endpoint uses a feature whose optional peer is not installed. */
+var OptionalPeerMissing = class extends Error {
+	packageName;
+	feature;
+	constructor(packageName, feature, cause) {
+		super(`${feature} needs '${packageName}', which could not be loaded. Add it to the dependencies of the app that serves this endpoint.`, { cause });
+		this.packageName = packageName;
+		this.feature = feature;
+		this.name = "OptionalPeerMissing";
+	}
+};
+/** `@geekmidas/audit`, for an endpoint with an auditor. */
+async function loadAudit() {
+	try {
+		return await import("@geekmidas/audit");
+	} catch (cause) {
+		throw new OptionalPeerMissing("@geekmidas/audit", "An endpoint with an auditor", cause);
+	}
+}
+/** `@geekmidas/rate-limit`, for an endpoint with a rate limit. */
+async function loadRateLimit() {
+	try {
+		return await import("@geekmidas/rate-limit");
+	} catch (cause) {
+		throw new OptionalPeerMissing("@geekmidas/rate-limit", "An endpoint with a rate limit", cause);
+	}
+}
+/** `@geekmidas/db/rls`, for an endpoint with row-level security. */
+async function loadRls() {
+	try {
+		return await import("@geekmidas/db/rls");
+	} catch (cause) {
+		throw new OptionalPeerMissing("@geekmidas/db", "An endpoint with row-level security", cause);
+	}
+}
+//#endregion
+//#region src/endpoints/processAudits.ts
+/**
+* Create audit context for handler execution.
+* Returns the auditor and storage for use in the handler.
+*
+* @param endpoint - The endpoint with audit configuration
+* @param serviceDiscovery - Service discovery for getting audit storage
+* @param logger - Logger for debug/error messages
+* @param ctx - Request context for actor extraction
+* @returns Audit context with auditor and storage, or undefined if not configured
+*/
+async function createAuditContext(endpoint, serviceDiscovery, logger, ctx) {
+	if (!endpoint.auditorStorageService) return;
+	const storage = (await serviceDiscovery.register([endpoint.auditorStorageService]))[endpoint.auditorStorageService.serviceName];
+	let actor = {
+		id: "system",
+		type: "system"
+	};
+	if (endpoint.actorExtractor) try {
+		actor = await endpoint.actorExtractor({
+			services: ctx.services,
+			session: ctx.session,
+			header: ctx.header,
+			cookie: ctx.cookie,
+			logger
+		});
+	} catch (error) {
+		logger.error(error, "Failed to extract actor for audits");
+	}
+	const { DefaultAuditor } = await loadAudit();
+	return {
+		auditor: new DefaultAuditor({
+			actor,
+			storage,
+			metadata: {
+				endpoint: endpoint.route,
+				method: endpoint.method
+			}
+		}),
+		storage
+	};
+}
+/**
+* Execute a handler with automatic audit transaction support.
+* If the audit storage provides a withTransaction method, wraps execution
+* in a transaction so audits are atomic with handler's database operations.
+*
+* This is database-agnostic - each storage implementation provides its own
+* transaction handling based on the underlying database (Kysely, Drizzle, etc.).
+*
+* If the db parameter is provided and is already a transaction, the storage
+* will reuse it instead of creating a nested transaction (similar to
+* packages/db/src/kysely.ts#withTransaction).
+*
+* @param auditContext - The audit context from createAuditContext
+* @param handler - The handler function to execute (receives auditor)
+* @param onComplete - Called after handler with response, to process declarative audits
+* @param options - Optional configuration including database connection
+* @returns The handler result
+*/
+async function executeWithAuditTransaction(auditContext, handler, onComplete, options) {
+	if (!auditContext) return handler(void 0);
+	const { auditor, storage } = auditContext;
+	if (storage.withTransaction) return storage.withTransaction(auditor, async () => {
+		const response = await handler(auditor);
+		if (onComplete) await onComplete(response, auditor);
+		return response;
+	}, options?.db);
+	const response = await handler(auditor);
+	if (onComplete) await onComplete(response, auditor);
+	await auditor.flush();
+	return response;
+}
+//#endregion
+//#region src/endpoints/rateLimit.ts
+/**
+* An endpoint's `.rateLimit()`, checked the one way every adaptor checks it —
+* Hono, Lambda and the test adaptor — after the request is authorized.
+*
+* Under the limit, it answers the headers the response carries:
+* `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` (and
+* `Retry-After` on the last request the window allows).
+*
+* @throws {TooManyRequestsError} over the limit — `@geekmidas/errors`' 429,
+* whose `headers` hold `Retry-After` (seconds until the window resets) and the
+* same `X-RateLimit-*`, which every adaptor sets on the error response.
+*/
+async function enforceRateLimit(config, ctx) {
+	const { checkRateLimit, getRateLimitHeaders } = await loadRateLimit();
+	const info = await checkRateLimit(config, ctx);
+	const headers = {};
+	for (const [key, value] of Object.entries(getRateLimitHeaders(info, config))) if (value !== void 0) headers[key] = value;
+	return headers;
+}
+//#endregion
+//#region src/endpoints/requestLogger.ts
+/**
+* The logger for one request to `endpoint`: the surface's, bound with which
+* request it is and what it was for — the request id, the endpoint, its route
+* and method — plus whatever the adaptor knows of the request itself (host,
+* path, the Lambda and API Gateway context).
+*
+* One per request, made once, and the one the request context carries: the
+* handler logs through it, a service reaches it through the context, and
+* identifying the request (`identifyRequest`) derives the signed-in user's
+* logger from it — so a line says whose request it was without losing which
+* route it came from. A field the request does not have is left out rather
+* than logged as `undefined`.
+*/
+function requestLogger(endpoint, fields) {
+	const { requestId, ...request } = fields;
+	const bindings = {
+		requestId,
+		endpoint: endpoint.fullPath,
+		route: endpoint.route,
+		method: endpoint.method
+	};
+	for (const [key, value] of Object.entries(request)) if (value !== void 0) bindings[key] = value;
+	return endpoint.logger.child(bindings);
+}
+//#endregion
+Object.defineProperty(exports, "createAuditContext", {
+	enumerable: true,
+	get: function() {
+		return createAuditContext;
+	}
+});
+Object.defineProperty(exports, "enforceRateLimit", {
+	enumerable: true,
+	get: function() {
+		return enforceRateLimit;
+	}
+});
+Object.defineProperty(exports, "executeWithAuditTransaction", {
+	enumerable: true,
+	get: function() {
+		return executeWithAuditTransaction;
+	}
+});
+Object.defineProperty(exports, "loadRls", {
+	enumerable: true,
+	get: function() {
+		return loadRls;
+	}
+});
+Object.defineProperty(exports, "requestLogger", {
+	enumerable: true,
+	get: function() {
+		return requestLogger;
+	}
+});
+
+//# sourceMappingURL=requestLogger-BZcXwdBs.cjs.map

package/dist/requestLogger-BZcXwdBs.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestLogger-BZcXwdBs.cjs","names":[],"sources":["../src/endpoints/optionalPeers.ts","../src/endpoints/processAudits.ts","../src/endpoints/rateLimit.ts","../src/endpoints/requestLogger.ts"],"sourcesContent":["/**\n * The optional peers an endpoint needs only for a feature it opted into.\n *\n * `@geekmidas/audit`, `@geekmidas/rate-limit` and `@geekmidas/db` are optional\n * peers of this package: an app that audits nothing, limits nothing and sets\n * no row-level security need not install them. The adaptor every endpoint is\n * served by used to import them at the top, so serving any endpoint needed\n * them all — and a production bundle of an app without them failed to build.\n * They are loaded here, when an endpoint that uses one is served, which is\n * also when the app declaring that endpoint has installed it: an auditor's\n * storage, a rate limit's store and an RLS policy's database come from these\n * packages.\n *\n * The `try` is load-bearing beyond the error it names: a bundler leaves an\n * import it cannot resolve to run time when the import is guarded, and fails\n * the build when it is not.\n */\n\n/** An endpoint uses a feature whose optional peer is not installed. */\nexport class OptionalPeerMissing extends Error {\n\tconstructor(\n\t\treadonly packageName: string,\n\t\treadonly feature: string,\n\t\tcause: unknown,\n\t) {\n\t\tsuper(\n\t\t\t`${feature} needs '${packageName}', which could not be loaded. ` +\n\t\t\t\t`Add it to the dependencies of the app that serves this endpoint.`,\n\t\t\t{ cause },\n\t\t);\n\t\tthis.name = 'OptionalPeerMissing';\n\t}\n}\n\n/** `@geekmidas/audit`, for an endpoint with an auditor. */\nexport async function loadAudit(): Promise<typeof import('@geekmidas/audit')> {\n\ttry {\n\t\treturn await import('@geekmidas/audit');\n\t} catch (cause) {\n\t\tthrow new OptionalPeerMissing(\n\t\t\t'@geekmidas/audit',\n\t\t\t'An endpoint with an auditor',\n\t\t\tcause,\n\t\t);\n\t}\n}\n\n/** `@geekmidas/rate-limit`, for an endpoint with a rate limit. */\nexport async function loadRateLimit(): Promise<\n\ttypeof import('@geekmidas/rate-limit')\n> {\n\ttry {\n\t\treturn await import('@geekmidas/rate-limit');\n\t} catch (cause) {\n\t\tthrow new OptionalPeerMissing(\n\t\t\t'@geekmidas/rate-limit',\n\t\t\t'An endpoint with a rate limit',\n\t\t\tcause,\n\t\t);\n\t}\n}\n\n/** `@geekmidas/db/rls`, for an endpoint with row-level security. */\nexport async function loadRls(): Promise<typeof import('@geekmidas/db/rls')> {\n\ttry {\n\t\treturn await import('@geekmidas/db/rls');\n\t} catch (cause) {\n\t\tthrow new OptionalPeerMissing(\n\t\t\t'@geekmidas/db',\n\t\t\t'An endpoint with row-level security',\n\t\t\tcause,\n\t\t);\n\t}\n}\n","import type {\n\tAuditActor,\n\tAuditableAction,\n\tAuditor,\n\tAuditStorage,\n} from '@geekmidas/audit';\nimport type { Logger } from '@geekmidas/logger';\nimport type { InferStandardSchema } from '@geekmidas/schema';\nimport type { Service, ServiceDiscovery } from '@geekmidas/services';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport type { ActorExtractor, MappedAudit } from './audit';\nimport type { CookieFn, Endpoint, HeaderFn } from './Endpoint';\nimport { loadAudit } from './optionalPeers';\n\n/**\n * Process declarative audit definitions after successful endpoint execution.\n * Similar to publishConstructEvents for events.\n *\n * @param endpoint - The endpoint with audit configuration\n * @param response - The handler response to generate audit payloads from\n * @param serviceDiscovery - Service discovery for registering audit storage\n * @param logger - Logger for debug/error messages\n * @param ctx - Request context (session, headers, cookies, services)\n * @param existingAuditor - Optional existing auditor instance (e.g., from handler context).\n *                          If provided, uses this auditor (with its stored transaction).\n *                          If not provided, creates a new auditor.\n */\nexport async function processEndpointAudits<\n\tTServices extends Service[] = [],\n\tTSession = unknown,\n\tTLogger extends Logger = Logger,\n\tOutSchema extends StandardSchemaV1 | undefined = undefined,\n\tTAuditStorage extends AuditStorage | undefined = undefined,\n\tTAuditStorageServiceName extends string = string,\n\tTAuditAction extends AuditableAction<string, unknown> = AuditableAction<\n\t\tstring,\n\t\tunknown\n\t>,\n>(\n\tendpoint: Endpoint<\n\t\tany,\n\t\tany,\n\t\tany,\n\t\tOutSchema,\n\t\tTServices,\n\t\tTLogger,\n\t\tTSession,\n\t\tTAuditStorage,\n\t\tTAuditStorageServiceName,\n\t\tTAuditAction\n\t>,\n\tresponse: InferStandardSchema<OutSchema>,\n\tserviceDiscovery: ServiceDiscovery<any>,\n\tlogger: TLogger,\n\tctx: {\n\t\tsession: TSession;\n\t\theader: HeaderFn;\n\t\tcookie: CookieFn;\n\t\tservices: Record<string, unknown>;\n\t},\n\texistingAuditor?: Auditor<TAuditAction>,\n): Promise<void> {\n\ttry {\n\t\tconst audits = endpoint.audits as MappedAudit<TAuditAction, OutSchema>[];\n\n\t\t// If we have an existing auditor (from handler context), we need to flush\n\t\t// any manual audits it collected, even if there are no declarative audits\n\t\tconst hasExistingRecords =\n\t\t\texistingAuditor && existingAuditor.getRecords().length > 0;\n\n\t\t// Skip if no declarative audits and no existing records to flush\n\t\tif (!audits?.length && !hasExistingRecords) {\n\t\t\tlogger.debug('No audits to process');\n\t\t\treturn;\n\t\t}\n\n\t\t// If no auditor storage service and we have things to process, warn\n\t\tif (!endpoint.auditorStorageService) {\n\t\t\tif (hasExistingRecords || audits?.length) {\n\t\t\t\tlogger.warn('No auditor storage service available');\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\n\t\t// Get or create auditor\n\t\tlet auditor: Auditor<TAuditAction>;\n\n\t\tif (existingAuditor) {\n\t\t\t// Use existing auditor (preserves stored transaction and manual audits)\n\t\t\tauditor = existingAuditor;\n\t\t\tlogger.debug('Using existing auditor from handler context');\n\t\t} else {\n\t\t\t// Create new auditor (backward compatibility)\n\t\t\tconst services = await serviceDiscovery.register([\n\t\t\t\tendpoint.auditorStorageService,\n\t\t\t]);\n\t\t\tconst storage = services[\n\t\t\t\tendpoint.auditorStorageService.serviceName\n\t\t\t] as AuditStorage;\n\n\t\t\t// Extract actor if configured\n\t\t\tlet actor: AuditActor = { id: 'system', type: 'system' };\n\t\t\tif (endpoint.actorExtractor) {\n\t\t\t\ttry {\n\t\t\t\t\tactor = await (\n\t\t\t\t\t\tendpoint.actorExtractor as ActorExtractor<\n\t\t\t\t\t\t\tTServices,\n\t\t\t\t\t\t\tTSession,\n\t\t\t\t\t\t\tTLogger\n\t\t\t\t\t\t>\n\t\t\t\t\t)({\n\t\t\t\t\t\tservices: ctx.services as any,\n\t\t\t\t\t\tsession: ctx.session,\n\t\t\t\t\t\theader: ctx.header,\n\t\t\t\t\t\tcookie: ctx.cookie,\n\t\t\t\t\t\tlogger,\n\t\t\t\t\t});\n\t\t\t\t} catch (error) {\n\t\t\t\t\tlogger.error(error as Error, 'Failed to extract actor for audits');\n\t\t\t\t\t// Continue with system actor\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst { DefaultAuditor } = await loadAudit();\n\t\t\tauditor = new DefaultAuditor<TAuditAction>({\n\t\t\t\tactor,\n\t\t\t\tstorage,\n\t\t\t\tmetadata: {\n\t\t\t\t\tendpoint: endpoint.route,\n\t\t\t\t\tmethod: endpoint.method,\n\t\t\t\t},\n\t\t\t});\n\t\t}\n\n\t\t// Process each declarative audit\n\t\tif (audits?.length) {\n\t\t\tfor (const audit of audits) {\n\t\t\t\tlogger.debug({ audit: audit.type }, 'Processing declarative audit');\n\n\t\t\t\t// Check when condition\n\t\t\t\tif (audit.when && !audit.when(response as any)) {\n\t\t\t\t\tlogger.debug(\n\t\t\t\t\t\t{ audit: audit.type },\n\t\t\t\t\t\t'Audit skipped due to when condition',\n\t\t\t\t\t);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\t// Extract payload\n\t\t\t\tconst payload = audit.payload(response as any);\n\n\t\t\t\t// Extract entityId if configured\n\t\t\t\tconst entityId = audit.entityId?.(response as any);\n\n\t\t\t\t// Record the audit\n\t\t\t\tauditor.audit(audit.type as any, payload as any, {\n\t\t\t\t\ttable: audit.table,\n\t\t\t\t\tentityId,\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\t// Flush audits to storage\n\t\t// Note: If existingAuditor has a stored transaction (via setTransaction),\n\t\t// flush() will use it automatically\n\t\tconst recordCount = auditor.getRecords().length;\n\t\tif (recordCount > 0) {\n\t\t\t// Check if auditor has a stored transaction (for logging purposes)\n\t\t\tconst trx =\n\t\t\t\t'getTransaction' in auditor\n\t\t\t\t\t? (auditor as { getTransaction(): unknown }).getTransaction()\n\t\t\t\t\t: undefined;\n\t\t\tlogger.debug(\n\t\t\t\t{ auditCount: recordCount, hasTransaction: !!trx },\n\t\t\t\t'Flushing audits',\n\t\t\t);\n\t\t\tawait auditor.flush();\n\t\t}\n\t} catch (error) {\n\t\tlogger.error(error as Error, 'Failed to process audits');\n\t\t// Don't rethrow - audit failures shouldn't fail the request\n\t}\n}\n\n/**\n * Context for audit-aware handler execution.\n */\nexport interface AuditExecutionContext<\n\tTAuditAction extends AuditableAction<string, unknown> = AuditableAction<\n\t\tstring,\n\t\tunknown\n\t>,\n> {\n\t/** The auditor instance for recording audits */\n\tauditor: Auditor<TAuditAction>;\n\t/** The audit storage instance */\n\tstorage: AuditStorage;\n}\n\n/**\n * Create audit context for handler execution.\n * Returns the auditor and storage for use in the handler.\n *\n * @param endpoint - The endpoint with audit configuration\n * @param serviceDiscovery - Service discovery for getting audit storage\n * @param logger - Logger for debug/error messages\n * @param ctx - Request context for actor extraction\n * @returns Audit context with auditor and storage, or undefined if not configured\n */\nexport async function createAuditContext<\n\tTServices extends Service[] = [],\n\tTSession = unknown,\n\tTLogger extends Logger = Logger,\n\tTAuditStorage extends AuditStorage | undefined = undefined,\n\tTAuditStorageServiceName extends string = string,\n\tTAuditAction extends AuditableAction<string, unknown> = AuditableAction<\n\t\tstring,\n\t\tunknown\n\t>,\n\tTDatabase = undefined,\n\tTDatabaseServiceName extends string = string,\n>(\n\tendpoint: Endpoint<\n\t\tany,\n\t\tany,\n\t\tany,\n\t\tany,\n\t\tTServices,\n\t\tTLogger,\n\t\tTSession,\n\t\tTAuditStorage,\n\t\tTAuditStorageServiceName,\n\t\tTAuditAction,\n\t\tTDatabase,\n\t\tTDatabaseServiceName\n\t>,\n\tserviceDiscovery: ServiceDiscovery<any>,\n\tlogger: TLogger,\n\tctx: {\n\t\tsession: TSession;\n\t\theader: HeaderFn;\n\t\tcookie: CookieFn;\n\t\tservices: Record<string, unknown>;\n\t},\n): Promise<AuditExecutionContext<TAuditAction> | undefined> {\n\tif (!endpoint.auditorStorageService) {\n\t\treturn undefined;\n\t}\n\n\tconst services = await serviceDiscovery.register([\n\t\tendpoint.auditorStorageService,\n\t]);\n\tconst storage = services[\n\t\tendpoint.auditorStorageService.serviceName\n\t] as AuditStorage;\n\n\t// Extract actor if configured\n\tlet actor: AuditActor = { id: 'system', type: 'system' };\n\tif (endpoint.actorExtractor) {\n\t\ttry {\n\t\t\tactor = await (\n\t\t\t\tendpoint.actorExtractor as ActorExtractor<TServices, TSession, TLogger>\n\t\t\t)({\n\t\t\t\tservices: ctx.services as any,\n\t\t\t\tsession: ctx.session,\n\t\t\t\theader: ctx.header,\n\t\t\t\tcookie: ctx.cookie,\n\t\t\t\tlogger,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tlogger.error(error as Error, 'Failed to extract actor for audits');\n\t\t}\n\t}\n\n\tconst { DefaultAuditor } = await loadAudit();\n\tconst auditor = new DefaultAuditor<TAuditAction>({\n\t\tactor,\n\t\tstorage,\n\t\tmetadata: {\n\t\t\tendpoint: endpoint.route,\n\t\t\tmethod: endpoint.method,\n\t\t},\n\t});\n\n\treturn { auditor, storage };\n}\n\n/**\n * Options for executeWithAuditTransaction.\n */\nexport interface ExecuteWithAuditTransactionOptions {\n\t/**\n\t * Database connection to use for the transaction.\n\t * If this is already a transaction, it will be reused instead of creating a nested one.\n\t * If not provided, the storage's internal database is used.\n\t */\n\tdb?: unknown;\n}\n\n/**\n * Execute a handler with automatic audit transaction support.\n * If the audit storage provides a withTransaction method, wraps execution\n * in a transaction so audits are atomic with handler's database operations.\n *\n * This is database-agnostic - each storage implementation provides its own\n * transaction handling based on the underlying database (Kysely, Drizzle, etc.).\n *\n * If the db parameter is provided and is already a transaction, the storage\n * will reuse it instead of creating a nested transaction (similar to\n * packages/db/src/kysely.ts#withTransaction).\n *\n * @param auditContext - The audit context from createAuditContext\n * @param handler - The handler function to execute (receives auditor)\n * @param onComplete - Called after handler with response, to process declarative audits\n * @param options - Optional configuration including database connection\n * @returns The handler result\n */\nexport async function executeWithAuditTransaction<\n\tT,\n\tTAuditAction extends AuditableAction<string, unknown> = AuditableAction<\n\t\tstring,\n\t\tunknown\n\t>,\n>(\n\tauditContext: AuditExecutionContext<TAuditAction> | undefined,\n\thandler: (auditor?: Auditor<TAuditAction>) => Promise<T>,\n\tonComplete?: (response: T, auditor: Auditor<TAuditAction>) => Promise<void>,\n\toptions?: ExecuteWithAuditTransactionOptions,\n): Promise<T> {\n\t// No audit context - just run handler\n\tif (!auditContext) {\n\t\treturn handler(undefined);\n\t}\n\n\tconst { auditor, storage } = auditContext;\n\n\t// Check if storage provides a transaction wrapper\n\tif (storage.withTransaction) {\n\t\t// Wrap in transaction - audits are atomic with handler operations\n\t\t// The storage's withTransaction handles setTransaction and flush\n\t\t// Pass db so existing transactions are reused\n\t\treturn storage.withTransaction(\n\t\t\tauditor,\n\t\t\tasync () => {\n\t\t\t\tconst response = await handler(auditor);\n\n\t\t\t\t// Process declarative audits within the transaction\n\t\t\t\tif (onComplete) {\n\t\t\t\t\tawait onComplete(response, auditor);\n\t\t\t\t}\n\n\t\t\t\treturn response;\n\t\t\t},\n\t\t\toptions?.db,\n\t\t);\n\t}\n\n\t// No transaction support - run handler and flush audits after\n\tconst response = await handler(auditor);\n\n\tif (onComplete) {\n\t\tawait onComplete(response, auditor);\n\t}\n\n\t// Flush audits (no transaction)\n\tawait auditor.flush();\n\n\treturn response;\n}\n","import type { RateLimitConfig, RateLimitContext } from '@geekmidas/rate-limit';\nimport { loadRateLimit } from './optionalPeers';\n\n/**\n * An endpoint's `.rateLimit()`, checked the one way every adaptor checks it —\n * Hono, Lambda and the test adaptor — after the request is authorized.\n *\n * Under the limit, it answers the headers the response carries:\n * `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` (and\n * `Retry-After` on the last request the window allows).\n *\n * @throws {TooManyRequestsError} over the limit — `@geekmidas/errors`' 429,\n * whose `headers` hold `Retry-After` (seconds until the window resets) and the\n * same `X-RateLimit-*`, which every adaptor sets on the error response.\n */\nexport async function enforceRateLimit(\n\tconfig: RateLimitConfig,\n\tctx: RateLimitContext<any, any, any>,\n): Promise<Record<string, string>> {\n\tconst { checkRateLimit, getRateLimitHeaders } = await loadRateLimit();\n\tconst info = await checkRateLimit(config, ctx);\n\n\tconst headers: Record<string, string> = {};\n\tfor (const [key, value] of Object.entries(\n\t\tgetRateLimitHeaders(info, config),\n\t)) {\n\t\tif (value !== undefined) headers[key] = value;\n\t}\n\treturn headers;\n}\n","import type { Logger } from '@geekmidas/logger';\n\n/** What an endpoint contributes to every line logged for one of its requests. */\ninterface LoggingEndpoint {\n\tlogger: Logger;\n\tfullPath: string;\n\troute: string;\n\tmethod: string;\n}\n\n/**\n * The logger for one request to `endpoint`: the surface's, bound with which\n * request it is and what it was for — the request id, the endpoint, its route\n * and method — plus whatever the adaptor knows of the request itself (host,\n * path, the Lambda and API Gateway context).\n *\n * One per request, made once, and the one the request context carries: the\n * handler logs through it, a service reaches it through the context, and\n * identifying the request (`identifyRequest`) derives the signed-in user's\n * logger from it — so a line says whose request it was without losing which\n * route it came from. A field the request does not have is left out rather\n * than logged as `undefined`.\n */\nexport function requestLogger<TLogger extends Logger>(\n\tendpoint: LoggingEndpoint,\n\tfields: { requestId: string } & Record<string, unknown>,\n): TLogger {\n\tconst { requestId, ...request } = fields;\n\tconst bindings: Record<string, unknown> = {\n\t\trequestId,\n\t\tendpoint: endpoint.fullPath,\n\t\troute: endpoint.route,\n\t\tmethod: endpoint.method,\n\t};\n\tfor (const [key, value] of Object.entries(request)) {\n\t\tif (value !== undefined) bindings[key] = value;\n\t}\n\treturn endpoint.logger.child(bindings) as TLogger;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAmBA,IAAa,sBAAb,cAAyC,MAAM;CAEpC;CACA;CAFV,YACC,aACA,SACA,OACC;EACD,MACC,GAAG,QAAQ,UAAU,YAAY,iGAEjC,EAAE,MAAM,CACT;EARS,KAAA,cAAA;EACA,KAAA,UAAA;EAQT,KAAK,OAAO;CACb;AACD;;AAGA,eAAsB,YAAwD;CAC7E,IAAI;EACH,OAAO,MAAM,OAAO;CACrB,SAAS,OAAO;EACf,MAAM,IAAI,oBACT,oBACA,+BACA,KACD;CACD;AACD;;AAGA,eAAsB,gBAEpB;CACD,IAAI;EACH,OAAO,MAAM,OAAO;CACrB,SAAS,OAAO;EACf,MAAM,IAAI,oBACT,yBACA,iCACA,KACD;CACD;AACD;;AAGA,eAAsB,UAAuD;CAC5E,IAAI;EACH,OAAO,MAAM,OAAO;CACrB,SAAS,OAAO;EACf,MAAM,IAAI,oBACT,iBACA,uCACA,KACD;CACD;AACD;;;;;;;;;;;;;ACwIA,eAAsB,mBAarB,UAcA,kBACA,QACA,KAM2D;CAC3D,IAAI,CAAC,SAAS,uBACb;CAMD,MAAM,WAAU,MAHO,iBAAiB,SAAS,CAChD,SAAS,qBACV,CAAC,EAAA,CAEA,SAAS,sBAAsB;CAIhC,IAAI,QAAoB;EAAE,IAAI;EAAU,MAAM;CAAS;CACvD,IAAI,SAAS,gBACZ,IAAI;EACH,QAAQ,MACP,SAAS,eACR;GACD,UAAU,IAAI;GACd,SAAS,IAAI;GACb,QAAQ,IAAI;GACZ,QAAQ,IAAI;GACZ;EACD,CAAC;CACF,SAAS,OAAO;EACf,OAAO,MAAM,OAAgB,oCAAoC;CAClE;CAGD,MAAM,EAAE,mBAAmB,MAAM,UAAU;CAU3C,OAAO;EAAE,SAAA,IATW,eAA6B;GAChD;GACA;GACA,UAAU;IACT,UAAU,SAAS;IACnB,QAAQ,SAAS;GAClB;EACD,CAEe;EAAG;CAAQ;AAC3B;;;;;;;;;;;;;;;;;;;AAgCA,eAAsB,4BAOrB,cACA,SACA,YACA,SACa;CAEb,IAAI,CAAC,cACJ,OAAO,QAAQ,KAAA,CAAS;CAGzB,MAAM,EAAE,SAAS,YAAY;CAG7B,IAAI,QAAQ,iBAIX,OAAO,QAAQ,gBACd,SACA,YAAY;EACX,MAAM,WAAW,MAAM,QAAQ,OAAO;EAGtC,IAAI,YACH,MAAM,WAAW,UAAU,OAAO;EAGnC,OAAO;CACR,GACA,SAAS,EACV;CAID,MAAM,WAAW,MAAM,QAAQ,OAAO;CAEtC,IAAI,YACH,MAAM,WAAW,UAAU,OAAO;CAInC,MAAM,QAAQ,MAAM;CAEpB,OAAO;AACR;;;;;;;;;;;;;;;ACjWA,eAAsB,iBACrB,QACA,KACkC;CAClC,MAAM,EAAE,gBAAgB,wBAAwB,MAAM,cAAc;CACpE,MAAM,OAAO,MAAM,eAAe,QAAQ,GAAG;CAE7C,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QACjC,oBAAoB,MAAM,MAAM,CACjC,GACC,IAAI,UAAU,KAAA,GAAW,QAAQ,OAAO;CAEzC,OAAO;AACR;;;;;;;;;;;;;;;;ACNA,SAAgB,cACf,UACA,QACU;CACV,MAAM,EAAE,WAAW,GAAG,YAAY;CAClC,MAAM,WAAoC;EACzC;EACA,UAAU,SAAS;EACnB,OAAO,SAAS;EAChB,QAAQ,SAAS;CAClB;CACA,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAChD,IAAI,UAAU,KAAA,GAAW,SAAS,OAAO;CAE1C,OAAO,SAAS,OAAO,MAAM,QAAQ;AACtC"}