@geekmidas/constructs 10.0.0-alpha.12 → 10.0.0-alpha.120

package/dist/{Endpoint-DCQPMdUX.mjs → Endpoint-gPXhHKhJ.mjs}

@@ -1,10 +1,10 @@
-import { ConstructType, __commonJS, __toESM } from "./Construct-BD5neF7w.mjs";
-import { Function as Function$1 } from "./functions-14lpEFL4.mjs";
+import { a as __commonJSMin, o as __toESM } from "./Construct-CKUA-CTA.mjs";
+import { t as identifyUser } from "./tracing-Bbj1uoFJ.mjs";
+import { n as Function$1 } from "./functions-CTI-hDem.mjs";
 import { convertSchemaWithComponents, convertStandardSchemaToJsonSchema } from "@geekmidas/schema/conversion";
 import { buildOpenApiSchema } from "@geekmidas/schema/openapi";
-
 //#region ../../node_modules/.pnpm/lodash.pick@4.4.0/node_modules/lodash.pick/index.js
-var require_lodash$1 = __commonJS({ "../../node_modules/.pnpm/lodash.pick@4.4.0/node_modules/lodash.pick/index.js"(exports, module) {
+var require_lodash_pick = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	/**
 	* lodash (Custom Build) <https://lodash.com/>
 	* Build: `lodash modularize exports="npm" -o ./`
@@ -14,15 +14,18 @@ var require_lodash$1 = __commonJS({ "../../node_modules/.pnpm/lodash.pick@4.4.0/
 	* Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors
 	*/
 	/** Used as references for various `Number` constants. */
-	var INFINITY$1 = Infinity, MAX_SAFE_INTEGER$1 = 9007199254740991;
+	var MAX_SAFE_INTEGER = 9007199254740991;
 	/** `Object#toString` result references. */
-	var argsTag = "[object Arguments]", funcTag$1 = "[object Function]", genTag$1 = "[object GeneratorFunction]", symbolTag$1 = "[object Symbol]";
+	var argsTag = "[object Arguments]";
+	var funcTag = "[object Function]";
+	var genTag = "[object GeneratorFunction]";
+	var symbolTag = "[object Symbol]";
 	/** Detect free variable `global` from Node.js. */
-	var freeGlobal$1 = typeof global == "object" && global && global.Object === Object && global;
+	var freeGlobal = typeof global == "object" && global && global.Object === Object && global;
 	/** Detect free variable `self`. */
-	var freeSelf$1 = typeof self == "object" && self && self.Object === Object && self;
+	var freeSelf = typeof self == "object" && self && self.Object === Object && self;
 	/** Used as a reference to the global object. */
-	var root$1 = freeGlobal$1 || freeSelf$1 || Function("return this")();
+	var root = freeGlobal || freeSelf || Function("return this")();
 	/**
 	* A faster alternative to `Function#apply`, this function invokes `func`
 	* with the `this` binding of `thisArg` and the arguments of `args`.
@@ -70,17 +73,19 @@ var require_lodash$1 = __commonJS({ "../../node_modules/.pnpm/lodash.pick@4.4.0/
 		return array;
 	}
 	/** Used for built-in method references. */
-	var objectProto$1 = Object.prototype;
+	var objectProto = Object.prototype;
 	/** Used to check objects for own properties. */
-	var hasOwnProperty$1 = objectProto$1.hasOwnProperty;
+	var hasOwnProperty = objectProto.hasOwnProperty;
 	/**
 	* Used to resolve the
 	* [`toStringTag`](http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring)
 	* of values.
 	*/
-	var objectToString$1 = objectProto$1.toString;
+	var objectToString = objectProto.toString;
 	/** Built-in value references. */
-	var Symbol$1 = root$1.Symbol, propertyIsEnumerable = objectProto$1.propertyIsEnumerable, spreadableSymbol = Symbol$1 ? Symbol$1.isConcatSpreadable : void 0;
+	var Symbol = root.Symbol;
+	var propertyIsEnumerable = objectProto.propertyIsEnumerable;
+	var spreadableSymbol = Symbol ? Symbol.isConcatSpreadable : void 0;
 	var nativeMax = Math.max;
 	/**
 	* The base implementation of `_.flatten` with support for restricting flattening.
@@ -99,9 +104,10 @@ var require_lodash$1 = __commonJS({ "../../node_modules/.pnpm/lodash.pick@4.4.0/
 		result || (result = []);
 		while (++index < length) {
 			var value = array[index];
-			if (depth > 0 && predicate(value)) if (depth > 1) baseFlatten(value, depth - 1, predicate, isStrict, result);
-			else arrayPush(result, value);
-			else if (!isStrict) result[result.length] = value;
+			if (depth > 0 && predicate(value)) {
+				if (depth > 1) baseFlatten(value, depth - 1, predicate, isStrict, result);
+				else arrayPush(result, value);
+			} else if (!isStrict) result[result.length] = value;
 		}
 		return result;
 	}
@@ -165,7 +171,7 @@ var require_lodash$1 = __commonJS({ "../../node_modules/.pnpm/lodash.pick@4.4.0/
 	* @returns {boolean} Returns `true` if `value` is flattenable, else `false`.
 	*/
 	function isFlattenable(value) {
-		return isArray$1(value) || isArguments(value) || !!(spreadableSymbol && value && value[spreadableSymbol]);
+		return isArray(value) || isArguments(value) || !!(spreadableSymbol && value && value[spreadableSymbol]);
 	}
 	/**
 	* Converts `value` to a string key if it's not a string or symbol.
@@ -174,10 +180,10 @@ var require_lodash$1 = __commonJS({ "../../node_modules/.pnpm/lodash.pick@4.4.0/
 	* @param {*} value The value to inspect.
 	* @returns {string|symbol} Returns the key.
 	*/
-	function toKey$1(value) {
-		if (typeof value == "string" || isSymbol$1(value)) return value;
+	function toKey(value) {
+		if (typeof value == "string" || isSymbol(value)) return value;
 		var result = value + "";
-		return result == "0" && 1 / value == -INFINITY$1 ? "-0" : result;
+		return result == "0" && 1 / value == -Infinity ? "-0" : result;
 	}
 	/**
 	* Checks if `value` is likely an `arguments` object.
@@ -198,7 +204,7 @@ var require_lodash$1 = __commonJS({ "../../node_modules/.pnpm/lodash.pick@4.4.0/
 	* // => false
 	*/
 	function isArguments(value) {
-		return isArrayLikeObject(value) && hasOwnProperty$1.call(value, "callee") && (!propertyIsEnumerable.call(value, "callee") || objectToString$1.call(value) == argsTag);
+		return isArrayLikeObject(value) && hasOwnProperty.call(value, "callee") && (!propertyIsEnumerable.call(value, "callee") || objectToString.call(value) == argsTag);
 	}
 	/**
 	* Checks if `value` is classified as an `Array` object.
@@ -223,7 +229,7 @@ var require_lodash$1 = __commonJS({ "../../node_modules/.pnpm/lodash.pick@4.4.0/
 	* _.isArray(_.noop);
 	* // => false
 	*/
-	var isArray$1 = Array.isArray;
+	var isArray = Array.isArray;
 	/**
 	* Checks if `value` is array-like. A value is considered array-like if it's
 	* not a function and has a `value.length` that's an integer greater than or
@@ -250,7 +256,7 @@ var require_lodash$1 = __commonJS({ "../../node_modules/.pnpm/lodash.pick@4.4.0/
 	* // => false
 	*/
 	function isArrayLike(value) {
-		return value != null && isLength(value.length) && !isFunction$1(value);
+		return value != null && isLength(value.length) && !isFunction(value);
 	}
 	/**
 	* This method is like `_.isArrayLike` except that it also checks if `value`
@@ -278,7 +284,7 @@ var require_lodash$1 = __commonJS({ "../../node_modules/.pnpm/lodash.pick@4.4.0/
 	* // => false
 	*/
 	function isArrayLikeObject(value) {
-		return isObjectLike$1(value) && isArrayLike(value);
+		return isObjectLike(value) && isArrayLike(value);
 	}
 	/**
 	* Checks if `value` is classified as a `Function` object.
@@ -297,9 +303,9 @@ var require_lodash$1 = __commonJS({ "../../node_modules/.pnpm/lodash.pick@4.4.0/
 	* _.isFunction(/abc/);
 	* // => false
 	*/
-	function isFunction$1(value) {
-		var tag = isObject$1(value) ? objectToString$1.call(value) : "";
-		return tag == funcTag$1 || tag == genTag$1;
+	function isFunction(value) {
+		var tag = isObject(value) ? objectToString.call(value) : "";
+		return tag == funcTag || tag == genTag;
 	}
 	/**
 	* Checks if `value` is a valid array-like length.
@@ -328,7 +334,7 @@ var require_lodash$1 = __commonJS({ "../../node_modules/.pnpm/lodash.pick@4.4.0/
 	* // => false
 	*/
 	function isLength(value) {
-		return typeof value == "number" && value > -1 && value % 1 == 0 && value <= MAX_SAFE_INTEGER$1;
+		return typeof value == "number" && value > -1 && value % 1 == 0 && value <= MAX_SAFE_INTEGER;
 	}
 	/**
 	* Checks if `value` is the
@@ -355,7 +361,7 @@ var require_lodash$1 = __commonJS({ "../../node_modules/.pnpm/lodash.pick@4.4.0/
 	* _.isObject(null);
 	* // => false
 	*/
-	function isObject$1(value) {
+	function isObject(value) {
 		var type = typeof value;
 		return !!value && (type == "object" || type == "function");
 	}
@@ -383,7 +389,7 @@ var require_lodash$1 = __commonJS({ "../../node_modules/.pnpm/lodash.pick@4.4.0/
 	* _.isObjectLike(null);
 	* // => false
 	*/
-	function isObjectLike$1(value) {
+	function isObjectLike(value) {
 		return !!value && typeof value == "object";
 	}
 	/**
@@ -403,35 +409,16 @@ var require_lodash$1 = __commonJS({ "../../node_modules/.pnpm/lodash.pick@4.4.0/
 	* _.isSymbol('abc');
 	* // => false
 	*/
-	function isSymbol$1(value) {
-		return typeof value == "symbol" || isObjectLike$1(value) && objectToString$1.call(value) == symbolTag$1;
+	function isSymbol(value) {
+		return typeof value == "symbol" || isObjectLike(value) && objectToString.call(value) == symbolTag;
 	}
-	/**
-	* Creates an object composed of the picked `object` properties.
-	*
-	* @static
-	* @since 0.1.0
-	* @memberOf _
-	* @category Object
-	* @param {Object} object The source object.
-	* @param {...(string|string[])} [props] The property identifiers to pick.
-	* @returns {Object} Returns the new object.
-	* @example
-	*
-	* var object = { 'a': 1, 'b': '2', 'c': 3 };
-	*
-	* _.pick(object, ['a', 'c']);
-	* // => { 'a': 1, 'c': 3 }
-	*/
-	var pick$1 = baseRest(function(object, props) {
-		return object == null ? {} : basePick(object, arrayMap(baseFlatten(props, 1), toKey$1));
+	module.exports = baseRest(function(object, props) {
+		return object == null ? {} : basePick(object, arrayMap(baseFlatten(props, 1), toKey));
 	});
-	module.exports = pick$1;
-} });
-
+}));
 //#endregion
 //#region ../../node_modules/.pnpm/lodash.set@4.3.2/node_modules/lodash.set/index.js
-var require_lodash = __commonJS({ "../../node_modules/.pnpm/lodash.set@4.3.2/node_modules/lodash.set/index.js"(exports, module) {
+var require_lodash_set = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	/**
 	* lodash (Custom Build) <https://lodash.com/>
 	* Build: `lodash modularize exports="npm" -o ./`
@@ -444,12 +431,16 @@ var require_lodash = __commonJS({ "../../node_modules/.pnpm/lodash.set@4.3.2/nod
 	var FUNC_ERROR_TEXT = "Expected a function";
 	/** Used to stand-in for `undefined` hash values. */
 	var HASH_UNDEFINED = "__lodash_hash_undefined__";
-	/** Used as references for various `Number` constants. */
-	var INFINITY = Infinity, MAX_SAFE_INTEGER = 9007199254740991;
+	var MAX_SAFE_INTEGER = 9007199254740991;
 	/** `Object#toString` result references. */
-	var funcTag = "[object Function]", genTag = "[object GeneratorFunction]", symbolTag = "[object Symbol]";
+	var funcTag = "[object Function]";
+	var genTag = "[object GeneratorFunction]";
+	var symbolTag = "[object Symbol]";
 	/** Used to match property names within property paths. */
-	var reIsDeepProp = /\.|\[(?:[^[\]]*|(["'])(?:(?!\1)[^\\]|\\.)*?\1)\]/, reIsPlainProp = /^\w*$/, reLeadingDot = /^\./, rePropName = /[^.[\]]+|\[(?:(-?\d+(?:\.\d+)?)|(["'])((?:(?!\2)[^\\]|\\.)*?)\2)\]|(?=(?:\.|\[\])(?:\.|\[\]|$))/g;
+	var reIsDeepProp = /\.|\[(?:[^[\]]*|(["'])(?:(?!\1)[^\\]|\\.)*?\1)\]/;
+	var reIsPlainProp = /^\w*$/;
+	var reLeadingDot = /^\./;
+	var rePropName = /[^.[\]]+|\[(?:(-?\d+(?:\.\d+)?)|(["'])((?:(?!\2)[^\\]|\\.)*?)\2)\]|(?=(?:\.|\[\])(?:\.|\[\]|$))/g;
 	/**
 	* Used to match `RegExp`
 	* [syntax characters](http://ecma-international.org/ecma-262/7.0/#sec-patterns).
@@ -493,7 +484,9 @@ var require_lodash = __commonJS({ "../../node_modules/.pnpm/lodash.set@4.3.2/nod
 		return result;
 	}
 	/** Used for built-in method references. */
-	var arrayProto = Array.prototype, funcProto = Function.prototype, objectProto = Object.prototype;
+	var arrayProto = Array.prototype;
+	var funcProto = Function.prototype;
+	var objectProto = Object.prototype;
 	/** Used to detect overreaching core-js shims. */
 	var coreJsData = root["__core-js_shared__"];
 	/** Used to detect methods masquerading as native. */
@@ -514,10 +507,13 @@ var require_lodash = __commonJS({ "../../node_modules/.pnpm/lodash.set@4.3.2/nod
 	/** Used to detect if a method is native. */
 	var reIsNative = RegExp("^" + funcToString.call(hasOwnProperty).replace(reRegExpChar, "\\$&").replace(/hasOwnProperty|(function).*?(?=\\\()| for .+?(?=\\\])/g, "$1.*?") + "$");
 	/** Built-in value references. */
-	var Symbol = root.Symbol, splice = arrayProto.splice;
-	var Map$1 = getNative(root, "Map"), nativeCreate = getNative(Object, "create");
+	var Symbol = root.Symbol;
+	var splice = arrayProto.splice;
+	var Map = getNative(root, "Map");
+	var nativeCreate = getNative(Object, "create");
 	/** Used to convert symbols to primitives and strings. */
-	var symbolProto = Symbol ? Symbol.prototype : void 0, symbolToString = symbolProto ? symbolProto.toString : void 0;
+	var symbolProto = Symbol ? Symbol.prototype : void 0;
+	var symbolToString = symbolProto ? symbolProto.toString : void 0;
 	/**
 	* Creates a hash object.
 	*
@@ -643,8 +639,7 @@ var require_lodash = __commonJS({ "../../node_modules/.pnpm/lodash.set@4.3.2/nod
 	function listCacheDelete(key) {
 		var data = this.__data__, index = assocIndexOf(data, key);
 		if (index < 0) return false;
-		var lastIndex = data.length - 1;
-		if (index == lastIndex) data.pop();
+		if (index == data.length - 1) data.pop();
 		else splice.call(data, index, 1);
 		return true;
 	}
@@ -719,7 +714,7 @@ var require_lodash = __commonJS({ "../../node_modules/.pnpm/lodash.set@4.3.2/nod
 	function mapCacheClear() {
 		this.__data__ = {
 			"hash": new Hash(),
-			"map": new (Map$1 || ListCache)(),
+			"map": new (Map || ListCache)(),
 			"string": new Hash()
 		};
 	}
@@ -815,8 +810,7 @@ var require_lodash = __commonJS({ "../../node_modules/.pnpm/lodash.set@4.3.2/nod
 	*/
 	function baseIsNative(value) {
 		if (!isObject(value) || isMasked(value)) return false;
-		var pattern = isFunction(value) || isHostObject(value) ? reIsNative : reIsHostCtor;
-		return pattern.test(toSource(value));
+		return (isFunction(value) || isHostObject(value) ? reIsNative : reIsHostCtor).test(toSource(value));
 	}
 	/**
 	* The base implementation of `_.set`.
@@ -856,7 +850,7 @@ var require_lodash = __commonJS({ "../../node_modules/.pnpm/lodash.set@4.3.2/nod
 		if (typeof value == "string") return value;
 		if (isSymbol(value)) return symbolToString ? symbolToString.call(value) : "";
 		var result = value + "";
-		return result == "0" && 1 / value == -INFINITY ? "-0" : result;
+		return result == "0" && 1 / value == -Infinity ? "-0" : result;
 	}
 	/**
 	* Casts `value` to a path array if it's not one.
@@ -950,8 +944,8 @@ var require_lodash = __commonJS({ "../../node_modules/.pnpm/lodash.set@4.3.2/nod
 		string = toString(string);
 		var result = [];
 		if (reLeadingDot.test(string)) result.push("");
-		string.replace(rePropName, function(match, number, quote, string$1) {
-			result.push(quote ? string$1.replace(reEscapeChar, "$1") : number || match);
+		string.replace(rePropName, function(match, number, quote, string) {
+			result.push(quote ? string.replace(reEscapeChar, "$1") : number || match);
 		});
 		return result;
 	});
@@ -965,7 +959,7 @@ var require_lodash = __commonJS({ "../../node_modules/.pnpm/lodash.set@4.3.2/nod
 	function toKey(value) {
 		if (typeof value == "string" || isSymbol(value)) return value;
 		var result = value + "";
-		return result == "0" && 1 / value == -INFINITY ? "-0" : result;
+		return result == "0" && 1 / value == -Infinity ? "-0" : result;
 	}
 	/**
 	* Converts `func` to its source code.
@@ -1250,16 +1244,60 @@ var require_lodash = __commonJS({ "../../node_modules/.pnpm/lodash.set@4.3.2/nod
 	* console.log(object.x[0].y.z);
 	* // => 5
 	*/
-	function set$1(object, path, value) {
+	function set(object, path, value) {
 		return object == null ? object : baseSet(object, path, value);
 	}
-	module.exports = set$1;
-} });
-
+	module.exports = set;
+}));
+//#endregion
+//#region src/endpoints/sessionAuth.ts
+var import_lodash_pick = /* @__PURE__ */ __toESM(require_lodash_pick(), 1);
+var import_lodash_set = /* @__PURE__ */ __toESM(require_lodash_set(), 1);
+/**
+* What is forwarded to the auth server: the headers a session travels in, and
+* whose request it is — nothing else.
+*
+* The client's address goes with the session because the auth server
+* rate-limits by it, `/get-session` included. Without it every user's session
+* check arrived from the surface itself — one shared bucket, so enough
+* traffic from anyone turned every session check into a 429 — and in tests,
+* concurrent tests queued on the same rate-limit row.
+*/
+const SESSION_HEADERS = [
+	"cookie",
+	"authorization",
+	"x-forwarded-for"
+];
+/** `auth` for one request on one surface. */
+function sessionAuth(surface, header) {
+	return { async getSession() {
+		const authenticator = surface?.auth;
+		if (!surface || !authenticator) throw new NoAuthenticator(surface?.id);
+		const headers = new Headers();
+		for (const name of SESSION_HEADERS) {
+			const value = header(name);
+			if (value) headers.set(name, value);
+		}
+		const session = await authenticator.verify(headers, surface.envParser);
+		const identity = session;
+		if (typeof identity?.user?.id === "string") identifyUser({
+			id: identity.user.id,
+			...typeof identity.session?.id === "string" ? { sessionId: identity.session.id } : {}
+		});
+		return session;
+	} };
+}
+/** `auth.getSession()` was called on a surface that names no authenticator. */
+var NoAuthenticator = class extends Error {
+	surface;
+	constructor(surface) {
+		super(`auth.getSession() needs an authenticator, and ${surface ? `the surface '${surface}'` : "this endpoint"} declares none: declare one on the surface with .auth(construct).`);
+		this.surface = surface;
+		this.name = "NoAuthenticator";
+	}
+};
 //#endregion
 //#region src/endpoints/Endpoint.ts
-var import_lodash = __toESM(require_lodash$1(), 1);
-var import_lodash$1 = __toESM(require_lodash(), 1);
 /**
 * Represents an HTTP endpoint that can handle requests with type-safe input/output validation,
 * dependency injection, session management, and authorization.
@@ -1303,7 +1341,7 @@ var Endpoint = class Endpoint extends Function$1 {
 	description;
 	/** Optional tags for OpenAPI documentation */
 	tags;
-	/** The HTTP success status code to return (default: 200) */
+	/** The HTTP status code to return (default: 200) */
 	status;
 	/**
 	* Response content type for this endpoint. Defaults to `'application/json'`.
@@ -1311,10 +1349,22 @@ var Endpoint = class Endpoint extends Function$1 {
 	* Content-Type header instead of JSON-serializing.
 	*/
 	responseType;
+	/**
+	* This route's telemetry — `.telemetry({ ignore, attributes })` — read by
+	* the build, which hands it to the request middleware.
+	*/
+	telemetry;
 	/** Default headers to apply to all responses */
 	defaultHeaders = {};
 	/** Function to extract session data from the request context */
 	getSession = () => ({});
+	/**
+	* Whether a session callback was given — `.session()` on the factory it was
+	* built from. A generated handler reads the session only when it is, so
+	* an endpoint with a session and no authorizer must say so: it used to be
+	* handed `undefined` in a production build and its session in `gkm dev`.
+	*/
+	hasSession = false;
 	/** Function to determine if the request is authorized */
 	authorize = () => true;
 	/** Optional rate limiting configuration */
@@ -1385,6 +1435,14 @@ var Endpoint = class Endpoint extends Function$1 {
 		return status >= 200 && status < 300;
 	}
 	/**
+	* Whether `status` sends the client elsewhere. A redirect has no body, so
+	* its response is not checked against the output schema, and what is
+	* derived from the output — declared events and audits — is not sent.
+	*/
+	static isRedirectStatus(status) {
+		return status !== void 0 && status >= 300 && status < 400;
+	}
+	/**
 	* Creates a case-insensitive header lookup function from a headers object.
 	*
 	* @param headers - Object containing header key-value pairs
@@ -1480,12 +1538,11 @@ var Endpoint = class Endpoint extends Function$1 {
 	* @internal
 	*/
 	refineInput(ctx) {
-		const input = (0, import_lodash.default)(ctx, [
+		return (0, import_lodash_pick.default)(ctx, [
 			"body",
 			"query",
 			"params"
 		]);
-		return input;
 	}
 	handler = (ctx, response) => {
 		for (const [key, value] of Object.entries(this.defaultHeaders)) response.header(key, value);
@@ -1508,7 +1565,7 @@ var Endpoint = class Endpoint extends Function$1 {
 	* @returns True if the object is an Endpoint
 	*/
 	static isEndpoint(obj) {
-		return Boolean(obj && obj.__IS_FUNCTION__ === true && obj.type === ConstructType.Endpoint);
+		return Boolean(obj && obj.__IS_FUNCTION__ === true && obj.type === "dev.geekmidas.function.endpoint");
 	}
 	/**
 	* Helper to check if response has metadata
@@ -1530,17 +1587,23 @@ var Endpoint = class Endpoint extends Function$1 {
 	* @returns OpenAPI route definition with operation details
 	*/
 	async toOpenApi3Route(componentCollector) {
+		const status = String(this.status);
 		const operation = {
 			operationId: this.operationId,
 			...this.description && { description: this.description },
 			...this.tags && this.tags.length > 0 && { tags: this.tags },
-			responses: { "200": { description: "Successful response" } }
+			responses: { [status]: { description: "Successful response" } }
 		};
+		const scheme = this.authorizer?.securityScheme;
+		if (this.authorizer && scheme && componentCollector) {
+			componentCollector.addSecurityScheme(this.authorizer.name, scheme);
+			operation.security = [{ [this.authorizer.name]: [] }];
+		}
 		if (this.outputSchema) {
 			const responseSchema = await convertSchemaWithComponents(this.outputSchema, componentCollector);
-			if (responseSchema) (0, import_lodash$1.default)(operation, [
+			if (responseSchema) (0, import_lodash_set.default)(operation, [
 				"responses",
-				"200",
+				status,
 				"content",
 				this.responseType,
 				"schema"
@@ -1555,7 +1618,7 @@ var Endpoint = class Endpoint extends Function$1 {
 				"PATCH"
 			].includes(this.method) && "body" in this.input && this.input.body) {
 				const bodySchema = await convertSchemaWithComponents(this.input.body, componentCollector);
-				if (bodySchema) (0, import_lodash$1.default)(operation, ["requestBody"], {
+				if (bodySchema) (0, import_lodash_set.default)(operation, ["requestBody"], {
 					required: true,
 					content: { "application/json": { schema: bodySchema } }
 				});
@@ -1603,8 +1666,8 @@ var Endpoint = class Endpoint extends Function$1 {
 	* @param options.status - Success HTTP status code (default: 200)
 	* @param options.authorizer - Optional authorizer configuration
 	*/
-	constructor({ fn, method, route, description, tags, input, logger, output: outputSchema, services, constructs, timeout, memorySize, getSession, authorize, rateLimit, status = SuccessStatus.OK, publisherService, events, authorizer, surface, auditorStorageService, actorExtractor, audits, databaseService, rlsConfig, rlsBypass, responseType }) {
-		super(fn, timeout, ConstructType.Endpoint, input, outputSchema, services, logger, publisherService, events, memorySize, auditorStorageService, void 0, constructs);
+	constructor({ fn, method, route, description, tags, input, logger, output: outputSchema, services, constructs, timeout, memorySize, getSession, authorize, rateLimit, status = 200, events, authorizer, surface, auditorStorageService, actorExtractor, audits, databaseService, rlsConfig, rlsBypass, responseType, telemetry }) {
+		super(fn, timeout, "dev.geekmidas.function.endpoint", input, outputSchema, services, logger, events, memorySize, auditorStorageService, void 0, constructs);
 		this.route = route;
 		this.method = method;
 		this.description = description;
@@ -1612,7 +1675,14 @@ var Endpoint = class Endpoint extends Function$1 {
 		this.status = status;
 		this.responseType = responseType ?? "application/json";
 		this.endpointFn = fn;
-		if (getSession) this.getSession = getSession;
+		if (telemetry) this.telemetry = telemetry;
+		if (getSession) {
+			this.hasSession = true;
+			this.getSession = (ctx) => getSession({
+				...ctx,
+				auth: sessionAuth(surface, ctx.header)
+			});
+		}
 		if (authorize) this.authorize = authorize;
 		if (rateLimit) this.rateLimit = rateLimit;
 		if (authorizer) this.authorizer = authorizer;
@@ -1658,6 +1728,27 @@ var ResponseBuilder = class {
 		this.metadata.status = code;
 		return this;
 	}
+	/**
+	* Send the client to `url` — `Location` and a 3xx, with no body. 303 by
+	* default: after a form post, the browser follows it with a GET, so a
+	* reload does not post the form again.
+	*
+	* A redirect is not checked against the endpoint's `.output()` schema, so
+	* an endpoint that renders a page can redirect instead.
+	*
+	* @example
+	* ```typescript
+	* return response.cookie('session', token).redirect('/dashboard');
+	* ```
+	*/
+	redirect(url, status = 303) {
+		this.metadata.headers.location = url;
+		this.metadata.status = status;
+		return {
+			data: void 0,
+			metadata: this.metadata
+		};
+	}
 	send(data) {
 		return {
 			data,
@@ -1671,22 +1762,39 @@ var ResponseBuilder = class {
 /**
 * HTTP success status codes that can be returned by endpoints.
 */
-let SuccessStatus = /* @__PURE__ */ function(SuccessStatus$1) {
+let SuccessStatus = /* @__PURE__ */ function(SuccessStatus) {
 	/** Standard response for successful HTTP requests */
-	SuccessStatus$1[SuccessStatus$1["OK"] = 200] = "OK";
+	SuccessStatus[SuccessStatus["OK"] = 200] = "OK";
 	/** Request has been fulfilled and resulted in a new resource being created */
-	SuccessStatus$1[SuccessStatus$1["Created"] = 201] = "Created";
+	SuccessStatus[SuccessStatus["Created"] = 201] = "Created";
 	/** Request has been accepted for processing, but processing is not complete */
-	SuccessStatus$1[SuccessStatus$1["Accepted"] = 202] = "Accepted";
+	SuccessStatus[SuccessStatus["Accepted"] = 202] = "Accepted";
 	/** Server successfully processed the request but is not returning any content */
-	SuccessStatus$1[SuccessStatus$1["NoContent"] = 204] = "NoContent";
+	SuccessStatus[SuccessStatus["NoContent"] = 204] = "NoContent";
 	/** Server successfully processed the request and is not returning any content, client should reset the document view */
-	SuccessStatus$1[SuccessStatus$1["ResetContent"] = 205] = "ResetContent";
+	SuccessStatus[SuccessStatus["ResetContent"] = 205] = "ResetContent";
 	/** Server is delivering only part of the resource due to a range header */
-	SuccessStatus$1[SuccessStatus$1["PartialContent"] = 206] = "PartialContent";
-	return SuccessStatus$1;
+	SuccessStatus[SuccessStatus["PartialContent"] = 206] = "PartialContent";
+	return SuccessStatus;
+}({});
+/**
+* HTTP redirect status codes an endpoint can answer with —
+* `response.redirect(url, status)`, or `.status()` with a `Location` header.
+*/
+let RedirectStatus = /* @__PURE__ */ function(RedirectStatus) {
+	/** The resource has moved for good; a POST may become a GET */
+	RedirectStatus[RedirectStatus["MovedPermanently"] = 301] = "MovedPermanently";
+	/** The resource is elsewhere for now; a POST may become a GET */
+	RedirectStatus[RedirectStatus["Found"] = 302] = "Found";
+	/** See the resource elsewhere, with a GET — the answer to a form post */
+	RedirectStatus[RedirectStatus["SeeOther"] = 303] = "SeeOther";
+	/** The resource is elsewhere for now; the method and body are kept */
+	RedirectStatus[RedirectStatus["TemporaryRedirect"] = 307] = "TemporaryRedirect";
+	/** The resource has moved for good; the method and body are kept */
+	RedirectStatus[RedirectStatus["PermanentRedirect"] = 308] = "PermanentRedirect";
+	return RedirectStatus;
 }({});
-
 //#endregion
-export { Endpoint, ResponseBuilder, require_lodash };
-//# sourceMappingURL=Endpoint-DCQPMdUX.mjs.map
+export { NoAuthenticator as a, SuccessStatus as i, RedirectStatus as n, require_lodash_set as o, ResponseBuilder as r, Endpoint as t };
+
+//# sourceMappingURL=Endpoint-gPXhHKhJ.mjs.map