@geekmidas/constructs 10.0.0-alpha.12 → 10.0.0-alpha.121

package/dist/{Endpoint-DcWXE-SZ.cjs → Endpoint-yhR2T2Wt.cjs}

@@ -1,11 +1,11 @@
-const require_chunk = require('./chunk-DWy1uDak.cjs');
-const require_Construct = require('./Construct-CyS3RpTL.cjs');
-const require_functions = require('./functions-i_la-N5r.cjs');
-const __geekmidas_schema_conversion = require_chunk.__toESM(require("@geekmidas/schema/conversion"));
-const __geekmidas_schema_openapi = require_chunk.__toESM(require("@geekmidas/schema/openapi"));
-
+const require_rolldown_runtime = require("./rolldown-runtime-y5ARvAq5.cjs");
+require("./Construct-DEOVauyA.cjs");
+const require_tracing = require("./tracing-C0ooU0V2.cjs");
+const require_functions = require("./functions-D7O5SGVc.cjs");
+let _geekmidas_schema_conversion = require("@geekmidas/schema/conversion");
+let _geekmidas_schema_openapi = require("@geekmidas/schema/openapi");
 //#region ../../node_modules/.pnpm/lodash.pick@4.4.0/node_modules/lodash.pick/index.js
-var require_lodash$1 = require_chunk.__commonJS({ "../../node_modules/.pnpm/lodash.pick@4.4.0/node_modules/lodash.pick/index.js"(exports, module) {
+var require_lodash_pick = /* @__PURE__ */ require_rolldown_runtime.__commonJSMin(((exports, module) => {
 	/**
 	* lodash (Custom Build) <https://lodash.com/>
 	* Build: `lodash modularize exports="npm" -o ./`
@@ -15,15 +15,18 @@ var require_lodash$1 = require_chunk.__commonJS({ "../../node_modules/.pnpm/loda
 	* Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors
 	*/
 	/** Used as references for various `Number` constants. */
-	var INFINITY$1 = Infinity, MAX_SAFE_INTEGER$1 = 9007199254740991;
+	var MAX_SAFE_INTEGER = 9007199254740991;
 	/** `Object#toString` result references. */
-	var argsTag = "[object Arguments]", funcTag$1 = "[object Function]", genTag$1 = "[object GeneratorFunction]", symbolTag$1 = "[object Symbol]";
+	var argsTag = "[object Arguments]";
+	var funcTag = "[object Function]";
+	var genTag = "[object GeneratorFunction]";
+	var symbolTag = "[object Symbol]";
 	/** Detect free variable `global` from Node.js. */
-	var freeGlobal$1 = typeof global == "object" && global && global.Object === Object && global;
+	var freeGlobal = typeof global == "object" && global && global.Object === Object && global;
 	/** Detect free variable `self`. */
-	var freeSelf$1 = typeof self == "object" && self && self.Object === Object && self;
+	var freeSelf = typeof self == "object" && self && self.Object === Object && self;
 	/** Used as a reference to the global object. */
-	var root$1 = freeGlobal$1 || freeSelf$1 || Function("return this")();
+	var root = freeGlobal || freeSelf || Function("return this")();
 	/**
 	* A faster alternative to `Function#apply`, this function invokes `func`
 	* with the `this` binding of `thisArg` and the arguments of `args`.
@@ -71,17 +74,19 @@ var require_lodash$1 = require_chunk.__commonJS({ "../../node_modules/.pnpm/loda
 		return array;
 	}
 	/** Used for built-in method references. */
-	var objectProto$1 = Object.prototype;
+	var objectProto = Object.prototype;
 	/** Used to check objects for own properties. */
-	var hasOwnProperty$1 = objectProto$1.hasOwnProperty;
+	var hasOwnProperty = objectProto.hasOwnProperty;
 	/**
 	* Used to resolve the
 	* [`toStringTag`](http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring)
 	* of values.
 	*/
-	var objectToString$1 = objectProto$1.toString;
+	var objectToString = objectProto.toString;
 	/** Built-in value references. */
-	var Symbol$1 = root$1.Symbol, propertyIsEnumerable = objectProto$1.propertyIsEnumerable, spreadableSymbol = Symbol$1 ? Symbol$1.isConcatSpreadable : void 0;
+	var Symbol = root.Symbol;
+	var propertyIsEnumerable = objectProto.propertyIsEnumerable;
+	var spreadableSymbol = Symbol ? Symbol.isConcatSpreadable : void 0;
 	var nativeMax = Math.max;
 	/**
 	* The base implementation of `_.flatten` with support for restricting flattening.
@@ -100,9 +105,10 @@ var require_lodash$1 = require_chunk.__commonJS({ "../../node_modules/.pnpm/loda
 		result || (result = []);
 		while (++index < length) {
 			var value = array[index];
-			if (depth > 0 && predicate(value)) if (depth > 1) baseFlatten(value, depth - 1, predicate, isStrict, result);
-			else arrayPush(result, value);
-			else if (!isStrict) result[result.length] = value;
+			if (depth > 0 && predicate(value)) {
+				if (depth > 1) baseFlatten(value, depth - 1, predicate, isStrict, result);
+				else arrayPush(result, value);
+			} else if (!isStrict) result[result.length] = value;
 		}
 		return result;
 	}
@@ -166,7 +172,7 @@ var require_lodash$1 = require_chunk.__commonJS({ "../../node_modules/.pnpm/loda
 	* @returns {boolean} Returns `true` if `value` is flattenable, else `false`.
 	*/
 	function isFlattenable(value) {
-		return isArray$1(value) || isArguments(value) || !!(spreadableSymbol && value && value[spreadableSymbol]);
+		return isArray(value) || isArguments(value) || !!(spreadableSymbol && value && value[spreadableSymbol]);
 	}
 	/**
 	* Converts `value` to a string key if it's not a string or symbol.
@@ -175,10 +181,10 @@ var require_lodash$1 = require_chunk.__commonJS({ "../../node_modules/.pnpm/loda
 	* @param {*} value The value to inspect.
 	* @returns {string|symbol} Returns the key.
 	*/
-	function toKey$1(value) {
-		if (typeof value == "string" || isSymbol$1(value)) return value;
+	function toKey(value) {
+		if (typeof value == "string" || isSymbol(value)) return value;
 		var result = value + "";
-		return result == "0" && 1 / value == -INFINITY$1 ? "-0" : result;
+		return result == "0" && 1 / value == -Infinity ? "-0" : result;
 	}
 	/**
 	* Checks if `value` is likely an `arguments` object.
@@ -199,7 +205,7 @@ var require_lodash$1 = require_chunk.__commonJS({ "../../node_modules/.pnpm/loda
 	* // => false
 	*/
 	function isArguments(value) {
-		return isArrayLikeObject(value) && hasOwnProperty$1.call(value, "callee") && (!propertyIsEnumerable.call(value, "callee") || objectToString$1.call(value) == argsTag);
+		return isArrayLikeObject(value) && hasOwnProperty.call(value, "callee") && (!propertyIsEnumerable.call(value, "callee") || objectToString.call(value) == argsTag);
 	}
 	/**
 	* Checks if `value` is classified as an `Array` object.
@@ -224,7 +230,7 @@ var require_lodash$1 = require_chunk.__commonJS({ "../../node_modules/.pnpm/loda
 	* _.isArray(_.noop);
 	* // => false
 	*/
-	var isArray$1 = Array.isArray;
+	var isArray = Array.isArray;
 	/**
 	* Checks if `value` is array-like. A value is considered array-like if it's
 	* not a function and has a `value.length` that's an integer greater than or
@@ -251,7 +257,7 @@ var require_lodash$1 = require_chunk.__commonJS({ "../../node_modules/.pnpm/loda
 	* // => false
 	*/
 	function isArrayLike(value) {
-		return value != null && isLength(value.length) && !isFunction$1(value);
+		return value != null && isLength(value.length) && !isFunction(value);
 	}
 	/**
 	* This method is like `_.isArrayLike` except that it also checks if `value`
@@ -279,7 +285,7 @@ var require_lodash$1 = require_chunk.__commonJS({ "../../node_modules/.pnpm/loda
 	* // => false
 	*/
 	function isArrayLikeObject(value) {
-		return isObjectLike$1(value) && isArrayLike(value);
+		return isObjectLike(value) && isArrayLike(value);
 	}
 	/**
 	* Checks if `value` is classified as a `Function` object.
@@ -298,9 +304,9 @@ var require_lodash$1 = require_chunk.__commonJS({ "../../node_modules/.pnpm/loda
 	* _.isFunction(/abc/);
 	* // => false
 	*/
-	function isFunction$1(value) {
-		var tag = isObject$1(value) ? objectToString$1.call(value) : "";
-		return tag == funcTag$1 || tag == genTag$1;
+	function isFunction(value) {
+		var tag = isObject(value) ? objectToString.call(value) : "";
+		return tag == funcTag || tag == genTag;
 	}
 	/**
 	* Checks if `value` is a valid array-like length.
@@ -329,7 +335,7 @@ var require_lodash$1 = require_chunk.__commonJS({ "../../node_modules/.pnpm/loda
 	* // => false
 	*/
 	function isLength(value) {
-		return typeof value == "number" && value > -1 && value % 1 == 0 && value <= MAX_SAFE_INTEGER$1;
+		return typeof value == "number" && value > -1 && value % 1 == 0 && value <= MAX_SAFE_INTEGER;
 	}
 	/**
 	* Checks if `value` is the
@@ -356,7 +362,7 @@ var require_lodash$1 = require_chunk.__commonJS({ "../../node_modules/.pnpm/loda
 	* _.isObject(null);
 	* // => false
 	*/
-	function isObject$1(value) {
+	function isObject(value) {
 		var type = typeof value;
 		return !!value && (type == "object" || type == "function");
 	}
@@ -384,7 +390,7 @@ var require_lodash$1 = require_chunk.__commonJS({ "../../node_modules/.pnpm/loda
 	* _.isObjectLike(null);
 	* // => false
 	*/
-	function isObjectLike$1(value) {
+	function isObjectLike(value) {
 		return !!value && typeof value == "object";
 	}
 	/**
@@ -404,35 +410,16 @@ var require_lodash$1 = require_chunk.__commonJS({ "../../node_modules/.pnpm/loda
 	* _.isSymbol('abc');
 	* // => false
 	*/
-	function isSymbol$1(value) {
-		return typeof value == "symbol" || isObjectLike$1(value) && objectToString$1.call(value) == symbolTag$1;
+	function isSymbol(value) {
+		return typeof value == "symbol" || isObjectLike(value) && objectToString.call(value) == symbolTag;
 	}
-	/**
-	* Creates an object composed of the picked `object` properties.
-	*
-	* @static
-	* @since 0.1.0
-	* @memberOf _
-	* @category Object
-	* @param {Object} object The source object.
-	* @param {...(string|string[])} [props] The property identifiers to pick.
-	* @returns {Object} Returns the new object.
-	* @example
-	*
-	* var object = { 'a': 1, 'b': '2', 'c': 3 };
-	*
-	* _.pick(object, ['a', 'c']);
-	* // => { 'a': 1, 'c': 3 }
-	*/
-	var pick$1 = baseRest(function(object, props) {
-		return object == null ? {} : basePick(object, arrayMap(baseFlatten(props, 1), toKey$1));
+	module.exports = baseRest(function(object, props) {
+		return object == null ? {} : basePick(object, arrayMap(baseFlatten(props, 1), toKey));
 	});
-	module.exports = pick$1;
-} });
-
+}));
 //#endregion
 //#region ../../node_modules/.pnpm/lodash.set@4.3.2/node_modules/lodash.set/index.js
-var require_lodash = require_chunk.__commonJS({ "../../node_modules/.pnpm/lodash.set@4.3.2/node_modules/lodash.set/index.js"(exports, module) {
+var require_lodash_set = /* @__PURE__ */ require_rolldown_runtime.__commonJSMin(((exports, module) => {
 	/**
 	* lodash (Custom Build) <https://lodash.com/>
 	* Build: `lodash modularize exports="npm" -o ./`
@@ -445,12 +432,16 @@ var require_lodash = require_chunk.__commonJS({ "../../node_modules/.pnpm/lodash
 	var FUNC_ERROR_TEXT = "Expected a function";
 	/** Used to stand-in for `undefined` hash values. */
 	var HASH_UNDEFINED = "__lodash_hash_undefined__";
-	/** Used as references for various `Number` constants. */
-	var INFINITY = Infinity, MAX_SAFE_INTEGER = 9007199254740991;
+	var MAX_SAFE_INTEGER = 9007199254740991;
 	/** `Object#toString` result references. */
-	var funcTag = "[object Function]", genTag = "[object GeneratorFunction]", symbolTag = "[object Symbol]";
+	var funcTag = "[object Function]";
+	var genTag = "[object GeneratorFunction]";
+	var symbolTag = "[object Symbol]";
 	/** Used to match property names within property paths. */
-	var reIsDeepProp = /\.|\[(?:[^[\]]*|(["'])(?:(?!\1)[^\\]|\\.)*?\1)\]/, reIsPlainProp = /^\w*$/, reLeadingDot = /^\./, rePropName = /[^.[\]]+|\[(?:(-?\d+(?:\.\d+)?)|(["'])((?:(?!\2)[^\\]|\\.)*?)\2)\]|(?=(?:\.|\[\])(?:\.|\[\]|$))/g;
+	var reIsDeepProp = /\.|\[(?:[^[\]]*|(["'])(?:(?!\1)[^\\]|\\.)*?\1)\]/;
+	var reIsPlainProp = /^\w*$/;
+	var reLeadingDot = /^\./;
+	var rePropName = /[^.[\]]+|\[(?:(-?\d+(?:\.\d+)?)|(["'])((?:(?!\2)[^\\]|\\.)*?)\2)\]|(?=(?:\.|\[\])(?:\.|\[\]|$))/g;
 	/**
 	* Used to match `RegExp`
 	* [syntax characters](http://ecma-international.org/ecma-262/7.0/#sec-patterns).
@@ -494,7 +485,9 @@ var require_lodash = require_chunk.__commonJS({ "../../node_modules/.pnpm/lodash
 		return result;
 	}
 	/** Used for built-in method references. */
-	var arrayProto = Array.prototype, funcProto = Function.prototype, objectProto = Object.prototype;
+	var arrayProto = Array.prototype;
+	var funcProto = Function.prototype;
+	var objectProto = Object.prototype;
 	/** Used to detect overreaching core-js shims. */
 	var coreJsData = root["__core-js_shared__"];
 	/** Used to detect methods masquerading as native. */
@@ -515,10 +508,13 @@ var require_lodash = require_chunk.__commonJS({ "../../node_modules/.pnpm/lodash
 	/** Used to detect if a method is native. */
 	var reIsNative = RegExp("^" + funcToString.call(hasOwnProperty).replace(reRegExpChar, "\\$&").replace(/hasOwnProperty|(function).*?(?=\\\()| for .+?(?=\\\])/g, "$1.*?") + "$");
 	/** Built-in value references. */
-	var Symbol = root.Symbol, splice = arrayProto.splice;
-	var Map$1 = getNative(root, "Map"), nativeCreate = getNative(Object, "create");
+	var Symbol = root.Symbol;
+	var splice = arrayProto.splice;
+	var Map = getNative(root, "Map");
+	var nativeCreate = getNative(Object, "create");
 	/** Used to convert symbols to primitives and strings. */
-	var symbolProto = Symbol ? Symbol.prototype : void 0, symbolToString = symbolProto ? symbolProto.toString : void 0;
+	var symbolProto = Symbol ? Symbol.prototype : void 0;
+	var symbolToString = symbolProto ? symbolProto.toString : void 0;
 	/**
 	* Creates a hash object.
 	*
@@ -644,8 +640,7 @@ var require_lodash = require_chunk.__commonJS({ "../../node_modules/.pnpm/lodash
 	function listCacheDelete(key) {
 		var data = this.__data__, index = assocIndexOf(data, key);
 		if (index < 0) return false;
-		var lastIndex = data.length - 1;
-		if (index == lastIndex) data.pop();
+		if (index == data.length - 1) data.pop();
 		else splice.call(data, index, 1);
 		return true;
 	}
@@ -720,7 +715,7 @@ var require_lodash = require_chunk.__commonJS({ "../../node_modules/.pnpm/lodash
 	function mapCacheClear() {
 		this.__data__ = {
 			"hash": new Hash(),
-			"map": new (Map$1 || ListCache)(),
+			"map": new (Map || ListCache)(),
 			"string": new Hash()
 		};
 	}
@@ -816,8 +811,7 @@ var require_lodash = require_chunk.__commonJS({ "../../node_modules/.pnpm/lodash
 	*/
 	function baseIsNative(value) {
 		if (!isObject(value) || isMasked(value)) return false;
-		var pattern = isFunction(value) || isHostObject(value) ? reIsNative : reIsHostCtor;
-		return pattern.test(toSource(value));
+		return (isFunction(value) || isHostObject(value) ? reIsNative : reIsHostCtor).test(toSource(value));
 	}
 	/**
 	* The base implementation of `_.set`.
@@ -857,7 +851,7 @@ var require_lodash = require_chunk.__commonJS({ "../../node_modules/.pnpm/lodash
 		if (typeof value == "string") return value;
 		if (isSymbol(value)) return symbolToString ? symbolToString.call(value) : "";
 		var result = value + "";
-		return result == "0" && 1 / value == -INFINITY ? "-0" : result;
+		return result == "0" && 1 / value == -Infinity ? "-0" : result;
 	}
 	/**
 	* Casts `value` to a path array if it's not one.
@@ -951,8 +945,8 @@ var require_lodash = require_chunk.__commonJS({ "../../node_modules/.pnpm/lodash
 		string = toString(string);
 		var result = [];
 		if (reLeadingDot.test(string)) result.push("");
-		string.replace(rePropName, function(match, number, quote, string$1) {
-			result.push(quote ? string$1.replace(reEscapeChar, "$1") : number || match);
+		string.replace(rePropName, function(match, number, quote, string) {
+			result.push(quote ? string.replace(reEscapeChar, "$1") : number || match);
 		});
 		return result;
 	});
@@ -966,7 +960,7 @@ var require_lodash = require_chunk.__commonJS({ "../../node_modules/.pnpm/lodash
 	function toKey(value) {
 		if (typeof value == "string" || isSymbol(value)) return value;
 		var result = value + "";
-		return result == "0" && 1 / value == -INFINITY ? "-0" : result;
+		return result == "0" && 1 / value == -Infinity ? "-0" : result;
 	}
 	/**
 	* Converts `func` to its source code.
@@ -1251,16 +1245,60 @@ var require_lodash = require_chunk.__commonJS({ "../../node_modules/.pnpm/lodash
 	* console.log(object.x[0].y.z);
 	* // => 5
 	*/
-	function set$1(object, path, value) {
+	function set(object, path, value) {
 		return object == null ? object : baseSet(object, path, value);
 	}
-	module.exports = set$1;
-} });
-
+	module.exports = set;
+}));
+//#endregion
+//#region src/endpoints/sessionAuth.ts
+var import_lodash_pick = /* @__PURE__ */ require_rolldown_runtime.__toESM(require_lodash_pick(), 1);
+var import_lodash_set = /* @__PURE__ */ require_rolldown_runtime.__toESM(require_lodash_set(), 1);
+/**
+* What is forwarded to the auth server: the headers a session travels in, and
+* whose request it is — nothing else.
+*
+* The client's address goes with the session because the auth server
+* rate-limits by it, `/get-session` included. Without it every user's session
+* check arrived from the surface itself — one shared bucket, so enough
+* traffic from anyone turned every session check into a 429 — and in tests,
+* concurrent tests queued on the same rate-limit row.
+*/
+const SESSION_HEADERS = [
+	"cookie",
+	"authorization",
+	"x-forwarded-for"
+];
+/** `auth` for one request on one surface. */
+function sessionAuth(surface, header) {
+	return { async getSession() {
+		const authenticator = surface?.auth;
+		if (!surface || !authenticator) throw new NoAuthenticator(surface?.id);
+		const headers = new Headers();
+		for (const name of SESSION_HEADERS) {
+			const value = header(name);
+			if (value) headers.set(name, value);
+		}
+		const session = await authenticator.verify(headers, surface.envParser);
+		const identity = session;
+		if (typeof identity?.user?.id === "string") require_tracing.identifyUser({
+			id: identity.user.id,
+			...typeof identity.session?.id === "string" ? { sessionId: identity.session.id } : {}
+		});
+		return session;
+	} };
+}
+/** `auth.getSession()` was called on a surface that names no authenticator. */
+var NoAuthenticator = class extends Error {
+	surface;
+	constructor(surface) {
+		super(`auth.getSession() needs an authenticator, and ${surface ? `the surface '${surface}'` : "this endpoint"} declares none: declare one on the surface with .auth(construct).`);
+		this.surface = surface;
+		this.name = "NoAuthenticator";
+	}
+};
 //#endregion
 //#region src/endpoints/Endpoint.ts
-var import_lodash = require_chunk.__toESM(require_lodash$1(), 1);
-var import_lodash$1 = require_chunk.__toESM(require_lodash(), 1);
 /**
 * Represents an HTTP endpoint that can handle requests with type-safe input/output validation,
 * dependency injection, session management, and authorization.
@@ -1304,7 +1342,7 @@ var Endpoint = class Endpoint extends require_functions.Function {
 	description;
 	/** Optional tags for OpenAPI documentation */
 	tags;
-	/** The HTTP success status code to return (default: 200) */
+	/** The HTTP status code to return (default: 200) */
 	status;
 	/**
 	* Response content type for this endpoint. Defaults to `'application/json'`.
@@ -1312,10 +1350,22 @@ var Endpoint = class Endpoint extends require_functions.Function {
 	* Content-Type header instead of JSON-serializing.
 	*/
 	responseType;
+	/**
+	* This route's telemetry — `.telemetry({ ignore, attributes })` — read by
+	* the build, which hands it to the request middleware.
+	*/
+	telemetry;
 	/** Default headers to apply to all responses */
 	defaultHeaders = {};
 	/** Function to extract session data from the request context */
 	getSession = () => ({});
+	/**
+	* Whether a session callback was given — `.session()` on the factory it was
+	* built from. A generated handler reads the session only when it is, so
+	* an endpoint with a session and no authorizer must say so: it used to be
+	* handed `undefined` in a production build and its session in `gkm dev`.
+	*/
+	hasSession = false;
 	/** Function to determine if the request is authorized */
 	authorize = () => true;
 	/** Optional rate limiting configuration */
@@ -1351,7 +1401,7 @@ var Endpoint = class Endpoint extends require_functions.Function {
 	* ```
 	*/
 	static async buildOpenApiSchema(endpoints, options) {
-		return (0, __geekmidas_schema_openapi.buildOpenApiSchema)(endpoints, options);
+		return (0, _geekmidas_schema_openapi.buildOpenApiSchema)(endpoints, options);
 	}
 	/**
 	* Gets the full path including HTTP method and route.
@@ -1386,6 +1436,14 @@ var Endpoint = class Endpoint extends require_functions.Function {
 		return status >= 200 && status < 300;
 	}
 	/**
+	* Whether `status` sends the client elsewhere. A redirect has no body, so
+	* its response is not checked against the output schema, and what is
+	* derived from the output — declared events and audits — is not sent.
+	*/
+	static isRedirectStatus(status) {
+		return status !== void 0 && status >= 300 && status < 400;
+	}
+	/**
 	* Creates a case-insensitive header lookup function from a headers object.
 	*
 	* @param headers - Object containing header key-value pairs
@@ -1481,12 +1539,11 @@ var Endpoint = class Endpoint extends require_functions.Function {
 	* @internal
 	*/
 	refineInput(ctx) {
-		const input = (0, import_lodash.default)(ctx, [
+		return (0, import_lodash_pick.default)(ctx, [
 			"body",
 			"query",
 			"params"
 		]);
-		return input;
 	}
 	handler = (ctx, response) => {
 		for (const [key, value] of Object.entries(this.defaultHeaders)) response.header(key, value);
@@ -1509,7 +1566,7 @@ var Endpoint = class Endpoint extends require_functions.Function {
 	* @returns True if the object is an Endpoint
 	*/
 	static isEndpoint(obj) {
-		return Boolean(obj && obj.__IS_FUNCTION__ === true && obj.type === require_Construct.ConstructType.Endpoint);
+		return Boolean(obj && obj.__IS_FUNCTION__ === true && obj.type === "dev.geekmidas.function.endpoint");
 	}
 	/**
 	* Helper to check if response has metadata
@@ -1531,17 +1588,23 @@ var Endpoint = class Endpoint extends require_functions.Function {
 	* @returns OpenAPI route definition with operation details
 	*/
 	async toOpenApi3Route(componentCollector) {
+		const status = String(this.status);
 		const operation = {
 			operationId: this.operationId,
 			...this.description && { description: this.description },
 			...this.tags && this.tags.length > 0 && { tags: this.tags },
-			responses: { "200": { description: "Successful response" } }
+			responses: { [status]: { description: "Successful response" } }
 		};
+		const scheme = this.authorizer?.securityScheme;
+		if (this.authorizer && scheme && componentCollector) {
+			componentCollector.addSecurityScheme(this.authorizer.name, scheme);
+			operation.security = [{ [this.authorizer.name]: [] }];
+		}
 		if (this.outputSchema) {
-			const responseSchema = await (0, __geekmidas_schema_conversion.convertSchemaWithComponents)(this.outputSchema, componentCollector);
-			if (responseSchema) (0, import_lodash$1.default)(operation, [
+			const responseSchema = await (0, _geekmidas_schema_conversion.convertSchemaWithComponents)(this.outputSchema, componentCollector);
+			if (responseSchema) (0, import_lodash_set.default)(operation, [
 				"responses",
-				"200",
+				status,
 				"content",
 				this.responseType,
 				"schema"
@@ -1555,14 +1618,14 @@ var Endpoint = class Endpoint extends require_functions.Function {
 				"PUT",
 				"PATCH"
 			].includes(this.method) && "body" in this.input && this.input.body) {
-				const bodySchema = await (0, __geekmidas_schema_conversion.convertSchemaWithComponents)(this.input.body, componentCollector);
-				if (bodySchema) (0, import_lodash$1.default)(operation, ["requestBody"], {
+				const bodySchema = await (0, _geekmidas_schema_conversion.convertSchemaWithComponents)(this.input.body, componentCollector);
+				if (bodySchema) (0, import_lodash_set.default)(operation, ["requestBody"], {
 					required: true,
 					content: { "application/json": { schema: bodySchema } }
 				});
 			}
 			if ("params" in this.input && this.input.params) {
-				const paramsSchema = await (0, __geekmidas_schema_conversion.convertStandardSchemaToJsonSchema)(this.input.params);
+				const paramsSchema = await (0, _geekmidas_schema_conversion.convertStandardSchemaToJsonSchema)(this.input.params);
 				if (paramsSchema && paramsSchema.type === "object" && paramsSchema.properties) for (const [name, schema] of Object.entries(paramsSchema.properties)) pathParameters.push({
 					name,
 					in: "path",
@@ -1571,7 +1634,7 @@ var Endpoint = class Endpoint extends require_functions.Function {
 				});
 			}
 			if ("query" in this.input && this.input.query) {
-				const querySchema = await (0, __geekmidas_schema_conversion.convertStandardSchemaToJsonSchema)(this.input.query);
+				const querySchema = await (0, _geekmidas_schema_conversion.convertStandardSchemaToJsonSchema)(this.input.query);
 				if (querySchema && querySchema.type === "object" && querySchema.properties) for (const [name, schema] of Object.entries(querySchema.properties)) queryParameters.push({
 					name,
 					in: "query",
@@ -1604,8 +1667,8 @@ var Endpoint = class Endpoint extends require_functions.Function {
 	* @param options.status - Success HTTP status code (default: 200)
 	* @param options.authorizer - Optional authorizer configuration
 	*/
-	constructor({ fn, method, route, description, tags, input, logger, output: outputSchema, services, constructs, timeout, memorySize, getSession, authorize, rateLimit, status = SuccessStatus.OK, publisherService, events, authorizer, surface, auditorStorageService, actorExtractor, audits, databaseService, rlsConfig, rlsBypass, responseType }) {
-		super(fn, timeout, require_Construct.ConstructType.Endpoint, input, outputSchema, services, logger, publisherService, events, memorySize, auditorStorageService, void 0, constructs);
+	constructor({ fn, method, route, description, tags, input, logger, output: outputSchema, services, constructs, timeout, memorySize, getSession, authorize, rateLimit, status = 200, events, authorizer, surface, auditorStorageService, actorExtractor, audits, databaseService, rlsConfig, rlsBypass, responseType, telemetry }) {
+		super(fn, timeout, "dev.geekmidas.function.endpoint", input, outputSchema, services, logger, events, memorySize, auditorStorageService, void 0, constructs);
 		this.route = route;
 		this.method = method;
 		this.description = description;
@@ -1613,7 +1676,14 @@ var Endpoint = class Endpoint extends require_functions.Function {
 		this.status = status;
 		this.responseType = responseType ?? "application/json";
 		this.endpointFn = fn;
-		if (getSession) this.getSession = getSession;
+		if (telemetry) this.telemetry = telemetry;
+		if (getSession) {
+			this.hasSession = true;
+			this.getSession = (ctx) => getSession({
+				...ctx,
+				auth: sessionAuth(surface, ctx.header)
+			});
+		}
 		if (authorize) this.authorize = authorize;
 		if (rateLimit) this.rateLimit = rateLimit;
 		if (authorizer) this.authorizer = authorizer;
@@ -1659,6 +1729,27 @@ var ResponseBuilder = class {
 		this.metadata.status = code;
 		return this;
 	}
+	/**
+	* Send the client to `url` — `Location` and a 3xx, with no body. 303 by
+	* default: after a form post, the browser follows it with a GET, so a
+	* reload does not post the form again.
+	*
+	* A redirect is not checked against the endpoint's `.output()` schema, so
+	* an endpoint that renders a page can redirect instead.
+	*
+	* @example
+	* ```typescript
+	* return response.cookie('session', token).redirect('/dashboard');
+	* ```
+	*/
+	redirect(url, status = 303) {
+		this.metadata.headers.location = url;
+		this.metadata.status = status;
+		return {
+			data: void 0,
+			metadata: this.metadata
+		};
+	}
 	send(data) {
 		return {
 			data,
@@ -1672,39 +1763,74 @@ var ResponseBuilder = class {
 /**
 * HTTP success status codes that can be returned by endpoints.
 */
-let SuccessStatus = /* @__PURE__ */ function(SuccessStatus$1) {
+let SuccessStatus = /* @__PURE__ */ function(SuccessStatus) {
 	/** Standard response for successful HTTP requests */
-	SuccessStatus$1[SuccessStatus$1["OK"] = 200] = "OK";
+	SuccessStatus[SuccessStatus["OK"] = 200] = "OK";
 	/** Request has been fulfilled and resulted in a new resource being created */
-	SuccessStatus$1[SuccessStatus$1["Created"] = 201] = "Created";
+	SuccessStatus[SuccessStatus["Created"] = 201] = "Created";
 	/** Request has been accepted for processing, but processing is not complete */
-	SuccessStatus$1[SuccessStatus$1["Accepted"] = 202] = "Accepted";
+	SuccessStatus[SuccessStatus["Accepted"] = 202] = "Accepted";
 	/** Server successfully processed the request but is not returning any content */
-	SuccessStatus$1[SuccessStatus$1["NoContent"] = 204] = "NoContent";
+	SuccessStatus[SuccessStatus["NoContent"] = 204] = "NoContent";
 	/** Server successfully processed the request and is not returning any content, client should reset the document view */
-	SuccessStatus$1[SuccessStatus$1["ResetContent"] = 205] = "ResetContent";
+	SuccessStatus[SuccessStatus["ResetContent"] = 205] = "ResetContent";
 	/** Server is delivering only part of the resource due to a range header */
-	SuccessStatus$1[SuccessStatus$1["PartialContent"] = 206] = "PartialContent";
-	return SuccessStatus$1;
+	SuccessStatus[SuccessStatus["PartialContent"] = 206] = "PartialContent";
+	return SuccessStatus;
+}({});
+/**
+* HTTP redirect status codes an endpoint can answer with —
+* `response.redirect(url, status)`, or `.status()` with a `Location` header.
+*/
+let RedirectStatus = /* @__PURE__ */ function(RedirectStatus) {
+	/** The resource has moved for good; a POST may become a GET */
+	RedirectStatus[RedirectStatus["MovedPermanently"] = 301] = "MovedPermanently";
+	/** The resource is elsewhere for now; a POST may become a GET */
+	RedirectStatus[RedirectStatus["Found"] = 302] = "Found";
+	/** See the resource elsewhere, with a GET — the answer to a form post */
+	RedirectStatus[RedirectStatus["SeeOther"] = 303] = "SeeOther";
+	/** The resource is elsewhere for now; the method and body are kept */
+	RedirectStatus[RedirectStatus["TemporaryRedirect"] = 307] = "TemporaryRedirect";
+	/** The resource has moved for good; the method and body are kept */
+	RedirectStatus[RedirectStatus["PermanentRedirect"] = 308] = "PermanentRedirect";
+	return RedirectStatus;
 }({});
-
 //#endregion
-Object.defineProperty(exports, 'Endpoint', {
-  enumerable: true,
-  get: function () {
-    return Endpoint;
-  }
+Object.defineProperty(exports, "Endpoint", {
+	enumerable: true,
+	get: function() {
+		return Endpoint;
+	}
 });
-Object.defineProperty(exports, 'ResponseBuilder', {
-  enumerable: true,
-  get: function () {
-    return ResponseBuilder;
-  }
+Object.defineProperty(exports, "NoAuthenticator", {
+	enumerable: true,
+	get: function() {
+		return NoAuthenticator;
+	}
 });
-Object.defineProperty(exports, 'require_lodash', {
-  enumerable: true,
-  get: function () {
-    return require_lodash;
-  }
+Object.defineProperty(exports, "RedirectStatus", {
+	enumerable: true,
+	get: function() {
+		return RedirectStatus;
+	}
 });
-//# sourceMappingURL=Endpoint-DcWXE-SZ.cjs.map
+Object.defineProperty(exports, "ResponseBuilder", {
+	enumerable: true,
+	get: function() {
+		return ResponseBuilder;
+	}
+});
+Object.defineProperty(exports, "SuccessStatus", {
+	enumerable: true,
+	get: function() {
+		return SuccessStatus;
+	}
+});
+Object.defineProperty(exports, "require_lodash_set", {
+	enumerable: true,
+	get: function() {
+		return require_lodash_set;
+	}
+});
+
+//# sourceMappingURL=Endpoint-yhR2T2Wt.cjs.map