@geekmidas/constructs 10.0.0-alpha.19 → 10.0.0-alpha.20

package/dist/{construct-interface-DgXTJcOD.d.cts.map → construct-interface-DIaTNKax.d.cts.map}

@@ -1 +1 @@
-{"version":3,"file":"construct-interface-DgXTJcOD.d.cts","names":[],"sources":["../src/construct-interface.ts"],"mappings":";;;;;;;;;;;;UA6BiB,UAAU,+BAA+B;;WAEhD,IAAI;;;;;;;;EASb,WAAW;;;;;;;;WASF,UAAU,mCAEhB,QAAQ,aAAa,QAAQ;;;;;;;;;;;UAYhB,WAAW;WAClB,IAAI;EACb,WAAW;;;;;;;;;;;;;;iBAeI,OAAO,WAAW,aAAa;;KAWnC,MAAM,KACjB,UAAU,wBAAwB,WAAW;;KAGlC,OAAO,KAClB,UAAU,gBAAgB,kBAAkB;;;;;;;;;;;UAY5B,WAAW,+BAA+B;WACjD,IAAI;WACJ,SAAS,QAAQ,aAAa,QAAQ;EAC/C,WAAW;;;;;;;;;;KAWA,WAAW,mBAAmB,mBACxC,WAAW,IAAI,EAAE;;;;;;;;iBAUH,iBAAiB,mBAAmB,cACnD,YAAY,IACV,WAAW;;;;;;;;;;iBAiBE,MACf,qBAAqB,cACrB;;cAMY,sBAAsB;WACb;EAArB,YAAqB;;;;;;;;;iBAsBN,aAAa,iBAAiB,SAAS;;;;;;;;iBAmBvC,UAAU,sBAAsB,SAC/C,QAAQ,WAAW,OAAO,WAAW,QAAQ,OAAO,WAClD,QAAQ,OAAO"}
+{"version":3,"file":"construct-interface-DIaTNKax.d.cts","names":[],"sources":["../src/construct-interface.ts"],"mappings":";;;;;;;;;;;;;UA8BiB,UAAU,+BAA+B;;WAEhD,IAAI;;;;;;;;EASb,WAAW;;;;;;;;WASF,UAAU,mCAEhB,QAAQ,aAAa,QAAQ;;;;;;;;;;;UAYhB,WAAW;WAClB,IAAI;EACb,WAAW;;;;;;;;;;UAWK,cAAc,4BAA4B;EAC1D,OACC,SAAS,SACT,WAAW,wBACT,QAAQ;;;;;;;;;;;;;;iBAeI,OAAO,WAAW,aAAa;;KAWnC,MAAM,KACjB,UAAU,wBAAwB,WAAW;;KAGlC,OAAO,KAClB,UAAU,gBAAgB,kBAAkB;;;;;;;;;;;UAY5B,WAAW,+BAA+B;WACjD,IAAI;WACJ,SAAS,QAAQ,aAAa,QAAQ;EAC/C,WAAW;;;;;;;;;;KAWA,WAAW,mBAAmB,mBACxC,WAAW,IAAI,EAAE;;;;;;;;iBAUH,iBAAiB,mBAAmB,cACnD,YAAY,IACV,WAAW;;;;;;;;;;iBAiBE,MACf,qBAAqB,cACrB;;cAMY,sBAAsB;WACb;EAArB,YAAqB;;;;;;;;;iBAsBN,aAAa,iBAAiB,SAAS;;;;;;;;iBAmBvC,UAAU,sBAAsB,SAC/C,QAAQ,WAAW,OAAO,WAAW,QAAQ,OAAO,WAClD,QAAQ,OAAO"}

package/dist/construct-interface.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"construct-interface.cjs","names":[],"sources":["../src/construct-interface.ts"],"sourcesContent":["/**\n * The construct contract.\n *\n * A construct is three things at once — an infrastructure requirement at build\n * time, a runtime capability, and something other code can consume — which is\n * what forces exactly these three members.\n *\n * An **interface**, not a base class: `Endpoint`, `Cron`, `Queue`, and `Topic`\n * can satisfy it without inheritance surgery, a lifted `Service` can satisfy it\n * as a plain object, and `.dependsOn()` gets its enforcement structurally — a\n * `Service` (`{ serviceName, register }`) simply does not match\n * `{ id, declare, service }`, with no `instanceof` anywhere.\n *\n * Lives in its own module while the existing abstract `Construct` class is\n * still in use; it takes that name once the class is gone.\n */\n\nimport type { Declaration, Dependency } from '@geekmidas/manifest';\nimport type { Service } from '@geekmidas/services';\n\n/**\n * @typeParam TName - the construct's canonical id, PascalCase. Keeping it a\n * literal is what lets the service key be `Uncapitalize<TName>` — a TypeScript\n * intrinsic, so no custom transform needs a runtime twin.\n * @typeParam TClient - what consuming this construct hands you. `never` means it\n * owns no address and cannot be consumed: a `Cron` is fired by a schedule and a\n * `Subscriber` is reached through its topic, so `.dependsOn()` on either is a\n * compile error rather than a stub that throws.\n */\nexport interface Construct<TName extends string = string, TClient = never> {\n\t/** Canonical, PascalCase, unique within the manifest. */\n\treadonly id: TName;\n\n\t/**\n\t * The build-time face: what this construct contributes to the manifest.\n\t *\n\t * Returns an array because some constructs contribute more than one node — a\n\t * queue declares the queue and its worker, a database declares its migrator\n\t * and seeder. Most return one.\n\t */\n\tdeclare(): Declaration[];\n\n\t/**\n\t * The consumable face — the address this construct owns, as a client.\n\t *\n\t * A field assigned once rather than a getter. `Construct.getEnvironment`\n\t * caches by service *object*, and `Topic.publisher` returns a fresh literal\n\t * on every access, so that cache never hits for topics or queues today.\n\t */\n\treadonly service: [TClient] extends [never]\n\t\t? never\n\t\t: Service<Uncapitalize<TName>, TClient>;\n}\n\n/**\n * The build-time face alone — an id and what it contributes to the manifest.\n *\n * Weaker than {@link Consumable} on purpose. An edge is not always an\n * injection: a site depending on an API needs that API's *address at build\n * time* and has no service record to put a client into, so requiring one would\n * make the weakest kind of edge impossible to express with the strongest\n * interface. Discovery asks this same question and nothing more.\n */\nexport interface Declarable<TName extends string = string> {\n\treadonly id: TName;\n\tdeclare(): Declaration[];\n}\n\n/**\n * The edge that points at a construct.\n *\n * A construct's *canonical* node is the one carrying its own id — the others are\n * things it owns rather than things it is, like the signing secret beside an\n * auth server — so the kind an edge records is read off that node instead of\n * being written down beside it. Hand-written kinds are the same fact stated\n * twice, and the copy is what goes stale when a construct changes what it\n * declares.\n *\n * @throws {NotAConstruct} when the value declares nothing under its own id.\n */\nexport function edgeTo(construct: Declarable): Dependency {\n\tconst canonical = construct\n\t\t.declare()\n\t\t.find((declaration) => declaration.id === construct.id);\n\n\tif (!canonical) throw new NotAConstruct(construct);\n\n\treturn { target: construct.id, kind: canonical.kind };\n}\n\n/** What consuming a construct hands you. */\nexport type Infer<C> =\n\tC extends Construct<string, infer TClient> ? TClient : never;\n\n/** A construct's canonical id. */\nexport type NameOf<C> =\n\tC extends Construct<infer TName, unknown> ? TName : never;\n\n/**\n * What `.dependsOn([…])` accepts: a construct that owns a client.\n *\n * Structural, and deliberately narrower than {@link Construct} — it is the\n * face a *consumer* needs, so the builders can accept a database, a bucket, a\n * mail sender, a queue, or a topic without importing any of them. A plain\n * `Service` is not one of these, which is the point: constructs-only confines\n * env sniffing to `.services()` and the explicit lift, so retiring that method\n * retires implicit inference with it.\n */\nexport interface Consumable<TName extends string = string, TClient = unknown> {\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, TClient>;\n\tdeclare(): Declaration[];\n}\n\n/**\n * The services a list of constructs dissolves into.\n *\n * A mapped tuple, so `[db, uploads]` types as `[Service<'orders', Kysely<DB>>,\n * Service<'uploads', StorageClient>]` and the handler's service record gains\n * both keys — the same machinery `.services()` already uses, which is why\n * `dependsOn` needs no type plumbing of its own.\n */\nexport type ServicesOf<T extends readonly Consumable[]> = {\n\t[K in keyof T]: T[K]['service'];\n};\n\n/**\n * The services of a list of constructs, at runtime.\n *\n * @throws {NotAConstruct} when handed something else. The type already refuses\n * it, but a JavaScript caller gets no such warning, and a `Service` slipping\n * through would fail later as an undefined key in the handler.\n */\nexport function servicesOf<const T extends readonly Consumable[]>(\n\tconstructs: T,\n): ServicesOf<T> {\n\treturn constructs.map((construct) => {\n\t\tif (!isConsumable(construct)) throw new NotAConstruct(construct);\n\n\t\treturn construct.service;\n\t}) as ServicesOf<T>;\n}\n\n/**\n * The other half of `servicesOf`: the same edge, as the manifest records it.\n *\n * `.dependsOn()` used to keep only the services, which is what a handler runs\n * with — and an id cannot be recovered from a service name reliably, so the\n * edges were gone by the time the build could read them. Both halves are taken\n * from one call now, and `existing` is folded in so repeated `.dependsOn()`\n * calls accumulate the way `.services()` already does.\n */\nexport function idsOf(\n\tconstructs: readonly Consumable[],\n\texisting: readonly string[] = [],\n): string[] {\n\treturn [...new Set([...existing, ...constructs.map(({ id }) => id)])];\n}\n\n/** Something that is not a construct was passed to `.dependsOn()`. */\nexport class NotAConstruct extends Error {\n\tconstructor(readonly value: unknown) {\n\t\tconst name =\n\t\t\ttypeof value === 'object' && value !== null && 'serviceName' in value\n\t\t\t\t? `the service '${String((value as { serviceName: unknown }).serviceName)}'`\n\t\t\t\t: `a ${typeof value}`;\n\n\t\tsuper(\n\t\t\t`.dependsOn() takes constructs, and was given ${name}. ` +\n\t\t\t\t`Pass it to .services([…]) instead, or lift it with ` +\n\t\t\t\t`Construct.fromService().`,\n\t\t);\n\t\tthis.name = 'NotAConstruct';\n\t}\n}\n\n/**\n * Whether a value is a construct rather than a bare `Service`.\n *\n * Structural rather than `instanceof`: a construct from a second copy of\n * `@geekmidas/constructs` — a linked workspace, two versions in a lockfile — is\n * still a construct, and `instanceof` is exactly the check that says otherwise.\n */\nexport function isConsumable(value: unknown): value is Consumable {\n\tif (typeof value !== 'object' || value === null) return false;\n\n\tconst candidate = value as Partial<Consumable>;\n\n\treturn (\n\t\ttypeof candidate.id === 'string' &&\n\t\ttypeof candidate.declare === 'function' &&\n\t\ttypeof (candidate.service as Service | undefined)?.serviceName === 'string'\n\t);\n}\n\n/**\n * The service behind either face.\n *\n * `.database()` and the publisher slots take a construct now; they took a\n * `Service` before and still do, because a hand-written one is exactly what\n * `Construct.fromService` exists to lift and not everything has been lifted.\n */\nexport function serviceOf<TName extends string, TClient>(\n\tsource: Consumable<TName, TClient> | Service<TName, TClient>,\n): Service<TName, TClient> {\n\t// A construct's service key is `Uncapitalize<TName>` and the slot is typed\n\t// by `TName`; the two describe the same key, and only the cast says so.\n\treturn isConsumable(source)\n\t\t? (source.service as unknown as Service<TName, TClient>)\n\t\t: (source as Service<TName, TClient>);\n}\n"],"mappings":";;;;;;;;;;;;;;AAgFA,SAAgB,OAAO,WAAmC;CACzD,MAAM,YAAY,UAChB,QAAQ,CAAC,CACT,MAAM,gBAAgB,YAAY,OAAO,UAAU,EAAE;CAEvD,IAAI,CAAC,WAAW,MAAM,IAAI,cAAc,SAAS;CAEjD,OAAO;EAAE,QAAQ,UAAU;EAAI,MAAM,UAAU;CAAK;AACrD;;;;;;;;AA6CA,SAAgB,WACf,YACgB;CAChB,OAAO,WAAW,KAAK,cAAc;EACpC,IAAI,CAAC,aAAa,SAAS,GAAG,MAAM,IAAI,cAAc,SAAS;EAE/D,OAAO,UAAU;CAClB,CAAC;AACF;;;;;;;;;;AAWA,SAAgB,MACf,YACA,WAA8B,CAAC,GACpB;CACX,OAAO,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAG,UAAU,GAAG,WAAW,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;AACrE;;AAGA,IAAa,gBAAb,cAAmC,MAAM;CACnB;CAArB,YAAY,OAAyB;EACpC,MAAM,OACL,OAAO,UAAU,YAAY,UAAU,QAAQ,iBAAiB,QAC7D,gBAAgB,OAAQ,MAAmC,WAAW,EAAE,KACxE,KAAK,OAAO;EAEhB,MACC,gDAAgD,KAAK,8EAGtD;EAVoB,KAAA,QAAA;EAWpB,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,SAAgB,aAAa,OAAqC;CACjE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CAExD,MAAM,YAAY;CAElB,OACC,OAAO,UAAU,OAAO,YACxB,OAAO,UAAU,YAAY,cAC7B,OAAQ,UAAU,SAAiC,gBAAgB;AAErE;;;;;;;;AASA,SAAgB,UACf,QAC0B;CAG1B,OAAO,aAAa,MAAM,IACtB,OAAO,UACP;AACL"}
+{"version":3,"file":"construct-interface.cjs","names":[],"sources":["../src/construct-interface.ts"],"sourcesContent":["/**\n * The construct contract.\n *\n * A construct is three things at once — an infrastructure requirement at build\n * time, a runtime capability, and something other code can consume — which is\n * what forces exactly these three members.\n *\n * An **interface**, not a base class: `Endpoint`, `Cron`, `Queue`, and `Topic`\n * can satisfy it without inheritance surgery, a lifted `Service` can satisfy it\n * as a plain object, and `.dependsOn()` gets its enforcement structurally — a\n * `Service` (`{ serviceName, register }`) simply does not match\n * `{ id, declare, service }`, with no `instanceof` anywhere.\n *\n * Lives in its own module while the existing abstract `Construct` class is\n * still in use; it takes that name once the class is gone.\n */\n\nimport type { EnvironmentParser } from '@geekmidas/envkit';\nimport type { Declaration, Dependency } from '@geekmidas/manifest';\nimport type { Service } from '@geekmidas/services';\n\n/**\n * @typeParam TName - the construct's canonical id, PascalCase. Keeping it a\n * literal is what lets the service key be `Uncapitalize<TName>` — a TypeScript\n * intrinsic, so no custom transform needs a runtime twin.\n * @typeParam TClient - what consuming this construct hands you. `never` means it\n * owns no address and cannot be consumed: a `Cron` is fired by a schedule and a\n * `Subscriber` is reached through its topic, so `.dependsOn()` on either is a\n * compile error rather than a stub that throws.\n */\nexport interface Construct<TName extends string = string, TClient = never> {\n\t/** Canonical, PascalCase, unique within the manifest. */\n\treadonly id: TName;\n\n\t/**\n\t * The build-time face: what this construct contributes to the manifest.\n\t *\n\t * Returns an array because some constructs contribute more than one node — a\n\t * queue declares the queue and its worker, a database declares its migrator\n\t * and seeder. Most return one.\n\t */\n\tdeclare(): Declaration[];\n\n\t/**\n\t * The consumable face — the address this construct owns, as a client.\n\t *\n\t * A field assigned once rather than a getter. `Construct.getEnvironment`\n\t * caches by service *object*, and `Topic.publisher` returns a fresh literal\n\t * on every access, so that cache never hits for topics or queues today.\n\t */\n\treadonly service: [TClient] extends [never]\n\t\t? never\n\t\t: Service<Uncapitalize<TName>, TClient>;\n}\n\n/**\n * The build-time face alone — an id and what it contributes to the manifest.\n *\n * Weaker than {@link Consumable} on purpose. An edge is not always an\n * injection: a site depending on an API needs that API's *address at build\n * time* and has no service record to put a client into, so requiring one would\n * make the weakest kind of edge impossible to express with the strongest\n * interface. Discovery asks this same question and nothing more.\n */\nexport interface Declarable<TName extends string = string> {\n\treadonly id: TName;\n\tdeclare(): Declaration[];\n}\n\n/**\n * A construct that authenticates requests — what `RestApi.auth()` takes.\n *\n * `verify` is the one thing every provider shares: given a request's headers,\n * whose request is it — the session, or `null` when there is none. Whether the\n * provider is a server mounted beside the API, deployed elsewhere, or an issuer\n * somebody else runs is its own business; a surface only ever asks this.\n */\nexport interface Authenticator<TSession = unknown> extends Declarable {\n\tverify(\n\t\theaders: Headers,\n\t\tenvParser: EnvironmentParser<{}>,\n\t): Promise<TSession | null>;\n}\n\n/**\n * The edge that points at a construct.\n *\n * A construct's *canonical* node is the one carrying its own id — the others are\n * things it owns rather than things it is, like the signing secret beside an\n * auth server — so the kind an edge records is read off that node instead of\n * being written down beside it. Hand-written kinds are the same fact stated\n * twice, and the copy is what goes stale when a construct changes what it\n * declares.\n *\n * @throws {NotAConstruct} when the value declares nothing under its own id.\n */\nexport function edgeTo(construct: Declarable): Dependency {\n\tconst canonical = construct\n\t\t.declare()\n\t\t.find((declaration) => declaration.id === construct.id);\n\n\tif (!canonical) throw new NotAConstruct(construct);\n\n\treturn { target: construct.id, kind: canonical.kind };\n}\n\n/** What consuming a construct hands you. */\nexport type Infer<C> =\n\tC extends Construct<string, infer TClient> ? TClient : never;\n\n/** A construct's canonical id. */\nexport type NameOf<C> =\n\tC extends Construct<infer TName, unknown> ? TName : never;\n\n/**\n * What `.dependsOn([…])` accepts: a construct that owns a client.\n *\n * Structural, and deliberately narrower than {@link Construct} — it is the\n * face a *consumer* needs, so the builders can accept a database, a bucket, a\n * mail sender, a queue, or a topic without importing any of them. A plain\n * `Service` is not one of these, which is the point: constructs-only confines\n * env sniffing to `.services()` and the explicit lift, so retiring that method\n * retires implicit inference with it.\n */\nexport interface Consumable<TName extends string = string, TClient = unknown> {\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, TClient>;\n\tdeclare(): Declaration[];\n}\n\n/**\n * The services a list of constructs dissolves into.\n *\n * A mapped tuple, so `[db, uploads]` types as `[Service<'orders', Kysely<DB>>,\n * Service<'uploads', StorageClient>]` and the handler's service record gains\n * both keys — the same machinery `.services()` already uses, which is why\n * `dependsOn` needs no type plumbing of its own.\n */\nexport type ServicesOf<T extends readonly Consumable[]> = {\n\t[K in keyof T]: T[K]['service'];\n};\n\n/**\n * The services of a list of constructs, at runtime.\n *\n * @throws {NotAConstruct} when handed something else. The type already refuses\n * it, but a JavaScript caller gets no such warning, and a `Service` slipping\n * through would fail later as an undefined key in the handler.\n */\nexport function servicesOf<const T extends readonly Consumable[]>(\n\tconstructs: T,\n): ServicesOf<T> {\n\treturn constructs.map((construct) => {\n\t\tif (!isConsumable(construct)) throw new NotAConstruct(construct);\n\n\t\treturn construct.service;\n\t}) as ServicesOf<T>;\n}\n\n/**\n * The other half of `servicesOf`: the same edge, as the manifest records it.\n *\n * `.dependsOn()` used to keep only the services, which is what a handler runs\n * with — and an id cannot be recovered from a service name reliably, so the\n * edges were gone by the time the build could read them. Both halves are taken\n * from one call now, and `existing` is folded in so repeated `.dependsOn()`\n * calls accumulate the way `.services()` already does.\n */\nexport function idsOf(\n\tconstructs: readonly Consumable[],\n\texisting: readonly string[] = [],\n): string[] {\n\treturn [...new Set([...existing, ...constructs.map(({ id }) => id)])];\n}\n\n/** Something that is not a construct was passed to `.dependsOn()`. */\nexport class NotAConstruct extends Error {\n\tconstructor(readonly value: unknown) {\n\t\tconst name =\n\t\t\ttypeof value === 'object' && value !== null && 'serviceName' in value\n\t\t\t\t? `the service '${String((value as { serviceName: unknown }).serviceName)}'`\n\t\t\t\t: `a ${typeof value}`;\n\n\t\tsuper(\n\t\t\t`.dependsOn() takes constructs, and was given ${name}. ` +\n\t\t\t\t`Pass it to .services([…]) instead, or lift it with ` +\n\t\t\t\t`Construct.fromService().`,\n\t\t);\n\t\tthis.name = 'NotAConstruct';\n\t}\n}\n\n/**\n * Whether a value is a construct rather than a bare `Service`.\n *\n * Structural rather than `instanceof`: a construct from a second copy of\n * `@geekmidas/constructs` — a linked workspace, two versions in a lockfile — is\n * still a construct, and `instanceof` is exactly the check that says otherwise.\n */\nexport function isConsumable(value: unknown): value is Consumable {\n\tif (typeof value !== 'object' || value === null) return false;\n\n\tconst candidate = value as Partial<Consumable>;\n\n\treturn (\n\t\ttypeof candidate.id === 'string' &&\n\t\ttypeof candidate.declare === 'function' &&\n\t\ttypeof (candidate.service as Service | undefined)?.serviceName === 'string'\n\t);\n}\n\n/**\n * The service behind either face.\n *\n * `.database()` and the publisher slots take a construct now; they took a\n * `Service` before and still do, because a hand-written one is exactly what\n * `Construct.fromService` exists to lift and not everything has been lifted.\n */\nexport function serviceOf<TName extends string, TClient>(\n\tsource: Consumable<TName, TClient> | Service<TName, TClient>,\n): Service<TName, TClient> {\n\t// A construct's service key is `Uncapitalize<TName>` and the slot is typed\n\t// by `TName`; the two describe the same key, and only the cast says so.\n\treturn isConsumable(source)\n\t\t? (source.service as unknown as Service<TName, TClient>)\n\t\t: (source as Service<TName, TClient>);\n}\n"],"mappings":";;;;;;;;;;;;;;AAgGA,SAAgB,OAAO,WAAmC;CACzD,MAAM,YAAY,UAChB,QAAQ,CAAC,CACT,MAAM,gBAAgB,YAAY,OAAO,UAAU,EAAE;CAEvD,IAAI,CAAC,WAAW,MAAM,IAAI,cAAc,SAAS;CAEjD,OAAO;EAAE,QAAQ,UAAU;EAAI,MAAM,UAAU;CAAK;AACrD;;;;;;;;AA6CA,SAAgB,WACf,YACgB;CAChB,OAAO,WAAW,KAAK,cAAc;EACpC,IAAI,CAAC,aAAa,SAAS,GAAG,MAAM,IAAI,cAAc,SAAS;EAE/D,OAAO,UAAU;CAClB,CAAC;AACF;;;;;;;;;;AAWA,SAAgB,MACf,YACA,WAA8B,CAAC,GACpB;CACX,OAAO,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAG,UAAU,GAAG,WAAW,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;AACrE;;AAGA,IAAa,gBAAb,cAAmC,MAAM;CACnB;CAArB,YAAY,OAAyB;EACpC,MAAM,OACL,OAAO,UAAU,YAAY,UAAU,QAAQ,iBAAiB,QAC7D,gBAAgB,OAAQ,MAAmC,WAAW,EAAE,KACxE,KAAK,OAAO;EAEhB,MACC,gDAAgD,KAAK,8EAGtD;EAVoB,KAAA,QAAA;EAWpB,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,SAAgB,aAAa,OAAqC;CACjE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CAExD,MAAM,YAAY;CAElB,OACC,OAAO,UAAU,OAAO,YACxB,OAAO,UAAU,YAAY,cAC7B,OAAQ,UAAU,SAAiC,gBAAgB;AAErE;;;;;;;;AASA,SAAgB,UACf,QAC0B;CAG1B,OAAO,aAAa,MAAM,IACtB,OAAO,UACP;AACL"}

package/dist/construct-interface.d.cts

@@ -1,2 +1,2 @@
-import { a as NameOf, c as edgeTo, d as serviceOf, f as servicesOf, i as Infer, l as idsOf, n as Consumable, o as NotAConstruct, r as Declarable, s as ServicesOf, t as Construct, u as isConsumable } from "./construct-interface-DgXTJcOD.cjs";
-export { Construct, Consumable, Declarable, Infer, NameOf, NotAConstruct, ServicesOf, edgeTo, idsOf, isConsumable, serviceOf, servicesOf };
+import { a as Infer, c as ServicesOf, d as isConsumable, f as serviceOf, i as Declarable, l as edgeTo, n as Construct, o as NameOf, p as servicesOf, r as Consumable, s as NotAConstruct, t as Authenticator, u as idsOf } from "./construct-interface-DIaTNKax.cjs";
+export { Authenticator, Construct, Consumable, Declarable, Infer, NameOf, NotAConstruct, ServicesOf, edgeTo, idsOf, isConsumable, serviceOf, servicesOf };

package/dist/construct-interface.d.mts

@@ -1,2 +1,2 @@
-import { a as NameOf, c as edgeTo, d as serviceOf, f as servicesOf, i as Infer, l as idsOf, n as Consumable, o as NotAConstruct, r as Declarable, s as ServicesOf, t as Construct, u as isConsumable } from "./construct-interface-DPlxfpoS.mjs";
-export { Construct, Consumable, Declarable, Infer, NameOf, NotAConstruct, ServicesOf, edgeTo, idsOf, isConsumable, serviceOf, servicesOf };
+import { a as Infer, c as ServicesOf, d as isConsumable, f as serviceOf, i as Declarable, l as edgeTo, n as Construct, o as NameOf, p as servicesOf, r as Consumable, s as NotAConstruct, t as Authenticator, u as idsOf } from "./construct-interface-Clz7_BwB.mjs";
+export { Authenticator, Construct, Consumable, Declarable, Infer, NameOf, NotAConstruct, ServicesOf, edgeTo, idsOf, isConsumable, serviceOf, servicesOf };

package/dist/construct-interface.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"construct-interface.mjs","names":[],"sources":["../src/construct-interface.ts"],"sourcesContent":["/**\n * The construct contract.\n *\n * A construct is three things at once — an infrastructure requirement at build\n * time, a runtime capability, and something other code can consume — which is\n * what forces exactly these three members.\n *\n * An **interface**, not a base class: `Endpoint`, `Cron`, `Queue`, and `Topic`\n * can satisfy it without inheritance surgery, a lifted `Service` can satisfy it\n * as a plain object, and `.dependsOn()` gets its enforcement structurally — a\n * `Service` (`{ serviceName, register }`) simply does not match\n * `{ id, declare, service }`, with no `instanceof` anywhere.\n *\n * Lives in its own module while the existing abstract `Construct` class is\n * still in use; it takes that name once the class is gone.\n */\n\nimport type { Declaration, Dependency } from '@geekmidas/manifest';\nimport type { Service } from '@geekmidas/services';\n\n/**\n * @typeParam TName - the construct's canonical id, PascalCase. Keeping it a\n * literal is what lets the service key be `Uncapitalize<TName>` — a TypeScript\n * intrinsic, so no custom transform needs a runtime twin.\n * @typeParam TClient - what consuming this construct hands you. `never` means it\n * owns no address and cannot be consumed: a `Cron` is fired by a schedule and a\n * `Subscriber` is reached through its topic, so `.dependsOn()` on either is a\n * compile error rather than a stub that throws.\n */\nexport interface Construct<TName extends string = string, TClient = never> {\n\t/** Canonical, PascalCase, unique within the manifest. */\n\treadonly id: TName;\n\n\t/**\n\t * The build-time face: what this construct contributes to the manifest.\n\t *\n\t * Returns an array because some constructs contribute more than one node — a\n\t * queue declares the queue and its worker, a database declares its migrator\n\t * and seeder. Most return one.\n\t */\n\tdeclare(): Declaration[];\n\n\t/**\n\t * The consumable face — the address this construct owns, as a client.\n\t *\n\t * A field assigned once rather than a getter. `Construct.getEnvironment`\n\t * caches by service *object*, and `Topic.publisher` returns a fresh literal\n\t * on every access, so that cache never hits for topics or queues today.\n\t */\n\treadonly service: [TClient] extends [never]\n\t\t? never\n\t\t: Service<Uncapitalize<TName>, TClient>;\n}\n\n/**\n * The build-time face alone — an id and what it contributes to the manifest.\n *\n * Weaker than {@link Consumable} on purpose. An edge is not always an\n * injection: a site depending on an API needs that API's *address at build\n * time* and has no service record to put a client into, so requiring one would\n * make the weakest kind of edge impossible to express with the strongest\n * interface. Discovery asks this same question and nothing more.\n */\nexport interface Declarable<TName extends string = string> {\n\treadonly id: TName;\n\tdeclare(): Declaration[];\n}\n\n/**\n * The edge that points at a construct.\n *\n * A construct's *canonical* node is the one carrying its own id — the others are\n * things it owns rather than things it is, like the signing secret beside an\n * auth server — so the kind an edge records is read off that node instead of\n * being written down beside it. Hand-written kinds are the same fact stated\n * twice, and the copy is what goes stale when a construct changes what it\n * declares.\n *\n * @throws {NotAConstruct} when the value declares nothing under its own id.\n */\nexport function edgeTo(construct: Declarable): Dependency {\n\tconst canonical = construct\n\t\t.declare()\n\t\t.find((declaration) => declaration.id === construct.id);\n\n\tif (!canonical) throw new NotAConstruct(construct);\n\n\treturn { target: construct.id, kind: canonical.kind };\n}\n\n/** What consuming a construct hands you. */\nexport type Infer<C> =\n\tC extends Construct<string, infer TClient> ? TClient : never;\n\n/** A construct's canonical id. */\nexport type NameOf<C> =\n\tC extends Construct<infer TName, unknown> ? TName : never;\n\n/**\n * What `.dependsOn([…])` accepts: a construct that owns a client.\n *\n * Structural, and deliberately narrower than {@link Construct} — it is the\n * face a *consumer* needs, so the builders can accept a database, a bucket, a\n * mail sender, a queue, or a topic without importing any of them. A plain\n * `Service` is not one of these, which is the point: constructs-only confines\n * env sniffing to `.services()` and the explicit lift, so retiring that method\n * retires implicit inference with it.\n */\nexport interface Consumable<TName extends string = string, TClient = unknown> {\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, TClient>;\n\tdeclare(): Declaration[];\n}\n\n/**\n * The services a list of constructs dissolves into.\n *\n * A mapped tuple, so `[db, uploads]` types as `[Service<'orders', Kysely<DB>>,\n * Service<'uploads', StorageClient>]` and the handler's service record gains\n * both keys — the same machinery `.services()` already uses, which is why\n * `dependsOn` needs no type plumbing of its own.\n */\nexport type ServicesOf<T extends readonly Consumable[]> = {\n\t[K in keyof T]: T[K]['service'];\n};\n\n/**\n * The services of a list of constructs, at runtime.\n *\n * @throws {NotAConstruct} when handed something else. The type already refuses\n * it, but a JavaScript caller gets no such warning, and a `Service` slipping\n * through would fail later as an undefined key in the handler.\n */\nexport function servicesOf<const T extends readonly Consumable[]>(\n\tconstructs: T,\n): ServicesOf<T> {\n\treturn constructs.map((construct) => {\n\t\tif (!isConsumable(construct)) throw new NotAConstruct(construct);\n\n\t\treturn construct.service;\n\t}) as ServicesOf<T>;\n}\n\n/**\n * The other half of `servicesOf`: the same edge, as the manifest records it.\n *\n * `.dependsOn()` used to keep only the services, which is what a handler runs\n * with — and an id cannot be recovered from a service name reliably, so the\n * edges were gone by the time the build could read them. Both halves are taken\n * from one call now, and `existing` is folded in so repeated `.dependsOn()`\n * calls accumulate the way `.services()` already does.\n */\nexport function idsOf(\n\tconstructs: readonly Consumable[],\n\texisting: readonly string[] = [],\n): string[] {\n\treturn [...new Set([...existing, ...constructs.map(({ id }) => id)])];\n}\n\n/** Something that is not a construct was passed to `.dependsOn()`. */\nexport class NotAConstruct extends Error {\n\tconstructor(readonly value: unknown) {\n\t\tconst name =\n\t\t\ttypeof value === 'object' && value !== null && 'serviceName' in value\n\t\t\t\t? `the service '${String((value as { serviceName: unknown }).serviceName)}'`\n\t\t\t\t: `a ${typeof value}`;\n\n\t\tsuper(\n\t\t\t`.dependsOn() takes constructs, and was given ${name}. ` +\n\t\t\t\t`Pass it to .services([…]) instead, or lift it with ` +\n\t\t\t\t`Construct.fromService().`,\n\t\t);\n\t\tthis.name = 'NotAConstruct';\n\t}\n}\n\n/**\n * Whether a value is a construct rather than a bare `Service`.\n *\n * Structural rather than `instanceof`: a construct from a second copy of\n * `@geekmidas/constructs` — a linked workspace, two versions in a lockfile — is\n * still a construct, and `instanceof` is exactly the check that says otherwise.\n */\nexport function isConsumable(value: unknown): value is Consumable {\n\tif (typeof value !== 'object' || value === null) return false;\n\n\tconst candidate = value as Partial<Consumable>;\n\n\treturn (\n\t\ttypeof candidate.id === 'string' &&\n\t\ttypeof candidate.declare === 'function' &&\n\t\ttypeof (candidate.service as Service | undefined)?.serviceName === 'string'\n\t);\n}\n\n/**\n * The service behind either face.\n *\n * `.database()` and the publisher slots take a construct now; they took a\n * `Service` before and still do, because a hand-written one is exactly what\n * `Construct.fromService` exists to lift and not everything has been lifted.\n */\nexport function serviceOf<TName extends string, TClient>(\n\tsource: Consumable<TName, TClient> | Service<TName, TClient>,\n): Service<TName, TClient> {\n\t// A construct's service key is `Uncapitalize<TName>` and the slot is typed\n\t// by `TName`; the two describe the same key, and only the cast says so.\n\treturn isConsumable(source)\n\t\t? (source.service as unknown as Service<TName, TClient>)\n\t\t: (source as Service<TName, TClient>);\n}\n"],"mappings":";;;;;;;;;;;;;AAgFA,SAAgB,OAAO,WAAmC;CACzD,MAAM,YAAY,UAChB,QAAQ,CAAC,CACT,MAAM,gBAAgB,YAAY,OAAO,UAAU,EAAE;CAEvD,IAAI,CAAC,WAAW,MAAM,IAAI,cAAc,SAAS;CAEjD,OAAO;EAAE,QAAQ,UAAU;EAAI,MAAM,UAAU;CAAK;AACrD;;;;;;;;AA6CA,SAAgB,WACf,YACgB;CAChB,OAAO,WAAW,KAAK,cAAc;EACpC,IAAI,CAAC,aAAa,SAAS,GAAG,MAAM,IAAI,cAAc,SAAS;EAE/D,OAAO,UAAU;CAClB,CAAC;AACF;;;;;;;;;;AAWA,SAAgB,MACf,YACA,WAA8B,CAAC,GACpB;CACX,OAAO,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAG,UAAU,GAAG,WAAW,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;AACrE;;AAGA,IAAa,gBAAb,cAAmC,MAAM;CACnB;CAArB,YAAY,OAAyB;EACpC,MAAM,OACL,OAAO,UAAU,YAAY,UAAU,QAAQ,iBAAiB,QAC7D,gBAAgB,OAAQ,MAAmC,WAAW,EAAE,KACxE,KAAK,OAAO;EAEhB,MACC,gDAAgD,KAAK,8EAGtD;EAVoB,KAAA,QAAA;EAWpB,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,SAAgB,aAAa,OAAqC;CACjE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CAExD,MAAM,YAAY;CAElB,OACC,OAAO,UAAU,OAAO,YACxB,OAAO,UAAU,YAAY,cAC7B,OAAQ,UAAU,SAAiC,gBAAgB;AAErE;;;;;;;;AASA,SAAgB,UACf,QAC0B;CAG1B,OAAO,aAAa,MAAM,IACtB,OAAO,UACP;AACL"}
+{"version":3,"file":"construct-interface.mjs","names":[],"sources":["../src/construct-interface.ts"],"sourcesContent":["/**\n * The construct contract.\n *\n * A construct is three things at once — an infrastructure requirement at build\n * time, a runtime capability, and something other code can consume — which is\n * what forces exactly these three members.\n *\n * An **interface**, not a base class: `Endpoint`, `Cron`, `Queue`, and `Topic`\n * can satisfy it without inheritance surgery, a lifted `Service` can satisfy it\n * as a plain object, and `.dependsOn()` gets its enforcement structurally — a\n * `Service` (`{ serviceName, register }`) simply does not match\n * `{ id, declare, service }`, with no `instanceof` anywhere.\n *\n * Lives in its own module while the existing abstract `Construct` class is\n * still in use; it takes that name once the class is gone.\n */\n\nimport type { EnvironmentParser } from '@geekmidas/envkit';\nimport type { Declaration, Dependency } from '@geekmidas/manifest';\nimport type { Service } from '@geekmidas/services';\n\n/**\n * @typeParam TName - the construct's canonical id, PascalCase. Keeping it a\n * literal is what lets the service key be `Uncapitalize<TName>` — a TypeScript\n * intrinsic, so no custom transform needs a runtime twin.\n * @typeParam TClient - what consuming this construct hands you. `never` means it\n * owns no address and cannot be consumed: a `Cron` is fired by a schedule and a\n * `Subscriber` is reached through its topic, so `.dependsOn()` on either is a\n * compile error rather than a stub that throws.\n */\nexport interface Construct<TName extends string = string, TClient = never> {\n\t/** Canonical, PascalCase, unique within the manifest. */\n\treadonly id: TName;\n\n\t/**\n\t * The build-time face: what this construct contributes to the manifest.\n\t *\n\t * Returns an array because some constructs contribute more than one node — a\n\t * queue declares the queue and its worker, a database declares its migrator\n\t * and seeder. Most return one.\n\t */\n\tdeclare(): Declaration[];\n\n\t/**\n\t * The consumable face — the address this construct owns, as a client.\n\t *\n\t * A field assigned once rather than a getter. `Construct.getEnvironment`\n\t * caches by service *object*, and `Topic.publisher` returns a fresh literal\n\t * on every access, so that cache never hits for topics or queues today.\n\t */\n\treadonly service: [TClient] extends [never]\n\t\t? never\n\t\t: Service<Uncapitalize<TName>, TClient>;\n}\n\n/**\n * The build-time face alone — an id and what it contributes to the manifest.\n *\n * Weaker than {@link Consumable} on purpose. An edge is not always an\n * injection: a site depending on an API needs that API's *address at build\n * time* and has no service record to put a client into, so requiring one would\n * make the weakest kind of edge impossible to express with the strongest\n * interface. Discovery asks this same question and nothing more.\n */\nexport interface Declarable<TName extends string = string> {\n\treadonly id: TName;\n\tdeclare(): Declaration[];\n}\n\n/**\n * A construct that authenticates requests — what `RestApi.auth()` takes.\n *\n * `verify` is the one thing every provider shares: given a request's headers,\n * whose request is it — the session, or `null` when there is none. Whether the\n * provider is a server mounted beside the API, deployed elsewhere, or an issuer\n * somebody else runs is its own business; a surface only ever asks this.\n */\nexport interface Authenticator<TSession = unknown> extends Declarable {\n\tverify(\n\t\theaders: Headers,\n\t\tenvParser: EnvironmentParser<{}>,\n\t): Promise<TSession | null>;\n}\n\n/**\n * The edge that points at a construct.\n *\n * A construct's *canonical* node is the one carrying its own id — the others are\n * things it owns rather than things it is, like the signing secret beside an\n * auth server — so the kind an edge records is read off that node instead of\n * being written down beside it. Hand-written kinds are the same fact stated\n * twice, and the copy is what goes stale when a construct changes what it\n * declares.\n *\n * @throws {NotAConstruct} when the value declares nothing under its own id.\n */\nexport function edgeTo(construct: Declarable): Dependency {\n\tconst canonical = construct\n\t\t.declare()\n\t\t.find((declaration) => declaration.id === construct.id);\n\n\tif (!canonical) throw new NotAConstruct(construct);\n\n\treturn { target: construct.id, kind: canonical.kind };\n}\n\n/** What consuming a construct hands you. */\nexport type Infer<C> =\n\tC extends Construct<string, infer TClient> ? TClient : never;\n\n/** A construct's canonical id. */\nexport type NameOf<C> =\n\tC extends Construct<infer TName, unknown> ? TName : never;\n\n/**\n * What `.dependsOn([…])` accepts: a construct that owns a client.\n *\n * Structural, and deliberately narrower than {@link Construct} — it is the\n * face a *consumer* needs, so the builders can accept a database, a bucket, a\n * mail sender, a queue, or a topic without importing any of them. A plain\n * `Service` is not one of these, which is the point: constructs-only confines\n * env sniffing to `.services()` and the explicit lift, so retiring that method\n * retires implicit inference with it.\n */\nexport interface Consumable<TName extends string = string, TClient = unknown> {\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, TClient>;\n\tdeclare(): Declaration[];\n}\n\n/**\n * The services a list of constructs dissolves into.\n *\n * A mapped tuple, so `[db, uploads]` types as `[Service<'orders', Kysely<DB>>,\n * Service<'uploads', StorageClient>]` and the handler's service record gains\n * both keys — the same machinery `.services()` already uses, which is why\n * `dependsOn` needs no type plumbing of its own.\n */\nexport type ServicesOf<T extends readonly Consumable[]> = {\n\t[K in keyof T]: T[K]['service'];\n};\n\n/**\n * The services of a list of constructs, at runtime.\n *\n * @throws {NotAConstruct} when handed something else. The type already refuses\n * it, but a JavaScript caller gets no such warning, and a `Service` slipping\n * through would fail later as an undefined key in the handler.\n */\nexport function servicesOf<const T extends readonly Consumable[]>(\n\tconstructs: T,\n): ServicesOf<T> {\n\treturn constructs.map((construct) => {\n\t\tif (!isConsumable(construct)) throw new NotAConstruct(construct);\n\n\t\treturn construct.service;\n\t}) as ServicesOf<T>;\n}\n\n/**\n * The other half of `servicesOf`: the same edge, as the manifest records it.\n *\n * `.dependsOn()` used to keep only the services, which is what a handler runs\n * with — and an id cannot be recovered from a service name reliably, so the\n * edges were gone by the time the build could read them. Both halves are taken\n * from one call now, and `existing` is folded in so repeated `.dependsOn()`\n * calls accumulate the way `.services()` already does.\n */\nexport function idsOf(\n\tconstructs: readonly Consumable[],\n\texisting: readonly string[] = [],\n): string[] {\n\treturn [...new Set([...existing, ...constructs.map(({ id }) => id)])];\n}\n\n/** Something that is not a construct was passed to `.dependsOn()`. */\nexport class NotAConstruct extends Error {\n\tconstructor(readonly value: unknown) {\n\t\tconst name =\n\t\t\ttypeof value === 'object' && value !== null && 'serviceName' in value\n\t\t\t\t? `the service '${String((value as { serviceName: unknown }).serviceName)}'`\n\t\t\t\t: `a ${typeof value}`;\n\n\t\tsuper(\n\t\t\t`.dependsOn() takes constructs, and was given ${name}. ` +\n\t\t\t\t`Pass it to .services([…]) instead, or lift it with ` +\n\t\t\t\t`Construct.fromService().`,\n\t\t);\n\t\tthis.name = 'NotAConstruct';\n\t}\n}\n\n/**\n * Whether a value is a construct rather than a bare `Service`.\n *\n * Structural rather than `instanceof`: a construct from a second copy of\n * `@geekmidas/constructs` — a linked workspace, two versions in a lockfile — is\n * still a construct, and `instanceof` is exactly the check that says otherwise.\n */\nexport function isConsumable(value: unknown): value is Consumable {\n\tif (typeof value !== 'object' || value === null) return false;\n\n\tconst candidate = value as Partial<Consumable>;\n\n\treturn (\n\t\ttypeof candidate.id === 'string' &&\n\t\ttypeof candidate.declare === 'function' &&\n\t\ttypeof (candidate.service as Service | undefined)?.serviceName === 'string'\n\t);\n}\n\n/**\n * The service behind either face.\n *\n * `.database()` and the publisher slots take a construct now; they took a\n * `Service` before and still do, because a hand-written one is exactly what\n * `Construct.fromService` exists to lift and not everything has been lifted.\n */\nexport function serviceOf<TName extends string, TClient>(\n\tsource: Consumable<TName, TClient> | Service<TName, TClient>,\n): Service<TName, TClient> {\n\t// A construct's service key is `Uncapitalize<TName>` and the slot is typed\n\t// by `TName`; the two describe the same key, and only the cast says so.\n\treturn isConsumable(source)\n\t\t? (source.service as unknown as Service<TName, TClient>)\n\t\t: (source as Service<TName, TClient>);\n}\n"],"mappings":";;;;;;;;;;;;;AAgGA,SAAgB,OAAO,WAAmC;CACzD,MAAM,YAAY,UAChB,QAAQ,CAAC,CACT,MAAM,gBAAgB,YAAY,OAAO,UAAU,EAAE;CAEvD,IAAI,CAAC,WAAW,MAAM,IAAI,cAAc,SAAS;CAEjD,OAAO;EAAE,QAAQ,UAAU;EAAI,MAAM,UAAU;CAAK;AACrD;;;;;;;;AA6CA,SAAgB,WACf,YACgB;CAChB,OAAO,WAAW,KAAK,cAAc;EACpC,IAAI,CAAC,aAAa,SAAS,GAAG,MAAM,IAAI,cAAc,SAAS;EAE/D,OAAO,UAAU;CAClB,CAAC;AACF;;;;;;;;;;AAWA,SAAgB,MACf,YACA,WAA8B,CAAC,GACpB;CACX,OAAO,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAG,UAAU,GAAG,WAAW,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;AACrE;;AAGA,IAAa,gBAAb,cAAmC,MAAM;CACnB;CAArB,YAAY,OAAyB;EACpC,MAAM,OACL,OAAO,UAAU,YAAY,UAAU,QAAQ,iBAAiB,QAC7D,gBAAgB,OAAQ,MAAmC,WAAW,EAAE,KACxE,KAAK,OAAO;EAEhB,MACC,gDAAgD,KAAK,8EAGtD;EAVoB,KAAA,QAAA;EAWpB,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,SAAgB,aAAa,OAAqC;CACjE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CAExD,MAAM,YAAY;CAElB,OACC,OAAO,UAAU,OAAO,YACxB,OAAO,UAAU,YAAY,cAC7B,OAAQ,UAAU,SAAiC,gBAAgB;AAErE;;;;;;;;AASA,SAAgB,UACf,QAC0B;CAG1B,OAAO,aAAa,MAAM,IACtB,OAAO,UACP;AACL"}

package/dist/credential.d.cts

@@ -1,5 +1,5 @@
 import { t as StandardSchemaV1 } from "./index-CeEtxDmK.cjs";
-import { n as Consumable } from "./construct-interface-DgXTJcOD.cjs";
+import { r as Consumable } from "./construct-interface-DIaTNKax.cjs";
 import { Service } from "@geekmidas/services";
 import { ConstructName, Declaration } from "@geekmidas/manifest";
 //#region src/credential.d.ts

package/dist/credential.d.mts

@@ -1,5 +1,5 @@
 import { t as StandardSchemaV1 } from "./index-CeEtxDmK.mjs";
-import { n as Consumable } from "./construct-interface-DPlxfpoS.mjs";
+import { r as Consumable } from "./construct-interface-Clz7_BwB.mjs";
 import { ConstructName, Declaration } from "@geekmidas/manifest";
 import { Service } from "@geekmidas/services";
 //#region src/credential.d.ts

package/dist/crons/index.d.cts

@@ -1,5 +1,5 @@
-import { i as ScheduleExpression, n as CronExpression, r as RateExpression, t as Cron } from "../Cron-szLBpMSi.cjs";
-import { t as CronBuilder } from "../CronBuilder-kqU9icLS.cjs";
+import { i as ScheduleExpression, n as CronExpression, r as RateExpression, t as Cron } from "../Cron-Bdcg9OAL.cjs";
+import { t as CronBuilder } from "../CronBuilder-DR21m9h2.cjs";
 //#region src/crons/schedule.d.ts
 /**
  * A schedule a cron runner can take, as standard five-field cron.

package/dist/crons/index.d.mts

@@ -1,5 +1,5 @@
-import { i as ScheduleExpression, n as CronExpression, r as RateExpression, t as Cron } from "../Cron-DFFsKfMQ.mjs";
-import { t as CronBuilder } from "../CronBuilder-Czxh8nnD.mjs";
+import { i as ScheduleExpression, n as CronExpression, r as RateExpression, t as Cron } from "../Cron-AYpQq725.mjs";
+import { t as CronBuilder } from "../CronBuilder-DeBnPVIT.mjs";
 //#region src/crons/schedule.d.ts
 /**
  * A schedule a cron runner can take, as standard five-field cron.

package/dist/database/kysely.d.cts

@@ -1,4 +1,4 @@
-import { t as Construct } from "../construct-interface-DgXTJcOD.cjs";
+import { n as Construct } from "../construct-interface-DIaTNKax.cjs";
 import { Cache } from "../cache.cjs";
 import { Service } from "@geekmidas/services";
 import { ConstructName, Declaration, PostgresVersion } from "@geekmidas/manifest";

package/dist/database/kysely.d.mts

@@ -1,4 +1,4 @@
-import { t as Construct } from "../construct-interface-DPlxfpoS.mjs";
+import { n as Construct } from "../construct-interface-Clz7_BwB.mjs";
 import { Cache } from "../cache.mjs";
 import { ConstructName, Declaration, PostgresVersion } from "@geekmidas/manifest";
 import { Kysely, KyselyConfig } from "kysely";

package/dist/email.d.cts

@@ -1,4 +1,4 @@
-import { t as Construct } from "./construct-interface-DgXTJcOD.cjs";
+import { n as Construct } from "./construct-interface-DIaTNKax.cjs";
 import { Service } from "@geekmidas/services";
 import { ConstructName, Declaration } from "@geekmidas/manifest";
 import { EmailClient, TemplateRecord } from "@geekmidas/emailkit";

package/dist/email.d.mts

@@ -1,4 +1,4 @@
-import { t as Construct } from "./construct-interface-DPlxfpoS.mjs";
+import { n as Construct } from "./construct-interface-Clz7_BwB.mjs";
 import { ConstructName, Declaration } from "@geekmidas/manifest";
 import { EmailClient, TemplateRecord } from "@geekmidas/emailkit";
 import { Service } from "@geekmidas/services";

package/dist/endpoints/index.cjs

@@ -1,12 +1,13 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_EndpointFactory = require("../EndpointFactory-BTj1GjZd.cjs");
-const require_Endpoint = require("../Endpoint-DDRSyB7y.cjs");
+const require_EndpointFactory = require("../EndpointFactory-vE2C1NG1.cjs");
+const require_Endpoint = require("../Endpoint-CtiPUpRX.cjs");
 const require_surfaceEnv = require("../surfaceEnv-CNimK76p.cjs");
 const require_lazyAccessors = require("../lazyAccessors-Dx9NLwJZ.cjs");
 exports.BUILT_IN_SECURITY_SCHEMES = require_EndpointFactory.BUILT_IN_SECURITY_SCHEMES;
 exports.Endpoint = require_Endpoint.Endpoint;
 exports.EndpointBuilder = require_EndpointFactory.EndpointBuilder;
 exports.EndpointFactory = require_EndpointFactory.EndpointFactory;
+exports.NoAuthenticator = require_Endpoint.NoAuthenticator;
 exports.RLS_BYPASS = require_EndpointFactory.RLS_BYPASS;
 exports.ResponseBuilder = require_Endpoint.ResponseBuilder;
 exports.createApiGatewayCookies = require_lazyAccessors.createApiGatewayCookies;

package/dist/endpoints/index.d.cts

@@ -1,7 +1,7 @@
 import { t as StandardSchemaV1 } from "../index-CeEtxDmK.cjs";
 import { t as Construct } from "../Construct-DTqYvkPG.cjs";
-import { C as OAuthFlow, D as getSecurityScheme, E as createAuthorizer, O as isBuiltInSecurityScheme, S as BuiltInSecuritySchemeId, T as SecurityScheme, _ as RlsContextExtractor, a as EndpointHandler, b as Authorizer, c as EndpointSurface, g as RlsContext, h as RlsConfig, i as EndpointContext, l as HeaderFn, m as RlsBypass, n as CookieFn, o as EndpointOutput, p as RLS_BYPASS, r as Endpoint, s as EndpointSchemas, u as ResponseBuilder, v as ActorExtractor, w as OAuthFlows, x as BUILT_IN_SECURITY_SCHEMES, y as MappedAudit } from "../Endpoint-DlGPQpsH.cjs";
-import { n as EndpointBuilder, t as EndpointFactory } from "../EndpointFactory-BG6DLRJH.cjs";
+import { A as getSecurityScheme, C as Authorizer, D as OAuthFlows, E as OAuthFlow, O as SecurityScheme, S as MappedAudit, T as BuiltInSecuritySchemeId, _ as RlsBypass, a as EndpointContext, b as RlsContextExtractor, c as EndpointSchemas, d as ResponseBuilder, g as RLS_BYPASS, h as SessionAuth, i as Endpoint, j as isBuiltInSecurityScheme, k as createAuthorizer, l as EndpointSurface, m as NoAuthenticator, n as ConvertRouteParams, o as EndpointHandler, r as CookieFn, s as EndpointOutput, u as HeaderFn, v as RlsConfig, w as BUILT_IN_SECURITY_SCHEMES, x as ActorExtractor, y as RlsContext } from "../Endpoint-DbYQJgb-.cjs";
+import { n as EndpointBuilder, t as EndpointFactory } from "../EndpointFactory-DE6nKtFZ.cjs";
 import { EnvironmentParser } from "@geekmidas/envkit";
 import { EventPublisher, MappedEvent } from "@geekmidas/events";
 import { Logger } from "@geekmidas/logger";
@@ -56,5 +56,5 @@ export declare function defaultEnvParser(): EnvironmentParser<{}>;
 /** The parser for an endpoint, from its surface or the default. */
 export declare function envParserFor(surface: EndpointSurface | undefined): EnvironmentParser<{}>;
 //#endregion
-export { type ActorExtractor, type Authorizer, BUILT_IN_SECURITY_SCHEMES, type BuiltInSecuritySchemeId, Endpoint, EndpointBuilder, type EndpointContext, EndpointFactory, type EndpointHandler, type EndpointOutput, type EndpointSchemas, type MappedAudit, type OAuthFlow, type OAuthFlows, RLS_BYPASS, ResponseBuilder, type RlsBypass, type RlsConfig, type RlsContext, type RlsContextExtractor, type SecurityScheme, createAuthorizer, getSecurityScheme, isBuiltInSecurityScheme };
+export { type ActorExtractor, type Authorizer, BUILT_IN_SECURITY_SCHEMES, type BuiltInSecuritySchemeId, type ConvertRouteParams, Endpoint, EndpointBuilder, type EndpointContext, EndpointFactory, type EndpointHandler, type EndpointOutput, type EndpointSchemas, type MappedAudit, NoAuthenticator, type OAuthFlow, type OAuthFlows, RLS_BYPASS, ResponseBuilder, type RlsBypass, type RlsConfig, type RlsContext, type RlsContextExtractor, type SecurityScheme, type SessionAuth, createAuthorizer, getSecurityScheme, isBuiltInSecurityScheme };
 //# sourceMappingURL=index.d.cts.map

package/dist/endpoints/index.d.mts

@@ -1,7 +1,7 @@
 import { t as StandardSchemaV1 } from "../index-CeEtxDmK.mjs";
 import { t as Construct } from "../Construct-pVadmURD.mjs";
-import { C as OAuthFlow, D as getSecurityScheme, E as createAuthorizer, O as isBuiltInSecurityScheme, S as BuiltInSecuritySchemeId, T as SecurityScheme, _ as RlsContextExtractor, a as EndpointHandler, b as Authorizer, c as EndpointSurface, g as RlsContext, h as RlsConfig, i as EndpointContext, l as HeaderFn, m as RlsBypass, n as CookieFn, o as EndpointOutput, p as RLS_BYPASS, r as Endpoint, s as EndpointSchemas, u as ResponseBuilder, v as ActorExtractor, w as OAuthFlows, x as BUILT_IN_SECURITY_SCHEMES, y as MappedAudit } from "../Endpoint-DVBog_2-.mjs";
-import { n as EndpointBuilder, t as EndpointFactory } from "../EndpointFactory-CrZXVjna.mjs";
+import { A as getSecurityScheme, C as Authorizer, D as OAuthFlows, E as OAuthFlow, O as SecurityScheme, S as MappedAudit, T as BuiltInSecuritySchemeId, _ as RlsBypass, a as EndpointContext, b as RlsContextExtractor, c as EndpointSchemas, d as ResponseBuilder, g as RLS_BYPASS, h as SessionAuth, i as Endpoint, j as isBuiltInSecurityScheme, k as createAuthorizer, l as EndpointSurface, m as NoAuthenticator, n as ConvertRouteParams, o as EndpointHandler, r as CookieFn, s as EndpointOutput, u as HeaderFn, v as RlsConfig, w as BUILT_IN_SECURITY_SCHEMES, x as ActorExtractor, y as RlsContext } from "../Endpoint-BxkRWQ8G.mjs";
+import { n as EndpointBuilder, t as EndpointFactory } from "../EndpointFactory-T06kTFHg.mjs";
 import { EnvironmentParser } from "@geekmidas/envkit";
 import { EventPublisher, MappedEvent } from "@geekmidas/events";
 import { Service, ServiceDiscovery } from "@geekmidas/services";
@@ -56,5 +56,5 @@ export declare function defaultEnvParser(): EnvironmentParser<{}>;
 /** The parser for an endpoint, from its surface or the default. */
 export declare function envParserFor(surface: EndpointSurface | undefined): EnvironmentParser<{}>;
 //#endregion
-export { type ActorExtractor, type Authorizer, BUILT_IN_SECURITY_SCHEMES, type BuiltInSecuritySchemeId, Endpoint, EndpointBuilder, type EndpointContext, EndpointFactory, type EndpointHandler, type EndpointOutput, type EndpointSchemas, type MappedAudit, type OAuthFlow, type OAuthFlows, RLS_BYPASS, ResponseBuilder, type RlsBypass, type RlsConfig, type RlsContext, type RlsContextExtractor, type SecurityScheme, createAuthorizer, getSecurityScheme, isBuiltInSecurityScheme };
+export { type ActorExtractor, type Authorizer, BUILT_IN_SECURITY_SCHEMES, type BuiltInSecuritySchemeId, type ConvertRouteParams, Endpoint, EndpointBuilder, type EndpointContext, EndpointFactory, type EndpointHandler, type EndpointOutput, type EndpointSchemas, type MappedAudit, NoAuthenticator, type OAuthFlow, type OAuthFlows, RLS_BYPASS, ResponseBuilder, type RlsBypass, type RlsConfig, type RlsContext, type RlsContextExtractor, type SecurityScheme, type SessionAuth, createAuthorizer, getSecurityScheme, isBuiltInSecurityScheme };
 //# sourceMappingURL=index.d.mts.map

package/dist/endpoints/index.mjs

@@ -1,5 +1,5 @@
-import { a as createAuthorizer, i as BUILT_IN_SECURITY_SCHEMES, n as EndpointBuilder, o as getSecurityScheme, r as RLS_BYPASS, s as isBuiltInSecurityScheme, t as EndpointFactory } from "../EndpointFactory-o_15B_ka.mjs";
-import { n as ResponseBuilder, t as Endpoint } from "../Endpoint-BIpXUxNf.mjs";
+import { a as createAuthorizer, i as BUILT_IN_SECURITY_SCHEMES, n as EndpointBuilder, o as getSecurityScheme, r as RLS_BYPASS, s as isBuiltInSecurityScheme, t as EndpointFactory } from "../EndpointFactory-Bs8pu-yY.mjs";
+import { n as ResponseBuilder, r as NoAuthenticator, t as Endpoint } from "../Endpoint-DCr5tlbJ.mjs";
 import { n as envParserFor, t as defaultEnvParser } from "../surfaceEnv-wMT5QzgZ.mjs";
 import { a as createHonoHeaders, i as createHonoCookies, l as publishConstructEvents, n as createApiGatewayHeaders, o as createNoopCookies, s as createNoopHeaders, t as createApiGatewayCookies } from "../lazyAccessors-BHtcqgz2.mjs";
-export { BUILT_IN_SECURITY_SCHEMES, Endpoint, EndpointBuilder, EndpointFactory, RLS_BYPASS, ResponseBuilder, createApiGatewayCookies, createApiGatewayHeaders, createAuthorizer, createHonoCookies, createHonoHeaders, createNoopCookies, createNoopHeaders, defaultEnvParser, envParserFor, getSecurityScheme, isBuiltInSecurityScheme, publishConstructEvents };
+export { BUILT_IN_SECURITY_SCHEMES, Endpoint, EndpointBuilder, EndpointFactory, NoAuthenticator, RLS_BYPASS, ResponseBuilder, createApiGatewayCookies, createApiGatewayHeaders, createAuthorizer, createHonoCookies, createHonoHeaders, createNoopCookies, createNoopHeaders, defaultEnvParser, envParserFor, getSecurityScheme, isBuiltInSecurityScheme, publishConstructEvents };

package/dist/file-server.d.cts

@@ -1,4 +1,4 @@
-import { r as Declarable, t as Construct } from "./construct-interface-DgXTJcOD.cjs";
+import { i as Declarable, n as Construct } from "./construct-interface-DIaTNKax.cjs";
 import { Service } from "@geekmidas/services";
 import { ConstructName, Declaration } from "@geekmidas/manifest";
 import { StorageClient } from "@geekmidas/storage";

package/dist/file-server.d.mts

@@ -1,4 +1,4 @@
-import { r as Declarable, t as Construct } from "./construct-interface-DPlxfpoS.mjs";
+import { i as Declarable, n as Construct } from "./construct-interface-Clz7_BwB.mjs";
 import { ConstructName, Declaration } from "@geekmidas/manifest";
 import { StorageClient } from "@geekmidas/storage";
 import { Service } from "@geekmidas/services";

package/dist/functions/index.d.cts

@@ -1,2 +1,2 @@
-import { a as FunctionHandler, i as FunctionContext, n as BaseFunctionBuilder, r as Function, t as FunctionBuilder } from "../index-D9gxXK1m.cjs";
+import { a as FunctionHandler, i as FunctionContext, n as BaseFunctionBuilder, r as Function, t as FunctionBuilder } from "../index-nBQT1tAh.cjs";
 export { BaseFunctionBuilder, Function, FunctionBuilder, type FunctionContext, type FunctionHandler };

package/dist/functions/index.d.mts

@@ -1,2 +1,2 @@
-import { a as FunctionHandler, i as FunctionContext, n as BaseFunctionBuilder, r as Function, t as FunctionBuilder } from "../index-Df4DrCZd.mjs";
+import { a as FunctionHandler, i as FunctionContext, n as BaseFunctionBuilder, r as Function, t as FunctionBuilder } from "../index-DU3Twmwh.mjs";
 export { BaseFunctionBuilder, Function, FunctionBuilder, type FunctionContext, type FunctionHandler };

package/dist/{index-Df4DrCZd.d.mts → index-DU3Twmwh.d.mts}

@@ -1,6 +1,6 @@
 import { t as StandardSchemaV1 } from "./index-CeEtxDmK.mjs";
 import { n as ConstructType, t as Construct } from "./Construct-pVadmURD.mjs";
-import { n as Consumable, s as ServicesOf } from "./construct-interface-DPlxfpoS.mjs";
+import { c as ServicesOf, r as Consumable } from "./construct-interface-Clz7_BwB.mjs";
 import { EventPublisher, MappedEvent } from "@geekmidas/events";
 import { Service, ServiceRecord } from "@geekmidas/services";
 import { AuditStorage, AuditableAction, Auditor } from "@geekmidas/audit";
@@ -162,4 +162,4 @@ declare class FunctionBuilder<TInput extends ComposableStandardSchema, OutSchema
 }
 //#endregion
 export { FunctionHandler as a, FunctionContext as i, BaseFunctionBuilder as n, Function as r, FunctionBuilder as t };
-//# sourceMappingURL=index-Df4DrCZd.d.mts.map
+//# sourceMappingURL=index-DU3Twmwh.d.mts.map

package/dist/{index-D9gxXK1m.d.cts.map → index-DU3Twmwh.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"index-D9gxXK1m.d.cts","names":[],"sources":["../src/functions/Function.ts","../src/functions/BaseFunctionBuilder.ts","../src/functions/FunctionBuilder.ts"],"mappings":";;;;;;;;;cA+Ca,SACZ,eAAe,kDACf,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,kBAAkB,0CAClB,wBAAwB,6CACxB,oDACA,sBAAsB,sCACtB,kDACA,uBACA,8CACA,qBAAqB,mCAAmC,kCAIxD,WAAW,gBACV,QACA,WACA,SACA,WACA,WACA,eACA,gBACG,gBACH,QACA,WACA,SACA,WACA,WACA,eACA,uBAEQ,UACT,SACA,4BACA,iBACA,WACA,WACA,0BACA;WAyDiB,IAAI;EAGb,QAAQ;EAQC,kBAAkB,QAAQ,sBAAsB;EAlEjE;SAEO,WAAW,WAAW,OAAO;;;;;;;;SAe7B,SAAS,UAAU,kBAAkB,QAAQ,GAAG,gBAAa,QAAA,iBAAA,mBAAA,iBAAA;;;;;;;;;SAYvD,YAAY,UAAU,kBAClC,QAAQ,GACR,gBACE,QAAQ,oBAAoB;;;;;;;;EAezB,YAAY,kBAAkB,QAAQ,oBAAoB;EAOhE,YACiB,IAAI,IACpB;IACA,OAAM,eACC,QAAQ,oBACf,eAAe,WACf,WAAU,WACV,SAAQ,SACR,mBAAmB,QAAQ,4BAA4B,kBACvD,SAAQ,YAAY,iBAAiB,cACrC,qBACA,wBAAwB,QAAQ,0BAA0B,gBAC1C,kBAAkB,QAAQ,sBAAsB,YAKhE;;;;;EAAA;;KAiBU,gBACX,eAAe,kDACf,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,kBAAkB,0CAClB,uBACA,sBAAsB,sCACtB,qBAAqB,mCAAmC,qCAKxD,KAAK,gBACJ,QACA,WACA,SACA,WACA,eACA,kBAEG,kBAAkB,mBACpB,oBAAoB,aAAa,QAAQ,oBAAoB,oBACvD;;;;KAKJ,gBAAgB,aAAa;EAE7B,IAAI;;;;;KAKJ,eACJ,qBAAqB,mCAAmC,kCAIxD,6BACG;;;;;EAOD,SAAS,QAAQ;;KAGR,gBACX,cAAc,kDACd,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,uBACA,sBAAsB,sCACtB,qBAAqB,mCAAmC;EAKxD,UAAU,cAAc;EACxB,QAAQ;EACR,OAAO,8BAA8B;IAClC,gBAAgB,aACnB,eAAe,cAAc;;;uBClOR,oBACrB,eAAe,0BACf,kBAAkB,0CAClB,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,wBAAwB,6CACxB,oDACA,sBAAsB,sCACtB,kDACA,uBACA;EAkFmB,MAAI;YAhFb,cAAc;YACd,eAAe;YACf;EAEH,WAAW;;;;;;;;;EASX;EACA,SAAS;;;;;;;EAQT;;;;;;;;EASA;YAEG,SAAS,YAAY,iBAAiB;YACtC,aAAa,QAAQ,4BAA4B;YACjD,kBAAkB,QAAQ,0BAA0B;YACpD,mBAAmB,QAAQ,sBAAsB;SAEpD,mBAAmB,aAAa,KAAK;SAM/B,8BACZ,UAAU,sCACT,eAAe,QAAQ,IAAI,QAAQ,8BAA8B;EAkCnE,YAAmB,OAAI;WAEd,SAAS,UAAU,WAAW,UAAU;WAExC,OAAO,UAAU,QAAQ,QAAQ;EAE1C,QAAQ;WAIC,OAAO,UAAU,kBAAkB,QAAQ;WAE3C,MAAM,UAAU,0BAA0B,QAAQ;EAE3D,MAAM,eAAe,YAAY,iBAAiB,YACjD,OAAO;EAOR,UAAU,UAAU,qBAAqB,sBACxC,WAAW,QAAQ,OAAO,KACxB,oBACF,QACA,WACA,WACA,SACA,GACA,OACA,eACA,0BACA,WACA;EAqBD,QAAQ,UAAU,cAAc,sBAC/B,SAAS,QAAQ,OAAO,KACtB,oBACF,QACA,WACA,WACA,SACA,iBACA,4BACA,GACA,OACA,WACA;;;;;EAyBD,SAAS,GAAG,sBACX,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,oBACF,QACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,GACA;;;;cChMW,gBACZ,eAAe,0BACf,kBAAkB,0CAClB,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,wBAAwB,6CACxB,oDACA,sBAAsB,sCACtB,kDACA,uBACA,8CACA,qBAAqB,mCAAmC,0CAI/C,oBACT,QACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,WACA;EAI4B,MAAI;YAFtB;EAEV,YAA4B,OAAI;EAIvB,QAAQ;EAIjB,WAAW;EAIX,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,GACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;EAmBD,MAAM,UAAU,0BACf,QAAQ,IACN,gBACF,GACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;;;;;;;;;;;;EA8BD,gBAAgB,mBAAmB,cAClC,YAAY,IACV,gBACF,QACA,eACI,cAAc,WAAW,KAC7B,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;EAgCD,SAAS,UAAU,WAClB,UAAU,IACR,gBACF,QACA,eACI,cAAc,IAClB,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;EAsBD,OAAO,UAAU,QAChB,QAAQ,IACN,gBACF,QACA,WACA,WACA,GACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;EAmBQ,UAAU,UAAU,qBAAqB,sBACjD,WAAW,QAAQ,OAAO,KACxB,gBACF,QACA,WACA,WACA,SACA,GACA,OACA,eACA,0BACA,WACA,sBACA;EAsBQ,QAAQ,UAAU,cAAc,sBACxC,SAAS,QAAQ,OAAO,KACtB,gBACF,QACA,WACA,WACA,SACA,iBACA,4BACA,GACA,OACA,WACA,sBACA;;;;;EA0BD,QAAQ,UAAU,qCAAqC,gBACtD,QACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;;;;;EAqBQ,SAAS,GAAG,sBACpB,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,gBACF,QACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,GACA,OACA;EAwBD,OACC,IAAI,gBACH,QACA,WACA,SACA,WACA,WACA,eACA,gBAEC,SACF,QACA,WACA,SACA,WACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA,cACA,gBACC,QACA,WACA,SACA,WACA,WACA,eACA"}
+{"version":3,"file":"index-DU3Twmwh.d.mts","names":[],"sources":["../src/functions/Function.ts","../src/functions/BaseFunctionBuilder.ts","../src/functions/FunctionBuilder.ts"],"mappings":";;;;;;;;;cA+Ca,SACZ,eAAe,kDACf,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,kBAAkB,0CAClB,wBAAwB,6CACxB,oDACA,sBAAsB,sCACtB,kDACA,uBACA,8CACA,qBAAqB,mCAAmC,kCAIxD,WAAW,gBACV,QACA,WACA,SACA,WACA,WACA,eACA,gBACG,gBACH,QACA,WACA,SACA,WACA,WACA,eACA,uBAEQ,UACT,SACA,4BACA,iBACA,WACA,WACA,0BACA;WAyDiB,IAAI;EAGb,QAAQ;EAQC,kBAAkB,QAAQ,sBAAsB;EAlEjE;SAEO,WAAW,WAAW,OAAO;;;;;;;;SAe7B,SAAS,UAAU,kBAAkB,QAAQ,GAAG,gBAAa,QAAA,iBAAA,mBAAA,iBAAA;;;;;;;;;SAYvD,YAAY,UAAU,kBAClC,QAAQ,GACR,gBACE,QAAQ,oBAAoB;;;;;;;;EAezB,YAAY,kBAAkB,QAAQ,oBAAoB;EAOhE,YACiB,IAAI,IACpB;IACA,OAAM,eACC,QAAQ,oBACf,eAAe,WACf,WAAU,WACV,SAAQ,SACR,mBAAmB,QAAQ,4BAA4B,kBACvD,SAAQ,YAAY,iBAAiB,cACrC,qBACA,wBAAwB,QAAQ,0BAA0B,gBAC1C,kBAAkB,QAAQ,sBAAsB,YAKhE;;;;;EAAA;;KAiBU,gBACX,eAAe,kDACf,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,kBAAkB,0CAClB,uBACA,sBAAsB,sCACtB,qBAAqB,mCAAmC,qCAKxD,KAAK,gBACJ,QACA,WACA,SACA,WACA,eACA,kBAEG,kBAAkB,mBACpB,oBAAoB,aAAa,QAAQ,oBAAoB,oBACvD;;;;KAKJ,gBAAgB,aAAa;EAE7B,IAAI;;;;;KAKJ,eACJ,qBAAqB,mCAAmC,kCAIxD,6BACG;;;;;EAOD,SAAS,QAAQ;;KAGR,gBACX,cAAc,kDACd,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,uBACA,sBAAsB,sCACtB,qBAAqB,mCAAmC;EAKxD,UAAU,cAAc;EACxB,QAAQ;EACR,OAAO,8BAA8B;IAClC,gBAAgB,aACnB,eAAe,cAAc;;;uBClOR,oBACrB,eAAe,0BACf,kBAAkB,0CAClB,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,wBAAwB,6CACxB,oDACA,sBAAsB,sCACtB,kDACA,uBACA;EAkFmB,MAAI;YAhFb,cAAc;YACd,eAAe;YACf;EAEH,WAAW;;;;;;;;;EASX;EACA,SAAS;;;;;;;EAQT;;;;;;;;EASA;YAEG,SAAS,YAAY,iBAAiB;YACtC,aAAa,QAAQ,4BAA4B;YACjD,kBAAkB,QAAQ,0BAA0B;YACpD,mBAAmB,QAAQ,sBAAsB;SAEpD,mBAAmB,aAAa,KAAK;SAM/B,8BACZ,UAAU,sCACT,eAAe,QAAQ,IAAI,QAAQ,8BAA8B;EAkCnE,YAAmB,OAAI;WAEd,SAAS,UAAU,WAAW,UAAU;WAExC,OAAO,UAAU,QAAQ,QAAQ;EAE1C,QAAQ;WAIC,OAAO,UAAU,kBAAkB,QAAQ;WAE3C,MAAM,UAAU,0BAA0B,QAAQ;EAE3D,MAAM,eAAe,YAAY,iBAAiB,YACjD,OAAO;EAOR,UAAU,UAAU,qBAAqB,sBACxC,WAAW,QAAQ,OAAO,KACxB,oBACF,QACA,WACA,WACA,SACA,GACA,OACA,eACA,0BACA,WACA;EAqBD,QAAQ,UAAU,cAAc,sBAC/B,SAAS,QAAQ,OAAO,KACtB,oBACF,QACA,WACA,WACA,SACA,iBACA,4BACA,GACA,OACA,WACA;;;;;EAyBD,SAAS,GAAG,sBACX,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,oBACF,QACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,GACA;;;;cChMW,gBACZ,eAAe,0BACf,kBAAkB,0CAClB,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,wBAAwB,6CACxB,oDACA,sBAAsB,sCACtB,kDACA,uBACA,8CACA,qBAAqB,mCAAmC,0CAI/C,oBACT,QACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,WACA;EAI4B,MAAI;YAFtB;EAEV,YAA4B,OAAI;EAIvB,QAAQ;EAIjB,WAAW;EAIX,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,GACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;EAmBD,MAAM,UAAU,0BACf,QAAQ,IACN,gBACF,GACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;;;;;;;;;;;;EA8BD,gBAAgB,mBAAmB,cAClC,YAAY,IACV,gBACF,QACA,eACI,cAAc,WAAW,KAC7B,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;EAgCD,SAAS,UAAU,WAClB,UAAU,IACR,gBACF,QACA,eACI,cAAc,IAClB,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;EAsBD,OAAO,UAAU,QAChB,QAAQ,IACN,gBACF,QACA,WACA,WACA,GACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;EAmBQ,UAAU,UAAU,qBAAqB,sBACjD,WAAW,QAAQ,OAAO,KACxB,gBACF,QACA,WACA,WACA,SACA,GACA,OACA,eACA,0BACA,WACA,sBACA;EAsBQ,QAAQ,UAAU,cAAc,sBACxC,SAAS,QAAQ,OAAO,KACtB,gBACF,QACA,WACA,WACA,SACA,iBACA,4BACA,GACA,OACA,WACA,sBACA;;;;;EA0BD,QAAQ,UAAU,qCAAqC,gBACtD,QACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;;;;;EAqBQ,SAAS,GAAG,sBACpB,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,gBACF,QACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,GACA,OACA;EAwBD,OACC,IAAI,gBACH,QACA,WACA,SACA,WACA,WACA,eACA,gBAEC,SACF,QACA,WACA,SACA,WACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA,cACA,gBACC,QACA,WACA,SACA,WACA,WACA,eACA"}

package/dist/{index-D9gxXK1m.d.cts → index-nBQT1tAh.d.cts}

@@ -1,6 +1,6 @@
 import { t as StandardSchemaV1 } from "./index-CeEtxDmK.cjs";
 import { n as ConstructType, t as Construct } from "./Construct-DTqYvkPG.cjs";
-import { n as Consumable, s as ServicesOf } from "./construct-interface-DgXTJcOD.cjs";
+import { c as ServicesOf, r as Consumable } from "./construct-interface-DIaTNKax.cjs";
 import { EventPublisher, MappedEvent } from "@geekmidas/events";
 import { Logger } from "@geekmidas/logger";
 import { ComposableStandardSchema, InferComposableStandardSchema, InferStandardSchema } from "@geekmidas/schema";
@@ -162,4 +162,4 @@ declare class FunctionBuilder<TInput extends ComposableStandardSchema, OutSchema
 }
 //#endregion
 export { FunctionHandler as a, FunctionContext as i, BaseFunctionBuilder as n, Function as r, FunctionBuilder as t };
-//# sourceMappingURL=index-D9gxXK1m.d.cts.map
+//# sourceMappingURL=index-nBQT1tAh.d.cts.map

package/dist/{index-Df4DrCZd.d.mts.map → index-nBQT1tAh.d.cts.map}

@@ -1 +1 @@
-{"version":3,"file":"index-Df4DrCZd.d.mts","names":[],"sources":["../src/functions/Function.ts","../src/functions/BaseFunctionBuilder.ts","../src/functions/FunctionBuilder.ts"],"mappings":";;;;;;;;;cA+Ca,SACZ,eAAe,kDACf,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,kBAAkB,0CAClB,wBAAwB,6CACxB,oDACA,sBAAsB,sCACtB,kDACA,uBACA,8CACA,qBAAqB,mCAAmC,kCAIxD,WAAW,gBACV,QACA,WACA,SACA,WACA,WACA,eACA,gBACG,gBACH,QACA,WACA,SACA,WACA,WACA,eACA,uBAEQ,UACT,SACA,4BACA,iBACA,WACA,WACA,0BACA;WAyDiB,IAAI;EAGb,QAAQ;EAQC,kBAAkB,QAAQ,sBAAsB;EAlEjE;SAEO,WAAW,WAAW,OAAO;;;;;;;;SAe7B,SAAS,UAAU,kBAAkB,QAAQ,GAAG,gBAAa,QAAA,iBAAA,mBAAA,iBAAA;;;;;;;;;SAYvD,YAAY,UAAU,kBAClC,QAAQ,GACR,gBACE,QAAQ,oBAAoB;;;;;;;;EAezB,YAAY,kBAAkB,QAAQ,oBAAoB;EAOhE,YACiB,IAAI,IACpB;IACA,OAAM,eACC,QAAQ,oBACf,eAAe,WACf,WAAU,WACV,SAAQ,SACR,mBAAmB,QAAQ,4BAA4B,kBACvD,SAAQ,YAAY,iBAAiB,cACrC,qBACA,wBAAwB,QAAQ,0BAA0B,gBAC1C,kBAAkB,QAAQ,sBAAsB,YAKhE;;;;;EAAA;;KAiBU,gBACX,eAAe,kDACf,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,kBAAkB,0CAClB,uBACA,sBAAsB,sCACtB,qBAAqB,mCAAmC,qCAKxD,KAAK,gBACJ,QACA,WACA,SACA,WACA,eACA,kBAEG,kBAAkB,mBACpB,oBAAoB,aAAa,QAAQ,oBAAoB,oBACvD;;;;KAKJ,gBAAgB,aAAa;EAE7B,IAAI;;;;;KAKJ,eACJ,qBAAqB,mCAAmC,kCAIxD,6BACG;;;;;EAOD,SAAS,QAAQ;;KAGR,gBACX,cAAc,kDACd,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,uBACA,sBAAsB,sCACtB,qBAAqB,mCAAmC;EAKxD,UAAU,cAAc;EACxB,QAAQ;EACR,OAAO,8BAA8B;IAClC,gBAAgB,aACnB,eAAe,cAAc;;;uBClOR,oBACrB,eAAe,0BACf,kBAAkB,0CAClB,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,wBAAwB,6CACxB,oDACA,sBAAsB,sCACtB,kDACA,uBACA;EAkFmB,MAAI;YAhFb,cAAc;YACd,eAAe;YACf;EAEH,WAAW;;;;;;;;;EASX;EACA,SAAS;;;;;;;EAQT;;;;;;;;EASA;YAEG,SAAS,YAAY,iBAAiB;YACtC,aAAa,QAAQ,4BAA4B;YACjD,kBAAkB,QAAQ,0BAA0B;YACpD,mBAAmB,QAAQ,sBAAsB;SAEpD,mBAAmB,aAAa,KAAK;SAM/B,8BACZ,UAAU,sCACT,eAAe,QAAQ,IAAI,QAAQ,8BAA8B;EAkCnE,YAAmB,OAAI;WAEd,SAAS,UAAU,WAAW,UAAU;WAExC,OAAO,UAAU,QAAQ,QAAQ;EAE1C,QAAQ;WAIC,OAAO,UAAU,kBAAkB,QAAQ;WAE3C,MAAM,UAAU,0BAA0B,QAAQ;EAE3D,MAAM,eAAe,YAAY,iBAAiB,YACjD,OAAO;EAOR,UAAU,UAAU,qBAAqB,sBACxC,WAAW,QAAQ,OAAO,KACxB,oBACF,QACA,WACA,WACA,SACA,GACA,OACA,eACA,0BACA,WACA;EAqBD,QAAQ,UAAU,cAAc,sBAC/B,SAAS,QAAQ,OAAO,KACtB,oBACF,QACA,WACA,WACA,SACA,iBACA,4BACA,GACA,OACA,WACA;;;;;EAyBD,SAAS,GAAG,sBACX,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,oBACF,QACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,GACA;;;;cChMW,gBACZ,eAAe,0BACf,kBAAkB,0CAClB,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,wBAAwB,6CACxB,oDACA,sBAAsB,sCACtB,kDACA,uBACA,8CACA,qBAAqB,mCAAmC,0CAI/C,oBACT,QACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,WACA;EAI4B,MAAI;YAFtB;EAEV,YAA4B,OAAI;EAIvB,QAAQ;EAIjB,WAAW;EAIX,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,GACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;EAmBD,MAAM,UAAU,0BACf,QAAQ,IACN,gBACF,GACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;;;;;;;;;;;;EA8BD,gBAAgB,mBAAmB,cAClC,YAAY,IACV,gBACF,QACA,eACI,cAAc,WAAW,KAC7B,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;EAgCD,SAAS,UAAU,WAClB,UAAU,IACR,gBACF,QACA,eACI,cAAc,IAClB,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;EAsBD,OAAO,UAAU,QAChB,QAAQ,IACN,gBACF,QACA,WACA,WACA,GACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;EAmBQ,UAAU,UAAU,qBAAqB,sBACjD,WAAW,QAAQ,OAAO,KACxB,gBACF,QACA,WACA,WACA,SACA,GACA,OACA,eACA,0BACA,WACA,sBACA;EAsBQ,QAAQ,UAAU,cAAc,sBACxC,SAAS,QAAQ,OAAO,KACtB,gBACF,QACA,WACA,WACA,SACA,iBACA,4BACA,GACA,OACA,WACA,sBACA;;;;;EA0BD,QAAQ,UAAU,qCAAqC,gBACtD,QACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;;;;;EAqBQ,SAAS,GAAG,sBACpB,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,gBACF,QACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,GACA,OACA;EAwBD,OACC,IAAI,gBACH,QACA,WACA,SACA,WACA,WACA,eACA,gBAEC,SACF,QACA,WACA,SACA,WACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA,cACA,gBACC,QACA,WACA,SACA,WACA,WACA,eACA"}
+{"version":3,"file":"index-nBQT1tAh.d.cts","names":[],"sources":["../src/functions/Function.ts","../src/functions/BaseFunctionBuilder.ts","../src/functions/FunctionBuilder.ts"],"mappings":";;;;;;;;;cA+Ca,SACZ,eAAe,kDACf,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,kBAAkB,0CAClB,wBAAwB,6CACxB,oDACA,sBAAsB,sCACtB,kDACA,uBACA,8CACA,qBAAqB,mCAAmC,kCAIxD,WAAW,gBACV,QACA,WACA,SACA,WACA,WACA,eACA,gBACG,gBACH,QACA,WACA,SACA,WACA,WACA,eACA,uBAEQ,UACT,SACA,4BACA,iBACA,WACA,WACA,0BACA;WAyDiB,IAAI;EAGb,QAAQ;EAQC,kBAAkB,QAAQ,sBAAsB;EAlEjE;SAEO,WAAW,WAAW,OAAO;;;;;;;;SAe7B,SAAS,UAAU,kBAAkB,QAAQ,GAAG,gBAAa,QAAA,iBAAA,mBAAA,iBAAA;;;;;;;;;SAYvD,YAAY,UAAU,kBAClC,QAAQ,GACR,gBACE,QAAQ,oBAAoB;;;;;;;;EAezB,YAAY,kBAAkB,QAAQ,oBAAoB;EAOhE,YACiB,IAAI,IACpB;IACA,OAAM,eACC,QAAQ,oBACf,eAAe,WACf,WAAU,WACV,SAAQ,SACR,mBAAmB,QAAQ,4BAA4B,kBACvD,SAAQ,YAAY,iBAAiB,cACrC,qBACA,wBAAwB,QAAQ,0BAA0B,gBAC1C,kBAAkB,QAAQ,sBAAsB,YAKhE;;;;;EAAA;;KAiBU,gBACX,eAAe,kDACf,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,kBAAkB,0CAClB,uBACA,sBAAsB,sCACtB,qBAAqB,mCAAmC,qCAKxD,KAAK,gBACJ,QACA,WACA,SACA,WACA,eACA,kBAEG,kBAAkB,mBACpB,oBAAoB,aAAa,QAAQ,oBAAoB,oBACvD;;;;KAKJ,gBAAgB,aAAa;EAE7B,IAAI;;;;;KAKJ,eACJ,qBAAqB,mCAAmC,kCAIxD,6BACG;;;;;EAOD,SAAS,QAAQ;;KAGR,gBACX,cAAc,kDACd,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,uBACA,sBAAsB,sCACtB,qBAAqB,mCAAmC;EAKxD,UAAU,cAAc;EACxB,QAAQ;EACR,OAAO,8BAA8B;IAClC,gBAAgB,aACnB,eAAe,cAAc;;;uBClOR,oBACrB,eAAe,0BACf,kBAAkB,0CAClB,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,wBAAwB,6CACxB,oDACA,sBAAsB,sCACtB,kDACA,uBACA;EAkFmB,MAAI;YAhFb,cAAc;YACd,eAAe;YACf;EAEH,WAAW;;;;;;;;;EASX;EACA,SAAS;;;;;;;EAQT;;;;;;;;EASA;YAEG,SAAS,YAAY,iBAAiB;YACtC,aAAa,QAAQ,4BAA4B;YACjD,kBAAkB,QAAQ,0BAA0B;YACpD,mBAAmB,QAAQ,sBAAsB;SAEpD,mBAAmB,aAAa,KAAK;SAM/B,8BACZ,UAAU,sCACT,eAAe,QAAQ,IAAI,QAAQ,8BAA8B;EAkCnE,YAAmB,OAAI;WAEd,SAAS,UAAU,WAAW,UAAU;WAExC,OAAO,UAAU,QAAQ,QAAQ;EAE1C,QAAQ;WAIC,OAAO,UAAU,kBAAkB,QAAQ;WAE3C,MAAM,UAAU,0BAA0B,QAAQ;EAE3D,MAAM,eAAe,YAAY,iBAAiB,YACjD,OAAO;EAOR,UAAU,UAAU,qBAAqB,sBACxC,WAAW,QAAQ,OAAO,KACxB,oBACF,QACA,WACA,WACA,SACA,GACA,OACA,eACA,0BACA,WACA;EAqBD,QAAQ,UAAU,cAAc,sBAC/B,SAAS,QAAQ,OAAO,KACtB,oBACF,QACA,WACA,WACA,SACA,iBACA,4BACA,GACA,OACA,WACA;;;;;EAyBD,SAAS,GAAG,sBACX,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,oBACF,QACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,GACA;;;;cChMW,gBACZ,eAAe,0BACf,kBAAkB,0CAClB,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,wBAAwB,6CACxB,oDACA,sBAAsB,sCACtB,kDACA,uBACA,8CACA,qBAAqB,mCAAmC,0CAI/C,oBACT,QACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,WACA;EAI4B,MAAI;YAFtB;EAEV,YAA4B,OAAI;EAIvB,QAAQ;EAIjB,WAAW;EAIX,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,GACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;EAmBD,MAAM,UAAU,0BACf,QAAQ,IACN,gBACF,GACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;;;;;;;;;;;;EA8BD,gBAAgB,mBAAmB,cAClC,YAAY,IACV,gBACF,QACA,eACI,cAAc,WAAW,KAC7B,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;EAgCD,SAAS,UAAU,WAClB,UAAU,IACR,gBACF,QACA,eACI,cAAc,IAClB,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;EAsBD,OAAO,UAAU,QAChB,QAAQ,IACN,gBACF,QACA,WACA,WACA,GACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;EAmBQ,UAAU,UAAU,qBAAqB,sBACjD,WAAW,QAAQ,OAAO,KACxB,gBACF,QACA,WACA,WACA,SACA,GACA,OACA,eACA,0BACA,WACA,sBACA;EAsBQ,QAAQ,UAAU,cAAc,sBACxC,SAAS,QAAQ,OAAO,KACtB,gBACF,QACA,WACA,WACA,SACA,iBACA,4BACA,GACA,OACA,WACA,sBACA;;;;;EA0BD,QAAQ,UAAU,qCAAqC,gBACtD,QACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA;;;;;EAqBQ,SAAS,GAAG,sBACpB,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,gBACF,QACA,WACA,WACA,SACA,iBACA,4BACA,eACA,0BACA,GACA,OACA;EAwBD,OACC,IAAI,gBACH,QACA,WACA,SACA,WACA,WACA,eACA,gBAEC,SACF,QACA,WACA,SACA,WACA,iBACA,4BACA,eACA,0BACA,WACA,sBACA,cACA,gBACC,QACA,WACA,SACA,WACA,WACA,eACA"}

package/dist/object-storage.d.cts

@@ -1,4 +1,4 @@
-import { t as Construct } from "./construct-interface-DgXTJcOD.cjs";
+import { n as Construct } from "./construct-interface-DIaTNKax.cjs";
 import { Service } from "@geekmidas/services";
 import { ConstructName, Declaration } from "@geekmidas/manifest";
 import { StorageClient } from "@geekmidas/storage";

package/dist/object-storage.d.mts

@@ -1,4 +1,4 @@
-import { t as Construct } from "./construct-interface-DPlxfpoS.mjs";
+import { n as Construct } from "./construct-interface-Clz7_BwB.mjs";
 import { ConstructName, Declaration } from "@geekmidas/manifest";
 import { StorageClient } from "@geekmidas/storage";
 import { Service } from "@geekmidas/services";

package/dist/queue/index.d.cts

@@ -1,5 +1,5 @@
 import { t as StandardSchemaV1 } from "../index-CeEtxDmK.cjs";
-import { n as Consumable, s as ServicesOf } from "../construct-interface-DgXTJcOD.cjs";
+import { c as ServicesOf, r as Consumable } from "../construct-interface-DIaTNKax.cjs";
 import { i as QueueMessage, n as QueueContext, r as QueueHandler, t as Queue } from "../Queue-Bhzi2WQC.cjs";
 import { Logger as Logger$1 } from "@geekmidas/logger";
 import { Service } from "@geekmidas/services";

package/dist/queue/index.d.mts

@@ -1,5 +1,5 @@
 import { t as StandardSchemaV1 } from "../index-CeEtxDmK.mjs";
-import { n as Consumable, s as ServicesOf } from "../construct-interface-DPlxfpoS.mjs";
+import { c as ServicesOf, r as Consumable } from "../construct-interface-Clz7_BwB.mjs";
 import { i as QueueMessage, n as QueueContext, r as QueueHandler, t as Queue } from "../Queue-BoUA-e83.mjs";
 import { Service } from "@geekmidas/services";
 import { Logger as Logger$1 } from "@geekmidas/logger";

package/dist/rest-api.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_construct_interface = require("./construct-interface.cjs");
-const require_EndpointFactory = require("./EndpointFactory-BTj1GjZd.cjs");
+const require_EndpointFactory = require("./EndpointFactory-vE2C1NG1.cjs");
 const require_surfaceEnv = require("./surfaceEnv-CNimK76p.cjs");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let _geekmidas_logger_console = require("@geekmidas/logger/console");
@@ -80,7 +80,8 @@ var RestApi = class RestApi {
 			...config.defaultAuthorizer && config.defaultAuthorizer !== "none" ? { defaultAuthorizerName: config.defaultAuthorizer } : {},
 			surface: {
 				id: this.id,
-				envParser: this.envParser
+				envParser: this.envParser,
+				...authenticator ? { auth: authenticator } : {}
 			}
 		});
 		const endpoints = this.#endpoints;
@@ -151,13 +152,14 @@ var RestApi = class RestApi {
 	* what a request is allowed to be. A surface with two of the first is a
 	* mistake; two of the second is Tuesday.
 	*
-	* It records the id, not a client. Every endpoint consumes the same thing —
-	* `verify(request) → Session | null` — and that is what every provider
-	* shares, whether the server is mounted in this process, deployed beside it,
-	* or an OIDC issuer somebody else runs.
+	* It declares the id, and keeps the construct: a session callback reads from
+	* it as `auth` — `session(async ({ auth }) => auth.getSession())` — which
+	* calls the construct's `verify(headers)`. That is the one thing every
+	* provider shares, whether the server is mounted in this process, deployed
+	* beside it, or an OIDC issuer somebody else runs.
 	*/
 	auth(construct) {
-		return new RestApi(this.id, this.config, [...this.dependencies, require_construct_interface.edgeTo(construct)], construct.id);
+		return new RestApi(this.id, this.config, [...this.dependencies, require_construct_interface.edgeTo(construct)], construct);
 	}
 	/**
 	* Other surfaces this one calls.
@@ -192,7 +194,7 @@ var RestApi = class RestApi {
 			path: this.config.path,
 			...this.config.telescope ? { telescope: true } : {},
 			...this.config.cors ? { cors: this.config.cors } : {},
-			...this.authenticator ? { auth: this.authenticator } : {},
+			...this.authenticator ? { auth: this.authenticator.id } : {},
 			endpoints: [],
 			...this.dependencies.length ? { calls: this.dependencies } : {},
 			...this.config.authorizers?.length ? { authorizers: this.config.authorizers } : {},

package/dist/rest-api.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"rest-api.cjs","names":["canonicalId","provideKey","DEFAULT_LOGGER","envParserFor","EndpointFactory","getSecurityScheme","edgeTo"],"sources":["../src/rest-api.ts"],"sourcesContent":["/**\n * `RestApi` — the application's own HTTP surface, declared.\n *\n * Everything an app serves already existed; what did not exist was a *node* for\n * it. Without one, three things that are properties of the graph had to be\n * written down somewhere else: which origins the API accepts, which origins the\n * auth server trusts, and which URL a frontend is built against. All three were\n * being derived by walking the workspace config for ports — a second mechanism,\n * running beside the graph and answering the same question worse, since it can\n * only ever describe what this repo happens to run.\n *\n * With the surface declared, all three become one edge read backwards: a\n * consumer depends on the API, and *that* is the CORS entry, the trusted origin,\n * and the build-time URL. Nothing enumerates its own callers.\n *\n * ```ts\n * export const api = new RestApi('Api', {\n *   authorizers: ['session'],\n *   defaultAuthorizer: 'session',\n * });\n * ```\n */\n\nimport type { EnvironmentParser } from '@geekmidas/envkit';\nimport type { Logger } from '@geekmidas/logger';\nimport { DEFAULT_LOGGER } from '@geekmidas/logger/console';\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\ttype Dependency,\n\tprovideKey,\n} from '@geekmidas/manifest';\nimport type { Telescope } from '@geekmidas/telescope';\nimport { type Declarable, edgeTo } from './construct-interface';\nimport {\n\ttype BuiltInSecuritySchemeId,\n\tgetSecurityScheme,\n} from './endpoints/Authorizer';\nimport { EndpointFactory } from './endpoints/EndpointFactory';\nimport { envParserFor } from './endpoints/surfaceEnv';\n\n/** The factory a surface builds its endpoints from. */\ntype Endpoints = EndpointFactory<[], '', Logger>;\n\nexport interface RestApiConfig<\n\t// `readonly []` rather than `readonly string[]`: a surface that declares no\n\t// authorizers of its own should narrow `defaultAuthorizer` to the built-ins\n\t// and `'none'`, not widen it back to any string.\n\tTAuthorizers extends readonly string[] = readonly [],\n> {\n\t/**\n\t * The app that serves this surface, relative to the workspace root —\n\t * `'apps/api'`, or `'.'` in a single-app project.\n\t *\n\t * Required. It was inferred from the id (`apps/<kebab-id>`, or the root\n\t * when no such directory existed), which meant a surface's home was\n\t * whatever happened to be on disk. It is where the app's `package.json`\n\t * and base `tsconfig.json` are, and which build serves this surface. It\n\t * does not change discovery: constructs still load from the workspace's\n\t * `constructs` glob.\n\t */\n\tpath: string;\n\t/**\n\t * CORS tunables. The *origins* are never here — they are read off the\n\t * constructs that declared an edge to this surface, which is the whole point\n\t * of declaring one. These are the parts a graph cannot answer.\n\t */\n\tcors?: {\n\t\tmaxAge?: number;\n\t\tcredentials?: boolean;\n\t\tallowHeaders?: readonly string[];\n\t\texposeHeaders?: readonly string[];\n\t};\n\t/**\n\t * The authorizer names this surface exposes. Names only — what verifies a\n\t * request legitimately differs between local and deployed, so the mechanism\n\t * belongs to the target and never to portable code.\n\t */\n\tauthorizers?: TAuthorizers;\n\t/**\n\t * The authorizer applied to an endpoint that names none.\n\t *\n\t * Required, and `'none'` is a valid answer that has to be typed out. The\n\t * alternative is an API that ships open because a field was left off, which\n\t * is the one default worth refusing to have.\n\t *\n\t * It was called `default`, which said what it was to the type and nothing\n\t * to the reader: next to `authorizers: ['iam']`, a bare `default: 'none'`\n\t * could be defaulting the runtime or the target. The manifest has always\n\t * called it `defaultAuthorizer` and the factory `defaultAuthorizerName`;\n\t * this is the same fact under the same name.\n\t *\n\t * Typed from `authorizers`, so it can only name one this surface exposes —\n\t * plus a built-in scheme, and `'none'`. It was a bare `string`, which let\n\t * `defaultAuthorizer: 'jwtt'` compile and every endpoint on the surface\n\t * default to an authorizer that does not exist.\n\t */\n\tdefaultAuthorizer: TAuthorizers[number] | BuiltInSecuritySchemeId | 'none';\n\t/**\n\t * The logger every endpoint on this surface runs with.\n\t *\n\t * The actual logger, not a path to one. It used to be named in config as\n\t * `logger: './config/logger'`, because the build wrote an import into each\n\t * generated handler and a generator can print a specifier but not an object.\n\t * Endpoints built from the surface carry it, so there is nothing to print\n\t * and nothing to keep in step with a moved file.\n\t */\n\tlogger?: Logger;\n\t/**\n\t * The environment parser every endpoint on this surface runs with.\n\t *\n\t * Same reason as `logger`, and the same field it replaces —\n\t * `envParser: './config/env#envParser'`, a module path with an export name\n\t * appended, parsed by us, checked by nothing.\n\t */\n\tenvParser?: EnvironmentParser<{}>;\n\t/**\n\t * The Telescope instance this surface's entry mounts.\n\t *\n\t * The actual instance, for the reason `logger` is: it used to be named as\n\t * `telescope: './config/telescope#telescope'`, a module path the build\n\t * printed an import for. The entry already imports the surface.\n\t */\n\ttelescope?: Telescope;\n}\n\n/**\n * What is *not* here, and why.\n *\n * `dependsOn`, `database`, `auditor` and `publisher` all inject a capability\n * into a handler. Putting one on the surface hands it to every route the\n * surface serves — a health check gets the database because a report needed it\n * — which is the thing least privilege forbids and the reason `.calls()` is not\n * spelled `dependsOn`. They belong to the endpoint, or to a branch —\n * `api.database(db)` — for a group of endpoints that genuinely share them. A\n * branch is a new factory; the surface config stays free of grants.\n *\n * `auth` is not here either: `.auth(construct)` already declares it, and a\n * second way to say the same thing is the duplication this whole model removes.\n *\n * What is left is what the *process* is rather than what a route may reach.\n */\n\nexport class RestApi<\n\tTName extends string = string,\n\tconst TAuthorizers extends readonly string[] = readonly [],\n> implements Declarable<TName>\n{\n\treadonly id: TName;\n\n\t/**\n\t * Declared once and read by both `declare()` and anything that consumes this\n\t * surface, so what the target publishes and what a consumer reads cannot\n\t * drift.\n\t */\n\treadonly keys: {\n\t\turl: string;\n\t\ttrustedOrigins: string;\n\t\tcookieDomain: string;\n\t};\n\n\t/**\n\t * The logger every endpoint on this surface runs with.\n\t *\n\t * Always defined — the surface's own if it was given one, the console\n\t * logger otherwise — so nothing downstream has to decide what to do about a\n\t * missing one. The generated entry reads it from here.\n\t */\n\treadonly logger: Logger;\n\n\t/**\n\t * The environment parser every endpoint on this surface runs with.\n\t *\n\t * Always defined, and normally the default: `process.env` merged with the\n\t * credentials `gkm dev`/`gkm exec` injected. That is what every\n\t * application's own `config/env.ts` was — boilerplate identical in every\n\t * project, and mandatory, which is a poor combination.\n\t */\n\treadonly envParser: EnvironmentParser<{}>;\n\n\t/** The Telescope instance, when this surface was given one. */\n\treadonly telescope?: Telescope;\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly config: RestApiConfig<TAuthorizers>,\n\t\t/** Internal: how `.calls()` carries edges into the copy it returns. */\n\t\tprivate readonly dependencies: readonly Dependency[] = [],\n\t\t/** Internal: how `.auth()` carries the authenticator into its copy. */\n\t\tprivate readonly authenticator?: string,\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\n\t\tthis.keys = {\n\t\t\turl: provideKey(canonical, 'url'),\n\t\t\ttrustedOrigins: provideKey(canonical, 'trustedOrigins'),\n\t\t\tcookieDomain: provideKey(canonical, 'cookieDomain'),\n\t\t};\n\n\t\tthis.logger = config.logger ?? DEFAULT_LOGGER;\n\t\tthis.telescope = config.telescope;\n\t\tthis.envParser = envParserFor(\n\t\t\tconfig.envParser\n\t\t\t\t? { id: canonical, envParser: config.envParser }\n\t\t\t\t: undefined,\n\t\t);\n\n\t\tthis.#endpoints = new EndpointFactory({\n\t\t\tdefaultLogger: this.logger,\n\t\t\t...(config.authorizers\n\t\t\t\t? {\n\t\t\t\t\t\t// With the scheme a built-in name stands for, as the factory's own\n\t\t\t\t\t\t// `.authorizers()` resolves it. Bare names reached the OpenAPI\n\t\t\t\t\t\t// document with no scheme, so a guarded endpoint read as public.\n\t\t\t\t\t\tavailableAuthorizers: config.authorizers.map((name) => {\n\t\t\t\t\t\t\tconst securityScheme = getSecurityScheme(name);\n\t\t\t\t\t\t\treturn securityScheme ? { name, securityScheme } : { name };\n\t\t\t\t\t\t}),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\t// `'none'` reaches the factory as no default at all, which is what\n\t\t\t// public means to an endpoint that names no authorizer.\n\t\t\t...(config.defaultAuthorizer && config.defaultAuthorizer !== 'none'\n\t\t\t\t? { defaultAuthorizerName: config.defaultAuthorizer }\n\t\t\t\t: {}),\n\t\t\tsurface: { id: this.id, envParser: this.envParser },\n\t\t});\n\n\t\tconst endpoints = this.#endpoints;\n\t\tthis.get = endpoints.get.bind(endpoints);\n\t\tthis.post = endpoints.post.bind(endpoints);\n\t\tthis.put = endpoints.put.bind(endpoints);\n\t\tthis.patch = endpoints.patch.bind(endpoints);\n\t\tthis.delete = endpoints.delete.bind(endpoints);\n\t\tthis.options = endpoints.options.bind(endpoints);\n\t\tthis.database = endpoints.database.bind(endpoints);\n\t\tthis.session = endpoints.session.bind(endpoints);\n\t\tthis.auditor = endpoints.auditor.bind(endpoints);\n\t\tthis.actor = endpoints.actor.bind(endpoints);\n\t\tthis.publisher = endpoints.publisher.bind(endpoints);\n\t\tthis.authorizer = endpoints.authorizer.bind(endpoints);\n\t\tthis.authorize = endpoints.authorize.bind(endpoints);\n\t\tthis.rls = endpoints.rls.bind(endpoints);\n\t\tthis.route = endpoints.route.bind(endpoints);\n\t}\n\n\t/**\n\t * This surface's endpoint factory, which every method below starts from.\n\t *\n\t * Private: a surface *is* where endpoints are built, so there is no second\n\t * object to reach through first. `api.database(db)` said the same\n\t * thing as `api.database(db)` with one more word to learn.\n\t */\n\treadonly #endpoints: Endpoints;\n\n\t/** `api.get('/users')` — one route on this surface. */\n\treadonly get: Endpoints['get'];\n\treadonly post: Endpoints['post'];\n\treadonly put: Endpoints['put'];\n\treadonly patch: Endpoints['patch'];\n\treadonly delete: Endpoints['delete'];\n\treadonly options: Endpoints['options'];\n\n\t/**\n\t * A branch for a *group* of endpoints that shares what a single route would\n\t * otherwise repeat — a database, an auditor, a publisher, a session:\n\t *\n\t * ```ts\n\t * export const router = api.database(database);\n\t * export const createUser = router.post('/users').handle(({ db }) => …);\n\t * ```\n\t *\n\t * Each returns a new factory and leaves the surface as it was. That is the\n\t * whole difference from putting the same thing in the surface's config: a\n\t * group opts in, where the surface would grant it to every route it serves —\n\t * a health check handed the database because a profile endpoint needed it.\n\t *\n\t * `dependsOn` is deliberately not here. It is per endpoint, and on the\n\t * surface it would read as the API depending on something, which is what\n\t * `.calls()` and `.auth()` say instead.\n\t */\n\treadonly database: Endpoints['database'];\n\treadonly session: Endpoints['session'];\n\treadonly auditor: Endpoints['auditor'];\n\treadonly actor: Endpoints['actor'];\n\treadonly publisher: Endpoints['publisher'];\n\treadonly authorizer: Endpoints['authorizer'];\n\treadonly authorize: Endpoints['authorize'];\n\treadonly rls: Endpoints['rls'];\n\treadonly route: Endpoints['route'];\n\n\t/**\n\t * What authenticates this surface.\n\t *\n\t * An edge like `.calls()` — the auth server learns this origin, and the two\n\t * share a cookie domain — but a named one, because *who authenticates me* is\n\t * a different fact from *who I happen to call*, and only one of them decides\n\t * what a request is allowed to be. A surface with two of the first is a\n\t * mistake; two of the second is Tuesday.\n\t *\n\t * It records the id, not a client. Every endpoint consumes the same thing —\n\t * `verify(request) → Session | null` — and that is what every provider\n\t * shares, whether the server is mounted in this process, deployed beside it,\n\t * or an OIDC issuer somebody else runs.\n\t */\n\tauth(construct: Declarable): RestApi<TName, TAuthorizers> {\n\t\treturn new RestApi<TName, TAuthorizers>(\n\t\t\tthis.id as ConstructName<TName>,\n\t\t\tthis.config,\n\t\t\t[...this.dependencies, edgeTo(construct)],\n\t\t\tconstruct.id,\n\t\t);\n\t}\n\n\t/**\n\t * Other surfaces this one calls.\n\t *\n\t * **Not `.dependsOn()`, and the difference matters.** An endpoint's\n\t * `.dependsOn()` injects a client into that handler and grants it exactly\n\t * what it named. This grants nothing and injects nothing: it records that\n\t * this API calls another surface, which is what puts this API's origin on\n\t * that surface's trusted-origin list.\n\t *\n\t * Spelling it `dependsOn` would invite the thing least privilege forbids —\n\t * every route on the surface receiving whatever the surface named.\n\t *\n\t * Immutable, like every other builder here.\n\t */\n\tcalls(constructs: readonly Declarable[]): RestApi<TName, TAuthorizers> {\n\t\treturn new RestApi<TName, TAuthorizers>(\n\t\t\tthis.id as ConstructName<TName>,\n\t\t\tthis.config,\n\t\t\t[...this.dependencies, ...constructs.map(edgeTo)],\n\t\t\tthis.authenticator,\n\t\t);\n\t}\n\n\t/**\n\t * One surface node, with its endpoints left to the build.\n\t *\n\t * The three provided keys are one fact about this surface and two about its\n\t * callers. Declaring the caller-derived pair here rather than having the\n\t * target invent them is what makes the contract checkable: a target that\n\t * resolves no origins is caught against this list instead of being noticed\n\t * when a browser is refused in production.\n\t */\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'rest-api',\n\t\t\t\tid: this.id,\n\t\t\t\tpath: this.config.path,\n\t\t\t\t...(this.config.telescope ? { telescope: true } : {}),\n\t\t\t\t...(this.config.cors ? { cors: this.config.cors } : {}),\n\t\t\t\t...(this.authenticator ? { auth: this.authenticator } : {}),\n\t\t\t\t// Filled by the build, which already generates one handler per\n\t\t\t\t// endpoint and knows the path it wrote it to. A surface that\n\t\t\t\t// enumerates its own routes statically — an auth server's single\n\t\t\t\t// wildcard — puts them here instead.\n\t\t\t\tendpoints: [],\n\t\t\t\t...(this.dependencies.length ? { calls: this.dependencies } : {}),\n\t\t\t\t...(this.config.authorizers?.length\n\t\t\t\t\t? { authorizers: this.config.authorizers }\n\t\t\t\t\t: {}),\n\t\t\t\tdefaultAuthorizer: this.config.defaultAuthorizer,\n\t\t\t\tprovides: [\n\t\t\t\t\tthis.keys.url,\n\t\t\t\t\tthis.keys.trustedOrigins,\n\t\t\t\t\tthis.keys.cookieDomain,\n\t\t\t\t],\n\t\t\t},\n\t\t];\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAgJA,IAAa,UAAb,MAAa,QAIb;CAsCmB;CAEA;CAEA;CAzClB;;;;;;CAOA;;;;;;;;CAaA;;;;;;;;;CAUA;;CAGA;CAEA,YACC,IACA,QAEA,eAAuD,CAAC,GAExD,eACC;EALgB,KAAA,SAAA;EAEA,KAAA,eAAA;EAEA,KAAA,gBAAA;EAEjB,MAAM,aAAA,GAAYA,oBAAAA,YAAAA,CAAY,EAAY;EAE1C,KAAK,KAAK;EAEV,KAAK,OAAO;GACX,MAAA,GAAKC,oBAAAA,WAAAA,CAAW,WAAW,KAAK;GAChC,iBAAA,GAAgBA,oBAAAA,WAAAA,CAAW,WAAW,gBAAgB;GACtD,eAAA,GAAcA,oBAAAA,WAAAA,CAAW,WAAW,cAAc;EACnD;EAEA,KAAK,SAAS,OAAO,UAAUC,0BAAAA;EAC/B,KAAK,YAAY,OAAO;EACxB,KAAK,YAAYC,mBAAAA,aAChB,OAAO,YACJ;GAAE,IAAI;GAAW,WAAW,OAAO;EAAU,IAC7C,KAAA,CACJ;EAEA,KAAK,aAAa,IAAIC,wBAAAA,gBAAgB;GACrC,eAAe,KAAK;GACpB,GAAI,OAAO,cACR,EAIA,sBAAsB,OAAO,YAAY,KAAK,SAAS;IACtD,MAAM,iBAAiBC,wBAAAA,kBAAkB,IAAI;IAC7C,OAAO,iBAAiB;KAAE;KAAM;IAAe,IAAI,EAAE,KAAK;GAC3D,CAAC,EACF,IACC,CAAC;GAGJ,GAAI,OAAO,qBAAqB,OAAO,sBAAsB,SAC1D,EAAE,uBAAuB,OAAO,kBAAkB,IAClD,CAAC;GACJ,SAAS;IAAE,IAAI,KAAK;IAAI,WAAW,KAAK;GAAU;EACnD,CAAC;EAED,MAAM,YAAY,KAAK;EACvB,KAAK,MAAM,UAAU,IAAI,KAAK,SAAS;EACvC,KAAK,OAAO,UAAU,KAAK,KAAK,SAAS;EACzC,KAAK,MAAM,UAAU,IAAI,KAAK,SAAS;EACvC,KAAK,QAAQ,UAAU,MAAM,KAAK,SAAS;EAC3C,KAAK,SAAS,UAAU,OAAO,KAAK,SAAS;EAC7C,KAAK,UAAU,UAAU,QAAQ,KAAK,SAAS;EAC/C,KAAK,WAAW,UAAU,SAAS,KAAK,SAAS;EACjD,KAAK,UAAU,UAAU,QAAQ,KAAK,SAAS;EAC/C,KAAK,UAAU,UAAU,QAAQ,KAAK,SAAS;EAC/C,KAAK,QAAQ,UAAU,MAAM,KAAK,SAAS;EAC3C,KAAK,YAAY,UAAU,UAAU,KAAK,SAAS;EACnD,KAAK,aAAa,UAAU,WAAW,KAAK,SAAS;EACrD,KAAK,YAAY,UAAU,UAAU,KAAK,SAAS;EACnD,KAAK,MAAM,UAAU,IAAI,KAAK,SAAS;EACvC,KAAK,QAAQ,UAAU,MAAM,KAAK,SAAS;CAC5C;;;;;;;;CASA;;CAGA;CACA;CACA;CACA;CACA;CACA;;;;;;;;;;;;;;;;;;;CAoBA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;;;;;;;;;;;CAgBA,KAAK,WAAqD;EACzD,OAAO,IAAI,QACV,KAAK,IACL,KAAK,QACL,CAAC,GAAG,KAAK,cAAcC,4BAAAA,OAAO,SAAS,CAAC,GACxC,UAAU,EACX;CACD;;;;;;;;;;;;;;;CAgBA,MAAM,YAAiE;EACtE,OAAO,IAAI,QACV,KAAK,IACL,KAAK,QACL,CAAC,GAAG,KAAK,cAAc,GAAG,WAAW,IAAIA,4BAAAA,MAAM,CAAC,GAChD,KAAK,aACN;CACD;;;;;;;;;;CAWA,UAAyB;EACxB,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,MAAM,KAAK,OAAO;GAClB,GAAI,KAAK,OAAO,YAAY,EAAE,WAAW,KAAK,IAAI,CAAC;GACnD,GAAI,KAAK,OAAO,OAAO,EAAE,MAAM,KAAK,OAAO,KAAK,IAAI,CAAC;GACrD,GAAI,KAAK,gBAAgB,EAAE,MAAM,KAAK,cAAc,IAAI,CAAC;GAKzD,WAAW,CAAC;GACZ,GAAI,KAAK,aAAa,SAAS,EAAE,OAAO,KAAK,aAAa,IAAI,CAAC;GAC/D,GAAI,KAAK,OAAO,aAAa,SAC1B,EAAE,aAAa,KAAK,OAAO,YAAY,IACvC,CAAC;GACJ,mBAAmB,KAAK,OAAO;GAC/B,UAAU;IACT,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,KAAK;GACX;EACD,CACD;CACD;AACD"}
+{"version":3,"file":"rest-api.cjs","names":["canonicalId","provideKey","DEFAULT_LOGGER","envParserFor","EndpointFactory","getSecurityScheme","edgeTo"],"sources":["../src/rest-api.ts"],"sourcesContent":["/**\n * `RestApi` — the application's own HTTP surface, declared.\n *\n * Everything an app serves already existed; what did not exist was a *node* for\n * it. Without one, three things that are properties of the graph had to be\n * written down somewhere else: which origins the API accepts, which origins the\n * auth server trusts, and which URL a frontend is built against. All three were\n * being derived by walking the workspace config for ports — a second mechanism,\n * running beside the graph and answering the same question worse, since it can\n * only ever describe what this repo happens to run.\n *\n * With the surface declared, all three become one edge read backwards: a\n * consumer depends on the API, and *that* is the CORS entry, the trusted origin,\n * and the build-time URL. Nothing enumerates its own callers.\n *\n * ```ts\n * export const api = new RestApi('Api', {\n *   authorizers: ['session'],\n *   defaultAuthorizer: 'session',\n * });\n * ```\n */\n\nimport type { EnvironmentParser } from '@geekmidas/envkit';\nimport type { Logger } from '@geekmidas/logger';\nimport { DEFAULT_LOGGER } from '@geekmidas/logger/console';\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\ttype Dependency,\n\tprovideKey,\n} from '@geekmidas/manifest';\nimport type { Telescope } from '@geekmidas/telescope';\nimport {\n\ttype Authenticator,\n\ttype Declarable,\n\tedgeTo,\n} from './construct-interface';\n\nexport type { Authenticator } from './construct-interface';\n\nimport {\n\ttype BuiltInSecuritySchemeId,\n\tgetSecurityScheme,\n} from './endpoints/Authorizer';\nimport { EndpointFactory } from './endpoints/EndpointFactory';\nimport { envParserFor } from './endpoints/surfaceEnv';\n\n/** The factory a surface builds its endpoints from. */\ntype Endpoints = EndpointFactory<[], '', Logger>;\n\nexport interface RestApiConfig<\n\t// `readonly []` rather than `readonly string[]`: a surface that declares no\n\t// authorizers of its own should narrow `defaultAuthorizer` to the built-ins\n\t// and `'none'`, not widen it back to any string.\n\tTAuthorizers extends readonly string[] = readonly [],\n> {\n\t/**\n\t * The app that serves this surface, relative to the workspace root —\n\t * `'apps/api'`, or `'.'` in a single-app project.\n\t *\n\t * Required. It was inferred from the id (`apps/<kebab-id>`, or the root\n\t * when no such directory existed), which meant a surface's home was\n\t * whatever happened to be on disk. It is where the app's `package.json`\n\t * and base `tsconfig.json` are, and which build serves this surface. It\n\t * does not change discovery: constructs still load from the workspace's\n\t * `constructs` glob.\n\t */\n\tpath: string;\n\t/**\n\t * CORS tunables. The *origins* are never here — they are read off the\n\t * constructs that declared an edge to this surface, which is the whole point\n\t * of declaring one. These are the parts a graph cannot answer.\n\t */\n\tcors?: {\n\t\tmaxAge?: number;\n\t\tcredentials?: boolean;\n\t\tallowHeaders?: readonly string[];\n\t\texposeHeaders?: readonly string[];\n\t};\n\t/**\n\t * The authorizer names this surface exposes. Names only — what verifies a\n\t * request legitimately differs between local and deployed, so the mechanism\n\t * belongs to the target and never to portable code.\n\t */\n\tauthorizers?: TAuthorizers;\n\t/**\n\t * The authorizer applied to an endpoint that names none.\n\t *\n\t * Required, and `'none'` is a valid answer that has to be typed out. The\n\t * alternative is an API that ships open because a field was left off, which\n\t * is the one default worth refusing to have.\n\t *\n\t * It was called `default`, which said what it was to the type and nothing\n\t * to the reader: next to `authorizers: ['iam']`, a bare `default: 'none'`\n\t * could be defaulting the runtime or the target. The manifest has always\n\t * called it `defaultAuthorizer` and the factory `defaultAuthorizerName`;\n\t * this is the same fact under the same name.\n\t *\n\t * Typed from `authorizers`, so it can only name one this surface exposes —\n\t * plus a built-in scheme, and `'none'`. It was a bare `string`, which let\n\t * `defaultAuthorizer: 'jwtt'` compile and every endpoint on the surface\n\t * default to an authorizer that does not exist.\n\t */\n\tdefaultAuthorizer: TAuthorizers[number] | BuiltInSecuritySchemeId | 'none';\n\t/**\n\t * The logger every endpoint on this surface runs with.\n\t *\n\t * The actual logger, not a path to one. It used to be named in config as\n\t * `logger: './config/logger'`, because the build wrote an import into each\n\t * generated handler and a generator can print a specifier but not an object.\n\t * Endpoints built from the surface carry it, so there is nothing to print\n\t * and nothing to keep in step with a moved file.\n\t */\n\tlogger?: Logger;\n\t/**\n\t * The environment parser every endpoint on this surface runs with.\n\t *\n\t * Same reason as `logger`, and the same field it replaces —\n\t * `envParser: './config/env#envParser'`, a module path with an export name\n\t * appended, parsed by us, checked by nothing.\n\t */\n\tenvParser?: EnvironmentParser<{}>;\n\t/**\n\t * The Telescope instance this surface's entry mounts.\n\t *\n\t * The actual instance, for the reason `logger` is: it used to be named as\n\t * `telescope: './config/telescope#telescope'`, a module path the build\n\t * printed an import for. The entry already imports the surface.\n\t */\n\ttelescope?: Telescope;\n}\n\n/**\n * What is *not* here, and why.\n *\n * `dependsOn`, `database`, `auditor` and `publisher` all inject a capability\n * into a handler. Putting one on the surface hands it to every route the\n * surface serves — a health check gets the database because a report needed it\n * — which is the thing least privilege forbids and the reason `.calls()` is not\n * spelled `dependsOn`. They belong to the endpoint, or to a branch —\n * `api.database(db)` — for a group of endpoints that genuinely share them. A\n * branch is a new factory; the surface config stays free of grants.\n *\n * `auth` is not here either: `.auth(construct)` already declares it, and a\n * second way to say the same thing is the duplication this whole model removes.\n *\n * What is left is what the *process* is rather than what a route may reach.\n */\n\nexport class RestApi<\n\tTName extends string = string,\n\tconst TAuthorizers extends readonly string[] = readonly [],\n> implements Declarable<TName>\n{\n\treadonly id: TName;\n\n\t/**\n\t * Declared once and read by both `declare()` and anything that consumes this\n\t * surface, so what the target publishes and what a consumer reads cannot\n\t * drift.\n\t */\n\treadonly keys: {\n\t\turl: string;\n\t\ttrustedOrigins: string;\n\t\tcookieDomain: string;\n\t};\n\n\t/**\n\t * The logger every endpoint on this surface runs with.\n\t *\n\t * Always defined — the surface's own if it was given one, the console\n\t * logger otherwise — so nothing downstream has to decide what to do about a\n\t * missing one. The generated entry reads it from here.\n\t */\n\treadonly logger: Logger;\n\n\t/**\n\t * The environment parser every endpoint on this surface runs with.\n\t *\n\t * Always defined, and normally the default: `process.env` merged with the\n\t * credentials `gkm dev`/`gkm exec` injected. That is what every\n\t * application's own `config/env.ts` was — boilerplate identical in every\n\t * project, and mandatory, which is a poor combination.\n\t */\n\treadonly envParser: EnvironmentParser<{}>;\n\n\t/** The Telescope instance, when this surface was given one. */\n\treadonly telescope?: Telescope;\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly config: RestApiConfig<TAuthorizers>,\n\t\t/** Internal: how `.calls()` carries edges into the copy it returns. */\n\t\tprivate readonly dependencies: readonly Dependency[] = [],\n\t\t/** Internal: how `.auth()` carries the authenticator into its copy. */\n\t\tprivate readonly authenticator?: Authenticator,\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\n\t\tthis.keys = {\n\t\t\turl: provideKey(canonical, 'url'),\n\t\t\ttrustedOrigins: provideKey(canonical, 'trustedOrigins'),\n\t\t\tcookieDomain: provideKey(canonical, 'cookieDomain'),\n\t\t};\n\n\t\tthis.logger = config.logger ?? DEFAULT_LOGGER;\n\t\tthis.telescope = config.telescope;\n\t\tthis.envParser = envParserFor(\n\t\t\tconfig.envParser\n\t\t\t\t? { id: canonical, envParser: config.envParser }\n\t\t\t\t: undefined,\n\t\t);\n\n\t\tthis.#endpoints = new EndpointFactory({\n\t\t\tdefaultLogger: this.logger,\n\t\t\t...(config.authorizers\n\t\t\t\t? {\n\t\t\t\t\t\t// With the scheme a built-in name stands for, as the factory's own\n\t\t\t\t\t\t// `.authorizers()` resolves it. Bare names reached the OpenAPI\n\t\t\t\t\t\t// document with no scheme, so a guarded endpoint read as public.\n\t\t\t\t\t\tavailableAuthorizers: config.authorizers.map((name) => {\n\t\t\t\t\t\t\tconst securityScheme = getSecurityScheme(name);\n\t\t\t\t\t\t\treturn securityScheme ? { name, securityScheme } : { name };\n\t\t\t\t\t\t}),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\t// `'none'` reaches the factory as no default at all, which is what\n\t\t\t// public means to an endpoint that names no authorizer.\n\t\t\t...(config.defaultAuthorizer && config.defaultAuthorizer !== 'none'\n\t\t\t\t? { defaultAuthorizerName: config.defaultAuthorizer }\n\t\t\t\t: {}),\n\t\t\tsurface: {\n\t\t\t\tid: this.id,\n\t\t\t\tenvParser: this.envParser,\n\t\t\t\t...(authenticator ? { auth: authenticator } : {}),\n\t\t\t},\n\t\t});\n\n\t\tconst endpoints = this.#endpoints;\n\t\tthis.get = endpoints.get.bind(endpoints);\n\t\tthis.post = endpoints.post.bind(endpoints);\n\t\tthis.put = endpoints.put.bind(endpoints);\n\t\tthis.patch = endpoints.patch.bind(endpoints);\n\t\tthis.delete = endpoints.delete.bind(endpoints);\n\t\tthis.options = endpoints.options.bind(endpoints);\n\t\tthis.database = endpoints.database.bind(endpoints);\n\t\tthis.session = endpoints.session.bind(endpoints);\n\t\tthis.auditor = endpoints.auditor.bind(endpoints);\n\t\tthis.actor = endpoints.actor.bind(endpoints);\n\t\tthis.publisher = endpoints.publisher.bind(endpoints);\n\t\tthis.authorizer = endpoints.authorizer.bind(endpoints);\n\t\tthis.authorize = endpoints.authorize.bind(endpoints);\n\t\tthis.rls = endpoints.rls.bind(endpoints);\n\t\tthis.route = endpoints.route.bind(endpoints);\n\t}\n\n\t/**\n\t * This surface's endpoint factory, which every method below starts from.\n\t *\n\t * Private: a surface *is* where endpoints are built, so there is no second\n\t * object to reach through first. `api.database(db)` said the same\n\t * thing as `api.database(db)` with one more word to learn.\n\t */\n\treadonly #endpoints: Endpoints;\n\n\t/** `api.get('/users')` — one route on this surface. */\n\treadonly get: Endpoints['get'];\n\treadonly post: Endpoints['post'];\n\treadonly put: Endpoints['put'];\n\treadonly patch: Endpoints['patch'];\n\treadonly delete: Endpoints['delete'];\n\treadonly options: Endpoints['options'];\n\n\t/**\n\t * A branch for a *group* of endpoints that shares what a single route would\n\t * otherwise repeat — a database, an auditor, a publisher, a session:\n\t *\n\t * ```ts\n\t * export const router = api.database(database);\n\t * export const createUser = router.post('/users').handle(({ db }) => …);\n\t * ```\n\t *\n\t * Each returns a new factory and leaves the surface as it was. That is the\n\t * whole difference from putting the same thing in the surface's config: a\n\t * group opts in, where the surface would grant it to every route it serves —\n\t * a health check handed the database because a profile endpoint needed it.\n\t *\n\t * `dependsOn` is deliberately not here. It is per endpoint, and on the\n\t * surface it would read as the API depending on something, which is what\n\t * `.calls()` and `.auth()` say instead.\n\t */\n\treadonly database: Endpoints['database'];\n\treadonly session: Endpoints['session'];\n\treadonly auditor: Endpoints['auditor'];\n\treadonly actor: Endpoints['actor'];\n\treadonly publisher: Endpoints['publisher'];\n\treadonly authorizer: Endpoints['authorizer'];\n\treadonly authorize: Endpoints['authorize'];\n\treadonly rls: Endpoints['rls'];\n\treadonly route: Endpoints['route'];\n\n\t/**\n\t * What authenticates this surface.\n\t *\n\t * An edge like `.calls()` — the auth server learns this origin, and the two\n\t * share a cookie domain — but a named one, because *who authenticates me* is\n\t * a different fact from *who I happen to call*, and only one of them decides\n\t * what a request is allowed to be. A surface with two of the first is a\n\t * mistake; two of the second is Tuesday.\n\t *\n\t * It declares the id, and keeps the construct: a session callback reads from\n\t * it as `auth` — `session(async ({ auth }) => auth.getSession())` — which\n\t * calls the construct's `verify(headers)`. That is the one thing every\n\t * provider shares, whether the server is mounted in this process, deployed\n\t * beside it, or an OIDC issuer somebody else runs.\n\t */\n\tauth(construct: Authenticator): RestApi<TName, TAuthorizers> {\n\t\treturn new RestApi<TName, TAuthorizers>(\n\t\t\tthis.id as ConstructName<TName>,\n\t\t\tthis.config,\n\t\t\t[...this.dependencies, edgeTo(construct)],\n\t\t\tconstruct,\n\t\t);\n\t}\n\n\t/**\n\t * Other surfaces this one calls.\n\t *\n\t * **Not `.dependsOn()`, and the difference matters.** An endpoint's\n\t * `.dependsOn()` injects a client into that handler and grants it exactly\n\t * what it named. This grants nothing and injects nothing: it records that\n\t * this API calls another surface, which is what puts this API's origin on\n\t * that surface's trusted-origin list.\n\t *\n\t * Spelling it `dependsOn` would invite the thing least privilege forbids —\n\t * every route on the surface receiving whatever the surface named.\n\t *\n\t * Immutable, like every other builder here.\n\t */\n\tcalls(constructs: readonly Declarable[]): RestApi<TName, TAuthorizers> {\n\t\treturn new RestApi<TName, TAuthorizers>(\n\t\t\tthis.id as ConstructName<TName>,\n\t\t\tthis.config,\n\t\t\t[...this.dependencies, ...constructs.map(edgeTo)],\n\t\t\tthis.authenticator,\n\t\t);\n\t}\n\n\t/**\n\t * One surface node, with its endpoints left to the build.\n\t *\n\t * The three provided keys are one fact about this surface and two about its\n\t * callers. Declaring the caller-derived pair here rather than having the\n\t * target invent them is what makes the contract checkable: a target that\n\t * resolves no origins is caught against this list instead of being noticed\n\t * when a browser is refused in production.\n\t */\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'rest-api',\n\t\t\t\tid: this.id,\n\t\t\t\tpath: this.config.path,\n\t\t\t\t...(this.config.telescope ? { telescope: true } : {}),\n\t\t\t\t...(this.config.cors ? { cors: this.config.cors } : {}),\n\t\t\t\t...(this.authenticator ? { auth: this.authenticator.id } : {}),\n\t\t\t\t// Filled by the build, which already generates one handler per\n\t\t\t\t// endpoint and knows the path it wrote it to. A surface that\n\t\t\t\t// enumerates its own routes statically — an auth server's single\n\t\t\t\t// wildcard — puts them here instead.\n\t\t\t\tendpoints: [],\n\t\t\t\t...(this.dependencies.length ? { calls: this.dependencies } : {}),\n\t\t\t\t...(this.config.authorizers?.length\n\t\t\t\t\t? { authorizers: this.config.authorizers }\n\t\t\t\t\t: {}),\n\t\t\t\tdefaultAuthorizer: this.config.defaultAuthorizer,\n\t\t\t\tprovides: [\n\t\t\t\t\tthis.keys.url,\n\t\t\t\t\tthis.keys.trustedOrigins,\n\t\t\t\t\tthis.keys.cookieDomain,\n\t\t\t\t],\n\t\t\t},\n\t\t];\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAuJA,IAAa,UAAb,MAAa,QAIb;CAsCmB;CAEA;CAEA;CAzClB;;;;;;CAOA;;;;;;;;CAaA;;;;;;;;;CAUA;;CAGA;CAEA,YACC,IACA,QAEA,eAAuD,CAAC,GAExD,eACC;EALgB,KAAA,SAAA;EAEA,KAAA,eAAA;EAEA,KAAA,gBAAA;EAEjB,MAAM,aAAA,GAAYA,oBAAAA,YAAAA,CAAY,EAAY;EAE1C,KAAK,KAAK;EAEV,KAAK,OAAO;GACX,MAAA,GAAKC,oBAAAA,WAAAA,CAAW,WAAW,KAAK;GAChC,iBAAA,GAAgBA,oBAAAA,WAAAA,CAAW,WAAW,gBAAgB;GACtD,eAAA,GAAcA,oBAAAA,WAAAA,CAAW,WAAW,cAAc;EACnD;EAEA,KAAK,SAAS,OAAO,UAAUC,0BAAAA;EAC/B,KAAK,YAAY,OAAO;EACxB,KAAK,YAAYC,mBAAAA,aAChB,OAAO,YACJ;GAAE,IAAI;GAAW,WAAW,OAAO;EAAU,IAC7C,KAAA,CACJ;EAEA,KAAK,aAAa,IAAIC,wBAAAA,gBAAgB;GACrC,eAAe,KAAK;GACpB,GAAI,OAAO,cACR,EAIA,sBAAsB,OAAO,YAAY,KAAK,SAAS;IACtD,MAAM,iBAAiBC,wBAAAA,kBAAkB,IAAI;IAC7C,OAAO,iBAAiB;KAAE;KAAM;IAAe,IAAI,EAAE,KAAK;GAC3D,CAAC,EACF,IACC,CAAC;GAGJ,GAAI,OAAO,qBAAqB,OAAO,sBAAsB,SAC1D,EAAE,uBAAuB,OAAO,kBAAkB,IAClD,CAAC;GACJ,SAAS;IACR,IAAI,KAAK;IACT,WAAW,KAAK;IAChB,GAAI,gBAAgB,EAAE,MAAM,cAAc,IAAI,CAAC;GAChD;EACD,CAAC;EAED,MAAM,YAAY,KAAK;EACvB,KAAK,MAAM,UAAU,IAAI,KAAK,SAAS;EACvC,KAAK,OAAO,UAAU,KAAK,KAAK,SAAS;EACzC,KAAK,MAAM,UAAU,IAAI,KAAK,SAAS;EACvC,KAAK,QAAQ,UAAU,MAAM,KAAK,SAAS;EAC3C,KAAK,SAAS,UAAU,OAAO,KAAK,SAAS;EAC7C,KAAK,UAAU,UAAU,QAAQ,KAAK,SAAS;EAC/C,KAAK,WAAW,UAAU,SAAS,KAAK,SAAS;EACjD,KAAK,UAAU,UAAU,QAAQ,KAAK,SAAS;EAC/C,KAAK,UAAU,UAAU,QAAQ,KAAK,SAAS;EAC/C,KAAK,QAAQ,UAAU,MAAM,KAAK,SAAS;EAC3C,KAAK,YAAY,UAAU,UAAU,KAAK,SAAS;EACnD,KAAK,aAAa,UAAU,WAAW,KAAK,SAAS;EACrD,KAAK,YAAY,UAAU,UAAU,KAAK,SAAS;EACnD,KAAK,MAAM,UAAU,IAAI,KAAK,SAAS;EACvC,KAAK,QAAQ,UAAU,MAAM,KAAK,SAAS;CAC5C;;;;;;;;CASA;;CAGA;CACA;CACA;CACA;CACA;CACA;;;;;;;;;;;;;;;;;;;CAoBA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;;;;;;;;;;;;CAiBA,KAAK,WAAwD;EAC5D,OAAO,IAAI,QACV,KAAK,IACL,KAAK,QACL,CAAC,GAAG,KAAK,cAAcC,4BAAAA,OAAO,SAAS,CAAC,GACxC,SACD;CACD;;;;;;;;;;;;;;;CAgBA,MAAM,YAAiE;EACtE,OAAO,IAAI,QACV,KAAK,IACL,KAAK,QACL,CAAC,GAAG,KAAK,cAAc,GAAG,WAAW,IAAIA,4BAAAA,MAAM,CAAC,GAChD,KAAK,aACN;CACD;;;;;;;;;;CAWA,UAAyB;EACxB,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,MAAM,KAAK,OAAO;GAClB,GAAI,KAAK,OAAO,YAAY,EAAE,WAAW,KAAK,IAAI,CAAC;GACnD,GAAI,KAAK,OAAO,OAAO,EAAE,MAAM,KAAK,OAAO,KAAK,IAAI,CAAC;GACrD,GAAI,KAAK,gBAAgB,EAAE,MAAM,KAAK,cAAc,GAAG,IAAI,CAAC;GAK5D,WAAW,CAAC;GACZ,GAAI,KAAK,aAAa,SAAS,EAAE,OAAO,KAAK,aAAa,IAAI,CAAC;GAC/D,GAAI,KAAK,OAAO,aAAa,SAC1B,EAAE,aAAa,KAAK,OAAO,YAAY,IACvC,CAAC;GACJ,mBAAmB,KAAK,OAAO;GAC/B,UAAU;IACT,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,KAAK;GACX;EACD,CACD;CACD;AACD"}

package/dist/rest-api.d.cts

@@ -1,6 +1,6 @@
-import { r as Declarable } from "./construct-interface-DgXTJcOD.cjs";
-import { S as BuiltInSecuritySchemeId } from "./Endpoint-DlGPQpsH.cjs";
-import { t as EndpointFactory } from "./EndpointFactory-BG6DLRJH.cjs";
+import { i as Declarable, t as Authenticator } from "./construct-interface-DIaTNKax.cjs";
+import { T as BuiltInSecuritySchemeId } from "./Endpoint-DbYQJgb-.cjs";
+import { t as EndpointFactory } from "./EndpointFactory-DE6nKtFZ.cjs";
 import { EnvironmentParser } from "@geekmidas/envkit";
 import { Logger } from "@geekmidas/logger";
 import { ConstructName, Declaration, Dependency } from "@geekmidas/manifest";
@@ -141,7 +141,7 @@ export declare class RestApi<TName extends string = string, const TAuthorizers e
   /** Internal: how `.calls()` carries edges into the copy it returns. */
   dependencies?: readonly Dependency[],
   /** Internal: how `.auth()` carries the authenticator into its copy. */
-  authenticator?: string | undefined);
+  authenticator?: Authenticator | undefined);
   /** `api.get('/users')` — one route on this surface. */
   readonly get: Endpoints['get'];
   readonly post: Endpoints['post'];
@@ -185,12 +185,13 @@ export declare class RestApi<TName extends string = string, const TAuthorizers e
    * what a request is allowed to be. A surface with two of the first is a
    * mistake; two of the second is Tuesday.
    *
-   * It records the id, not a client. Every endpoint consumes the same thing —
-   * `verify(request) → Session | null` — and that is what every provider
-   * shares, whether the server is mounted in this process, deployed beside it,
-   * or an OIDC issuer somebody else runs.
+   * It declares the id, and keeps the construct: a session callback reads from
+   * it as `auth` — `session(async ({ auth }) => auth.getSession())` — which
+   * calls the construct's `verify(headers)`. That is the one thing every
+   * provider shares, whether the server is mounted in this process, deployed
+   * beside it, or an OIDC issuer somebody else runs.
    */
-  auth(construct: Declarable): RestApi<TName, TAuthorizers>;
+  auth(construct: Authenticator): RestApi<TName, TAuthorizers>;
   /**
    * Other surfaces this one calls.
    *
@@ -218,4 +219,5 @@ export declare class RestApi<TName extends string = string, const TAuthorizers e
   declare(): Declaration[];
 }
 //#endregion
+export type { Authenticator };
 //# sourceMappingURL=rest-api.d.cts.map

package/dist/rest-api.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"rest-api.d.cts","names":[],"sources":["../src/rest-api.ts"],"mappings":";;;;;;;;;KA2CK,YAAY,wBAAwB;iBAExB,cAIhB;;;;;;;;;;;;EAaA;;;;;;EAMA;IACC;IACA;IACA;IACA;;;;;;;EAOD,cAAc;;;;;;;;;;;;;;;;;;;EAmBd,mBAAmB,uBAAuB;;;;;;;;;;EAU1C,SAAS;;;;;;;;EAQT,YAAY;;;;;;;;EAQZ,YAAY;;;;;;;;;;;;;;;;;;qBAoBA,QACZ,qCACM,iEACM,WAAW;;mBAuCL;;mBAEA;;mBAEA;WAzCT,IAAI;;;;;;WAOJ;IACR;IACA;IACA;;;;;;;;;WAUQ,QAAQ;;;;;;;;;WAUR,WAAW;;WAGX,YAAY;EAErB,YACC,IAAI,cAAc,QACD,QAAQ,cAAc,eAEtB;;EAAA,wBAAuB,cAEvB;;EAAA;;WAqET,KAAK;WACL,MAAM;WACN,KAAK;WACL,OAAO;WACP,QAAQ;WACR,SAAS;;;;;;;;;;;;;;;;;;;WAoBT,UAAU;WACV,SAAS;WACT,SAAS;WACT,OAAO;WACP,WAAW;WACX,YAAY;WACZ,WAAW;WACX,KAAK;WACL,OAAO;;;;;;;;;;;;;;;EAgBhB,KAAK,WAAW,aAAa,QAAQ,OAAO;;;;;;;;;;;;;;;EAuB5C,MAAM,qBAAqB,eAAe,QAAQ,OAAO;;;;;;;;;;EAkBzD,WAAW"}
+{"version":3,"file":"rest-api.d.cts","names":[],"sources":["../src/rest-api.ts"],"mappings":";;;;;;;;;KAkDK,YAAY,wBAAwB;iBAExB,cAIhB;;;;;;;;;;;;EAaA;;;;;;EAMA;IACC;IACA;IACA;IACA;;;;;;;EAOD,cAAc;;;;;;;;;;;;;;;;;;;EAmBd,mBAAmB,uBAAuB;;;;;;;;;;EAU1C,SAAS;;;;;;;;EAQT,YAAY;;;;;;;;EAQZ,YAAY;;;;;;;;;;;;;;;;;;qBAoBA,QACZ,qCACM,iEACM,WAAW;;mBAuCL;;mBAEA;;mBAEA;WAzCT,IAAI;;;;;;WAOJ;IACR;IACA;IACA;;;;;;;;;WAUQ,QAAQ;;;;;;;;;WAUR,WAAW;;WAGX,YAAY;EAErB,YACC,IAAI,cAAc,QACD,QAAQ,cAAc,eAEtB;;EAAA,wBAAuB,cAEvB;;EAAA,gBAAgB;;WAyEzB,KAAK;WACL,MAAM;WACN,KAAK;WACL,OAAO;WACP,QAAQ;WACR,SAAS;;;;;;;;;;;;;;;;;;;WAoBT,UAAU;WACV,SAAS;WACT,SAAS;WACT,OAAO;WACP,WAAW;WACX,YAAY;WACZ,WAAW;WACX,KAAK;WACL,OAAO;;;;;;;;;;;;;;;;EAiBhB,KAAK,WAAW,gBAAgB,QAAQ,OAAO;;;;;;;;;;;;;;;EAuB/C,MAAM,qBAAqB,eAAe,QAAQ,OAAO;;;;;;;;;;EAkBzD,WAAW"}