@geekmidas/constructs 10.0.0-alpha.2 → 10.0.0-alpha.21

package/dist/email.d.mts

@@ -1,11 +1,9 @@
-import { Construct } from "./construct-interface-g5GM5pwR.mjs";
+import { n as Construct } from "./construct-interface-Clz7_BwB.mjs";
 import { ConstructName, Declaration } from "@geekmidas/manifest";
 import { EmailClient, TemplateRecord } from "@geekmidas/emailkit";
 import { Service } from "@geekmidas/services";
-
 //#region src/email.d.ts
-
-interface EmailOptions<TTemplates extends TemplateRecord> {
+export interface EmailOptions<TTemplates extends TemplateRecord> {
   /**
    * The React templates this app can send.
    *
@@ -24,7 +22,7 @@ interface EmailOptions<TTemplates extends TemplateRecord> {
    */
   replyTo?: string;
 }
-declare class Email<TName extends string = string, TTemplates extends TemplateRecord = TemplateRecord> implements Construct<TName, EmailClient<TTemplates>> {
+export declare class Email<TName extends string = string, TTemplates extends TemplateRecord = TemplateRecord> implements Construct<TName, EmailClient<TTemplates>> {
   private readonly options;
   readonly id: TName;
   readonly service: Service<Uncapitalize<TName>, EmailClient<TTemplates>>;
@@ -44,7 +42,5 @@ declare class Email<TName extends string = string, TTemplates extends TemplateRe
    */
   private connect;
 }
-//# sourceMappingURL=email.d.ts.map
 //#endregion
-export { Email, EmailOptions };
 //# sourceMappingURL=email.d.mts.map

package/dist/email.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"email.d.mts","names":[],"sources":["../src/email.ts"],"sourcesContent":[],"mappings":";;;;;;;AAqD8B,UAvBb,YAuBa,CAAA,mBAvBmB,cAuBnB,CAAA,CAAA;EAAW;;;;;;;;EAYtB,SACsB,EA3B7B,UA2B6B;EAAU;;;AAb7B;;;;;;cAHT,wDAEO,iBAAiB,2BACxB,UAAU,OAAO,YAAY;;eAE5B;oBACK,QAAQ,aAAa,QAAQ,YAAY;;;;;;kBAStD,cAAc,iBACQ,aAAa;aAoB7B"}
+{"version":3,"file":"email.d.mts","names":[],"sources":["../src/email.ts"],"mappings":";;;;;iBA8BiB,aAAa,mBAAmB;;;;;;;;;EAShD,WAAW;;;;;;;;EAQX;;qBAGY,MACZ,+BACA,mBAAmB,iBAAiB,2BACxB,UAAU,OAAO,YAAY;mBAavB;WAXT,IAAI;WACJ,SAAS,QAAQ,aAAa,QAAQ,YAAY;;;;;mBAM1C;EAEjB,YACC,IAAI,cAAc,QACD,SAAS,aAAa;EAoBxC,WAAW;;;;;;;;UAiBG"}

package/dist/email.mjs

@@ -1,8 +1,21 @@
 import { canonicalId, provideKey, serviceKey } from "@geekmidas/manifest";
 import { createEmailClient, parseEmailUrl } from "@geekmidas/emailkit";
-
 //#region src/email.ts
+/**
+* `Email` — declared outbound mail.
+*
+* The same three-package meeting point as `ObjectStorage`: it implements the
+* construct contract, derives its env key through `@geekmidas/manifest`, and
+* hands back an `@geekmidas/emailkit` client. It names no provider — locally the
+* injected URL points at Mailpit, deployed it points at SES or whichever service
+* config selected.
+*
+* Where object storage needs a driver per provider, this needs none: mail is
+* delivered over SMTP whoever delivers it, so there is one client and one URL
+* shape, and the provider survives only as a host and a credential.
+*/
 var Email = class {
+	options;
 	id;
 	service;
 	/**
@@ -20,7 +33,7 @@ var Email = class {
 		};
 		this.service = {
 			serviceName: serviceKey(canonical),
-			register: (options$1) => this.connect(options$1)
+			register: (options) => this.connect(options)
 		};
 	}
 	declare() {
@@ -52,7 +65,7 @@ var Email = class {
 		});
 	}
 };
-
 //#endregion
 export { Email };
+
 //# sourceMappingURL=email.mjs.map

package/dist/email.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"email.mjs","names":["id: ConstructName<TName>","options: EmailOptions<TTemplates>","options"],"sources":["../src/email.ts"],"sourcesContent":["/**\n * `Email` — declared outbound mail.\n *\n * The same three-package meeting point as `ObjectStorage`: it implements the\n * construct contract, derives its env key through `@geekmidas/manifest`, and\n * hands back an `@geekmidas/emailkit` client. It names no provider — locally the\n * injected URL points at Mailpit, deployed it points at SES or whichever service\n * config selected.\n *\n * Where object storage needs a driver per provider, this needs none: mail is\n * delivered over SMTP whoever delivers it, so there is one client and one URL\n * shape, and the provider survives only as a host and a credential.\n */\n\nimport {\n\tcreateEmailClient,\n\ttype EmailClient,\n\tparseEmailUrl,\n\ttype TemplateRecord,\n} from '@geekmidas/emailkit';\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport type { Construct } from './construct-interface';\n\nexport interface EmailOptions<TTemplates extends TemplateRecord> {\n\t/**\n\t * The React templates this app can send.\n\t *\n\t * Structural — they are code, they ship with the handler, and which ones\n\t * exist cannot differ between stages. They are also what types\n\t * `sendTemplate`, so passing them here is what makes the client's call sites\n\t * checkable.\n\t */\n\ttemplates: TTemplates;\n\t/**\n\t * A reply-to address for every send.\n\t *\n\t * `from` is deliberately absent: it belongs to the verified sending domain,\n\t * which is `myapp.test` locally and the real domain deployed, so it arrives\n\t * as stage config rather than being written here.\n\t */\n\treplyTo?: string;\n}\n\nexport class Email<\n\tTName extends string = string,\n\tTTemplates extends TemplateRecord = TemplateRecord,\n> implements Construct<TName, EmailClient<TTemplates>>\n{\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, EmailClient<TTemplates>>;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the key the\n\t * build publishes and the key the client reads cannot drift.\n\t */\n\tprivate readonly keys: { url: string; from: string };\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly options: EmailOptions<TTemplates>,\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.keys = {\n\t\t\turl: provideKey(canonical, 'url'),\n\t\t\t// The sending identity travels with the URL rather than being a second\n\t\t\t// construct option, for the same reason the URL does: it is the one\n\t\t\t// thing about mail that differs per stage.\n\t\t\tfrom: provideKey(canonical, 'from'),\n\t\t};\n\n\t\t// A field, not a getter: consumers cache services by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\tregister: (options) => this.connect(options),\n\t\t};\n\t}\n\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'email',\n\t\t\t\tid: this.id,\n\t\t\t\tprovides: [this.keys.url, this.keys.from],\n\t\t\t},\n\t\t];\n\t}\n\n\t/**\n\t * Builds the client from the URL the adapter supplied.\n\t *\n\t * No provider branch and no driver lookup — `parseEmailUrl` turns any of\n\t * Mailpit, SES, or Resend into the same transport config, which is the whole\n\t * reason the scheme is always `smtp://`.\n\t */\n\tprivate async connect({\n\t\tenvParser,\n\t}: ServiceRegisterOptions): Promise<EmailClient<TTemplates>> {\n\t\tconst { url, from } = envParser\n\t\t\t.create((get) => ({\n\t\t\t\turl: get(this.keys.url).string(),\n\t\t\t\tfrom: get(this.keys.from).string(),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\treturn createEmailClient({\n\t\t\tsmtp: parseEmailUrl(url),\n\t\t\ttemplates: this.options.templates,\n\t\t\tdefaults: {\n\t\t\t\tfrom,\n\t\t\t\t...(this.options.replyTo ? { replyTo: this.options.replyTo } : {}),\n\t\t\t},\n\t\t});\n\t}\n}\n"],"mappings":";;;;AAkDA,IAAa,QAAb,MAIA;CACC,AAAS;CACT,AAAS;;;;;CAMT,AAAiB;CAEjB,YACCA,IACiBC,SAChB;EADgB;EAEjB,MAAM,YAAY,YAAY,GAAa;AAE3C,OAAK,KAAK;AACV,OAAK,OAAO;GACX,KAAK,WAAW,WAAW,MAAM;GAIjC,MAAM,WAAW,WAAW,OAAO;EACnC;AAGD,OAAK,UAAU;GACd,aAAa,WAAW,UAAU;GAClC,UAAU,CAACC,cAAY,KAAK,QAAQA,UAAQ;EAC5C;CACD;CAED,UAAyB;AACxB,SAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,UAAU,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,IAAK;EACzC,CACD;CACD;;;;;;;;CASD,MAAc,QAAQ,EACrB,WACwB,EAAoC;EAC5D,MAAM,EAAE,KAAK,MAAM,GAAG,UACpB,OAAO,CAAC,SAAS;GACjB,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC,QAAQ;GAChC,MAAM,IAAI,KAAK,KAAK,KAAK,CAAC,QAAQ;EAClC,GAAE,CACF,OAAO;AAET,SAAO,kBAAkB;GACxB,MAAM,cAAc,IAAI;GACxB,WAAW,KAAK,QAAQ;GACxB,UAAU;IACT;IACA,GAAI,KAAK,QAAQ,UAAU,EAAE,SAAS,KAAK,QAAQ,QAAS,IAAG,CAAE;GACjE;EACD,EAAC;CACF;AACD"}
+{"version":3,"file":"email.mjs","names":[],"sources":["../src/email.ts"],"sourcesContent":["/**\n * `Email` — declared outbound mail.\n *\n * The same three-package meeting point as `ObjectStorage`: it implements the\n * construct contract, derives its env key through `@geekmidas/manifest`, and\n * hands back an `@geekmidas/emailkit` client. It names no provider — locally the\n * injected URL points at Mailpit, deployed it points at SES or whichever service\n * config selected.\n *\n * Where object storage needs a driver per provider, this needs none: mail is\n * delivered over SMTP whoever delivers it, so there is one client and one URL\n * shape, and the provider survives only as a host and a credential.\n */\n\nimport {\n\tcreateEmailClient,\n\ttype EmailClient,\n\tparseEmailUrl,\n\ttype TemplateRecord,\n} from '@geekmidas/emailkit';\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport type { Construct } from './construct-interface';\n\nexport interface EmailOptions<TTemplates extends TemplateRecord> {\n\t/**\n\t * The React templates this app can send.\n\t *\n\t * Structural — they are code, they ship with the handler, and which ones\n\t * exist cannot differ between stages. They are also what types\n\t * `sendTemplate`, so passing them here is what makes the client's call sites\n\t * checkable.\n\t */\n\ttemplates: TTemplates;\n\t/**\n\t * A reply-to address for every send.\n\t *\n\t * `from` is deliberately absent: it belongs to the verified sending domain,\n\t * which is `myapp.test` locally and the real domain deployed, so it arrives\n\t * as stage config rather than being written here.\n\t */\n\treplyTo?: string;\n}\n\nexport class Email<\n\tTName extends string = string,\n\tTTemplates extends TemplateRecord = TemplateRecord,\n> implements Construct<TName, EmailClient<TTemplates>>\n{\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, EmailClient<TTemplates>>;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the key the\n\t * build publishes and the key the client reads cannot drift.\n\t */\n\tprivate readonly keys: { url: string; from: string };\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly options: EmailOptions<TTemplates>,\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.keys = {\n\t\t\turl: provideKey(canonical, 'url'),\n\t\t\t// The sending identity travels with the URL rather than being a second\n\t\t\t// construct option, for the same reason the URL does: it is the one\n\t\t\t// thing about mail that differs per stage.\n\t\t\tfrom: provideKey(canonical, 'from'),\n\t\t};\n\n\t\t// A field, not a getter: consumers cache services by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\tregister: (options) => this.connect(options),\n\t\t};\n\t}\n\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'email',\n\t\t\t\tid: this.id,\n\t\t\t\tprovides: [this.keys.url, this.keys.from],\n\t\t\t},\n\t\t];\n\t}\n\n\t/**\n\t * Builds the client from the URL the adapter supplied.\n\t *\n\t * No provider branch and no driver lookup — `parseEmailUrl` turns any of\n\t * Mailpit, SES, or Resend into the same transport config, which is the whole\n\t * reason the scheme is always `smtp://`.\n\t */\n\tprivate async connect({\n\t\tenvParser,\n\t}: ServiceRegisterOptions): Promise<EmailClient<TTemplates>> {\n\t\tconst { url, from } = envParser\n\t\t\t.create((get) => ({\n\t\t\t\turl: get(this.keys.url).string(),\n\t\t\t\tfrom: get(this.keys.from).string(),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\treturn createEmailClient({\n\t\t\tsmtp: parseEmailUrl(url),\n\t\t\ttemplates: this.options.templates,\n\t\t\tdefaults: {\n\t\t\t\tfrom,\n\t\t\t\t...(this.options.replyTo ? { replyTo: this.options.replyTo } : {}),\n\t\t\t},\n\t\t});\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAkDA,IAAa,QAAb,MAIA;CAYmB;CAXlB;CACA;;;;;CAMA;CAEA,YACC,IACA,SACC;EADgB,KAAA,UAAA;EAEjB,MAAM,YAAY,YAAY,EAAY;EAE1C,KAAK,KAAK;EACV,KAAK,OAAO;GACX,KAAK,WAAW,WAAW,KAAK;GAIhC,MAAM,WAAW,WAAW,MAAM;EACnC;EAGA,KAAK,UAAU;GACd,aAAa,WAAW,SAAS;GACjC,WAAW,YAAY,KAAK,QAAQ,OAAO;EAC5C;CACD;CAEA,UAAyB;EACxB,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,UAAU,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI;EACzC,CACD;CACD;;;;;;;;CASA,MAAc,QAAQ,EACrB,aAC4D;EAC5D,MAAM,EAAE,KAAK,SAAS,UACpB,QAAQ,SAAS;GACjB,KAAK,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC,OAAO;GAC/B,MAAM,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO;EAClC,EAAE,CAAC,CACF,MAAM;EAER,OAAO,kBAAkB;GACxB,MAAM,cAAc,GAAG;GACvB,WAAW,KAAK,QAAQ;GACxB,UAAU;IACT;IACA,GAAI,KAAK,QAAQ,UAAU,EAAE,SAAS,KAAK,QAAQ,QAAQ,IAAI,CAAC;GACjE;EACD,CAAC;CACF;AACD"}

package/dist/endpoints/index.cjs

@@ -1,16 +1,13 @@
-require('../construct-interface-BfjcOD_E.cjs');
-require('../Construct-CyS3RpTL.cjs');
-require('../functions-Bd3TPxid.cjs');
-const require_EndpointFactory = require('../EndpointFactory-ChxLZllA.cjs');
-require('../clone-Dy0cR2SZ.cjs');
-const require_Endpoint = require('../Endpoint-BiaaMEn_.cjs');
-const require_surfaceEnv = require('../surfaceEnv-BFXEms2f.cjs');
-const require_lazyAccessors = require('../lazyAccessors-e3j2oE2m.cjs');
-
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_EndpointFactory = require("../EndpointFactory-vE2C1NG1.cjs");
+const require_Endpoint = require("../Endpoint-CtiPUpRX.cjs");
+const require_surfaceEnv = require("../surfaceEnv-CNimK76p.cjs");
+const require_lazyAccessors = require("../lazyAccessors-Dx9NLwJZ.cjs");
 exports.BUILT_IN_SECURITY_SCHEMES = require_EndpointFactory.BUILT_IN_SECURITY_SCHEMES;
 exports.Endpoint = require_Endpoint.Endpoint;
 exports.EndpointBuilder = require_EndpointFactory.EndpointBuilder;
 exports.EndpointFactory = require_EndpointFactory.EndpointFactory;
+exports.NoAuthenticator = require_Endpoint.NoAuthenticator;
 exports.RLS_BYPASS = require_EndpointFactory.RLS_BYPASS;
 exports.ResponseBuilder = require_Endpoint.ResponseBuilder;
 exports.createApiGatewayCookies = require_lazyAccessors.createApiGatewayCookies;
@@ -24,4 +21,4 @@ exports.defaultEnvParser = require_surfaceEnv.defaultEnvParser;
 exports.envParserFor = require_surfaceEnv.envParserFor;
 exports.getSecurityScheme = require_EndpointFactory.getSecurityScheme;
 exports.isBuiltInSecurityScheme = require_EndpointFactory.isBuiltInSecurityScheme;
-exports.publishConstructEvents = require_lazyAccessors.publishConstructEvents;
+exports.publishConstructEvents = require_lazyAccessors.publishConstructEvents;

package/dist/endpoints/index.d.cts

@@ -1,7 +1,60 @@
-import "../Construct-C0ijr2qp.cjs";
-import "../index-JSf9xNIJ.cjs";
-import "../construct-interface-D9d4Gm4p.cjs";
-import "../types-BlAkSuGI.cjs";
-import { ActorExtractor, Authorizer, BUILT_IN_SECURITY_SCHEMES, BuiltInSecuritySchemeId, Endpoint, EndpointContext, EndpointHandler, EndpointOutput, EndpointSchemas, MappedAudit, OAuthFlow, OAuthFlows, RLS_BYPASS, ResponseBuilder, RlsBypass, RlsConfig, RlsContext, RlsContextExtractor, SecurityScheme, createAuthorizer, getSecurityScheme, isBuiltInSecurityScheme } from "../Endpoint-CH9Fn1AD.cjs";
-import { EndpointBuilder, EndpointFactory, createApiGatewayCookies, createApiGatewayHeaders, createHonoCookies, createHonoHeaders, createNoopCookies, createNoopHeaders, defaultEnvParser, envParserFor, publishConstructEvents } from "../index-V2nksZIJ.cjs";
-export { ActorExtractor, Authorizer, BUILT_IN_SECURITY_SCHEMES, BuiltInSecuritySchemeId, Endpoint, EndpointBuilder, EndpointContext, EndpointFactory, EndpointHandler, EndpointOutput, EndpointSchemas, MappedAudit, OAuthFlow, OAuthFlows, RLS_BYPASS, ResponseBuilder, RlsBypass, RlsConfig, RlsContext, RlsContextExtractor, SecurityScheme, createApiGatewayCookies, createApiGatewayHeaders, createAuthorizer, createHonoCookies, createHonoHeaders, createNoopCookies, createNoopHeaders, defaultEnvParser, envParserFor, getSecurityScheme, isBuiltInSecurityScheme, publishConstructEvents };
+import { t as StandardSchemaV1 } from "../index-CeEtxDmK.cjs";
+import { t as Construct } from "../Construct-DTqYvkPG.cjs";
+import { A as getSecurityScheme, C as Authorizer, D as OAuthFlows, E as OAuthFlow, O as SecurityScheme, S as MappedAudit, T as BuiltInSecuritySchemeId, _ as RlsBypass, a as EndpointContext, b as RlsContextExtractor, c as EndpointSchemas, d as ResponseBuilder, g as RLS_BYPASS, h as SessionAuth, i as Endpoint, j as isBuiltInSecurityScheme, k as createAuthorizer, l as EndpointSurface, m as NoAuthenticator, n as ConvertRouteParams, o as EndpointHandler, r as CookieFn, s as EndpointOutput, u as HeaderFn, v as RlsConfig, w as BUILT_IN_SECURITY_SCHEMES, x as ActorExtractor, y as RlsContext } from "../Endpoint-DbYQJgb-.cjs";
+import { n as EndpointBuilder, t as EndpointFactory } from "../EndpointFactory-DE6nKtFZ.cjs";
+import { EnvironmentParser } from "@geekmidas/envkit";
+import { EventPublisher, MappedEvent } from "@geekmidas/events";
+import { Logger } from "@geekmidas/logger";
+import { InferStandardSchema } from "@geekmidas/schema";
+import { Service, ServiceDiscovery } from "@geekmidas/services";
+import { AuditStorage } from "@geekmidas/audit";
+import { Context } from "hono";
+//#region src/publisher.d.ts
+export declare function publishConstructEvents<T extends EventPublisher<any> | undefined, OutSchema extends StandardSchemaV1 | undefined = undefined, TServiceName extends string = string, TServices extends Service[] = [], TAuditStorageServiceName extends string = string, TAuditStorage extends AuditStorage | undefined = undefined>(construct: Construct<Logger, TServiceName, T, OutSchema, TServices, TAuditStorageServiceName, TAuditStorage>, response: InferStandardSchema<OutSchema>, serviceDiscovery: ServiceDiscovery<any>, logger?: Logger): Promise<void>;
+//#endregion
+//#region src/endpoints/lazyAccessors.d.ts
+/**
+ * Create a lazy header accessor for Hono.
+ * Uses `c.req.header(name)` for single lookups (native, case-insensitive).
+ * Only calls `c.req.header()` to get all headers when needed.
+ */
+export declare function createHonoHeaders(c: Context): HeaderFn;
+/**
+ * Create a lazy cookie accessor for Hono.
+ * Uses `getCookie(c, name)` for single lookups (native).
+ * Only parses the cookie header when all cookies are requested.
+ */
+export declare function createHonoCookies(c: Context): CookieFn;
+/**
+ * Create a lazy header accessor for API Gateway events.
+ * Handles case-insensitive lookups.
+ */
+export declare function createApiGatewayHeaders(headers: Record<string, string | undefined> | null | undefined): HeaderFn;
+/**
+ * Create a lazy cookie accessor for API Gateway events.
+ * Decodes URL-encoded values to match browser behavior.
+ */
+export declare function createApiGatewayCookies(cookies: string[] | undefined, cookieHeader: string | undefined): CookieFn;
+/**
+ * Create a no-op header accessor (for minimal endpoints that don't use headers).
+ */
+export declare function createNoopHeaders(): HeaderFn;
+/**
+ * Create a no-op cookie accessor (for minimal endpoints that don't use cookies).
+ */
+export declare function createNoopCookies(): CookieFn;
+//#endregion
+//#region src/endpoints/surfaceEnv.d.ts
+/**
+ * The default parser, built once.
+ *
+ * Once because `Credentials` resolves through `globalThis` and decryption is
+ * not free, and because two parsers over the same environment are two caches of
+ * the same answer.
+ */
+export declare function defaultEnvParser(): EnvironmentParser<{}>;
+/** The parser for an endpoint, from its surface or the default. */
+export declare function envParserFor(surface: EndpointSurface | undefined): EnvironmentParser<{}>;
+//#endregion
+export { type ActorExtractor, type Authorizer, BUILT_IN_SECURITY_SCHEMES, type BuiltInSecuritySchemeId, type ConvertRouteParams, Endpoint, EndpointBuilder, type EndpointContext, EndpointFactory, type EndpointHandler, type EndpointOutput, type EndpointSchemas, type MappedAudit, NoAuthenticator, type OAuthFlow, type OAuthFlows, RLS_BYPASS, ResponseBuilder, type RlsBypass, type RlsConfig, type RlsContext, type RlsContextExtractor, type SecurityScheme, type SessionAuth, createAuthorizer, getSecurityScheme, isBuiltInSecurityScheme };
+//# sourceMappingURL=index.d.cts.map

package/dist/endpoints/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/publisher.ts","../../src/endpoints/lazyAccessors.ts","../../src/endpoints/surfaceEnv.ts"],"mappings":";;;;;;;;;;;;wBAgEsB,uBACrB,UAAU,iCACV,kBAAkB,0CAClB,sCACA,kBAAkB,gBAClB,kDACA,sBAAsB,sCAEtB,WAAW,UACV,QACA,cACA,GACA,WACA,WACA,0BACA,gBAED,UAAU,oBAAoB,YAC9B,kBAAkB,uBAClB,SAAQ,SAAyB;;;;;;;;wBCnElB,kBAAkB,GAAG,UAAU;;;;;;wBAqB/B,kBAAkB,GAAG,UAAU;;;;;wBAgC/B,wBACf,SAAS,wDACP;;;;;wBAoCa,wBACf,+BACA,mCACE;;;;wBAmHa,qBAAqB;;;;wBAUrB,qBAAqB;;;;;;;;;;wBC1MrB,oBAAoB;;wBASpB,aACf,SAAS,8BACP"}

package/dist/endpoints/index.d.mts

@@ -1,7 +1,60 @@
-import "../Construct-Ct8nalEi.mjs";
-import "../index-CubPzHd9.mjs";
-import "../construct-interface-g5GM5pwR.mjs";
-import "../types-aKksMEWL.mjs";
-import { ActorExtractor, Authorizer, BUILT_IN_SECURITY_SCHEMES, BuiltInSecuritySchemeId, Endpoint, EndpointContext, EndpointHandler, EndpointOutput, EndpointSchemas, MappedAudit, OAuthFlow, OAuthFlows, RLS_BYPASS, ResponseBuilder, RlsBypass, RlsConfig, RlsContext, RlsContextExtractor, SecurityScheme, createAuthorizer, getSecurityScheme, isBuiltInSecurityScheme } from "../Endpoint-2Wg7T7Cq.mjs";
-import { EndpointBuilder, EndpointFactory, createApiGatewayCookies, createApiGatewayHeaders, createHonoCookies, createHonoHeaders, createNoopCookies, createNoopHeaders, defaultEnvParser, envParserFor, publishConstructEvents } from "../index-BxHDdy6a.mjs";
-export { ActorExtractor, Authorizer, BUILT_IN_SECURITY_SCHEMES, BuiltInSecuritySchemeId, Endpoint, EndpointBuilder, EndpointContext, EndpointFactory, EndpointHandler, EndpointOutput, EndpointSchemas, MappedAudit, OAuthFlow, OAuthFlows, RLS_BYPASS, ResponseBuilder, RlsBypass, RlsConfig, RlsContext, RlsContextExtractor, SecurityScheme, createApiGatewayCookies, createApiGatewayHeaders, createAuthorizer, createHonoCookies, createHonoHeaders, createNoopCookies, createNoopHeaders, defaultEnvParser, envParserFor, getSecurityScheme, isBuiltInSecurityScheme, publishConstructEvents };
+import { t as StandardSchemaV1 } from "../index-CeEtxDmK.mjs";
+import { t as Construct } from "../Construct-pVadmURD.mjs";
+import { A as getSecurityScheme, C as Authorizer, D as OAuthFlows, E as OAuthFlow, O as SecurityScheme, S as MappedAudit, T as BuiltInSecuritySchemeId, _ as RlsBypass, a as EndpointContext, b as RlsContextExtractor, c as EndpointSchemas, d as ResponseBuilder, g as RLS_BYPASS, h as SessionAuth, i as Endpoint, j as isBuiltInSecurityScheme, k as createAuthorizer, l as EndpointSurface, m as NoAuthenticator, n as ConvertRouteParams, o as EndpointHandler, r as CookieFn, s as EndpointOutput, u as HeaderFn, v as RlsConfig, w as BUILT_IN_SECURITY_SCHEMES, x as ActorExtractor, y as RlsContext } from "../Endpoint-BxkRWQ8G.mjs";
+import { n as EndpointBuilder, t as EndpointFactory } from "../EndpointFactory-T06kTFHg.mjs";
+import { EnvironmentParser } from "@geekmidas/envkit";
+import { EventPublisher, MappedEvent } from "@geekmidas/events";
+import { Service, ServiceDiscovery } from "@geekmidas/services";
+import { Context } from "hono";
+import { AuditStorage } from "@geekmidas/audit";
+import { Logger } from "@geekmidas/logger";
+import { InferStandardSchema } from "@geekmidas/schema";
+//#region src/publisher.d.ts
+export declare function publishConstructEvents<T extends EventPublisher<any> | undefined, OutSchema extends StandardSchemaV1 | undefined = undefined, TServiceName extends string = string, TServices extends Service[] = [], TAuditStorageServiceName extends string = string, TAuditStorage extends AuditStorage | undefined = undefined>(construct: Construct<Logger, TServiceName, T, OutSchema, TServices, TAuditStorageServiceName, TAuditStorage>, response: InferStandardSchema<OutSchema>, serviceDiscovery: ServiceDiscovery<any>, logger?: Logger): Promise<void>;
+//#endregion
+//#region src/endpoints/lazyAccessors.d.ts
+/**
+ * Create a lazy header accessor for Hono.
+ * Uses `c.req.header(name)` for single lookups (native, case-insensitive).
+ * Only calls `c.req.header()` to get all headers when needed.
+ */
+export declare function createHonoHeaders(c: Context): HeaderFn;
+/**
+ * Create a lazy cookie accessor for Hono.
+ * Uses `getCookie(c, name)` for single lookups (native).
+ * Only parses the cookie header when all cookies are requested.
+ */
+export declare function createHonoCookies(c: Context): CookieFn;
+/**
+ * Create a lazy header accessor for API Gateway events.
+ * Handles case-insensitive lookups.
+ */
+export declare function createApiGatewayHeaders(headers: Record<string, string | undefined> | null | undefined): HeaderFn;
+/**
+ * Create a lazy cookie accessor for API Gateway events.
+ * Decodes URL-encoded values to match browser behavior.
+ */
+export declare function createApiGatewayCookies(cookies: string[] | undefined, cookieHeader: string | undefined): CookieFn;
+/**
+ * Create a no-op header accessor (for minimal endpoints that don't use headers).
+ */
+export declare function createNoopHeaders(): HeaderFn;
+/**
+ * Create a no-op cookie accessor (for minimal endpoints that don't use cookies).
+ */
+export declare function createNoopCookies(): CookieFn;
+//#endregion
+//#region src/endpoints/surfaceEnv.d.ts
+/**
+ * The default parser, built once.
+ *
+ * Once because `Credentials` resolves through `globalThis` and decryption is
+ * not free, and because two parsers over the same environment are two caches of
+ * the same answer.
+ */
+export declare function defaultEnvParser(): EnvironmentParser<{}>;
+/** The parser for an endpoint, from its surface or the default. */
+export declare function envParserFor(surface: EndpointSurface | undefined): EnvironmentParser<{}>;
+//#endregion
+export { type ActorExtractor, type Authorizer, BUILT_IN_SECURITY_SCHEMES, type BuiltInSecuritySchemeId, type ConvertRouteParams, Endpoint, EndpointBuilder, type EndpointContext, EndpointFactory, type EndpointHandler, type EndpointOutput, type EndpointSchemas, type MappedAudit, NoAuthenticator, type OAuthFlow, type OAuthFlows, RLS_BYPASS, ResponseBuilder, type RlsBypass, type RlsConfig, type RlsContext, type RlsContextExtractor, type SecurityScheme, type SessionAuth, createAuthorizer, getSecurityScheme, isBuiltInSecurityScheme };
+//# sourceMappingURL=index.d.mts.map

package/dist/endpoints/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/publisher.ts","../../src/endpoints/lazyAccessors.ts","../../src/endpoints/surfaceEnv.ts"],"mappings":";;;;;;;;;;;;wBAgEsB,uBACrB,UAAU,iCACV,kBAAkB,0CAClB,sCACA,kBAAkB,gBAClB,kDACA,sBAAsB,sCAEtB,WAAW,UACV,QACA,cACA,GACA,WACA,WACA,0BACA,gBAED,UAAU,oBAAoB,YAC9B,kBAAkB,uBAClB,SAAQ,SAAyB;;;;;;;;wBCnElB,kBAAkB,GAAG,UAAU;;;;;;wBAqB/B,kBAAkB,GAAG,UAAU;;;;;wBAgC/B,wBACf,SAAS,wDACP;;;;;wBAoCa,wBACf,+BACA,mCACE;;;;wBAmHa,qBAAqB;;;;wBAUrB,qBAAqB;;;;;;;;;;wBC1MrB,oBAAoB;;wBASpB,aACf,SAAS,8BACP"}

package/dist/endpoints/index.mjs

@@ -1,10 +1,5 @@
-import "../Construct-BD5neF7w.mjs";
-import "../construct-interface-Z4CpS8tK.mjs";
-import "../functions-Cxbo-pEd.mjs";
-import { BUILT_IN_SECURITY_SCHEMES, EndpointBuilder, EndpointFactory, RLS_BYPASS, createAuthorizer, getSecurityScheme, isBuiltInSecurityScheme } from "../EndpointFactory-DTTCkGEL.mjs";
-import "../clone-DblgEZZa.mjs";
-import { Endpoint, ResponseBuilder } from "../Endpoint-VIOpSo0S.mjs";
-import { defaultEnvParser, envParserFor } from "../surfaceEnv-C3Ktahea.mjs";
-import { createApiGatewayCookies, createApiGatewayHeaders, createHonoCookies, createHonoHeaders, createNoopCookies, createNoopHeaders, publishConstructEvents } from "../lazyAccessors-BoJN3SMd.mjs";
-
-export { BUILT_IN_SECURITY_SCHEMES, Endpoint, EndpointBuilder, EndpointFactory, RLS_BYPASS, ResponseBuilder, createApiGatewayCookies, createApiGatewayHeaders, createAuthorizer, createHonoCookies, createHonoHeaders, createNoopCookies, createNoopHeaders, defaultEnvParser, envParserFor, getSecurityScheme, isBuiltInSecurityScheme, publishConstructEvents };
+import { a as createAuthorizer, i as BUILT_IN_SECURITY_SCHEMES, n as EndpointBuilder, o as getSecurityScheme, r as RLS_BYPASS, s as isBuiltInSecurityScheme, t as EndpointFactory } from "../EndpointFactory-Bs8pu-yY.mjs";
+import { n as ResponseBuilder, r as NoAuthenticator, t as Endpoint } from "../Endpoint-DCr5tlbJ.mjs";
+import { n as envParserFor, t as defaultEnvParser } from "../surfaceEnv-wMT5QzgZ.mjs";
+import { a as createHonoHeaders, i as createHonoCookies, l as publishConstructEvents, n as createApiGatewayHeaders, o as createNoopCookies, s as createNoopHeaders, t as createApiGatewayCookies } from "../lazyAccessors-BHtcqgz2.mjs";
+export { BUILT_IN_SECURITY_SCHEMES, Endpoint, EndpointBuilder, EndpointFactory, NoAuthenticator, RLS_BYPASS, ResponseBuilder, createApiGatewayCookies, createApiGatewayHeaders, createAuthorizer, createHonoCookies, createHonoHeaders, createNoopCookies, createNoopHeaders, defaultEnvParser, envParserFor, getSecurityScheme, isBuiltInSecurityScheme, publishConstructEvents };

package/dist/file-server.cjs

@@ -1,10 +1,41 @@
-const require_chunk = require('./chunk-DWy1uDak.cjs');
-const __geekmidas_manifest = require_chunk.__toESM(require("@geekmidas/manifest"));
-const __geekmidas_storage = require_chunk.__toESM(require("@geekmidas/storage"));
-
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let _geekmidas_manifest = require("@geekmidas/manifest");
+let _geekmidas_storage = require("@geekmidas/storage");
 //#region src/file-server.ts
+/**
+* `FileServer` — a domain that serves a bucket's objects.
+*
+* `ObjectStorage` is the bucket: it writes, it presigns, and its URL is never
+* public. Serving those objects on a domain is a different thing, and it is a
+* construct of its own rather than a flag on the bucket — see
+* `docs/design/constructs-paradigm.md`, "Why a separate construct, and what it
+* costs", for the comparison that rules the other two shapes out.
+*
+* ```ts
+* export const uploads = new FileServer('Uploads', { open: ['brand/**'] });
+*
+* uploads.getUploadURL({ path, contentType })  // an S3 presign at the bucket
+* uploads.url('brand/logo.png')                // open path — no signature
+* uploads.signedUrl('invoices/7.pdf')          // one object, one recipient
+* ```
+*
+* **One construct, one client, both halves.** How a file lands in the bucket is
+* the same whether or not it is served, so splitting the upload half from the
+* serving half would be ceremony rather than safety. The client is a *superset*
+* of `StorageClient`, made literal in the type, so anything taking
+* `services.uploads` keeps compiling when the construct behind it grows a
+* serving half.
+*
+* **The id names the bucket, not the surface.** This is the detail that has to
+* be right before anything ships, because getting it backwards is destructive:
+* the migration people actually perform is serving a bucket they already have,
+* and naming the bucket after the construct makes that edit *add* a node rather
+* than rename the one holding the data.
+*/
 /** A key was asked to be served unsigned, and no open pattern admits it. */
 var NotOpen = class extends Error {
+	key;
+	open;
 	constructor(key, open) {
 		super(`'${key}' is not served without a signature. ` + (open.length ? `Open paths: ${open.join(", ")}. Use signedUrl() for anything else.` : "This file server declares no open paths, so every object needs signedUrl()."));
 		this.key = key;
@@ -13,6 +44,7 @@ var NotOpen = class extends Error {
 	}
 };
 var FileServer = class {
+	options;
 	id;
 	service;
 	/** The id of the surface node, as opposed to the bucket's. */
@@ -25,17 +57,17 @@ var FileServer = class {
 	keys;
 	constructor(id, options = {}) {
 		this.options = options;
-		const canonical = (0, __geekmidas_manifest.canonicalId)(id);
+		const canonical = (0, _geekmidas_manifest.canonicalId)(id);
 		this.id = canonical;
 		this.open = options.open ?? [];
 		const originId = options.origin?.id ?? canonical;
 		this.surfaceId = `${canonical}Server`;
 		this.keys = {
-			origin: (0, __geekmidas_manifest.provideKey)(originId, "url"),
-			server: (0, __geekmidas_manifest.provideKey)(this.surfaceId, "url")
+			origin: (0, _geekmidas_manifest.provideKey)(originId, "url"),
+			server: (0, _geekmidas_manifest.provideKey)(this.surfaceId, "url")
 		};
 		this.service = {
-			serviceName: (0, __geekmidas_manifest.serviceKey)(canonical),
+			serviceName: (0, _geekmidas_manifest.serviceKey)(canonical),
 			register: (registerOptions) => this.connect(registerOptions)
 		};
 	}
@@ -99,7 +131,7 @@ var FileServer = class {
 			origin: get(this.keys.origin).string(),
 			server: get(this.keys.server).string()
 		})).parse();
-		const storage = (0, __geekmidas_storage.createStorageClient)(origin);
+		const storage = (0, _geekmidas_storage.createStorageClient)(origin);
 		const base = server.replace(/\/+$/, "");
 		const serve = (key) => {
 			if (!this.serves(key)) throw new NotOpen(key, this.open);
@@ -147,8 +179,8 @@ function globToRegExp(pattern) {
 	}
 	return new RegExp(`^${source}$`);
 }
-
 //#endregion
 exports.FileServer = FileServer;
 exports.NotOpen = NotOpen;
+
 //# sourceMappingURL=file-server.cjs.map

package/dist/file-server.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"file-server.cjs","names":["key: string","open: readonly string[]","id: ConstructName<TName>","options: FileServerOptions<TOpen>","surface: Declaration","options: ServiceRegisterOptions","expiresIn?: number","pattern: string"],"sources":["../src/file-server.ts"],"sourcesContent":["/**\n * `FileServer` — a domain that serves a bucket's objects.\n *\n * `ObjectStorage` is the bucket: it writes, it presigns, and its URL is never\n * public. Serving those objects on a domain is a different thing, and it is a\n * construct of its own rather than a flag on the bucket — see\n * `docs/design/constructs-paradigm.md`, \"Why a separate construct, and what it\n * costs\", for the comparison that rules the other two shapes out.\n *\n * ```ts\n * export const uploads = new FileServer('Uploads', { open: ['brand/**'] });\n *\n * uploads.getUploadURL({ path, contentType })  // an S3 presign at the bucket\n * uploads.url('brand/logo.png')                // open path — no signature\n * uploads.signedUrl('invoices/7.pdf')          // one object, one recipient\n * ```\n *\n * **One construct, one client, both halves.** How a file lands in the bucket is\n * the same whether or not it is served, so splitting the upload half from the\n * serving half would be ceremony rather than safety. The client is a *superset*\n * of `StorageClient`, made literal in the type, so anything taking\n * `services.uploads` keeps compiling when the construct behind it grows a\n * serving half.\n *\n * **The id names the bucket, not the surface.** This is the detail that has to\n * be right before anything ships, because getting it backwards is destructive:\n * the migration people actually perform is serving a bucket they already have,\n * and naming the bucket after the construct makes that edit *add* a node rather\n * than rename the one holding the data.\n */\n\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport { createStorageClient, type StorageClient } from '@geekmidas/storage';\nimport type { Construct, Declarable } from './construct-interface';\n\n/**\n * A key an open pattern admits.\n *\n * The same template-literal trick `ConstructName` uses, so `open` is checked at\n * the call site rather than only at the edge:\n *\n * ```ts\n * files.url('brand/logo.png')       // ok\n * files.url(`avatars/${id}.png`)    // ok — a template literal still matches\n * files.url('invoices/7.pdf')       // not assignable — never served unsigned\n * ```\n *\n * A single star and a double star resolve to the same type, stated rather than\n * discovered: a template literal cannot exclude `/`, so this is a prefix-and-\n * suffix guard while the *exact* pattern is enforced by the bucket policy, by\n * the cache behaviour, and by this construct's own runtime check. The type says\n * plausibly open; the infrastructure says definitely.\n */\nexport type Served<P extends string> = P extends `${infer Head}**`\n\t? `${Head}${string}`\n\t: P extends `${infer Head}*${infer Tail}`\n\t\t? `${Head}${string}${Tail}`\n\t\t: P;\n\n/** What consuming a file server hands you: a bucket client that also serves. */\nexport interface FileServerClient<TOpen extends string = never>\n\textends StorageClient {\n\t/**\n\t * The unsigned address of an open object.\n\t *\n\t * Compile-checked against the declared patterns, *and* checked again at\n\t * runtime — a JavaScript caller gets no compiler, and minting an unsigned\n\t * URL for a private object is a leak rather than a mistake.\n\t *\n\t * @throws {NotOpen} when the key matches no declared pattern.\n\t */\n\turl(key: Served<TOpen>): string;\n\n\t/**\n\t * The same thing for a key the compiler cannot see.\n\t *\n\t * A fully dynamic key does not type, which is correct and is also the case\n\t * people will hit — so the escape hatch is a named method rather than a\n\t * cast, and it runs the *same* runtime check rather than being a way around\n\t * it.\n\t *\n\t * @throws {NotOpen} when the key matches no declared pattern.\n\t */\n\topenUrl(key: string): string;\n\n\t/**\n\t * A signed address for one object and one recipient.\n\t *\n\t * Today this is an **S3 presign at the bucket**, which is what works\n\t * unchanged against MinIO locally and against S3 deployed. It is deliberately\n\t * not described as a CDN URL: CloudFront signing is a different mechanism,\n\t * with different keys, against a different host, and it needs key material\n\t * this construct does not yet declare.\n\t *\n\t * @param expiresIn - minutes, matching `getUploadURL`.\n\t */\n\tsignedUrl(key: string, expiresIn?: number): Promise<string>;\n}\n\nexport interface FileServerOptions<TOpen extends string = never> {\n\t/**\n\t * Paths served without a signature. Everything else needs one.\n\t *\n\t * Private by default: a bucket where forgetting a flag publishes user\n\t * uploads is the wrong default, so this is an exception list, and listing it\n\t * in code means exactly one set of paths is unauthenticated and it is\n\t * reviewable in a diff.\n\t *\n\t * Uploading is deliberately *not* restricted to these. Writing to a path\n\t * that happens to be open is ordinary; the only asymmetry worth enforcing is\n\t * that you cannot hand out an unsigned URL for something the server would\n\t * refuse to serve unsigned.\n\t */\n\topen?: readonly TOpen[];\n\t/** Keep previous versions of an object. */\n\tversioned?: boolean;\n\t/**\n\t * A bucket declared elsewhere, instead of one of this server's own.\n\t *\n\t * `new FileServer('Uploads')` declares both nodes; this fronts a bucket that\n\t * already exists, which is also how the two edges come back when you want\n\t * them separately — a handler depending on the bucket writes, a handler\n\t * depending on the server mints URLs.\n\t */\n\torigin?: Declarable;\n}\n\n/** A key was asked to be served unsigned, and no open pattern admits it. */\nexport class NotOpen extends Error {\n\tconstructor(\n\t\treadonly key: string,\n\t\treadonly open: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`'${key}' is not served without a signature. ` +\n\t\t\t\t(open.length\n\t\t\t\t\t? `Open paths: ${open.join(', ')}. Use signedUrl() for anything else.`\n\t\t\t\t\t: 'This file server declares no open paths, so every object needs signedUrl().'),\n\t\t);\n\t\tthis.name = 'NotOpen';\n\t}\n}\n\nexport class FileServer<\n\tTName extends string = string,\n\tTOpen extends string = never,\n> implements Construct<TName, FileServerClient<TOpen>>\n{\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, FileServerClient<TOpen>>;\n\n\t/** The id of the surface node, as opposed to the bucket's. */\n\treadonly surfaceId: string;\n\n\tprivate readonly open: readonly string[];\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the keys the\n\t * target publishes and the keys the client reads cannot drift.\n\t */\n\tprivate readonly keys: { origin: string; server: string };\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly options: FileServerOptions<TOpen> = {},\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.open = options.open ?? [];\n\n\t\t// The surface takes the suffix and the bucket keeps the plain id, which\n\t\t// is what makes \"serve a bucket I already have\" an edit that adds a node\n\t\t// instead of renaming the one holding the data.\n\t\tconst originId = options.origin?.id ?? canonical;\n\t\tthis.surfaceId = `${canonical}Server`;\n\n\t\tthis.keys = {\n\t\t\torigin: provideKey(originId, 'url'),\n\t\t\tserver: provideKey(this.surfaceId, 'url'),\n\t\t};\n\n\t\t// A field, not a getter: consumers cache services by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\tregister: (registerOptions) => this.connect(registerOptions),\n\t\t};\n\t}\n\n\t/**\n\t * The served surface, as something an edge can point at.\n\t *\n\t * Depending on the `FileServer` itself points at the **bucket** — its\n\t * canonical node — which is right for a handler: it presigns and writes. But\n\t * a bucket's URL is never public, so a site depending on it gets nothing\n\t * inlined, which is correct and also useless.\n\t *\n\t * This is the other half: `.dependsOn([uploads.server])` points at the\n\t * surface, whose address *is* public, and is what puts\n\t * `VITE_UPLOADS_SERVER_URL` in a bundle. The same accessor shape\n\t * `database.reader()` uses, and for the same reason — one construct owning\n\t * two addresses needs a way to name the second.\n\t */\n\tget server(): Declarable {\n\t\tconst surface = this.declare().find(\n\t\t\t(declaration) => declaration.id === this.surfaceId,\n\t\t);\n\n\t\treturn {\n\t\t\tid: this.surfaceId,\n\t\t\tdeclare: () => (surface ? [surface] : []),\n\t\t};\n\t}\n\n\t/**\n\t * The bucket and the surface over it — or just the surface, when the bucket\n\t * was declared elsewhere.\n\t *\n\t * The surface names its origin through `of`, which is what makes the\n\t * reference check work: an origin resolving to nothing is a build failure,\n\t * the same guarantee `assertDerivations` already gives a reader and a schema\n\t * tenant.\n\t */\n\tdeclare(): Declaration[] {\n\t\tconst origin = this.options.origin;\n\n\t\tconst surface: Declaration = {\n\t\t\tkind: 'file-server',\n\t\t\tid: this.surfaceId,\n\t\t\tof: origin?.id ?? this.id,\n\t\t\t...(this.open.length ? { open: this.open } : {}),\n\t\t\tprovides: [this.keys.server],\n\t\t};\n\n\t\t// A vended bucket is declared here; a given one already declares itself,\n\t\t// and declaring it twice is the duplication the whole model removes.\n\t\tif (origin) return [surface];\n\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'objects',\n\t\t\t\tid: this.id,\n\t\t\t\tprovides: [this.keys.origin],\n\t\t\t\t...(this.options.versioned ? { versioned: true } : {}),\n\t\t\t},\n\t\t\tsurface,\n\t\t];\n\t}\n\n\t/**\n\t * The bucket's client, with the serving half added.\n\t *\n\t * Both addresses are read here, which is also how the environment reaches a\n\t * handler: the sniffer records what this reads, so `.dependsOn([uploads])`\n\t * carries the bucket URL and the server URL without either being written\n\t * down beside the handler.\n\t */\n\tprivate async connect(\n\t\toptions: ServiceRegisterOptions,\n\t): Promise<FileServerClient<TOpen>> {\n\t\tconst { origin, server } = options.envParser\n\t\t\t.create((get) => ({\n\t\t\t\torigin: get(this.keys.origin).string(),\n\t\t\t\tserver: get(this.keys.server).string(),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\tconst storage = createStorageClient(origin);\n\t\tconst base = server.replace(/\\/+$/, '');\n\n\t\tconst serve = (key: string): string => {\n\t\t\tif (!this.serves(key)) throw new NotOpen(key, this.open);\n\n\t\t\treturn `${base}/${key.replace(/^\\/+/, '')}`;\n\t\t};\n\n\t\t// Delegating rather than copying: the bucket half is whatever the driver\n\t\t// produced, including anything it grows later, and only the serving half\n\t\t// is added on top.\n\t\treturn Object.assign(Object.create(storage) as StorageClient, {\n\t\t\turl: serve as (key: Served<TOpen>) => string,\n\t\t\topenUrl: serve,\n\t\t\tsignedUrl: (key: string, expiresIn?: number) =>\n\t\t\t\tstorage.getDownloadURL({ path: key } as never, expiresIn),\n\t\t}) as FileServerClient<TOpen>;\n\t}\n\n\t/**\n\t * Whether an open pattern admits a key.\n\t *\n\t * The runtime half of {@link Served}, and stricter than it: here a single\n\t * star stops at a segment boundary and a double star does not, which is the\n\t * distinction a template-literal type cannot draw and the infrastructure\n\t * does.\n\t */\n\tprivate serves(key: string): boolean {\n\t\treturn this.open.some((pattern) => globToRegExp(pattern).test(key));\n\t}\n}\n\n/**\n * One open pattern as an anchored expression.\n *\n * A double star crosses `/`; a single star does not. Both are consumed in one\n * left-to-right pass rather than by substitution, so a pattern cannot be\n * rewritten into a placeholder that a later pass mistakes for literal text.\n */\nfunction globToRegExp(pattern: string): RegExp {\n\tlet source = '';\n\n\tfor (let index = 0; index < pattern.length; index++) {\n\t\tconst character = pattern[index];\n\n\t\tif (character !== '*') {\n\t\t\tsource += character?.replace(/[.+^${}()|[\\]\\\\?]/, '\\\\$&') ?? '';\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (pattern[index + 1] === '*') {\n\t\t\tsource += '.*';\n\t\t\tindex++;\n\t\t\tcontinue;\n\t\t}\n\n\t\tsource += '[^/]*';\n\t}\n\n\treturn new RegExp(`^${source}$`);\n}\n"],"mappings":";;;;;;AAuIA,IAAa,UAAb,cAA6B,MAAM;CAClC,YACUA,KACAC,MACR;AACD,SACE,GAAG,IAAI,0CACN,KAAK,UACF,cAAc,KAAK,KAAK,KAAK,CAAC,wCAC/B,+EACJ;EARQ;EACA;AAQT,OAAK,OAAO;CACZ;AACD;AAED,IAAa,aAAb,MAIA;CACC,AAAS;CACT,AAAS;;CAGT,AAAS;CAET,AAAiB;;;;;CAMjB,AAAiB;CAEjB,YACCC,IACiBC,UAAoC,CAAE,GACtD;EADgB;EAEjB,MAAM,YAAY,sCAAY,GAAa;AAE3C,OAAK,KAAK;AACV,OAAK,OAAO,QAAQ,QAAQ,CAAE;EAK9B,MAAM,WAAW,QAAQ,QAAQ,MAAM;AACvC,OAAK,aAAa,EAAE,UAAU;AAE9B,OAAK,OAAO;GACX,QAAQ,qCAAW,UAAU,MAAM;GACnC,QAAQ,qCAAW,KAAK,WAAW,MAAM;EACzC;AAGD,OAAK,UAAU;GACd,aAAa,qCAAW,UAAU;GAClC,UAAU,CAAC,oBAAoB,KAAK,QAAQ,gBAAgB;EAC5D;CACD;;;;;;;;;;;;;;;CAgBD,IAAI,SAAqB;EACxB,MAAM,UAAU,KAAK,SAAS,CAAC,KAC9B,CAAC,gBAAgB,YAAY,OAAO,KAAK,UACzC;AAED,SAAO;GACN,IAAI,KAAK;GACT,SAAS,MAAO,UAAU,CAAC,OAAQ,IAAG,CAAE;EACxC;CACD;;;;;;;;;;CAWD,UAAyB;EACxB,MAAM,SAAS,KAAK,QAAQ;EAE5B,MAAMC,UAAuB;GAC5B,MAAM;GACN,IAAI,KAAK;GACT,IAAI,QAAQ,MAAM,KAAK;GACvB,GAAI,KAAK,KAAK,SAAS,EAAE,MAAM,KAAK,KAAM,IAAG,CAAE;GAC/C,UAAU,CAAC,KAAK,KAAK,MAAO;EAC5B;AAID,MAAI,OAAQ,QAAO,CAAC,OAAQ;AAE5B,SAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,UAAU,CAAC,KAAK,KAAK,MAAO;GAC5B,GAAI,KAAK,QAAQ,YAAY,EAAE,WAAW,KAAM,IAAG,CAAE;EACrD,GACD,OACA;CACD;;;;;;;;;CAUD,MAAc,QACbC,SACmC;EACnC,MAAM,EAAE,QAAQ,QAAQ,GAAG,QAAQ,UACjC,OAAO,CAAC,SAAS;GACjB,QAAQ,IAAI,KAAK,KAAK,OAAO,CAAC,QAAQ;GACtC,QAAQ,IAAI,KAAK,KAAK,OAAO,CAAC,QAAQ;EACtC,GAAE,CACF,OAAO;EAET,MAAM,UAAU,6CAAoB,OAAO;EAC3C,MAAM,OAAO,OAAO,QAAQ,QAAQ,GAAG;EAEvC,MAAM,QAAQ,CAACL,QAAwB;AACtC,QAAK,KAAK,OAAO,IAAI,CAAE,OAAM,IAAI,QAAQ,KAAK,KAAK;AAEnD,WAAQ,EAAE,KAAK,GAAG,IAAI,QAAQ,QAAQ,GAAG,CAAC;EAC1C;AAKD,SAAO,OAAO,OAAO,OAAO,OAAO,QAAQ,EAAmB;GAC7D,KAAK;GACL,SAAS;GACT,WAAW,CAACA,KAAaM,cACxB,QAAQ,eAAe,EAAE,MAAM,IAAK,GAAW,UAAU;EAC1D,EAAC;CACF;;;;;;;;;CAUD,AAAQ,OAAON,KAAsB;AACpC,SAAO,KAAK,KAAK,KAAK,CAAC,YAAY,aAAa,QAAQ,CAAC,KAAK,IAAI,CAAC;CACnE;AACD;;;;;;;;AASD,SAAS,aAAaO,SAAyB;CAC9C,IAAI,SAAS;AAEb,MAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;EACpD,MAAM,YAAY,QAAQ;AAE1B,MAAI,cAAc,KAAK;AACtB,aAAU,WAAW,QAAQ,qBAAqB,OAAO,IAAI;AAC7D;EACA;AAED,MAAI,QAAQ,QAAQ,OAAO,KAAK;AAC/B,aAAU;AACV;AACA;EACA;AAED,YAAU;CACV;AAED,QAAO,IAAI,QAAQ,GAAG,OAAO;AAC7B"}
+{"version":3,"file":"file-server.cjs","names":["canonicalId","provideKey","serviceKey","createStorageClient"],"sources":["../src/file-server.ts"],"sourcesContent":["/**\n * `FileServer` — a domain that serves a bucket's objects.\n *\n * `ObjectStorage` is the bucket: it writes, it presigns, and its URL is never\n * public. Serving those objects on a domain is a different thing, and it is a\n * construct of its own rather than a flag on the bucket — see\n * `docs/design/constructs-paradigm.md`, \"Why a separate construct, and what it\n * costs\", for the comparison that rules the other two shapes out.\n *\n * ```ts\n * export const uploads = new FileServer('Uploads', { open: ['brand/**'] });\n *\n * uploads.getUploadURL({ path, contentType })  // an S3 presign at the bucket\n * uploads.url('brand/logo.png')                // open path — no signature\n * uploads.signedUrl('invoices/7.pdf')          // one object, one recipient\n * ```\n *\n * **One construct, one client, both halves.** How a file lands in the bucket is\n * the same whether or not it is served, so splitting the upload half from the\n * serving half would be ceremony rather than safety. The client is a *superset*\n * of `StorageClient`, made literal in the type, so anything taking\n * `services.uploads` keeps compiling when the construct behind it grows a\n * serving half.\n *\n * **The id names the bucket, not the surface.** This is the detail that has to\n * be right before anything ships, because getting it backwards is destructive:\n * the migration people actually perform is serving a bucket they already have,\n * and naming the bucket after the construct makes that edit *add* a node rather\n * than rename the one holding the data.\n */\n\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport { createStorageClient, type StorageClient } from '@geekmidas/storage';\nimport type { Construct, Declarable } from './construct-interface';\n\n/**\n * A key an open pattern admits.\n *\n * The same template-literal trick `ConstructName` uses, so `open` is checked at\n * the call site rather than only at the edge:\n *\n * ```ts\n * files.url('brand/logo.png')       // ok\n * files.url(`avatars/${id}.png`)    // ok — a template literal still matches\n * files.url('invoices/7.pdf')       // not assignable — never served unsigned\n * ```\n *\n * A single star and a double star resolve to the same type, stated rather than\n * discovered: a template literal cannot exclude `/`, so this is a prefix-and-\n * suffix guard while the *exact* pattern is enforced by the bucket policy, by\n * the cache behaviour, and by this construct's own runtime check. The type says\n * plausibly open; the infrastructure says definitely.\n */\nexport type Served<P extends string> = P extends `${infer Head}**`\n\t? `${Head}${string}`\n\t: P extends `${infer Head}*${infer Tail}`\n\t\t? `${Head}${string}${Tail}`\n\t\t: P;\n\n/** What consuming a file server hands you: a bucket client that also serves. */\nexport interface FileServerClient<TOpen extends string = never>\n\textends StorageClient {\n\t/**\n\t * The unsigned address of an open object.\n\t *\n\t * Compile-checked against the declared patterns, *and* checked again at\n\t * runtime — a JavaScript caller gets no compiler, and minting an unsigned\n\t * URL for a private object is a leak rather than a mistake.\n\t *\n\t * @throws {NotOpen} when the key matches no declared pattern.\n\t */\n\turl(key: Served<TOpen>): string;\n\n\t/**\n\t * The same thing for a key the compiler cannot see.\n\t *\n\t * A fully dynamic key does not type, which is correct and is also the case\n\t * people will hit — so the escape hatch is a named method rather than a\n\t * cast, and it runs the *same* runtime check rather than being a way around\n\t * it.\n\t *\n\t * @throws {NotOpen} when the key matches no declared pattern.\n\t */\n\topenUrl(key: string): string;\n\n\t/**\n\t * A signed address for one object and one recipient.\n\t *\n\t * Today this is an **S3 presign at the bucket**, which is what works\n\t * unchanged against MinIO locally and against S3 deployed. It is deliberately\n\t * not described as a CDN URL: CloudFront signing is a different mechanism,\n\t * with different keys, against a different host, and it needs key material\n\t * this construct does not yet declare.\n\t *\n\t * @param expiresIn - minutes, matching `getUploadURL`.\n\t */\n\tsignedUrl(key: string, expiresIn?: number): Promise<string>;\n}\n\nexport interface FileServerOptions<TOpen extends string = never> {\n\t/**\n\t * Paths served without a signature. Everything else needs one.\n\t *\n\t * Private by default: a bucket where forgetting a flag publishes user\n\t * uploads is the wrong default, so this is an exception list, and listing it\n\t * in code means exactly one set of paths is unauthenticated and it is\n\t * reviewable in a diff.\n\t *\n\t * Uploading is deliberately *not* restricted to these. Writing to a path\n\t * that happens to be open is ordinary; the only asymmetry worth enforcing is\n\t * that you cannot hand out an unsigned URL for something the server would\n\t * refuse to serve unsigned.\n\t */\n\topen?: readonly TOpen[];\n\t/** Keep previous versions of an object. */\n\tversioned?: boolean;\n\t/**\n\t * A bucket declared elsewhere, instead of one of this server's own.\n\t *\n\t * `new FileServer('Uploads')` declares both nodes; this fronts a bucket that\n\t * already exists, which is also how the two edges come back when you want\n\t * them separately — a handler depending on the bucket writes, a handler\n\t * depending on the server mints URLs.\n\t */\n\torigin?: Declarable;\n}\n\n/** A key was asked to be served unsigned, and no open pattern admits it. */\nexport class NotOpen extends Error {\n\tconstructor(\n\t\treadonly key: string,\n\t\treadonly open: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`'${key}' is not served without a signature. ` +\n\t\t\t\t(open.length\n\t\t\t\t\t? `Open paths: ${open.join(', ')}. Use signedUrl() for anything else.`\n\t\t\t\t\t: 'This file server declares no open paths, so every object needs signedUrl().'),\n\t\t);\n\t\tthis.name = 'NotOpen';\n\t}\n}\n\nexport class FileServer<\n\tTName extends string = string,\n\tTOpen extends string = never,\n> implements Construct<TName, FileServerClient<TOpen>>\n{\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, FileServerClient<TOpen>>;\n\n\t/** The id of the surface node, as opposed to the bucket's. */\n\treadonly surfaceId: string;\n\n\tprivate readonly open: readonly string[];\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the keys the\n\t * target publishes and the keys the client reads cannot drift.\n\t */\n\tprivate readonly keys: { origin: string; server: string };\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly options: FileServerOptions<TOpen> = {},\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.open = options.open ?? [];\n\n\t\t// The surface takes the suffix and the bucket keeps the plain id, which\n\t\t// is what makes \"serve a bucket I already have\" an edit that adds a node\n\t\t// instead of renaming the one holding the data.\n\t\tconst originId = options.origin?.id ?? canonical;\n\t\tthis.surfaceId = `${canonical}Server`;\n\n\t\tthis.keys = {\n\t\t\torigin: provideKey(originId, 'url'),\n\t\t\tserver: provideKey(this.surfaceId, 'url'),\n\t\t};\n\n\t\t// A field, not a getter: consumers cache services by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\tregister: (registerOptions) => this.connect(registerOptions),\n\t\t};\n\t}\n\n\t/**\n\t * The served surface, as something an edge can point at.\n\t *\n\t * Depending on the `FileServer` itself points at the **bucket** — its\n\t * canonical node — which is right for a handler: it presigns and writes. But\n\t * a bucket's URL is never public, so a site depending on it gets nothing\n\t * inlined, which is correct and also useless.\n\t *\n\t * This is the other half: `.dependsOn([uploads.server])` points at the\n\t * surface, whose address *is* public, and is what puts\n\t * `VITE_UPLOADS_SERVER_URL` in a bundle. The same accessor shape\n\t * `database.reader()` uses, and for the same reason — one construct owning\n\t * two addresses needs a way to name the second.\n\t */\n\tget server(): Declarable {\n\t\tconst surface = this.declare().find(\n\t\t\t(declaration) => declaration.id === this.surfaceId,\n\t\t);\n\n\t\treturn {\n\t\t\tid: this.surfaceId,\n\t\t\tdeclare: () => (surface ? [surface] : []),\n\t\t};\n\t}\n\n\t/**\n\t * The bucket and the surface over it — or just the surface, when the bucket\n\t * was declared elsewhere.\n\t *\n\t * The surface names its origin through `of`, which is what makes the\n\t * reference check work: an origin resolving to nothing is a build failure,\n\t * the same guarantee `assertDerivations` already gives a reader and a schema\n\t * tenant.\n\t */\n\tdeclare(): Declaration[] {\n\t\tconst origin = this.options.origin;\n\n\t\tconst surface: Declaration = {\n\t\t\tkind: 'file-server',\n\t\t\tid: this.surfaceId,\n\t\t\tof: origin?.id ?? this.id,\n\t\t\t...(this.open.length ? { open: this.open } : {}),\n\t\t\tprovides: [this.keys.server],\n\t\t};\n\n\t\t// A vended bucket is declared here; a given one already declares itself,\n\t\t// and declaring it twice is the duplication the whole model removes.\n\t\tif (origin) return [surface];\n\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'objects',\n\t\t\t\tid: this.id,\n\t\t\t\tprovides: [this.keys.origin],\n\t\t\t\t...(this.options.versioned ? { versioned: true } : {}),\n\t\t\t},\n\t\t\tsurface,\n\t\t];\n\t}\n\n\t/**\n\t * The bucket's client, with the serving half added.\n\t *\n\t * Both addresses are read here, which is also how the environment reaches a\n\t * handler: the sniffer records what this reads, so `.dependsOn([uploads])`\n\t * carries the bucket URL and the server URL without either being written\n\t * down beside the handler.\n\t */\n\tprivate async connect(\n\t\toptions: ServiceRegisterOptions,\n\t): Promise<FileServerClient<TOpen>> {\n\t\tconst { origin, server } = options.envParser\n\t\t\t.create((get) => ({\n\t\t\t\torigin: get(this.keys.origin).string(),\n\t\t\t\tserver: get(this.keys.server).string(),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\tconst storage = createStorageClient(origin);\n\t\tconst base = server.replace(/\\/+$/, '');\n\n\t\tconst serve = (key: string): string => {\n\t\t\tif (!this.serves(key)) throw new NotOpen(key, this.open);\n\n\t\t\treturn `${base}/${key.replace(/^\\/+/, '')}`;\n\t\t};\n\n\t\t// Delegating rather than copying: the bucket half is whatever the driver\n\t\t// produced, including anything it grows later, and only the serving half\n\t\t// is added on top.\n\t\treturn Object.assign(Object.create(storage) as StorageClient, {\n\t\t\turl: serve as (key: Served<TOpen>) => string,\n\t\t\topenUrl: serve,\n\t\t\tsignedUrl: (key: string, expiresIn?: number) =>\n\t\t\t\tstorage.getDownloadURL({ path: key } as never, expiresIn),\n\t\t}) as FileServerClient<TOpen>;\n\t}\n\n\t/**\n\t * Whether an open pattern admits a key.\n\t *\n\t * The runtime half of {@link Served}, and stricter than it: here a single\n\t * star stops at a segment boundary and a double star does not, which is the\n\t * distinction a template-literal type cannot draw and the infrastructure\n\t * does.\n\t */\n\tprivate serves(key: string): boolean {\n\t\treturn this.open.some((pattern) => globToRegExp(pattern).test(key));\n\t}\n}\n\n/**\n * One open pattern as an anchored expression.\n *\n * A double star crosses `/`; a single star does not. Both are consumed in one\n * left-to-right pass rather than by substitution, so a pattern cannot be\n * rewritten into a placeholder that a later pass mistakes for literal text.\n */\nfunction globToRegExp(pattern: string): RegExp {\n\tlet source = '';\n\n\tfor (let index = 0; index < pattern.length; index++) {\n\t\tconst character = pattern[index];\n\n\t\tif (character !== '*') {\n\t\t\tsource += character?.replace(/[.+^${}()|[\\]\\\\?]/, '\\\\$&') ?? '';\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (pattern[index + 1] === '*') {\n\t\t\tsource += '.*';\n\t\t\tindex++;\n\t\t\tcontinue;\n\t\t}\n\n\t\tsource += '[^/]*';\n\t}\n\n\treturn new RegExp(`^${source}$`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuIA,IAAa,UAAb,cAA6B,MAAM;CAExB;CACA;CAFV,YACC,KACA,MACC;EACD,MACC,IAAI,IAAI,0CACN,KAAK,SACH,eAAe,KAAK,KAAK,IAAI,EAAE,wCAC/B,8EACL;EARS,KAAA,MAAA;EACA,KAAA,OAAA;EAQT,KAAK,OAAO;CACb;AACD;AAEA,IAAa,aAAb,MAIA;CAiBmB;CAhBlB;CACA;;CAGA;CAEA;;;;;CAMA;CAEA,YACC,IACA,UAAqD,CAAC,GACrD;EADgB,KAAA,UAAA;EAEjB,MAAM,aAAA,GAAYA,oBAAAA,YAAAA,CAAY,EAAY;EAE1C,KAAK,KAAK;EACV,KAAK,OAAO,QAAQ,QAAQ,CAAC;EAK7B,MAAM,WAAW,QAAQ,QAAQ,MAAM;EACvC,KAAK,YAAY,GAAG,UAAU;EAE9B,KAAK,OAAO;GACX,SAAA,GAAQC,oBAAAA,WAAAA,CAAW,UAAU,KAAK;GAClC,SAAA,GAAQA,oBAAAA,WAAAA,CAAW,KAAK,WAAW,KAAK;EACzC;EAGA,KAAK,UAAU;GACd,cAAA,GAAaC,oBAAAA,WAAAA,CAAW,SAAS;GACjC,WAAW,oBAAoB,KAAK,QAAQ,eAAe;EAC5D;CACD;;;;;;;;;;;;;;;CAgBA,IAAI,SAAqB;EACxB,MAAM,UAAU,KAAK,QAAQ,CAAC,CAAC,MAC7B,gBAAgB,YAAY,OAAO,KAAK,SAC1C;EAEA,OAAO;GACN,IAAI,KAAK;GACT,eAAgB,UAAU,CAAC,OAAO,IAAI,CAAC;EACxC;CACD;;;;;;;;;;CAWA,UAAyB;EACxB,MAAM,SAAS,KAAK,QAAQ;EAE5B,MAAM,UAAuB;GAC5B,MAAM;GACN,IAAI,KAAK;GACT,IAAI,QAAQ,MAAM,KAAK;GACvB,GAAI,KAAK,KAAK,SAAS,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;GAC9C,UAAU,CAAC,KAAK,KAAK,MAAM;EAC5B;EAIA,IAAI,QAAQ,OAAO,CAAC,OAAO;EAE3B,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK;GACT,UAAU,CAAC,KAAK,KAAK,MAAM;GAC3B,GAAI,KAAK,QAAQ,YAAY,EAAE,WAAW,KAAK,IAAI,CAAC;EACrD,GACA,OACD;CACD;;;;;;;;;CAUA,MAAc,QACb,SACmC;EACnC,MAAM,EAAE,QAAQ,WAAW,QAAQ,UACjC,QAAQ,SAAS;GACjB,QAAQ,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,OAAO;GACrC,QAAQ,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,OAAO;EACtC,EAAE,CAAC,CACF,MAAM;EAER,MAAM,WAAA,GAAUC,mBAAAA,oBAAAA,CAAoB,MAAM;EAC1C,MAAM,OAAO,OAAO,QAAQ,QAAQ,EAAE;EAEtC,MAAM,SAAS,QAAwB;GACtC,IAAI,CAAC,KAAK,OAAO,GAAG,GAAG,MAAM,IAAI,QAAQ,KAAK,KAAK,IAAI;GAEvD,OAAO,GAAG,KAAK,GAAG,IAAI,QAAQ,QAAQ,EAAE;EACzC;EAKA,OAAO,OAAO,OAAO,OAAO,OAAO,OAAO,GAAoB;GAC7D,KAAK;GACL,SAAS;GACT,YAAY,KAAa,cACxB,QAAQ,eAAe,EAAE,MAAM,IAAI,GAAY,SAAS;EAC1D,CAAC;CACF;;;;;;;;;CAUA,OAAe,KAAsB;EACpC,OAAO,KAAK,KAAK,MAAM,YAAY,aAAa,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC;CACnE;AACD;;;;;;;;AASA,SAAS,aAAa,SAAyB;CAC9C,IAAI,SAAS;CAEb,KAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;EACpD,MAAM,YAAY,QAAQ;EAE1B,IAAI,cAAc,KAAK;GACtB,UAAU,WAAW,QAAQ,qBAAqB,MAAM,KAAK;GAC7D;EACD;EAEA,IAAI,QAAQ,QAAQ,OAAO,KAAK;GAC/B,UAAU;GACV;GACA;EACD;EAEA,UAAU;CACX;CAEA,OAAO,IAAI,OAAO,IAAI,OAAO,EAAE;AAChC"}

package/dist/file-server.d.cts

@@ -1,10 +1,8 @@
-import { Construct, Declarable } from "./construct-interface-D9d4Gm4p.cjs";
+import { i as Declarable, n as Construct } from "./construct-interface-DIaTNKax.cjs";
 import { Service } from "@geekmidas/services";
 import { ConstructName, Declaration } from "@geekmidas/manifest";
 import { StorageClient } from "@geekmidas/storage";
-
 //#region src/file-server.d.ts
-
 /**
  * A key an open pattern admits.
  *
@@ -23,9 +21,9 @@ import { StorageClient } from "@geekmidas/storage";
  * the cache behaviour, and by this construct's own runtime check. The type says
  * plausibly open; the infrastructure says definitely.
  */
-type Served<P extends string> = P extends `${infer Head}**` ? `${Head}${string}` : P extends `${infer Head}*${infer Tail}` ? `${Head}${string}${Tail}` : P;
+export type Served<P extends string> = P extends `${infer Head}**` ? `${Head}${string}` : P extends `${infer Head}*${infer Tail}` ? `${Head}${string}${Tail}` : P;
 /** What consuming a file server hands you: a bucket client that also serves. */
-interface FileServerClient<TOpen extends string = never> extends StorageClient {
+export interface FileServerClient<TOpen extends string = never> extends StorageClient {
   /**
    * The unsigned address of an open object.
    *
@@ -60,7 +58,7 @@ interface FileServerClient<TOpen extends string = never> extends StorageClient {
    */
   signedUrl(key: string, expiresIn?: number): Promise<string>;
 }
-interface FileServerOptions<TOpen extends string = never> {
+export interface FileServerOptions<TOpen extends string = never> {
   /**
    * Paths served without a signature. Everything else needs one.
    *
@@ -88,12 +86,12 @@ interface FileServerOptions<TOpen extends string = never> {
   origin?: Declarable;
 }
 /** A key was asked to be served unsigned, and no open pattern admits it. */
-declare class NotOpen extends Error {
+export declare class NotOpen extends Error {
   readonly key: string;
   readonly open: readonly string[];
   constructor(key: string, open: readonly string[]);
 }
-declare class FileServer<TName extends string = string, TOpen extends string = never> implements Construct<TName, FileServerClient<TOpen>> {
+export declare class FileServer<TName extends string = string, TOpen extends string = never> implements Construct<TName, FileServerClient<TOpen>> {
   private readonly options;
   readonly id: TName;
   readonly service: Service<Uncapitalize<TName>, FileServerClient<TOpen>>;
@@ -150,7 +148,5 @@ declare class FileServer<TName extends string = string, TOpen extends string = n
    */
   private serves;
 }
-//# sourceMappingURL=file-server.d.ts.map
 //#endregion
-export { FileServer, FileServerClient, FileServerOptions, NotOpen, Served };
 //# sourceMappingURL=file-server.d.cts.map

package/dist/file-server.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"file-server.d.cts","names":[],"sources":["../src/file-server.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;;;;;;AAyJsB;;;;;;KA7FV,2BAA2B,iCACjC,kBACH,6CACI,gBAAgB,SACnB;;UAGa,uDACR;;;;;;;;;;WAUC,OAAO;;;;;;;;;;;;;;;;;;;;;;;8CAyB4B;;UAG5B;;;;;;;;;;;;;;kBAcA;;;;;;;;;;;WAWP;;;cAIG,OAAA,SAAgB,KAAK;;;;;cAerB,mFAGA,UAAU,OAAO,iBAAiB;;eAEjC;oBACK,QAAQ,aAAa,QAAQ,iBAAiB;;;;;;;;;kBAc3D,cAAc,kBACQ,kBAAkB;;;;;;;;;;;;;;;gBAuC/B;;;;;;;;;;aAoBH"}
+{"version":3,"file":"file-server.d.cts","names":[],"sources":["../src/file-server.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;YA4DY,OAAO,oBAAoB,mBAAmB,cACpD,kBACH,mBAAmB,cAAc,YAC7B,gBAAgB,SACnB;;iBAGa,iBAAiB,sCACzB;;;;;;;;;;EAUR,IAAI,KAAK,OAAO;;;;;;;;;;;EAYhB,QAAQ;;;;;;;;;;;;EAaR,UAAU,aAAa,qBAAqB;;iBAG5B,kBAAkB;;;;;;;;;;;;;;EAclC,gBAAgB;;EAEhB;;;;;;;;;EASA,SAAS;;;qBAIG,gBAAgB;WAElB;WACA;EAFV,YACU,aACA;;qBAYE,WACZ,+BACA,yCACY,UAAU,OAAO,iBAAiB;mBAkB5B;WAhBT,IAAI;WACJ,SAAS,QAAQ,aAAa,QAAQ,iBAAiB;;WAGvD;mBAEQ;;;;;mBAMA;EAEjB,YACC,IAAI,cAAc,QACD,UAAS,kBAAkB;;;;;;;;;;;;;;;MAuCzC,UAAU;;;;;;;;;;EAoBd,WAAW;;;;;;;;;UAkCG;;;;;;;;;UAsCN"}

package/dist/file-server.d.mts

@@ -1,10 +1,8 @@
-import { Construct, Declarable } from "./construct-interface-g5GM5pwR.mjs";
+import { i as Declarable, n as Construct } from "./construct-interface-Clz7_BwB.mjs";
 import { ConstructName, Declaration } from "@geekmidas/manifest";
 import { StorageClient } from "@geekmidas/storage";
 import { Service } from "@geekmidas/services";
-
 //#region src/file-server.d.ts
-
 /**
  * A key an open pattern admits.
  *
@@ -23,9 +21,9 @@ import { Service } from "@geekmidas/services";
  * the cache behaviour, and by this construct's own runtime check. The type says
  * plausibly open; the infrastructure says definitely.
  */
-type Served<P extends string> = P extends `${infer Head}**` ? `${Head}${string}` : P extends `${infer Head}*${infer Tail}` ? `${Head}${string}${Tail}` : P;
+export type Served<P extends string> = P extends `${infer Head}**` ? `${Head}${string}` : P extends `${infer Head}*${infer Tail}` ? `${Head}${string}${Tail}` : P;
 /** What consuming a file server hands you: a bucket client that also serves. */
-interface FileServerClient<TOpen extends string = never> extends StorageClient {
+export interface FileServerClient<TOpen extends string = never> extends StorageClient {
   /**
    * The unsigned address of an open object.
    *
@@ -60,7 +58,7 @@ interface FileServerClient<TOpen extends string = never> extends StorageClient {
    */
   signedUrl(key: string, expiresIn?: number): Promise<string>;
 }
-interface FileServerOptions<TOpen extends string = never> {
+export interface FileServerOptions<TOpen extends string = never> {
   /**
    * Paths served without a signature. Everything else needs one.
    *
@@ -88,12 +86,12 @@ interface FileServerOptions<TOpen extends string = never> {
   origin?: Declarable;
 }
 /** A key was asked to be served unsigned, and no open pattern admits it. */
-declare class NotOpen extends Error {
+export declare class NotOpen extends Error {
   readonly key: string;
   readonly open: readonly string[];
   constructor(key: string, open: readonly string[]);
 }
-declare class FileServer<TName extends string = string, TOpen extends string = never> implements Construct<TName, FileServerClient<TOpen>> {
+export declare class FileServer<TName extends string = string, TOpen extends string = never> implements Construct<TName, FileServerClient<TOpen>> {
   private readonly options;
   readonly id: TName;
   readonly service: Service<Uncapitalize<TName>, FileServerClient<TOpen>>;
@@ -150,7 +148,5 @@ declare class FileServer<TName extends string = string, TOpen extends string = n
    */
   private serves;
 }
-//# sourceMappingURL=file-server.d.ts.map
 //#endregion
-export { FileServer, FileServerClient, FileServerOptions, NotOpen, Served };
 //# sourceMappingURL=file-server.d.mts.map

package/dist/file-server.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"file-server.d.mts","names":[],"sources":["../src/file-server.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;;;;;;AAyJsB;;;;;;KA7FV,2BAA2B,iCACjC,kBACH,6CACI,gBAAgB,SACnB;;UAGa,uDACR;;;;;;;;;;WAUC,OAAO;;;;;;;;;;;;;;;;;;;;;;;8CAyB4B;;UAG5B;;;;;;;;;;;;;;kBAcA;;;;;;;;;;;WAWP;;;cAIG,OAAA,SAAgB,KAAK;;;;;cAerB,mFAGA,UAAU,OAAO,iBAAiB;;eAEjC;oBACK,QAAQ,aAAa,QAAQ,iBAAiB;;;;;;;;;kBAc3D,cAAc,kBACQ,kBAAkB;;;;;;;;;;;;;;;gBAuC/B;;;;;;;;;;aAoBH"}
+{"version":3,"file":"file-server.d.mts","names":[],"sources":["../src/file-server.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;YA4DY,OAAO,oBAAoB,mBAAmB,cACpD,kBACH,mBAAmB,cAAc,YAC7B,gBAAgB,SACnB;;iBAGa,iBAAiB,sCACzB;;;;;;;;;;EAUR,IAAI,KAAK,OAAO;;;;;;;;;;;EAYhB,QAAQ;;;;;;;;;;;;EAaR,UAAU,aAAa,qBAAqB;;iBAG5B,kBAAkB;;;;;;;;;;;;;;EAclC,gBAAgB;;EAEhB;;;;;;;;;EASA,SAAS;;;qBAIG,gBAAgB;WAElB;WACA;EAFV,YACU,aACA;;qBAYE,WACZ,+BACA,yCACY,UAAU,OAAO,iBAAiB;mBAkB5B;WAhBT,IAAI;WACJ,SAAS,QAAQ,aAAa,QAAQ,iBAAiB;;WAGvD;mBAEQ;;;;;mBAMA;EAEjB,YACC,IAAI,cAAc,QACD,UAAS,kBAAkB;;;;;;;;;;;;;;;MAuCzC,UAAU;;;;;;;;;;EAoBd,WAAW;;;;;;;;;UAkCG;;;;;;;;;UAsCN"}