@geekmidas/constructs 9.0.2 → 10.0.0-alpha.0

package/dist/endpoints/index.cjs

@@ -1,754 +1,28 @@
-const require_Construct = require('../Construct-vXMZJgRp.cjs');
-const require_functions = require('../functions-C8i1kCMM.cjs');
-const require_publisher = require('../publisher-lFQleddL.cjs');
-const require_lazyAccessors = require('../lazyAccessors-DmTG8sQH.cjs');
-const __geekmidas_logger_console = require_Construct.__toESM(require("@geekmidas/logger/console"));
+require('../construct-interface-BfjcOD_E.cjs');
+require('../Construct-roId57cU.cjs');
+require('../functions-DukjG8ov.cjs');
+const require_EndpointFactory = require('../EndpointFactory-DYoGLaIT.cjs');
+require('../clone-Dy0cR2SZ.cjs');
+const require_Endpoint = require('../Endpoint-BBkV6l0k.cjs');
+const require_surfaceEnv = require('../surfaceEnv-BFXEms2f.cjs');
+const require_publisher = require('../publisher-CqGsXB2X.cjs');
+const require_lazyAccessors = require('../lazyAccessors-DrJj8NpA.cjs');
 
-//#region src/endpoints/Authorizer.ts
-/**
-* Built-in security schemes available by default.
-* Users can use these without defining them via .securitySchemes().
-*/
-const BUILT_IN_SECURITY_SCHEMES = {
-	jwt: {
-		type: "http",
-		scheme: "bearer",
-		bearerFormat: "JWT",
-		description: "JWT Bearer token authentication"
-	},
-	bearer: {
-		type: "http",
-		scheme: "bearer",
-		description: "Bearer token authentication"
-	},
-	apiKey: {
-		type: "apiKey",
-		in: "header",
-		name: "X-API-Key",
-		description: "API key authentication via header"
-	},
-	oauth2: {
-		type: "oauth2",
-		flows: {},
-		description: "OAuth 2.0 authentication"
-	},
-	oidc: {
-		type: "openIdConnect",
-		openIdConnectUrl: "",
-		description: "OpenID Connect authentication"
-	},
-	iam: {
-		type: "apiKey",
-		in: "header",
-		name: "Authorization",
-		description: "AWS IAM Signature Version 4 authentication",
-		"x-amazon-apigateway-authtype": "awsSigv4"
-	}
-};
-/**
-* Helper to create an authorizer configuration
-*/
-function createAuthorizer(name, options) {
-	return {
-		name,
-		...options
-	};
-}
-/**
-* Check if a name is a built-in security scheme
-*/
-function isBuiltInSecurityScheme(name) {
-	return name in BUILT_IN_SECURITY_SCHEMES;
-}
-/**
-* Get a security scheme by name (built-in or custom)
-*/
-function getSecurityScheme(name, customSchemes) {
-	if (customSchemes && name in customSchemes) return customSchemes[name];
-	if (isBuiltInSecurityScheme(name)) return BUILT_IN_SECURITY_SCHEMES[name];
-	return void 0;
-}
-
-//#endregion
-//#region src/endpoints/rls.ts
-/**
-* Symbol used to bypass RLS for an endpoint.
-*/
-const RLS_BYPASS = Symbol.for("geekmidas.rls.bypass");
-
-//#endregion
-//#region src/endpoints/EndpointBuilder.ts
-var import_lodash$1 = require_Construct.__toESM(require_functions.require_lodash(), 1);
-var EndpointBuilder = class extends require_functions.BaseFunctionBuilder {
-	schemas = {};
-	_description;
-	_status;
-	_tags;
-	_memorySize;
-	_responseType = "application/json";
-	_getSession = () => ({});
-	_authorize = () => true;
-	_rateLimit;
-	_availableAuthorizers = [];
-	_authorizerName;
-	_actorExtractor;
-	_audits = [];
-	_customSecuritySchemes = {};
-	_rlsConfig;
-	_rlsBypass;
-	constructor(route, method) {
-		super(require_Construct.ConstructType.Endpoint);
-		this.route = route;
-		this.method = method;
-	}
-	_setPublisher(publisher) {
-		this._publisher = publisher;
-	}
-	_setAuditorStorage(storage) {
-		this._auditorStorage = storage;
-	}
-	_setDatabaseService(service) {
-		this._databaseService = service;
-	}
-	description(description) {
-		this._description = description;
-		return this;
-	}
-	status(status) {
-		this._status = status;
-		return this;
-	}
-	event(event) {
-		this._events.push(event);
-		return this;
-	}
-	tags(tags) {
-		this._tags = tags;
-		return this;
-	}
-	memorySize(memorySize) {
-		this._memorySize = memorySize;
-		return this;
-	}
-	/**
-	* Set the response content type for this endpoint.
-	*
-	* Defaults to `'application/json'`. When set to any other value
-	* (e.g. `'text/html'`, `'text/plain'`), the response body is emitted
-	* as-is rather than JSON-serialized, and the `Content-Type` header
-	* reflects the declared value. Runtime overrides via `r.header()` still win.
-	*
-	* @param type - The MIME type to return (e.g. `'text/html'`)
-	*
-	* @example
-	* ```typescript
-	* e.get('/checkout-page')
-	*   .output(z.string())
-	*   .responseType('text/html')
-	*   .handle(async () => '<html>...</html>');
-	* ```
-	*/
-	responseType(type) {
-		this._responseType = type;
-		return this;
-	}
-	publisher(publisher) {
-		this._publisher = publisher;
-		return this;
-	}
-	body(schema) {
-		this.schemas.body = schema;
-		return this;
-	}
-	search(schema) {
-		this.schemas.query = schema;
-		return this;
-	}
-	query(schema) {
-		return this.search(schema);
-	}
-	params(schema) {
-		this.schemas.params = schema;
-		return this;
-	}
-	authorize(fn) {
-		this._authorize = fn;
-		return this;
-	}
-	rateLimit(config) {
-		this._rateLimit = config;
-		return this;
-	}
-	authorizer(name) {
-		if (name === "none") {
-			this._authorizerName = void 0;
-			return this;
-		}
-		const authorizerExists = this._availableAuthorizers.some((a) => a.name === name);
-		if (!authorizerExists && this._availableAuthorizers.length > 0) {
-			const available = this._availableAuthorizers.map((a) => a.name).join(", ");
-			throw new Error(`Authorizer "${name}" not found in available authorizers: ${available}`);
-		}
-		this._authorizerName = name;
-		return this;
-	}
-	services(services) {
-		this._services = (0, import_lodash$1.default)([...this._services, ...services], (s) => s.serviceName);
-		return this;
-	}
-	logger(logger) {
-		this._logger = logger;
-		return this;
-	}
-	output(schema) {
-		this.outputSchema = schema;
-		return this;
-	}
-	/**
-	* Set the auditor storage service for this endpoint.
-	* This enables audit functionality and makes `auditor` available in the handler context.
-	* The audit action type is automatically inferred from the storage's generic parameter.
-	*/
-	auditor(storage) {
-		this._auditorStorage = storage;
-		return this;
-	}
-	/**
-	* Set the actor extractor function for audit records.
-	* The actor is extracted from the request context and attached to all audits.
-	*/
-	actor(extractor) {
-		this._actorExtractor = extractor;
-		return this;
-	}
-	/**
-	* Add declarative audit definitions that are processed after the handler executes.
-	* Similar to `.event()` for events, but for audits.
-	*
-	* @example
-	* ```typescript
-	* .audit<AppAuditAction>([
-	*   {
-	*     type: 'user.created',
-	*     payload: (response) => ({ userId: response.id, email: response.email }),
-	*     when: (response) => response.active,
-	*     entityId: (response) => response.id,
-	*     table: 'users',
-	*   },
-	* ])
-	* ```
-	*/
-	audit(audits) {
-		this._audits = audits;
-		return this;
-	}
-	/**
-	* Set the database service for this endpoint.
-	* The database will be available in the handler context as `db`.
-	* When audit storage is configured and uses the same database,
-	* `db` will automatically be the transaction for ACID compliance.
-	*
-	* @example
-	* ```typescript
-	* .database(databaseService)
-	* .handle(async ({ db }) => {
-	*   // db is the raw database or transaction (when auditor uses same db)
-	*   return await db.selectFrom('users').selectAll().execute();
-	* })
-	* ```
-	*/
-	database(service) {
-		this._databaseService = service;
-		return this;
-	}
-	/**
-	* Configure RLS (Row-Level Security) context for this endpoint.
-	* Pass `false` or `RLS_BYPASS` to explicitly bypass RLS for this endpoint.
-	*
-	* @example
-	* ```typescript
-	* // Custom RLS config for this endpoint
-	* .rls({
-	*   extractor: ({ session }) => ({
-	*     user_id: session.userId,
-	*     tenant_id: session.tenantId,
-	*   }),
-	*   prefix: 'app',
-	* })
-	*
-	* // Bypass RLS (for admin endpoints)
-	* .rls(false)
-	* ```
-	*/
-	rls(config) {
-		if (config === false || config === RLS_BYPASS) {
-			this._rlsBypass = true;
-			this._rlsConfig = void 0;
-		} else {
-			this._rlsConfig = config;
-			this._rlsBypass = false;
-		}
-		return this;
-	}
-	/**
-	* Explicitly bypass RLS for this endpoint.
-	* Useful for admin operations that need unrestricted database access.
-	*
-	* @example
-	* ```typescript
-	* .rlsBypass()
-	* .handle(async ({ db }) => {
-	*   // Full access, no RLS filtering
-	*   return db.selectFrom('orders').selectAll().execute();
-	* })
-	* ```
-	*/
-	rlsBypass() {
-		this._rlsBypass = true;
-		this._rlsConfig = void 0;
-		return this;
-	}
-	input(_schema) {
-		throw new Error("EndpointBuilder does not support generic input. Use body(), query(), or params() instead.");
-	}
-	handle(fn) {
-		let authorizer;
-		if (this._authorizerName) {
-			const existingAuthorizer = this._availableAuthorizers.find((a) => a.name === this._authorizerName);
-			if (existingAuthorizer) authorizer = existingAuthorizer;
-			else {
-				const securityScheme = getSecurityScheme(this._authorizerName, this._customSecuritySchemes);
-				authorizer = {
-					name: this._authorizerName,
-					securityScheme
-				};
-			}
-		}
-		return new require_lazyAccessors.Endpoint({
-			fn,
-			method: this.method,
-			route: this.route,
-			description: this._description,
-			tags: this._tags,
-			input: this.schemas,
-			output: this.outputSchema,
-			services: this._services,
-			logger: this._logger,
-			timeout: this._timeout,
-			memorySize: this._memorySize,
-			authorize: this._authorize,
-			status: this._status,
-			getSession: this._getSession,
-			rateLimit: this._rateLimit,
-			publisherService: this._publisher,
-			events: this._events,
-			authorizer,
-			auditorStorageService: this._auditorStorage,
-			actorExtractor: this._actorExtractor,
-			audits: this._audits,
-			databaseService: this._databaseService,
-			rlsConfig: this._rlsConfig,
-			rlsBypass: this._rlsBypass,
-			responseType: this._responseType
-		});
-	}
-};
-
-//#endregion
-//#region src/endpoints/EndpointFactory.ts
-var import_lodash = require_Construct.__toESM(require_functions.require_lodash(), 1);
-const DEFAULT_LOGGER = new __geekmidas_logger_console.ConsoleLogger();
-var EndpointFactory = class EndpointFactory {
-	defaultServices = [];
-	basePath = "";
-	defaultAuthorizeFn;
-	defaultEventPublisher;
-	defaultSessionExtractor;
-	defaultLogger = DEFAULT_LOGGER;
-	availableAuthorizers = [];
-	defaultAuthorizerName;
-	defaultAuditorStorage;
-	defaultDatabaseService;
-	defaultActorExtractor;
-	customSecuritySchemes = {};
-	defaultRlsConfig;
-	constructor({ basePath, defaultAuthorizeFn, defaultLogger, defaultSessionExtractor, defaultServices = [], defaultEventPublisher, availableAuthorizers = [], defaultAuthorizerName, defaultAuditorStorage, defaultDatabaseService, defaultActorExtractor, customSecuritySchemes = {}, defaultRlsConfig } = {}) {
-		this.defaultServices = (0, import_lodash.default)(defaultServices, (s) => s.serviceName);
-		this.basePath = basePath || "";
-		this.defaultAuthorizeFn = defaultAuthorizeFn;
-		this.defaultLogger = defaultLogger || DEFAULT_LOGGER;
-		this.defaultSessionExtractor = defaultSessionExtractor;
-		this.defaultEventPublisher = defaultEventPublisher;
-		this.availableAuthorizers = availableAuthorizers;
-		this.defaultAuthorizerName = defaultAuthorizerName;
-		this.defaultAuditorStorage = defaultAuditorStorage;
-		this.defaultDatabaseService = defaultDatabaseService;
-		this.defaultActorExtractor = defaultActorExtractor;
-		this.customSecuritySchemes = customSecuritySchemes;
-		this.defaultRlsConfig = defaultRlsConfig;
-	}
-	static joinPaths(path, basePath = "") {
-		if (!basePath && !path) return "/";
-		if (!basePath) return path.startsWith("/") ? path : `/${path}`;
-		if (!path) return basePath.startsWith("/") ? basePath : `/${basePath}`;
-		const base = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
-		const segment = path.startsWith("/") ? path : `/${path}`;
-		let result = base + segment;
-		if (!result.startsWith("/")) result = `/${result}`;
-		result = result.replace(/^\/+/g, "/");
-		if (result.length > 1 && result.endsWith("/")) result = result.slice(0, -1);
-		return result;
-	}
-	authorizers(authorizers) {
-		const authorizerConfigs = authorizers.map((name) => ({
-			name,
-			securityScheme: getSecurityScheme(name, this.customSecuritySchemes)
-		}));
-		return new EndpointFactory({
-			defaultServices: this.defaultServices,
-			basePath: this.basePath,
-			defaultAuthorizeFn: this.defaultAuthorizeFn,
-			defaultLogger: this.defaultLogger,
-			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
-			availableAuthorizers: authorizerConfigs,
-			defaultAuthorizerName: this.defaultAuthorizerName,
-			defaultAuditorStorage: this.defaultAuditorStorage,
-			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor,
-			customSecuritySchemes: this.customSecuritySchemes,
-			defaultRlsConfig: this.defaultRlsConfig
-		});
-	}
-	/**
-	* Define custom security schemes for this factory.
-	* These extend the built-in schemes (jwt, bearer, apiKey, oauth2, oidc).
-	*
-	* @example
-	* ```typescript
-	* const router = e.securitySchemes({
-	*   awsIamSigV4: {
-	*     type: 'apiKey',
-	*     in: 'header',
-	*     name: 'Authorization',
-	*     'x-amazon-apigateway-authtype': 'awsSigv4',
-	*   },
-	* });
-	* ```
-	*/
-	securitySchemes(schemes) {
-		return new EndpointFactory({
-			defaultServices: this.defaultServices,
-			basePath: this.basePath,
-			defaultAuthorizeFn: this.defaultAuthorizeFn,
-			defaultLogger: this.defaultLogger,
-			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
-			availableAuthorizers: this.availableAuthorizers,
-			defaultAuthorizerName: this.defaultAuthorizerName,
-			defaultAuditorStorage: this.defaultAuditorStorage,
-			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor,
-			customSecuritySchemes: {
-				...this.customSecuritySchemes,
-				...schemes
-			},
-			defaultRlsConfig: this.defaultRlsConfig
-		});
-	}
-	/**
-	* Set the default authorizer for all endpoints created from this factory.
-	* Individual endpoints can override this by calling `.authorizer()` on the builder.
-	* Use `'none'` to explicitly disable authorization for all endpoints.
-	*
-	* Accepts:
-	* - Built-in security scheme names: 'jwt', 'bearer', 'apiKey', 'oauth2', 'oidc'
-	* - Custom security scheme names defined via `.securitySchemes()`
-	* - 'none' to disable authorization
-	*/
-	authorizer(name) {
-		if (name !== "none" && this.availableAuthorizers.length > 0) {
-			const authorizerExists = this.availableAuthorizers.some((a) => a.name === name);
-			if (!authorizerExists) {
-				const available = this.availableAuthorizers.map((a) => a.name).join(", ");
-				throw new Error(`Authorizer "${name}" not found in available authorizers: ${available}`);
-			}
-		}
-		return new EndpointFactory({
-			defaultServices: this.defaultServices,
-			basePath: this.basePath,
-			defaultAuthorizeFn: this.defaultAuthorizeFn,
-			defaultLogger: this.defaultLogger,
-			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
-			availableAuthorizers: this.availableAuthorizers,
-			defaultAuthorizerName: name === "none" ? void 0 : name,
-			defaultAuditorStorage: this.defaultAuditorStorage,
-			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor,
-			customSecuritySchemes: this.customSecuritySchemes,
-			defaultRlsConfig: this.defaultRlsConfig
-		});
-	}
-	route(path) {
-		const newBasePath = EndpointFactory.joinPaths(path, this.basePath);
-		return new EndpointFactory({
-			defaultServices: this.defaultServices,
-			basePath: newBasePath,
-			defaultAuthorizeFn: this.defaultAuthorizeFn,
-			defaultLogger: this.defaultLogger,
-			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
-			availableAuthorizers: this.availableAuthorizers,
-			defaultAuthorizerName: this.defaultAuthorizerName,
-			defaultAuditorStorage: this.defaultAuditorStorage,
-			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor,
-			customSecuritySchemes: this.customSecuritySchemes,
-			defaultRlsConfig: this.defaultRlsConfig
-		});
-	}
-	authorize(fn) {
-		return new EndpointFactory({
-			defaultServices: this.defaultServices,
-			basePath: this.basePath,
-			defaultAuthorizeFn: fn,
-			defaultLogger: this.defaultLogger,
-			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
-			availableAuthorizers: this.availableAuthorizers,
-			defaultAuthorizerName: this.defaultAuthorizerName,
-			defaultAuditorStorage: this.defaultAuditorStorage,
-			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor,
-			customSecuritySchemes: this.customSecuritySchemes,
-			defaultRlsConfig: this.defaultRlsConfig
-		});
-	}
-	services(services) {
-		return new EndpointFactory({
-			defaultServices: [...services, ...this.defaultServices],
-			basePath: this.basePath,
-			defaultAuthorizeFn: this.defaultAuthorizeFn,
-			defaultLogger: this.defaultLogger,
-			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
-			availableAuthorizers: this.availableAuthorizers,
-			defaultAuthorizerName: this.defaultAuthorizerName,
-			defaultAuditorStorage: this.defaultAuditorStorage,
-			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor,
-			customSecuritySchemes: this.customSecuritySchemes,
-			defaultRlsConfig: this.defaultRlsConfig
-		});
-	}
-	logger(logger) {
-		return new EndpointFactory({
-			defaultServices: this.defaultServices,
-			basePath: this.basePath,
-			defaultAuthorizeFn: this.defaultAuthorizeFn,
-			defaultLogger: logger,
-			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
-			availableAuthorizers: this.availableAuthorizers,
-			defaultAuthorizerName: this.defaultAuthorizerName,
-			defaultAuditorStorage: this.defaultAuditorStorage,
-			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor,
-			customSecuritySchemes: this.customSecuritySchemes,
-			defaultRlsConfig: this.defaultRlsConfig
-		});
-	}
-	publisher(publisher) {
-		return new EndpointFactory({
-			defaultServices: this.defaultServices,
-			basePath: this.basePath,
-			defaultAuthorizeFn: this.defaultAuthorizeFn,
-			defaultLogger: this.defaultLogger,
-			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: publisher,
-			availableAuthorizers: this.availableAuthorizers,
-			defaultAuthorizerName: this.defaultAuthorizerName,
-			defaultAuditorStorage: this.defaultAuditorStorage,
-			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor,
-			customSecuritySchemes: this.customSecuritySchemes,
-			defaultRlsConfig: this.defaultRlsConfig
-		});
-	}
-	session(session) {
-		return new EndpointFactory({
-			defaultServices: this.defaultServices,
-			basePath: this.basePath,
-			defaultAuthorizeFn: this.defaultAuthorizeFn,
-			defaultLogger: this.defaultLogger,
-			defaultSessionExtractor: session,
-			defaultEventPublisher: this.defaultEventPublisher,
-			availableAuthorizers: this.availableAuthorizers,
-			defaultAuthorizerName: this.defaultAuthorizerName,
-			defaultAuditorStorage: this.defaultAuditorStorage,
-			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor,
-			customSecuritySchemes: this.customSecuritySchemes,
-			defaultRlsConfig: this.defaultRlsConfig
-		});
-	}
-	/**
-	* Set the database service for endpoints created from this factory.
-	* The database will be available in handler context as `db`.
-	*/
-	database(service) {
-		return new EndpointFactory({
-			defaultServices: this.defaultServices,
-			basePath: this.basePath,
-			defaultAuthorizeFn: this.defaultAuthorizeFn,
-			defaultLogger: this.defaultLogger,
-			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
-			availableAuthorizers: this.availableAuthorizers,
-			defaultAuthorizerName: this.defaultAuthorizerName,
-			defaultAuditorStorage: this.defaultAuditorStorage,
-			defaultDatabaseService: service,
-			customSecuritySchemes: this.customSecuritySchemes,
-			defaultRlsConfig: this.defaultRlsConfig
-		});
-	}
-	/**
-	* Set the auditor storage service for endpoints created from this factory.
-	* This enables audit functionality and makes `auditor` available in handler context.
-	* The audit action type is automatically inferred from the storage's generic parameter.
-	*/
-	auditor(storage) {
-		return new EndpointFactory({
-			defaultServices: this.defaultServices,
-			basePath: this.basePath,
-			defaultAuthorizeFn: this.defaultAuthorizeFn,
-			defaultLogger: this.defaultLogger,
-			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
-			availableAuthorizers: this.availableAuthorizers,
-			defaultAuthorizerName: this.defaultAuthorizerName,
-			defaultAuditorStorage: storage,
-			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor,
-			customSecuritySchemes: this.customSecuritySchemes,
-			defaultRlsConfig: this.defaultRlsConfig
-		});
-	}
-	/**
-	* Set the actor extractor function for endpoints created from this factory.
-	* The actor is extracted from the request context and attached to all audits.
-	*/
-	actor(extractor) {
-		return new EndpointFactory({
-			defaultServices: this.defaultServices,
-			basePath: this.basePath,
-			defaultAuthorizeFn: this.defaultAuthorizeFn,
-			defaultLogger: this.defaultLogger,
-			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
-			availableAuthorizers: this.availableAuthorizers,
-			defaultAuthorizerName: this.defaultAuthorizerName,
-			defaultAuditorStorage: this.defaultAuditorStorage,
-			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: extractor,
-			customSecuritySchemes: this.customSecuritySchemes,
-			defaultRlsConfig: this.defaultRlsConfig
-		});
-	}
-	/**
-	* Set the RLS (Row-Level Security) configuration for endpoints created from this factory.
-	* This enables automatic PostgreSQL session variable setting for RLS policies.
-	*
-	* @example
-	* ```typescript
-	* const api = new EndpointFactory()
-	*   .database(databaseService)
-	*   .session(extractSession)
-	*   .rls({
-	*     extractor: ({ session }) => ({
-	*       user_id: session.userId,
-	*       tenant_id: session.tenantId,
-	*     }),
-	*     prefix: 'app',
-	*   });
-	* ```
-	*/
-	rls(config) {
-		return new EndpointFactory({
-			defaultServices: this.defaultServices,
-			basePath: this.basePath,
-			defaultAuthorizeFn: this.defaultAuthorizeFn,
-			defaultLogger: this.defaultLogger,
-			defaultSessionExtractor: this.defaultSessionExtractor,
-			defaultEventPublisher: this.defaultEventPublisher,
-			availableAuthorizers: this.availableAuthorizers,
-			defaultAuthorizerName: this.defaultAuthorizerName,
-			defaultAuditorStorage: this.defaultAuditorStorage,
-			defaultDatabaseService: this.defaultDatabaseService,
-			defaultActorExtractor: this.defaultActorExtractor,
-			customSecuritySchemes: this.customSecuritySchemes,
-			defaultRlsConfig: config
-		});
-	}
-	createBuilder(method, path) {
-		const fullPath = EndpointFactory.joinPaths(path, this.basePath);
-		const builder = new EndpointBuilder(fullPath, method);
-		if (this.defaultAuthorizeFn) builder._authorize = this.defaultAuthorizeFn;
-		if (this.defaultServices.length) builder._services = [...this.defaultServices];
-		if (this.defaultLogger) builder._logger = this.defaultLogger;
-		if (this.defaultSessionExtractor) builder._getSession = this.defaultSessionExtractor;
-		if (this.defaultEventPublisher) builder._setPublisher(this.defaultEventPublisher);
-		builder._availableAuthorizers = this.availableAuthorizers;
-		if (this.defaultAuthorizerName) builder._authorizerName = this.defaultAuthorizerName;
-		if (this.defaultAuditorStorage) builder._setAuditorStorage(this.defaultAuditorStorage);
-		if (this.defaultDatabaseService) builder._setDatabaseService(this.defaultDatabaseService);
-		if (this.defaultActorExtractor) builder._actorExtractor = this.defaultActorExtractor;
-		builder._customSecuritySchemes = this.customSecuritySchemes;
-		if (this.defaultRlsConfig) builder._rlsConfig = this.defaultRlsConfig;
-		return builder;
-	}
-	post(path) {
-		return this.createBuilder("POST", path);
-	}
-	get(path) {
-		return this.createBuilder("GET", path);
-	}
-	put(path) {
-		return this.createBuilder("PUT", path);
-	}
-	delete(path) {
-		return this.createBuilder("DELETE", path);
-	}
-	patch(path) {
-		return this.createBuilder("PATCH", path);
-	}
-	options(path) {
-		return this.createBuilder("OPTIONS", path);
-	}
-};
-const e$1 = new EndpointFactory();
-
-//#endregion
-//#region src/endpoints/index.ts
-const e = new EndpointFactory();
-
-//#endregion
-exports.BUILT_IN_SECURITY_SCHEMES = BUILT_IN_SECURITY_SCHEMES;
-exports.Endpoint = require_lazyAccessors.Endpoint;
-exports.EndpointBuilder = EndpointBuilder;
-exports.EndpointFactory = EndpointFactory;
-exports.RLS_BYPASS = RLS_BYPASS;
-exports.ResponseBuilder = require_lazyAccessors.ResponseBuilder;
+exports.BUILT_IN_SECURITY_SCHEMES = require_EndpointFactory.BUILT_IN_SECURITY_SCHEMES;
+exports.Endpoint = require_Endpoint.Endpoint;
+exports.EndpointBuilder = require_EndpointFactory.EndpointBuilder;
+exports.EndpointFactory = require_EndpointFactory.EndpointFactory;
+exports.RLS_BYPASS = require_EndpointFactory.RLS_BYPASS;
+exports.ResponseBuilder = require_Endpoint.ResponseBuilder;
 exports.createApiGatewayCookies = require_lazyAccessors.createApiGatewayCookies;
 exports.createApiGatewayHeaders = require_lazyAccessors.createApiGatewayHeaders;
-exports.createAuthorizer = createAuthorizer;
+exports.createAuthorizer = require_EndpointFactory.createAuthorizer;
 exports.createHonoCookies = require_lazyAccessors.createHonoCookies;
 exports.createHonoHeaders = require_lazyAccessors.createHonoHeaders;
 exports.createNoopCookies = require_lazyAccessors.createNoopCookies;
 exports.createNoopHeaders = require_lazyAccessors.createNoopHeaders;
-exports.e = e;
-exports.getSecurityScheme = getSecurityScheme;
-exports.isBuiltInSecurityScheme = isBuiltInSecurityScheme;
-exports.publishConstructEvents = require_publisher.publishConstructEvents;
-//# sourceMappingURL=index.cjs.map
+exports.defaultEnvParser = require_surfaceEnv.defaultEnvParser;
+exports.envParserFor = require_surfaceEnv.envParserFor;
+exports.getSecurityScheme = require_EndpointFactory.getSecurityScheme;
+exports.isBuiltInSecurityScheme = require_EndpointFactory.isBuiltInSecurityScheme;
+exports.publishConstructEvents = require_publisher.publishConstructEvents;