@geekmidas/constructs 9.0.2 → 10.0.0-alpha.0

package/dist/EndpointFactory-DYoGLaIT.cjs

@@ -0,0 +1,850 @@
+const require_chunk = require('./chunk-DWy1uDak.cjs');
+const require_construct_interface = require('./construct-interface-BfjcOD_E.cjs');
+const require_Construct = require('./Construct-roId57cU.cjs');
+const require_functions = require('./functions-DukjG8ov.cjs');
+const require_clone = require('./clone-Dy0cR2SZ.cjs');
+const require_Endpoint = require('./Endpoint-BBkV6l0k.cjs');
+const __geekmidas_logger_console = require_chunk.__toESM(require("@geekmidas/logger/console"));
+
+//#region src/endpoints/Authorizer.ts
+/**
+* Built-in security schemes available by default.
+* Users can use these without defining them via .securitySchemes().
+*/
+const BUILT_IN_SECURITY_SCHEMES = {
+	jwt: {
+		type: "http",
+		scheme: "bearer",
+		bearerFormat: "JWT",
+		description: "JWT Bearer token authentication"
+	},
+	bearer: {
+		type: "http",
+		scheme: "bearer",
+		description: "Bearer token authentication"
+	},
+	apiKey: {
+		type: "apiKey",
+		in: "header",
+		name: "X-API-Key",
+		description: "API key authentication via header"
+	},
+	oauth2: {
+		type: "oauth2",
+		flows: {},
+		description: "OAuth 2.0 authentication"
+	},
+	oidc: {
+		type: "openIdConnect",
+		openIdConnectUrl: "",
+		description: "OpenID Connect authentication"
+	},
+	iam: {
+		type: "apiKey",
+		in: "header",
+		name: "Authorization",
+		description: "AWS IAM Signature Version 4 authentication",
+		"x-amazon-apigateway-authtype": "awsSigv4"
+	}
+};
+/**
+* Helper to create an authorizer configuration
+*/
+function createAuthorizer(name, options) {
+	return {
+		name,
+		...options
+	};
+}
+/**
+* Check if a name is a built-in security scheme
+*/
+function isBuiltInSecurityScheme(name) {
+	return name in BUILT_IN_SECURITY_SCHEMES;
+}
+/**
+* Get a security scheme by name (built-in or custom)
+*/
+function getSecurityScheme(name, customSchemes) {
+	if (customSchemes && name in customSchemes) return customSchemes[name];
+	if (isBuiltInSecurityScheme(name)) return BUILT_IN_SECURITY_SCHEMES[name];
+	return void 0;
+}
+
+//#endregion
+//#region src/endpoints/rls.ts
+/**
+* Symbol used to bypass RLS for an endpoint.
+*/
+const RLS_BYPASS = Symbol.for("geekmidas.rls.bypass");
+
+//#endregion
+//#region src/endpoints/EndpointBuilder.ts
+var import_lodash$1 = require_chunk.__toESM(require_functions.require_lodash(), 1);
+var EndpointBuilder = class extends require_functions.BaseFunctionBuilder {
+	schemas = {};
+	_description;
+	_status;
+	_tags;
+	_memorySize;
+	_responseType = "application/json";
+	_getSession = () => ({});
+	_authorize = () => true;
+	_rateLimit;
+	_availableAuthorizers = [];
+	_authorizerName;
+	_actorExtractor;
+	_audits = [];
+	/**
+	* Internal: the surface this builder came from, carried to the endpoint.
+	*
+	* Assigned by the factory before the builder is handed out, which is the
+	* only way a builder is ever created.
+	*/
+	_surface;
+	_customSecuritySchemes = {};
+	_rlsConfig;
+	_rlsBypass;
+	constructor(route, method) {
+		super(require_Construct.ConstructType.Endpoint);
+		this.route = route;
+		this.method = method;
+	}
+	_setPublisher(publisher) {
+		this._publisher = publisher;
+	}
+	_setAuditorStorage(storage) {
+		this._auditorStorage = storage;
+	}
+	_setDatabaseService(service) {
+		this._databaseService = service;
+	}
+	description(description) {
+		return require_clone.cloneWith(this, { _description: description });
+	}
+	status(status) {
+		return require_clone.cloneWith(this, { _status: status });
+	}
+	event(event) {
+		return require_clone.cloneWith(this, { _events: [...this._events, event] });
+	}
+	tags(tags) {
+		return require_clone.cloneWith(this, { _tags: tags });
+	}
+	memorySize(memorySize) {
+		return require_clone.cloneWith(this, { _memorySize: memorySize });
+	}
+	/**
+	* Set the response content type for this endpoint.
+	*
+	* Defaults to `'application/json'`. When set to any other value
+	* (e.g. `'text/html'`, `'text/plain'`), the response body is emitted
+	* as-is rather than JSON-serialized, and the `Content-Type` header
+	* reflects the declared value. Runtime overrides via `r.header()` still win.
+	*
+	* @param type - The MIME type to return (e.g. `'text/html'`)
+	*
+	* @example
+	* ```typescript
+	* api.get('/checkout-page')
+	*   .output(z.string())
+	*   .responseType('text/html')
+	*   .handle(async () => '<html>...</html>');
+	* ```
+	*/
+	responseType(type) {
+		return require_clone.cloneWith(this, { _responseType: type });
+	}
+	publisher(publisher) {
+		return require_clone.cloneWith(this, { _publisher: publisher });
+	}
+	body(schema) {
+		this.schemas.body = schema;
+		return this;
+	}
+	search(schema) {
+		this.schemas.query = schema;
+		return this;
+	}
+	query(schema) {
+		return this.search(schema);
+	}
+	params(schema) {
+		this.schemas.params = schema;
+		return this;
+	}
+	authorize(fn) {
+		return require_clone.cloneWith(this, { _authorize: fn });
+	}
+	rateLimit(config) {
+		return require_clone.cloneWith(this, { _rateLimit: config });
+	}
+	authorizer(name) {
+		if (name === "none") return require_clone.cloneWith(this, { _authorizerName: void 0 });
+		const authorizerExists = this._availableAuthorizers.some((a) => a.name === name);
+		if (!authorizerExists && this._availableAuthorizers.length > 0) {
+			const available = this._availableAuthorizers.map((a) => a.name).join(", ");
+			throw new Error(`Authorizer "${name}" not found in available authorizers: ${available}`);
+		}
+		return require_clone.cloneWith(this, { _authorizerName: name });
+	}
+	/**
+	* Depend on constructs — a database, a bucket, a mail sender, a queue, a
+	* topic.
+	*
+	* It records the edge and dissolves each construct's client into the
+	* handler's service record under the construct's own id, so
+	* `.dependsOn([uploads])` is what makes `services.uploads` exist and type.
+	*
+	* Constructs only. A `Service` does not match the shape, which is what keeps
+	* env sniffing confined to `.services()` and the explicit lift.
+	*/
+	dependsOn(constructs) {
+		const services = require_construct_interface.servicesOf(constructs);
+		return require_clone.cloneWith(this, {
+			_services: (0, import_lodash$1.default)([...this._services, ...services], (service) => service.serviceName),
+			_constructs: require_construct_interface.idsOf(constructs, this._constructs)
+		});
+	}
+	services(services) {
+		return require_clone.cloneWith(this, { _services: (0, import_lodash$1.default)([...this._services, ...services], (s) => s.serviceName) });
+	}
+	logger(logger) {
+		return require_clone.cloneWith(this, { _logger: logger });
+	}
+	output(schema) {
+		return require_clone.cloneWith(this, { outputSchema: schema });
+	}
+	/**
+	* Set the auditor storage service for this endpoint.
+	* This enables audit functionality and makes `auditor` available in the handler context.
+	* The audit action type is automatically inferred from the storage's generic parameter.
+	*/
+	auditor(storage) {
+		return require_clone.cloneWith(this, { _auditorStorage: storage });
+	}
+	/**
+	* Set the actor extractor function for audit records.
+	* The actor is extracted from the request context and attached to all audits.
+	*/
+	actor(extractor) {
+		return require_clone.cloneWith(this, { _actorExtractor: extractor });
+	}
+	/**
+	* Add declarative audit definitions that are processed after the handler executes.
+	* Similar to `.event()` for events, but for audits.
+	*
+	* @example
+	* ```typescript
+	* .audit<AppAuditAction>([
+	*   {
+	*     type: 'user.created',
+	*     payload: (response) => ({ userId: response.id, email: response.email }),
+	*     when: (response) => response.active,
+	*     entityId: (response) => response.id,
+	*     table: 'users',
+	*   },
+	* ])
+	* ```
+	*/
+	audit(audits) {
+		return require_clone.cloneWith(this, { _audits: audits });
+	}
+	/**
+	* Set the database service for this endpoint.
+	* The database will be available in the handler context as `db`.
+	* When audit storage is configured and uses the same database,
+	* `db` will automatically be the transaction for ACID compliance.
+	*
+	* @example
+	* ```typescript
+	* .database(databaseService)
+	* .handle(async ({ db }) => {
+	*   // db is the raw database or transaction (when auditor uses same db)
+	*   return await db.selectFrom('users').selectAll().execute();
+	* })
+	* ```
+	*/
+	database(source) {
+		const service = require_construct_interface.serviceOf(source);
+		return require_clone.cloneWith(this, { _databaseService: service });
+	}
+	/**
+	* Configure RLS (Row-Level Security) context for this endpoint.
+	* Pass `false` or `RLS_BYPASS` to explicitly bypass RLS for this endpoint.
+	*
+	* @example
+	* ```typescript
+	* // Custom RLS config for this endpoint
+	* .rls({
+	*   extractor: ({ session }) => ({
+	*     user_id: session.userId,
+	*     tenant_id: session.tenantId,
+	*   }),
+	*   prefix: 'app',
+	* })
+	*
+	* // Bypass RLS (for admin endpoints)
+	* .rls(false)
+	* ```
+	*/
+	rls(config) {
+		if (config === false || config === RLS_BYPASS) {
+			this._rlsBypass = true;
+			this._rlsConfig = void 0;
+		} else {
+			this._rlsConfig = config;
+			this._rlsBypass = false;
+		}
+		return this;
+	}
+	/**
+	* Explicitly bypass RLS for this endpoint.
+	* Useful for admin operations that need unrestricted database access.
+	*
+	* @example
+	* ```typescript
+	* .rlsBypass()
+	* .handle(async ({ db }) => {
+	*   // Full access, no RLS filtering
+	*   return db.selectFrom('orders').selectAll().execute();
+	* })
+	* ```
+	*/
+	rlsBypass() {
+		return require_clone.cloneWith(this, {
+			_rlsBypass: true,
+			_rlsConfig: void 0
+		});
+	}
+	input(_schema) {
+		throw new Error("EndpointBuilder does not support generic input. Use body(), query(), or params() instead.");
+	}
+	handle(fn) {
+		let authorizer;
+		if (this._authorizerName) {
+			const existingAuthorizer = this._availableAuthorizers.find((a) => a.name === this._authorizerName);
+			if (existingAuthorizer) authorizer = existingAuthorizer;
+			else {
+				const securityScheme = getSecurityScheme(this._authorizerName, this._customSecuritySchemes);
+				authorizer = {
+					name: this._authorizerName,
+					securityScheme
+				};
+			}
+		}
+		return new require_Endpoint.Endpoint({
+			fn,
+			method: this.method,
+			route: this.route,
+			description: this._description,
+			tags: this._tags,
+			input: this.schemas,
+			output: this.outputSchema,
+			services: this._services,
+			constructs: this._constructs,
+			logger: this._logger,
+			timeout: this._timeout,
+			memorySize: this._memorySize,
+			authorize: this._authorize,
+			status: this._status,
+			getSession: this._getSession,
+			rateLimit: this._rateLimit,
+			publisherService: this._publisher,
+			events: this._events,
+			authorizer,
+			surface: this._surface,
+			auditorStorageService: this._auditorStorage,
+			actorExtractor: this._actorExtractor,
+			audits: this._audits,
+			databaseService: this._databaseService,
+			rlsConfig: this._rlsConfig,
+			rlsBypass: this._rlsBypass,
+			responseType: this._responseType
+		});
+	}
+};
+
+//#endregion
+//#region src/endpoints/EndpointFactory.ts
+var import_lodash = require_chunk.__toESM(require_functions.require_lodash(), 1);
+var EndpointFactory = class EndpointFactory {
+	defaultServices = [];
+	/**
+	* The constructs `.dependsOn()` was given, kept alongside the services they
+	* dissolve into.
+	*
+	* `.dependsOn()` collapses straight into `.services()`, which is right for
+	* *running* — a handler wants clients, not ids — and loses the one thing the
+	* manifest needs: which constructs this endpoint reaches. Keeping the ids
+	* here is what lets a route declare its edges, and lets a target derive its
+	* environment from the graph rather than from sniffing what the code touched.
+	*/
+	defaultConstructs = [];
+	basePath = "";
+	defaultAuthorizeFn;
+	defaultEventPublisher;
+	defaultSessionExtractor;
+	defaultLogger;
+	/**
+	* The surface this factory belongs to, stamped onto everything it builds.
+	*
+	* Set only by `RestApi`, which is the only thing that has one. A factory
+	* with no surface produces endpoints that carry none, which is what a
+	* standalone endpoint has always been.
+	*/
+	surface;
+	availableAuthorizers;
+	defaultAuthorizerName;
+	defaultAuditorStorage;
+	defaultDatabaseService;
+	defaultActorExtractor;
+	customSecuritySchemes;
+	defaultRlsConfig;
+	constructor({ basePath, defaultAuthorizeFn, defaultLogger = __geekmidas_logger_console.DEFAULT_LOGGER, defaultSessionExtractor, defaultServices = [], defaultConstructs = [], defaultEventPublisher, availableAuthorizers = [], defaultAuthorizerName, defaultAuditorStorage, defaultDatabaseService, defaultActorExtractor, customSecuritySchemes = {}, defaultRlsConfig, surface }) {
+		this.defaultConstructs = [...new Set(defaultConstructs)];
+		this.defaultServices = (0, import_lodash.default)(defaultServices, (s) => s.serviceName);
+		this.basePath = basePath || "";
+		this.defaultAuthorizeFn = defaultAuthorizeFn;
+		this.defaultLogger = defaultLogger;
+		this.defaultSessionExtractor = defaultSessionExtractor;
+		this.defaultEventPublisher = defaultEventPublisher;
+		this.availableAuthorizers = availableAuthorizers;
+		this.defaultAuthorizerName = defaultAuthorizerName;
+		this.defaultAuditorStorage = defaultAuditorStorage;
+		this.defaultDatabaseService = defaultDatabaseService;
+		this.defaultActorExtractor = defaultActorExtractor;
+		this.customSecuritySchemes = customSecuritySchemes;
+		this.defaultRlsConfig = defaultRlsConfig;
+		this.surface = surface;
+	}
+	static joinPaths(path, basePath = "") {
+		if (!basePath && !path) return "/";
+		if (!basePath) return path.startsWith("/") ? path : `/${path}`;
+		if (!path) return basePath.startsWith("/") ? basePath : `/${basePath}`;
+		const base = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
+		const segment = path.startsWith("/") ? path : `/${path}`;
+		let result = base + segment;
+		if (!result.startsWith("/")) result = `/${result}`;
+		result = result.replace(/^\/+/g, "/");
+		if (result.length > 1 && result.endsWith("/")) result = result.slice(0, -1);
+		return result;
+	}
+	authorizers(authorizers) {
+		const authorizerConfigs = authorizers.map((name) => ({
+			name,
+			securityScheme: getSecurityScheme(name, this.customSecuritySchemes)
+		}));
+		return new EndpointFactory({
+			defaultServices: this.defaultServices,
+			defaultConstructs: this.defaultConstructs,
+			basePath: this.basePath,
+			defaultAuthorizeFn: this.defaultAuthorizeFn,
+			defaultLogger: this.defaultLogger,
+			defaultSessionExtractor: this.defaultSessionExtractor,
+			defaultEventPublisher: this.defaultEventPublisher,
+			availableAuthorizers: authorizerConfigs,
+			defaultAuthorizerName: this.defaultAuthorizerName,
+			defaultAuditorStorage: this.defaultAuditorStorage,
+			defaultDatabaseService: this.defaultDatabaseService,
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			surface: this.surface,
+			defaultRlsConfig: this.defaultRlsConfig
+		});
+	}
+	/**
+	* Define custom security schemes for this factory.
+	* These extend the built-in schemes (jwt, bearer, apiKey, oauth2, oidc).
+	*
+	* @example
+	* ```typescript
+	* const router = e.securitySchemes({
+	*   awsIamSigV4: {
+	*     type: 'apiKey',
+	*     in: 'header',
+	*     name: 'Authorization',
+	*     'x-amazon-apigateway-authtype': 'awsSigv4',
+	*   },
+	* });
+	* ```
+	*/
+	securitySchemes(schemes) {
+		return new EndpointFactory({
+			defaultServices: this.defaultServices,
+			defaultConstructs: this.defaultConstructs,
+			basePath: this.basePath,
+			defaultAuthorizeFn: this.defaultAuthorizeFn,
+			defaultLogger: this.defaultLogger,
+			defaultSessionExtractor: this.defaultSessionExtractor,
+			defaultEventPublisher: this.defaultEventPublisher,
+			availableAuthorizers: this.availableAuthorizers,
+			defaultAuthorizerName: this.defaultAuthorizerName,
+			defaultAuditorStorage: this.defaultAuditorStorage,
+			defaultDatabaseService: this.defaultDatabaseService,
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: {
+				...this.customSecuritySchemes,
+				...schemes
+			},
+			surface: this.surface,
+			defaultRlsConfig: this.defaultRlsConfig
+		});
+	}
+	/**
+	* Set the default authorizer for all endpoints created from this factory.
+	* Individual endpoints can override this by calling `.authorizer()` on the builder.
+	* Use `'none'` to explicitly disable authorization for all endpoints.
+	*
+	* Accepts:
+	* - Built-in security scheme names: 'jwt', 'bearer', 'apiKey', 'oauth2', 'oidc'
+	* - Custom security scheme names defined via `.securitySchemes()`
+	* - 'none' to disable authorization
+	*/
+	authorizer(name) {
+		if (name !== "none" && this.availableAuthorizers.length > 0) {
+			const authorizerExists = this.availableAuthorizers.some((a) => a.name === name);
+			if (!authorizerExists) {
+				const available = this.availableAuthorizers.map((a) => a.name).join(", ");
+				throw new Error(`Authorizer "${name}" not found in available authorizers: ${available}`);
+			}
+		}
+		return new EndpointFactory({
+			defaultServices: this.defaultServices,
+			defaultConstructs: this.defaultConstructs,
+			basePath: this.basePath,
+			defaultAuthorizeFn: this.defaultAuthorizeFn,
+			defaultLogger: this.defaultLogger,
+			defaultSessionExtractor: this.defaultSessionExtractor,
+			defaultEventPublisher: this.defaultEventPublisher,
+			availableAuthorizers: this.availableAuthorizers,
+			defaultAuthorizerName: name === "none" ? void 0 : name,
+			defaultAuditorStorage: this.defaultAuditorStorage,
+			defaultDatabaseService: this.defaultDatabaseService,
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			surface: this.surface,
+			defaultRlsConfig: this.defaultRlsConfig
+		});
+	}
+	route(path) {
+		const newBasePath = EndpointFactory.joinPaths(path, this.basePath);
+		return new EndpointFactory({
+			defaultServices: this.defaultServices,
+			defaultConstructs: this.defaultConstructs,
+			basePath: newBasePath,
+			defaultAuthorizeFn: this.defaultAuthorizeFn,
+			defaultLogger: this.defaultLogger,
+			defaultSessionExtractor: this.defaultSessionExtractor,
+			defaultEventPublisher: this.defaultEventPublisher,
+			availableAuthorizers: this.availableAuthorizers,
+			defaultAuthorizerName: this.defaultAuthorizerName,
+			defaultAuditorStorage: this.defaultAuditorStorage,
+			defaultDatabaseService: this.defaultDatabaseService,
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			surface: this.surface,
+			defaultRlsConfig: this.defaultRlsConfig
+		});
+	}
+	authorize(fn) {
+		return new EndpointFactory({
+			defaultServices: this.defaultServices,
+			defaultConstructs: this.defaultConstructs,
+			basePath: this.basePath,
+			defaultAuthorizeFn: fn,
+			defaultLogger: this.defaultLogger,
+			defaultSessionExtractor: this.defaultSessionExtractor,
+			defaultEventPublisher: this.defaultEventPublisher,
+			availableAuthorizers: this.availableAuthorizers,
+			defaultAuthorizerName: this.defaultAuthorizerName,
+			defaultAuditorStorage: this.defaultAuditorStorage,
+			defaultDatabaseService: this.defaultDatabaseService,
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			surface: this.surface,
+			defaultRlsConfig: this.defaultRlsConfig
+		});
+	}
+	/**
+	* Depend on constructs — a database, a bucket, a mail sender, a queue, a
+	* topic.
+	*
+	* It records the edge and dissolves each construct's client into the
+	* handler's service record under the construct's own id, so
+	* `.dependsOn([uploads])` is what makes `services.uploads` exist and type.
+	*
+	* Constructs only. A `Service` does not match the shape, which is what keeps
+	* env sniffing confined to `.services()` and the explicit lift.
+	*/
+	dependsOn(constructs) {
+		const next = this.services(require_construct_interface.servicesOf(constructs));
+		next.defaultConstructs = [...new Set([...this.defaultConstructs, ...constructs.map((construct) => construct.id)])];
+		return next;
+	}
+	services(services) {
+		return new EndpointFactory({
+			defaultServices: [...services, ...this.defaultServices],
+			defaultConstructs: this.defaultConstructs,
+			basePath: this.basePath,
+			defaultAuthorizeFn: this.defaultAuthorizeFn,
+			defaultLogger: this.defaultLogger,
+			defaultSessionExtractor: this.defaultSessionExtractor,
+			defaultEventPublisher: this.defaultEventPublisher,
+			availableAuthorizers: this.availableAuthorizers,
+			defaultAuthorizerName: this.defaultAuthorizerName,
+			defaultAuditorStorage: this.defaultAuditorStorage,
+			defaultDatabaseService: this.defaultDatabaseService,
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			surface: this.surface,
+			defaultRlsConfig: this.defaultRlsConfig
+		});
+	}
+	logger(logger) {
+		return new EndpointFactory({
+			defaultServices: this.defaultServices,
+			defaultConstructs: this.defaultConstructs,
+			basePath: this.basePath,
+			defaultAuthorizeFn: this.defaultAuthorizeFn,
+			defaultLogger: logger,
+			defaultSessionExtractor: this.defaultSessionExtractor,
+			defaultEventPublisher: this.defaultEventPublisher,
+			availableAuthorizers: this.availableAuthorizers,
+			defaultAuthorizerName: this.defaultAuthorizerName,
+			defaultAuditorStorage: this.defaultAuditorStorage,
+			defaultDatabaseService: this.defaultDatabaseService,
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			surface: this.surface,
+			defaultRlsConfig: this.defaultRlsConfig
+		});
+	}
+	publisher(publisher) {
+		return new EndpointFactory({
+			defaultServices: this.defaultServices,
+			defaultConstructs: this.defaultConstructs,
+			basePath: this.basePath,
+			defaultAuthorizeFn: this.defaultAuthorizeFn,
+			defaultLogger: this.defaultLogger,
+			defaultSessionExtractor: this.defaultSessionExtractor,
+			defaultEventPublisher: publisher,
+			availableAuthorizers: this.availableAuthorizers,
+			defaultAuthorizerName: this.defaultAuthorizerName,
+			defaultAuditorStorage: this.defaultAuditorStorage,
+			defaultDatabaseService: this.defaultDatabaseService,
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			surface: this.surface,
+			defaultRlsConfig: this.defaultRlsConfig
+		});
+	}
+	session(session) {
+		return new EndpointFactory({
+			defaultServices: this.defaultServices,
+			defaultConstructs: this.defaultConstructs,
+			basePath: this.basePath,
+			defaultAuthorizeFn: this.defaultAuthorizeFn,
+			defaultLogger: this.defaultLogger,
+			defaultSessionExtractor: session,
+			defaultEventPublisher: this.defaultEventPublisher,
+			availableAuthorizers: this.availableAuthorizers,
+			defaultAuthorizerName: this.defaultAuthorizerName,
+			defaultAuditorStorage: this.defaultAuditorStorage,
+			defaultDatabaseService: this.defaultDatabaseService,
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			surface: this.surface,
+			defaultRlsConfig: this.defaultRlsConfig
+		});
+	}
+	/**
+	* Set the database service for endpoints created from this factory.
+	* The database will be available in handler context as `db`.
+	*/
+	database(source) {
+		const service = require_construct_interface.serviceOf(source);
+		return new EndpointFactory({
+			defaultServices: this.defaultServices,
+			defaultConstructs: this.defaultConstructs,
+			basePath: this.basePath,
+			defaultAuthorizeFn: this.defaultAuthorizeFn,
+			defaultLogger: this.defaultLogger,
+			defaultSessionExtractor: this.defaultSessionExtractor,
+			defaultEventPublisher: this.defaultEventPublisher,
+			availableAuthorizers: this.availableAuthorizers,
+			defaultAuthorizerName: this.defaultAuthorizerName,
+			defaultAuditorStorage: this.defaultAuditorStorage,
+			defaultDatabaseService: service,
+			customSecuritySchemes: this.customSecuritySchemes,
+			surface: this.surface,
+			defaultRlsConfig: this.defaultRlsConfig
+		});
+	}
+	/**
+	* Set the auditor storage service for endpoints created from this factory.
+	* This enables audit functionality and makes `auditor` available in handler context.
+	* The audit action type is automatically inferred from the storage's generic parameter.
+	*/
+	auditor(storage) {
+		return new EndpointFactory({
+			defaultServices: this.defaultServices,
+			defaultConstructs: this.defaultConstructs,
+			basePath: this.basePath,
+			defaultAuthorizeFn: this.defaultAuthorizeFn,
+			defaultLogger: this.defaultLogger,
+			defaultSessionExtractor: this.defaultSessionExtractor,
+			defaultEventPublisher: this.defaultEventPublisher,
+			availableAuthorizers: this.availableAuthorizers,
+			defaultAuthorizerName: this.defaultAuthorizerName,
+			defaultAuditorStorage: storage,
+			defaultDatabaseService: this.defaultDatabaseService,
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			surface: this.surface,
+			defaultRlsConfig: this.defaultRlsConfig
+		});
+	}
+	/**
+	* Set the actor extractor function for endpoints created from this factory.
+	* The actor is extracted from the request context and attached to all audits.
+	*/
+	actor(extractor) {
+		return new EndpointFactory({
+			defaultServices: this.defaultServices,
+			defaultConstructs: this.defaultConstructs,
+			basePath: this.basePath,
+			defaultAuthorizeFn: this.defaultAuthorizeFn,
+			defaultLogger: this.defaultLogger,
+			defaultSessionExtractor: this.defaultSessionExtractor,
+			defaultEventPublisher: this.defaultEventPublisher,
+			availableAuthorizers: this.availableAuthorizers,
+			defaultAuthorizerName: this.defaultAuthorizerName,
+			defaultAuditorStorage: this.defaultAuditorStorage,
+			defaultDatabaseService: this.defaultDatabaseService,
+			defaultActorExtractor: extractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			surface: this.surface,
+			defaultRlsConfig: this.defaultRlsConfig
+		});
+	}
+	/**
+	* Set the RLS (Row-Level Security) configuration for endpoints created from this factory.
+	* This enables automatic PostgreSQL session variable setting for RLS policies.
+	*
+	* @example
+	* ```typescript
+	* const api = new EndpointFactory()
+	*   .database(databaseService)
+	*   .session(extractSession)
+	*   .rls({
+	*     extractor: ({ session }) => ({
+	*       user_id: session.userId,
+	*       tenant_id: session.tenantId,
+	*     }),
+	*     prefix: 'app',
+	*   });
+	* ```
+	*/
+	rls(config) {
+		return new EndpointFactory({
+			defaultServices: this.defaultServices,
+			defaultConstructs: this.defaultConstructs,
+			basePath: this.basePath,
+			defaultAuthorizeFn: this.defaultAuthorizeFn,
+			defaultLogger: this.defaultLogger,
+			defaultSessionExtractor: this.defaultSessionExtractor,
+			defaultEventPublisher: this.defaultEventPublisher,
+			availableAuthorizers: this.availableAuthorizers,
+			defaultAuthorizerName: this.defaultAuthorizerName,
+			defaultAuditorStorage: this.defaultAuditorStorage,
+			defaultDatabaseService: this.defaultDatabaseService,
+			defaultActorExtractor: this.defaultActorExtractor,
+			customSecuritySchemes: this.customSecuritySchemes,
+			surface: this.surface,
+			defaultRlsConfig: config
+		});
+	}
+	createBuilder(method, path) {
+		const fullPath = EndpointFactory.joinPaths(path, this.basePath);
+		const builder = new EndpointBuilder(fullPath, method);
+		if (this.defaultAuthorizeFn) builder._authorize = this.defaultAuthorizeFn;
+		if (this.defaultServices.length) builder._services = [...this.defaultServices];
+		if (this.defaultConstructs.length) builder._constructs = [...this.defaultConstructs];
+		if (this.defaultLogger) builder._logger = this.defaultLogger;
+		builder._surface = this.surface;
+		if (this.defaultSessionExtractor) builder._getSession = this.defaultSessionExtractor;
+		if (this.defaultEventPublisher) builder._setPublisher(this.defaultEventPublisher);
+		builder._availableAuthorizers = this.availableAuthorizers;
+		if (this.defaultAuthorizerName) builder._authorizerName = this.defaultAuthorizerName;
+		if (this.defaultAuditorStorage) builder._setAuditorStorage(this.defaultAuditorStorage);
+		if (this.defaultDatabaseService) builder._setDatabaseService(this.defaultDatabaseService);
+		if (this.defaultActorExtractor) builder._actorExtractor = this.defaultActorExtractor;
+		builder._customSecuritySchemes = this.customSecuritySchemes;
+		if (this.defaultRlsConfig) builder._rlsConfig = this.defaultRlsConfig;
+		return builder;
+	}
+	post(path) {
+		return this.createBuilder("POST", path);
+	}
+	get(path) {
+		return this.createBuilder("GET", path);
+	}
+	put(path) {
+		return this.createBuilder("PUT", path);
+	}
+	delete(path) {
+		return this.createBuilder("DELETE", path);
+	}
+	patch(path) {
+		return this.createBuilder("PATCH", path);
+	}
+	options(path) {
+		return this.createBuilder("OPTIONS", path);
+	}
+};
+
+//#endregion
+Object.defineProperty(exports, 'BUILT_IN_SECURITY_SCHEMES', {
+  enumerable: true,
+  get: function () {
+    return BUILT_IN_SECURITY_SCHEMES;
+  }
+});
+Object.defineProperty(exports, 'EndpointBuilder', {
+  enumerable: true,
+  get: function () {
+    return EndpointBuilder;
+  }
+});
+Object.defineProperty(exports, 'EndpointFactory', {
+  enumerable: true,
+  get: function () {
+    return EndpointFactory;
+  }
+});
+Object.defineProperty(exports, 'RLS_BYPASS', {
+  enumerable: true,
+  get: function () {
+    return RLS_BYPASS;
+  }
+});
+Object.defineProperty(exports, 'createAuthorizer', {
+  enumerable: true,
+  get: function () {
+    return createAuthorizer;
+  }
+});
+Object.defineProperty(exports, 'getSecurityScheme', {
+  enumerable: true,
+  get: function () {
+    return getSecurityScheme;
+  }
+});
+Object.defineProperty(exports, 'isBuiltInSecurityScheme', {
+  enumerable: true,
+  get: function () {
+    return isBuiltInSecurityScheme;
+  }
+});
+//# sourceMappingURL=EndpointFactory-DYoGLaIT.cjs.map