@jakuta-inc/worker-proxy 6.0.0 → 6.1.0

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export type { AllowedHosts, Backend, PathRewrite, Route, HealthProbeResult, ProxyHealthCheck, ProxyHandlerConfig, ProxyOutcome, ProxyHandler, ProxyError } from "./same-origin-proxy.js";
-export { createProxyHandler, createAdminAuthRoute } from "./same-origin-proxy.js";
+export type { AllowedHosts, Backend, PathRewrite, ProxyRoute, HealthProbeResult, ProxyHealthCheck, ProxyHandlerConfig, ProxyOutcome, ProxyHandler, ProxyError } from "./same-origin-proxy.js";
+export { createProxyHandler, createAdminAuthRoute, createAdminApiAuthRoute } from "./same-origin-proxy.js";
 export { VENTURE_API_PREFIX, createVentureApiRoute } from "./venture_api_route.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzL,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC9L,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAC3G,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -1,3 +1,3 @@
-export { createProxyHandler, createAdminAuthRoute } from "./same-origin-proxy.js";
+export { createProxyHandler, createAdminAuthRoute, createAdminApiAuthRoute } from "./same-origin-proxy.js";
 export { VENTURE_API_PREFIX, createVentureApiRoute } from "./venture_api_route.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAC3G,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/same-origin-proxy.d.ts

@@ -28,11 +28,11 @@ interface BackendBase {
  * - `"venture"` — a venture backend must never see the raw `admin_session`
  *   cookie. The proxy deletes the `Cookie` header and, if an `admin_session`
  *   was present, injects `X-Admin-Session: <session_id>` carrying the raw
- *   session id for `admin-client`'s `extract_session_from_handoff_header`.
+ *   session id for `admin-shared`'s `extract_session_from_handoff_header`.
  *   Any inbound `X-Admin-Session` header is stripped first (forgery defense).
  *
  * Cookie-transform semantics are an attribute of the Backend, not of the
- * Route. There is no per-route override. Any caller that could point a route
+ * ProxyRoute. There is no per-route override. Any caller that could point a route
  * at the admin backend while running the venture cookie-stripping transform
  * would break web session restore on admin-api; attaching the transform to
  * backend identity makes that state unrepresentable.
@@ -46,7 +46,7 @@ export type Backend = (BackendBase & {
  * A path-rewrite policy applied to the incoming pathname before forwarding.
  * Either an identity passthrough or an explicit transform function. Encoded
  * as a discriminated union so `createProxyHandler` callers cannot omit the
- * decision — every Route states its rewrite policy explicitly.
+ * decision — every ProxyRoute states its rewrite policy explicitly.
  */
 export type PathRewrite = {
     readonly kind: "identity";
@@ -63,19 +63,19 @@ export type PathRewrite = {
  * @field target - Backend to forward matched requests to
  * @field rewrite - Path rewrite policy applied before forwarding
  */
-export interface Route {
+export interface ProxyRoute {
     readonly pathPrefix: string;
     readonly target: Backend;
     readonly rewrite: PathRewrite;
 }
 /**
- * Result of probing a backend's `/health` endpoint.
+ * Result of probing a backend's Jakuta `/status` endpoint.
  *
- * @field status - `"ok"` if the backend responded with a 2xx, `"error"` on non-2xx or network failure
+ * @field healthStatus - `"ok"` if the backend responded with a 2xx, `"error"` on non-2xx or network failure
  * @field probeUrl - The full URL that was probed, useful for error reporting
  */
 export interface HealthProbeResult {
-    readonly status: "ok" | "error";
+    readonly healthStatus: "ok" | "error";
     readonly probeUrl: string;
 }
 /**
@@ -96,9 +96,9 @@ export type ProxyHealthCheck = {
     readonly kind: "disabled";
 } | {
     readonly kind: "enabled";
-    readonly path: string;
+    readonly healthPath: string;
     readonly probeTargets: readonly Backend[];
-    readonly buildHealthResponse: (results: Record<string, HealthProbeResult>) => Response;
+    readonly buildHealthResponse: (healthResults: Record<string, HealthProbeResult>) => Response;
 };
 /**
  * Declarative configuration for `createProxyHandler`.
@@ -109,7 +109,7 @@ export type ProxyHealthCheck = {
  */
 export interface ProxyHandlerConfig {
     readonly allowedHosts: AllowedHosts;
-    readonly routes: readonly Route[];
+    readonly routes: readonly ProxyRoute[];
     readonly healthCheck: ProxyHealthCheck;
 }
 /**
@@ -145,7 +145,7 @@ export interface ProxyHandler {
     handleRequest(workerRequest: Request): Promise<ProxyOutcome>;
 }
 /**
- * Build a `Route` that proxies `/auth/*` to the admin backend's `/api/auth/*`
+ * Build a `ProxyRoute` that proxies `/auth/*` to the admin backend's `/api/auth/*`
  * surface with cookies preserved. Every frontend that renders admin-shell's
  * login UI needs this route, because admin-shell's `AdminRoute.*` constants
  * (`/auth/login`, `/auth/logout`, `/auth/session`) are the single source of
@@ -155,16 +155,31 @@ export interface ProxyHandler {
  * Spread the result into your `routes` array; do not hand-maintain the
  * rewrite.
  *
- * @why Bridges the browser-facing /auth/* path family that admin-shell expects to the admin API's /api/auth/* surface, so every Worker proxy that mounts admin login uses the identical rewrite.
+ * @why Prevents each Worker from hand-writing the admin login rewrite because admin-shell's browser paths and admin-api's server paths intentionally differ.
  * @param adminBaseUrl - Origin of the jakuta-admin API (scheme + host, no path)
- * @returns A Route that matches `/auth` / `/auth/*` and forwards to `adminBaseUrl/api/auth/*`
+ * @returns A ProxyRoute that matches `/auth` / `/auth/*` and forwards to `adminBaseUrl/api/auth/*`
  */
-export declare function createAdminAuthRoute(adminBaseUrl: string): Route;
+export declare function createAdminAuthRoute(adminBaseUrl: string): ProxyRoute;
+/**
+ * Build a `ProxyRoute` that proxies generated admin-shell `/api/auth/*` requests
+ * to the Central Admin backend with cookies preserved.
+ *
+ * Mount this before the venture `/api/*` route. The generated admin-shell
+ * auth client now uses the same `/api/auth/*` route templates as the Central
+ * Admin backend, so the worker should forward those paths without rewriting
+ * them or applying venture cookie-to-header handoff.
+ *
+ * @why Preserves generated admin auth paths because venture workers must route
+ * Central Admin session requests before the general venture API proxy.
+ * @param adminBaseUrl - Origin of the jakuta-admin API (scheme + host, no path)
+ * @returns A ProxyRoute that matches `/api/auth` / `/api/auth/*` and forwards to Central Admin unchanged.
+ */
+export declare function createAdminApiAuthRoute(adminBaseUrl: string): ProxyRoute;
 /**
  * Build a `ProxyHandler` from a declarative `ProxyHandlerConfig`. This is the
  * single handler constructor — there is no separate venture or central-admin
  * handler. Consumers express their routing topology as a list of
- * `Route`s pointing at `Backend`s, and the handler dispatches by first-match.
+ * `ProxyRoute`s pointing at `Backend`s, and the handler dispatches by first-match.
  *
  * Every config must declare its `allowedHosts` — the non-empty list of
  * hostnames this worker accepts. A request for any other hostname is
@@ -177,7 +192,7 @@ export declare function createAdminAuthRoute(adminBaseUrl: string): Route;
  * handoff). There is no per-route override. See the `Backend` doc comment for
  * why this is unrepresentable state, not a missing feature.
  *
- * @why Single constructor for every Worker proxy in the admin family — the only place that reads {@link AllowedHosts}, normalizes backend URLs, and wires the cookie-transform / route-dispatch invariants together so individual workers cannot accidentally diverge.
+ * @why Centralizes host allowlisting, backend URL normalization, and cookie-transform routing because individual worker entries must not diverge on those security rules.
  * @param config - Declarative host allowlist, route list, and health-check hook
  * @returns A ProxyHandler whose `handleRequest` dispatches the inbound request
  */

package/dist/same-origin-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"same-origin-proxy.d.ts","sourceRoot":"","sources":["../src/same-origin-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AAE1D,UAAU,WAAW;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,OAAO,GACf,CAAC,WAAW,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,GAC1C,CAAC,WAAW,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAA;CAAE,CAAC;AAErF;;;;;;;;GAQG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;CAC/B;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,SAAS,OAAO,EAAE,CAAC;IAC1C,QAAQ,CAAC,mBAAmB,EAAE,CAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,KACvC,QAAQ,CAAC;CACf,CAAC;AAEN;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC;AAEhC;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;CACvC;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC9D;AA4OD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,KAAK,CAShE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CA+D3E"}
+{"version":3,"file":"same-origin-proxy.d.ts","sourceRoot":"","sources":["../src/same-origin-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AAE1D,UAAU,WAAW;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,OAAO,GACf,CAAC,WAAW,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,GAC1C,CAAC,WAAW,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAA;CAAE,CAAC;AAErF;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;CAC/B;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,YAAY,EAAE,IAAI,GAAG,OAAO,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,SAAS,OAAO,EAAE,CAAC;IAC1C,QAAQ,CAAC,mBAAmB,EAAE,CAC5B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,KAC7C,QAAQ,CAAC;CACf,CAAC;AAEN;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC;AAEhC;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;CACvC;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC9D;AAiPD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,UAAU,CASrE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,UAAU,CAMxE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CA+D3E"}

package/dist/same-origin-proxy.js

@@ -1,6 +1,9 @@
 const HEALTH_TIMEOUT_MS = 5000;
 function stripTrailingSlash(originUrl) {
-    return originUrl.endsWith("/") ? originUrl.slice(0, -1) : originUrl;
+    if (originUrl.endsWith("/")) {
+        return originUrl.slice(0, -1);
+    }
+    return originUrl;
 }
 function jsonErrorResponse(errorInput) {
     return new Response(JSON.stringify(errorInput.errorBody), {
@@ -9,15 +12,18 @@ function jsonErrorResponse(errorInput) {
     });
 }
 async function probeHealth(probedBaseUrl) {
-    const probeUrl = new URL("/health", probedBaseUrl).toString();
+    const probeUrl = new URL("/status", probedBaseUrl).toString();
     try {
         const healthResponse = await fetch(probeUrl, {
             signal: AbortSignal.timeout(HEALTH_TIMEOUT_MS),
         });
-        return { status: healthResponse.ok ? "ok" : "error", probeUrl };
+        if (healthResponse.ok) {
+            return { healthStatus: "ok", probeUrl };
+        }
+        return { healthStatus: "error", probeUrl };
     }
     catch {
-        return { status: "error", probeUrl };
+        return { healthStatus: "error", probeUrl };
     }
 }
 const ADMIN_SESSION_COOKIE_NAME = "admin_session";
@@ -33,11 +39,11 @@ function findAdminSessionCookieValue(cookieHeader) {
     return { kind: "absent" };
 }
 function readCookieHeader(headers) {
-    const value = headers.get("cookie");
-    if (value === null) {
+    const cookieHeaderValue = headers.get("cookie");
+    if (cookieHeaderValue === null) {
         return { kind: "absent" };
     }
-    return { kind: "present", value };
+    return { kind: "present", cookieHeaderValue };
 }
 function buildVentureForwardedHeaders(originalHeaders) {
     const forwarded = new Headers(originalHeaders);
@@ -45,7 +51,7 @@ function buildVentureForwardedHeaders(originalHeaders) {
     const cookieLookup = readCookieHeader(forwarded);
     forwarded.delete("cookie");
     if (cookieLookup.kind === "present") {
-        const sessionLookup = findAdminSessionCookieValue(cookieLookup.value);
+        const sessionLookup = findAdminSessionCookieValue(cookieLookup.cookieHeaderValue);
         if (sessionLookup.kind === "found") {
             forwarded.set(ADMIN_SESSION_HANDOFF_HEADER, sessionLookup.sessionValue);
         }
@@ -57,17 +63,25 @@ function stripInboundHandoffHeader(originalHeaders) {
     stripped.delete(ADMIN_SESSION_HANDOFF_HEADER);
     return stripped;
 }
-async function forwardToBackend(forwardInput) {
-    const target = forwardInput.target;
-    const targetUrl = new URL(forwardInput.targetPath + forwardInput.originalUrl.search, target.baseUrl);
-    const forwardedHeaders = target.kind === "venture"
-        ? buildVentureForwardedHeaders(forwardInput.originalRequest.headers)
-        : stripInboundHandoffHeader(forwardInput.originalRequest.headers);
+async function forwardToBackend({ originalRequest, originalUrl, target, targetPath, }) {
+    const targetUrl = new URL(targetPath + originalUrl.search, target.baseUrl);
+    let forwardedHeaders;
+    switch (target.kind) {
+        case "venture":
+            forwardedHeaders = buildVentureForwardedHeaders(originalRequest.headers);
+            break;
+        case "admin":
+            forwardedHeaders = stripInboundHandoffHeader(originalRequest.headers);
+            break;
+        default:
+            forwardedHeaders = target;
+            break;
+    }
     try {
         return await fetch(new Request(targetUrl, {
-            method: forwardInput.originalRequest.method,
+            method: originalRequest.method,
             headers: forwardedHeaders,
-            body: forwardInput.originalRequest.body,
+            body: originalRequest.body,
             redirect: "manual",
         }));
     }
@@ -88,26 +102,23 @@ async function forwardToBackend(forwardInput) {
         });
     }
 }
-function matchPathPrefix(params) {
-    if (params.pathname === params.prefix) {
+function matchPathPrefix(pathPrefixMatchInput) {
+    if (pathPrefixMatchInput.pathname === pathPrefixMatchInput.prefix) {
         return { kind: "match" };
     }
-    if (params.pathname.startsWith(params.prefix + "/")) {
+    if (pathPrefixMatchInput.pathname.startsWith(pathPrefixMatchInput.prefix + "/")) {
         return { kind: "match" };
     }
     return { kind: "no_match" };
 }
-function assertNeverPathRewrite(rewrite) {
-    throw new Error(`unreachable PathRewrite variant: ${JSON.stringify(rewrite)}`);
-}
-function applyPathRewrite(params) {
-    switch (params.rewrite.kind) {
+function applyPathRewrite(pathRewriteInput) {
+    switch (pathRewriteInput.rewrite.kind) {
         case "identity":
-            return params.incomingPath;
+            return pathRewriteInput.incomingPath;
         case "transform":
-            return params.rewrite.apply(params.incomingPath);
+            return pathRewriteInput.rewrite.apply(pathRewriteInput.incomingPath);
         default:
-            return assertNeverPathRewrite(params.rewrite);
+            return pathRewriteInput.rewrite;
     }
 }
 function matchAllowedHost(matchParams) {
@@ -134,16 +145,13 @@ function buildHostRejectionResponse(rejectionInput) {
 function normalizeBackend(backend) {
     return { kind: backend.kind, baseUrl: stripTrailingSlash(backend.baseUrl) };
 }
-function normalizeRoute(route) {
+function normalizeRoute(proxyRoute) {
     return {
-        pathPrefix: route.pathPrefix,
-        target: normalizeBackend(route.target),
-        rewrite: route.rewrite,
+        pathPrefix: proxyRoute.pathPrefix,
+        target: normalizeBackend(proxyRoute.target),
+        rewrite: proxyRoute.rewrite,
     };
 }
-function assertNeverHealthCheck(healthCheck) {
-    throw new Error(`unreachable ProxyHealthCheck variant: ${JSON.stringify(healthCheck)}`);
-}
 function normalizeHealthCheck(healthCheck) {
     switch (healthCheck.kind) {
         case "disabled":
@@ -151,16 +159,16 @@ function normalizeHealthCheck(healthCheck) {
         case "enabled":
             return {
                 kind: "enabled",
-                path: healthCheck.path,
+                healthPath: healthCheck.healthPath,
                 probeTargets: healthCheck.probeTargets.map(normalizeBackend),
                 buildHealthResponse: healthCheck.buildHealthResponse,
             };
         default:
-            return assertNeverHealthCheck(healthCheck);
+            return healthCheck;
     }
 }
 /**
- * Build a `Route` that proxies `/auth/*` to the admin backend's `/api/auth/*`
+ * Build a `ProxyRoute` that proxies `/auth/*` to the admin backend's `/api/auth/*`
  * surface with cookies preserved. Every frontend that renders admin-shell's
  * login UI needs this route, because admin-shell's `AdminRoute.*` constants
  * (`/auth/login`, `/auth/logout`, `/auth/session`) are the single source of
@@ -170,9 +178,9 @@ function normalizeHealthCheck(healthCheck) {
  * Spread the result into your `routes` array; do not hand-maintain the
  * rewrite.
  *
- * @why Bridges the browser-facing /auth/* path family that admin-shell expects to the admin API's /api/auth/* surface, so every Worker proxy that mounts admin login uses the identical rewrite.
+ * @why Prevents each Worker from hand-writing the admin login rewrite because admin-shell's browser paths and admin-api's server paths intentionally differ.
  * @param adminBaseUrl - Origin of the jakuta-admin API (scheme + host, no path)
- * @returns A Route that matches `/auth` / `/auth/*` and forwards to `adminBaseUrl/api/auth/*`
+ * @returns A ProxyRoute that matches `/auth` / `/auth/*` and forwards to `adminBaseUrl/api/auth/*`
  */
 export function createAdminAuthRoute(adminBaseUrl) {
     return {
@@ -184,11 +192,32 @@ export function createAdminAuthRoute(adminBaseUrl) {
         },
     };
 }
+/**
+ * Build a `ProxyRoute` that proxies generated admin-shell `/api/auth/*` requests
+ * to the Central Admin backend with cookies preserved.
+ *
+ * Mount this before the venture `/api/*` route. The generated admin-shell
+ * auth client now uses the same `/api/auth/*` route templates as the Central
+ * Admin backend, so the worker should forward those paths without rewriting
+ * them or applying venture cookie-to-header handoff.
+ *
+ * @why Preserves generated admin auth paths because venture workers must route
+ * Central Admin session requests before the general venture API proxy.
+ * @param adminBaseUrl - Origin of the jakuta-admin API (scheme + host, no path)
+ * @returns A ProxyRoute that matches `/api/auth` / `/api/auth/*` and forwards to Central Admin unchanged.
+ */
+export function createAdminApiAuthRoute(adminBaseUrl) {
+    return {
+        pathPrefix: "/api/auth",
+        target: { kind: "admin", baseUrl: stripTrailingSlash(adminBaseUrl) },
+        rewrite: { kind: "identity" },
+    };
+}
 /**
  * Build a `ProxyHandler` from a declarative `ProxyHandlerConfig`. This is the
  * single handler constructor — there is no separate venture or central-admin
  * handler. Consumers express their routing topology as a list of
- * `Route`s pointing at `Backend`s, and the handler dispatches by first-match.
+ * `ProxyRoute`s pointing at `Backend`s, and the handler dispatches by first-match.
  *
  * Every config must declare its `allowedHosts` — the non-empty list of
  * hostnames this worker accepts. A request for any other hostname is
@@ -201,7 +230,7 @@ export function createAdminAuthRoute(adminBaseUrl) {
  * handoff). There is no per-route override. See the `Backend` doc comment for
  * why this is unrepresentable state, not a missing feature.
  *
- * @why Single constructor for every Worker proxy in the admin family — the only place that reads {@link AllowedHosts}, normalizes backend URLs, and wires the cookie-transform / route-dispatch invariants together so individual workers cannot accidentally diverge.
+ * @why Centralizes host allowlisting, backend URL normalization, and cookie-transform routing because individual worker entries must not diverge on those security rules.
  * @param config - Declarative host allowlist, route list, and health-check hook
  * @returns A ProxyHandler whose `handleRequest` dispatches the inbound request
  */
@@ -227,7 +256,7 @@ export function createProxyHandler(config) {
             }
             const pathname = requestUrl.pathname;
             if (normalizedHealthCheck.kind === "enabled" &&
-                pathname === normalizedHealthCheck.path) {
+                pathname === normalizedHealthCheck.healthPath) {
                 const probeResults = await Promise.all(normalizedHealthCheck.probeTargets.map(async (backend) => {
                     const probeResult = await probeHealth(backend.baseUrl);
                     return [backend.kind, probeResult];
@@ -239,17 +268,17 @@ export function createProxyHandler(config) {
                 const proxiedResponse = normalizedHealthCheck.buildHealthResponse(resultsByKind);
                 return { proxied: true, proxiedResponse };
             }
-            for (const route of normalizedRoutes) {
-                const match = matchPathPrefix({ pathname, prefix: route.pathPrefix });
+            for (const proxyRoute of normalizedRoutes) {
+                const match = matchPathPrefix({ pathname, prefix: proxyRoute.pathPrefix });
                 if (match.kind === "match") {
                     const rewrittenPath = applyPathRewrite({
-                        rewrite: route.rewrite,
+                        rewrite: proxyRoute.rewrite,
                         incomingPath: pathname,
                     });
                     const proxiedResponse = await forwardToBackend({
                         originalRequest: workerRequest,
                         originalUrl: requestUrl,
-                        target: route.target,
+                        target: proxyRoute.target,
                         targetPath: rewrittenPath,
                     });
                     return { proxied: true, proxiedResponse };

package/dist/same-origin-proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"same-origin-proxy.js","sourceRoot":"","sources":["../src/same-origin-proxy.ts"],"names":[],"mappings":"AAuJA,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAOD,SAAS,iBAAiB,CAAC,UAAkC;IAC3D,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE;QACxD,MAAM,EAAE,UAAU,CAAC,UAAU;QAC7B,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,aAAqB;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YAC3C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC;SAC/C,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAED,MAAM,yBAAyB,GAAG,eAAe,CAAC;AAClD,MAAM,4BAA4B,GAAG,iBAAiB,CAAC;AAMvD,SAAS,2BAA2B,CAAC,YAAoB;IACvD,MAAM,MAAM,GAAG,yBAAyB,GAAG,GAAG,CAAC;IAC/C,KAAK,MAAM,aAAa,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAMD,SAAS,gBAAgB,CAAC,OAAgB;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,4BAA4B,CAAC,eAAwB;IAC5D,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAC/C,SAAS,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACjD,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3B,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,aAAa,GAAG,2BAA2B,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,aAAa,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACnC,SAAS,CAAC,GAAG,CAAC,4BAA4B,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,yBAAyB,CAAC,eAAwB;IACzD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9C,QAAQ,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAC9C,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD,KAAK,UAAU,gBAAgB,CAAC,YAA0B;IACxD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,YAAY,CAAC,UAAU,GAAG,YAAY,CAAC,WAAW,CAAC,MAAM,EACzD,MAAM,CAAC,OAAO,CACf,CAAC;IAEF,MAAM,gBAAgB,GACpB,MAAM,CAAC,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,4BAA4B,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC;QACpE,CAAC,CAAC,yBAAyB,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAEtE,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAChB,IAAI,OAAO,CAAC,SAAS,EAAE;YACrB,MAAM,EAAE,YAAY,CAAC,eAAe,CAAC,MAAM;YAC3C,OAAO,EAAE,gBAAgB;YACzB,IAAI,EAAE,YAAY,CAAC,eAAe,CAAC,IAAI;YACvC,QAAQ,EAAE,QAAQ;SACnB,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;YAC5B,WAAW,EAAE,MAAM,CAAC,IAAI;SACzB,CAAC;QACF,OAAO,iBAAiB,CAAC;YACvB,UAAU,EAAE,GAAG;YACf,SAAS,EAAE;gBACT,KAAK,EAAE,UAAU,CAAC,IAAI;gBACtB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE,UAAU,CAAC,WAAW;gBAC/B,OAAO,EAAE,4BAA4B,UAAU,CAAC,WAAW,eAAe,UAAU,CAAC,MAAM,wEAAwE;aACpK;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAWD,SAAS,eAAe,CAAC,MAA6B;IACpD,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAOD,SAAS,sBAAsB,CAAC,OAAc;IAC5C,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA8B;IACtD,QAAQ,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,KAAK,UAAU;YACb,OAAO,MAAM,CAAC,YAAY,CAAC;QAC7B,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACnD;YACE,OAAO,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAWD,SAAS,gBAAgB,CAAC,WAAmC;IAC3D,MAAM,qBAAqB,GAAG,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC5E,KAAK,MAAM,WAAW,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;QACnD,IAAI,qBAAqB,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YACxD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;AACjF,CAAC;AAOD,SAAS,0BAA0B,CAAC,cAAuC;IACzE,MAAM,cAAc,GAAG,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,iBAAiB,CAAC;QACvB,UAAU,EAAE,GAAG;QACf,SAAS,EAAE;YACT,KAAK,EAAE,qBAAqB;YAC5B,IAAI,EAAE,cAAc,CAAC,gBAAgB;YACrC,UAAU,EAAE,cAAc;YAC1B,OAAO,EAAE,4CAA4C,cAAc,CAAC,gBAAgB,sCAAsC,cAAc,+GAA+G;SACxP;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB;IACxC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,KAAY;IAClC,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC;QACtC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,WAAkB;IAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,oBAAoB,CAAC,WAA6B;IACzD,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,UAAU;YACb,OAAO,WAAW,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,YAAY,EAAE,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBAC5D,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;aACrD,CAAC;QACJ;YACE,OAAO,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,OAAO;QACL,UAAU,EAAE,OAAO;QACnB,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,CAAC,YAAY,CAAC,EAAE;QACpE,OAAO,EAAE;YACP,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,MAAM,GAAG,YAAY;SAC/C;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA0B;IAC3D,MAAM,sBAAsB,GAAG,MAAM,CAAC,YAAY,CAAC;IACnD,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,MAAM,qBAAqB,GAAG,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvE,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,aAAsB;YACxC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAE9C,MAAM,SAAS,GAAG,gBAAgB,CAAC;gBACjC,UAAU;gBACV,YAAY,EAAE,sBAAsB;aACrC,CAAC,CAAC;YACH,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,eAAe,EAAE,0BAA0B,CAAC;wBAC1C,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;wBAC5C,YAAY,EAAE,sBAAsB;qBACrC,CAAC;iBACH,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;YAErC,IACE,qBAAqB,CAAC,IAAI,KAAK,SAAS;gBACxC,QAAQ,KAAK,qBAAqB,CAAC,IAAI,EACvC,CAAC;gBACD,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CACpC,qBAAqB,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;oBACvD,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBACvD,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAU,CAAC;gBAC9C,CAAC,CAAC,CACH,CAAC;gBACF,MAAM,aAAa,GAAsC,EAAE,CAAC;gBAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,YAAY,EAAE,CAAC;oBAC/C,aAAa,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;gBACpC,CAAC;gBACD,MAAM,eAAe,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;gBACjF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;YAC5C,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;gBACtE,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC3B,MAAM,aAAa,GAAG,gBAAgB,CAAC;wBACrC,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,YAAY,EAAE,QAAQ;qBACvB,CAAC,CAAC;oBACH,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC;wBAC7C,eAAe,EAAE,aAAa;wBAC9B,WAAW,EAAE,UAAU;wBACvB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,UAAU,EAAE,aAAa;qBAC1B,CAAC,CAAC;oBACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;gBAC5C,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"same-origin-proxy.js","sourceRoot":"","sources":["../src/same-origin-proxy.ts"],"names":[],"mappings":"AAuJA,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAOD,SAAS,iBAAiB,CAAC,UAAkC;IAC3D,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE;QACxD,MAAM,EAAE,UAAU,CAAC,UAAU;QAC7B,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,aAAqB;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YAC3C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC;SAC/C,CAAC,CAAC;QACH,IAAI,cAAc,CAAC,EAAE,EAAE,CAAC;YACtB,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,yBAAyB,GAAG,eAAe,CAAC;AAClD,MAAM,4BAA4B,GAAG,iBAAiB,CAAC;AAMvD,SAAS,2BAA2B,CAAC,YAAoB;IACvD,MAAM,MAAM,GAAG,yBAAyB,GAAG,GAAG,CAAC;IAC/C,KAAK,MAAM,aAAa,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAMD,SAAS,gBAAgB,CAAC,OAAgB;IACxC,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,4BAA4B,CAAC,eAAwB;IAC5D,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAC/C,SAAS,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACjD,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3B,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,aAAa,GAAG,2BAA2B,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;QAClF,IAAI,aAAa,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACnC,SAAS,CAAC,GAAG,CAAC,4BAA4B,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,yBAAyB,CAAC,eAAwB;IACzD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9C,QAAQ,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAC9C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,EAC9B,eAAe,EACf,WAAW,EACX,MAAM,EACN,UAAU,GAMX;IACC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAE3E,IAAI,gBAAyB,CAAC;IAC9B,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,SAAS;YACZ,gBAAgB,GAAG,4BAA4B,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM;QACR,KAAK,OAAO;YACV,gBAAgB,GAAG,yBAAyB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YACtE,MAAM;QACR;YACE,gBAAgB,GAAG,MAAM,CAAC;YAC1B,MAAM;IACV,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAChB,IAAI,OAAO,CAAC,SAAS,EAAE;YACrB,MAAM,EAAE,eAAe,CAAC,MAAM;YAC9B,OAAO,EAAE,gBAAgB;YACzB,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,QAAQ,EAAE,QAAQ;SACnB,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;YAC5B,WAAW,EAAE,MAAM,CAAC,IAAI;SACzB,CAAC;QACF,OAAO,iBAAiB,CAAC;YACvB,UAAU,EAAE,GAAG;YACf,SAAS,EAAE;gBACT,KAAK,EAAE,UAAU,CAAC,IAAI;gBACtB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE,UAAU,CAAC,WAAW;gBAC/B,OAAO,EAAE,4BAA4B,UAAU,CAAC,WAAW,eAAe,UAAU,CAAC,MAAM,wEAAwE;aACpK;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAWD,SAAS,eAAe,CAAC,oBAA0C;IACjE,IAAI,oBAAoB,CAAC,QAAQ,KAAK,oBAAoB,CAAC,MAAM,EAAE,CAAC;QAClE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAOD,SAAS,gBAAgB,CAAC,gBAAwC;IAChE,QAAQ,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,KAAK,UAAU;YACb,OAAO,gBAAgB,CAAC,YAAY,CAAC;QACvC,KAAK,WAAW;YACd,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QACvE;YACE,OAAO,gBAAgB,CAAC,OAAO,CAAC;IACpC,CAAC;AACH,CAAC;AAWD,SAAS,gBAAgB,CAAC,WAAmC;IAC3D,MAAM,qBAAqB,GAAG,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC5E,KAAK,MAAM,WAAW,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;QACnD,IAAI,qBAAqB,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YACxD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;AACjF,CAAC;AAOD,SAAS,0BAA0B,CAAC,cAAuC;IACzE,MAAM,cAAc,GAAG,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,iBAAiB,CAAC;QACvB,UAAU,EAAE,GAAG;QACf,SAAS,EAAE;YACT,KAAK,EAAE,qBAAqB;YAC5B,IAAI,EAAE,cAAc,CAAC,gBAAgB;YACrC,UAAU,EAAE,cAAc;YAC1B,OAAO,EAAE,4CAA4C,cAAc,CAAC,gBAAgB,sCAAsC,cAAc,+GAA+G;SACxP;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB;IACxC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,UAAsB;IAC5C,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,MAAM,EAAE,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC;QAC3C,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,WAA6B;IACzD,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,UAAU;YACb,OAAO,WAAW,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,YAAY,EAAE,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBAC5D,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;aACrD,CAAC;QACJ;YACE,OAAO,WAAW,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,OAAO;QACL,UAAU,EAAE,OAAO;QACnB,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,CAAC,YAAY,CAAC,EAAE;QACpE,OAAO,EAAE;YACP,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,MAAM,GAAG,YAAY;SAC/C;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB;IAC1D,OAAO;QACL,UAAU,EAAE,WAAW;QACvB,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,CAAC,YAAY,CAAC,EAAE;QACpE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA0B;IAC3D,MAAM,sBAAsB,GAAG,MAAM,CAAC,YAAY,CAAC;IACnD,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,MAAM,qBAAqB,GAAG,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvE,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,aAAsB;YACxC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAE9C,MAAM,SAAS,GAAG,gBAAgB,CAAC;gBACjC,UAAU;gBACV,YAAY,EAAE,sBAAsB;aACrC,CAAC,CAAC;YACH,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,eAAe,EAAE,0BAA0B,CAAC;wBAC1C,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;wBAC5C,YAAY,EAAE,sBAAsB;qBACrC,CAAC;iBACH,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;YAErC,IACE,qBAAqB,CAAC,IAAI,KAAK,SAAS;gBACxC,QAAQ,KAAK,qBAAqB,CAAC,UAAU,EAC7C,CAAC;gBACD,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CACpC,qBAAqB,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;oBACvD,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBACvD,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAU,CAAC;gBAC9C,CAAC,CAAC,CACH,CAAC;gBACF,MAAM,aAAa,GAAsC,EAAE,CAAC;gBAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,YAAY,EAAE,CAAC;oBAC/C,aAAa,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;gBACpC,CAAC;gBACD,MAAM,eAAe,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;gBACjF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;YAC5C,CAAC;YAED,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;gBAC1C,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC3E,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC3B,MAAM,aAAa,GAAG,gBAAgB,CAAC;wBACrC,OAAO,EAAE,UAAU,CAAC,OAAO;wBAC3B,YAAY,EAAE,QAAQ;qBACvB,CAAC,CAAC;oBACH,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC;wBAC7C,eAAe,EAAE,aAAa;wBAC9B,WAAW,EAAE,UAAU;wBACvB,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,UAAU,EAAE,aAAa;qBAC1B,CAAC,CAAC;oBACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;gBAC5C,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/venture_api_route.d.ts

@@ -1,13 +1,11 @@
-import type { Route } from "./same-origin-proxy.js";
+import type { ProxyRoute } from "./same-origin-proxy.js";
 export declare const VENTURE_API_PREFIX = "/api";
 /**
- * @why Builds the canonical venture-api route from a venture origin so
- * every venture Worker proxy mounts `/api/*` the same way, keeping the
- * Worker-side path contract aligned with the Rust `VENTURE_API_PREFIX`
- * constant.
+ * @why Preserves the shared venture API prefix contract because worker proxy
+ * routes and Rust venture routing must agree on one mounted path.
  *
  * @param ventureBaseUrl - Origin of the venture backend (scheme + host, no path).
- * @returns A Route that matches `/api` / `/api/*` and forwards to `ventureBaseUrl`.
+ * @returns A ProxyRoute that matches `/api` / `/api/*` and forwards to `ventureBaseUrl`.
  */
-export declare function createVentureApiRoute(ventureBaseUrl: string): Route;
+export declare function createVentureApiRoute(ventureBaseUrl: string): ProxyRoute;
 //# sourceMappingURL=venture_api_route.d.ts.map

package/dist/venture_api_route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"venture_api_route.d.ts","sourceRoot":"","sources":["../src/venture_api_route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAKpD,eAAO,MAAM,kBAAkB,SAAS,CAAC;AAEzC;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,KAAK,CAMnE"}
+{"version":3,"file":"venture_api_route.d.ts","sourceRoot":"","sources":["../src/venture_api_route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAKzD,eAAO,MAAM,kBAAkB,SAAS,CAAC;AAEzC;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,UAAU,CAMxE"}

package/dist/venture_api_route.js

@@ -3,13 +3,11 @@
 // and venture Worker proxies all agree on where the admin surface is nested.
 export const VENTURE_API_PREFIX = "/api";
 /**
- * @why Builds the canonical venture-api route from a venture origin so
- * every venture Worker proxy mounts `/api/*` the same way, keeping the
- * Worker-side path contract aligned with the Rust `VENTURE_API_PREFIX`
- * constant.
+ * @why Preserves the shared venture API prefix contract because worker proxy
+ * routes and Rust venture routing must agree on one mounted path.
  *
  * @param ventureBaseUrl - Origin of the venture backend (scheme + host, no path).
- * @returns A Route that matches `/api` / `/api/*` and forwards to `ventureBaseUrl`.
+ * @returns A ProxyRoute that matches `/api` / `/api/*` and forwards to `ventureBaseUrl`.
  */
 export function createVentureApiRoute(ventureBaseUrl) {
     return {

package/dist/venture_api_route.js.map

@@ -1 +1 @@
-{"version":3,"file":"venture_api_route.js","sourceRoot":"","sources":["../src/venture_api_route.ts"],"names":[],"mappings":"AAEA,yEAAyE;AACzE,2EAA2E;AAC3E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,cAAsB;IACxD,OAAO;QACH,UAAU,EAAE,kBAAkB;QAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE;QACpD,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;KAChC,CAAC;AACN,CAAC"}
+{"version":3,"file":"venture_api_route.js","sourceRoot":"","sources":["../src/venture_api_route.ts"],"names":[],"mappings":"AAEA,yEAAyE;AACzE,2EAA2E;AAC3E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,cAAsB;IACxD,OAAO;QACH,UAAU,EAAE,kBAAkB;QAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE;QACpD,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;KAChC,CAAC;AACN,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jakuta-inc/worker-proxy",
-  "version": "6.0.0",
+  "version": "6.1.0",
   "description": "Same-origin reverse proxy for Jakuta admin panel Cloudflare Workers",
   "type": "module",
   "main": "dist/index.js",