@kindgi/api 0.0.0-bootstrap.0 → 0.1.0

package/dist/middleware/authorize.d.ts

@@ -0,0 +1,26 @@
+import type { Context, MiddlewareHandler } from 'hono';
+import { type Action, type AuthzCheckBinding, type Decision, type ResourceRef } from '@kindgi/authz';
+import type { AppEnv } from '../types.js';
+/**
+ * Callback that produces the resource being acted upon from the Hono
+ * context. Called at request time — can read path params, query, or
+ * body (if already parsed).
+ */
+export type ResourceGetter = (c: Context<AppEnv>) => ResourceRef | Promise<ResourceRef>;
+export interface Authorizer {
+    readonly authorize: (action: Action, getResource: ResourceGetter) => MiddlewareHandler<AppEnv>;
+    readonly can: (c: Context<AppEnv>, action: Action, resource: ResourceRef) => Promise<boolean>;
+    readonly check: (c: Context<AppEnv>, action: Action, resource: ResourceRef) => Promise<Decision>;
+    /**
+     * List-filtering helper — takes items + a ref-extractor and returns
+     * only those items where the principal has `action` on the derived
+     * resource. Preserves input order. Empty in → empty out.
+     *
+     * Use in GET-list route handlers after fetching tenant-scoped rows;
+     * strips rows the caller can't read so the response only includes
+     * what they'd be allowed to touch.
+     */
+    readonly filterByCan: <T>(c: Context<AppEnv>, action: Action, items: readonly T[], refFn: (item: T) => ResourceRef) => Promise<T[]>;
+}
+export declare function createAuthorizer(binding: AuthzCheckBinding): Authorizer;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/middleware/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,EACL,KAAK,MAAM,EACX,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EAEb,KAAK,WAAW,EAEjB,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAExF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,KAAK,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC/F,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9F,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjG;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,EACtB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,WAAW,KAC5B,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;CACnB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,CAgEvE"}

package/dist/middleware/authorize.js

@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { denyPayload, } from '@kindgi/authz';
+export function createAuthorizer(binding) {
+    async function checkInternal(c, action, resource) {
+        const principal = c.get('principal');
+        if (principal === undefined) {
+            return {
+                allowed: false,
+                failing: 'actor',
+                reason: 'no principal on request (bearer/principal middleware did not run)',
+                evidence: {
+                    action,
+                    relation: '',
+                    resource: `${resource.type}:${resource.id}`,
+                    actorSubject: '',
+                },
+            };
+        }
+        const requestId = c.get('requestId');
+        const ctx = typeof requestId === 'string' && requestId.length > 0
+            ? { correlationId: requestId }
+            : undefined;
+        return binding.check(principal, action, resource, ctx);
+    }
+    return {
+        check: checkInternal,
+        async can(c, action, resource) {
+            const d = await checkInternal(c, action, resource);
+            return d.allowed;
+        },
+        authorize(action, getResource) {
+            return async (c, next) => {
+                const resource = await getResource(c);
+                const decision = await checkInternal(c, action, resource);
+                if (!decision.allowed) {
+                    const body = denyPayload(action, resource.type, resource.id, decision.reason);
+                    c.status(403);
+                    return c.json(body);
+                }
+                return next();
+            };
+        },
+        async filterByCan(c, action, items, refFn) {
+            if (items.length === 0)
+                return [];
+            const principal = c.get('principal');
+            if (principal === undefined)
+                return [];
+            const refs = items.map(refFn);
+            const requestId = c.get('requestId');
+            const ctx = typeof requestId === 'string' && requestId.length > 0
+                ? { correlationId: requestId }
+                : undefined;
+            const decisions = await binding.checkBatch(principal, action, refs, ctx);
+            const out = [];
+            for (let i = 0; i < items.length; i++) {
+                if (decisions[i]?.allowed)
+                    out.push(items[i]);
+            }
+            return out;
+        },
+    };
+}
+//# sourceMappingURL=authorize.js.map

package/dist/middleware/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAoBjC,OAAO,EAML,WAAW,GACZ,MAAM,eAAe,CAAC;AAgCvB,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,KAAK,UAAU,aAAa,CAC1B,CAAkB,EAClB,MAAc,EACd,QAAqB;QAErB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAA0B,CAAC;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,mEAAmE;gBAC3E,QAAQ,EAAE;oBACR,MAAM;oBACN,QAAQ,EAAE,EAAE;oBACZ,QAAQ,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,EAAE;oBAC3C,YAAY,EAAE,EAAE;iBACjB;aACF,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,GAAG,GACP,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YACnD,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE;YAC9B,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IAED,OAAO;QACL,KAAK,EAAE,aAAa;QACpB,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ;YAC3B,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC,OAAO,CAAC;QACnB,CAAC;QACD,SAAS,CAAC,MAAM,EAAE,WAAW;YAC3B,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC;gBACtC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC1D,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAC9E,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACd,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC;gBACD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;YACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAA0B,CAAC;YAC9D,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrC,MAAM,GAAG,GACP,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;gBACnD,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE;gBAC9B,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACzE,MAAM,GAAG,GAA6B,EAAE,CAAC;YACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO;oBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAA2B,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/middleware/error-mapper.d.ts

@@ -0,0 +1,13 @@
+import type { MiddlewareHandler } from 'hono';
+/**
+ * Top-level catch-all. Any uncaught exception is translated to a
+ * `500 internal-server-error` wire error. Domain errors returned via
+ * `Result<T, E>` are handled per-route — this middleware only catches
+ * thrown exceptions (framework bugs, DB failures without Result wrap,
+ * etc.).
+ *
+ * The requestId embedded in the response body matches
+ * `middleware/request-id.ts`, so a caller can correlate.
+ */
+export declare function errorMapperMiddleware(): MiddlewareHandler;
+//# sourceMappingURL=error-mapper.d.ts.map

package/dist/middleware/error-mapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-mapper.d.ts","sourceRoot":"","sources":["../../src/middleware/error-mapper.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI9C;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,IAAI,iBAAiB,CAmBzD"}

package/dist/middleware/error-mapper.js

@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { statusFor, toWireError } from '../errors.js';
+/**
+ * Top-level catch-all. Any uncaught exception is translated to a
+ * `500 internal-server-error` wire error. Domain errors returned via
+ * `Result<T, E>` are handled per-route — this middleware only catches
+ * thrown exceptions (framework bugs, DB failures without Result wrap,
+ * etc.).
+ *
+ * The requestId embedded in the response body matches
+ * `middleware/request-id.ts`, so a caller can correlate.
+ */
+export function errorMapperMiddleware() {
+    return async (c, next) => {
+        try {
+            await next();
+            return;
+        }
+        catch (cause) {
+            const requestId = c.get('requestId') ?? 'req-unknown';
+            const message = cause instanceof Error ? cause.message : String(cause);
+            const body = toWireError({
+                code: 'internal-server-error',
+                message: message.length > 0 ? message : 'Unhandled server error',
+            }, requestId);
+            c.status(statusFor('internal-server-error'));
+            return c.json(body);
+        }
+    };
+}
+//# sourceMappingURL=error-mapper.js.map

package/dist/middleware/error-mapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-mapper.js","sourceRoot":"","sources":["../../src/middleware/error-mapper.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAIjC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,SAAS,GAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAwB,IAAI,aAAa,CAAC;YAC9E,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,GAAG,WAAW,CACtB;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;aACjE,EACD,SAAS,CACV,CAAC;YACF,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAU,CAAC,CAAC;YACtD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/idempotency.d.ts

@@ -0,0 +1,43 @@
+import type { MiddlewareHandler } from 'hono';
+/**
+ * Idempotency-key store: `(tenantId, route, key) → cached response`,
+ * cached for `ttlMs` (default 24h per API-ROUTE-CONVENTIONS.md §3.1).
+ *
+ * Injected into the middleware so deployments can plug in a durable
+ * store (e.g. Postgres, Redis). The bundled `createInMemoryIdempotencyStore()`
+ * is fine for dev + tests; production installs are expected to plug
+ * in a persistent one so retries survive restarts.
+ */
+export interface IdempotencyStore {
+    get(key: string): Promise<StoredIdempotencyEntry | null>;
+    set(key: string, entry: StoredIdempotencyEntry): Promise<void>;
+}
+export interface StoredIdempotencyEntry {
+    readonly bodyHash: string;
+    readonly status: number;
+    readonly contentType: string;
+    readonly bodyText: string;
+    readonly expiresAt: number;
+}
+/** Simple in-memory store with lazy expiry — swap for a DB store in prod. */
+export declare function createInMemoryIdempotencyStore(): IdempotencyStore;
+/**
+ * Idempotency-Key middleware per API-ROUTE-CONVENTIONS.md §3.1.
+ *
+ * Behaviour:
+ * - Only applies to mutating methods (POST/PUT/PATCH/DELETE).
+ * - No `Idempotency-Key` header → pass through.
+ * - Cached hit with matching body hash → replay stored response
+ *   byte-identical (status, content-type, body).
+ * - Cached hit with different body hash → 409
+ *   `idempotency-key-body-mismatch`.
+ * - Cache miss → run the handler, then store the response.
+ *
+ * The middleware sits AFTER auth so `tenantId` is available; the
+ * cache key is namespaced by tenant so callers can't collide across
+ * tenants.
+ */
+export declare function idempotencyMiddleware(store: IdempotencyStore, opts?: {
+    ttlMs?: number;
+}): MiddlewareHandler;
+//# sourceMappingURL=idempotency.d.ts.map

package/dist/middleware/idempotency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../../src/middleware/idempotency.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAM9C;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACzD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,6EAA6E;AAC7E,wBAAgB,8BAA8B,IAAI,gBAAgB,CAgBjE;AAKD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,gBAAgB,EACvB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5B,iBAAiB,CA6DnB"}

package/dist/middleware/idempotency.js

@@ -0,0 +1,118 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { createHash } from 'node:crypto';
+import { statusFor, toWireError } from '../errors.js';
+/** Simple in-memory store with lazy expiry — swap for a DB store in prod. */
+export function createInMemoryIdempotencyStore() {
+    const table = new Map();
+    return {
+        async get(key) {
+            const hit = table.get(key);
+            if (hit === undefined)
+                return null;
+            if (hit.expiresAt <= Date.now()) {
+                table.delete(key);
+                return null;
+            }
+            return hit;
+        },
+        async set(key, entry) {
+            table.set(key, entry);
+        },
+    };
+}
+const MUTATING_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+const DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
+/**
+ * Idempotency-Key middleware per API-ROUTE-CONVENTIONS.md §3.1.
+ *
+ * Behaviour:
+ * - Only applies to mutating methods (POST/PUT/PATCH/DELETE).
+ * - No `Idempotency-Key` header → pass through.
+ * - Cached hit with matching body hash → replay stored response
+ *   byte-identical (status, content-type, body).
+ * - Cached hit with different body hash → 409
+ *   `idempotency-key-body-mismatch`.
+ * - Cache miss → run the handler, then store the response.
+ *
+ * The middleware sits AFTER auth so `tenantId` is available; the
+ * cache key is namespaced by tenant so callers can't collide across
+ * tenants.
+ */
+export function idempotencyMiddleware(store, opts = {}) {
+    const ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+    return async (c, next) => {
+        if (!MUTATING_METHODS.has(c.req.method.toUpperCase())) {
+            return next();
+        }
+        const rawKey = c.req.header('idempotency-key');
+        if (rawKey === undefined || rawKey.length === 0) {
+            return next();
+        }
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        if (tenantId === undefined) {
+            // Auth middleware didn't set it — bail out and let the auth
+            // failure surface. This shouldn't happen because auth runs
+            // first, but the guard keeps the cache key well-formed.
+            return next();
+        }
+        const bodyText = await readRawBody(c.req.raw);
+        const bodyHash = hashBody(bodyText);
+        const cacheKey = `${tenantId}|${c.req.method.toUpperCase()}:${c.req.path}|${rawKey}`;
+        const hit = await store.get(cacheKey);
+        if (hit !== null) {
+            if (hit.bodyHash !== bodyHash) {
+                c.status(statusFor('idempotency-key-body-mismatch'));
+                return c.json(toWireError({
+                    code: 'idempotency-key-body-mismatch',
+                    message: 'Idempotency-Key was reused with a different request body. Use a fresh key or the original body.',
+                }, requestId));
+            }
+            return c.body(hit.bodyText, hit.status, {
+                'Content-Type': hit.contentType,
+                'X-Idempotent-Replay': 'true',
+            });
+        }
+        // Re-attach the buffered body so downstream handlers reading
+        // `c.req.json()` see the same bytes.
+        if (bodyText.length > 0)
+            rebindBody(c, bodyText);
+        await next();
+        const res = c.res;
+        const savedBody = await res.clone().text();
+        const contentType = res.headers.get('Content-Type') ?? 'application/octet-stream';
+        await store.set(cacheKey, {
+            bodyHash,
+            status: res.status,
+            contentType,
+            bodyText: savedBody,
+            expiresAt: Date.now() + ttlMs,
+        });
+        return;
+    };
+}
+async function readRawBody(req) {
+    const method = req.method.toUpperCase();
+    if (method === 'GET' || method === 'HEAD')
+        return '';
+    try {
+        return await req.clone().text();
+    }
+    catch {
+        return '';
+    }
+}
+function hashBody(body) {
+    return createHash('sha256').update(body).digest('hex');
+}
+function rebindBody(c, body) {
+    const original = c.req.raw;
+    const rebuilt = new Request(original.url, {
+        method: original.method,
+        headers: original.headers,
+        body,
+    });
+    Object.defineProperty(c.req, 'raw', { value: rebuilt, configurable: true });
+}
+//# sourceMappingURL=idempotency.js.map

package/dist/middleware/idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../../src/middleware/idempotency.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAMzC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAwBtD,6EAA6E;AAC7E,MAAM,UAAU,8BAA8B;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkC,CAAC;IACxD,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACnC,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAChC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAClB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK;YAClB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC1F,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAuB,EACvB,OAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;IAC3C,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACtD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAW,CAAC;QAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAyB,CAAC;QAC3D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,4DAA4D;YAC5D,2DAA2D;YAC3D,wDAAwD;YACxD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,GAAG,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;QACrF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEtC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,+BAA+B,CAAU,CAAC,CAAC;gBAC9D,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,+BAA+B;oBACrC,OAAO,EACL,iGAAiG;iBACpG,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAe,EAAE;gBAC/C,cAAc,EAAE,GAAG,CAAC,WAAW;gBAC/B,qBAAqB,EAAE,MAAM;aAC9B,CAAC,CAAC;QACL,CAAC;QAED,6DAA6D;QAC7D,qCAAqC;QACrC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACjD,MAAM,IAAI,EAAE,CAAC;QAEb,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;QAClB,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,0BAA0B,CAAC;QAClF,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;YACxB,QAAQ;YACR,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,WAAW;YACX,QAAQ,EAAE,SAAS;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC9B,CAAC,CAAC;QACH,OAAO;IACT,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAY;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,UAAU,CAAC,CAA4B,EAAE,IAAY;IAC5D,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE;QACxC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,IAAI;KACL,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/middleware/principal.d.ts

@@ -0,0 +1,4 @@
+import type { MiddlewareHandler } from 'hono';
+import type { AppEnv } from '../types.js';
+export declare function principalMiddleware(): MiddlewareHandler<AppEnv>;
+//# sourceMappingURL=principal.d.ts.map

package/dist/middleware/principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../src/middleware/principal.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,wBAAgB,mBAAmB,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAuC/D"}

package/dist/middleware/principal.js

@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { principalFromToken } from '@kindgi/authz';
+export function principalMiddleware() {
+    return async (c, next) => {
+        const tenantId = c.get('tenantId');
+        const userId = c.get('userId');
+        const tokenId = c.get('tokenId');
+        const sessionId = c.get('sessionId');
+        if (tenantId === undefined) {
+            // Bearer middleware didn't populate — either the route is
+            // pre-auth (unlikely at this mount point) or the resolver
+            // failed silently. Skip; downstream authorize() will 403 in a
+            // coherent way if it needs the principal.
+            return next();
+        }
+        // A user when the token names one; otherwise a service account: a
+        // durable API key's id, or else the session id (which uniquely
+        // identifies the token record). With none of them, leave `principal`
+        // unset; `authorize()` treats that as "no principal" and 403s cleanly.
+        const serviceAccountId = tokenId ?? sessionId;
+        if (userId === undefined && serviceAccountId === undefined) {
+            return next();
+        }
+        try {
+            const principal = principalFromToken({
+                tenantId,
+                ...(userId !== undefined ? { userId } : {}),
+                ...(userId === undefined && serviceAccountId !== undefined
+                    ? { tokenId: serviceAccountId }
+                    : {}),
+            });
+            c.set('principal', principal);
+        }
+        catch {
+            // Defensive: principalFromToken throws when its guardrail is
+            // violated; downstream authorize() handles the missing principal.
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=principal.js.map

package/dist/middleware/principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["../../src/middleware/principal.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAmBjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAInD,MAAM,UAAU,mBAAmB;IACjC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAErC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,0DAA0D;YAC1D,0DAA0D;YAC1D,8DAA8D;YAC9D,0CAA0C;YAC1C,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,kEAAkE;QAClE,+DAA+D;QAC/D,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,gBAAgB,GACnB,OAAyC,IAAK,SAA2C,CAAC;QAC7F,IAAI,MAAM,KAAK,SAAS,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC3D,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,kBAAkB,CAAC;gBACnC,QAAQ;gBACR,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,gBAAgB,KAAK,SAAS;oBACxD,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE;oBAC/B,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YACH,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;YAC7D,kEAAkE;QACpE,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/public-run-routes.d.ts

@@ -0,0 +1,16 @@
+import type { MiddlewareHandler } from 'hono';
+/**
+ * The routes a public run token may call: the operations registered with
+ * `security: 'bearer-or-public-run'`. Deriving the list from the
+ * operation registry keeps the middleware, the OpenAPI document and the
+ * routes in step.
+ */
+export declare function publicRunRouteMatcher(): (method: string, path: string) => boolean;
+/**
+ * CORS for the public-run-token routes only, so a browser on one of
+ * `allowedOrigins` can call them with a public token. Every other route
+ * gets no CORS headers: secret API tokens stay server-side. Registered
+ * ahead of authentication, so preflights don't need a token.
+ */
+export declare function publicRunCorsMiddleware(allowedOrigins: readonly string[]): MiddlewareHandler;
+//# sourceMappingURL=public-run-routes.d.ts.map

package/dist/middleware/public-run-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-run-routes.d.ts","sourceRoot":"","sources":["../../src/middleware/public-run-routes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAK9C;;;;;GAKG;AACH,wBAAgB,qBAAqB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CASjF;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CAkB5F"}

package/dist/middleware/public-run-routes.js

@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { cors } from 'hono/cors';
+import { OPERATIONS } from '../openapi/operations.js';
+/**
+ * The routes a public run token may call: the operations registered with
+ * `security: 'bearer-or-public-run'`. Deriving the list from the
+ * operation registry keeps the middleware, the OpenAPI document and the
+ * routes in step.
+ */
+export function publicRunRouteMatcher() {
+    const routes = OPERATIONS.filter((op) => op.security === 'bearer-or-public-run').map((op) => ({
+        method: op.method.toUpperCase(),
+        pattern: new RegExp(`^${op.honoPath.replace(/[.*+?^${}()|[\]\\]/g, '\\$&').replace(/:[A-Za-z][A-Za-z0-9_]*/g, '[^/]+')}$`),
+    }));
+    return (method, path) => routes.some((route) => route.method === method && route.pattern.test(path));
+}
+/**
+ * CORS for the public-run-token routes only, so a browser on one of
+ * `allowedOrigins` can call them with a public token. Every other route
+ * gets no CORS headers: secret API tokens stay server-side. Registered
+ * ahead of authentication, so preflights don't need a token.
+ */
+export function publicRunCorsMiddleware(allowedOrigins) {
+    const matchesPath = publicRunRouteMatcher();
+    const handler = cors({
+        origin: [...allowedOrigins],
+        allowMethods: ['GET'],
+        allowHeaders: ['Authorization', 'Last-Event-ID'],
+        exposeHeaders: ['X-Request-Id'],
+        maxAge: 600,
+    });
+    return async (c, next) => {
+        // A preflight asks about the method it will use; match on that.
+        const method = c.req.method === 'OPTIONS'
+            ? (c.req.header('access-control-request-method') ?? '').toUpperCase()
+            : c.req.method;
+        if (!matchesPath(method, c.req.path))
+            return next();
+        return handler(c, next);
+    };
+}
+//# sourceMappingURL=public-run-routes.js.map

package/dist/middleware/public-run-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-run-routes.js","sourceRoot":"","sources":["../../src/middleware/public-run-routes.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAGjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,KAAK,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5F,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE;QAC/B,OAAO,EAAE,IAAI,MAAM,CACjB,IAAI,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,yBAAyB,EAAE,OAAO,CAAC,GAAG,CACtG;KACF,CAAC,CAAC,CAAC;IACJ,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CACtB,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,cAAiC;IACvE,MAAM,WAAW,GAAG,qBAAqB,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC;QACnB,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC;QAC3B,YAAY,EAAE,CAAC,KAAK,CAAC;QACrB,YAAY,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC;QAChD,aAAa,EAAE,CAAC,cAAc,CAAC;QAC/B,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;IACH,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,gEAAgE;QAChE,MAAM,MAAM,GACV,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;YACxB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,+BAA+B,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;YACrE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QACnB,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACpD,OAAO,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/request-id.d.ts

@@ -0,0 +1,14 @@
+import type { MiddlewareHandler } from 'hono';
+/**
+ * Assigns a request id to every incoming request. Stored on the Hono
+ * context as `c.get('requestId')`. Every error envelope embeds this so
+ * a caller reporting a bug can hand us one string to grep the logs.
+ *
+ * If the client provided `X-Request-Id`, we honor it (matching a
+ * caller-supplied id makes SDK retries observable in server logs).
+ * Otherwise we mint a new UUID.
+ *
+ * The response header `X-Request-Id` mirrors the id back.
+ */
+export declare function requestIdMiddleware(): MiddlewareHandler;
+//# sourceMappingURL=request-id.d.ts.map

package/dist/middleware/request-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-id.d.ts","sourceRoot":"","sources":["../../src/middleware/request-id.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,iBAAiB,CASvD"}

package/dist/middleware/request-id.js

@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { randomUUID } from 'node:crypto';
+/**
+ * Assigns a request id to every incoming request. Stored on the Hono
+ * context as `c.get('requestId')`. Every error envelope embeds this so
+ * a caller reporting a bug can hand us one string to grep the logs.
+ *
+ * If the client provided `X-Request-Id`, we honor it (matching a
+ * caller-supplied id makes SDK retries observable in server logs).
+ * Otherwise we mint a new UUID.
+ *
+ * The response header `X-Request-Id` mirrors the id back.
+ */
+export function requestIdMiddleware() {
+    return async (c, next) => {
+        const provided = c.req.header('x-request-id');
+        const requestId = provided !== undefined && provided.length > 0 ? provided : `req-${randomUUID()}`;
+        c.set('requestId', requestId);
+        await next();
+        c.header('X-Request-Id', requestId);
+    };
+}
+//# sourceMappingURL=request-id.js.map

package/dist/middleware/request-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-id.js","sourceRoot":"","sources":["../../src/middleware/request-id.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,SAAS,GACb,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,UAAU,EAAE,EAAE,CAAC;QACnF,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC9B,MAAM,IAAI,EAAE,CAAC;QACb,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/sigv4-verify.d.ts

@@ -0,0 +1,64 @@
+/** S3's allowed clock skew for signed requests (15 minutes). */
+export declare const MAX_CLOCK_SKEW_SECONDS: number;
+/** S3's maximum presigned-URL lifetime (7 days). */
+export declare const MAX_PRESIGN_EXPIRES_SECONDS: number;
+export interface SigV4Error {
+    /** S3 error code. */
+    readonly code: string;
+    readonly message: string;
+    readonly status: 400 | 403;
+}
+export type SigV4Result<T> = {
+    readonly kind: 'ok';
+    readonly value: T;
+} | {
+    readonly kind: 'err';
+    readonly error: SigV4Error;
+};
+/** What a request claims about its signature, before verification. */
+export interface SigV4Claim {
+    readonly kind: 'header' | 'presigned';
+    readonly accessKeyId: string;
+    /** Credential-scope date, `YYYYMMDD`. */
+    readonly scopeDate: string;
+    readonly region: string;
+    readonly service: string;
+    /** Lowercase header names, as the client listed them. */
+    readonly signedHeaders: readonly string[];
+    readonly signature: string;
+    /** `YYYYMMDDTHHMMSSZ`. */
+    readonly amzDate: string;
+    /** Presigned only: `X-Amz-Expires`, seconds. */
+    readonly expiresSeconds?: number;
+}
+export interface SigV4Request {
+    readonly method: string;
+    /** The request URL as received (pathname still percent-encoded). */
+    readonly url: URL;
+    readonly headers: Headers;
+}
+/**
+ * Parse the signature claim from the `Authorization` header or the
+ * presigned-URL query parameters. Does not verify anything.
+ */
+export declare function parseSigV4(request: SigV4Request): SigV4Result<SigV4Claim>;
+/**
+ * Check the claim's timestamp and shape against the server clock:
+ * `X-Amz-Date` well-formed and consistent with the credential scope,
+ * within {@link MAX_CLOCK_SKEW_SECONDS} (header auth / presigned not
+ * dated in the future), and — presigned — not expired. Also checks the
+ * signed-header list is sorted, lowercase, and covers what must be
+ * signed.
+ */
+export declare function checkSigV4Claim(claim: SigV4Claim, now: Date): SigV4Result<void>;
+/**
+ * Re-derive the signature from exactly what the client signed and compare
+ * it (constant-time) with the claimed one. `payloadHash` is the header
+ * `x-amz-content-sha256` for header auth (the caller verifies it against
+ * the body); presigned requests always sign `UNSIGNED-PAYLOAD`.
+ */
+export declare function verifySigV4Signature(request: SigV4Request, claim: SigV4Claim, secretKey: string): SigV4Result<void>;
+/** The SigV4 canonical request (exported for tests). */
+export declare function canonicalRequest(request: SigV4Request, claim: SigV4Claim): SigV4Result<string>;
+export declare function constantTimeEqual(a: string, b: string): boolean;
+//# sourceMappingURL=sigv4-verify.d.ts.map

package/dist/middleware/sigv4-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4-verify.d.ts","sourceRoot":"","sources":["../../src/middleware/sigv4-verify.ts"],"names":[],"mappings":"AA0BA,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,QAAU,CAAC;AAC9C,oDAAoD;AACpD,eAAO,MAAM,2BAA2B,QAAmB,CAAC;AAM5D,MAAM,WAAW,UAAU;IACzB,qBAAqB;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;CAC5B;AAED,MAAM,MAAM,WAAW,CAAC,CAAC,IACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC1C;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAEzD,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yCAAyC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0BAA0B;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gDAAgD;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAMD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,WAAW,CAAC,UAAU,CAAC,CAmFzE;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CA0C/E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,YAAY,EACrB,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,MAAM,GAChB,WAAW,CAAC,IAAI,CAAC,CAkBnB;AAED,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,CA+B9F;AA2FD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAK/D"}