@luckystack/api 0.1.0

package/dist/index.js

@@ -0,0 +1,816 @@
+// src/handleApiRequest.ts
+import { getSession, logout } from "@luckystack/login";
+import { getProjectConfig } from "@luckystack/core";
+import { getRuntimeApiMaps } from "@luckystack/core";
+import {
+  validateRequest,
+  checkRateLimit,
+  tryCatch,
+  parseTransportRouteName,
+  buildApiResponseEventName,
+  buildApiStreamEventName,
+  dispatchHook,
+  validateInputByType,
+  getLogger
+} from "@luckystack/core";
+import {
+  defaultHttpStatusForResponse,
+  extractLanguageFromHeader,
+  normalizeErrorResponse,
+  applyErrorFormatter,
+  registerApiAbortController,
+  unregisterApiAbortController,
+  socketEventNames
+} from "@luckystack/core";
+var shouldLogDev = () => getProjectConfig().logging.devLogs;
+var shouldLogStream = () => getProjectConfig().logging.stream;
+var warnedMissingInputType = /* @__PURE__ */ new Set();
+var warnIfInputTypeMissing = (resolvedName, inputType) => {
+  if (!getProjectConfig().dev.warnOnMissingInputType) return;
+  if (inputType && inputType.trim().length > 0 && inputType.trim() !== "any") return;
+  if (warnedMissingInputType.has(resolvedName)) return;
+  warnedMissingInputType.add(resolvedName);
+  getLogger().warn(`api: route ${resolvedName} has no inputType \u2014 runtime input validation is disabled. Regenerate types or set the inputType on the handler.`);
+};
+var validateApiMessage = ({ msg, emitApiError }) => {
+  const { name, data, responseIndex } = msg;
+  if (!responseIndex && typeof responseIndex !== "number") {
+    if (shouldLogDev()) {
+      getLogger().warn("api: no response index given");
+    }
+    return null;
+  }
+  if (!name || !data || typeof name != "string" || typeof data != "object") {
+    emitApiError({
+      response: { status: "error", errorCode: "api.invalidRequest" },
+      fallbackHttpStatus: 400
+    });
+    return null;
+  }
+  return { name, data };
+};
+var checkApiAuth = ({ apiEntry, user, name, emitApiError }) => {
+  if (apiEntry.auth.login && !user?.id) {
+    if (shouldLogDev()) {
+      getLogger().warn(`api: ${name} requires login`, { route: name });
+    }
+    emitApiError({
+      response: { status: "error", errorCode: "auth.required" },
+      fallbackHttpStatus: 401
+    });
+    return false;
+  }
+  const authResult = validateRequest({ auth: apiEntry.auth, user });
+  if (authResult.status === "error") {
+    if (shouldLogDev()) {
+      getLogger().warn(`api: auth failed for ${name}`, { route: name, errorCode: authResult.errorCode });
+    }
+    emitApiError({
+      response: {
+        status: "error",
+        errorCode: authResult.errorCode || "auth.forbidden",
+        errorParams: authResult.errorParams,
+        httpStatus: authResult.httpStatus
+      },
+      fallbackHttpStatus: authResult.httpStatus ?? 403
+    });
+    return false;
+  }
+  return true;
+};
+var applyApiRateLimits = async ({ apiEntry, resolvedName, token, socket, user, emitApiError }) => {
+  const apiRateLimit = apiEntry.rateLimit;
+  const effectiveApiLimit = apiRateLimit === void 0 ? getProjectConfig().rateLimiting.defaultApiLimit : apiRateLimit;
+  if (effectiveApiLimit !== false && effectiveApiLimit > 0) {
+    const requesterIdentity = token ?? socket.handshake.address ?? "unknown";
+    const keyPrefix = token ? "token" : "ip";
+    const rateLimitKey = `${keyPrefix}:${requesterIdentity}:api:${resolvedName}`;
+    const { allowed, resetIn } = await checkRateLimit({
+      key: rateLimitKey,
+      limit: effectiveApiLimit,
+      windowMs: getProjectConfig().rateLimiting.windowMs
+    });
+    if (!allowed) {
+      void dispatchHook("rateLimitExceeded", {
+        scope: token ? "user" : "route",
+        key: rateLimitKey,
+        limit: effectiveApiLimit,
+        windowMs: getProjectConfig().rateLimiting.windowMs,
+        count: effectiveApiLimit + 1,
+        route: resolvedName,
+        userId: user?.id
+      });
+      if (shouldLogDev()) {
+        getLogger().warn(`api: rate limit exceeded for ${resolvedName}`, { route: resolvedName, key: rateLimitKey });
+      }
+      emitApiError({
+        response: {
+          status: "error",
+          errorCode: "api.rateLimitExceeded",
+          errorParams: [{ key: "seconds", value: resetIn }]
+        },
+        fallbackHttpStatus: 429
+      });
+      return false;
+    }
+  }
+  const defaultIpLimit = getProjectConfig().rateLimiting.defaultIpLimit;
+  if (defaultIpLimit !== false && defaultIpLimit > 0) {
+    const requesterIp = socket.handshake.address ?? "unknown";
+    const { allowed, resetIn } = await checkRateLimit({
+      key: `ip:${requesterIp}:api:all`,
+      limit: defaultIpLimit,
+      windowMs: getProjectConfig().rateLimiting.windowMs
+    });
+    if (!allowed) {
+      void dispatchHook("rateLimitExceeded", {
+        scope: "ip",
+        key: `ip:${requesterIp}:api:all`,
+        limit: defaultIpLimit,
+        windowMs: getProjectConfig().rateLimiting.windowMs,
+        count: defaultIpLimit + 1,
+        ip: requesterIp
+      });
+      if (shouldLogDev()) {
+        getLogger().warn(`api: global IP rate limit exceeded`, { ip: requesterIp });
+      }
+      emitApiError({
+        response: {
+          status: "error",
+          errorCode: "api.rateLimitExceeded",
+          errorParams: [{ key: "seconds", value: resetIn }]
+        },
+        fallbackHttpStatus: 429
+      });
+      return false;
+    }
+  }
+  return true;
+};
+var executeApiHandler = async ({ apiEntry, normalizedData, user, functionsObject, resolvedName, emitStream, abortSignal, flushPressure }) => {
+  const executeStart = Date.now();
+  const [error, result] = await tryCatch(
+    async () => await apiEntry.main({ data: normalizedData, user, functions: functionsObject, stream: emitStream, abortSignal, flushPressure }),
+    void 0,
+    {
+      handler: "handleApiRequest",
+      api: resolvedName,
+      userId: user?.id,
+      transport: "socket"
+    }
+  );
+  return { error: error ?? null, result: result ?? void 0, durationMs: Date.now() - executeStart };
+};
+var buildApiResponseEnvelope = ({
+  resolvedName,
+  error,
+  result,
+  preferredLocale,
+  user
+}) => {
+  if (error) {
+    if (shouldLogDev()) {
+      getLogger().error(`api: error in ${resolvedName}`, error, { route: resolvedName });
+    }
+    return { ...normalizeErrorResponse({
+      response: { status: "error", errorCode: "api.internalServerError" },
+      preferredLocale,
+      userLanguage: user?.language,
+      fallbackHttpStatus: 500
+    }) };
+  }
+  if (result === void 0 || result === null) {
+    if (shouldLogDev()) {
+      getLogger().warn(`api: ${resolvedName} returned nothing`);
+    }
+    return { ...normalizeErrorResponse({
+      response: { status: "error", errorCode: "api.emptyResponse" },
+      preferredLocale,
+      userLanguage: user?.language,
+      fallbackHttpStatus: 500
+    }) };
+  }
+  if (shouldLogDev()) {
+    getLogger().debug(`api: ${resolvedName} completed`);
+  }
+  if (result.status !== "success" && result.status !== "error") {
+    return { ...normalizeErrorResponse({
+      response: { status: "error", errorCode: "api.invalidResponseStatus" },
+      preferredLocale,
+      userLanguage: user?.language,
+      fallbackHttpStatus: 500
+    }) };
+  }
+  if (result.status === "error") {
+    return { ...normalizeErrorResponse({
+      response: result,
+      preferredLocale,
+      userLanguage: user?.language,
+      fallbackHttpStatus: defaultHttpStatusForResponse({
+        status: "error",
+        explicitHttpStatus: typeof result.httpStatus === "number" ? result.httpStatus : void 0
+      })
+    }) };
+  }
+  return {
+    ...result,
+    status: "success",
+    httpStatus: defaultHttpStatusForResponse({
+      status: "success",
+      explicitHttpStatus: typeof result.httpStatus === "number" ? result.httpStatus : void 0
+    })
+  };
+};
+var emitApiResult = async ({
+  socket,
+  responseIndex,
+  resolvedName,
+  error,
+  result,
+  preferredLocale,
+  user,
+  perRouteFormatter
+}) => {
+  const envelope = buildApiResponseEnvelope({ resolvedName, error, result, preferredLocale, user });
+  const preRespond = { routeName: resolvedName, user, response: envelope };
+  const preRespondResult = await dispatchHook("preApiRespond", preRespond);
+  const finalResponse = preRespondResult.stopped ? { ...normalizeErrorResponse({
+    response: { status: "error", errorCode: preRespondResult.signal.errorCode },
+    preferredLocale,
+    userLanguage: user?.language,
+    fallbackHttpStatus: preRespondResult.signal.httpStatus ?? 403
+  }) } : preRespond.response;
+  const transformPayload = { routeName: resolvedName, user, response: finalResponse };
+  await dispatchHook("transformApiResponse", transformPayload);
+  const formattedResponse = applyErrorFormatter({
+    response: transformPayload.response,
+    routeName: resolvedName,
+    transport: "socket",
+    userId: user?.id,
+    perRouteFormatter
+  });
+  socket.emit(buildApiResponseEventName(responseIndex), formattedResponse);
+  await dispatchHook("postApiRespond", { routeName: resolvedName, user, response: formattedResponse });
+};
+async function handleApiRequest({ msg, socket, token }) {
+  if (typeof msg != "object") {
+    if (shouldLogDev()) {
+      getLogger().warn("api: socket message was not a json object");
+    }
+    return;
+  }
+  const { responseIndex } = msg;
+  const user = await getSession(token);
+  const preferredLocale = extractLanguageFromHeader(socket.handshake.headers["x-language"]) || extractLanguageFromHeader(socket.handshake.headers["accept-language"]) || void 0;
+  let currentRouteName;
+  let currentPerRouteFormatter;
+  const emitApiError = ({ response, fallbackHttpStatus }) => {
+    const normalized = normalizeErrorResponse({
+      response,
+      preferredLocale,
+      userLanguage: user?.language,
+      fallbackHttpStatus
+    });
+    const formatted = applyErrorFormatter({
+      response: normalized,
+      routeName: currentRouteName ?? "api/unknown",
+      transport: "socket",
+      userId: user?.id,
+      perRouteFormatter: currentPerRouteFormatter
+    });
+    socket.emit(buildApiResponseEventName(responseIndex), formatted);
+  };
+  const validated = validateApiMessage({ msg, emitApiError });
+  if (!validated) return;
+  const { name, data: normalizedData } = validated;
+  const parsedRoute = parseTransportRouteName({ value: name, prefix: "api" });
+  if (parsedRoute.status === "error") {
+    return emitApiError({
+      response: {
+        status: "error",
+        errorCode: "routing.invalidServiceRouteName",
+        errorParams: [{ key: "name", value: name }]
+      },
+      fallbackHttpStatus: 400
+    });
+  }
+  const resolvedName = parsedRoute.normalizedFullName;
+  currentRouteName = resolvedName;
+  if (parsedRoute.serviceRoute.normalizedRouteName === "system/logout") {
+    await logout({ token, socket, userId: user?.id || null });
+    return socket.emit(buildApiResponseEventName(responseIndex), {
+      status: "success",
+      httpStatus: 200,
+      result: true
+    });
+  }
+  if (shouldLogDev()) {
+    getLogger().debug(`api: ${resolvedName} called`);
+  }
+  const { apisObject, functionsObject } = await getRuntimeApiMaps();
+  if (!apisObject[resolvedName]) {
+    return emitApiError({
+      response: {
+        status: "error",
+        errorCode: "api.notFound",
+        errorParams: [{ key: "name", value: name }]
+      },
+      fallbackHttpStatus: 404
+    });
+  }
+  const apiEntry = apisObject[resolvedName];
+  currentPerRouteFormatter = apiEntry.errorFormatter;
+  const abortController = new AbortController();
+  const abortKey = registerApiAbortController(socket.id, responseIndex, abortController);
+  const onSocketDisconnect = () => {
+    abortController.abort();
+  };
+  socket.once(socketEventNames.disconnect, onSocketDisconnect);
+  let cleanupDone = false;
+  const cleanupRequest = () => {
+    if (cleanupDone) return;
+    cleanupDone = true;
+    socket.off(socketEventNames.disconnect, onSocketDisconnect);
+    unregisterApiAbortController(abortKey);
+  };
+  const emitStream = (payload = {}) => {
+    if (abortController.signal.aborted) {
+      if (shouldLogStream()) {
+        getLogger().debug(`api: ${resolvedName} stream skipped \u2014 request aborted`);
+      }
+      return;
+    }
+    if (shouldLogStream()) {
+      getLogger().debug(`api: ${resolvedName} stream`, { payload });
+    }
+    socket.emit(buildApiStreamEventName(responseIndex), payload);
+  };
+  const apiFlushPressure = async ({ thresholdBytes } = {}) => {
+    if (abortController.signal.aborted) return;
+    const effectiveThresholdBytes = typeof thresholdBytes === "number" && thresholdBytes > 0 ? thresholdBytes : 1048576;
+    const packetThreshold = Math.max(1, Math.ceil(effectiveThresholdBytes / 1024));
+    while (true) {
+      if (abortController.signal.aborted) return;
+      const conn = socket.conn;
+      const packets = conn?.writeBuffer?.length ?? 0;
+      const writable = conn?.transport?.writable ?? true;
+      if (!writable) return;
+      if (packets < packetThreshold) return;
+      await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+  };
+  if (!checkApiAuth({ apiEntry, user, name, emitApiError })) {
+    cleanupRequest();
+    return;
+  }
+  const rateLimitOk = await applyApiRateLimits({ apiEntry, resolvedName, token, socket, user, emitApiError });
+  if (!rateLimitOk) {
+    cleanupRequest();
+    return;
+  }
+  const validationMode = (() => {
+    const v = apiEntry.validation;
+    if (!v) return "strict";
+    if (typeof v === "string") return v;
+    return v.input === "skip" ? "relaxed" : "strict";
+  })();
+  if (validationMode === "strict") {
+    warnIfInputTypeMissing(resolvedName, apiEntry.inputType);
+  }
+  await dispatchHook("preApiValidate", { routeName: resolvedName, data: normalizedData, user, transport: "socket" });
+  if (validationMode === "strict") {
+    const inputValidation = await validateInputByType({
+      typeText: apiEntry.inputType,
+      value: normalizedData,
+      rootKey: "data",
+      filePath: apiEntry.inputTypeFilePath
+    });
+    await dispatchHook("postApiValidate", {
+      routeName: resolvedName,
+      data: normalizedData,
+      user,
+      validation: inputValidation,
+      transport: "socket"
+    });
+    if (inputValidation.status === "error") {
+      cleanupRequest();
+      return emitApiError({
+        response: {
+          status: "error",
+          errorCode: "api.invalidInputType",
+          errorParams: [{ key: "message", value: inputValidation.message }]
+        },
+        fallbackHttpStatus: 400
+      });
+    }
+  } else {
+    await dispatchHook("postApiValidate", {
+      routeName: resolvedName,
+      data: normalizedData,
+      user,
+      validation: { status: "success" },
+      transport: "socket"
+    });
+  }
+  const executePayload = {
+    routeName: resolvedName,
+    data: normalizedData,
+    user,
+    transport: "socket",
+    result: void 0,
+    error: null,
+    durationMs: 0
+  };
+  const preExecuteResult = await dispatchHook("preApiExecute", executePayload);
+  if (preExecuteResult.stopped) {
+    cleanupRequest();
+    return emitApiError({
+      response: { status: "error", errorCode: preExecuteResult.signal.errorCode },
+      fallbackHttpStatus: preExecuteResult.signal.httpStatus ?? 403
+    });
+  }
+  const { error, result, durationMs } = await executeApiHandler({
+    apiEntry,
+    normalizedData,
+    user,
+    functionsObject,
+    resolvedName,
+    emitStream,
+    abortSignal: abortController.signal,
+    flushPressure: apiFlushPressure
+  });
+  executePayload.result = result;
+  executePayload.error = error ?? null;
+  executePayload.durationMs = durationMs;
+  await dispatchHook("postApiExecute", executePayload);
+  await emitApiResult({ socket, responseIndex, resolvedName, error, result, preferredLocale, user, perRouteFormatter: apiEntry.errorFormatter });
+  cleanupRequest();
+}
+
+// src/handleHttpApiRequest.ts
+import { getSession as getSession2 } from "@luckystack/login";
+import {
+  getProjectConfig as getProjectConfig2,
+  getRuntimeApiMaps as getRuntimeApiMapsFromSource,
+  validateRequest as validateRequest2,
+  checkRateLimit as checkRateLimit2,
+  inferHttpMethod,
+  tryCatch as tryCatch2,
+  parseTransportRouteName as parseTransportRouteName2,
+  validateInputByType as validateInputByType2,
+  dispatchHook as dispatchHook2,
+  getLogger as getLogger2,
+  defaultHttpStatusForResponse as defaultHttpStatusForResponse2,
+  extractLanguageFromHeader as extractLanguageFromHeader2,
+  normalizeErrorResponse as normalizeErrorResponse2,
+  applyErrorFormatter as applyErrorFormatter2
+} from "@luckystack/core";
+var httpApiFlushPressureNoop = async () => {
+};
+var isRuntimeApiResult = (value) => {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const status = value.status;
+  return status === "success" || status === "error";
+};
+var shouldLogDev2 = () => getProjectConfig2().logging.devLogs;
+var shouldLogStream2 = () => getProjectConfig2().logging.stream;
+var warnedMissingInputType2 = /* @__PURE__ */ new Set();
+var warnIfInputTypeMissing2 = (resolvedName, inputType) => {
+  if (!getProjectConfig2().dev.warnOnMissingInputType) return;
+  if (inputType && inputType.trim().length > 0 && inputType.trim() !== "any") return;
+  if (warnedMissingInputType2.has(resolvedName)) return;
+  warnedMissingInputType2.add(resolvedName);
+  getLogger2().warn(`http-api: route ${resolvedName} has no inputType \u2014 runtime input validation is disabled.`);
+};
+async function handleHttpApiRequest(params) {
+  const { response, user, preferredLocale, perRouteFormatter } = await runHandleHttpApiRequest(params);
+  const routeNameForHook = params.name.startsWith("api/") ? params.name : `api/${params.name}`;
+  const preRespond = { routeName: routeNameForHook, user, response };
+  const preRespondResult = await dispatchHook2("preApiRespond", preRespond);
+  const finalResponse = preRespondResult.stopped ? normalizeErrorResponse2({
+    response: { status: "error", errorCode: preRespondResult.signal.errorCode },
+    preferredLocale,
+    userLanguage: user?.language,
+    fallbackHttpStatus: preRespondResult.signal.httpStatus ?? 403
+  }) : preRespond.response;
+  const formatterInput = finalResponse;
+  const formattedResponse = applyErrorFormatter2({
+    response: formatterInput,
+    routeName: routeNameForHook,
+    transport: "http",
+    userId: user?.id,
+    perRouteFormatter
+  });
+  await dispatchHook2("postApiRespond", { routeName: routeNameForHook, user, response: formattedResponse });
+  return formattedResponse;
+}
+async function runHandleHttpApiRequest(params) {
+  const preferredLocale = extractLanguageFromHeader2(params.xLanguageHeader) ?? extractLanguageFromHeader2(params.acceptLanguageHeader);
+  const user = await getSession2(params.token);
+  const formatterHolder = {};
+  const response = await runHandleHttpApiRequestInner(params, user, preferredLocale, formatterHolder);
+  return { response, user, preferredLocale, perRouteFormatter: formatterHolder.current };
+}
+async function runHandleHttpApiRequestInner({
+  name,
+  data,
+  token,
+  requesterIp,
+  xLanguageHeader: _xLanguageHeader,
+  acceptLanguageHeader: _acceptLanguageHeader,
+  method = "POST",
+  stream,
+  abortSignal
+}, user, preferredLocale, formatterHolder) {
+  const effectiveAbortSignal = abortSignal ?? new AbortController().signal;
+  const flushPressure = httpApiFlushPressureNoop;
+  const normalizedName = name.startsWith("api/") ? name : `api/${name}`;
+  const buildNetworkError = ({
+    response,
+    fallbackHttpStatus
+  }) => {
+    return normalizeErrorResponse2({
+      response,
+      preferredLocale,
+      userLanguage: user?.language,
+      fallbackHttpStatus
+    });
+  };
+  if (!name || typeof name !== "string") {
+    return buildNetworkError({
+      response: { status: "error", errorCode: "api.invalidName" },
+      fallbackHttpStatus: 400
+    });
+  }
+  if (typeof data !== "object" || data === null) {
+    return buildNetworkError({
+      response: { status: "error", errorCode: "api.invalidDataObject" },
+      fallbackHttpStatus: 400
+    });
+  }
+  const requestData = data ?? {};
+  const parsedRoute = parseTransportRouteName2({ value: normalizedName, prefix: "api" });
+  if (parsedRoute.status === "error") {
+    return buildNetworkError({
+      response: {
+        status: "error",
+        errorCode: "routing.invalidServiceRouteName",
+        errorParams: [{ key: "name", value: normalizedName }]
+      },
+      fallbackHttpStatus: 400
+    });
+  }
+  const resolvedName = parsedRoute.normalizedFullName;
+  if (shouldLogDev2()) {
+    getLogger2().debug(`http api: ${resolvedName} called`);
+  }
+  const { apisObject, functionsObject } = await getRuntimeApiMapsFromSource();
+  if (!apisObject[resolvedName]) {
+    return buildNetworkError({
+      response: {
+        status: "error",
+        errorCode: "api.notFound",
+        errorParams: [{ key: "name", value: resolvedName }]
+      },
+      fallbackHttpStatus: 404
+    });
+  }
+  const runtimeApiRoute = apisObject[resolvedName];
+  formatterHolder.current = runtimeApiRoute.errorFormatter;
+  const { auth, main, httpMethod: declaredMethod } = runtimeApiRoute;
+  const inputType = runtimeApiRoute.inputType;
+  const inputTypeFilePath = runtimeApiRoute.inputTypeFilePath;
+  if (auth.login && !user?.id) {
+    if (shouldLogDev2()) {
+      getLogger2().warn(`http-api: ${name} requires login`, { route: name, transport: "http" });
+    }
+    return buildNetworkError({
+      response: { status: "error", errorCode: "auth.required" },
+      fallbackHttpStatus: 401
+    });
+  }
+  const authResult = validateRequest2({ auth, user });
+  if (authResult.status === "error") {
+    if (shouldLogDev2()) {
+      getLogger2().warn(`http-api: auth failed for ${name}`, { route: name, errorCode: authResult.errorCode, transport: "http" });
+    }
+    return buildNetworkError({
+      response: {
+        status: "error",
+        errorCode: authResult.errorCode ?? "auth.forbidden",
+        errorParams: authResult.errorParams,
+        httpStatus: authResult.httpStatus
+      },
+      fallbackHttpStatus: authResult.httpStatus ?? 403
+    });
+  }
+  const apiRateLimit = runtimeApiRoute.rateLimit;
+  const effectiveApiLimit = apiRateLimit === void 0 ? getProjectConfig2().rateLimiting.defaultApiLimit : apiRateLimit;
+  if (effectiveApiLimit !== false && effectiveApiLimit > 0) {
+    const requesterIdentity = token ?? requesterIp ?? "anonymous";
+    const keyPrefix = token ? "token" : "ip";
+    const rateLimitKey = `${keyPrefix}:${requesterIdentity}:api:${resolvedName}`;
+    const { allowed, resetIn } = await checkRateLimit2({
+      key: rateLimitKey,
+      limit: effectiveApiLimit,
+      windowMs: getProjectConfig2().rateLimiting.windowMs
+    });
+    if (!allowed) {
+      void dispatchHook2("rateLimitExceeded", {
+        scope: token ? "user" : "route",
+        key: rateLimitKey,
+        limit: effectiveApiLimit,
+        windowMs: getProjectConfig2().rateLimiting.windowMs,
+        count: effectiveApiLimit + 1,
+        route: resolvedName,
+        userId: user?.id
+      });
+      if (shouldLogDev2()) {
+        getLogger2().warn(`http api: rate limit exceeded for ${resolvedName}`);
+      }
+      return buildNetworkError({
+        response: {
+          status: "error",
+          errorCode: "api.rateLimitExceeded",
+          errorParams: [{ key: "seconds", value: resetIn }]
+        },
+        fallbackHttpStatus: 429
+      });
+    }
+  }
+  const defaultIpLimit = getProjectConfig2().rateLimiting.defaultIpLimit;
+  const requesterIsLoopback = process.env.NODE_ENV !== "production" && (requesterIp === "127.0.0.1" || requesterIp === "::1" || requesterIp === "::ffff:127.0.0.1" || typeof requesterIp === "string" && requesterIp.startsWith("127."));
+  if (!requesterIsLoopback && defaultIpLimit !== false && defaultIpLimit > 0) {
+    const ipBucket = requesterIp ?? "unknown";
+    const { allowed, resetIn } = await checkRateLimit2({
+      key: `ip:${ipBucket}:api:all`,
+      limit: defaultIpLimit,
+      windowMs: getProjectConfig2().rateLimiting.windowMs
+    });
+    if (!allowed) {
+      void dispatchHook2("rateLimitExceeded", {
+        scope: "ip",
+        key: `ip:${ipBucket}:api:all`,
+        limit: defaultIpLimit,
+        windowMs: getProjectConfig2().rateLimiting.windowMs,
+        count: defaultIpLimit + 1,
+        ip: ipBucket
+      });
+      if (shouldLogDev2()) {
+        getLogger2().warn(`http api: global IP rate limit exceeded`, { ip: ipBucket });
+      }
+      return buildNetworkError({
+        response: {
+          status: "error",
+          errorCode: "api.rateLimitExceeded",
+          errorParams: [{ key: "seconds", value: resetIn }]
+        },
+        fallbackHttpStatus: 429
+      });
+    }
+  }
+  const expectedMethod = declaredMethod ?? inferHttpMethod(resolvedName);
+  if (method !== expectedMethod) {
+    if (shouldLogDev2()) {
+      getLogger2().warn(`http api: method mismatch for ${resolvedName}`, { expected: expectedMethod, got: method });
+    }
+    return buildNetworkError({
+      response: {
+        status: "error",
+        errorCode: "api.methodNotAllowed",
+        errorParams: [{ key: "method", value: expectedMethod }]
+      },
+      fallbackHttpStatus: 405
+    });
+  }
+  warnIfInputTypeMissing2(resolvedName, inputType);
+  await dispatchHook2("preApiValidate", { routeName: resolvedName, data: requestData, user, transport: "http" });
+  const inputValidation = await validateInputByType2({
+    typeText: inputType,
+    value: requestData,
+    rootKey: "data",
+    filePath: inputTypeFilePath
+  });
+  await dispatchHook2("postApiValidate", {
+    routeName: resolvedName,
+    data: requestData,
+    user,
+    validation: inputValidation,
+    transport: "http"
+  });
+  if (inputValidation.status === "error") {
+    return buildNetworkError({
+      response: {
+        status: "error",
+        errorCode: "api.invalidInputType",
+        errorParams: [{ key: "message", value: inputValidation.message }]
+      },
+      fallbackHttpStatus: 400
+    });
+  }
+  const emitApiStream = (payload = {}) => {
+    if (!stream) {
+      return;
+    }
+    if (effectiveAbortSignal.aborted) {
+      if (shouldLogStream2()) {
+        getLogger2().debug(`http api: ${resolvedName} stream skipped \u2014 request aborted`);
+      }
+      return;
+    }
+    if (shouldLogStream2()) {
+      getLogger2().debug(`http api: ${resolvedName} stream`, { payload });
+    }
+    stream(payload);
+  };
+  const executePayload = {
+    routeName: resolvedName,
+    data: requestData,
+    user,
+    transport: "http",
+    result: void 0,
+    error: null,
+    durationMs: 0
+  };
+  const preExecuteResult = await dispatchHook2("preApiExecute", executePayload);
+  if (preExecuteResult.stopped) {
+    return buildNetworkError({
+      response: { status: "error", errorCode: preExecuteResult.signal.errorCode },
+      fallbackHttpStatus: preExecuteResult.signal.httpStatus ?? 403
+    });
+  }
+  const executeStart = Date.now();
+  const [error, result] = await tryCatch2(
+    async () => await main({
+      data: requestData,
+      user,
+      functions: functionsObject,
+      stream: emitApiStream,
+      abortSignal: effectiveAbortSignal,
+      flushPressure
+    }),
+    void 0,
+    {
+      handler: "handleHttpApiRequest",
+      api: resolvedName,
+      userId: user?.id,
+      transport: "http"
+    }
+  );
+  executePayload.result = result;
+  executePayload.error = error ?? null;
+  executePayload.durationMs = Date.now() - executeStart;
+  await dispatchHook2("postApiExecute", executePayload);
+  if (error) {
+    if (shouldLogDev2()) {
+      getLogger2().error(`http-api: error in ${resolvedName}`, error, { route: resolvedName, transport: "http" });
+    }
+    return buildNetworkError({
+      response: { status: "error", errorCode: "api.internalServerError" },
+      fallbackHttpStatus: 500
+    });
+  }
+  if (result !== void 0 && result !== null) {
+    if (shouldLogDev2()) {
+      getLogger2().debug(`http api: ${resolvedName} completed`);
+    }
+    if (isRuntimeApiResult(result)) {
+      if (result.status === "error") {
+        return buildNetworkError({
+          response: result,
+          fallbackHttpStatus: defaultHttpStatusForResponse2({
+            status: "error",
+            explicitHttpStatus: typeof result.httpStatus === "number" ? result.httpStatus : void 0
+          })
+        });
+      }
+      const successEnvelope = {
+        ...result,
+        status: "success",
+        httpStatus: defaultHttpStatusForResponse2({
+          status: "success",
+          explicitHttpStatus: typeof result.httpStatus === "number" ? result.httpStatus : void 0
+        })
+      };
+      return successEnvelope;
+    }
+    return buildNetworkError({
+      response: { status: "error", errorCode: "api.invalidResponseStatus" },
+      fallbackHttpStatus: 500
+    });
+  }
+  if (shouldLogDev2()) {
+    getLogger2().warn(`http api: ${resolvedName} returned nothing`);
+  }
+  return buildNetworkError({
+    response: { status: "error", errorCode: "api.emptyResponse" },
+    fallbackHttpStatus: 500
+  });
+}
+export {
+  handleApiRequest,
+  handleHttpApiRequest
+};
+//# sourceMappingURL=index.js.map