@openlup/platform 0.0.0 → 0.16.0

package/dist/data/queryBuilderSql.js

@@ -0,0 +1,145 @@
+// Vanilla-Postgres query-builder SQL primitives.
+//
+// Extracted from queryBuilder.ts (300-LOC cap) — the pure, stateless SQL-fragment layer the builder
+// composes: result/error shapes, the injection-safety chokepoint (ParamAccumulator), identifier
+// quoting (allowlist), column projection, and filter rendering. VALUES ARE NEVER string-interpolated;
+// they flow through ParamAccumulator as $N placeholders. Identifiers (table/column names) are validated
+// against a strict allowlist regex and double-quoted, so they cannot smuggle SQL either.
+// Identifiers (table + column names) are NEVER parameterizable in SQL, so they are validated against
+// a strict allowlist and quoted. Consumers only ever pass static, code-literal identifiers; this
+// guard turns any attempt to pass a crafted identifier into a thrown error rather than injected SQL.
+const IDENTIFIER_RE = /^[a-z_][a-z0-9_]*$/i;
+export function quoteIdent(raw) {
+    if (!IDENTIFIER_RE.test(raw)) {
+        throw new Error(`pg-shim: unsafe identifier ${JSON.stringify(raw)}`);
+    }
+    return `"${raw}"`;
+}
+// `select("a, b")` etc. — a comma list of identifiers or "*". Each segment is validated; "*" passes
+// through. PostgREST embedding syntax (foo(bar)) is NOT used by any consumer, so it is rejected
+// (fail-closed) rather than silently mistranslated.
+export function renderColumns(columns) {
+    const trimmed = columns.trim();
+    if (trimmed === "" || trimmed === "*")
+        return "*";
+    return trimmed
+        .split(",")
+        .map((c) => c.trim())
+        .map((c) => (c === "*" ? "*" : quoteIdent(c)))
+        .join(", ");
+}
+export function renderFilter(filter, params) {
+    const col = quoteIdent(filter.column);
+    switch (filter.kind) {
+        case "eq":
+            return `${col} = ${params.add(filter.value)}`;
+        case "gt":
+            return `${col} > ${params.add(filter.value)}`;
+        case "gte":
+            return `${col} >= ${params.add(filter.value)}`;
+        case "lte":
+            return `${col} <= ${params.add(filter.value)}`;
+        case "ilike":
+            return `${col} ILIKE ${params.add(filter.value)}`;
+        case "in": {
+            // Empty IN () is invalid SQL; PostgREST treats `.in([])` as matching nothing.
+            if (filter.values.length === 0)
+                return "false";
+            const placeholders = filter.values.map((v) => params.add(v)).join(", ");
+            return `${col} IN (${placeholders})`;
+        }
+        case "is":
+            // .is(col, null) → IS NULL; .is(col, true/false) → IS TRUE/FALSE. Value is a literal keyword,
+            // not user data (consumers only pass null/true/false), so it is rendered, not parameterized.
+            if (filter.value === null)
+                return `${col} IS NULL`;
+            if (filter.value === true)
+                return `${col} IS TRUE`;
+            if (filter.value === false)
+                return `${col} IS FALSE`;
+            throw new Error("pg-shim: .is() only supports null/true/false");
+    }
+}
+/**
+ * PostgREST `count=exact` rendered as a SEPARATE aggregate over the same FROM/WHERE — deliberately
+ * NOT a `COUNT(*) OVER()` folded into the row query. PostgREST's exact count ignores limit/offset,
+ * and a window function emits no row at all for an empty page, so an offset past the end would
+ * report 0 instead of the true total. Keeping it separate also leaves the row projection
+ * byte-identical: there is no synthetic column to strip before cardinality shaping.
+ */
+export function renderCountQuery(table, filters, params) {
+    const where = filters.length === 0
+        ? ""
+        : `WHERE ${filters.map((filter) => renderFilter(filter, params)).join(" AND ")}`;
+    return joinParts([`SELECT count(*) AS exact_count FROM ${quoteIdent(table)}`, where]);
+}
+/**
+ * PostgREST refuses an out-of-bounds page instead of answering an empty one -- but ONLY when it
+ * knows the total, i.e. when an exact count was requested; without one it answers 200 and `[]`,
+ * which is what this shim already did. The boundary is strict: offset === total is a legal empty
+ * page, offset === total + 1 is not. Measured against PostgREST 14.10 before this was written,
+ * including the `details` sentence, which carries the two numbers a caller pages on.
+ */
+export function rangeNotSatisfiable(offset, total) {
+    if (offset === null || total === null || offset <= total)
+        return null;
+    return {
+        code: "PGRST103",
+        message: "Requested range not satisfiable",
+        details: `An offset of ${offset} was requested, but there are only ${total} rows.`,
+    };
+}
+/**
+ * INSERT ... VALUES ... RETURNING, with the column list taken from the FIRST row and every later
+ * row required to carry the same key set. Deriving the columns from row 0 alone and binding the
+ * rest positionally is how a batch used to lose a column silently: an extra key vanished, a missing
+ * one bound NULL over a DEFAULT. PostgREST answers PGRST102 "All object keys must match" to exactly
+ * this payload -- and keeps answering it under `Prefer: missing=default`, measured -- so the shim
+ * refuses too. Refusal, not union: parity is the point, and this builder exposes no Prefer header
+ * through which a caller could ask for anything else.
+ */
+export function renderInsertStatement(table, rows, projection, params) {
+    if (rows.length === 0)
+        throw new Error("pg-shim: insert requires at least one row");
+    const columns = Object.keys(rows[0]);
+    const signature = [...columns].sort().join("\u0000");
+    for (const row of rows) {
+        if ([...Object.keys(row)].sort().join("\u0000") !== signature) {
+            throw Object.assign(new Error("All object keys must match"), { code: "PGRST102" });
+        }
+    }
+    const tuples = rows.map((row) => `(${columns.map((column) => params.add(row[column])).join(", ")})`).join(", ");
+    return `INSERT INTO ${quoteIdent(table)} (${columns.map(quoteIdent).join(", ")}) VALUES ${tuples} `
+        + `RETURNING ${renderColumns(projection)}`;
+}
+// supabase-js rpc() returns the function's return value directly: a scalar/json function yields that
+// value; a TABLE/SETOF function yields the row array. Heuristic mirrors that: 1 row × 1 column whose
+// name equals the function → the scalar; otherwise the rows array (TABLE-returning).
+export function unwrapRpcRows(rows, functionName) {
+    if (rows.length === 1) {
+        const keys = Object.keys(rows[0]);
+        if (keys.length === 1 && keys[0] === functionName)
+            return rows[0][functionName];
+    }
+    return rows;
+}
+/** Accumulates values and hands back $1,$2,… placeholders — the single injection-safety chokepoint. */
+export class ParamAccumulator {
+    values = [];
+    add(value) {
+        this.values.push(value);
+        return `$${this.values.length}`;
+    }
+}
+export function joinParts(parts) {
+    return parts.filter((p) => p.trim() !== "").join(" ");
+}
+export function toShimError(error) {
+    const e = error;
+    return {
+        code: e?.code,
+        message: e?.message ?? "query failed",
+        details: e?.detail,
+        hint: e?.hint,
+    };
+}

package/dist/data/supabaseClientFactory.d.ts

@@ -0,0 +1,34 @@
+/** Structural shape of the supabase-js `createClient` we depend on (injection seam for tests). */
+export type SupabaseCreateClient = (url: string, key: string, options?: {
+    auth?: {
+        persistSession?: boolean;
+        autoRefreshToken?: boolean;
+    };
+    global?: {
+        headers?: Record<string, string>;
+    };
+}) => unknown;
+export interface SupabaseDataGatewayEnv {
+    /** Project URL (SUPABASE_URL / VITE_SUPABASE_URL). */
+    url: string;
+    /** Anon/publishable key — used for actor (RLS-bound) clients. */
+    anonKey: string;
+    /** Service-role key — used for elevated (RLS-bypassing) clients. */
+    serviceRoleKey: string;
+}
+/** Read the gateway env using the same precedence the inline sites use today. */
+export declare function readSupabaseDataGatewayEnv(env: Record<string, string | undefined>): SupabaseDataGatewayEnv | null;
+/** Read env for actor-only gateway consumers. Does not require the elevated service-role key. */
+export declare function readSupabaseActorDataGatewayEnv(env: Record<string, string | undefined>): SupabaseDataGatewayEnv | null;
+/**
+ * Build an elevated (service-role) supabase client — byte-identical to the inline
+ * `createClient(env.url, env.serviceRoleKey, { auth: { persistSession: false, autoRefreshToken: false } })`
+ * shape the BFF handlers use today.
+ */
+export declare function createServiceClient(env: SupabaseDataGatewayEnv, factory: SupabaseCreateClient): unknown;
+/**
+ * Build an actor (RLS-bound) supabase client — anon key + the actor's Bearer access token, matching
+ * the inline `createAdminAuthClient` / `createCustomerClient` shape. When no token is supplied the
+ * global Authorization header is omitted (identical to the inline `accessToken ? {...} : {}`).
+ */
+export declare function createActorClient(env: SupabaseDataGatewayEnv, accessToken: string | null, factory: SupabaseCreateClient): unknown;

package/dist/data/supabaseClientFactory.js

@@ -0,0 +1,56 @@
+// Supabase client factory for the DataGatewayPort.
+//
+// ONE canonical definition of the two supabase-js client shapes BFF handlers need:
+//   - SERVICE-ROLE client (elevated, RLS-bypassing) — `createClient(url, serviceRoleKey, {auth:{...}})`
+//   - ACTOR client (RLS-bound via a Bearer access token)  — anon key + `Authorization: Bearer <jwt>`
+// Both use one exact option shape
+// (`auth: { persistSession: false, autoRefreshToken: false }`, plus the actor's global Authorization
+// header). The supabase-js `createClient`
+// is always supplied by the application's composition root, so this package carries no SDK import
+// and the adapter stays unit-testable without network.
+/** Read the gateway env using the same precedence the inline sites use today. */
+export function readSupabaseDataGatewayEnv(env) {
+    const url = env.SUPABASE_URL ?? env.VITE_SUPABASE_URL;
+    const anonKey = env.VITE_SUPABASE_PUBLISHABLE_KEY ??
+        env.VITE_SUPABASE_ANON_KEY ??
+        env.SUPABASE_ANON_KEY;
+    const serviceRoleKey = env.SUPABASE_SERVICE_ROLE_KEY;
+    // anonKey is only needed for actor clients; service-role work needs only url + serviceRoleKey.
+    // We require url + serviceRoleKey (the elevated path the default bundle uses); anonKey may be
+    // empty for service-only deployments and is validated lazily when an actor client is requested.
+    return url && serviceRoleKey ? { url, anonKey: anonKey ?? "", serviceRoleKey } : null;
+}
+/** Read env for actor-only gateway consumers. Does not require the elevated service-role key. */
+export function readSupabaseActorDataGatewayEnv(env) {
+    const url = env.SUPABASE_URL ?? env.VITE_SUPABASE_URL;
+    const anonKey = env.VITE_SUPABASE_PUBLISHABLE_KEY ??
+        env.VITE_SUPABASE_ANON_KEY ??
+        env.SUPABASE_ANON_KEY;
+    return url && anonKey ? { url, anonKey, serviceRoleKey: env.SUPABASE_SERVICE_ROLE_KEY ?? "" } : null;
+}
+/**
+ * Build an elevated (service-role) supabase client — byte-identical to the inline
+ * `createClient(env.url, env.serviceRoleKey, { auth: { persistSession: false, autoRefreshToken: false } })`
+ * shape the BFF handlers use today.
+ */
+export function createServiceClient(env, factory) {
+    return factory(env.url, env.serviceRoleKey, {
+        auth: { persistSession: false, autoRefreshToken: false },
+    });
+}
+/**
+ * Build an actor (RLS-bound) supabase client — anon key + the actor's Bearer access token, matching
+ * the inline `createAdminAuthClient` / `createCustomerClient` shape. When no token is supplied the
+ * global Authorization header is omitted (identical to the inline `accessToken ? {...} : {}`).
+ */
+export function createActorClient(env, accessToken, factory) {
+    if (!env.anonKey) {
+        throw new Error("supabase_data_gateway_actor_requires_anon_key");
+    }
+    return factory(env.url, env.anonKey, {
+        auth: { persistSession: false, autoRefreshToken: false },
+        global: {
+            headers: accessToken ? { Authorization: `Bearer ${accessToken}` } : {},
+        },
+    });
+}

package/dist/data/supabaseGateway.d.ts

@@ -0,0 +1,22 @@
+import type { DataGatewayPort } from "@openlup/core/platform-runtime";
+import { type SupabaseCreateClient, type SupabaseDataGatewayEnv } from "./supabaseClientFactory.js";
+type ActorClaims = {
+    sub?: string;
+    role?: string;
+} | null;
+export interface SupabaseDataGatewayOptions {
+    /** The supabase-js `createClient` (tests pass a stub). */
+    createClientImpl: SupabaseCreateClient;
+    /**
+     * Resolve an actor's Bearer access token from their claims. The port contract carries only
+     * `{ sub, role }`, but RLS needs the raw JWT; call sites that have the request token bind it here.
+     * Returns null → anon (RLS-bound but unauthenticated) client.
+     */
+    resolveAccessToken?: (claims: ActorClaims) => string | null;
+}
+/**
+ * Build a supabase-backed DataGatewayPort from resolved env. Pure: no client is created until a
+ * port method runs work (matches the per-request creation the inline sites do today).
+ */
+export declare function createSupabaseDataGateway(env: SupabaseDataGatewayEnv, options: SupabaseDataGatewayOptions): DataGatewayPort;
+export {};

package/dist/data/supabaseGateway.js

@@ -0,0 +1,49 @@
+// Supabase adapter for the platform-runtime DataGatewayPort.
+//
+// Centralizes the two persistence access modes the BFF handlers build inline today:
+//   - asService(work): elevated, RLS-bypassing — a service-role client (the default bundle's path).
+//   - asActor(claims, work): RLS-bound — an anon client carrying the actor's Bearer access token, so
+//     RLS evaluates the request as that principal (UUID-keep: claims.sub IS the supabase auth uuid).
+// The work callback receives the concrete supabase client (typed `unknown` per the port contract;
+// consumers cast to their narrow read/write surface). Behavior is byte-identical to the inline
+// `createClient(...)` sites this replaces — same option shape, same Authorization header — so the
+// default vercel-supabase bundle stays unchanged (golden-master byte-identical).
+//
+// POOLING SEMANTICS (documented, no behavior change):
+//   - Serverless (vercel-supabase): each invocation is short-lived; supabase-js talks to PostgREST
+//     over HTTP (PgBouncer in transaction-mode behind the scenes), so there is no long-lived pool to
+//     manage — a fresh client per asActor/asService call matches the current per-request creation and
+//     is correct for transaction-pooled connections (no session-level state assumed).
+//   - Long-running Node (node-supabase): the same supabase-js HTTP path applies; a direct-PG gateway
+//     (node-postgres) would instead hold a standard `pg.Pool` and run asActor work inside a
+//     `BEGIN; SET LOCAL request.jwt.claims = ...; ... COMMIT` tx-per-request for RLS. That is the
+//     MigrationRunner/postgres band's concern; this supabase adapter stays HTTP-pooled either way.
+//
+// asActor honors the access token supplied via `options.resolveAccessToken(claims)` (defaults to the
+// claims' own bearer if present) so RLS is enforced; when no token resolves it falls back to an anon
+// client (RLS still applies, just unauthenticated) rather than silently elevating — fail-safe.
+import { createActorClient, createServiceClient, } from "./supabaseClientFactory.js";
+/**
+ * Build a supabase-backed DataGatewayPort from resolved env. Pure: no client is created until a
+ * port method runs work (matches the per-request creation the inline sites do today).
+ */
+export function createSupabaseDataGateway(env, options) {
+    const resolveAccessToken = options.resolveAccessToken ?? defaultResolveAccessToken;
+    return {
+        async asService(work) {
+            const client = createServiceClient(env, options.createClientImpl);
+            return work(client);
+        },
+        async asActor(claims, work) {
+            const accessToken = resolveAccessToken(claims);
+            const client = createActorClient(env, accessToken, options.createClientImpl);
+            return work(client);
+        },
+    };
+}
+// Default token resolver: the port's claims shape doesn't carry a raw JWT, so without an injected
+// resolver an actor request maps to an anon (unauthenticated, still RLS-bound) client. Call sites
+// that hold the request bearer inject `resolveAccessToken` to make RLS see the real principal.
+function defaultResolveAccessToken(_claims) {
+    return null;
+}

package/dist/http/deadline.d.ts

@@ -0,0 +1,20 @@
+import type { HttpRequest, HttpResponse } from "./types.js";
+export declare const NODE_HTTP_TIMEOUT_CODE = "NODE_HTTP_TIMEOUT";
+export interface HttpDeadlineOptions {
+    req: HttpRequest;
+    res: HttpResponse;
+    durationMs: number;
+    run: () => Promise<unknown> | unknown;
+    onLateError?: (error: unknown) => void;
+}
+/**
+ * Run one Node HTTP admission from the instant before lazy loading/adaptation.
+ *
+ * A timeout before headers commit gets one minimal JSON 504. After headers are
+ * committed we cannot change the status safely, so the response is destroyed.
+ * The invocation promise remains observed, preventing a late rejection from
+ * becoming an unhandled rejection or a second response.
+ */
+export declare function runWithHttpDeadline(options: HttpDeadlineOptions): Promise<void>;
+/** Send a response before closing its request input, so the status is deliverable. */
+export declare function closeInputAfterResponse(req: HttpRequest, res: HttpResponse): void;

package/dist/http/deadline.js

@@ -0,0 +1,93 @@
+// Bounded request/response lifecycle for the Node HTTP adapter.
+//
+// This owns transport cancellation only. It gives handlers a cooperative
+// AbortSignal, but cannot roll back downstream work that ignores it.
+export const NODE_HTTP_TIMEOUT_CODE = "NODE_HTTP_TIMEOUT";
+/**
+ * Run one Node HTTP admission from the instant before lazy loading/adaptation.
+ *
+ * A timeout before headers commit gets one minimal JSON 504. After headers are
+ * committed we cannot change the status safely, so the response is destroyed.
+ * The invocation promise remains observed, preventing a late rejection from
+ * becoming an unhandled rejection or a second response.
+ */
+export async function runWithHttpDeadline(options) {
+    const { req, res, durationMs, run, onLateError } = options;
+    if (!Number.isSafeInteger(durationMs) || durationMs <= 0 || durationMs > 2_147_483_647) {
+        throw new Error("invalid_node_http_deadline");
+    }
+    const controller = new AbortController();
+    // Node 24 exposes IncomingMessage.signal as a getter without a setter. Keep
+    // that host-native property untouched and use the portable adapter seam.
+    req.abortSignal = controller.signal;
+    const eventedReq = req;
+    const eventedRes = res;
+    const abortForClose = () => controller.abort();
+    eventedReq.once?.("aborted", abortForClose);
+    eventedRes.once?.("close", abortForClose);
+    let expired = false;
+    let finishTimeout;
+    const timeout = new Promise((resolve) => { finishTimeout = resolve; });
+    const timer = setTimeout(() => {
+        expired = true;
+        controller.abort();
+        if (res.destroyed || res.writableEnded) {
+            destroyInput(req);
+            return finishTimeout?.();
+        }
+        if (!res.headersSent && !res.writableEnded) {
+            closeInputAfterResponse(req, res);
+            res.statusCode = 504;
+            res.setHeader("content-type", "application/json; charset=utf-8");
+            res.end(JSON.stringify({ ok: false, error: { code: NODE_HTTP_TIMEOUT_CODE, message: "Request timed out" } }));
+            sealLateWrites(res);
+        }
+        else if (!res.writableEnded) {
+            sealLateWrites(res);
+            res.destroy?.();
+            destroyInput(req);
+        }
+        finishTimeout?.();
+    }, durationMs);
+    const invocation = Promise.resolve().then(run);
+    // Keep a late completion/rejection observed after timeout. It must never get a
+    // chance to write a second envelope, and its raw value is not client output.
+    void invocation.catch((error) => {
+        if (expired)
+            onLateError?.(error);
+    });
+    try {
+        await Promise.race([invocation.then(() => undefined), timeout]);
+    }
+    finally {
+        clearTimeout(timer);
+        eventedReq.removeListener?.("aborted", abortForClose);
+        eventedRes.removeListener?.("close", abortForClose);
+    }
+}
+/** Send a response before closing its request input, so the status is deliverable. */
+export function closeInputAfterResponse(req, res) {
+    const evented = res;
+    let closed = false;
+    const destroy = () => {
+        if (closed)
+            return;
+        closed = true;
+        evented.removeListener?.("finish", destroy);
+        evented.removeListener?.("close", destroy);
+        destroyInput(req);
+    };
+    evented.once?.("finish", destroy);
+    evented.once?.("close", destroy);
+}
+function destroyInput(req) {
+    req.destroy?.();
+}
+/** Refuse late handler writes after a deadline response has committed. */
+function sealLateWrites(res) {
+    const mutable = res;
+    mutable.write = () => false;
+    mutable.writeHead = () => mutable;
+    mutable.end = () => mutable;
+    mutable.setHeader = () => mutable;
+}

package/dist/http/index.d.ts

@@ -0,0 +1,6 @@
+export type { EntrypointLoader, HttpHandler, HttpRequest, HttpResponse } from "./types.js";
+export { DEFAULT_NODE_BUFFERED_BODY_LIMIT_BYTES, NodeRequestAbortedError, NodeRequestBodyTooLargeError, adaptRequest, decorateRequest, decorateResponse, isRawStreamEntrypoint, isWebhookPath, pathnameOf, } from "./requestAdapter.js";
+export { NODE_HTTP_TIMEOUT_CODE, closeInputAfterResponse, runWithHttpDeadline, type HttpDeadlineOptions, } from "./deadline.js";
+export { applySecurityHeaders, contentTypeFor, looksLikeAsset, serveSpaStatic, type NodeSecurityHeaderPolicy, type StaticAssetReader, } from "./security.js";
+export { createDistStaticReader } from "./staticAssets.js";
+export { createNodeHttpRuntime, createRequestHandler, type HttpEntrypointRegistration, type HttpPathEntrypoint, type NodeCsrFallback, type NodeHttpRuntimeOptions, type NodeLegacyRedirect, } from "./runtime.js";

package/dist/http/index.js

@@ -0,0 +1,5 @@
+export { DEFAULT_NODE_BUFFERED_BODY_LIMIT_BYTES, NodeRequestAbortedError, NodeRequestBodyTooLargeError, adaptRequest, decorateRequest, decorateResponse, isRawStreamEntrypoint, isWebhookPath, pathnameOf, } from "./requestAdapter.js";
+export { NODE_HTTP_TIMEOUT_CODE, closeInputAfterResponse, runWithHttpDeadline, } from "./deadline.js";
+export { applySecurityHeaders, contentTypeFor, looksLikeAsset, serveSpaStatic, } from "./security.js";
+export { createDistStaticReader } from "./staticAssets.js";
+export { createNodeHttpRuntime, createRequestHandler, } from "./runtime.js";

package/dist/http/requestAdapter.d.ts

@@ -0,0 +1,38 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { HttpRequest, HttpResponse } from "./types.js";
+export declare const DEFAULT_NODE_BUFFERED_BODY_LIMIT_BYTES = 1048576;
+export declare class NodeRequestBodyTooLargeError extends Error {
+    constructor();
+}
+export declare class NodeRequestAbortedError extends Error {
+    constructor();
+}
+/** A path is a webhook iff it contains a `/webhooks/` segment. */
+export declare function isWebhookPath(pathname: string): boolean;
+/**
+ * The PLATFORM's stream-first standalone entrypoints: they read the raw stream
+ * themselves, so the runtime must never pre-parse their body.
+ *
+ * A deployment's own stream-first endpoint is NOT listed here. It declares
+ * `rawStream: true` on its `HttpEntrypointRegistration` and the runtime passes that
+ * decision to `adaptRequest` directly — which is what stops this publishable list
+ * from having to name a path only that deployment owns.
+ */
+export declare function isRawStreamEntrypoint(pathname: string): boolean;
+export declare function pathnameOf(req: IncomingMessage): string;
+/**
+ * Decorate a Node response with Vercel's status/json/send/redirect sugar (productionized from the
+ * dev shim's decorateResponse — identical semantics).
+ */
+export declare function decorateResponse(res: ServerResponse): HttpResponse;
+/**
+ * Adapt a Node IncomingMessage into the Vercel request shape, honoring the raw-body invariant:
+ *  - raw-stream entrypoints (process/csp/feedback): stream left intact, NO req.body;
+ *  - everything else: raw bytes buffered + re-exposed as async-iterable (so readRawBody sees the
+ *    EXACT bytes for any signature-verifying route, webhook-segment or not) AND req.body = parsed JSON.
+ */
+export declare function adaptRequest(req: IncomingMessage, pathname: string, 
+/** Explicit override for a caller that knows the entrypoint's body contract (see above). */
+rawStream?: boolean, bufferedBodyLimitBytes?: number): Promise<HttpRequest>;
+/** Narrow a raw IncomingMessage to HttpRequest at the server boundary (query/cookies set in adapt). */
+export declare function decorateRequest(req: IncomingMessage): HttpRequest;