@rotorsoft/act-http 1.4.0 → 1.5.0

package/dist/@types/openapi/index.d.ts

@@ -0,0 +1,191 @@
+/**
+ * @packageDocumentation
+ * @module act-http/openapi
+ *
+ * OpenAPI subpath for the auto-generated API epic (#835). Walks the
+ * registry of a built `Act` once at function call and returns a
+ * valid OpenAPI 3.1 document describing the same action surface the
+ * Hono sibling at `@rotorsoft/act-http/hono` serves. The doc is
+ * suitable for cross-language client codegen (Go, Python, Swift,
+ * Kotlin, .NET), for serving over `/openapi.json` alongside a live
+ * API, and for the broader OpenAPI tooling ecosystem (Postman,
+ * Swagger UI, Redoc, schemathesis, API gateways).
+ *
+ * Usage:
+ *
+ * ```ts
+ * import { openapi } from "@rotorsoft/act-http/openapi";
+ *
+ * const doc = openapi(app, {
+ *   info: { title: "Wolfdesk API", version: "1.0.0" },
+ *   servers: [{ url: "https://api.example.com" }],
+ * });
+ * // doc: OpenAPIDocument — valid OpenAPI 3.1 object
+ * ```
+ *
+ * **Pure data emit.** No runtime dep on Hono or tRPC. The subpath is
+ * consumable standalone for hosts that serve their API some other
+ * way (Fastify, Lambda, edge) or that only want the doc for client
+ * codegen. The emit walks the registry once at function call; cost
+ * is linear in `N actions × M Zod fields each`, single-digit
+ * milliseconds for a 100-endpoint registry.
+ *
+ * **Determinism.** Output is stable across runs given the same
+ * registry — entries land in `Object.entries(app.registry.actions)`
+ * iteration order, schemas come from the action's Zod definition,
+ * and the rest of the doc is fixed content. CI can snapshot the
+ * result to catch unintended API surface changes.
+ *
+ * The same shared utilities at `@rotorsoft/act-http/api` underwrite
+ * cross-transport consistency: the `ApiError` envelope is referenced
+ * once from `components.schemas`, every error response points at it,
+ * and the same shape ships from the tRPC and Hono siblings at
+ * runtime. A client speaking the doc and the live REST API sees one
+ * envelope per framework error.
+ *
+ * **The doc describes the Hono surface, not tRPC.** tRPC's URL
+ * shape (`POST /trpc/<procedure>`, JSON-RPC-style body framing,
+ * batching) doesn't model cleanly as OpenAPI operations — and tRPC
+ * consumers already share types directly via `typeof router`, so
+ * OpenAPI buys them nothing. The path shape this emitter produces
+ * (`POST <basePath>/actions/<name>`) matches the
+ * `@rotorsoft/act-http/hono` sibling exactly: same default
+ * `basePath`, same request/response shapes, same envelope. If the
+ * operator overrides `basePath` on the Hono adapter, they pass the
+ * same override here so the doc keeps matching the live routes by
+ * construction. tRPC and Hono can run side-by-side at different
+ * mount points on the same Act instance; the OpenAPI doc covers
+ * the REST half only.
+ */
+import type { Act, Schema, Schemas } from "@rotorsoft/act";
+/**
+ * Minimal OpenAPI 3.1 document type. The emitter targets the 3.1
+ * spec; the type is intentionally a structural subset rather than
+ * the full surface from `openapi-types` so callers can post-process
+ * without fighting the type system. Cast to a fuller type from
+ * `openapi-types` when downstream consumers need it.
+ */
+export type OpenAPIDocument = {
+    readonly openapi: "3.1.0";
+    readonly info: OpenAPIInfo;
+    readonly servers?: ReadonlyArray<OpenAPIServer>;
+    readonly paths: Record<string, OpenAPIPathItem>;
+    readonly components: OpenAPIComponents;
+};
+/**
+ * Per-call options for {@link openapi}. The host supplies the
+ * document-shape fields the registry can't derive (title, version,
+ * servers) and toggles for the cross-cutting headers that the live
+ * REST API may accept.
+ *
+ * - `info` — required. `title` and `version` must be non-empty;
+ *   `info` may carry any other top-level OpenAPI info fields.
+ * - `servers` — optional. Each entry's `url` may contain
+ *   `{variable}` template syntax; bare URLs are validated through
+ *   `URL`'s parser and reject malformed inputs.
+ * - `basePath` — optional, default `/api`. Mirrors the Hono
+ *   sibling's default so the doc describes the same paths the
+ *   generated REST surface serves.
+ * - `idempotency` — optional, default `false`. When `true`, every
+ *   mutation operation documents an optional `Idempotency-Key`
+ *   request header.
+ * - `expectedVersion` — optional, default `false`. When `true`,
+ *   every mutation operation documents an optional `If-Match`
+ *   request header carrying the expected stream version.
+ */
+export type OpenAPIOptions = {
+    readonly info: OpenAPIInfo;
+    readonly servers?: ReadonlyArray<OpenAPIServer>;
+    readonly basePath?: string;
+    readonly idempotency?: boolean;
+    readonly expectedVersion?: boolean;
+};
+export type OpenAPIInfo = {
+    readonly title: string;
+    readonly version: string;
+    readonly description?: string;
+    readonly summary?: string;
+    readonly termsOfService?: string;
+    readonly contact?: {
+        readonly name?: string;
+        readonly url?: string;
+        readonly email?: string;
+    };
+    readonly license?: {
+        readonly name: string;
+        readonly identifier?: string;
+        readonly url?: string;
+    };
+};
+export type OpenAPIServer = {
+    readonly url: string;
+    readonly description?: string;
+    readonly variables?: Record<string, {
+        readonly default: string;
+        readonly enum?: ReadonlyArray<string>;
+        readonly description?: string;
+    }>;
+};
+export type OpenAPIPathItem = {
+    readonly post?: OpenAPIOperation;
+};
+export type OpenAPIOperation = {
+    readonly operationId: string;
+    readonly summary: string;
+    readonly tags: ReadonlyArray<string>;
+    readonly parameters?: ReadonlyArray<OpenAPIParameter>;
+    readonly requestBody?: OpenAPIRequestBody;
+    readonly responses: Record<string, OpenAPIResponse>;
+};
+export type OpenAPIParameter = {
+    readonly name: string;
+    readonly in: "header" | "query" | "path" | "cookie";
+    readonly required?: boolean;
+    readonly description?: string;
+    readonly schema?: Record<string, unknown>;
+};
+export type OpenAPIRequestBody = {
+    readonly required?: boolean;
+    readonly content: Record<string, {
+        readonly schema: Record<string, unknown>;
+    }>;
+};
+export type OpenAPIResponse = {
+    readonly description: string;
+    readonly content?: Record<string, {
+        readonly schema: Record<string, unknown>;
+    }>;
+} | {
+    readonly $ref: string;
+};
+export type OpenAPIComponents = {
+    readonly schemas: Record<string, Record<string, unknown>>;
+    readonly responses: Record<string, OpenAPIResponse>;
+};
+/**
+ * Build an OpenAPI 3.1 document describing a built `Act` instance's
+ * action surface.
+ *
+ * Walks `app.registry.actions` once and emits a `POST
+ * <basePath>/actions/<actionName>` operation per action, deriving
+ * the request-body schema from each action's Zod definition via
+ * `z.toJSONSchema` (Zod 4's native JSON Schema 2020-12 emitter,
+ * which is the OpenAPI 3.1 schema dialect — no conversion layer
+ * needed). Error responses reference the shared
+ * `#/components/responses/ApiError` so a single envelope shape
+ * covers every error path.
+ *
+ * @param app A built `Act` orchestrator. Required.
+ * @param options Document-shape fields (`info.title`, `info.version`,
+ *   servers, base path) and toggles for the cross-cutting headers
+ *   the live REST API may accept (`Idempotency-Key`, `If-Match`).
+ * @returns A valid OpenAPI 3.1 document object — serve as
+ *   `/openapi.json`, ship to a CDN, write to disk during CI, or
+ *   pipe to a codegen tool.
+ *
+ * @throws Error if `info.title` / `info.version` is missing or
+ *   empty, or if any `servers[].url` fails URL parsing after
+ *   `{variable}` substitution.
+ */
+export declare function openapi(app: Act<Schemas, Schemas, Schemas, Record<string, Schema>>, options: OpenAPIOptions): OpenAPIDocument;
+//# sourceMappingURL=index.d.ts.map

package/dist/@types/openapi/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/openapi/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAG3D;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAChD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CACzB,MAAM,EACN;QACE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;KAC/B,CACF,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACtD,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CACtB,MAAM,EACN;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAC7C,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,eAAe,GACvB;IACE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CACvB,MAAM,EACN;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAC7C,CAAC;CACH,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9B,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACrD,CAAC;AAyJF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,OAAO,CACrB,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC3D,OAAO,EAAE,cAAc,GACtB,eAAe,CA8BjB"}

package/dist/api/index.js

@@ -3,6 +3,7 @@ import {
   toApiError,
   withIdempotency
 } from "../chunk-Z6FVXDDU.js";
+import "../chunk-PZ5AY32C.js";
 export {
   ERROR_MAP,
   toApiError,

package/dist/chunk-PZ5AY32C.js

@@ -0,0 +1,10 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+export {
+  __export
+};
+//# sourceMappingURL=chunk-PZ5AY32C.js.map

package/dist/chunk-PZ5AY32C.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/hono/index.js

@@ -2,6 +2,7 @@ import {
   toApiError,
   withIdempotency
 } from "../chunk-Z6FVXDDU.js";
+import "../chunk-PZ5AY32C.js";
 
 // ../../node_modules/.pnpm/@hono+zod-validator@0.8.0_hono@4.12.23_zod@4.4.3/node_modules/@hono/zod-validator/dist/index.js
 import { validator } from "hono/validator";

package/dist/hono/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../node_modules/.pnpm/@hono+zod-validator@0.8.0_hono@4.12.23_zod@4.4.3/node_modules/@hono/zod-validator/src/index.ts","../../src/hono/index.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any */\nimport type { Context, Env, Input, MiddlewareHandler, TypedResponse, ValidationTargets } from 'hono'\nimport { validator } from 'hono/validator'\nimport type * as v3 from 'zod/v3'\nimport type { ZodSafeParseResult as v4ZodSafeParseResult } from 'zod/v4'\nimport type * as v4 from 'zod/v4/core'\nimport type { InferInput } from './utils'\n\ntype ZodSchema = v3.ZodType | v4.$ZodType\ntype ZodError<T extends ZodSchema> = T extends v4.$ZodType\n  ? v4.$ZodError<v4.output<T>>\n  : v3.ZodError\ntype ZodSafeParseResult<T, T2, T3 extends ZodSchema> = T3 extends v4.$ZodType\n  ? v4ZodSafeParseResult<T>\n  : v3.SafeParseReturnType<T, T2>\ntype zInput<T> = T extends v3.ZodType ? v3.input<T> : T extends v4.$ZodType ? v4.input<T> : never\ntype zOutput<T> = T extends v3.ZodType ? v3.output<T> : T extends v4.$ZodType ? v4.output<T> : never\ntype zInfer<T> = T extends v3.ZodType ? v3.infer<T> : T extends v4.$ZodType ? v4.infer<T> : never\n\n// Failure variant of `safeParseAsync`'s return value.\n// Mirrors the runtime body returned by `c.json(result, 400)` on validation failure.\ntype ZodValidatorFailureBody<T extends ZodSchema> = T extends v4.$ZodType\n  ? Extract<v4ZodSafeParseResult<v4.output<T>>, { success: false }>\n  : T extends v3.ZodType\n    ? Extract<v3.SafeParseReturnType<v3.input<T>, v3.output<T>>, { success: false }>\n    : never\n\ntype ZodValidatorFailureResponse<T extends ZodSchema> = Response &\n  TypedResponse<ZodValidatorFailureBody<T>, 400, 'json'>\n\nexport type Hook<\n  T,\n  E extends Env,\n  P extends string,\n  Target extends keyof ValidationTargets = keyof ValidationTargets,\n  O = {},\n  Schema extends ZodSchema = any,\n> = (\n  result: ({ success: true; data: T } | { success: false; error: ZodError<Schema>; data: T }) & {\n    target: Target\n  },\n  c: Context<E, P>\n) => Response | void | TypedResponse<O> | Promise<Response | void | TypedResponse<O>>\n\ntype HasUndefined<T> = undefined extends T ? true : false\n\ntype ExtractValidationResponse<VF> = VF extends (value: any, c: any) => infer R\n  ? R extends Promise<infer PR>\n    ? PR extends TypedResponse<infer T, infer S, infer F>\n      ? Response & TypedResponse<T, S, F>\n      : PR extends Response\n        ? PR\n        : PR extends undefined\n          ? never\n          : never\n    : R extends TypedResponse<infer T, infer S, infer F>\n      ? Response & TypedResponse<T, S, F>\n      : R extends Response\n        ? R\n        : R extends undefined\n          ? never\n          : never\n  : never\n\ntype ValidationFunctionOption<T extends ZodSchema, Target extends keyof ValidationTargets> = {\n  validationFunction: (\n    schema: T,\n    value: ValidationTargets[Target]\n  ) => ZodSafeParseResult<any, any, T> | Promise<ZodSafeParseResult<any, any, T>>\n}\n\ntype DefaultInput<Target extends keyof ValidationTargets, In, Out> = {\n  in: HasUndefined<In> extends true\n    ? {\n        [K in Target]?: [In] extends [ValidationTargets[K]] ? In : InferInput<In, K>\n      }\n    : {\n        [K in Target]: [In] extends [ValidationTargets[K]] ? In : InferInput<In, K>\n      }\n  out: { [K in Target]: Out }\n}\n\n// without hook (with or without options)\nfunction zValidatorFunction<\n  T extends ZodSchema,\n  Target extends keyof ValidationTargets,\n  E extends Env,\n  P extends string,\n  In = zInput<T>,\n  Out = zOutput<T>,\n  I extends Input = DefaultInput<Target, In, Out>,\n  V extends I = I,\n>(\n  target: Target,\n  schema: T,\n  hook?: undefined,\n  options?: ValidationFunctionOption<T, Target>\n): MiddlewareHandler<E, P, V, ZodValidatorFailureResponse<T>>\n\n// with hook and options\nfunction zValidatorFunction<\n  T extends ZodSchema,\n  Target extends keyof ValidationTargets,\n  E extends Env,\n  P extends string,\n  HookFn extends Hook<InferredValue, E, P, Target, {}, T>,\n  In = zInput<T>,\n  Out = zOutput<T>,\n  I extends Input = DefaultInput<Target, In, Out>,\n  V extends I = I,\n  InferredValue = zInfer<T>,\n>(\n  target: Target,\n  schema: T,\n  hook?: HookFn,\n  options?: ValidationFunctionOption<T, Target>\n): MiddlewareHandler<E, P, V, ExtractValidationResponse<HookFn>>\n\n// implementation\nfunction zValidatorFunction<\n  T extends ZodSchema,\n  Target extends keyof ValidationTargets,\n  E extends Env,\n  P extends string,\n  HookFn extends Hook<InferredValue, E, P, Target, {}, T>,\n  In = zInput<T>,\n  Out = zOutput<T>,\n  I extends Input = DefaultInput<Target, In, Out>,\n  V extends I = I,\n  InferredValue = zInfer<T>,\n>(\n  target: Target,\n  schema: T,\n  hook?: HookFn,\n  options?: ValidationFunctionOption<T, Target>\n):\n  | MiddlewareHandler<E, P, V, ZodValidatorFailureResponse<T>>\n  | MiddlewareHandler<E, P, V, ExtractValidationResponse<HookFn>> {\n  // @ts-expect-error not typed well\n  return validator(target, async (value: ValidationTargets[Target], c) => {\n    let validatorValue = value\n\n    // in case where our `target` === `header`, Hono parses all of the headers into lowercase.\n    // this might not match the Zod schema, so we want to make sure that we account for that when parsing the schema.\n    if ((target === 'header' && '_def' in schema) || (target === 'header' && '_zod' in schema)) {\n      // create an object that maps lowercase schema keys to lowercase\n      // @ts-expect-error the schema is a Zod Schema\n      const schemaKeys = Object.keys('in' in schema ? schema.in.shape : schema.shape)\n      const caseInsensitiveKeymap = Object.fromEntries(\n        schemaKeys.map((key) => [key.toLowerCase(), key])\n      )\n\n      validatorValue = Object.fromEntries(\n        Object.entries(value).map(([key, value]) => [caseInsensitiveKeymap[key] || key, value])\n      )\n    }\n\n    const result =\n      options && options.validationFunction\n        ? await options.validationFunction(schema, validatorValue)\n        : // @ts-expect-error z4.$ZodType has safeParseAsync\n          await schema.safeParseAsync(validatorValue)\n\n    if (hook) {\n      const hookResult = await hook({ data: validatorValue, ...result, target }, c)\n      if (hookResult) {\n        if (hookResult instanceof Response) {\n          return hookResult\n        }\n\n        if ('response' in hookResult) {\n          return hookResult.response\n        }\n      }\n    }\n\n    if (!result.success) {\n      return c.json(result, 400)\n    }\n\n    return result.data as zInfer<T>\n  })\n}\n\nexport const zValidator: typeof zValidatorFunction = zValidatorFunction\n","/**\n * @packageDocumentation\n * @module act-http/hono\n *\n * Hono subpath for the auto-generated API epic (#835). Walks the\n * registry of a built `Act` once at function call and emits a Hono\n * app with one `POST /actions/<name>` route per registered action,\n * Zod-validated bodies, and the shared error envelope.\n *\n * Usage:\n *\n * ```ts\n * import { hono } from \"@rotorsoft/act-http/hono\";\n *\n * const api = hono(app, {\n *   actor: (c) => ({ id: c.req.header(\"x-user-id\")!, name: \"...\" }),\n *   stream: (action, input, c) => `tenant-${c.req.header(\"x-tenant\")}`,\n * });\n *\n * // Mounts at /api by default — pass `basePath` to override.\n * // POST /api/actions/OpenTicket  body: { title }  → 200 Snapshot[] | 4xx ApiError\n * ```\n *\n * The route shape matches the flat tRPC sibling at\n * `@rotorsoft/act-http/trpc`: one endpoint per action, no\n * state-name tier. Action names are unique across the registry —\n * the framework enforces no duplicates — so an extra namespace\n * level would be overhead. Queries live in a follow-up; this\n * slice is mutations only.\n *\n * **Actor lives on the context.** The generator wires an internal\n * middleware that runs the host's\n * {@link HonoOptions.actor | actor extractor} once per call and\n * stashes the resolved {@link Actor} under `c.get(\"actor\")`. Every\n * generated route reads from there — auth resolves at one seam,\n * downstream middleware (logging, tracing) sees the same actor.\n * The middleware factory is also exported as {@link authenticated}\n * for hosts that want to compose it into their own Hono chain\n * alongside hand-written routes.\n *\n * Composes the shared utilities at `@rotorsoft/act-http/api`:\n * {@link ActorExtractor} for the auth seam, {@link toApiError} for\n * the uniform error → status / code mapping, {@link withIdempotency}\n * for `Idempotency-Key` dedup. Three transports (tRPC, this one,\n * OpenAPI) ride the same utilities so a client speaking two of\n * them never sees two shapes for the same framework error.\n */\nimport { zValidator } from \"@hono/zod-validator\";\nimport type { Act, Actor, Schema, Schemas } from \"@rotorsoft/act\";\nimport type { IdempotencyStore } from \"@rotorsoft/act-ops/idempotency\";\nimport type { Context, MiddlewareHandler } from \"hono\";\nimport { Hono } from \"hono\";\nimport {\n  type ActorExtractor,\n  type ApiError,\n  toApiError,\n  withIdempotency,\n} from \"../api/index.js\";\n\n/**\n * Hono context variables this subpath contributes. The generic on\n * the returned middleware threads it through so routes downstream\n * of {@link authenticated} see `c.get(\"actor\")` typed without a\n * manual cast.\n */\nexport type ActMiddlewareVariables = {\n  actor: Actor;\n};\n\n/**\n * Per-call options for {@link hono}. The host supplies the four\n * seams the package can't make decisions on:\n *\n * - `actor` — auth resolver. Receives the Hono context, returns the\n *   `Actor` that flows onto `c.get(\"actor\")` for every generated\n *   route (via an internal {@link authenticated}).\n * - `stream` — stream-id resolver. Receives the action name, the\n *   validated body, and the Hono context; returns the target\n *   stream. Singleton aggregates return a constant; per-tenant\n *   aggregates pull from headers, path, or body.\n * - `expectedVersion` (optional) — optimistic-concurrency resolver.\n *   Hosts typically read it from an `If-Match` header on the\n *   request, or from the client's last-known snapshot. Returning\n *   `undefined` skips the check for that call — handy when only\n *   some actions are concurrency-sensitive.\n * - `idempotency` (optional) — when set, the route honors\n *   `Idempotency-Key` via {@link withIdempotency}. The host\n *   supplies the `IdempotencyStore`; `keyFrom` defaults to reading\n *   the `Idempotency-Key` header. On a duplicate claim, the route\n *   responds `409 Conflict` — the contract intentionally doesn't\n *   cache the original handler's result, matching the\n *   receiver-side \"ack the duplicate\" semantics.\n * - `basePath` (optional, default `\"/api\"`) — Hono basePath the\n *   routes mount under.\n */\nexport type HonoOptions = {\n  readonly actor: ActorExtractor;\n  readonly stream: (\n    action_name: string,\n    input: unknown,\n    c: Context\n  ) => string | Promise<string>;\n  readonly expectedVersion?: (\n    action_name: string,\n    input: unknown,\n    c: Context\n  ) => number | undefined | Promise<number | undefined>;\n  readonly idempotency?: {\n    readonly store: IdempotencyStore;\n    readonly keyFrom?: (c: Context) => string | undefined;\n  };\n  readonly basePath?: string;\n};\n\n/**\n * Build a Hono middleware that runs an {@link ActorExtractor} once\n * per call and stashes the resolved {@link Actor} under\n * `c.set(\"actor\", ...)` so downstream routes can read it via\n * `c.get(\"actor\")`. The generator at {@link hono} uses this\n * internally; it's also exported so hosts that want to compose\n * their own route chain (logging, tracing, custom auth flavors)\n * can wire it directly:\n *\n * ```ts\n * import { Hono } from \"hono\";\n * import { authenticated, type ActMiddlewareVariables } from \"@rotorsoft/act-http/hono\";\n *\n * const api = new Hono<{ Variables: ActMiddlewareVariables }>();\n * api.use(\"*\", authenticated((c) => resolveUserFromJwt(c)));\n * api.get(\"/me\", (c) => c.json(c.get(\"actor\"))); // typed\n * ```\n *\n * Errors thrown by the extractor surface as `401 Unauthorized` with\n * the shared {@link ApiError} envelope.\n */\nexport function authenticated(\n  extractor: ActorExtractor\n): MiddlewareHandler<{ Variables: ActMiddlewareVariables }> {\n  return async (c, next) => {\n    try {\n      const actor = await extractor(c);\n      c.set(\"actor\", actor);\n      await next();\n    } catch (err) {\n      const body: ApiError = {\n        error: \"Unauthorized\",\n        detail: err instanceof Error ? err.message : undefined,\n        code: \"UNAUTHORIZED\",\n      };\n      return c.json(body, 401);\n    }\n  };\n}\n\nconst default_key_from = (c: Context): string | undefined =>\n  c.req.header(\"idempotency-key\");\n\n/**\n * Build a typed Hono REST surface from a built `Act` instance.\n *\n * Walks `app.registry.actions` once and emits one\n * `POST /actions/<actionName>` per action under the configured\n * `basePath` (default `/api`). Each route:\n *\n * 1. Runs the internal {@link authenticated} middleware —\n *    `options.actor` resolves the {@link Actor} once and stashes\n *    it under `c.get(\"actor\")`.\n * 2. Validates the JSON body against the action's Zod schema via\n *    `@hono/zod-validator`. Failures short-circuit with `422`.\n * 3. Resolves the target stream via\n *    `options.stream(name, input, c)`.\n * 4. (Optionally) resolves `expectedVersion` for optimistic\n *    concurrency.\n * 5. (Optionally) claims the `Idempotency-Key` via\n *    {@link withIdempotency} — responds `409` on duplicate.\n * 6. Calls\n *    `app.do(name, { stream, actor, expectedVersion? }, input)`.\n * 7. Maps any thrown framework error onto the shared\n *    {@link ApiError} envelope via {@link toApiError}, returning\n *    the conventional HTTP status (`409` / `412` for concurrency,\n *    `422` for validation, `400` for non-retryable, etc.).\n *\n * @param app A built `Act` orchestrator.\n * @param options Auth, stream, expected-version, idempotency, and\n *   base-path seams.\n * @returns A Hono app covering every registered action under\n *   `<basePath>/actions/<name>`.\n */\nexport function hono(\n  app: Act<Schemas, Schemas, Schemas, Record<string, Schema>>,\n  options: HonoOptions\n): Hono<{ Variables: ActMiddlewareVariables }> {\n  const base_path = options.basePath ?? \"/api\";\n  const api = new Hono<{ Variables: ActMiddlewareVariables }>().basePath(\n    base_path\n  );\n  api.use(\"*\", authenticated(options.actor));\n\n  const key_from = options.idempotency?.keyFrom ?? default_key_from;\n\n  for (const [action_name, state] of Object.entries(app.registry.actions)) {\n    const schema = state.actions[action_name] as Schema;\n    api.post(\n      `/actions/${action_name}`,\n      zValidator(\"json\", schema as never),\n      async (c) => {\n        try {\n          const input = c.req.valid(\"json\" as never) as unknown;\n          const actor = c.get(\"actor\");\n          const stream = await options.stream(action_name, input, c);\n          const expected_version = options.expectedVersion\n            ? await options.expectedVersion(action_name, input, c)\n            : undefined;\n          const target =\n            expected_version === undefined\n              ? { stream, actor }\n              : { stream, actor, expectedVersion: expected_version };\n\n          if (options.idempotency) {\n            const key = key_from(c);\n            if (!key) {\n              const body: ApiError = {\n                error: \"BadRequest\",\n                detail: \"Idempotency-Key required\",\n                code: \"BAD_REQUEST\",\n              };\n              return c.json(body, 400);\n            }\n            const outcome = await withIdempotency(\n              options.idempotency.store,\n              key,\n              () =>\n                app.do(action_name as never, target as never, input as never)\n            );\n            if (outcome.deduped) {\n              const body: ApiError = {\n                error: \"Conflict\",\n                detail:\n                  \"Idempotency-Key already used; original result not cached\",\n                code: \"CONFLICT\",\n              };\n              return c.json(body, 409);\n            }\n            return c.json(outcome.result);\n          }\n\n          const snapshots = await app.do(\n            action_name as never,\n            target as never,\n            input as never\n          );\n          return c.json(snapshots);\n        } catch (err) {\n          const { status, body } = toApiError(err);\n          // Hono types narrow `status` to its known status-number union;\n          // `toApiError` returns a numeric status from a closed set that\n          // matches but TypeScript can't prove it through the union.\n          return c.json(body, status as 400 | 409 | 410 | 412 | 422 | 500);\n        }\n      }\n    );\n  }\n\n  return api;\n}\n"],"mappings":";;;;;;;AAuHA,SAAS,mBAYP,QACA,QACA,MACA,SAGgE;AAEhE,SAAO,UAAU,QAAQ,OAAO,OAAkC,MAAM;AACtE,QAAI,iBAAiB;AAIrB,QAAK,WAAW,YAAY,UAAU,UAAY,WAAW,YAAY,UAAU,QAAS;AAG1F,YAAM,aAAa,OAAO,KAAK,QAAQ,SAAS,OAAO,GAAG,QAAQ,OAAO,KAAA;AACzE,YAAM,wBAAwB,OAAO,YACnC,WAAW,IAAA,CAAK,QAAQ,CAAC,IAAI,YAAA,GAAe,GAAA,CAAI,CAAC;AAGnD,uBAAiB,OAAO,YACtB,OAAO,QAAQ,KAAA,EAAO,IAAA,CAAK,CAAC,KAAKA,OAAAA,MAAW,CAAC,sBAAsB,GAAA,KAAQ,KAAKA,OAAAA,CAAM,CAAC;;AAI3F,UAAM,SACJ,WAAW,QAAQ,qBACf,MAAM,QAAQ,mBAAmB,QAAQ,cAAA,IAEzC,MAAM,OAAO,eAAe,cAAA;AAElC,QAAI,MAAM;AACR,YAAM,aAAa,MAAM,KAAK;QAAE,MAAM;QAAgB,GAAG;QAAQ;SAAU,CAAA;AAC3E,UAAI,YAAY;AACd,YAAI,sBAAsB,SACxB,QAAO;AAGT,YAAI,cAAc,WAChB,QAAO,WAAW;;;AAKxB,QAAI,CAAC,OAAO,QACV,QAAO,EAAE,KAAK,QAAQ,GAAA;AAGxB,WAAO,OAAO;;;AAIlB,IAAaC,aAAwC;;;ACrIrD,SAAS,YAAY;AAoFd,SAAS,cACd,WAC0D;AAC1D,SAAO,OAAO,GAAG,SAAS;AACxB,QAAI;AACF,YAAM,QAAQ,MAAM,UAAU,CAAC;AAC/B,QAAE,IAAI,SAAS,KAAK;AACpB,YAAM,KAAK;AAAA,IACb,SAAS,KAAK;AACZ,YAAM,OAAiB;AAAA,QACrB,OAAO;AAAA,QACP,QAAQ,eAAe,QAAQ,IAAI,UAAU;AAAA,QAC7C,MAAM;AAAA,MACR;AACA,aAAO,EAAE,KAAK,MAAM,GAAG;AAAA,IACzB;AAAA,EACF;AACF;AAEA,IAAM,mBAAmB,CAAC,MACxB,EAAE,IAAI,OAAO,iBAAiB;AAiCzB,SAAS,KACd,KACA,SAC6C;AAC7C,QAAM,YAAY,QAAQ,YAAY;AACtC,QAAM,MAAM,IAAI,KAA4C,EAAE;AAAA,IAC5D;AAAA,EACF;AACA,MAAI,IAAI,KAAK,cAAc,QAAQ,KAAK,CAAC;AAEzC,QAAM,WAAW,QAAQ,aAAa,WAAW;AAEjD,aAAW,CAAC,aAAa,KAAK,KAAK,OAAO,QAAQ,IAAI,SAAS,OAAO,GAAG;AACvE,UAAM,SAAS,MAAM,QAAQ,WAAW;AACxC,QAAI;AAAA,MACF,YAAY,WAAW;AAAA,MACvB,WAAW,QAAQ,MAAe;AAAA,MAClC,OAAO,MAAM;AACX,YAAI;AACF,gBAAM,QAAQ,EAAE,IAAI,MAAM,MAAe;AACzC,gBAAM,QAAQ,EAAE,IAAI,OAAO;AAC3B,gBAAM,SAAS,MAAM,QAAQ,OAAO,aAAa,OAAO,CAAC;AACzD,gBAAM,mBAAmB,QAAQ,kBAC7B,MAAM,QAAQ,gBAAgB,aAAa,OAAO,CAAC,IACnD;AACJ,gBAAM,SACJ,qBAAqB,SACjB,EAAE,QAAQ,MAAM,IAChB,EAAE,QAAQ,OAAO,iBAAiB,iBAAiB;AAEzD,cAAI,QAAQ,aAAa;AACvB,kBAAM,MAAM,SAAS,CAAC;AACtB,gBAAI,CAAC,KAAK;AACR,oBAAM,OAAiB;AAAA,gBACrB,OAAO;AAAA,gBACP,QAAQ;AAAA,gBACR,MAAM;AAAA,cACR;AACA,qBAAO,EAAE,KAAK,MAAM,GAAG;AAAA,YACzB;AACA,kBAAM,UAAU,MAAM;AAAA,cACpB,QAAQ,YAAY;AAAA,cACpB;AAAA,cACA,MACE,IAAI,GAAG,aAAsB,QAAiB,KAAc;AAAA,YAChE;AACA,gBAAI,QAAQ,SAAS;AACnB,oBAAM,OAAiB;AAAA,gBACrB,OAAO;AAAA,gBACP,QACE;AAAA,gBACF,MAAM;AAAA,cACR;AACA,qBAAO,EAAE,KAAK,MAAM,GAAG;AAAA,YACzB;AACA,mBAAO,EAAE,KAAK,QAAQ,MAAM;AAAA,UAC9B;AAEA,gBAAM,YAAY,MAAM,IAAI;AAAA,YAC1B;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,iBAAO,EAAE,KAAK,SAAS;AAAA,QACzB,SAAS,KAAK;AACZ,gBAAM,EAAE,QAAQ,KAAK,IAAI,WAAW,GAAG;AAIvC,iBAAO,EAAE,KAAK,MAAM,MAA2C;AAAA,QACjE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;","names":["value","zValidator: typeof zValidatorFunction"]}
+{"version":3,"sources":["../../../../node_modules/.pnpm/@hono+zod-validator@0.8.0_hono@4.12.23_zod@4.4.3/node_modules/@hono/zod-validator/src/index.ts","../../src/hono/index.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any */\nimport type { Context, Env, Input, MiddlewareHandler, TypedResponse, ValidationTargets } from 'hono'\nimport { validator } from 'hono/validator'\nimport type * as v3 from 'zod/v3'\nimport type { ZodSafeParseResult as v4ZodSafeParseResult } from 'zod/v4'\nimport type * as v4 from 'zod/v4/core'\nimport type { InferInput } from './utils'\n\ntype ZodSchema = v3.ZodType | v4.$ZodType\ntype ZodError<T extends ZodSchema> = T extends v4.$ZodType\n  ? v4.$ZodError<v4.output<T>>\n  : v3.ZodError\ntype ZodSafeParseResult<T, T2, T3 extends ZodSchema> = T3 extends v4.$ZodType\n  ? v4ZodSafeParseResult<T>\n  : v3.SafeParseReturnType<T, T2>\ntype zInput<T> = T extends v3.ZodType ? v3.input<T> : T extends v4.$ZodType ? v4.input<T> : never\ntype zOutput<T> = T extends v3.ZodType ? v3.output<T> : T extends v4.$ZodType ? v4.output<T> : never\ntype zInfer<T> = T extends v3.ZodType ? v3.infer<T> : T extends v4.$ZodType ? v4.infer<T> : never\n\n// Failure variant of `safeParseAsync`'s return value.\n// Mirrors the runtime body returned by `c.json(result, 400)` on validation failure.\ntype ZodValidatorFailureBody<T extends ZodSchema> = T extends v4.$ZodType\n  ? Extract<v4ZodSafeParseResult<v4.output<T>>, { success: false }>\n  : T extends v3.ZodType\n    ? Extract<v3.SafeParseReturnType<v3.input<T>, v3.output<T>>, { success: false }>\n    : never\n\ntype ZodValidatorFailureResponse<T extends ZodSchema> = Response &\n  TypedResponse<ZodValidatorFailureBody<T>, 400, 'json'>\n\nexport type Hook<\n  T,\n  E extends Env,\n  P extends string,\n  Target extends keyof ValidationTargets = keyof ValidationTargets,\n  O = {},\n  Schema extends ZodSchema = any,\n> = (\n  result: ({ success: true; data: T } | { success: false; error: ZodError<Schema>; data: T }) & {\n    target: Target\n  },\n  c: Context<E, P>\n) => Response | void | TypedResponse<O> | Promise<Response | void | TypedResponse<O>>\n\ntype HasUndefined<T> = undefined extends T ? true : false\n\ntype ExtractValidationResponse<VF> = VF extends (value: any, c: any) => infer R\n  ? R extends Promise<infer PR>\n    ? PR extends TypedResponse<infer T, infer S, infer F>\n      ? Response & TypedResponse<T, S, F>\n      : PR extends Response\n        ? PR\n        : PR extends undefined\n          ? never\n          : never\n    : R extends TypedResponse<infer T, infer S, infer F>\n      ? Response & TypedResponse<T, S, F>\n      : R extends Response\n        ? R\n        : R extends undefined\n          ? never\n          : never\n  : never\n\ntype ValidationFunctionOption<T extends ZodSchema, Target extends keyof ValidationTargets> = {\n  validationFunction: (\n    schema: T,\n    value: ValidationTargets[Target]\n  ) => ZodSafeParseResult<any, any, T> | Promise<ZodSafeParseResult<any, any, T>>\n}\n\ntype DefaultInput<Target extends keyof ValidationTargets, In, Out> = {\n  in: HasUndefined<In> extends true\n    ? {\n        [K in Target]?: [In] extends [ValidationTargets[K]] ? In : InferInput<In, K>\n      }\n    : {\n        [K in Target]: [In] extends [ValidationTargets[K]] ? In : InferInput<In, K>\n      }\n  out: { [K in Target]: Out }\n}\n\n// without hook (with or without options)\nfunction zValidatorFunction<\n  T extends ZodSchema,\n  Target extends keyof ValidationTargets,\n  E extends Env,\n  P extends string,\n  In = zInput<T>,\n  Out = zOutput<T>,\n  I extends Input = DefaultInput<Target, In, Out>,\n  V extends I = I,\n>(\n  target: Target,\n  schema: T,\n  hook?: undefined,\n  options?: ValidationFunctionOption<T, Target>\n): MiddlewareHandler<E, P, V, ZodValidatorFailureResponse<T>>\n\n// with hook and options\nfunction zValidatorFunction<\n  T extends ZodSchema,\n  Target extends keyof ValidationTargets,\n  E extends Env,\n  P extends string,\n  HookFn extends Hook<InferredValue, E, P, Target, {}, T>,\n  In = zInput<T>,\n  Out = zOutput<T>,\n  I extends Input = DefaultInput<Target, In, Out>,\n  V extends I = I,\n  InferredValue = zInfer<T>,\n>(\n  target: Target,\n  schema: T,\n  hook?: HookFn,\n  options?: ValidationFunctionOption<T, Target>\n): MiddlewareHandler<E, P, V, ExtractValidationResponse<HookFn>>\n\n// implementation\nfunction zValidatorFunction<\n  T extends ZodSchema,\n  Target extends keyof ValidationTargets,\n  E extends Env,\n  P extends string,\n  HookFn extends Hook<InferredValue, E, P, Target, {}, T>,\n  In = zInput<T>,\n  Out = zOutput<T>,\n  I extends Input = DefaultInput<Target, In, Out>,\n  V extends I = I,\n  InferredValue = zInfer<T>,\n>(\n  target: Target,\n  schema: T,\n  hook?: HookFn,\n  options?: ValidationFunctionOption<T, Target>\n):\n  | MiddlewareHandler<E, P, V, ZodValidatorFailureResponse<T>>\n  | MiddlewareHandler<E, P, V, ExtractValidationResponse<HookFn>> {\n  // @ts-expect-error not typed well\n  return validator(target, async (value: ValidationTargets[Target], c) => {\n    let validatorValue = value\n\n    // in case where our `target` === `header`, Hono parses all of the headers into lowercase.\n    // this might not match the Zod schema, so we want to make sure that we account for that when parsing the schema.\n    if ((target === 'header' && '_def' in schema) || (target === 'header' && '_zod' in schema)) {\n      // create an object that maps lowercase schema keys to lowercase\n      // @ts-expect-error the schema is a Zod Schema\n      const schemaKeys = Object.keys('in' in schema ? schema.in.shape : schema.shape)\n      const caseInsensitiveKeymap = Object.fromEntries(\n        schemaKeys.map((key) => [key.toLowerCase(), key])\n      )\n\n      validatorValue = Object.fromEntries(\n        Object.entries(value).map(([key, value]) => [caseInsensitiveKeymap[key] || key, value])\n      )\n    }\n\n    const result =\n      options && options.validationFunction\n        ? await options.validationFunction(schema, validatorValue)\n        : // @ts-expect-error z4.$ZodType has safeParseAsync\n          await schema.safeParseAsync(validatorValue)\n\n    if (hook) {\n      const hookResult = await hook({ data: validatorValue, ...result, target }, c)\n      if (hookResult) {\n        if (hookResult instanceof Response) {\n          return hookResult\n        }\n\n        if ('response' in hookResult) {\n          return hookResult.response\n        }\n      }\n    }\n\n    if (!result.success) {\n      return c.json(result, 400)\n    }\n\n    return result.data as zInfer<T>\n  })\n}\n\nexport const zValidator: typeof zValidatorFunction = zValidatorFunction\n","/**\n * @packageDocumentation\n * @module act-http/hono\n *\n * Hono subpath for the auto-generated API epic (#835). Walks the\n * registry of a built `Act` once at function call and emits a Hono\n * app with one `POST /actions/<name>` route per registered action,\n * Zod-validated bodies, and the shared error envelope.\n *\n * Usage:\n *\n * ```ts\n * import { hono } from \"@rotorsoft/act-http/hono\";\n *\n * const api = hono(app, {\n *   actor: (c) => ({ id: c.req.header(\"x-user-id\")!, name: \"...\" }),\n *   stream: (action, input, c) => `tenant-${c.req.header(\"x-tenant\")}`,\n * });\n *\n * // Mounts at /api by default — pass `basePath` to override.\n * // POST /api/actions/OpenTicket  body: { title }  → 200 Snapshot[] | 4xx ApiError\n * ```\n *\n * The route shape matches the flat tRPC sibling at\n * `@rotorsoft/act-http/trpc`: one endpoint per action, no\n * state-name tier. Action names are unique across the registry —\n * the framework enforces no duplicates — so an extra namespace\n * level would be overhead. Queries live in a follow-up; this\n * slice is mutations only.\n *\n * **Actor lives on the context.** The generator wires an internal\n * middleware that runs the host's\n * {@link HonoOptions.actor | actor extractor} once per call and\n * stashes the resolved {@link Actor} under `c.get(\"actor\")`. Every\n * generated route reads from there — auth resolves at one seam,\n * downstream middleware (logging, tracing) sees the same actor.\n * The middleware factory is also exported as {@link authenticated}\n * for hosts that want to compose it into their own Hono chain\n * alongside hand-written routes.\n *\n * Composes the shared utilities at `@rotorsoft/act-http/api`:\n * {@link ActorExtractor} for the auth seam, {@link toApiError} for\n * the uniform error → status / code mapping, {@link withIdempotency}\n * for `Idempotency-Key` dedup. Three transports (tRPC, this one,\n * OpenAPI) ride the same utilities so a client speaking two of\n * them never sees two shapes for the same framework error.\n */\nimport { zValidator } from \"@hono/zod-validator\";\nimport type { Act, Actor, Schema, Schemas } from \"@rotorsoft/act\";\nimport type { IdempotencyStore } from \"@rotorsoft/act-ops/idempotency\";\nimport type { Context, MiddlewareHandler } from \"hono\";\nimport { Hono } from \"hono\";\nimport {\n  type ActorExtractor,\n  type ApiError,\n  toApiError,\n  withIdempotency,\n} from \"../api/index.js\";\n\n/**\n * Hono context variables this subpath contributes. The generic on\n * the returned middleware threads it through so routes downstream\n * of {@link authenticated} see `c.get(\"actor\")` typed without a\n * manual cast.\n */\nexport type ActMiddlewareVariables = {\n  actor: Actor;\n};\n\n/**\n * Per-call options for {@link hono}. The host supplies the four\n * seams the package can't make decisions on:\n *\n * - `actor` — auth resolver. Receives the Hono context, returns the\n *   `Actor` that flows onto `c.get(\"actor\")` for every generated\n *   route (via an internal {@link authenticated}).\n * - `stream` — stream-id resolver. Receives the action name, the\n *   validated body, and the Hono context; returns the target\n *   stream. Singleton aggregates return a constant; per-tenant\n *   aggregates pull from headers, path, or body.\n * - `expectedVersion` (optional) — optimistic-concurrency resolver.\n *   Hosts typically read it from an `If-Match` header on the\n *   request, or from the client's last-known snapshot. Returning\n *   `undefined` skips the check for that call — handy when only\n *   some actions are concurrency-sensitive.\n * - `idempotency` (optional) — when set, the route honors\n *   `Idempotency-Key` via {@link withIdempotency}. The host\n *   supplies the `IdempotencyStore`; `keyFrom` defaults to reading\n *   the `Idempotency-Key` header. On a duplicate claim, the route\n *   responds `409 Conflict` — the contract intentionally doesn't\n *   cache the original handler's result, matching the\n *   receiver-side \"ack the duplicate\" semantics.\n * - `basePath` (optional, default `\"/api\"`) — Hono basePath the\n *   routes mount under.\n */\nexport type HonoOptions = {\n  readonly actor: ActorExtractor;\n  readonly stream: (\n    action_name: string,\n    input: unknown,\n    c: Context\n  ) => string | Promise<string>;\n  readonly expectedVersion?: (\n    action_name: string,\n    input: unknown,\n    c: Context\n  ) => number | undefined | Promise<number | undefined>;\n  readonly idempotency?: {\n    readonly store: IdempotencyStore;\n    readonly keyFrom?: (c: Context) => string | undefined;\n  };\n  readonly basePath?: string;\n};\n\n/**\n * Build a Hono middleware that runs an {@link ActorExtractor} once\n * per call and stashes the resolved {@link Actor} under\n * `c.set(\"actor\", ...)` so downstream routes can read it via\n * `c.get(\"actor\")`. The generator at {@link hono} uses this\n * internally; it's also exported so hosts that want to compose\n * their own route chain (logging, tracing, custom auth flavors)\n * can wire it directly:\n *\n * ```ts\n * import { Hono } from \"hono\";\n * import { authenticated, type ActMiddlewareVariables } from \"@rotorsoft/act-http/hono\";\n *\n * const api = new Hono<{ Variables: ActMiddlewareVariables }>();\n * api.use(\"*\", authenticated((c) => resolveUserFromJwt(c)));\n * api.get(\"/me\", (c) => c.json(c.get(\"actor\"))); // typed\n * ```\n *\n * Errors thrown by the extractor surface as `401 Unauthorized` with\n * the shared {@link ApiError} envelope.\n */\nexport function authenticated(\n  extractor: ActorExtractor\n): MiddlewareHandler<{ Variables: ActMiddlewareVariables }> {\n  return async (c, next) => {\n    try {\n      const actor = await extractor(c);\n      c.set(\"actor\", actor);\n      await next();\n    } catch (err) {\n      const body: ApiError = {\n        error: \"Unauthorized\",\n        detail: err instanceof Error ? err.message : undefined,\n        code: \"UNAUTHORIZED\",\n      };\n      return c.json(body, 401);\n    }\n  };\n}\n\nconst default_key_from = (c: Context): string | undefined =>\n  c.req.header(\"idempotency-key\");\n\n/**\n * Build a typed Hono REST surface from a built `Act` instance.\n *\n * Walks `app.registry.actions` once and emits one\n * `POST /actions/<actionName>` per action under the configured\n * `basePath` (default `/api`). Each route:\n *\n * 1. Runs the internal {@link authenticated} middleware —\n *    `options.actor` resolves the {@link Actor} once and stashes\n *    it under `c.get(\"actor\")`.\n * 2. Validates the JSON body against the action's Zod schema via\n *    `@hono/zod-validator`. Failures short-circuit with `422`.\n * 3. Resolves the target stream via\n *    `options.stream(name, input, c)`.\n * 4. (Optionally) resolves `expectedVersion` for optimistic\n *    concurrency.\n * 5. (Optionally) claims the `Idempotency-Key` via\n *    {@link withIdempotency} — responds `409` on duplicate.\n * 6. Calls\n *    `app.do(name, { stream, actor, expectedVersion? }, input)`.\n * 7. Maps any thrown framework error onto the shared\n *    {@link ApiError} envelope via {@link toApiError}, returning\n *    the conventional HTTP status (`409` / `412` for concurrency,\n *    `422` for validation, `400` for non-retryable, etc.).\n *\n * @param app A built `Act` orchestrator.\n * @param options Auth, stream, expected-version, idempotency, and\n *   base-path seams.\n * @returns A Hono app covering every registered action under\n *   `<basePath>/actions/<name>`.\n */\nexport function hono(\n  app: Act<Schemas, Schemas, Schemas, Record<string, Schema>>,\n  options: HonoOptions\n): Hono<{ Variables: ActMiddlewareVariables }> {\n  const base_path = options.basePath ?? \"/api\";\n  const api = new Hono<{ Variables: ActMiddlewareVariables }>().basePath(\n    base_path\n  );\n  api.use(\"*\", authenticated(options.actor));\n\n  const key_from = options.idempotency?.keyFrom ?? default_key_from;\n\n  for (const [action_name, state] of Object.entries(app.registry.actions)) {\n    const schema = state.actions[action_name] as Schema;\n    api.post(\n      `/actions/${action_name}`,\n      zValidator(\"json\", schema as never),\n      async (c) => {\n        try {\n          const input = c.req.valid(\"json\" as never) as unknown;\n          const actor = c.get(\"actor\");\n          const stream = await options.stream(action_name, input, c);\n          const expected_version = options.expectedVersion\n            ? await options.expectedVersion(action_name, input, c)\n            : undefined;\n          const target =\n            expected_version === undefined\n              ? { stream, actor }\n              : { stream, actor, expectedVersion: expected_version };\n\n          if (options.idempotency) {\n            const key = key_from(c);\n            if (!key) {\n              const body: ApiError = {\n                error: \"BadRequest\",\n                detail: \"Idempotency-Key required\",\n                code: \"BAD_REQUEST\",\n              };\n              return c.json(body, 400);\n            }\n            const outcome = await withIdempotency(\n              options.idempotency.store,\n              key,\n              () =>\n                app.do(action_name as never, target as never, input as never)\n            );\n            if (outcome.deduped) {\n              const body: ApiError = {\n                error: \"Conflict\",\n                detail:\n                  \"Idempotency-Key already used; original result not cached\",\n                code: \"CONFLICT\",\n              };\n              return c.json(body, 409);\n            }\n            return c.json(outcome.result);\n          }\n\n          const snapshots = await app.do(\n            action_name as never,\n            target as never,\n            input as never\n          );\n          return c.json(snapshots);\n        } catch (err) {\n          const { status, body } = toApiError(err);\n          // Hono types narrow `status` to its known status-number union;\n          // `toApiError` returns a numeric status from a closed set that\n          // matches but TypeScript can't prove it through the union.\n          return c.json(body, status as 400 | 409 | 410 | 412 | 422 | 500);\n        }\n      }\n    );\n  }\n\n  return api;\n}\n"],"mappings":";;;;;;;;AAuHA,SAAS,mBAYP,QACA,QACA,MACA,SAGgE;AAEhE,SAAO,UAAU,QAAQ,OAAO,OAAkC,MAAM;AACtE,QAAI,iBAAiB;AAIrB,QAAK,WAAW,YAAY,UAAU,UAAY,WAAW,YAAY,UAAU,QAAS;AAG1F,YAAM,aAAa,OAAO,KAAK,QAAQ,SAAS,OAAO,GAAG,QAAQ,OAAO,KAAA;AACzE,YAAM,wBAAwB,OAAO,YACnC,WAAW,IAAA,CAAK,QAAQ,CAAC,IAAI,YAAA,GAAe,GAAA,CAAI,CAAC;AAGnD,uBAAiB,OAAO,YACtB,OAAO,QAAQ,KAAA,EAAO,IAAA,CAAK,CAAC,KAAKA,OAAAA,MAAW,CAAC,sBAAsB,GAAA,KAAQ,KAAKA,OAAAA,CAAM,CAAC;;AAI3F,UAAM,SACJ,WAAW,QAAQ,qBACf,MAAM,QAAQ,mBAAmB,QAAQ,cAAA,IAEzC,MAAM,OAAO,eAAe,cAAA;AAElC,QAAI,MAAM;AACR,YAAM,aAAa,MAAM,KAAK;QAAE,MAAM;QAAgB,GAAG;QAAQ;SAAU,CAAA;AAC3E,UAAI,YAAY;AACd,YAAI,sBAAsB,SACxB,QAAO;AAGT,YAAI,cAAc,WAChB,QAAO,WAAW;;;AAKxB,QAAI,CAAC,OAAO,QACV,QAAO,EAAE,KAAK,QAAQ,GAAA;AAGxB,WAAO,OAAO;;;AAIlB,IAAaC,aAAwC;;;ACrIrD,SAAS,YAAY;AAoFd,SAAS,cACd,WAC0D;AAC1D,SAAO,OAAO,GAAG,SAAS;AACxB,QAAI;AACF,YAAM,QAAQ,MAAM,UAAU,CAAC;AAC/B,QAAE,IAAI,SAAS,KAAK;AACpB,YAAM,KAAK;AAAA,IACb,SAAS,KAAK;AACZ,YAAM,OAAiB;AAAA,QACrB,OAAO;AAAA,QACP,QAAQ,eAAe,QAAQ,IAAI,UAAU;AAAA,QAC7C,MAAM;AAAA,MACR;AACA,aAAO,EAAE,KAAK,MAAM,GAAG;AAAA,IACzB;AAAA,EACF;AACF;AAEA,IAAM,mBAAmB,CAAC,MACxB,EAAE,IAAI,OAAO,iBAAiB;AAiCzB,SAAS,KACd,KACA,SAC6C;AAC7C,QAAM,YAAY,QAAQ,YAAY;AACtC,QAAM,MAAM,IAAI,KAA4C,EAAE;AAAA,IAC5D;AAAA,EACF;AACA,MAAI,IAAI,KAAK,cAAc,QAAQ,KAAK,CAAC;AAEzC,QAAM,WAAW,QAAQ,aAAa,WAAW;AAEjD,aAAW,CAAC,aAAa,KAAK,KAAK,OAAO,QAAQ,IAAI,SAAS,OAAO,GAAG;AACvE,UAAM,SAAS,MAAM,QAAQ,WAAW;AACxC,QAAI;AAAA,MACF,YAAY,WAAW;AAAA,MACvB,WAAW,QAAQ,MAAe;AAAA,MAClC,OAAO,MAAM;AACX,YAAI;AACF,gBAAM,QAAQ,EAAE,IAAI,MAAM,MAAe;AACzC,gBAAM,QAAQ,EAAE,IAAI,OAAO;AAC3B,gBAAM,SAAS,MAAM,QAAQ,OAAO,aAAa,OAAO,CAAC;AACzD,gBAAM,mBAAmB,QAAQ,kBAC7B,MAAM,QAAQ,gBAAgB,aAAa,OAAO,CAAC,IACnD;AACJ,gBAAM,SACJ,qBAAqB,SACjB,EAAE,QAAQ,MAAM,IAChB,EAAE,QAAQ,OAAO,iBAAiB,iBAAiB;AAEzD,cAAI,QAAQ,aAAa;AACvB,kBAAM,MAAM,SAAS,CAAC;AACtB,gBAAI,CAAC,KAAK;AACR,oBAAM,OAAiB;AAAA,gBACrB,OAAO;AAAA,gBACP,QAAQ;AAAA,gBACR,MAAM;AAAA,cACR;AACA,qBAAO,EAAE,KAAK,MAAM,GAAG;AAAA,YACzB;AACA,kBAAM,UAAU,MAAM;AAAA,cACpB,QAAQ,YAAY;AAAA,cACpB;AAAA,cACA,MACE,IAAI,GAAG,aAAsB,QAAiB,KAAc;AAAA,YAChE;AACA,gBAAI,QAAQ,SAAS;AACnB,oBAAM,OAAiB;AAAA,gBACrB,OAAO;AAAA,gBACP,QACE;AAAA,gBACF,MAAM;AAAA,cACR;AACA,qBAAO,EAAE,KAAK,MAAM,GAAG;AAAA,YACzB;AACA,mBAAO,EAAE,KAAK,QAAQ,MAAM;AAAA,UAC9B;AAEA,gBAAM,YAAY,MAAM,IAAI;AAAA,YAC1B;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,iBAAO,EAAE,KAAK,SAAS;AAAA,QACzB,SAAS,KAAK;AACZ,gBAAM,EAAE,QAAQ,KAAK,IAAI,WAAW,GAAG;AAIvC,iBAAO,EAAE,KAAK,MAAM,MAA2C;AAAA,QACjE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;","names":["value","zValidator: typeof zValidatorFunction"]}