@spfn/core 0.2.0-beta.9 → 0.3.0-beta.10

package/dist/app-config/index.d.ts

@@ -0,0 +1,96 @@
+/**
+ * `spfn.config.js` — the app's serving shape, read by both the CLI and the server.
+ *
+ * The file has existed since `spfn init` started writing it, and until now
+ * nothing read it back. It is the one committed place that describes how an app
+ * is served, which makes it the right home for the ports: an app that wants a
+ * different port says so once here instead of repeating the number across its
+ * `server.config.ts`, Dockerfile, compose file, `next.config.ts` and env
+ * example, where nothing checks that the copies still agree.
+ *
+ * This module is deliberately free of side effects. `@spfn/core/config`
+ * validates the whole environment schema the moment it is imported, which is
+ * fine inside a server and wrong inside a CLI that has not been handed an
+ * app's environment yet.
+ *
+ * @module app-config
+ */
+/**
+ * Ports the app is served on.
+ *
+ * Two names because two processes are started. Next.js reads `PORT` as its own,
+ * so the SPFN server cannot claim that name without the two colliding whenever
+ * they run together.
+ */
+interface SpfnPorts {
+    /** Next.js frontend. Passed to `next` as `-p`. */
+    next?: number;
+    /** SPFN API server. */
+    server?: number;
+}
+interface SpfnAppConfig {
+    ports?: SpfnPorts;
+    /** Host the SPFN API server binds. */
+    host?: string;
+    /** Deployment settings — untouched by this module, kept so the type is whole. */
+    [key: string]: unknown;
+}
+/**
+ * The single place each default exists.
+ *
+ * Defaults live at the bottom of the chain and nowhere else. A default declared
+ * at an input layer — a commander option, a generated entry file, an env schema
+ * — cannot be told apart from a value someone supplied, so it silently outranks
+ * whatever is below it. Three separate defects in this repository came from
+ * exactly that, including an env schema default that forced the environment to
+ * be consulted last and made an injected port unreachable.
+ */
+declare const PORT_DEFAULTS: {
+    readonly next: 3790;
+    readonly server: 8790;
+};
+declare const HOST_DEFAULT = "localhost";
+/**
+ * Read `spfn.config.js` from an app directory.
+ *
+ * Returns an empty object when there is no file, and also when the file cannot
+ * be imported — a malformed deployment config must not stop a server from
+ * booting. The caller decides whether the absence is worth reporting.
+ */
+declare function loadAppConfig(cwd?: string): Promise<SpfnAppConfig>;
+/**
+ * The port each process binds, given a loaded config and the environment.
+ *
+ * Three layers, in this order, and no more: environment variable, then
+ * `spfn.config.js`, then the default.
+ */
+declare function resolvePorts(config: SpfnAppConfig, env?: NodeJS.ProcessEnv): {
+    next: number;
+    server: number;
+};
+/**
+ * The host the SPFN server binds, on the same three layers.
+ *
+ * `localhost` by default: a container states `SPFN_HOST=0.0.0.0` in its own
+ * files, where that decision belongs, rather than every developer machine
+ * publishing a dev server to its network.
+ */
+declare function resolveHost(config: SpfnAppConfig, env?: NodeJS.ProcessEnv): string;
+/**
+ * Where the SPFN server binds, including the address a server config may still
+ * carry through `.port()` / `.host()`.
+ *
+ * Those two are deprecated and sit between `spfn.config.js` and the default for
+ * one release, so an app that has not moved yet keeps the address it had. Once
+ * they are removed this collapses back to {@link resolvePorts} and
+ * {@link resolveHost}.
+ */
+declare function resolveServerAddress(config: SpfnAppConfig, deprecated?: {
+    port?: number;
+    host?: string;
+}, env?: NodeJS.ProcessEnv): {
+    port: number;
+    host: string;
+};
+
+export { HOST_DEFAULT, PORT_DEFAULTS, type SpfnAppConfig, type SpfnPorts, loadAppConfig, resolveHost, resolvePorts, resolveServerAddress };

package/dist/app-config/index.js

@@ -0,0 +1,58 @@
+import { existsSync } from 'fs';
+import { pathToFileURL } from 'url';
+import { join } from 'path';
+
+// src/app-config/index.ts
+var PORT_DEFAULTS = {
+  next: 3790,
+  server: 8790
+};
+var HOST_DEFAULT = "localhost";
+var CONFIG_FILE_NAMES = [
+  "spfn.config.js",
+  "spfn.config.mjs"
+];
+async function loadAppConfig(cwd = process.cwd()) {
+  for (const fileName of CONFIG_FILE_NAMES) {
+    const fullPath = join(cwd, fileName);
+    if (!existsSync(fullPath)) {
+      continue;
+    }
+    try {
+      const module = await import(pathToFileURL(fullPath).href);
+      return module.default ?? {};
+    } catch (error) {
+      console.warn(
+        `\u26A0\uFE0F  ${fileName} could not be imported \u2014 falling back to defaults for ports and host. ${error instanceof Error ? error.message : String(error)}`
+      );
+      return {};
+    }
+  }
+  return {};
+}
+function resolvePorts(config, env = process.env) {
+  return {
+    next: readPort(env.NEXT_PORT) ?? config.ports?.next ?? PORT_DEFAULTS.next,
+    server: readPort(env.SPFN_PORT) ?? config.ports?.server ?? PORT_DEFAULTS.server
+  };
+}
+function resolveHost(config, env = process.env) {
+  return env.SPFN_HOST || config.host || HOST_DEFAULT;
+}
+function resolveServerAddress(config, deprecated = {}, env = process.env) {
+  return {
+    port: readPort(env.SPFN_PORT) ?? config.ports?.server ?? deprecated.port ?? PORT_DEFAULTS.server,
+    host: env.SPFN_HOST || config.host || deprecated.host || HOST_DEFAULT
+  };
+}
+function readPort(value) {
+  if (!value) {
+    return void 0;
+  }
+  const port = Number(value);
+  return Number.isInteger(port) && port > 0 && port < 65536 ? port : void 0;
+}
+
+export { HOST_DEFAULT, PORT_DEFAULTS, loadAppConfig, resolveHost, resolvePorts, resolveServerAddress };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/app-config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/app-config/index.ts"],"names":[],"mappings":";;;;;AA2DO,IAAM,aAAA,GAAgB;AAAA,EACzB,IAAA,EAAM,IAAA;AAAA,EACN,MAAA,EAAQ;AACZ;AAEO,IAAM,YAAA,GAAe;AAE5B,IAAM,iBAAA,GAAoB;AAAA,EACtB,gBAAA;AAAA,EACA;AACJ,CAAA;AASA,eAAsB,aAAA,CAAc,GAAA,GAAc,OAAA,CAAQ,GAAA,EAAI,EAC9D;AACI,EAAA,KAAA,MAAW,YAAY,iBAAA,EACvB;AACI,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAK,QAAQ,CAAA;AAEnC,IAAA,IAAI,CAAC,UAAA,CAAW,QAAQ,CAAA,EACxB;AACI,MAAA;AAAA,IACJ;AAEA,IAAA,IACA;AAGI,MAAA,MAAM,MAAA,GAAS,MAAM,OAAO,aAAA,CAAc,QAAQ,CAAA,CAAE,IAAA,CAAA;AAEpD,MAAA,OAAQ,MAAA,CAAO,WAAW,EAAC;AAAA,IAC/B,SACO,KAAA,EACP;AAQI,MAAA,OAAA,CAAQ,IAAA;AAAA,QACJ,CAAA,cAAA,EAAO,QAAQ,CAAA,2EAAA,EACU,KAAA,YAAiB,QAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,OACnF;AAEA,MAAA,OAAO,EAAC;AAAA,IACZ;AAAA,EACJ;AAEA,EAAA,OAAO,EAAC;AACZ;AAQO,SAAS,YAAA,CACZ,MAAA,EACA,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAErC;AACI,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,SAAS,GAAA,CAAI,SAAS,KAAK,MAAA,CAAO,KAAA,EAAO,QAAQ,aAAA,CAAc,IAAA;AAAA,IACrE,MAAA,EAAQ,SAAS,GAAA,CAAI,SAAS,KAAK,MAAA,CAAO,KAAA,EAAO,UAAU,aAAA,CAAc;AAAA,GAC7E;AACJ;AASO,SAAS,WAAA,CACZ,MAAA,EACA,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAErC;AACI,EAAA,OAAO,GAAA,CAAI,SAAA,IAAa,MAAA,CAAO,IAAA,IAAQ,YAAA;AAC3C;AAWO,SAAS,qBACZ,MAAA,EACA,UAAA,GAA+C,EAAC,EAChD,GAAA,GAAyB,QAAQ,GAAA,EAErC;AACI,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,QAAA,CAAS,GAAA,CAAI,SAAS,CAAA,IACrB,OAAO,KAAA,EAAO,MAAA,IACd,UAAA,CAAW,IAAA,IACX,aAAA,CAAc,MAAA;AAAA,IACrB,MAAM,GAAA,CAAI,SAAA,IACH,MAAA,CAAO,IAAA,IACP,WAAW,IAAA,IACX;AAAA,GACX;AACJ;AAEA,SAAS,SAAS,KAAA,EAClB;AACI,EAAA,IAAI,CAAC,KAAA,EACL;AACI,IAAA,OAAO,MAAA;AAAA,EACX;AAEA,EAAA,MAAM,IAAA,GAAO,OAAO,KAAK,CAAA;AAEzB,EAAA,OAAO,MAAA,CAAO,UAAU,IAAI,CAAA,IAAK,OAAO,CAAA,IAAK,IAAA,GAAO,QAAQ,IAAA,GAAO,MAAA;AACvE","file":"index.js","sourcesContent":["/**\n * `spfn.config.js` — the app's serving shape, read by both the CLI and the server.\n *\n * The file has existed since `spfn init` started writing it, and until now\n * nothing read it back. It is the one committed place that describes how an app\n * is served, which makes it the right home for the ports: an app that wants a\n * different port says so once here instead of repeating the number across its\n * `server.config.ts`, Dockerfile, compose file, `next.config.ts` and env\n * example, where nothing checks that the copies still agree.\n *\n * This module is deliberately free of side effects. `@spfn/core/config`\n * validates the whole environment schema the moment it is imported, which is\n * fine inside a server and wrong inside a CLI that has not been handed an\n * app's environment yet.\n *\n * @module app-config\n */\n\nimport { existsSync } from 'fs';\nimport { pathToFileURL } from 'url';\nimport { join } from 'path';\n\n/**\n * Ports the app is served on.\n *\n * Two names because two processes are started. Next.js reads `PORT` as its own,\n * so the SPFN server cannot claim that name without the two colliding whenever\n * they run together.\n */\nexport interface SpfnPorts\n{\n    /** Next.js frontend. Passed to `next` as `-p`. */\n    next?: number;\n\n    /** SPFN API server. */\n    server?: number;\n}\n\nexport interface SpfnAppConfig\n{\n    ports?: SpfnPorts;\n\n    /** Host the SPFN API server binds. */\n    host?: string;\n\n    /** Deployment settings — untouched by this module, kept so the type is whole. */\n    [key: string]: unknown;\n}\n\n/**\n * The single place each default exists.\n *\n * Defaults live at the bottom of the chain and nowhere else. A default declared\n * at an input layer — a commander option, a generated entry file, an env schema\n * — cannot be told apart from a value someone supplied, so it silently outranks\n * whatever is below it. Three separate defects in this repository came from\n * exactly that, including an env schema default that forced the environment to\n * be consulted last and made an injected port unreachable.\n */\nexport const PORT_DEFAULTS = {\n    next: 3790,\n    server: 8790,\n} as const;\n\nexport const HOST_DEFAULT = 'localhost';\n\nconst CONFIG_FILE_NAMES = [\n    'spfn.config.js',\n    'spfn.config.mjs',\n] as const;\n\n/**\n * Read `spfn.config.js` from an app directory.\n *\n * Returns an empty object when there is no file, and also when the file cannot\n * be imported — a malformed deployment config must not stop a server from\n * booting. The caller decides whether the absence is worth reporting.\n */\nexport async function loadAppConfig(cwd: string = process.cwd()): Promise<SpfnAppConfig>\n{\n    for (const fileName of CONFIG_FILE_NAMES)\n    {\n        const fullPath = join(cwd, fileName);\n\n        if (!existsSync(fullPath))\n        {\n            continue;\n        }\n\n        try\n        {\n            // A file URL, not a path: on Windows an absolute path is not a\n            // valid ESM specifier, and this file is imported at runtime.\n            const module = await import(pathToFileURL(fullPath).href);\n\n            return (module.default ?? {}) as SpfnAppConfig;\n        }\n        catch (error)\n        {\n            // Falling back to defaults, and saying so. A file that exists and\n            // cannot be imported is a typo, not an absence — silence would send\n            // the server to port 8790 while its own config named another, and\n            // the only symptom would be a port nobody chose.\n            //\n            // console, not the server logger: this runs inside the CLI too,\n            // before any logger is configured.\n            console.warn(\n                `⚠️  ${fileName} could not be imported — falling back to defaults `\n                + `for ports and host. ${error instanceof Error ? error.message : String(error)}`,\n            );\n\n            return {};\n        }\n    }\n\n    return {};\n}\n\n/**\n * The port each process binds, given a loaded config and the environment.\n *\n * Three layers, in this order, and no more: environment variable, then\n * `spfn.config.js`, then the default.\n */\nexport function resolvePorts(\n    config: SpfnAppConfig,\n    env: NodeJS.ProcessEnv = process.env,\n): { next: number; server: number }\n{\n    return {\n        next: readPort(env.NEXT_PORT) ?? config.ports?.next ?? PORT_DEFAULTS.next,\n        server: readPort(env.SPFN_PORT) ?? config.ports?.server ?? PORT_DEFAULTS.server,\n    };\n}\n\n/**\n * The host the SPFN server binds, on the same three layers.\n *\n * `localhost` by default: a container states `SPFN_HOST=0.0.0.0` in its own\n * files, where that decision belongs, rather than every developer machine\n * publishing a dev server to its network.\n */\nexport function resolveHost(\n    config: SpfnAppConfig,\n    env: NodeJS.ProcessEnv = process.env,\n): string\n{\n    return env.SPFN_HOST || config.host || HOST_DEFAULT;\n}\n\n/**\n * Where the SPFN server binds, including the address a server config may still\n * carry through `.port()` / `.host()`.\n *\n * Those two are deprecated and sit between `spfn.config.js` and the default for\n * one release, so an app that has not moved yet keeps the address it had. Once\n * they are removed this collapses back to {@link resolvePorts} and\n * {@link resolveHost}.\n */\nexport function resolveServerAddress(\n    config: SpfnAppConfig,\n    deprecated: { port?: number; host?: string } = {},\n    env: NodeJS.ProcessEnv = process.env,\n): { port: number; host: string }\n{\n    return {\n        port: readPort(env.SPFN_PORT)\n            ?? config.ports?.server\n            ?? deprecated.port\n            ?? PORT_DEFAULTS.server,\n        host: env.SPFN_HOST\n            || config.host\n            || deprecated.host\n            || HOST_DEFAULT,\n    };\n}\n\nfunction readPort(value: string | undefined): number | undefined\n{\n    if (!value)\n    {\n        return undefined;\n    }\n\n    const port = Number(value);\n\n    return Number.isInteger(port) && port > 0 && port < 65536 ? port : undefined;\n}\n"]}

package/dist/authz/index.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @spfn/core/authz - Authorization primitives
+ *
+ * Small, domain-agnostic guards for resource ownership. The point is to make the
+ * "load, then check it belongs to the requester" step a single call so a handler
+ * can't forget it and leak another user's data (IDOR).
+ */
+interface RequireOwnerOptions<T> {
+    /**
+     * Property on the resource holding the owner id. Defaults to `'ownerId'`.
+     * SPFN entities commonly use `userId` / `createdBy` — pass it explicitly:
+     * `requireOwner(doc, userId, { ownerKey: 'userId' })`.
+     */
+    ownerKey?: keyof T;
+    /** Message for the thrown NotFoundError. @default 'not found' */
+    message?: string;
+}
+/**
+ * Return the resource only if it exists and belongs to `ownerId`; otherwise throw
+ * `NotFoundError`. Not-found and not-owned are deliberately the same response, so
+ * the endpoint never reveals that a resource exists to a non-owner.
+ *
+ * Ids are compared as strings, so number/string/bigint ids interoperate. A
+ * missing or null owner value never matches, so it throws.
+ *
+ * @example
+ * ```ts
+ * const chat = requireOwner(await chats.findById(id), userId, { ownerKey: 'userId' });
+ * // chat is non-null here, narrowed from T | null
+ * ```
+ */
+declare function requireOwner<T extends object>(resource: T | null | undefined, ownerId: string | number | bigint, options?: RequireOwnerOptions<T>): T;
+
+export { type RequireOwnerOptions, requireOwner };

package/dist/authz/index.js

@@ -0,0 +1,430 @@
+import { logger } from '@spfn/core/logger';
+
+// src/errors/error-registry.ts
+var ErrorRegistry = class _ErrorRegistry {
+  errors = /* @__PURE__ */ new Map();
+  constructor(initialErrors) {
+    if (initialErrors) {
+      for (const input of initialErrors) {
+        if (input instanceof _ErrorRegistry) {
+          this.concat(input);
+        } else if (Array.isArray(input)) {
+          this.append(input);
+        } else {
+          this.append(input);
+        }
+      }
+    }
+  }
+  /**
+   * Append error class(es) to the registry
+   *
+   * @param input - Error constructor or array of constructors
+   * @returns This registry for chaining
+   */
+  append(input) {
+    if (Array.isArray(input)) {
+      for (const ErrorClass of input) {
+        this.errors.set(ErrorClass.name, ErrorClass);
+      }
+    } else {
+      this.errors.set(input.name, input);
+    }
+    return this;
+  }
+  /**
+   * Concatenate another ErrorRegistry into this one
+   *
+   * @param registry - Another ErrorRegistry to merge
+   * @returns This registry for chaining
+   */
+  concat(registry) {
+    for (const [name, ErrorClass] of registry.errors) {
+      this.errors.set(name, ErrorClass);
+    }
+    return this;
+  }
+  /**
+   * Check if error type is registered
+   *
+   * @param name - Error class name
+   */
+  has(name) {
+    return this.errors.has(name);
+  }
+  /**
+   * Deserialize error from JSON data
+   *
+   * @param data - Serialized error data with __type field
+   * @returns Deserialized error instance
+   * @throws Error if error type is not registered
+   */
+  deserialize(data) {
+    const ErrorClass = this.errors.get(data.__type);
+    if (!ErrorClass) {
+      throw new Error(`Unknown error type: ${data.__type}`);
+    }
+    const { __type: _type, error: _envelope, ...fields } = data;
+    return new ErrorClass(fields);
+  }
+  /**
+   * Try to deserialize error, return null if type unknown
+   *
+   * @param data - Serialized error data
+   * @returns Deserialized error or null
+   */
+  tryDeserialize(data) {
+    if (!data.__type || !this.has(data.__type)) {
+      return null;
+    }
+    try {
+      return this.deserialize(data);
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Get all registered error types
+   */
+  getRegisteredTypes() {
+    return Array.from(this.errors.keys());
+  }
+};
+var RESERVED_RESPONSE_KEYS = /* @__PURE__ */ new Set(["__type", "message", "error"]);
+var AUTHORING_ENVIRONMENTS = /* @__PURE__ */ new Set(["local", "development", "test"]);
+function refuseReservedKey(className, key) {
+  const detail = `${className} declares the reserved field "${key}". Reserved response keys: ${[...RESERVED_RESPONSE_KEYS].join(", ")}. Rename the field.`;
+  if (AUTHORING_ENVIRONMENTS.has(process.env.NODE_ENV ?? "local")) {
+    throw new Error(detail);
+  }
+  logger.error(`[SerializableError] ${detail} The field is omitted from the response.`);
+}
+var SerializableError = class extends Error {
+  /**
+   * Serialize error to JSON-compatible object
+   *
+   * Automatically includes:
+   * - __type: Constructor name for deserialization
+   * - message: Error message
+   * - All public instance properties (except name, stack)
+   */
+  toJSON() {
+    const json = {
+      __type: this.constructor.name,
+      message: this.message
+    };
+    for (const key of Object.keys(this)) {
+      if (key === "name" || key === "stack" || key === "statusCode") {
+        continue;
+      }
+      if (RESERVED_RESPONSE_KEYS.has(key)) {
+        refuseReservedKey(this.constructor.name, key);
+        continue;
+      }
+      json[key] = this[key];
+    }
+    return json;
+  }
+};
+
+// src/errors/http-errors.ts
+var HttpError = class extends SerializableError {
+  statusCode;
+  details;
+  constructor(data) {
+    super(data.message);
+    this.name = "HttpError";
+    this.statusCode = data.statusCode;
+    if (data.details) {
+      this.details = data.details;
+    }
+    Error.captureStackTrace(this, this.constructor);
+  }
+};
+var BadRequestError = class extends HttpError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Bad request",
+      statusCode: 400,
+      details: data.details
+    });
+    this.name = "BadRequestError";
+  }
+};
+var ValidationError = class extends HttpError {
+  fields;
+  constructor(data) {
+    super({
+      message: data.message,
+      statusCode: 400,
+      details: data.details
+    });
+    this.name = "ValidationError";
+    if (data.fields) {
+      this.fields = data.fields;
+    }
+  }
+};
+var UnauthorizedError = class extends HttpError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Authentication required",
+      statusCode: 401,
+      details: data.details
+    });
+    this.name = "UnauthorizedError";
+  }
+};
+var ForbiddenError = class extends HttpError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Access forbidden",
+      statusCode: 403,
+      details: data.details
+    });
+    this.name = "ForbiddenError";
+  }
+};
+var NotFoundError = class extends HttpError {
+  resource;
+  constructor(data = {}) {
+    super({
+      message: data.message || "Resource not found",
+      statusCode: 404,
+      details: data.details
+    });
+    this.name = "NotFoundError";
+    if (data.resource) {
+      this.resource = data.resource;
+    }
+  }
+};
+var ConflictError = class extends HttpError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Resource conflict",
+      statusCode: 409,
+      details: data.details
+    });
+    this.name = "ConflictError";
+  }
+};
+var GoneError = class extends HttpError {
+  resource;
+  constructor(data = {}) {
+    super({
+      message: data.message || "Resource permanently deleted",
+      statusCode: 410,
+      details: data.details
+    });
+    this.name = "GoneError";
+    if (data.resource) {
+      this.resource = data.resource;
+    }
+  }
+};
+var TooManyRequestsError = class extends HttpError {
+  retryAfter;
+  constructor(data = {}) {
+    super({
+      message: data.message || "Too many requests",
+      statusCode: 429,
+      details: data.details
+    });
+    this.name = "TooManyRequestsError";
+    if (data.retryAfter) {
+      this.retryAfter = data.retryAfter;
+    }
+  }
+};
+var InternalServerError = class extends HttpError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Internal server error",
+      statusCode: 500,
+      details: data.details
+    });
+    this.name = "InternalServerError";
+  }
+};
+var UnsupportedMediaTypeError = class extends HttpError {
+  mediaType;
+  supportedTypes;
+  constructor(data = {}) {
+    super({
+      message: data.message || "Unsupported media type",
+      statusCode: 415,
+      details: data.details
+    });
+    this.name = "UnsupportedMediaTypeError";
+    if (data.mediaType) {
+      this.mediaType = data.mediaType;
+    }
+    if (data.supportedTypes) {
+      this.supportedTypes = data.supportedTypes;
+    }
+  }
+};
+var UnprocessableEntityError = class extends HttpError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Unprocessable entity",
+      statusCode: 422,
+      details: data.details
+    });
+    this.name = "UnprocessableEntityError";
+  }
+};
+var ServiceUnavailableError = class extends HttpError {
+  retryAfter;
+  constructor(data = {}) {
+    super({
+      message: data.message || "Service unavailable",
+      statusCode: 503,
+      details: data.details
+    });
+    this.name = "ServiceUnavailableError";
+    if (data.retryAfter) {
+      this.retryAfter = data.retryAfter;
+    }
+  }
+};
+
+// src/errors/database-errors.ts
+var DatabaseError = class extends SerializableError {
+  statusCode;
+  details;
+  constructor(data) {
+    super(data.message);
+    this.name = "DatabaseError";
+    this.statusCode = data.statusCode ?? 500;
+    this.details = data.details;
+    Error.captureStackTrace(this, this.constructor);
+  }
+  /**
+   * Whether this error's message/details are derived from the raw database
+   * driver (SQL text, table/column/constraint names, parameter values) and
+   * therefore must NOT be exposed to clients in production. Defined as a
+   * prototype getter so it is never serialized into the response by toJSON().
+   * Subclasses with a safe, constructed message override this to `false`.
+   */
+  get internal() {
+    return true;
+  }
+};
+var ConnectionError = class extends DatabaseError {
+  constructor(data) {
+    super({ message: data.message, statusCode: 503, details: data.details });
+    this.name = "ConnectionError";
+  }
+};
+var QueryError = class extends DatabaseError {
+  constructor(data) {
+    super({
+      message: data.message,
+      statusCode: data.statusCode ?? 500,
+      details: data.details
+    });
+    this.name = "QueryError";
+  }
+};
+var EntityNotFoundError = class extends QueryError {
+  resource;
+  id;
+  constructor(data) {
+    super({
+      message: `${data.resource} with id ${data.id} not found`,
+      statusCode: 404,
+      details: { resource: data.resource, id: data.id }
+    });
+    this.name = "EntityNotFoundError";
+    this.resource = data.resource;
+    this.id = data.id;
+  }
+  // Message/details are constructed from the resource + id, not driver text
+  get internal() {
+    return false;
+  }
+};
+var ConstraintViolationError = class extends QueryError {
+  constructor(data) {
+    super({ message: data.message, statusCode: 400, details: data.details });
+    this.name = "ConstraintViolationError";
+  }
+};
+var TransactionError = class extends DatabaseError {
+  constructor(data) {
+    super({
+      message: data.message,
+      statusCode: data.statusCode ?? 500,
+      details: data.details
+    });
+    this.name = "TransactionError";
+  }
+};
+var DeadlockError = class extends TransactionError {
+  constructor(data) {
+    super({ message: data.message, statusCode: 409, details: data.details });
+    this.name = "DeadlockError";
+  }
+};
+var DuplicateEntryError = class extends QueryError {
+  field;
+  value;
+  constructor(data) {
+    super({
+      message: `${data.field} already exists`,
+      statusCode: 409,
+      details: { field: data.field }
+    });
+    this.name = "DuplicateEntryError";
+    this.field = data.field;
+    this.value = data.value;
+  }
+  // Field-only message/details — safe to surface to the client (not internal)
+  get internal() {
+    return false;
+  }
+};
+
+// src/errors/index.ts
+var errorRegistry = new ErrorRegistry();
+errorRegistry.append([
+  HttpError,
+  BadRequestError,
+  ValidationError,
+  UnauthorizedError,
+  ForbiddenError,
+  NotFoundError,
+  ConflictError,
+  GoneError,
+  TooManyRequestsError,
+  UnsupportedMediaTypeError,
+  UnprocessableEntityError,
+  InternalServerError,
+  ServiceUnavailableError
+]);
+errorRegistry.append([
+  DatabaseError,
+  ConnectionError,
+  QueryError,
+  EntityNotFoundError,
+  ConstraintViolationError,
+  TransactionError,
+  DeadlockError,
+  DuplicateEntryError
+]);
+
+// src/authz/index.ts
+function requireOwner(resource, ownerId, options = {}) {
+  const ownerKey = options.ownerKey ?? "ownerId";
+  const value = resource ? resource[ownerKey] : void 0;
+  if (!resource || value === null || value === void 0 || String(value) !== String(ownerId)) {
+    throw new NotFoundError({ message: options.message ?? "not found" });
+  }
+  return resource;
+}
+
+export { requireOwner };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map