@syncular/server-hono 0.0.6-95 → 0.2.0

package/src/index.ts

@@ -1,42 +1,186 @@
 /**
- * @syncular/server-hono - Hono adapter for sync infrastructure
- *
- * This package provides Hono-specific routes for @syncular/server.
- * Keeps @syncular/server framework-agnostic.
+ * Hono adapter (REVISE B2): a thin wrapper proving the embed boundary.
+ * Hono is a dependency of this adapter only, never of the server core.
+ * Mounts the §1.1 routes: POST /sync and GET /segments/:segmentId
+ * (realtime upgrades are runtime-specific and stay with the host).
  */
+import {
+  encodeSegmentBody,
+  errorBody,
+  handleBlobDownload,
+  handleBlobUpload,
+  handleBlobUploadGrant,
+  handleSegmentDownload,
+  handleSyncRequest,
+  SSP2_CONTENT_TYPE,
+  SyncError,
+  type SyncServerConfig,
+} from '@syncular/server';
+import { Hono } from 'hono';
 
-// API Key Auth
-export * from './api-key-auth';
+export * from './admin';
 
-// Blob routes
-export { type CreateBlobRoutesOptions, createBlobRoutes } from './blobs';
+export interface SyncularHonoOptions {
+  readonly config: SyncServerConfig;
+  /** Host authentication (§1.1); `null` ⇒ 401 `sync.auth_required`. */
+  readonly authenticate: (
+    request: Request,
+  ) => Promise<{ actorId: string; partition: string } | null>;
+}
 
-// Console
-export * from './console';
+function errorResponse(error: unknown): Response {
+  const sync =
+    error instanceof SyncError
+      ? error
+      : new SyncError('sync.invalid_request', String(error));
+  return Response.json(errorBody(sync), { status: sync.httpStatus });
+}
 
-// Simplified server factory
-export {
-  createSyncServer,
-  type SyncServerOptions,
-  type SyncServerResult,
-} from './create-server';
+export function createSyncularHono(options: SyncularHonoOptions): Hono {
+  const app = new Hono();
 
-// OpenAPI utilities
-export * from './openapi';
+  app.post('/sync', async (c) => {
+    const contentType = c.req.header('content-type')?.split(';')[0]?.trim();
+    if (contentType !== SSP2_CONTENT_TYPE) {
+      // §1.1: any other content type is rejected with HTTP 415.
+      return Response.json(
+        errorBody(
+          new SyncError('sync.invalid_request', 'unsupported content type'),
+        ),
+        { status: 415 },
+      );
+    }
+    const auth = await options.authenticate(c.req.raw);
+    if (auth === null)
+      return errorResponse(new SyncError('sync.auth_required'));
+    try {
+      const bytes = new Uint8Array(await c.req.arrayBuffer());
+      const out = await handleSyncRequest(bytes, {
+        ...options.config,
+        ...auth,
+      });
+      return c.body(out.slice().buffer as ArrayBuffer, 200, {
+        'Content-Type': SSP2_CONTENT_TYPE,
+      });
+    } catch (error) {
+      return errorResponse(error);
+    }
+  });
 
-// Proxy
-export * from './proxy';
+  app.get('/segments/:segmentId', async (c) => {
+    const auth = await options.authenticate(c.req.raw);
+    if (auth === null)
+      return errorResponse(new SyncError('sync.auth_required'));
+    try {
+      const result = await handleSegmentDownload(
+        { ...options.config, ...auth },
+        {
+          segmentId: c.req.param('segmentId'),
+          scopesHeader: c.req.header('x-syncular-scopes') ?? '{}',
+        },
+      );
+      if (c.req.header('if-none-match') === result.headers.ETag) {
+        return c.body(null, 304, result.headers);
+      }
+      // §5.8 shipped default: compress the body per Accept-Encoding
+      // (zstd preferred, gzip fallback, identity otherwise). Content
+      // addresses are over the uncompressed bytes (§5.1) — fetch
+      // decodes transparently on the client.
+      const encoded = encodeSegmentBody(
+        result.bytes,
+        c.req.header('accept-encoding'),
+      );
+      return c.body(encoded.bytes.slice().buffer as ArrayBuffer, 200, {
+        ...result.headers,
+        ...(encoded.contentEncoding !== undefined
+          ? { 'Content-Encoding': encoded.contentEncoding }
+          : {}),
+      });
+    } catch (error) {
+      return errorResponse(error);
+    }
+  });
 
-// Rate limiting
-export * from './rate-limit';
+  // §5.9.3: blob upload with server-side content-address verification.
+  app.put('/blobs/:blobId', async (c) => {
+    const auth = await options.authenticate(c.req.raw);
+    if (auth === null)
+      return errorResponse(new SyncError('sync.auth_required'));
+    try {
+      const bytes = new Uint8Array(await c.req.arrayBuffer());
+      const contentType = c.req.header('content-type')?.split(';')[0]?.trim();
+      await handleBlobUpload(
+        { ...options.config, ...auth },
+        {
+          blobId: c.req.param('blobId'),
+          bytes,
+          ...(contentType !== undefined &&
+          contentType !== 'application/octet-stream'
+            ? { mediaType: contentType }
+            : {}),
+        },
+      );
+      return c.body(null, 200);
+    } catch (error) {
+      return errorResponse(error);
+    }
+  });
 
-// Route types and factory
-export {
-  type CreateSyncRoutesOptions,
-  createSyncRoutes,
-  getSyncRealtimeUnsubscribe,
-  getSyncWebSocketConnectionManager,
-} from './routes';
+  // §5.9.3: presigned-upload grant — mint a direct-to-storage PUT URL.
+  app.post('/blobs/:blobId/upload-grant', async (c) => {
+    const auth = await options.authenticate(c.req.raw);
+    if (auth === null)
+      return errorResponse(new SyncError('sync.auth_required'));
+    try {
+      const body = (await c.req.json().catch(() => ({}))) as {
+        byteLength?: number;
+        mediaType?: string;
+      };
+      const grant = await handleBlobUploadGrant(
+        { ...options.config, ...auth },
+        {
+          blobId: c.req.param('blobId'),
+          byteLength: Number(body.byteLength ?? 0),
+          ...(typeof body.mediaType === 'string'
+            ? { mediaType: body.mediaType }
+            : {}),
+        },
+      );
+      return c.json(grant, 200);
+    } catch (error) {
+      return errorResponse(error);
+    }
+  });
 
-// WebSocket helpers for realtime sync
-export * from './ws';
+  // §5.9.5: blob download, re-authorized against referencing rows. When the
+  // host configured presigned URLs, the result carries `url` (no bytes) and
+  // the client fetches it directly (§5.9.5 always-issue).
+  app.get('/blobs/:blobId', async (c) => {
+    const auth = await options.authenticate(c.req.raw);
+    if (auth === null)
+      return errorResponse(new SyncError('sync.auth_required'));
+    try {
+      const result = await handleBlobDownload(
+        { ...options.config, ...auth },
+        c.req.param('blobId'),
+      );
+      if (result.url !== undefined) {
+        return c.json(
+          { url: result.url, urlExpiresAtMs: result.urlExpiresAtMs },
+          200,
+        );
+      }
+      if (c.req.header('if-none-match') === result.headers.ETag) {
+        return c.body(null, 304, result.headers);
+      }
+      const bytes = result.bytes ?? new Uint8Array(0);
+      return c.body(bytes.slice().buffer as ArrayBuffer, 200, {
+        ...result.headers,
+      });
+    } catch (error) {
+      return errorResponse(error);
+    }
+  });
+
+  return app;
+}

package/dist/api-key-auth.d.ts

@@ -1,49 +0,0 @@
-/**
- * @syncular/server-hono - API Key Authentication Helper
- *
- * Provides utilities for validating API keys in relay/proxy routes.
- */
-import type { ServerSyncDialect } from '@syncular/server';
-import type { Context } from 'hono';
-import { type Kysely } from 'kysely';
-import { type ApiKeyType } from './console/schemas';
-interface SyncApiKeysTable {
-    key_id: string;
-    key_hash: string;
-    key_prefix: string;
-    name: string;
-    key_type: string;
-    scope_keys: unknown | null;
-    actor_id: string | null;
-    created_at: string;
-    expires_at: string | null;
-    last_used_at: string | null;
-    revoked_at: string | null;
-}
-type ApiKeyDb = {
-    sync_api_keys: SyncApiKeysTable;
-};
-interface ValidateApiKeyResult {
-    keyId: string;
-    keyType: ApiKeyType;
-    actorId: string | null;
-    scopeKeys: string[];
-}
-/**
- * Validates an API key from Authorization header.
- * Updates last_used_at on successful validation.
- */
-export declare function validateApiKey<DB extends ApiKeyDb>(db: Kysely<DB>, dialect: ServerSyncDialect, authHeader: string | undefined): Promise<ValidateApiKeyResult | null>;
-/**
- * Creates an authenticator for relay/proxy routes.
- * Returns actorId from the API key if valid and allowed.
- */
-export declare function createApiKeyAuthenticator<DB extends ApiKeyDb>(db: Kysely<DB>, dialect: ServerSyncDialect, allowedTypes: ApiKeyType[]): (c: Context) => Promise<{
-    actorId: string;
-} | null>;
-/**
- * Middleware that validates API key and attaches result to context.
- */
-export declare function apiKeyAuthMiddleware<DB extends ApiKeyDb>(db: Kysely<DB>, dialect: ServerSyncDialect, allowedTypes: ApiKeyType[]): (c: Context<any, any, {}>, next: () => Promise<void>) => Promise<Response | undefined>;
-export {};
-//# sourceMappingURL=api-key-auth.d.ts.map

package/dist/api-key-auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-key-auth.d.ts","sourceRoot":"","sources":["../src/api-key-auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,KAAK,MAAM,EAAO,MAAM,QAAQ,CAAC;AAC1C,OAAO,EAAE,KAAK,UAAU,EAAoB,MAAM,mBAAmB,CAAC;AAEtE,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,KAAK,QAAQ,GAAG;IACd,aAAa,EAAE,gBAAgB,CAAC;CACjC,CAAC;AAEF,UAAU,oBAAoB;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,UAAU,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,EAAE,SAAS,QAAQ,EACtD,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EACd,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAkEtC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,EAAE,SAAS,QAAQ,EAC3D,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EACd,OAAO,EAAE,iBAAiB,EAC1B,YAAY,EAAE,UAAU,EAAE,GACzB,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAmBrD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,SAAS,QAAQ,EACtD,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EACd,OAAO,EAAE,iBAAiB,EAC1B,YAAY,EAAE,UAAU,EAAE,0FAsB3B"}

package/dist/api-key-auth.js

@@ -1,110 +0,0 @@
-/**
- * @syncular/server-hono - API Key Authentication Helper
- *
- * Provides utilities for validating API keys in relay/proxy routes.
- */
-import { sql } from 'kysely';
-import { ApiKeyTypeSchema } from './console/schemas.js';
-/**
- * Validates an API key from Authorization header.
- * Updates last_used_at on successful validation.
- */
-export async function validateApiKey(db, dialect, authHeader) {
-    if (!authHeader?.startsWith('Bearer ')) {
-        return null;
-    }
-    const secretKey = authHeader.slice(7);
-    if (!secretKey || !secretKey.startsWith('sk_')) {
-        return null;
-    }
-    // Hash the provided key
-    const keyHash = await hashApiKey(secretKey);
-    // Look up key by hash
-    const rowResult = await sql `
-    select key_id, key_type, actor_id, scope_keys, expires_at, revoked_at
-    from ${sql.table('sync_api_keys')}
-    where key_hash = ${keyHash}
-    limit 1
-  `.execute(db);
-    const row = rowResult.rows[0];
-    if (!row) {
-        return null;
-    }
-    const parsedKeyType = ApiKeyTypeSchema.safeParse(row.key_type);
-    if (!parsedKeyType.success)
-        return null;
-    // Check if revoked
-    if (row.revoked_at) {
-        return null;
-    }
-    // Check if expired
-    if (row.expires_at) {
-        const expiresAt = new Date(row.expires_at);
-        if (expiresAt < new Date()) {
-            return null;
-        }
-    }
-    // Update last_used_at
-    const now = new Date().toISOString();
-    await sql `
-    update ${sql.table('sync_api_keys')}
-    set last_used_at = ${now}
-    where key_id = ${row.key_id}
-  `.execute(db);
-    // Parse scopes
-    const scopeKeys = dialect.dbToArray(row.scope_keys);
-    return {
-        keyId: row.key_id,
-        keyType: parsedKeyType.data,
-        actorId: row.actor_id,
-        scopeKeys,
-    };
-}
-/**
- * Creates an authenticator for relay/proxy routes.
- * Returns actorId from the API key if valid and allowed.
- */
-export function createApiKeyAuthenticator(db, dialect, allowedTypes) {
-    return async (c) => {
-        const authHeader = c.req.header('Authorization');
-        const result = await validateApiKey(db, dialect, authHeader);
-        if (!result) {
-            return null;
-        }
-        // Check if key type is allowed
-        if (!allowedTypes.includes(result.keyType)) {
-            return null;
-        }
-        // Return actorId (use key's actorId if set, otherwise use a default)
-        return {
-            actorId: result.actorId ?? `api-key:${result.keyId}`,
-        };
-    };
-}
-/**
- * Middleware that validates API key and attaches result to context.
- */
-export function apiKeyAuthMiddleware(db, dialect, allowedTypes) {
-    return async (c, next) => {
-        const authHeader = c.req.header('Authorization');
-        const result = await validateApiKey(db, dialect, authHeader);
-        if (!result) {
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        }
-        if (!allowedTypes.includes(result.keyType)) {
-            return c.json({ error: 'FORBIDDEN', message: 'Invalid key type' }, 403);
-        }
-        // Attach to context for downstream handlers
-        c.set('apiKey', result);
-        await next();
-    };
-}
-// Hash function (same as in routes.ts)
-async function hashApiKey(secretKey) {
-    const encoder = new TextEncoder();
-    const data = encoder.encode(secretKey);
-    const hashBuffer = await crypto.subtle.digest('SHA-256', data);
-    const hashArray = new Uint8Array(hashBuffer);
-    return Array.from(hashArray, (b) => b.toString(16).padStart(2, '0')).join('');
-}
-//# sourceMappingURL=api-key-auth.js.map

package/dist/api-key-auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-key-auth.js","sourceRoot":"","sources":["../src/api-key-auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAe,GAAG,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,EAAmB,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA2BtE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAc,EACd,OAA0B,EAC1B,UAA8B,EACQ;IACtC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wBAAwB;IACxB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;IAE5C,sBAAsB;IACtB,MAAM,SAAS,GAAG,MAAM,GAAG,CAOzB;;WAEO,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC;uBACd,OAAO;;GAE3B,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACd,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE9B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,CAAC,aAAa,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAExC,mBAAmB;IACnB,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mBAAmB;IACnB,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,GAAG,CAAA;aACE,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC;yBACd,GAAG;qBACP,GAAG,CAAC,MAAM;GAC5B,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAEd,eAAe;IACf,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEpD,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,MAAM;QACjB,OAAO,EAAE,aAAa,CAAC,IAAI;QAC3B,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,SAAS;KACV,CAAC;AAAA,CACH;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,EAAc,EACd,OAA0B,EAC1B,YAA0B,EAC2B;IACrD,OAAO,KAAK,EAAE,CAAU,EAAE,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAE7D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,+BAA+B;QAC/B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,qEAAqE;QACrE,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,WAAW,MAAM,CAAC,KAAK,EAAE;SACrD,CAAC;IAAA,CACH,CAAC;AAAA,CACH;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,EAAc,EACd,OAA0B,EAC1B,YAA0B,EAC1B;IACA,OAAO,KAAK,EACV,CAAU,EACV,IAAyB,EACM,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAE7D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,4CAA4C;QAC5C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAExB,MAAM,IAAI,EAAE,CAAC;IAAA,CACd,CAAC;AAAA,CACH;AAED,uCAAuC;AACvC,KAAK,UAAU,UAAU,CAAC,SAAiB,EAAmB;IAC5D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAAA,CAC/E"}

package/dist/blobs.d.ts

@@ -1,69 +0,0 @@
-/**
- * @syncular/server-hono - Blob routes for media/binary handling
- *
- * Provides:
- * - POST /blobs/upload - Initiate a blob upload (get presigned URL)
- * - POST /blobs/:hash/complete - Complete a blob upload
- * - GET /blobs/:hash/url - Get a presigned download URL
- * - PUT /blobs/:hash/upload - Direct upload (for database adapter)
- * - GET /blobs/:hash/download - Direct download (for database adapter)
- */
-import type { BlobManager } from '@syncular/server';
-import { type BlobTokenSigner, type SyncBlobsDb } from '@syncular/server';
-import type { Context } from 'hono';
-import { Hono } from 'hono';
-import type { Kysely } from 'kysely';
-interface BlobAuthResult {
-    actorId: string;
-}
-export interface CreateBlobRoutesOptions<DB extends SyncBlobsDb = SyncBlobsDb> {
-    /** Blob manager instance */
-    blobManager: BlobManager;
-    /** Authentication function */
-    authenticate: (c: Context) => Promise<BlobAuthResult | null>;
-    /**
-     * Token signer for database adapter direct uploads/downloads.
-     * Required if using the database blob storage adapter.
-     */
-    tokenSigner?: BlobTokenSigner;
-    /**
-     * Database instance for direct blob storage.
-     * Required if using the database blob storage adapter.
-     */
-    db?: Kysely<DB>;
-    /**
-     * Optional: Check if actor can access a blob.
-     * By default, any authenticated actor can access any completed blob.
-     * Provide this to implement scope-based access control.
-     */
-    canAccessBlob?: (args: {
-        actorId: string;
-        hash: string;
-    }) => Promise<boolean>;
-    /**
-     * Maximum upload size in bytes.
-     * Default: 100MB (104857600)
-     */
-    maxUploadSize?: number;
-}
-/**
- * Create blob routes for Hono.
- *
- * @example
- * ```typescript
- * const blobRoutes = createBlobRoutes({
- *   blobManager,
- *   authenticate: async (c) => {
- *     const token = c.req.header('Authorization')?.replace('Bearer ', '');
- *     if (!token) return null;
- *     const user = await verifyToken(token);
- *     return user ? { actorId: user.id } : null;
- *   },
- * });
- *
- * app.route('/api/sync', blobRoutes);
- * ```
- */
-export declare function createBlobRoutes<DB extends SyncBlobsDb>(options: CreateBlobRoutesOptions<DB>): Hono;
-export {};
-//# sourceMappingURL=blobs.d.ts.map

package/dist/blobs.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"blobs.d.ts","sourceRoot":"","sources":["../src/blobs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,KAAK,EACV,WAAW,EAGZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,WAAW,EAEjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGrC,UAAU,cAAc;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB,CAAC,EAAE,SAAS,WAAW,GAAG,WAAW;IAC3E,4BAA4B;IAC5B,WAAW,EAAE,WAAW,CAAC;IACzB,8BAA8B;IAC9B,YAAY,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC7D;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAChB;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAUD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,SAAS,WAAW,EACrD,OAAO,EAAE,uBAAuB,CAAC,EAAE,CAAC,GACnC,IAAI,CAwZN"}