@teamblind/axeda-better-auth 0.0.0-stage → 0.1.0-alpha.0

package/dist/endpoints-tenants.js

@@ -0,0 +1,247 @@
+import { createAuthEndpoint, sessionMiddleware } from 'better-auth/api';
+import { z } from 'zod';
+import { toBusinessDto, toCompanyDto, toInvitationDto, toAssignmentDto } from './dto.js';
+import { access, cursor, id, limit, pageOf, run, scopeBody, scopeFromQuery, scopeQuery, } from './endpoints.js';
+import { toApiError } from './http-errors.js';
+import { AxedaError } from '@teamblind/axeda-core';
+const deleted = z.enum(['exclude', 'include', 'only']);
+const version = z.number().int().min(1);
+const status = z.enum(['active', 'inactive']);
+const url = z.string().max(2048);
+const slug = z.string().min(1).max(63);
+const name = z.string().min(1).max(200);
+const metadata = z.record(z.string().max(100), z.unknown());
+/** Compañías y negocios. El permiso lo impone el caso de uso (ver `AxedaError` → 403 / 404). */
+export function createTenantEndpoints(core) {
+    return {
+        axedaCompanyList: createAuthEndpoint('/axeda/company/list', {
+            method: 'GET',
+            use: [sessionMiddleware],
+            query: z.strictObject({
+                deleted: deleted.optional(),
+                cursor: cursor.optional(),
+                limit: limit.optional(),
+            }),
+            metadata: access('(membership)', 'per-target'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            const page = await axeda.companies.list(actor, { deleted: ctx.query.deleted }, pageOf(ctx.query));
+            return ctx.json({ items: page.items.map(toCompanyDto), nextCursor: page.nextCursor });
+        })),
+        axedaCompanyGet: createAuthEndpoint('/axeda/company/get', {
+            method: 'GET',
+            use: [sessionMiddleware],
+            query: z.strictObject({ id }),
+            metadata: access('(membership)', 'per-target'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => ctx.json(toCompanyDto(await axeda.companies.get(actor, ctx.query.id))))),
+        axedaCompanyCreate: createAuthEndpoint('/axeda/company/create', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({
+                slug,
+                name,
+                legalName: name.nullish(),
+                logoUrl: url.nullish(),
+                faviconUrl: url.nullish(),
+                metadata: metadata.optional(),
+            }),
+            metadata: access('axeda:company:manage', 'global'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => ctx.json(toCompanyDto(await axeda.companies.create(actor, ctx.body))))),
+        axedaCompanyUpdate: createAuthEndpoint('/axeda/company/update', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({
+                id,
+                version,
+                name: name.optional(),
+                legalName: name.nullish(),
+                logoUrl: url.nullish(),
+                faviconUrl: url.nullish(),
+                metadata: metadata.optional(),
+            }),
+            metadata: access('axeda:company:manage', 'per-target'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            const { id: companyId, version: expected, ...changes } = ctx.body;
+            return ctx.json(toCompanyDto(await axeda.companies.update(actor, companyId, expected, changes)));
+        })),
+        axedaCompanySetStatus: createAuthEndpoint('/axeda/company/set-status', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({ id, version, status }),
+            metadata: access('axeda:company:manage', 'global'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => ctx.json(toCompanyDto(await axeda.companies.setStatus(actor, ctx.body.id, ctx.body.version, ctx.body.status))))),
+        axedaCompanyDelete: createAuthEndpoint('/axeda/company/delete', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({ id, version, immediate: z.boolean().optional() }),
+            metadata: access('axeda:company:manage', 'global'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            await axeda.companies.delete(actor, ctx.body.id, ctx.body.version, {
+                immediate: ctx.body.immediate,
+            });
+            return ctx.json({ deleted: true });
+        })),
+        axedaCompanyRestore: createAuthEndpoint('/axeda/company/restore', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({ id, version }),
+            metadata: access('axeda:company:manage', 'global'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => ctx.json(toCompanyDto(await axeda.companies.restore(actor, ctx.body.id, ctx.body.version))))),
+        axedaBusinessList: createAuthEndpoint('/axeda/business/list', {
+            method: 'GET',
+            use: [sessionMiddleware],
+            query: z.strictObject({
+                companyId: id,
+                deleted: deleted.optional(),
+                cursor: cursor.optional(),
+                limit: limit.optional(),
+            }),
+            metadata: access('(membership)', 'per-target'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            const page = await axeda.businesses.list(actor, ctx.query.companyId, { deleted: ctx.query.deleted }, pageOf(ctx.query));
+            return ctx.json({ items: page.items.map(toBusinessDto), nextCursor: page.nextCursor });
+        })),
+        axedaBusinessGet: createAuthEndpoint('/axeda/business/get', {
+            method: 'GET',
+            use: [sessionMiddleware],
+            query: z.strictObject({ id }),
+            metadata: access('(membership)', 'per-target'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => ctx.json(toBusinessDto(await axeda.businesses.get(actor, ctx.query.id))))),
+        axedaBusinessCreate: createAuthEndpoint('/axeda/business/create', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({
+                companyId: id,
+                slug,
+                name,
+                logoUrl: url.nullish(),
+                faviconUrl: url.nullish(),
+                metadata: metadata.optional(),
+            }),
+            metadata: access('axeda:business:manage', 'per-target'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            const { companyId, ...input } = ctx.body;
+            return ctx.json(toBusinessDto(await axeda.businesses.create(actor, companyId, input)));
+        })),
+        axedaBusinessUpdate: createAuthEndpoint('/axeda/business/update', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({
+                id,
+                version,
+                name: name.optional(),
+                logoUrl: url.nullish(),
+                faviconUrl: url.nullish(),
+                metadata: metadata.optional(),
+            }),
+            metadata: access('axeda:business:manage', 'per-target'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            const { id: businessId, version: expected, ...changes } = ctx.body;
+            return ctx.json(toBusinessDto(await axeda.businesses.update(actor, businessId, expected, changes)));
+        })),
+        axedaBusinessSetStatus: createAuthEndpoint('/axeda/business/set-status', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({ id, version, status }),
+            metadata: access('axeda:business:manage', 'per-target'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => ctx.json(toBusinessDto(await axeda.businesses.setStatus(actor, ctx.body.id, ctx.body.version, ctx.body.status))))),
+        axedaBusinessDelete: createAuthEndpoint('/axeda/business/delete', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({ id, version, immediate: z.boolean().optional() }),
+            metadata: access('axeda:business:manage', 'per-target'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            await axeda.businesses.delete(actor, ctx.body.id, ctx.body.version, {
+                immediate: ctx.body.immediate,
+            });
+            return ctx.json({ deleted: true });
+        })),
+        axedaBusinessRestore: createAuthEndpoint('/axeda/business/restore', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({ id, version }),
+            metadata: access('axeda:business:manage', 'per-target'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => ctx.json(toBusinessDto(await axeda.businesses.restore(actor, ctx.body.id, ctx.body.version))))),
+    };
+}
+/** Invitaciones. Aceptar solo exige sesión: lo que lo autoriza es el secreto y el correo verificado. */
+export function createInvitationEndpoints(core) {
+    return {
+        axedaInvitationList: createAuthEndpoint('/axeda/invitation/list', {
+            method: 'GET',
+            use: [sessionMiddleware],
+            query: z.strictObject({
+                ...scopeQuery,
+                pendingOnly: z.enum(['true', 'false']).optional(),
+                cursor: cursor.optional(),
+                limit: limit.optional(),
+            }),
+            metadata: access('axeda:invitation:manage', 'scope-parameter'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            const scope = scopeFromQuery(ctx.query);
+            if (scope === undefined) {
+                throw new AxedaError('AXEDA_INVALID_INPUT', 'Pass scopeType (and scopeId).');
+            }
+            const page = await axeda.invitations.list(actor, scope, { pendingOnly: ctx.query.pendingOnly === 'true' }, pageOf(ctx.query));
+            return ctx.json({ items: page.items.map(toInvitationDto), nextCursor: page.nextCursor });
+        })),
+        axedaInvitationCreate: createAuthEndpoint('/axeda/invitation/create', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({
+                email: z.string().min(3).max(254),
+                scope: scopeBody,
+                roleIds: z.array(id).min(1).max(50),
+                ttlHours: z
+                    .number()
+                    .int()
+                    .min(1)
+                    .max(24 * 30)
+                    .optional(),
+            }),
+            metadata: access('axeda:invitation:manage', 'scope-parameter'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => ctx.json(toInvitationDto(await axeda.invitations.create(actor, ctx.body))))),
+        axedaInvitationAccept: createAuthEndpoint('/axeda/invitation/accept', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({ token: z.string().min(1).max(512) }),
+            metadata: access('(authenticated; the secret and the verified email authorize)', 'own'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            const created = await axeda.invitations.accept(actor, ctx.body.token);
+            return ctx.json({ assignments: created.map(toAssignmentDto) });
+        })),
+        axedaInvitationRevoke: createAuthEndpoint('/axeda/invitation/revoke', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({ id }),
+            metadata: access('axeda:invitation:manage', 'per-target'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            await axeda.invitations.revoke(actor, ctx.body.id);
+            return ctx.json({ revoked: true });
+        })),
+    };
+}
+/**
+ * Identidad pública: nombre y logos de una compañía o negocio activo. **No** pide sesión, por eso
+ * está aparte y solo se registra si la aplicación lo activa (`publicIdentity: true`). Una
+ * compañía inexistente, inactiva o borrada responde igual: 404.
+ */
+export function createPublicEndpoints(core, enabled) {
+    return {
+        axedaPublicIdentity: createAuthEndpoint('/axeda/public/identity', {
+            method: 'GET',
+            query: z.strictObject({ company: slug, business: slug.optional() }),
+            metadata: { axeda: { public: true, requires: '(public)', scope: 'own' } },
+        }, async (ctx) => {
+            try {
+                const identity = enabled() ? await core().publicIdentity(ctx.query) : null;
+                if (identity === null) {
+                    throw new AxedaError('AXEDA_COMPANY_NOT_FOUND', 'Not found.');
+                }
+                return ctx.json(identity);
+            }
+            catch (error) {
+                throw toApiError(error);
+            }
+        }),
+    };
+}

package/dist/endpoints-users.d.ts

@@ -0,0 +1,242 @@
+import { z } from 'zod';
+import { type CoreProvider } from './endpoints.js';
+/** El primer idioma de `Accept-Language` (`es-MX,es;q=0.9,en;q=0.8` → `es-MX`), si es válido. */
+export declare function localeFromHeader(header: string | null | undefined): string | undefined;
+/**
+ * Administración de usuarios (solo global, `axeda:user:manage`) y el menú de cada persona.
+ * Axeda no maneja contraseñas: `user/create` crea la cuenta sin credencial.
+ */
+export declare function createUserEndpoints(core: CoreProvider): {
+    axedaUserList: import("better-call").StrictEndpoint<"/axeda/user/list", {
+        method: "GET";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+            session: {
+                session: Record<string, any> & {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    userId: string;
+                    expiresAt: Date;
+                    token: string;
+                    ipAddress?: string | null | undefined;
+                    userAgent?: string | null | undefined;
+                };
+                user: Record<string, any> & {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    image?: string | null | undefined;
+                };
+            };
+        }>>[];
+        query: z.ZodObject<{
+            emailPrefix: z.ZodOptional<z.ZodString>;
+            banned: z.ZodOptional<z.ZodEnum<{
+                true: "true";
+                false: "false";
+            }>>;
+            cursor: z.ZodOptional<z.ZodString>;
+            limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+        }, z.core.$strict>;
+        metadata: {
+            axeda: {
+                requires: string;
+                scope: "own" | "any" | "global" | "scope-parameter" | "per-target";
+            };
+        };
+    }, {
+        items: import("./dto.js").ManagedUserDto[];
+        nextCursor: string | null;
+    }>;
+    axedaUserCreate: import("better-call").StrictEndpoint<"/axeda/user/create", {
+        method: "POST";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+            session: {
+                session: Record<string, any> & {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    userId: string;
+                    expiresAt: Date;
+                    token: string;
+                    ipAddress?: string | null | undefined;
+                    userAgent?: string | null | undefined;
+                };
+                user: Record<string, any> & {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    image?: string | null | undefined;
+                };
+            };
+        }>>[];
+        body: z.ZodObject<{
+            email: z.ZodString;
+            name: z.ZodString;
+        }, z.core.$strict>;
+        metadata: {
+            axeda: {
+                requires: string;
+                scope: "own" | "any" | "global" | "scope-parameter" | "per-target";
+            };
+        };
+    }, import("./dto.js").ManagedUserDto>;
+    axedaUserBan: import("better-call").StrictEndpoint<"/axeda/user/ban", {
+        method: "POST";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+            session: {
+                session: Record<string, any> & {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    userId: string;
+                    expiresAt: Date;
+                    token: string;
+                    ipAddress?: string | null | undefined;
+                    userAgent?: string | null | undefined;
+                };
+                user: Record<string, any> & {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    image?: string | null | undefined;
+                };
+            };
+        }>>[];
+        body: z.ZodObject<{
+            id: z.ZodString;
+            reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            expiresAt: z.ZodOptional<z.ZodNullable<z.ZodISODateTime>>;
+        }, z.core.$strict>;
+        metadata: {
+            axeda: {
+                requires: string;
+                scope: "own" | "any" | "global" | "scope-parameter" | "per-target";
+            };
+        };
+    }, import("./dto.js").ManagedUserDto>;
+    axedaUserUnban: import("better-call").StrictEndpoint<"/axeda/user/unban", {
+        method: "POST";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+            session: {
+                session: Record<string, any> & {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    userId: string;
+                    expiresAt: Date;
+                    token: string;
+                    ipAddress?: string | null | undefined;
+                    userAgent?: string | null | undefined;
+                };
+                user: Record<string, any> & {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    image?: string | null | undefined;
+                };
+            };
+        }>>[];
+        body: z.ZodObject<{
+            id: z.ZodString;
+        }, z.core.$strict>;
+        metadata: {
+            axeda: {
+                requires: string;
+                scope: "own" | "any" | "global" | "scope-parameter" | "per-target";
+            };
+        };
+    }, import("./dto.js").ManagedUserDto>;
+    axedaUserRevokeSessions: import("better-call").StrictEndpoint<"/axeda/user/revoke-sessions", {
+        method: "POST";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+            session: {
+                session: Record<string, any> & {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    userId: string;
+                    expiresAt: Date;
+                    token: string;
+                    ipAddress?: string | null | undefined;
+                    userAgent?: string | null | undefined;
+                };
+                user: Record<string, any> & {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    image?: string | null | undefined;
+                };
+            };
+        }>>[];
+        body: z.ZodObject<{
+            id: z.ZodString;
+        }, z.core.$strict>;
+        metadata: {
+            axeda: {
+                requires: string;
+                scope: "own" | "any" | "global" | "scope-parameter" | "per-target";
+            };
+        };
+    }, {
+        revoked: number;
+    }>;
+    axedaMenu: import("better-call").StrictEndpoint<"/axeda/menu", {
+        method: "GET";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+            session: {
+                session: Record<string, any> & {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    userId: string;
+                    expiresAt: Date;
+                    token: string;
+                    ipAddress?: string | null | undefined;
+                    userAgent?: string | null | undefined;
+                };
+                user: Record<string, any> & {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    image?: string | null | undefined;
+                };
+            };
+        }>>[];
+        query: z.ZodObject<{
+            locale: z.ZodOptional<z.ZodString>;
+            scopeType: z.ZodOptional<z.ZodEnum<{
+                company: "company";
+                business: "business";
+                global: "global";
+            }>>;
+            scopeId: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        metadata: {
+            axeda: {
+                requires: string;
+                scope: "own" | "any" | "global" | "scope-parameter" | "per-target";
+            };
+        };
+    }, {
+        items: import("@teamblind/axeda-core").MenuNode[];
+    }>;
+};

package/dist/endpoints-users.js

@@ -0,0 +1,85 @@
+import { createAuthEndpoint, sessionMiddleware } from 'better-auth/api';
+import { z } from 'zod';
+import { toManagedUserDto } from './dto.js';
+import { access, cursor, id, limit, pageOf, run, scopeFromQuery, scopeQuery, } from './endpoints.js';
+const LOCALE = /^[A-Za-z]{2}(-[A-Za-z0-9]{2,8})?$/;
+/** El primer idioma de `Accept-Language` (`es-MX,es;q=0.9,en;q=0.8` → `es-MX`), si es válido. */
+export function localeFromHeader(header) {
+    const first = header?.split(',')[0]?.split(';')[0]?.trim();
+    return first !== undefined && LOCALE.test(first) ? first : undefined;
+}
+/**
+ * Administración de usuarios (solo global, `axeda:user:manage`) y el menú de cada persona.
+ * Axeda no maneja contraseñas: `user/create` crea la cuenta sin credencial.
+ */
+export function createUserEndpoints(core) {
+    return {
+        axedaUserList: createAuthEndpoint('/axeda/user/list', {
+            method: 'GET',
+            use: [sessionMiddleware],
+            query: z.strictObject({
+                emailPrefix: z.string().min(1).max(254).optional(),
+                banned: z.enum(['true', 'false']).optional(),
+                cursor: cursor.optional(),
+                limit: limit.optional(),
+            }),
+            metadata: access('axeda:user:manage', 'global'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            const { emailPrefix, banned } = ctx.query;
+            const page = await axeda.users.list(actor, { emailPrefix, banned: banned === undefined ? undefined : banned === 'true' }, pageOf(ctx.query));
+            return ctx.json({ items: page.items.map(toManagedUserDto), nextCursor: page.nextCursor });
+        })),
+        axedaUserCreate: createAuthEndpoint('/axeda/user/create', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({
+                email: z.string().min(3).max(254),
+                name: z.string().min(1).max(200),
+            }),
+            metadata: access('axeda:user:manage', 'global'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => ctx.json(toManagedUserDto(await axeda.users.create(actor, ctx.body))))),
+        axedaUserBan: createAuthEndpoint('/axeda/user/ban', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({
+                id,
+                reason: z.string().min(1).max(500).nullish(),
+                expiresAt: z.iso.datetime().nullish(),
+            }),
+            metadata: access('axeda:user:manage', 'global'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            const { expiresAt, reason } = ctx.body;
+            const banned = await axeda.users.ban(actor, ctx.body.id, {
+                reason,
+                expiresAt: expiresAt === null || expiresAt === undefined ? null : new Date(expiresAt),
+            });
+            return ctx.json(toManagedUserDto(banned));
+        })),
+        axedaUserUnban: createAuthEndpoint('/axeda/user/unban', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({ id }),
+            metadata: access('axeda:user:manage', 'global'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => ctx.json(toManagedUserDto(await axeda.users.unban(actor, ctx.body.id))))),
+        axedaUserRevokeSessions: createAuthEndpoint('/axeda/user/revoke-sessions', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({ id }),
+            metadata: access('axeda:user:manage', 'global'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => ctx.json({ revoked: await axeda.users.revokeSessions(actor, ctx.body.id) }))),
+        axedaMenu: createAuthEndpoint('/axeda/menu', {
+            method: 'GET',
+            use: [sessionMiddleware],
+            query: z.strictObject({
+                ...scopeQuery,
+                locale: z.string().regex(LOCALE).optional(),
+            }),
+            metadata: access('(authenticated; the menu only lists what you may use)', 'own'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            const locale = ctx.query.locale ??
+                localeFromHeader(ctx.headers?.get('accept-language') ?? ctx.request?.headers.get('accept-language'));
+            const menu = await axeda.menu(actor, { scope: scopeFromQuery(ctx.query), locale });
+            return ctx.json({ items: menu });
+        })),
+    };
+}