@voltro/protocol 0.85.0 → 0.87.0

package/dist/rest.js

@@ -1,355 +1,28 @@
-import { H as e, V as t } from "./scopes-ClywBij8.js";
-import { E as n, O as r, T as i, a, c as o, d as s, f as c, i as l, k as u, l as d, n as f, o as p, r as m, s as h, t as g, u as _, v, w as y, y as b } from "./restFormat-BlgTLxm1.js";
-import { Effect as x, Schema as S, SchemaGetter as C, SchemaIssue as w } from "effect";
-import * as T from "effect/SchemaAST";
-//#region src/publicApi.ts
-var E = (e, t, n) => t.method ?? (t.resource !== void 0 && n !== void 0 ? A("", t, n).method : void 0) ?? (e === "query" ? "GET" : "POST"), D = (e, t, n) => j(t.path ?? (t.resource !== void 0 && n !== void 0 ? A(e, t, n).path : `/${t.version ?? "v1"}/${e.replace(/\./g, "/")}`)), O = (e) => {
-	let t = e.split("/").pop() ?? e;
-	return t.endsWith("ies") ? `${t.slice(0, -3)}y` : t.endsWith("ses") || t.endsWith("xes") ? t.slice(0, -2) : t.endsWith("s") ? t.slice(0, -1) : t;
-}, k = (e, t) => {
-	let n = t != null && (typeof t == "object" || typeof t == "function") && "ast" in t ? re(t) : void 0;
-	if (n === void 0) return;
-	let r = `${O(e)}Id`;
-	return n.has(r) ? r : n.has("id") ? "id" : void 0;
-}, A = (e, t, n) => {
-	let r = (t.resource ?? "").replace(/^\/+|\/+$/g, ""), i = `/${t.version ?? "v1"}/${r}`, a = k(r, n.input), o = a === void 0 ? i : `${i}/:${a}`, s = e.split(".").pop() ?? e, c = n.target?.op;
-	return n.kind === "query" || n.kind === "stream" ? {
-		method: "GET",
-		path: o
-	} : n.kind === "mutation" && c === "insert" ? {
-		method: "POST",
-		path: i
-	} : n.kind === "mutation" && c === "update" ? {
-		method: a === void 0 ? "POST" : "PATCH",
-		path: o
-	} : n.kind === "mutation" && c === "delete" ? {
-		method: a === void 0 ? "POST" : "DELETE",
-		path: o
-	} : {
-		method: "POST",
-		path: `${o}/${s}`
-	};
-}, j = (e) => e.replace(/\{([A-Za-z0-9_]+)\}/g, ":$1"), M = (e) => [...e.matchAll(/:([A-Za-z0-9_]+)/g)].map((e) => e[1]), N = (e) => {
-	if (T.isUnion(e)) {
-		let t = e.types.filter((e) => !T.isUndefined(e));
-		if (t.length === 1) return t[0];
-		if (t.length !== e.types.length) return new T.Union(t);
-	}
-	return e;
-}, P = /^-?(\d+\.?\d*|\.\d+)(e[+-]?\d+)?$/i, F = (e, t) => {
-	let n = N(t);
-	if (n.encoding !== void 0) return F(e, T.toEncoded(n));
-	if (T.isUnion(n)) {
-		for (let t of n.types) {
-			let n = F(e, t);
-			if (n !== e) return n;
-		}
-		return e;
-	}
-	if (T.isArrays(n)) {
-		let t = Array.isArray(e) ? e : e === void 0 ? void 0 : [e];
-		if (t === void 0) return e;
-		let r = n.rest[0] ?? n.elements[0];
-		return r === void 0 ? t : t.map((e) => F(e, r));
-	}
-	if (typeof e != "string") return e;
-	if (T.isNumber(n)) return P.test(e.trim()) ? Number(e) : e;
-	if (T.isBoolean(n)) return e === "true" || e !== "false" && e;
-	if (T.isLiteral(n)) {
-		let t = n.literal;
-		return typeof t == "number" && P.test(e.trim()) && Number(e) === t || typeof t == "boolean" && String(t) === e ? t : e;
-	}
-	return e;
-}, I = (e, t) => {
-	if (typeof e != "object" || !e || Array.isArray(e)) return e;
-	let n = N(T.toEncoded(t.ast));
-	if (!T.isObjects(n)) return e;
-	let r = { ...e };
-	for (let e of n.propertySignatures) {
-		let t = String(e.name);
-		t in r && (r[t] = F(r[t], e.type));
-	}
-	return r;
-}, ee = (e) => {
-	let t = N(T.toEncoded(e.ast));
-	if (!T.isObjects(t)) return (e) => e;
-	let n = t.propertySignatures, r = /* @__PURE__ */ new Map(), i = n.length >= 32 && n.every((e, t) => typeof e.name != "string" || e.name in Object.prototype || r.has(e.name) ? !1 : (r.set(e.name, {
-		type: e.type,
-		order: t
-	}), !0));
-	return (e) => {
-		if (typeof e != "object" || !e || Array.isArray(e)) return e;
-		let t = { ...e }, a = i ? Object.keys(t) : void 0;
-		if (a !== void 0 && a.length * 4 < n.length) {
-			let e = [];
-			for (let t of a) {
-				let n = r.get(t);
-				n !== void 0 && e.push({
-					key: t,
-					...n
-				});
-			}
-			e.sort((e, t) => e.order - t.order);
-			for (let { key: n, type: r } of e) t[n] = F(t[n], r);
-		} else for (let e of n) {
-			let n = String(e.name);
-			n in t && (t[n] = F(t[n], e.type));
-		}
-		return t;
-	};
-}, L = (e) => {
-	let t = /* @__PURE__ */ new Set();
-	if (e === void 0) return t;
-	let n = (e) => {
-		if (T.isUnion(e)) {
-			for (let t of e.types) n(t);
-			return;
-		}
-		if (e.encoding !== void 0 && n(T.toEncoded(e)), T.isObjects(e)) {
-			let n = e.propertySignatures.find((e) => e.name === "_tag");
-			n !== void 0 && T.isLiteral(n.type) && typeof n.type.literal == "string" && t.add(n.type.literal);
-		}
-	};
-	return n(e.ast), t;
-}, R = (e, t, n) => {
-	if (n !== void 0) try {
-		let r = S.encodeUnknownSync(n)(e);
-		if (typeof r == "object" && r) return {
-			error: t,
-			...r
-		};
-	} catch {}
-	let r = { error: t };
-	for (let [t, n] of Object.entries(e)) t !== "stack" && t !== "_tag" && (r[t] = n);
-	return r;
-}, z = (e, t, n, r = []) => B(e, t, n, r, L), B = (e, t, n, r, i) => {
-	if (typeof e != "object" || !e) return e;
-	let a = e._tag;
-	if (typeof a != "string" || a === "ScopeError" || a === "NoSuchResource") return e;
-	if (i(t.error).has(a)) return new Y(n.errorStatus?.[a] ?? 422, R(e, a, t.error));
-	let o = r.find((e) => i(e.schema).has(a));
-	if (o === void 0) return e;
-	let s = n.errorStatus?.[a] ?? o.rest?.status ?? 422, c = o.rest?.headers?.(e);
-	return new Y(s, R(e, a, o.schema), c);
-}, te = (e, t, n, r, i, a, o) => {
-	let s = B(e, t, n, r, o);
-	if (!(s instanceof Y) || i.errors === "tagged" && i.encodeError === void 0) return s;
-	let { error: c, _tag: u, ...d } = s.body, f = typeof d.message == "string" ? d.message : typeof d.reason == "string" ? d.reason : "", p = l(i, {
-		status: s.status,
-		tag: c,
-		message: f,
-		fields: d
-	}, {
-		...a,
-		status: s.status
-	});
-	return new Y(s.status, p.body, {
-		...s.headers ?? {},
-		...p.headers ?? {}
-	}, p.contentType);
-}, V = (e, t) => {
-	if (e === void 0) return;
-	let n = T.isUnion(e.ast) ? e.ast.types : [e.ast];
-	for (let e of n) {
-		let n = S.make(e);
-		if (L(n).has(t)) return n;
-	}
-}, ne = (e) => e.split(".").map((e, t) => t === 0 ? e : e.charAt(0).toUpperCase() + e.slice(1)).join("").replace(/[^A-Za-z0-9_]/g, "_"), re = (e) => {
-	let t = N(T.toEncoded(e.ast));
-	return T.isObjects(t) && t.indexSignatures.length === 0 ? new Set(t.propertySignatures.map((e) => String(e.name))) : void 0;
-}, ie = (e, t) => e === t || JSON.stringify(e) === JSON.stringify(t), ae = (e) => {
-	let t = N(T.toEncoded(e.ast)), n = T.isObjects(t) ? new Map(t.propertySignatures.map((e) => [String(e.name), e.type])) : /* @__PURE__ */ new Map();
-	return (e) => {
-		let t = {};
-		for (let [r, i] of Object.entries(e)) {
-			let e = n.get(r);
-			t[r] = e === void 0 ? i : F(i, e);
-		}
-		return t;
-	};
-}, H = (e, t) => {
-	if (e !== void 0) {
-		try {
-			return S.encodeUnknownSync(t)(e);
-		} catch {}
-		try {
-			return S.decodeUnknownSync(t)(e), e;
-		} catch {}
-		return e;
-	}
-}, oe = (e, t, n) => ({
-	...e.request === void 0 ? {} : { request: H(e.request, t) },
-	...e.response === void 0 ? {} : { response: H(e.response, n) }
-}), se = () => (e) => {
-	if (e.subject.type !== "anonymous") return;
-	let t = e.subject.credentialRejected;
-	return t === void 0 ? void 0 : {
-		status: 401,
-		message: t
-	};
-}, U = (e, t, n, r = {}) => {
-	let i = e.publicApi;
-	if (i === void 0) throw Error(`publicApiRoute: descriptor '${e.name}' has no publicApi annotation`);
-	let o = d(r.profile, i.format), c = r.pluginErrors ?? [], l = /* @__PURE__ */ new WeakMap(), u = (e) => {
-		if (e === void 0) return /* @__PURE__ */ new Set();
-		let t = l.get(e.ast);
-		if (t !== void 0) return t;
-		let n = L(e);
-		return l.set(e.ast, n), n;
-	}, f = /* @__PURE__ */ new WeakMap(), p = (e, t) => {
-		if (e === void 0) return;
-		let n = f.get(e.ast);
-		if (n === void 0) {
-			let t = /* @__PURE__ */ new Map();
-			for (let n of T.isUnion(e.ast) ? e.ast.types : [e.ast]) {
-				let e = S.make(n);
-				for (let n of u(e)) t.has(n) || t.set(n, e);
-			}
-			n = t, f.set(e.ast, n);
-		}
-		return n.get(t);
-	}, m = {
-		kind: e.kind,
-		input: e.input,
-		target: e.target
-	}, h = E(e.kind, i, m), g = (e) => o.naming === "snake_case" ? s(e) : e, v = D(e.name, i, m), y = v.replace(/:([A-Za-z0-9_]+)/g, (e, t) => `:${g(t)}`), b = M(y), O = _(e.input, o), k = ee(O), A = ae(O), j = re(O);
-	if (j !== void 0) {
-		for (let t of b) if (!j.has(t)) throw Error(`publicApi: descriptor '${e.name}' — path '${v}' binds ':${t}', and the input declares no field of that name` + (j.size > 0 ? ` (fields: ${[...j].join(", ")})` : " (the input declares no fields)"));
-	}
-	let N = _(e.output, o), P = S.Struct({ value: O }), F = h !== "GET" && j === void 0;
-	if (h !== "GET" && j !== void 0) {
-		let e = b.length >= 32 ? new Set(b) : void 0;
-		for (let t of j) if (!(e?.has(t) ?? b.includes(t))) {
-			F = !0;
-			break;
-		}
-	}
-	let I = {
-		query: S.Unknown,
-		params: S.Unknown,
-		form: S.Boolean
-	}, R = (F ? S.Struct({
-		...I,
-		body: S.Unknown
-	}) : S.Struct(I)).pipe(S.decodeTo(P, {
-		decode: C.transformEffect((e) => {
-			let t = "body" in e ? e.body : void 0, n = h === "GET" ? k(e.query) : e.form ? k(t ?? {}) : t ?? {}, r = typeof e.params == "object" && e.params !== null ? A(e.params) : {};
-			if (typeof n != "object" || !n || Array.isArray(n)) return x.succeed({ value: n });
-			let i = n, a = Object.keys(r), o = 0;
-			for (let e of a) e in i && !ie(i[e], r[e]) && (a[o++] = e);
-			if (a.length = o, a.length > 0) {
-				let t = h === "GET" ? "query string" : "body";
-				return x.fail(new w.InvalidValue({ message: `${a.map((e) => `'${e}'`).join(", ")} ${a.length === 1 ? "is" : "are"} bound by the path and sent with another value in the ${t}` }, e));
-			}
-			return x.succeed({ value: {
-				...i,
-				...r
-			} });
-		}),
-		encode: C.transform((e) => e)
-	})), z = [
-		se(),
-		...e.openAccess === void 0 ? [le()] : [],
-		...(i.scopes ?? []).map((e) => ue(e))
-	], B = (() => {
-		let t = e.source;
-		return typeof t == "string" ? t : Array.isArray(t) ? t[0] : void 0;
-	})(), V = (t, n = 200) => ({
-		tag: e.name,
-		method: t.method,
-		path: t.path,
-		query: t.query,
-		source: B,
-		status: n
-	}), H = i.stream === "sse" && e.kind === "query" && n !== void 0, U = S.encodeUnknownEffect(N), ce = H ? (e, t) => he((r) => n(e.value, t, (e) => {
-		r(ge(String(e._tag ?? "message"), e));
-	})) : async (n, r) => {
-		let s;
-		try {
-			s = await t(n.value, r);
-		} catch (t) {
-			throw te(t, e, i, c, o, V(r), u);
-		}
-		let l = await x.runPromise(U(s)), d = a(o, l, V(r));
-		return q(d.body, {
-			...d.headers === void 0 ? {} : { headers: d.headers },
-			...d.contentType === void 0 ? {} : { contentType: d.contentType }
-		});
-	}, W = e.error, G = u(W), de = [...G], K = [];
-	for (let e of de) {
-		let t = p(W, e);
-		t !== void 0 && K.push({
-			status: i.errorStatus?.[e] ?? 422,
-			tag: e,
-			schema: t
-		});
-	}
-	for (let e of c) for (let t of u(e.schema)) {
-		if (G.has(t)) continue;
-		let n = i.errorStatus?.[t] ?? e.rest?.status;
-		if (n === void 0) continue;
-		let r = p(e.schema, t) ?? e.schema;
-		K.push({
-			status: n,
-			tag: t,
-			schema: r
-		});
-	}
-	let fe = i.security === !1 ? "none" : i.security ?? (e.openAccess === void 0 ? "required" : "optional"), J = {
-		tag: e.name,
-		kind: e.kind,
-		version: i.version ?? "v1",
-		security: fe,
-		idempotent: i.idempotent === !0,
-		input: O,
-		pathParams: b,
-		output: N,
-		source: B,
-		errorResponses: K,
-		format: o
-	};
-	return me({
-		method: h,
-		path: y,
-		input: R,
-		output: S.Unknown,
-		handler: ce,
-		...H ? { streaming: !0 } : {},
-		guards: z,
-		operationId: i.operationId ?? ne(e.name),
-		tags: i.tags ?? [e.name.split(".")[0] ?? e.name],
-		projection: J,
-		...o.etag && h === "GET" && !H ? { etag: !0 } : {},
-		...i.cache !== void 0 && h === "GET" && !H ? { cache: i.cache } : {},
-		...i.example === void 0 ? {} : { example: oe(i.example, O, N) },
-		...i.summary === void 0 ? {} : { summary: i.summary },
-		...i.description === void 0 ? {} : { description: i.description },
-		...i.deprecated === void 0 ? {} : { deprecated: i.deprecated },
-		...i.sunset === void 0 ? {} : { sunset: i.sunset }
-	});
-}, ce = (e, t = {}) => e.filter((e) => e.descriptor.publicApi !== void 0).map((e) => U(e.descriptor, e.invoke, e.subscribe, t)).sort((e, t) => e.path.localeCompare(t.path)), W = (e) => b(e.filter((e) => e.projection !== void 0).map((e) => {
-	let t = e.projection, n = {
-		tag: t.tag,
-		method: e.method,
-		path: e.path,
-		pathParams: t.pathParams,
-		version: t.version,
-		security: t.security,
-		errors: [...t.errorResponses].map((e) => `${e.status}:${e.tag}`).sort()
-	};
-	return `${JSON.stringify(n)} ${v(t.input.ast)} ${v(t.output.ast)}`;
-}).sort().join("\n")), le = () => (e) => {
+import { Unauthenticated as e, anonymousSubject as t, currentSubjectAuthority as n } from "./auth.js";
+import { effectiveScopes as r, hasEffectiveScope as i, recheckGuardsEffect as a } from "./scopes.js";
+import { beginIdempotent as o, failIdempotent as s, finishIdempotent as c, holdIdempotentClaim as l, idempotencyScope as u } from "./idempotency.js";
+import { declaredErrorTags as d, errorMemberSchema as f } from "./errorSchema.js";
+import { prepareIdempotentInput as p } from "./idempotencyInput.js";
+import { validateHttpStreamMaxDuration as m } from "./httpStreamMaxDuration.js";
+import { publishServerError as h } from "./serverErrorBus.js";
+import { JSONAPI_MEDIA_TYPE as g, PROBLEM_JSON as _, REST_PROFILE_NAMES as v, encodeRestError as y, encodeRestSuccess as b, nextLink as x, problemDetails as S, problemTypeOf as C, resolveRestFormat as w, restViewSchema as T, toSnakeCase as E } from "./restFormat.js";
+import { makeRestReceiptCodec as D } from "./restReceipt.js";
+import { coerceQueryObject as O, coerceQueryValue as k, collectPublicApiRoutes as A, derivePublicMethod as j, derivePublicPath as M, deriveResource as N, normalizePathParams as P, operationIdOf as F, pathParamNames as I, projectedFailure as ee, publicApiRoute as te, publicSurfaceDigest as ne, resourceIdField as re, wireExample as ie } from "./publicApi.js";
+import { Effect as L, Schema as R } from "effect";
+import * as ae from "effect/SchemaAST";
+import { newTraceId as oe } from "@voltro/shared";
+//#region src/rest.ts
+var se = () => (e) => {
 	if (e.subject.type === "anonymous") return {
 		status: 401,
 		message: e.subject.credentialRejected ?? "Authentication required"
 	};
-}, ue = (e) => (t) => {
-	let n = t.subject.scopes;
-	if (!(n && (n.includes(e) || n.includes("admin:full")))) return {
+}, ce = (e) => (t) => {
+	if (!i(t.subject, e)) return {
 		status: 403,
 		message: `Missing required scope: ${e}`
 	};
-}, G = (e) => {
+}, z = (e) => {
 	for (let t of [
 		"includes",
 		"some",
@@ -364,24 +37,47 @@ var E = (e, t, n) => t.method ?? (t.resource !== void 0 && n !== void 0 ? A("",
 		if (n === void 0 || !("value" in n) || typeof n.value != "string") return !1;
 	}
 	return !0;
-}, de = (e) => (t) => {
-	let n = t.subject.scopes;
+}, le = (e) => (t) => {
+	let n = r(t.subject);
 	if (n) {
 		if (n.includes("admin:full")) return;
-		let t = n.length >= 32 && e.length >= 256 && G(n) && G(e) ? new Set(n) : void 0;
+		let t = n.length >= 32 && e.length >= 256 && z(n) && z(e) ? new Set(n) : void 0;
 		if (e.some((e) => t === void 0 ? n.includes(e) : t.has(e))) return;
 	}
 	return {
 		status: 403,
 		message: `Missing required scope: one of ${e.join(", ")}`
 	};
-}, K = (e, t) => e.method === "GET" && e.cache !== void 0 && t.status !== 200 && t.status !== 304 ? {
+}, B = (e, t) => {
+	if (e === void 0) return {};
+	let n = { vary: "Origin" };
+	return t !== void 0 && (e.origins.includes(t) || e.origins.includes("*")) && (n["access-control-allow-origin"] = e.origins.includes("*") ? "*" : t, n["access-control-expose-headers"] = (e.exposeHeaders ?? [
+		"retry-after",
+		"ratelimit-limit",
+		"ratelimit-remaining",
+		"ratelimit-reset"
+	]).join(", ")), n;
+}, V = (e, t, n) => {
+	let r = B(e, n.origin), i = e.methods ?? (t === "GET" ? ["GET", "HEAD"] : [t]), a = e.headers ?? ["authorization", "content-type"], o = (n["access-control-request-headers"] ?? "").split(",").map((e) => e.trim().toLowerCase()).filter(Boolean), s = r["access-control-allow-origin"] !== void 0 && i.some((e) => e === n["access-control-request-method"]) && o.every((e) => a.some((t) => t.toLowerCase() === e));
+	return {
+		status: s ? 204 : 403,
+		headers: {
+			...r,
+			vary: "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
+			...s ? {
+				"access-control-allow-methods": i.join(", "),
+				"access-control-allow-headers": a.join(", "),
+				...e.maxAge === void 0 ? {} : { "access-control-max-age": String(e.maxAge) }
+			} : {}
+		}
+	};
+}, H = (e, t) => e.method === "GET" && e.cache !== void 0 && t.status !== 200 && t.status !== 304 ? {
 	...t,
 	headers: {
 		...t.headers,
 		"Cache-Control": "private, no-store"
 	}
-} : t, fe = (e, t, n, r, i) => {
+} : t, ue = (e, t, n, r, i) => {
 	if (e === void 0) return {};
 	let a = { Vary: e.audience === void 0 ? "Authorization, Cookie" : "Authorization" };
 	if (t.headers.authorization !== void 0 || e.audience === void 0 && t.headers.cookie !== void 0) return {
@@ -407,13 +103,13 @@ var E = (e, t, n) => t.method ?? (t.resource !== void 0 && n !== void 0 ? A("",
 			"Surrogate-Key": c.join(" ")
 		} : {}
 	};
-}, q = (e, t = {}) => ({
+}, U = (e, t = {}) => ({
 	__voltroRestResponse: !0,
 	status: t.status ?? 200,
 	body: e,
 	...t.headers === void 0 ? {} : { headers: t.headers },
 	...t.contentType === void 0 ? {} : { contentType: t.contentType }
-}), J = (e) => typeof e == "object" && !!e && e.__voltroRestResponse === !0, Y = class extends Error {
+}), W = (e) => typeof e == "object" && !!e && e.__voltroRestResponse === !0, G = class extends Error {
 	status;
 	body;
 	headers;
@@ -421,7 +117,7 @@ var E = (e, t, n) => t.method ?? (t.resource !== void 0 && n !== void 0 ? A("",
 	constructor(e, t, n, r) {
 		super(`REST ${e}`), this.name = "RestRouteError", this.status = e, this.body = t, this.headers = n, this.contentType = r;
 	}
-}, pe = (e, t, n) => new Y(e, t, n), me = (e) => {
+}, de = (e, t, n) => new G(e, t, n), fe = (e) => {
 	if (e.version === void 0) return e;
 	if (!/^v\d+$/.test(e.version)) throw Error(`defineRestRoute(${e.method} ${e.path}): version "${e.version}" must be 'v' followed by digits — 'v1', 'v2', …`);
 	if ((/* @__PURE__ */ RegExp("^/v\\d+(/|$)")).test(e.path)) throw Error(`defineRestRoute(${e.method} ${e.path}): the path already starts with a version segment AND declares version: '${e.version}'. Pick one spelling — either bake the version into the path, or declare version: and keep the path bare ('/customers'). Both would mount '/${e.version}${e.path}', which is never what the author meant.`);
@@ -429,13 +125,17 @@ var E = (e, t, n) => t.method ?? (t.resource !== void 0 && n !== void 0 ? A("",
 		...e,
 		path: `/${e.version}${e.path}`
 	};
-}, he = (e, t = {}) => ({
-	__voltroRestStream: !0,
-	stream: {
-		subscribe: e,
-		...t.keepAliveMs === void 0 ? {} : { keepAliveMs: t.keepAliveMs }
-	}
-}), ge = (e, t) => `event: ${e}\n${(typeof t == "string" ? t : JSON.stringify(t)).split("\n").map((e) => `data: ${e}`).join("\n")}\n\n`, _e = (e) => typeof e == "object" && !!e && e.__voltroRestStream === !0, ve = (e, t = {}) => ({
+}, pe = (e, t = {}) => {
+	let n = m(t.maxDurationMs);
+	return {
+		__voltroRestStream: !0,
+		stream: {
+			subscribe: e,
+			...t.keepAliveMs === void 0 ? {} : { keepAliveMs: t.keepAliveMs },
+			...n === void 0 ? {} : { maxDurationMs: n }
+		}
+	};
+}, me = (e, t) => `event: ${e}\n${(typeof t == "string" ? t : JSON.stringify(t)).split("\n").map((e) => `data: ${e}`).join("\n")}\n\n`, K = (e) => typeof e == "object" && !!e && e.__voltroRestStream === !0, he = (e, t = {}) => ({
 	__voltroRestBytes: !0,
 	byteStream: {
 		stream: e,
@@ -445,18 +145,18 @@ var E = (e, t, n) => t.method ?? (t.resource !== void 0 && n !== void 0 ? A("",
 	...t.contentType === void 0 ? {} : { contentType: t.contentType },
 	...t.status === void 0 ? {} : { status: t.status },
 	...t.headers === void 0 ? {} : { headers: t.headers }
-}), X = (e) => typeof e == "object" && !!e && e.__voltroRestBytes === !0, ye = async (e) => {
+}), q = (e) => typeof e == "object" && !!e && e.__voltroRestBytes === !0, ge = async (e) => {
 	let t = await globalThis.crypto.subtle.digest("SHA-1", new TextEncoder().encode(e)), n = "";
 	for (let e of new Uint8Array(t)) n += e.toString(16).padStart(2, "0");
 	return n;
-}, Z = (e, t, n, r = "application/json; charset=utf-8") => ({
+}, J = (e, t, n, r = "application/json; charset=utf-8") => ({
 	status: e,
 	contentType: r,
 	body: JSON.stringify(t),
 	...n ? { headers: n } : {}
-}), Q = (e, t, n, r, i, a, o) => {
+}), Y = (e, t, n, r, i, a, o) => {
 	let s = e.projection;
-	if (s === void 0) return Z(n, {
+	if (s === void 0) return J(n, {
 		error: i,
 		...a
 	}, o);
@@ -467,17 +167,17 @@ var E = (e, t, n) => t.method ?? (t.resource !== void 0 && n !== void 0 ? A("",
 		query: t.query,
 		source: s.source,
 		status: n
-	}, u = l(s.format, {
+	}, l = y(s.format, {
 		status: n,
 		tag: r,
 		message: i,
 		fields: a
 	}, c);
-	return Z(n, u.body, {
+	return J(n, l.body, {
 		...o,
-		...u.headers ?? {}
-	}, u.contentType);
-}, be = (e) => (e.headers["content-type"] ?? "application/json").split(";")[0].trim().toLowerCase(), xe = (e, t) => {
+		...l.headers ?? {}
+	}, l.contentType);
+}, X = (e) => (e.headers["content-type"] ?? "application/json").split(";")[0].trim().toLowerCase(), _e = (e, t) => {
 	if (e.length === 0) return;
 	let n = t === "application/x-www-form-urlencoded";
 	if (!n && t !== "application/json" && !/^application\/[^/;\s]+\+json$/.test(t)) return;
@@ -485,21 +185,21 @@ var E = (e, t, n) => t.method ?? (t.resource !== void 0 && n !== void 0 ? A("",
 	if (r.trim() !== "") {
 		if (n) {
 			let e = (e) => decodeURIComponent(e.replace(/\+/g, " "));
-			return Ce((r.match(/[^&]+/g) ?? []).map((t) => {
+			return Z((r.match(/[^&]+/g) ?? []).map((t) => {
 				let n = t.indexOf("=");
 				return n < 0 ? [e(t), ""] : [e(t.slice(0, n)), e(t.slice(n + 1))];
 			}));
 		}
 		return JSON.parse(r);
 	}
-}, Se = (e) => Ce(new URLSearchParams(e)), Ce = (e) => {
+}, ve = (e) => Z(new URLSearchParams(e)), Z = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let [n, r] of e) {
 		let e = t.get(n);
 		e === void 0 ? t.set(n, r) : Array.isArray(e) ? e.push(r) : t.set(n, [e, r]);
 	}
 	return Object.fromEntries(t);
-}, we = (e, t) => {
+}, ye = (e, t) => {
 	let n = e.match(/[^/]+/g) ?? [], r = t.match(/[^/]+/g) ?? [], i = {};
 	for (let e = 0; e < n.length; e++) {
 		let t = n[e];
@@ -513,7 +213,7 @@ var E = (e, t, n) => t.method ?? (t.resource !== void 0 && n !== void 0 ? A("",
 		}
 	}
 	return i;
-}, Te = (e, t) => {
+}, be = (e, t) => {
 	let n = e.path.split("/"), r = n[n.length - 1] === "*", i = r ? n.slice(0, -1) : n, a = t.split("/");
 	if (a.length < i.length) return !1;
 	for (let e = 0; e < i.length; e++) {
@@ -523,191 +223,337 @@ var E = (e, t, n) => t.method ?? (t.resource !== void 0 && n !== void 0 ? A("",
 		} else if (t !== n) return !1;
 	}
 	return a.length === i.length ? !0 : e.match === "exact" && !r ? !1 : a.slice(i.length).some((e) => e.length > 0);
-}, Ee = (e, t, n) => ({
-	query: Se(e.query),
+}, xe = (e, t, n) => ({
+	query: ve(e.query),
 	params: t,
-	body: n ? xe(e.rawBody, be(e)) : void 0,
-	form: be(e) === "application/x-www-form-urlencoded"
-}), $ = /* @__PURE__ */ new Set([
+	body: n ? _e(e.rawBody, X(e)) : void 0,
+	form: X(e) === "application/x-www-form-urlencoded"
+}), Q = /* @__PURE__ */ new Set([
 	"POST",
 	"PUT",
 	"PATCH",
 	"DELETE"
-]), De = (e, n, r, i, a) => {
-	if (e instanceof Y) return Z(e.status, e.body, {
+]), $ = (t, n, r, i, a) => {
+	if (r.mapFailure !== void 0) try {
+		let e = r.mapFailure(t, {
+			method: a.method,
+			path: a.path,
+			query: a.query
+		});
+		if (e instanceof Promise) throw e.catch(() => void 0), Error("REST failure mapping must complete synchronously");
+		if (L.isEffect(e) && !(e instanceof Error)) throw Error("REST failure mapping must be pure");
+		e !== void 0 && (t = e);
+	} catch {
+		t = /* @__PURE__ */ Error("REST failure mapping could not be applied");
+	}
+	if (t instanceof G) return J(t.status, t.body, {
 		...i,
-		...e.headers
-	}, e.contentType);
-	if (typeof e == "object" && e) {
-		let o = e;
-		if (typeof o.status == "number") return Q(r, a, o.status, typeof o._tag == "string" ? o._tag : "Error", typeof o.message == "string" ? o.message : "Error", {}, { ...i });
-		if (o._tag === "Unauthenticated" || e instanceof t) return Q(r, a, 401, "Unauthorized", typeof o.reason == "string" ? o.reason : "Authentication required", {}, { ...i });
+		...t.headers
+	}, t.contentType);
+	if (typeof t == "object" && t) {
+		let o = t;
+		if (typeof o.status == "number") return Y(r, a, o.status, typeof o._tag == "string" ? o._tag : "Error", typeof o.message == "string" ? o.message : "Error", {}, { ...i });
+		if (o._tag === "Unauthenticated" || t instanceof e) return Y(r, a, 401, "Unauthorized", typeof o.reason == "string" ? o.reason : "Authentication required", {}, { ...i });
 		if (o._tag === "ScopeError") {
 			let e = n.type === "anonymous" ? 401 : 403;
-			return Q(r, a, e, e === 401 ? "Unauthorized" : "Forbidden", typeof o.message == "string" ? o.message : "Forbidden", {}, { ...i });
+			return Y(r, a, e, e === 401 ? "Unauthorized" : "Forbidden", typeof o.message == "string" ? o.message : "Forbidden", {}, { ...i });
 		}
 		if (o._tag === "NoSuchResource") {
-			let t = e;
-			return Q(r, a, 404, "NoSuchResource", typeof o.message == "string" ? o.message : "Not Found", {
-				resourceType: typeof t.resourceType == "string" ? t.resourceType : null,
-				resourceId: typeof t.resourceId == "string" ? t.resourceId : null
+			let e = t;
+			return Y(r, a, 404, "NoSuchResource", typeof o.message == "string" ? o.message : "Not Found", {
+				resourceType: typeof e.resourceType == "string" ? e.resourceType : null,
+				resourceId: typeof e.resourceId == "string" ? e.resourceId : null
 			}, { ...i });
 		}
 	}
-	return c({
-		error: e,
+	return h({
+		error: t,
 		source: "rest",
 		name: `${r.method} ${r.path}`,
 		fields: { status: 500 }
 	}), {
-		...Q(r, a, 500, "InternalServerError", "Internal Server Error", {}, { ...i }),
-		cause: e
+		...Y(r, a, 500, "InternalServerError", "Internal Server Error", {}, { ...i }),
+		cause: t
 	};
-}, Oe = (a, o, s) => {
-	let c = a.input ? S.decodeUnknownEffect(a.input) : void 0, l = S.encodeEffect(a.output), d = a.input === void 0 ? void 0 : T.toEncoded(a.input.ast), f = d !== void 0 && (!T.isObjects(d) || d.indexSignatures.length > 0 || d.propertySignatures.some((e) => e.name === "body")), p = {};
-	a.projection !== void 0 && (p["x-voltro-rest-profile"] = a.projection.format.name);
-	let m = (e) => e.replace(/\/$/, "").split("/").length, h = m(a.path);
-	return a.deprecated !== void 0 && (p.Deprecation = "true"), a.sunset !== void 0 && (p.Sunset = a.sunset), {
-		method: a.method,
+}, Se = (e, r, i) => {
+	let d = e.input ? R.decodeUnknownEffect(e.input) : void 0, f = R.encodeEffect(e.output), m = D(e.projection === void 0 ? e.output : e.publicApiDescriptor?.output ?? e.output, e.projection === void 0 ? "raw" : "projection"), h = (t, n, r) => {
+		if (!Number.isInteger(t.status) || t.status < 200 || t.status > 599) throw Error("Invalid final REST response status");
+		let i = e.projection;
+		if (i === void 0) return {
+			...t,
+			body: n
+		};
+		let a = b(i.format, n, {
+			tag: i.tag,
+			method: r.method,
+			path: r.path,
+			query: r.query,
+			source: i.source,
+			status: t.status
+		});
+		return U(a.body, {
+			status: t.status,
+			headers: {
+				...t.headers,
+				...a.headers
+			},
+			...(a.contentType ?? t.contentType) === void 0 ? {} : { contentType: a.contentType ?? t.contentType }
+		});
+	}, g = e.input === void 0 ? void 0 : ae.toEncoded(e.input.ast), _ = g !== void 0 && (!ae.isObjects(g) || g.indexSignatures.length > 0 || g.propertySignatures.some((e) => e.name === "body")), v = {};
+	e.projection !== void 0 && (v["x-voltro-rest-profile"] = e.projection.format.name);
+	let y = (e) => e.replace(/\/$/, "").split("/").length, x = y(e.path);
+	e.deprecated !== void 0 && (v.Deprecation = "true"), e.sunset !== void 0 && (v.Sunset = e.sunset);
+	let S = {
+		method: e.method,
+		...e.publicApiDescriptor === void 0 ? {} : { restContract: e },
 		answersOtherMethods: !0,
-		path: a.path,
-		match: a.path.endsWith("/*") ? "prefix" : "exact",
-		...a.maxBodyBytes === void 0 ? {} : { maxBodyBytes: a.maxBodyBytes },
-		handle: async (d) => {
-			if (!a.path.endsWith("/*") && m(d.path) !== h) return Q(a, d, 404, "NotFound", "Not Found", {}, { ...p });
-			let g = d.method.toUpperCase();
-			if (!(g === a.method || g === "HEAD" && a.method === "GET")) return Q(a, d, 405, "MethodNotAllowed", "Method Not Allowed", { allow: s }, {
-				...p,
-				Allow: s
+		path: e.path,
+		match: e.path.endsWith("/*") ? "prefix" : "exact",
+		...e.maxBodyBytes === void 0 ? {} : { maxBodyBytes: e.maxBodyBytes },
+		...e.cors === void 0 ? {} : { cors: e.cors },
+		...e.credentials === void 0 ? {} : { credentials: e.credentials },
+		handle: async (g) => {
+			if (!e.path.endsWith("/*") && y(g.path) !== x) return Y(e, g, 404, "NotFound", "Not Found", {}, { ...v });
+			let b = g.method.toUpperCase();
+			if (!(b === e.method || b === "HEAD" && e.method === "GET")) return Y(e, g, 405, "MethodNotAllowed", "Method Not Allowed", { allow: i }, {
+				...v,
+				Allow: i
 			});
-			if (a.sunset !== void 0) {
-				let e = Date.parse(a.sunset);
-				if (!Number.isNaN(e) && Date.now() >= e) return Q(a, d, 410, "Gone", "Gone", {
-					...a.version === void 0 ? {} : { version: a.version },
-					...a.deprecated === void 0 ? {} : { replacement: a.deprecated }
-				}, { ...p });
+			if (e.sunset !== void 0) {
+				let t = Date.parse(e.sunset);
+				if (!Number.isNaN(t) && Date.now() >= t) return Y(e, g, 410, "Gone", "Gone", {
+					...e.version === void 0 ? {} : { version: e.version },
+					...e.deprecated === void 0 ? {} : { replacement: e.deprecated }
+				}, { ...v });
 			}
-			let _;
-			if (c) {
-				let e;
+			let S;
+			if (d) {
+				let t;
 				try {
-					e = Ee(d, we(a.path, d.path), f);
+					t = xe(g, ye(e.path, g.path), _);
 				} catch {
-					return Q(a, d, 400, "InvalidRequest", "Malformed request body", {}, { ...p });
+					return Y(e, g, 400, "InvalidRequest", "Malformed request body", {}, { ...v });
 				}
-				let t = await x.runPromise(c(e).pipe(x.map((e) => ({
+				let n = await L.runPromise(d(t).pipe(L.map((e) => ({
 					ok: !0,
 					value: e
-				})), x.catch((e) => x.succeed({
+				})), L.catch((e) => L.succeed({
 					ok: !1,
 					cause: e
 				}))));
-				if (!t.ok) return Q(a, d, 400, "InvalidRequest", "Invalid request", { detail: String(t.cause) }, { ...p });
-				_ = t.value;
-			}
-			let v;
-			try {
-				v = o.resolveSubject ? await o.resolveSubject(d.headers) : e(d.headers["x-tenant"] ?? null);
-			} catch (e) {
-				if (e instanceof t || typeof e == "object" && e && e._tag === "Unauthenticated") {
-					let t = e.reason;
-					return Q(a, d, 401, "Unauthorized", t ?? "Authentication required", {}, { ...p });
-				}
-				throw e;
+				if (!n.ok) return Y(e, g, 400, "InvalidRequest", "Invalid request", { detail: String(n.cause) }, { ...v });
+				S = n.value;
 			}
-			let b;
+			let C;
 			try {
-				b = o.buildContext ? await o.buildContext(v, d.headers) : void 0;
-			} catch (e) {
-				return K(a, De(e, v, a, p, d));
-			}
-			let S = typeof b == "object" && b && "store" in b ? b.store : o.store, C = {
-				subject: v,
-				headers: d.headers,
-				store: S,
-				method: g,
-				path: d.path,
-				query: d.query,
-				rawBody: d.rawBody,
-				...b === void 0 ? {} : { app: b },
-				...d.remoteAddr === void 0 ? {} : { remoteAddr: d.remoteAddr }
-			};
-			if (a.guards) for (let e of a.guards) {
-				let t = await e(C);
-				if (t) return Q(a, d, t.status, t.status === 401 ? "Unauthorized" : t.status === 403 ? "Forbidden" : "GuardRejected", t.message, {}, { ...p });
+				C = r.resolveSubject ? await r.resolveSubject(g.headers, {
+					path: g.path,
+					query: g.query
+				}) : t(g.headers["x-tenant"] ?? null);
+			} catch (n) {
+				return H(e, $(n, t(null), e, v, g));
 			}
-			let w = o.idempotency, T = w && $.has(a.method) ? d.headers[w.header.toLowerCase()] : void 0, E = w && T ? u(v.tenantId, a.method, a.path) : "", D;
-			if (w && T) {
-				let e = await y(w.store, E, T, w.ttlMs, Date.now());
-				if (e.kind === "replay") return Z(e.response.status, e.response.body, {
-					...p,
-					"Idempotency-Replayed": "true"
+			if (e.credentials === "bearer" && C.type === "anonymous") return Y(e, g, 401, "Unauthorized", C.credentialRejected ?? "Authentication required", {}, { ...v });
+			let w = C, T = r.traceId?.() ?? oe(), E = {
+				traceId: T,
+				...g.remoteAddr === void 0 ? {} : { remoteAddr: g.remoteAddr }
+			}, D = r.idempotency, O = D && Q.has(e.method) ? g.headers[D.header.toLowerCase()] : void 0, k = D && O ? u(C.tenantId, e.method, e.path) : "", A = e.projection === void 0 ? void 0 : e.publicApiDescriptor, j;
+			if (D && O) try {
+				let t = await p(A?.input ?? e.input ?? R.Unknown, A === void 0 ? S : S.value, C, {
+					path: g.path,
+					...A === void 0 && e.input === void 0 ? {
+						query: g.query,
+						rawBody: g.rawBody
+					} : {}
 				});
-				if (e.kind === "conflict") return Q(a, d, 409, "Conflict", "A request with this Idempotency-Key is already being processed", {}, { ...p });
-				D = r(w.store, E, T);
+				S = A === void 0 ? t.input : { value: t.input }, j = t.fingerprint;
+			} catch {
+				return Y(e, g, 503, "IdempotencyUnavailable", "This request input cannot be safely retained for replay.", {}, { ...v });
 			}
+			let M, N = async () => {
+				let t = r.bindReplayAuthority?.({
+					subject: w,
+					traceId: T,
+					tag: A?.name ?? e.operationId ?? `${e.method} ${e.path}`,
+					kind: A?.kind ?? "rest",
+					input: A === void 0 ? S : S.value,
+					surface: "rest",
+					...A?.publicApi === void 0 ? {} : { publicApi: A.publicApi },
+					...g.remoteAddr === void 0 ? {} : { remoteAddr: g.remoteAddr }
+				});
+				if (t !== void 0) throw t instanceof Promise && t.catch(() => void 0), Error("Replay authority bindings must complete synchronously");
+				let i = await L.runPromise(a(w, void 0, S));
+				if (i) throw i;
+				C = n(w);
+				let o = r.buildContext ? await r.buildContext(C, g.headers, E) : void 0, s = typeof o == "object" && o && "store" in o ? o.store : r.store;
+				M = {
+					...E,
+					subject: C,
+					headers: g.headers,
+					store: s,
+					method: b,
+					path: g.path,
+					query: g.query,
+					rawBody: g.rawBody,
+					...o === void 0 ? {} : { app: o }
+				};
+				for (let t of e.guards ?? []) {
+					let n = await t(M, {
+						input: S,
+						defaultDeny: r.defaultDeny === !0
+					});
+					if (n) return Y(e, g, n.status, n.status === 401 ? "Unauthorized" : n.status === 403 ? "Forbidden" : "GuardRejected", n.message, {}, { ...v });
+				}
+			}, P, F, I = !1;
 			try {
-				let e = await a.handler(_, C);
-				if (_e(e) || X(e)) return w && T && await i(w.store, E, T), X(e) ? {
-					status: e.status ?? 200,
+				let t = await N();
+				if (t) return t;
+				if (e.rateLimit !== void 0 && r.rateLimit !== void 0) {
+					let t = await L.runPromise(r.rateLimit(e.rateLimit, M, e).pipe(L.as({ allowed: !0 }), L.catch((e) => L.succeed({
+						allowed: !1,
+						error: e
+					}))));
+					if (!t.allowed) return $(t.error, C, e, v, g);
+					let n = await N();
+					if (n) return n;
+				}
+				if (D && O) {
+					if (j === void 0) throw Error("Missing captured REST input identity");
+					let t = await o(D.store, k, O, j, D.ttlMs, Date.now());
+					t.kind === "fresh" && (F = t.claim, P = l(D.store, F));
+					let n = await N();
+					if (n) return n;
+					if (t.kind === "input-conflict" || t.kind === "input-unbound") return Y(e, g, 409, "IdempotencyInputRefused", "Check the original operation before starting another action; this request cannot be matched safely.", {}, { ...v });
+					if (t.kind === "replay") try {
+						let n = t.response.status;
+						if (!Number.isInteger(n) || n < 200 || n > 599 || e.projection !== void 0 && n !== 200) throw Error("Invalid retained REST response status");
+						let r = await m.read(t.response), i = await L.runPromise(f(r.body)), a = h(U(r.body, {
+							status: n,
+							...r.headers === void 0 ? {} : { headers: r.headers },
+							...r.contentType === void 0 ? {} : { contentType: r.contentType }
+						}), i, g), o = {
+							...v,
+							...a.headers,
+							"Idempotency-Replayed": "true"
+						};
+						return H(e, n === 204 || n === 304 ? {
+							status: n,
+							headers: o
+						} : J(n, a.body, o, a.contentType));
+					} catch {
+						throw Error("Stored REST response is incompatible with the current output contract");
+					}
+					if (t.kind === "conflict") return Y(e, g, 409, "Conflict", "A request with this Idempotency-Key is already being processed", {}, { ...v });
+				}
+				let n = await e.handler(S, M);
+				if (I = !0, K(n) || q(n)) return D && F && await s(D.store, F), q(n) ? {
+					status: n.status ?? 200,
 					headers: {
-						...p,
-						...e.headers
+						...v,
+						...n.headers
 					},
-					byteStream: e.byteStream,
-					...e.contentType === void 0 ? {} : { contentType: e.contentType }
+					byteStream: n.byteStream,
+					...n.contentType === void 0 ? {} : { contentType: n.contentType }
 				} : {
 					status: 200,
-					headers: p,
-					stream: e.stream
+					headers: v,
+					stream: n.stream
 				};
-				let t = J(e) ? e : q(e), r = await x.runPromise(l(t.body)), o = a.method === "GET" && t.status === 200 ? fe(a.cache, d, r, _, v) : {}, s = {
-					...p,
-					...t.headers,
-					...o
+				let i = W(n) ? n : U(n), a = await L.runPromise(f(i.body)), u = h(i, a, g), d = u.body, p = e.method === "GET" && u.status === 200 ? ue(e.cache, g, d, S, C) : {}, _ = {
+					...v,
+					...u.headers,
+					...p
 				};
-				if (w && T && await n(w.store, E, T, {
-					status: t.status,
-					body: r
-				}, Date.now()), a.etag === !0 && a.method === "GET") {
-					let e = `W/"${await ye(JSON.stringify(r))}"`, n = d.headers["if-none-match"];
-					return n !== void 0 && n.split(",").some((t) => t.trim() === e) ? {
+				if (D && F && !await c(D.store, F, {
+					status: u.status,
+					...await m.capture(i.body, i)
+				}, Date.now())) throw Error("Original idempotent response claim is no longer owned");
+				if (e.etag === !0 && e.method === "GET") {
+					let t = `W/"${await ge(JSON.stringify(d))}"`, n = g.headers["if-none-match"];
+					return n !== void 0 && n.split(",").some((e) => e.trim() === t) ? {
 						status: 304,
 						headers: {
+							...v,
 							...p,
-							...o,
-							ETag: e
+							ETag: t
 						}
-					} : K(a, Z(t.status, r, {
-						...s,
-						ETag: e
-					}, t.contentType));
+					} : H(e, J(u.status, d, {
+						..._,
+						ETag: t
+					}, u.contentType));
 				}
-				return t.status === 204 || t.status === 304 ? K(a, {
-					status: t.status,
-					headers: s
-				}) : K(a, Z(t.status, r, s, t.contentType));
-			} catch (e) {
-				return w && T && await i(w.store, E, T), K(a, De(e, v, a, p, d));
+				return u.status === 204 || u.status === 304 ? H(e, {
+					status: u.status,
+					headers: _
+				}) : H(e, J(u.status, d, _, u.contentType));
+			} catch (t) {
+				if (D && F && I) try {
+					await c(D.store, F, {
+						status: 500,
+						body: null
+					}, Date.now());
+				} catch {}
+				return H(e, $(I && F ? /* @__PURE__ */ Error("Idempotent response could not be retained") : t, C, e, v, g));
 			} finally {
-				D?.();
+				if (P?.(), D && F && !I) try {
+					await s(D.store, F);
+				} catch {}
+			}
+		}
+	};
+	return {
+		...S,
+		handle: async (n) => {
+			let r = B(e.cors, n.headers.origin), i;
+			if (e.cors !== void 0 && n.method === "OPTIONS" && n.headers["access-control-request-method"] !== void 0 && n.headers["access-control-request-method"] === e.method) return V(e.cors, e.method, n.headers);
+			let a = n;
+			if (e.credentials === "bearer" && (n.method === e.method || n.method === "HEAD" && e.method === "GET")) {
+				let t = Object.fromEntries(Object.entries(n.headers).filter(([e]) => e.toLowerCase() !== "cookie"));
+				if (a = {
+					...n,
+					headers: t
+				}, !/^Bearer\s+\S+$/i.test(t.authorization ?? "")) return Y(e, a, 401, "Unauthorized", "Bearer authentication required", {}, r);
+			}
+			try {
+				i = await S.handle(a);
+			} catch (n) {
+				i = $(n, t(null), e, v, a);
 			}
+			let o = {
+				...i.headers,
+				...r
+			}, s = Object.entries(i.headers ?? {}).find(([e]) => e.toLowerCase() === "vary")?.[1];
+			if (s !== void 0 && e.cors !== void 0) {
+				for (let e of Object.keys(o)) e.toLowerCase() === "vary" && delete o[e];
+				o.vary = [...new Set(`${Array.isArray(s) ? s.join(", ") : s}, Origin`.split(",").map((e) => e.trim()))].join(", ");
+			}
+			return H(e, {
+				...i,
+				headers: o
+			});
 		}
 	};
-}, ke = (e, t = {}) => {
+}, Ce = (e, t = {}) => {
+	for (let n of e) {
+		if (n.rateLimit !== void 0 && t.rateLimit === void 0) throw Error(`REST route ${n.method} ${n.path} declares rateLimit but no rate-limit plugin is mounted`);
+		if (n.rateLimit !== void 0 && (!Number.isInteger(n.rateLimit.limit) || n.rateLimit.limit <= 0)) throw Error(`REST route ${n.method} ${n.path} rateLimit.limit must be a positive integer`);
+	}
 	if (t.idempotency !== void 0) {
-		for (let t of e) if (t.streaming === !0 && $.has(t.method)) throw Error(`REST route ${t.method} ${t.path} declares \`streaming: true\` on a method the idempotency binding claims (${[...$].join("/")}). A stream cannot complete an idempotency claim — there is no replayable body to cache — so a retried request would 409 until the claim's TTL. Either serve the stream on GET, or scope the idempotency binding away from this app's streaming routes.`);
+		for (let t of e) if (t.streaming === !0 && Q.has(t.method)) throw Error(`REST route ${t.method} ${t.path} declares \`streaming: true\` on a method the idempotency binding claims (${[...Q].join("/")}). A stream cannot complete an idempotency claim — there is no replayable body to cache — so a retried request would 409 until the claim's TTL. Either serve the stream on GET, or scope the idempotency binding away from this app's streaming routes.`);
 	}
 	let n = (e) => e.split("/").map((e) => e.startsWith(":") ? ":" : e).join("/"), r = /* @__PURE__ */ new Map();
 	for (let t of e) {
 		let e = r.get(n(t.path)) ?? [];
 		e.includes(t.method) || e.push(t.method), r.set(n(t.path), e);
 	}
-	return e.map((e) => Oe(e, t, r.get(n(e.path)).join(", ")));
-}, Ae = async (e, t) => {
+	return e.map((e) => ({
+		...Se(e, t, r.get(n(e.path)).join(", ")),
+		workload: "rest"
+	}));
+}, we = async (e, t) => {
 	let n = await e[0].handle(t);
 	for (let r = 1; r < e.length && n.status === 405; r++) n = await e[r].handle(t);
 	return n;
 };
 //#endregion
-export { g as JSONAPI_MEDIA_TYPE, f as PROBLEM_JSON, m as REST_PROFILE_NAMES, Y as RestRouteError, ve as bytes, I as coerceQueryObject, F as coerceQueryValue, ce as collectPublicApiRoutes, L as declaredErrorTags, me as defineRestRoute, E as derivePublicMethod, D as derivePublicPath, A as deriveResource, Ae as dispatchSharedPath, l as encodeRestError, a as encodeRestSuccess, V as errorMemberSchema, X as isRestByteResponse, J as isRestResponse, _e as isRestStreamResponse, we as matchPathParams, p as nextLink, j as normalizePathParams, ne as operationIdOf, M as pathParamNames, h as problemDetails, o as problemTypeOf, z as projectedFailure, U as publicApiRoute, W as publicSurfaceDigest, de as requireAnyScope, le as requireAuthenticated, ue as requireScope, d as resolveRestFormat, k as resourceIdField, q as response, pe as restError, ke as restRoutesToHttpRoutes, _ as restViewSchema, Te as routeAcceptsPath, he as sse, ge as sseFrame, s as toSnakeCase, oe as wireExample };
+export { g as JSONAPI_MEDIA_TYPE, _ as PROBLEM_JSON, v as REST_PROFILE_NAMES, G as RestRouteError, he as bytes, O as coerceQueryObject, k as coerceQueryValue, A as collectPublicApiRoutes, d as declaredErrorTags, fe as defineRestRoute, j as derivePublicMethod, M as derivePublicPath, N as deriveResource, we as dispatchSharedPath, y as encodeRestError, b as encodeRestSuccess, f as errorMemberSchema, q as isRestByteResponse, W as isRestResponse, K as isRestStreamResponse, ye as matchPathParams, x as nextLink, P as normalizePathParams, F as operationIdOf, I as pathParamNames, S as problemDetails, C as problemTypeOf, ee as projectedFailure, te as publicApiRoute, ne as publicSurfaceDigest, le as requireAnyScope, se as requireAuthenticated, ce as requireScope, w as resolveRestFormat, re as resourceIdField, U as response, B as restCorsHeaders, V as restCorsPreflight, de as restError, Ce as restRoutesToHttpRoutes, T as restViewSchema, be as routeAcceptsPath, pe as sse, me as sseFrame, E as toSnakeCase, ie as wireExample };