@voyant-travel/hono 0.118.2 → 0.118.4

package/dist/lib/request-event-bus.d.ts

@@ -10,9 +10,10 @@ import type { EventBus, OutboxEventStore } from "@voyant-travel/core";
  * With a `store` (transactional outbox), emits are also DURABLE: the
  * envelope is persisted before any handler runs, and failed deliveries
  * are retried by the drain. If the durable capture itself fails (DB
- * unreachable), the emit falls back to direct (non-durable) delivery —
- * losing durability for that one event is strictly better than losing
- * the event, and an order of magnitude better than failing the request.
+ * unreachable), the emit falls back to direct (non-durable) delivery.
+ * Once capture has succeeded, the wrapper must not redeliver directly:
+ * the stored row owns completion/retry, and direct fallback would make
+ * subscriber side effects ambiguous.
  *
  * Buses that predate the {@link EmitOptions} parameter simply ignore it
  * and keep awaiting all handlers — a safe degradation.

package/dist/lib/request-event-bus.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-event-bus.d.ts","sourceRoot":"","sources":["../../src/lib/request-event-bus.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,QAAQ,EAAiB,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEjG;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,QAAQ,EACb,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,gBAAgB,GACvB,QAAQ,CA+BV"}
+{"version":3,"file":"request-event-bus.d.ts","sourceRoot":"","sources":["../../src/lib/request-event-bus.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,QAAQ,EAAiB,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEjG;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,QAAQ,EACb,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,gBAAgB,GACvB,QAAQ,CAiDV"}

package/dist/lib/request-event-bus.js

@@ -9,9 +9,10 @@
  * With a `store` (transactional outbox), emits are also DURABLE: the
  * envelope is persisted before any handler runs, and failed deliveries
  * are retried by the drain. If the durable capture itself fails (DB
- * unreachable), the emit falls back to direct (non-durable) delivery —
- * losing durability for that one event is strictly better than losing
- * the event, and an order of magnitude better than failing the request.
+ * unreachable), the emit falls back to direct (non-durable) delivery.
+ * Once capture has succeeded, the wrapper must not redeliver directly:
+ * the stored row owns completion/retry, and direct fallback would make
+ * subscriber side effects ambiguous.
  *
  * Buses that predate the {@link EmitOptions} parameter simply ignore it
  * and keep awaiting all handlers — a safe degradation.
@@ -26,12 +27,28 @@ export function requestScopedEventBus(bus, schedule, store) {
             if (!store) {
                 return bus.emit(event, data, metadata, { ...base, ...options });
             }
+            let captureFailed = false;
+            const guardedStore = {
+                async insert(envelope) {
+                    try {
+                        return await store.insert(envelope);
+                    }
+                    catch (err) {
+                        captureFailed = true;
+                        throw err;
+                    }
+                },
+                complete: (id) => store.complete(id),
+                fail: (id, error) => store.fail(id, error),
+            };
             try {
-                return await bus.emit(event, data, metadata, { ...base, store, ...options });
+                return await bus.emit(event, data, metadata, { ...base, store: guardedStore, ...options });
             }
             catch (err) {
-                // Only the outbox insert can reject (handler errors are
-                // collected, bookkeeping failures are swallowed inside the bus).
+                if (!captureFailed) {
+                    console.error(`[events] durable delivery failed for "${event}" after outbox capture:`, err);
+                    return;
+                }
                 console.error(`[events] outbox capture failed for "${event}" — falling back to direct delivery:`, err);
                 return bus.emit(event, data, metadata, { ...base, ...options });
             }

package/dist/middleware/require-actor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"require-actor.d.ts","sourceRoot":"","sources":["../../src/middleware/require-actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAG7C,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAuClE;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAIzD;AAED,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAMD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,EAC5E,GAAG,OAAO,EAAE,KAAK,EAAE,GAClB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAC,CAAA;AACF,wBAAgB,YAAY,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,EAC5E,OAAO,EAAE,mBAAmB,EAC5B,GAAG,OAAO,EAAE,KAAK,EAAE,GAClB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAC,CAAA"}
+{"version":3,"file":"require-actor.d.ts","sourceRoot":"","sources":["../../src/middleware/require-actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAG7C,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AA8DlE;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAIzD;AAED,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAMD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,EAC5E,GAAG,OAAO,EAAE,KAAK,EAAE,GAClB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAC,CAAA;AACF,wBAAgB,YAAY,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,EAC5E,OAAO,EAAE,mBAAmB,EAC5B,GAAG,OAAO,EAAE,KAAK,EAAE,GAClB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAC,CAAA"}

package/dist/middleware/require-actor.js

@@ -10,7 +10,7 @@ function apiKeyResourceFromPath(pathname) {
     }
     return null;
 }
-function apiKeyPermissionActionsForMethod(method) {
+function baseApiKeyPermissionActionsForMethod(method) {
     switch (method.toUpperCase()) {
         case "GET":
         case "HEAD":
@@ -26,6 +26,27 @@ function apiKeyPermissionActionsForMethod(method) {
             return [];
     }
 }
+/**
+ * Search endpoints accept complex request bodies, so they're exposed as `POST`
+ * even though they're read-family operations. Without this, `POST
+ * /v1/<surface>/catalog/search` would only accept `write`/`trigger`/`relay`,
+ * and a `catalog:search`/`catalog:read`-scoped token would be rejected
+ * (voyant#2649). Matching a `search` / `*-search` path segment (e.g.
+ * `/catalog/search`, `/catalog/package-search`) keeps every other POST route
+ * (product writes, bookings, pricing, …) gated on its normal write actions.
+ */
+function isSearchPath(pathname) {
+    // A segment that is `search` or ends in `-search` (e.g. `package-search`),
+    // bounded so `/searchable` or `/researcher` don't count.
+    return /(?:\/|-)search(?:\/|$)/.test(pathname);
+}
+function apiKeyPermissionActionsForMethod(method, pathname) {
+    const actions = baseApiKeyPermissionActionsForMethod(method);
+    if (isSearchPath(pathname)) {
+        return Array.from(new Set([...actions, "search", "read"]));
+    }
+    return actions;
+}
 function hasAnyApiKeyPermission(scopes, resource, actions) {
     if (!scopes || scopes.length === 0)
         return false;
@@ -69,7 +90,7 @@ export function requireActor(...args) {
             // is a reserved namespace (no module is named `_meta`).
             if (resource === "_meta")
                 return next();
-            const actions = apiKeyPermissionActionsForMethod(c.req.method);
+            const actions = apiKeyPermissionActionsForMethod(c.req.method, pathname);
             if (resource && hasAnyApiKeyPermission(c.get("scopes"), resource, actions)) {
                 return next();
             }
@@ -99,7 +120,7 @@ export function requireActor(...args) {
             });
             const resource = apiKeyResourceFromPath(pathname);
             if (resource && resource !== "_meta") {
-                const actions = apiKeyPermissionActionsForMethod(c.req.method);
+                const actions = apiKeyPermissionActionsForMethod(c.req.method, pathname);
                 if (!hasAnyApiKeyPermission(scopes, resource, actions)) {
                     return c.json({ error: "Forbidden: missing required permission" }, 403);
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyant-travel/hono",
-  "version": "0.118.2",
+  "version": "0.118.4",
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
@@ -135,7 +135,7 @@
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.25",
     "zod": "^4.4.3",
-    "@voyant-travel/core": "^0.111.0",
+    "@voyant-travel/core": "^0.111.1",
     "@voyant-travel/db": "^0.109.4",
     "@voyant-travel/storage": "^0.106.0",
     "@voyant-travel/types": "^0.106.1",