cursedbelt 0.0.0

package/dist/server/middleware/errorEnvelope.js

@@ -0,0 +1,30 @@
+import { HTTPException } from 'hono/http-exception';
+import { isApiError, toErrorEnvelope } from '../errors';
+/**
+ * Hono `onError` handler. Converts ANY thrown value into the canonical
+ * `{ error: { message, code?, context? } }` envelope + the right HTTP status, and
+ * echoes the correlation id so a client can quote it in a bug report.
+ *
+ *   - `ApiError`        → its status + full envelope (message/code/context).
+ *   - `HTTPException`   → its status + message (Hono's own thrown errors).
+ *   - anything else     → 500 + a generic message; the real error is logged with
+ *                         the correlation id (never leaked to the client).
+ */
+export const errorEnvelope = (err, c) => {
+    const cid = c.get('correlationId');
+    if (cid)
+        c.header('x-correlation-id', cid);
+    if (isApiError(err)) {
+        return c.json(toErrorEnvelope(err), err.status);
+    }
+    if (err instanceof HTTPException) {
+        const body = { error: { message: err.message || 'Error' } };
+        return c.json(body, err.status);
+    }
+    // Unexpected: log the real error (with the correlation id for cross-reference),
+    // return a sanitized envelope so internals never reach the client.
+    console.error(`[error]${cid ? ` [${cid}]` : ''}`, err);
+    const body = { error: { message: 'Internal Server Error' } };
+    return c.json(body, 500);
+};
+//# sourceMappingURL=errorEnvelope.js.map

package/dist/server/middleware/errorEnvelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorEnvelope.js","sourceRoot":"","sources":["../../../src/server/middleware/errorEnvelope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAsB,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAgC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;IACnE,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACnC,IAAI,GAAG;QAAE,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAE3C,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,MAA8B,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,GAAkB,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,OAAO,EAAE,EAAE,CAAC;QAC3E,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,gFAAgF;IAChF,mEAAmE;IACnE,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,IAAI,GAAkB,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,CAAC;IAC5E,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3B,CAAC,CAAC"}

package/dist/server/middleware/index.d.ts

@@ -0,0 +1,7 @@
+export { correlationId } from './correlationId';
+export { errorEnvelope } from './errorEnvelope';
+export { clientIp, createRateLimiter, type RateLimitOpts } from './rateLimit';
+export { type RequestLoggerOpts, requestLogger } from './requestLogger';
+export { type CspDirectives, type SecurityHeadersOpts, securityHeaders, } from './securityHeaders';
+export { type FieldError, toFieldErrors, VALIDATION_ERROR_CODE, validationEnvelope, type ZValidatorTarget, zValidator, } from './zValidator';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,KAAK,iBAAiB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,UAAU,EACf,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,UAAU,GACX,MAAM,cAAc,CAAC"}

package/dist/server/middleware/index.js

@@ -0,0 +1,8 @@
+// The cross-cutting cursedbelt server middleware set.
+export { correlationId } from './correlationId';
+export { errorEnvelope } from './errorEnvelope';
+export { clientIp, createRateLimiter } from './rateLimit';
+export { requestLogger } from './requestLogger';
+export { securityHeaders, } from './securityHeaders';
+export { toFieldErrors, VALIDATION_ERROR_CODE, validationEnvelope, zValidator, } from './zValidator';
+//# sourceMappingURL=index.js.map

package/dist/server/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/middleware/index.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAsB,MAAM,aAAa,CAAC;AAC9E,OAAO,EAA0B,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAGL,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAElB,UAAU,GACX,MAAM,cAAc,CAAC"}

package/dist/server/middleware/rateLimit.d.ts

@@ -0,0 +1,28 @@
+import type { Context, MiddlewareHandler } from 'hono';
+/**
+ * The client IP for rate-limiting / logging. When `trustProxy` (default: true — Bun
+ * runs behind nginx), trust `x-forwarded-for` (first hop) / `x-real-ip`; otherwise
+ * use the socket peer. Falls back to `'unknown'` when no connection info is
+ * available (e.g. `app.fetch(new Request(...))` in tests).
+ */
+export declare function clientIp(c: Context, trustProxy?: boolean): string;
+export interface RateLimitOpts {
+    /** Max requests allowed per window per key. */
+    limit: number;
+    /** Sliding window length in ms. */
+    windowMs: number;
+    /** 429 body message. */
+    message?: string;
+    /** Key function (default: client IP). Use to throttle per authenticated user. */
+    keyFn?: (c: Context) => string;
+    /** Trust proxy headers for the default IP key. Default: true. */
+    trustProxy?: boolean;
+}
+/**
+ * A sliding-window, in-memory rate limiter as Hono middleware. Keeps a timestamp log
+ * per key, prunes entries older than the window on access, and a cheap periodic
+ * sweep drops idle keys (no dangling timers). On limit: 429 + `Retry-After` + the
+ * canonical `{ error }` envelope. Used by auth routes (task 26) + vault unlock.
+ */
+export declare function createRateLimiter(opts: RateLimitOpts): MiddlewareHandler;
+//# sourceMappingURL=rateLimit.d.ts.map

package/dist/server/middleware/rateLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/rateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAIvD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,UAAO,GAAG,MAAM,CAY9D;AAED,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,wBAAwB;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IAC/B,iEAAiE;IACjE,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CA2CxE"}

package/dist/server/middleware/rateLimit.js

@@ -0,0 +1,65 @@
+import { getConnInfo } from 'hono/bun';
+/**
+ * The client IP for rate-limiting / logging. When `trustProxy` (default: true — Bun
+ * runs behind nginx), trust `x-forwarded-for` (first hop) / `x-real-ip`; otherwise
+ * use the socket peer. Falls back to `'unknown'` when no connection info is
+ * available (e.g. `app.fetch(new Request(...))` in tests).
+ */
+export function clientIp(c, trustProxy = true) {
+    if (trustProxy) {
+        const xff = c.req.header('x-forwarded-for');
+        if (xff)
+            return xff.split(',')[0]?.trim() || 'unknown';
+        const xri = c.req.header('x-real-ip');
+        if (xri)
+            return xri.trim();
+    }
+    try {
+        return getConnInfo(c).remote.address ?? 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+/**
+ * A sliding-window, in-memory rate limiter as Hono middleware. Keeps a timestamp log
+ * per key, prunes entries older than the window on access, and a cheap periodic
+ * sweep drops idle keys (no dangling timers). On limit: 429 + `Retry-After` + the
+ * canonical `{ error }` envelope. Used by auth routes (task 26) + vault unlock.
+ */
+export function createRateLimiter(opts) {
+    const { limit, windowMs, message = 'Too many requests. Please try again later.', keyFn, trustProxy = true, } = opts;
+    const hits = new Map();
+    let lastSweep = Date.now();
+    const sweep = (now) => {
+        const cutoff = now - windowMs;
+        for (const [key, times] of hits) {
+            const live = times.filter((t) => t > cutoff);
+            if (live.length === 0)
+                hits.delete(key);
+            else
+                hits.set(key, live);
+        }
+        lastSweep = now;
+    };
+    return async (c, next) => {
+        const key = keyFn ? keyFn(c) : clientIp(c, trustProxy);
+        const now = Date.now();
+        const cutoff = now - windowMs;
+        // Periodically evict idle keys so the map can't grow unbounded.
+        if (now - lastSweep > windowMs)
+            sweep(now);
+        const times = (hits.get(key) ?? []).filter((t) => t > cutoff);
+        if (times.length >= limit) {
+            hits.set(key, times);
+            const retryMs = (times[0] ?? now) + windowMs - now;
+            c.header('Retry-After', String(Math.max(1, Math.ceil(retryMs / 1000))));
+            const body = { error: { message, code: 'rate_limited' } };
+            return c.json(body, 429);
+        }
+        times.push(now);
+        hits.set(key, times);
+        await next();
+    };
+}
+//# sourceMappingURL=rateLimit.js.map

package/dist/server/middleware/rateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../../src/server/middleware/rateLimit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAGvC;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAU,EAAE,UAAU,GAAG,IAAI;IACpD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC5C,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QACvD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAeD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,MAAM,EACJ,KAAK,EACL,QAAQ,EACR,OAAO,GAAG,4CAA4C,EACtD,KAAK,EACL,UAAU,GAAG,IAAI,GAClB,GAAG,IAAI,CAAC;IACT,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE3B,MAAM,KAAK,GAAG,CAAC,GAAW,EAAQ,EAAE;QAClC,MAAM,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC;QAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;;gBACnC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,SAAS,GAAG,GAAG,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC;QAE9B,gEAAgE;QAChE,IAAI,GAAG,GAAG,SAAS,GAAG,QAAQ;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAE3C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QAE9D,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACrB,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,QAAQ,GAAG,GAAG,CAAC;YACnD,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,MAAM,IAAI,GAAkB,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC;YACzE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrB,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/middleware/requestLogger.d.ts

@@ -0,0 +1,30 @@
+import type { Database } from 'bun:sqlite';
+import type { MiddlewareHandler } from 'hono';
+import type { CursedbeltEnv } from '../context';
+import { type MetricsBuffer } from '../metrics/metricsBuffer';
+/**
+ * Structured request/response logging. After each request it records one slim
+ * `request_metrics` row (via the batched {@link MetricsBuffer}, off the hot path)
+ * and, for errors (status ≥ 400) or slow requests, one `event_logs` row tagged with
+ * the correlation id. Attributes rows to `c.get('userId')` when the app's auth
+ * middleware has set it.
+ *
+ * It records metrics even when a downstream handler THROWS: the error is caught,
+ * the would-be status derived, the row written, then the error re-thrown so the
+ * error-envelope `onError` still produces the response.
+ */
+export interface RequestLoggerOpts {
+    /**
+     * The metrics buffer to write through. Provide one (and own its lifecycle via
+     * `buffer.stop()`) to share it / flush deterministically; omit to create one from
+     * `db`. Its flush timer is `unref()`'d, so an internally-created buffer is fine for
+     * long-running servers.
+     */
+    buffer?: MetricsBuffer;
+    /** Duration (ms) at/above which a 2xx request also logs an `event_logs` row. Default: 2000. */
+    slowMs?: number;
+    /** Also write `event_logs` rows for status ≥ 400. Default: true. */
+    logErrors?: boolean;
+}
+export declare function requestLogger(db: Database, opts?: RequestLoggerOpts): MiddlewareHandler<CursedbeltEnv>;
+//# sourceMappingURL=requestLogger.d.ts.map

package/dist/server/middleware/requestLogger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestLogger.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/requestLogger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGnF;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAQD,wBAAgB,aAAa,CAC3B,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE,iBAAsB,GAC3B,iBAAiB,CAAC,aAAa,CAAC,CAmDlC"}

package/dist/server/middleware/requestLogger.js

@@ -0,0 +1,48 @@
+import { HTTPException } from 'hono/http-exception';
+import { isApiError } from '../errors';
+import { createMetricsBuffer } from '../metrics/metricsBuffer';
+import { normalizeRoute } from '../metrics/normalizeRoute';
+function statusOfThrown(err) {
+    if (isApiError(err))
+        return err.status;
+    if (err instanceof HTTPException)
+        return err.status;
+    return 500;
+}
+export function requestLogger(db, opts = {}) {
+    const buffer = opts.buffer ?? createMetricsBuffer({ db });
+    const slowMs = opts.slowMs ?? 2000;
+    const logErrors = opts.logErrors ?? true;
+    const insertEvent = db.prepare(`INSERT INTO event_logs
+       (id, correlation_id, event_name, type, message, details, duration_ms, user_id, created_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+    return async (c, next) => {
+        const start = performance.now();
+        let thrown;
+        let didThrow = false;
+        try {
+            await next();
+        }
+        catch (err) {
+            thrown = err;
+            didThrow = true;
+        }
+        const durationMs = performance.now() - start;
+        const { method, route } = normalizeRoute(c);
+        const status = didThrow ? statusOfThrown(thrown) : c.res.status;
+        const lenHeader = didThrow ? null : c.res.headers.get('content-length');
+        const bytesOut = lenHeader ? Number(lenHeader) : null;
+        const userId = c.get('userId') ?? null;
+        buffer.record({ ts: Date.now(), method, route, status, durationMs, bytesOut, userId });
+        const isError = status >= 400;
+        const isSlow = durationMs >= slowMs;
+        if ((logErrors && isError) || isSlow) {
+            const type = status >= 500 ? 'error' : isError ? 'warn' : 'info';
+            insertEvent.run(crypto.randomUUID(), c.get('correlationId') ?? null, isError ? 'http_error' : 'http_slow', type, `${method} ${route} → ${status}`, JSON.stringify({ method, route, status, durationMs: Math.round(durationMs), bytesOut }), Math.round(durationMs), userId, new Date().toISOString());
+        }
+        // Re-throw so the error-envelope onError still builds the response.
+        if (didThrow)
+            throw thrown;
+    };
+}
+//# sourceMappingURL=requestLogger.js.map

package/dist/server/middleware/requestLogger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestLogger.js","sourceRoot":"","sources":["../../../src/server/middleware/requestLogger.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAsB,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA4B3D,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IACvC,IAAI,GAAG,YAAY,aAAa;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,EAAY,EACZ,OAA0B,EAAE;IAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IAEzC,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAC5B;;wCAEoC,CACrC,CAAC;IAEF,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,MAAe,CAAC;QACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,CAAC;YACb,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAE7C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QAEvC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAEvF,MAAM,OAAO,GAAG,MAAM,IAAI,GAAG,CAAC;QAC9B,MAAM,MAAM,GAAG,UAAU,IAAI,MAAM,CAAC;QACpC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;YACjE,WAAW,CAAC,GAAG,CACb,MAAM,CAAC,UAAU,EAAE,EACnB,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,EAC9B,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EACpC,IAAI,EACJ,GAAG,MAAM,IAAI,KAAK,MAAM,MAAM,EAAE,EAChC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,EACvF,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EACtB,MAAM,EACN,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CACzB,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,IAAI,QAAQ;YAAE,MAAM,MAAM,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/middleware/securityHeaders.d.ts

@@ -0,0 +1,30 @@
+import type { MiddlewareHandler } from 'hono';
+import { secureHeaders } from 'hono/secure-headers';
+/**
+ * Security headers, built on Hono's `secureHeaders` (helmet-equivalent) rather than
+ * a hand-rolled header pass — robust + maintained, per the "prefer configured
+ * libraries" mandate. cursedbelt supplies sensible cross-app defaults (strict CSP,
+ * `X-Frame-Options: DENY`, COOP, HSTS in production, …); the consuming app extends
+ * just the directives it needs (CDN hosts, embed frames) via {@link SecurityHeadersOpts}.
+ */
+type SecureHeadersOptions = NonNullable<Parameters<typeof secureHeaders>[0]>;
+export type CspDirectives = NonNullable<SecureHeadersOptions['contentSecurityPolicy']>;
+export interface SecurityHeadersOpts {
+    /**
+     * Extend/override the default CSP directives. Shallow-merged per directive, so a
+     * supplied directive REPLACES that default's value (pass the full list). Set to
+     * `false` to omit the CSP header entirely.
+     */
+    csp?: CspDirectives | false;
+    /**
+     * `Strict-Transport-Security` value. Default: enabled in production
+     * (`NODE_ENV==='production'`) as `max-age=31536000; includeSubDomains`, off
+     * otherwise. Pass a string to force a value, or `false` to disable.
+     */
+    hsts?: boolean | string;
+    /** Escape hatch: any other `secureHeaders` option, merged last (wins). */
+    overrides?: Partial<SecureHeadersOptions>;
+}
+export declare function securityHeaders(opts?: SecurityHeadersOpts): MiddlewareHandler;
+export {};
+//# sourceMappingURL=securityHeaders.d.ts.map

package/dist/server/middleware/securityHeaders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityHeaders.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/securityHeaders.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD;;;;;;GAMG;AAGH,KAAK,oBAAoB,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC,CAAC;AAEvF,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,aAAa,GAAG,KAAK,CAAC;IAC5B;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC3C;AAqBD,wBAAgB,eAAe,CAAC,IAAI,GAAE,mBAAwB,GAAG,iBAAiB,CA0BjF"}

package/dist/server/middleware/securityHeaders.js

@@ -0,0 +1,45 @@
+import { secureHeaders } from 'hono/secure-headers';
+// A strict baseline that works for a same-origin SPA + JSON API. Apps widen the
+// few directives they need (script/img/connect hosts, frame embeds) via `opts.csp`.
+const DEFAULT_CSP = {
+    defaultSrc: ["'self'"],
+    baseUri: ["'self'"],
+    objectSrc: ["'none'"],
+    frameAncestors: ["'none'"],
+    formAction: ["'self'"],
+    scriptSrc: ["'self'"],
+    scriptSrcAttr: ["'none'"],
+    // Inline styles are needed for Tailwind / chart / drag transforms; inline SCRIPTS
+    // stay blocked (the real XSS barrier).
+    styleSrc: ["'self'", "'unsafe-inline'"],
+    imgSrc: ["'self'", 'data:', 'blob:'],
+    fontSrc: ["'self'", 'data:'],
+    connectSrc: ["'self'"],
+    upgradeInsecureRequests: [],
+};
+export function securityHeaders(opts = {}) {
+    // A runtime escape hatch matching ca's ops convention: CSP_DISABLED=true drops CSP.
+    const cspOff = opts.csp === false || process.env.CSP_DISABLED === 'true';
+    const csp = cspOff ? undefined : { ...DEFAULT_CSP, ...(opts.csp ?? {}) };
+    const isProd = process.env.NODE_ENV === 'production';
+    const hsts = opts.hsts ?? (isProd ? 'max-age=31536000; includeSubDomains' : false);
+    return secureHeaders({
+        contentSecurityPolicy: csp,
+        xContentTypeOptions: 'nosniff',
+        // DENY (not SAMEORIGIN) to agree with CSP `frame-ancestors 'none'`.
+        xFrameOptions: 'DENY',
+        referrerPolicy: 'strict-origin-when-cross-origin',
+        crossOriginOpenerPolicy: 'same-origin',
+        // We serve cross-origin media/fonts, so keep CORP permissive.
+        crossOriginResourcePolicy: 'cross-origin',
+        // COEP breaks third-party embeds (YouTube, CDNs) — off by default.
+        crossOriginEmbedderPolicy: false,
+        originAgentCluster: true,
+        xDnsPrefetchControl: 'off',
+        xPermittedCrossDomainPolicies: 'none',
+        strictTransportSecurity: hsts,
+        removePoweredBy: true,
+        ...opts.overrides,
+    });
+}
+//# sourceMappingURL=securityHeaders.js.map

package/dist/server/middleware/securityHeaders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityHeaders.js","sourceRoot":"","sources":["../../../src/server/middleware/securityHeaders.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA+BpD,gFAAgF;AAChF,oFAAoF;AACpF,MAAM,WAAW,GAAkB;IACjC,UAAU,EAAE,CAAC,QAAQ,CAAC;IACtB,OAAO,EAAE,CAAC,QAAQ,CAAC;IACnB,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,cAAc,EAAE,CAAC,QAAQ,CAAC;IAC1B,UAAU,EAAE,CAAC,QAAQ,CAAC;IACtB,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,aAAa,EAAE,CAAC,QAAQ,CAAC;IACzB,kFAAkF;IAClF,uCAAuC;IACvC,QAAQ,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACvC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC;IACpC,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC5B,UAAU,EAAE,CAAC,QAAQ,CAAC;IACtB,uBAAuB,EAAE,EAAE;CAC5B,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,OAA4B,EAAE;IAC5D,oFAAoF;IACpF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC;IACzE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;IAEzE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAEnF,OAAO,aAAa,CAAC;QACnB,qBAAqB,EAAE,GAAG;QAC1B,mBAAmB,EAAE,SAAS;QAC9B,oEAAoE;QACpE,aAAa,EAAE,MAAM;QACrB,cAAc,EAAE,iCAAiC;QACjD,uBAAuB,EAAE,aAAa;QACtC,8DAA8D;QAC9D,yBAAyB,EAAE,cAAc;QACzC,mEAAmE;QACnE,yBAAyB,EAAE,KAAK;QAChC,kBAAkB,EAAE,IAAI;QACxB,mBAAmB,EAAE,KAAK;QAC1B,6BAA6B,EAAE,MAAM;QACrC,uBAAuB,EAAE,IAAI;QAC7B,eAAe,EAAE,IAAI;QACrB,GAAG,IAAI,CAAC,SAAS;KAClB,CAAC,CAAC;AACL,CAAC"}

package/dist/server/middleware/zValidator.d.ts

@@ -0,0 +1,48 @@
+import type { Env, MiddlewareHandler } from 'hono';
+import type { ZodType, z } from 'zod';
+import type { CursedbeltEnv } from '../context';
+import type { ErrorEnvelope } from '../errors';
+/** One per-field validation error — `z.ZodError.issues` map to this on the wire. */
+export interface FieldError {
+    /** Dotted path to the offending field (`''` for a top-level/whole-body issue). */
+    field: string;
+    /** Human-readable, zod-authored message. */
+    message: string;
+}
+/**
+ * The canonical machine code carried in a validation envelope's `error.code`. Matches
+ * the apps' `ERROR_CODES.validation`, so a client can branch on it without string-
+ * matching the (localizable) message.
+ */
+export declare const VALIDATION_ERROR_CODE = "validation";
+/** The request locations a schema can validate. Mirrors Hono's body/non-body split. */
+export type ZValidatorTarget = 'json' | 'form' | 'query' | 'param';
+/** Map a {@link https://zod.dev | zod} error's issues to the wire {@link FieldError}s. */
+export declare function toFieldErrors(error: z.ZodError): FieldError[];
+/** Build the canonical validation envelope from a set of field errors. */
+export declare function validationEnvelope(errors: FieldError[], message?: string): ErrorEnvelope;
+/**
+ * Validate a request `target` against a zod `schema`. Mount per route ahead of the
+ * handler:
+ *
+ * ```ts
+ * register('post', '/notes', zValidator(CreateNoteSchema), (c) => {
+ *   const body = c.req.valid('json'); // typed z.infer<typeof CreateNoteSchema>
+ *   // …
+ * });
+ * ```
+ *
+ * On failure responds `400` with the canonical envelope (field errors under
+ * `context.errors`); never throws, so it produces the same body whether or not the
+ * app mounts the {@link errorEnvelope} `onError` handler. On success the parsed value
+ * is available as both `c.req.valid(target)` and `c.get('validatedBody')`.
+ */
+export declare function zValidator<Schema extends ZodType, Target extends ZValidatorTarget = 'json', E extends Env = CursedbeltEnv, P extends string = string>(schema: Schema, target?: Target): MiddlewareHandler<E, P, {
+    in: {
+        [K in Target]: z.input<Schema>;
+    };
+    out: {
+        [K in Target]: z.output<Schema>;
+    };
+}>;
+//# sourceMappingURL=zValidator.d.ts.map

package/dist/server/middleware/zValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zValidator.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/zValidator.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACnD,OAAO,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,oFAAoF;AACpF,MAAM,WAAW,UAAU;IACzB,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAKlD,uFAAuF;AACvF,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAEnE,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,GAAG,UAAU,EAAE,CAK7D;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,UAAU,EAAE,EACpB,OAAO,GAAE,MAAwB,GAChC,aAAa,CAEf;AA4BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CACxB,MAAM,SAAS,OAAO,EACtB,MAAM,SAAS,gBAAgB,GAAG,MAAM,EACxC,CAAC,SAAS,GAAG,GAAG,aAAa,EAC7B,CAAC,SAAS,MAAM,GAAG,MAAM,EAEzB,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,MAAyB,GAChC,iBAAiB,CAClB,CAAC,EACD,CAAC,EACD;IAAE,EAAE,EAAE;SAAG,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;KAAE,CAAC;IAAC,GAAG,EAAE;SAAG,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;KAAE,CAAA;CAAE,CACrF,CAsBA"}

package/dist/server/middleware/zValidator.js

@@ -0,0 +1,76 @@
+/**
+ * The canonical machine code carried in a validation envelope's `error.code`. Matches
+ * the apps' `ERROR_CODES.validation`, so a client can branch on it without string-
+ * matching the (localizable) message.
+ */
+export const VALIDATION_ERROR_CODE = 'validation';
+/** The default client-facing message when validation fails. */
+const DEFAULT_MESSAGE = 'Validation failed';
+/** Map a {@link https://zod.dev | zod} error's issues to the wire {@link FieldError}s. */
+export function toFieldErrors(error) {
+    return error.issues.map((issue) => ({
+        field: issue.path.map((segment) => String(segment)).join('.'),
+        message: issue.message,
+    }));
+}
+/** Build the canonical validation envelope from a set of field errors. */
+export function validationEnvelope(errors, message = DEFAULT_MESSAGE) {
+    return { error: { message, code: VALIDATION_ERROR_CODE, context: { errors } } };
+}
+/**
+ * Read the value a target validates against. The body targets (`json`/`form`) prefer
+ * the ctgr-decoded body so a tunnelled mutation validates its real payload; the
+ * URL-bound targets (`query`/`param`) are never tunnelled (GETs go direct) and read
+ * from the live request. A query object collapses single-valued keys to a string so
+ * `z.string()`/`z.coerce.number()` field schemas see a scalar (repeated keys stay an
+ * array) — matching Hono's own validator semantics.
+ */
+async function readTarget(c, target) {
+    if (target === 'json' || target === 'form') {
+        const decoded = c.get('ctgrDecoded');
+        if (decoded)
+            return decoded.body;
+        if (target === 'json')
+            return c.req.json().catch(() => undefined);
+        return c.req.parseBody();
+    }
+    if (target === 'param')
+        return c.req.param();
+    return Object.fromEntries(Object.entries(c.req.queries()).map(([key, values]) => values.length === 1 ? [key, values[0]] : [key, values]));
+}
+/**
+ * Validate a request `target` against a zod `schema`. Mount per route ahead of the
+ * handler:
+ *
+ * ```ts
+ * register('post', '/notes', zValidator(CreateNoteSchema), (c) => {
+ *   const body = c.req.valid('json'); // typed z.infer<typeof CreateNoteSchema>
+ *   // …
+ * });
+ * ```
+ *
+ * On failure responds `400` with the canonical envelope (field errors under
+ * `context.errors`); never throws, so it produces the same body whether or not the
+ * app mounts the {@link errorEnvelope} `onError` handler. On success the parsed value
+ * is available as both `c.req.valid(target)` and `c.get('validatedBody')`.
+ */
+export function zValidator(schema, target = 'json') {
+    const handler = async (c, next) => {
+        const raw = await readTarget(c, target);
+        const result = schema.safeParse(raw);
+        if (!result.success) {
+            return c.json(validationEnvelope(toFieldErrors(result.error)), 400);
+        }
+        // Expose the parsed value both ways (typed `c.req.valid` + convenience getter).
+        c.req.addValidatedData(target, result.data);
+        c.set('validatedBody', result.data);
+        await next();
+    };
+    // The body is written against the concrete `CursedbeltEnv` (so the ctgr/validatedBody
+    // accessors type-check); the public signature is the generic, schema-typed
+    // MiddlewareHandler that flows `c.req.valid(target)` into the handler. Hono's Context
+    // is invariant in its Env, so this widening goes through `unknown` — the same cast
+    // a hand-rolled typed middleware (e.g. @hono/zod-validator) performs.
+    return handler;
+}
+//# sourceMappingURL=zValidator.js.map

package/dist/server/middleware/zValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zValidator.js","sourceRoot":"","sources":["../../../src/server/middleware/zValidator.ts"],"names":[],"mappings":"AAyCA;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAElD,+DAA+D;AAC/D,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAK5C,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7D,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAChC,MAAoB,EACpB,UAAkB,eAAe;IAEjC,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAClF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,UAAU,CACvB,CAAkD,EAClD,MAAwB;IAExB,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACrC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC;QACjC,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IAC7C,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CACpD,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CACvD,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,UAAU,CAMxB,MAAc,EACd,SAAiB,MAAgB;IAMjC,MAAM,OAAO,GAAqC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAClE,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,gFAAgF;QAChF,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,IAA+B,CAAC,CAAC;QACvE,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;IACF,sFAAsF;IACtF,2EAA2E;IAC3E,sFAAsF;IACtF,mFAAmF;IACnF,sEAAsE;IACtE,OAAO,OAIN,CAAC;AACJ,CAAC"}

package/dist/server/migration/runner.d.ts

@@ -0,0 +1,43 @@
+import type { Database } from 'bun:sqlite';
+import type { Migration } from './types';
+/**
+ * The versioned SQLite migration runner — a tiny `_migrations`-sentinel runner, NOT
+ * a schema-first ORM. It replaces the old scattered guarded-`ALTER` /
+ * `addColumnIfMissing` pattern with ordered, once-only migrations whose names are
+ * recorded once applied. Business tables stay raw (`db.query` + `data JSON`); only
+ * the *plumbing* tables get Kysely types (see `../db/kysely`).
+ */
+export interface PragmaOptions {
+    /** Enforce foreign keys. Default: ON. */
+    foreignKeys?: boolean;
+    /** Journal mode. Default: WAL (falls back to `memory` on `:memory:` DBs). */
+    journalMode?: 'WAL' | 'DELETE' | 'TRUNCATE' | 'PERSIST' | 'MEMORY' | 'OFF';
+    /** Synchronous level. Default: NORMAL (safe + fast under WAL). */
+    synchronous?: 'OFF' | 'NORMAL' | 'FULL' | 'EXTRA';
+    /** Busy timeout in ms before SQLITE_BUSY. Default: 5000. */
+    busyTimeoutMs?: number;
+}
+/**
+ * Apply the recommended connection PRAGMAs. **Call this BEFORE {@link runMigrations}
+ * and OUTSIDE any transaction** — `PRAGMA foreign_keys` is silently ignored inside a
+ * transaction, and the runner wraps each migration in one. Idempotent; safe on boot.
+ */
+export declare function applyRecommendedPragmas(db: Database, opts?: PragmaOptions): void;
+/**
+ * Run every pending migration exactly once, in array order, each inside its own
+ * transaction, recording its `name` in `_migrations`. Returns the names actually
+ * applied this call (empty when already up to date — re-running is a no-op).
+ *
+ * Set the connection PRAGMAs first via {@link applyRecommendedPragmas} (foreign-key
+ * enforcement cannot be turned on inside the per-migration transaction).
+ */
+export declare function runMigrations(db: Database, migrations: readonly Migration[]): string[];
+/** Does `table` have a column named `column`? (via `PRAGMA table_info`). */
+export declare function columnExists(db: Database, table: string, column: string): boolean;
+/**
+ * Add a column if it is missing (idempotent). Returns true when it was added. A
+ * migration helper for the rare evolve-in-place case; the canonical schema is built
+ * fresh by `0001_initial`, so new migrations normally `CREATE` rather than `ALTER`.
+ */
+export declare function addColumnIfMissing(db: Database, table: string, column: string, ddl: string): boolean;
+//# sourceMappingURL=runner.d.ts.map

package/dist/server/migration/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/server/migration/runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;GAMG;AAEH,MAAM,WAAW,aAAa;IAC5B,yCAAyC;IACzC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,KAAK,CAAC;IAC3E,kEAAkE;IAClE,WAAW,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IAClD,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAE,aAAkB,GAAG,IAAI,CAKpF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,EAAE,CAqBtF;AAMD,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAGjF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAIT"}

package/dist/server/migration/runner.js

@@ -0,0 +1,56 @@
+/**
+ * Apply the recommended connection PRAGMAs. **Call this BEFORE {@link runMigrations}
+ * and OUTSIDE any transaction** — `PRAGMA foreign_keys` is silently ignored inside a
+ * transaction, and the runner wraps each migration in one. Idempotent; safe on boot.
+ */
+export function applyRecommendedPragmas(db, opts = {}) {
+    db.run(`PRAGMA foreign_keys = ${opts.foreignKeys === false ? 'OFF' : 'ON'}`);
+    db.run(`PRAGMA journal_mode = ${opts.journalMode ?? 'WAL'}`);
+    db.run(`PRAGMA synchronous = ${opts.synchronous ?? 'NORMAL'}`);
+    db.run(`PRAGMA busy_timeout = ${opts.busyTimeoutMs ?? 5000}`);
+}
+/**
+ * Run every pending migration exactly once, in array order, each inside its own
+ * transaction, recording its `name` in `_migrations`. Returns the names actually
+ * applied this call (empty when already up to date — re-running is a no-op).
+ *
+ * Set the connection PRAGMAs first via {@link applyRecommendedPragmas} (foreign-key
+ * enforcement cannot be turned on inside the per-migration transaction).
+ */
+export function runMigrations(db, migrations) {
+    db.run('CREATE TABLE IF NOT EXISTS _migrations (name TEXT PRIMARY KEY, applied_at TEXT NOT NULL)');
+    const applied = new Set(db.query('SELECT name FROM _migrations').all().map((r) => r.name));
+    const insert = db.prepare('INSERT INTO _migrations (name, applied_at) VALUES (?, ?)');
+    const ran = [];
+    for (const m of migrations) {
+        if (applied.has(m.name))
+            continue;
+        const apply = db.transaction(() => {
+            m.up(db);
+            insert.run(m.name, new Date().toISOString());
+        });
+        apply();
+        ran.push(m.name);
+    }
+    return ran;
+}
+function quoteIdent(name) {
+    return `"${name.replace(/"/g, '""')}"`;
+}
+/** Does `table` have a column named `column`? (via `PRAGMA table_info`). */
+export function columnExists(db, table, column) {
+    const rows = db.query(`PRAGMA table_info(${quoteIdent(table)})`).all();
+    return rows.some((r) => r.name === column);
+}
+/**
+ * Add a column if it is missing (idempotent). Returns true when it was added. A
+ * migration helper for the rare evolve-in-place case; the canonical schema is built
+ * fresh by `0001_initial`, so new migrations normally `CREATE` rather than `ALTER`.
+ */
+export function addColumnIfMissing(db, table, column, ddl) {
+    if (columnExists(db, table, column))
+        return false;
+    db.run(`ALTER TABLE ${quoteIdent(table)} ADD COLUMN ${quoteIdent(column)} ${ddl}`);
+    return true;
+}
+//# sourceMappingURL=runner.js.map

package/dist/server/migration/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../../src/server/migration/runner.ts"],"names":[],"mappings":"AAsBA;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,EAAY,EAAE,OAAsB,EAAE;IAC5E,EAAE,CAAC,GAAG,CAAC,yBAAyB,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,EAAE,CAAC,GAAG,CAAC,yBAAyB,IAAI,CAAC,WAAW,IAAI,KAAK,EAAE,CAAC,CAAC;IAC7D,EAAE,CAAC,GAAG,CAAC,wBAAwB,IAAI,CAAC,WAAW,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC/D,EAAE,CAAC,GAAG,CAAC,yBAAyB,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,EAAY,EAAE,UAAgC;IAC1E,EAAE,CAAC,GAAG,CACJ,0FAA0F,CAC3F,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,GAAG,CACpB,EAAE,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,GAAG,EAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC/F,CAAC;IACF,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC;IACtF,MAAM,GAAG,GAAa,EAAE,CAAC;IAEzB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YAChC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACT,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QACH,KAAK,EAAE,CAAC;QACR,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACzC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,EAAY,EAAE,KAAa,EAAE,MAAc;IACtE,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,qBAAqB,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAA6B,CAAC;IAClG,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,EAAY,EACZ,KAAa,EACb,MAAc,EACd,GAAW;IAEX,IAAI,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,EAAE,CAAC,GAAG,CAAC,eAAe,UAAU,CAAC,KAAK,CAAC,eAAe,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACnF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/server/migration/types.d.ts

@@ -0,0 +1,17 @@
+import type { Database } from 'bun:sqlite';
+/**
+ * One ordered, immutable schema migration. `name` is recorded in the `_migrations`
+ * sentinel once applied, so a migration's `up()` runs exactly once across the life
+ * of a database. Corrections land as NEW migrations — never edit a shipped one, and
+ * never rename one that has been applied (the name is its identity).
+ *
+ * `up()` runs inside the runner's per-migration transaction; throw to abort + roll
+ * back that migration (the sentinel row is not written, so it retries next boot).
+ */
+export interface Migration {
+    /** Unique, lexically-ordered name, e.g. `0001_initial`. Immutable once applied. */
+    readonly name: string;
+    /** Apply the migration. Runs inside the runner's transaction. */
+    up(db: Database): void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/server/migration/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/server/migration/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,EAAE,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAAC;CACxB"}

package/dist/server/migration/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/server/migration/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/server/migration/types.ts"],"names":[],"mappings":""}