cursedbelt 2.8.0 → 3.0.0

package/dist/server/middleware/requestLogger.js

@@ -1,48 +0,0 @@
-import { HTTPException } from 'hono/http-exception';
-import { isApiError } from '../errors';
-import { createMetricsBuffer } from '../metrics/metricsBuffer';
-import { normalizeRoute } from '../metrics/normalizeRoute';
-function statusOfThrown(err) {
-    if (isApiError(err))
-        return err.status;
-    if (err instanceof HTTPException)
-        return err.status;
-    return 500;
-}
-export function requestLogger(db, opts = {}) {
-    const buffer = opts.buffer ?? createMetricsBuffer({ db });
-    const slowMs = opts.slowMs ?? 2000;
-    const logErrors = opts.logErrors ?? true;
-    const insertEvent = db.prepare(`INSERT INTO event_logs
-       (id, correlation_id, event_name, type, message, details, duration_ms, user_id, created_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`);
-    return async (c, next) => {
-        const start = performance.now();
-        let thrown;
-        let didThrow = false;
-        try {
-            await next();
-        }
-        catch (err) {
-            thrown = err;
-            didThrow = true;
-        }
-        const durationMs = performance.now() - start;
-        const { method, route } = normalizeRoute(c);
-        const status = didThrow ? statusOfThrown(thrown) : c.res.status;
-        const lenHeader = didThrow ? null : c.res.headers.get('content-length');
-        const bytesOut = lenHeader ? Number(lenHeader) : null;
-        const userId = c.get('userId') ?? null;
-        buffer.record({ ts: Date.now(), method, route, status, durationMs, bytesOut, userId });
-        const isError = status >= 400;
-        const isSlow = durationMs >= slowMs;
-        if ((logErrors && isError) || isSlow) {
-            const type = status >= 500 ? 'error' : isError ? 'warn' : 'info';
-            insertEvent.run(crypto.randomUUID(), c.get('correlationId') ?? null, isError ? 'http_error' : 'http_slow', type, `${method} ${route} → ${status}`, JSON.stringify({ method, route, status, durationMs: Math.round(durationMs), bytesOut }), Math.round(durationMs), userId, new Date().toISOString());
-        }
-        // Re-throw so the error-envelope onError still builds the response.
-        if (didThrow)
-            throw thrown;
-    };
-}
-//# sourceMappingURL=requestLogger.js.map

package/dist/server/middleware/requestLogger.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"requestLogger.js","sourceRoot":"","sources":["../../../src/server/middleware/requestLogger.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAsB,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA4B3D,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IACvC,IAAI,GAAG,YAAY,aAAa;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,EAAY,EACZ,OAA0B,EAAE;IAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IAEzC,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAC5B;;wCAEoC,CACrC,CAAC;IAEF,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,MAAe,CAAC;QACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,CAAC;YACb,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAE7C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QAEvC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAEvF,MAAM,OAAO,GAAG,MAAM,IAAI,GAAG,CAAC;QAC9B,MAAM,MAAM,GAAG,UAAU,IAAI,MAAM,CAAC;QACpC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;YACjE,WAAW,CAAC,GAAG,CACb,MAAM,CAAC,UAAU,EAAE,EACnB,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,EAC9B,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EACpC,IAAI,EACJ,GAAG,MAAM,IAAI,KAAK,MAAM,MAAM,EAAE,EAChC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,EACvF,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EACtB,MAAM,EACN,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CACzB,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,IAAI,QAAQ;YAAE,MAAM,MAAM,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/middleware/securityHeaders.d.ts

@@ -1,30 +0,0 @@
-import type { MiddlewareHandler } from 'hono';
-import { secureHeaders } from 'hono/secure-headers';
-/**
- * Security headers, built on Hono's `secureHeaders` (helmet-equivalent) rather than
- * a hand-rolled header pass — robust + maintained, per the "prefer configured
- * libraries" mandate. cursedbelt supplies sensible cross-app defaults (strict CSP,
- * `X-Frame-Options: DENY`, COOP, HSTS in production, …); the consuming app extends
- * just the directives it needs (CDN hosts, embed frames) via {@link SecurityHeadersOpts}.
- */
-type SecureHeadersOptions = NonNullable<Parameters<typeof secureHeaders>[0]>;
-export type CspDirectives = NonNullable<SecureHeadersOptions['contentSecurityPolicy']>;
-export interface SecurityHeadersOpts {
-    /**
-     * Extend/override the default CSP directives. Shallow-merged per directive, so a
-     * supplied directive REPLACES that default's value (pass the full list). Set to
-     * `false` to omit the CSP header entirely.
-     */
-    csp?: CspDirectives | false;
-    /**
-     * `Strict-Transport-Security` value. Default: enabled in production
-     * (`NODE_ENV==='production'`) as `max-age=31536000; includeSubDomains`, off
-     * otherwise. Pass a string to force a value, or `false` to disable.
-     */
-    hsts?: boolean | string;
-    /** Escape hatch: any other `secureHeaders` option, merged last (wins). */
-    overrides?: Partial<SecureHeadersOptions>;
-}
-export declare function securityHeaders(opts?: SecurityHeadersOpts): MiddlewareHandler;
-export {};
-//# sourceMappingURL=securityHeaders.d.ts.map

package/dist/server/middleware/securityHeaders.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"securityHeaders.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/securityHeaders.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD;;;;;;GAMG;AAGH,KAAK,oBAAoB,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC,CAAC;AAEvF,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,aAAa,GAAG,KAAK,CAAC;IAC5B;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC3C;AAqBD,wBAAgB,eAAe,CAAC,IAAI,GAAE,mBAAwB,GAAG,iBAAiB,CA0BjF"}

package/dist/server/middleware/securityHeaders.js

@@ -1,45 +0,0 @@
-import { secureHeaders } from 'hono/secure-headers';
-// A strict baseline that works for a same-origin SPA + JSON API. Apps widen the
-// few directives they need (script/img/connect hosts, frame embeds) via `opts.csp`.
-const DEFAULT_CSP = {
-    defaultSrc: ["'self'"],
-    baseUri: ["'self'"],
-    objectSrc: ["'none'"],
-    frameAncestors: ["'none'"],
-    formAction: ["'self'"],
-    scriptSrc: ["'self'"],
-    scriptSrcAttr: ["'none'"],
-    // Inline styles are needed for Tailwind / chart / drag transforms; inline SCRIPTS
-    // stay blocked (the real XSS barrier).
-    styleSrc: ["'self'", "'unsafe-inline'"],
-    imgSrc: ["'self'", 'data:', 'blob:'],
-    fontSrc: ["'self'", 'data:'],
-    connectSrc: ["'self'"],
-    upgradeInsecureRequests: [],
-};
-export function securityHeaders(opts = {}) {
-    // A runtime escape hatch matching ca's ops convention: CSP_DISABLED=true drops CSP.
-    const cspOff = opts.csp === false || process.env.CSP_DISABLED === 'true';
-    const csp = cspOff ? undefined : { ...DEFAULT_CSP, ...(opts.csp ?? {}) };
-    const isProd = process.env.NODE_ENV === 'production';
-    const hsts = opts.hsts ?? (isProd ? 'max-age=31536000; includeSubDomains' : false);
-    return secureHeaders({
-        contentSecurityPolicy: csp,
-        xContentTypeOptions: 'nosniff',
-        // DENY (not SAMEORIGIN) to agree with CSP `frame-ancestors 'none'`.
-        xFrameOptions: 'DENY',
-        referrerPolicy: 'strict-origin-when-cross-origin',
-        crossOriginOpenerPolicy: 'same-origin',
-        // We serve cross-origin media/fonts, so keep CORP permissive.
-        crossOriginResourcePolicy: 'cross-origin',
-        // COEP breaks third-party embeds (YouTube, CDNs) — off by default.
-        crossOriginEmbedderPolicy: false,
-        originAgentCluster: true,
-        xDnsPrefetchControl: 'off',
-        xPermittedCrossDomainPolicies: 'none',
-        strictTransportSecurity: hsts,
-        removePoweredBy: true,
-        ...opts.overrides,
-    });
-}
-//# sourceMappingURL=securityHeaders.js.map

package/dist/server/middleware/securityHeaders.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"securityHeaders.js","sourceRoot":"","sources":["../../../src/server/middleware/securityHeaders.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA+BpD,gFAAgF;AAChF,oFAAoF;AACpF,MAAM,WAAW,GAAkB;IACjC,UAAU,EAAE,CAAC,QAAQ,CAAC;IACtB,OAAO,EAAE,CAAC,QAAQ,CAAC;IACnB,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,cAAc,EAAE,CAAC,QAAQ,CAAC;IAC1B,UAAU,EAAE,CAAC,QAAQ,CAAC;IACtB,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,aAAa,EAAE,CAAC,QAAQ,CAAC;IACzB,kFAAkF;IAClF,uCAAuC;IACvC,QAAQ,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACvC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC;IACpC,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC5B,UAAU,EAAE,CAAC,QAAQ,CAAC;IACtB,uBAAuB,EAAE,EAAE;CAC5B,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,OAA4B,EAAE;IAC5D,oFAAoF;IACpF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC;IACzE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;IAEzE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAEnF,OAAO,aAAa,CAAC;QACnB,qBAAqB,EAAE,GAAG;QAC1B,mBAAmB,EAAE,SAAS;QAC9B,oEAAoE;QACpE,aAAa,EAAE,MAAM;QACrB,cAAc,EAAE,iCAAiC;QACjD,uBAAuB,EAAE,aAAa;QACtC,8DAA8D;QAC9D,yBAAyB,EAAE,cAAc;QACzC,mEAAmE;QACnE,yBAAyB,EAAE,KAAK;QAChC,kBAAkB,EAAE,IAAI;QACxB,mBAAmB,EAAE,KAAK;QAC1B,6BAA6B,EAAE,MAAM;QACrC,uBAAuB,EAAE,IAAI;QAC7B,eAAe,EAAE,IAAI;QACrB,GAAG,IAAI,CAAC,SAAS;KAClB,CAAC,CAAC;AACL,CAAC"}

package/dist/server/middleware/zValidator.d.ts

@@ -1,30 +0,0 @@
-import type { Env, MiddlewareHandler } from 'hono';
-import type { ZodType, z } from 'zod';
-import type { CursedbeltEnv } from '../context';
-/** The request locations a schema can validate. Mirrors Hono's body/non-body split. */
-export type ZValidatorTarget = 'json' | 'form' | 'query' | 'param';
-/**
- * Validate a request `target` against a zod `schema`. Mount per route ahead of the
- * handler:
- *
- * ```ts
- * register('post', '/notes', zValidator(CreateNoteSchema), (c) => {
- *   const body = c.req.valid('json'); // typed z.infer<typeof CreateNoteSchema>
- *   // …
- * });
- * ```
- *
- * On failure responds `400` with the canonical envelope (field errors under
- * `context.issues`); never throws, so it produces the same body whether or not the
- * app mounts the {@link errorEnvelope} `onError` handler. On success the parsed value
- * is available as both `c.req.valid(target)` and `c.get('validatedBody')`.
- */
-export declare function zValidator<Schema extends ZodType, Target extends ZValidatorTarget = 'json', E extends Env = CursedbeltEnv, P extends string = string>(schema: Schema, target?: Target): MiddlewareHandler<E, P, {
-    in: {
-        [K in Target]: z.input<Schema>;
-    };
-    out: {
-        [K in Target]: z.output<Schema>;
-    };
-}>;
-//# sourceMappingURL=zValidator.d.ts.map

package/dist/server/middleware/zValidator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"zValidator.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/zValidator.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACnD,OAAO,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,uFAAuF;AACvF,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AA4BnE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CACxB,MAAM,SAAS,OAAO,EACtB,MAAM,SAAS,gBAAgB,GAAG,MAAM,EACxC,CAAC,SAAS,GAAG,GAAG,aAAa,EAC7B,CAAC,SAAS,MAAM,GAAG,MAAM,EAEzB,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,MAAyB,GAChC,iBAAiB,CAClB,CAAC,EACD,CAAC,EACD;IAAE,EAAE,EAAE;SAAG,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;KAAE,CAAC;IAAC,GAAG,EAAE;SAAG,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;KAAE,CAAA;CAAE,CACrF,CAsBA"}

package/dist/server/middleware/zValidator.js

@@ -1,58 +0,0 @@
-import { validationEnvelope } from '../errors';
-/**
- * Read the value a target validates against. The body targets (`json`/`form`) prefer
- * the ctgr-decoded body so a tunnelled mutation validates its real payload; the
- * URL-bound targets (`query`/`param`) are never tunnelled (GETs go direct) and read
- * from the live request. A query object collapses single-valued keys to a string so
- * `z.string()`/`z.coerce.number()` field schemas see a scalar (repeated keys stay an
- * array) — matching Hono's own validator semantics.
- */
-async function readTarget(c, target) {
-    if (target === 'json' || target === 'form') {
-        const decoded = c.get('ctgrDecoded');
-        if (decoded)
-            return decoded.body;
-        if (target === 'json')
-            return c.req.json().catch(() => undefined);
-        return c.req.parseBody();
-    }
-    if (target === 'param')
-        return c.req.param();
-    return Object.fromEntries(Object.entries(c.req.queries()).map(([key, values]) => values.length === 1 ? [key, values[0]] : [key, values]));
-}
-/**
- * Validate a request `target` against a zod `schema`. Mount per route ahead of the
- * handler:
- *
- * ```ts
- * register('post', '/notes', zValidator(CreateNoteSchema), (c) => {
- *   const body = c.req.valid('json'); // typed z.infer<typeof CreateNoteSchema>
- *   // …
- * });
- * ```
- *
- * On failure responds `400` with the canonical envelope (field errors under
- * `context.issues`); never throws, so it produces the same body whether or not the
- * app mounts the {@link errorEnvelope} `onError` handler. On success the parsed value
- * is available as both `c.req.valid(target)` and `c.get('validatedBody')`.
- */
-export function zValidator(schema, target = 'json') {
-    const handler = async (c, next) => {
-        const raw = await readTarget(c, target);
-        const result = schema.safeParse(raw);
-        if (!result.success) {
-            return c.json(validationEnvelope(result.error), 400);
-        }
-        // Expose the parsed value both ways (typed `c.req.valid` + convenience getter).
-        c.req.addValidatedData(target, result.data);
-        c.set('validatedBody', result.data);
-        await next();
-    };
-    // The body is written against the concrete `CursedbeltEnv` (so the ctgr/validatedBody
-    // accessors type-check); the public signature is the generic, schema-typed
-    // MiddlewareHandler that flows `c.req.valid(target)` into the handler. Hono's Context
-    // is invariant in its Env, so this widening goes through `unknown` — the same cast
-    // a hand-rolled typed middleware (e.g. @hono/zod-validator) performs.
-    return handler;
-}
-//# sourceMappingURL=zValidator.js.map

package/dist/server/middleware/zValidator.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"zValidator.js","sourceRoot":"","sources":["../../../src/server/middleware/zValidator.ts"],"names":[],"mappings":"AAgCA,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAK/C;;;;;;;GAOG;AACH,KAAK,UAAU,UAAU,CACvB,CAAkD,EAClD,MAAwB;IAExB,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACrC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC;QACjC,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IAC7C,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CACpD,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CACvD,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,UAAU,CAMxB,MAAc,EACd,SAAiB,MAAgB;IAMjC,MAAM,OAAO,GAAqC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAClE,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,gFAAgF;QAChF,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,IAA+B,CAAC,CAAC;QACvE,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;IACF,sFAAsF;IACtF,2EAA2E;IAC3E,sFAAsF;IACtF,mFAAmF;IACnF,sEAAsE;IACtE,OAAO,OAIN,CAAC;AACJ,CAAC"}

package/dist/server/migration/runner.d.ts

@@ -1,43 +0,0 @@
-import type { Database } from 'bun:sqlite';
-import type { Migration } from './types';
-/**
- * The versioned SQLite migration runner — a tiny `_migrations`-sentinel runner, NOT
- * a schema-first ORM. It replaces the old scattered guarded-`ALTER` /
- * `addColumnIfMissing` pattern with ordered, once-only migrations whose names are
- * recorded once applied. Business tables stay raw (`db.query` + `data JSON`); only
- * the *plumbing* tables get Kysely types (see `../db/kysely`).
- */
-/**
- * Apply the recommended connection PRAGMAs. **Call this BEFORE {@link runMigrations}
- * and OUTSIDE any transaction** — `PRAGMA foreign_keys` is silently ignored inside a
- * transaction, and the runner wraps each migration in one. Idempotent; safe on boot.
- *
- * This is now a straight alias of cwip's `applyCcPragmas`: the CC storage tier pins
- * ONE pragma profile monorepo-wide (`CC_PRAGMAS` — WAL + NORMAL + busy_timeout 5000 +
- * foreign_keys ON + wal_autocheckpoint 1000), and the belt-local copy that used to
- * live here was the second implementation the spec forbids. The per-pragma
- * `PragmaOptions` overrides are gone with it — a handle that drifts from the profile
- * is a `pragma-drift` violation, not a configuration choice.
- *
- * @deprecated Prefer cwip's `assertCcPragmas`, which additionally verifies each
- * pragma took and installs the WAL transaction-lifetime guard.
- */
-export declare function applyRecommendedPragmas(db: Database): void;
-/**
- * Run every pending migration exactly once, in array order, each inside its own
- * transaction, recording its `name` in `_migrations`. Returns the names actually
- * applied this call (empty when already up to date — re-running is a no-op).
- *
- * Set the connection PRAGMAs first via {@link applyRecommendedPragmas} (foreign-key
- * enforcement cannot be turned on inside the per-migration transaction).
- */
-export declare function runMigrations(db: Database, migrations: readonly Migration[]): string[];
-/** Does `table` have a column named `column`? (via `PRAGMA table_info`). */
-export declare function columnExists(db: Database, table: string, column: string): boolean;
-/**
- * Add a column if it is missing (idempotent). Returns true when it was added. A
- * migration helper for the rare evolve-in-place case; the canonical schema is built
- * fresh by `0001_initial`, so new migrations normally `CREATE` rather than `ALTER`.
- */
-export declare function addColumnIfMissing(db: Database, table: string, column: string, ddl: string): boolean;
-//# sourceMappingURL=runner.d.ts.map

package/dist/server/migration/runner.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/server/migration/runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;GAMG;AAEH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAE1D;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,EAAE,CAqBtF;AAMD,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAGjF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAIT"}

package/dist/server/migration/runner.js

@@ -1,71 +0,0 @@
-import { applyCcPragmas } from 'cwip/sqlite';
-/**
- * The versioned SQLite migration runner — a tiny `_migrations`-sentinel runner, NOT
- * a schema-first ORM. It replaces the old scattered guarded-`ALTER` /
- * `addColumnIfMissing` pattern with ordered, once-only migrations whose names are
- * recorded once applied. Business tables stay raw (`db.query` + `data JSON`); only
- * the *plumbing* tables get Kysely types (see `../db/kysely`).
- */
-/**
- * Apply the recommended connection PRAGMAs. **Call this BEFORE {@link runMigrations}
- * and OUTSIDE any transaction** — `PRAGMA foreign_keys` is silently ignored inside a
- * transaction, and the runner wraps each migration in one. Idempotent; safe on boot.
- *
- * This is now a straight alias of cwip's `applyCcPragmas`: the CC storage tier pins
- * ONE pragma profile monorepo-wide (`CC_PRAGMAS` — WAL + NORMAL + busy_timeout 5000 +
- * foreign_keys ON + wal_autocheckpoint 1000), and the belt-local copy that used to
- * live here was the second implementation the spec forbids. The per-pragma
- * `PragmaOptions` overrides are gone with it — a handle that drifts from the profile
- * is a `pragma-drift` violation, not a configuration choice.
- *
- * @deprecated Prefer cwip's `assertCcPragmas`, which additionally verifies each
- * pragma took and installs the WAL transaction-lifetime guard.
- */
-export function applyRecommendedPragmas(db) {
-    applyCcPragmas(db);
-}
-/**
- * Run every pending migration exactly once, in array order, each inside its own
- * transaction, recording its `name` in `_migrations`. Returns the names actually
- * applied this call (empty when already up to date — re-running is a no-op).
- *
- * Set the connection PRAGMAs first via {@link applyRecommendedPragmas} (foreign-key
- * enforcement cannot be turned on inside the per-migration transaction).
- */
-export function runMigrations(db, migrations) {
-    db.run('CREATE TABLE IF NOT EXISTS _migrations (name TEXT PRIMARY KEY, applied_at TEXT NOT NULL)');
-    const applied = new Set(db.query('SELECT name FROM _migrations').all().map((r) => r.name));
-    const insert = db.prepare('INSERT INTO _migrations (name, applied_at) VALUES (?, ?)');
-    const ran = [];
-    for (const m of migrations) {
-        if (applied.has(m.name))
-            continue;
-        const apply = db.transaction(() => {
-            m.up(db);
-            insert.run(m.name, new Date().toISOString());
-        });
-        apply();
-        ran.push(m.name);
-    }
-    return ran;
-}
-function quoteIdent(name) {
-    return `"${name.replace(/"/g, '""')}"`;
-}
-/** Does `table` have a column named `column`? (via `PRAGMA table_info`). */
-export function columnExists(db, table, column) {
-    const rows = db.query(`PRAGMA table_info(${quoteIdent(table)})`).all();
-    return rows.some((r) => r.name === column);
-}
-/**
- * Add a column if it is missing (idempotent). Returns true when it was added. A
- * migration helper for the rare evolve-in-place case; the canonical schema is built
- * fresh by `0001_initial`, so new migrations normally `CREATE` rather than `ALTER`.
- */
-export function addColumnIfMissing(db, table, column, ddl) {
-    if (columnExists(db, table, column))
-        return false;
-    db.run(`ALTER TABLE ${quoteIdent(table)} ADD COLUMN ${quoteIdent(column)} ${ddl}`);
-    return true;
-}
-//# sourceMappingURL=runner.js.map

package/dist/server/migration/runner.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../../src/server/migration/runner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C;;;;;;GAMG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CAAC,EAAY;IAClD,cAAc,CAAC,EAAE,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,EAAY,EAAE,UAAgC;IAC1E,EAAE,CAAC,GAAG,CACJ,0FAA0F,CAC3F,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,GAAG,CACpB,EAAE,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,GAAG,EAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC/F,CAAC;IACF,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC;IACtF,MAAM,GAAG,GAAa,EAAE,CAAC;IAEzB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YAChC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACT,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QACH,KAAK,EAAE,CAAC;QACR,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACzC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,EAAY,EAAE,KAAa,EAAE,MAAc;IACtE,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,qBAAqB,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAA6B,CAAC;IAClG,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,EAAY,EACZ,KAAa,EACb,MAAc,EACd,GAAW;IAEX,IAAI,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,EAAE,CAAC,GAAG,CAAC,eAAe,UAAU,CAAC,KAAK,CAAC,eAAe,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACnF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/server/migration/types.d.ts

@@ -1,17 +0,0 @@
-import type { Database } from 'bun:sqlite';
-/**
- * One ordered, immutable schema migration. `name` is recorded in the `_migrations`
- * sentinel once applied, so a migration's `up()` runs exactly once across the life
- * of a database. Corrections land as NEW migrations — never edit a shipped one, and
- * never rename one that has been applied (the name is its identity).
- *
- * `up()` runs inside the runner's per-migration transaction; throw to abort + roll
- * back that migration (the sentinel row is not written, so it retries next boot).
- */
-export interface Migration {
-    /** Unique, lexically-ordered name, e.g. `0001_initial`. Immutable once applied. */
-    readonly name: string;
-    /** Apply the migration. Runs inside the runner's transaction. */
-    up(db: Database): void;
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/server/migration/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/server/migration/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,EAAE,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAAC;CACxB"}

package/dist/server/migration/types.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=types.js.map

package/dist/server/migration/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/server/migration/types.ts"],"names":[],"mappings":""}

package/dist/server/mixins/asset.mixin.d.ts

@@ -1,13 +0,0 @@
-import type { AssetService } from './services';
-import { type CCHono, type MixinContext } from './types';
-/**
- * The headers a stored object is served with. Returns the type to declare and
- * the disposition to force — exported so the rule is testable on its own and so
- * a second bytes route cannot re-derive it slightly differently.
- */
-export declare const storedObjectHeaders: (contentType: string | undefined) => {
-    type: string;
-    disposition: string;
-};
-export declare function createAssetMixin(service: AssetService): (app: CCHono, ctx: MixinContext) => void;
-//# sourceMappingURL=asset.mixin.d.ts.map

package/dist/server/mixins/asset.mixin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"asset.mixin.d.ts","sourceRoot":"","sources":["../../../src/server/mixins/asset.mixin.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAkB,KAAK,MAAM,EAAwB,KAAK,YAAY,EAAe,MAAM,SAAS,CAAC;AA4B5G;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,aAAa,MAAM,GAAG,SAAS,KAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAUxG,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,IAC5C,KAAK,MAAM,EAAE,KAAK,YAAY,KAAG,IAAI,CA0V9C"}