vintasend-api 1.0.0-alpha5 → 1.0.0-alpha7

package/README.md

@@ -38,6 +38,19 @@ npm install vintasend-api vintasend
 Install the same release line for both: the API is released together with
 `vintasend`, and its version matches.
 
+The standalone server also needs `@hono/node-server`. It is an optional peer
+dependency, so a host that mounts `createApp` in its own server does not install
+a Node HTTP server it never starts:
+
+```bash
+npm install @hono/node-server   # only to run the vintasend-api command
+```
+
+`vintasend-api` holds `createApp`, the authenticators, `ApiError` and the wire
+types, and loads in a browser. `vintasend-api/server` holds what the standalone
+command is built from: `loadServerConfig` and the service-module loader. It is
+Node only.
+
 ## Architecture
 
 ```
@@ -146,11 +159,14 @@ either package: both recognise an error by its name and code, not by its class.
 Throw `ApiError.unauthorized` for a caller with no valid credential and
 `ApiError.forbidden` for one you know and refuse: a 401 would tell a signed-in
 user to sign in again. For one shared secret, pass
-`authenticate: apiKeyAuthenticator(key)`, which compares in constant time.
+`authenticate: apiKeyAuthenticator(key)`, which compares in constant time. To
+check a token yourself, such as the caller's own identity-provider token, read it
+with `bearerToken(c.req.header('authorization'))`, which is `null` when the
+request carries none.
 
 The app uses Web APIs only — no Node built-ins — so it runs wherever `fetch`
-does. The standalone server and the module-path service loader are the Node-only
-parts, and `createApp` loads neither.
+does. The standalone server and the module-path service loader on `./server` are
+the Node-only parts, and the package entry loads neither.
 
 An unexpected error is reported to the client as a generic 500 with an
 `X-Request-Id` header. By default it is logged as one line — the error's name,

package/dist/domain/schemas.d.ts

@@ -9,82 +9,53 @@ export declare const DEFAULT_PAGE_SIZE = 20;
 export declare const MIN_PAGE_SIZE = 1;
 export declare const MAX_PAGE_SIZE = 100;
 export declare const paginationQuerySchema: z.ZodObject<{
-    page: z.ZodDefault<z.ZodNumber>;
-    pageSize: z.ZodDefault<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    page: number;
-    pageSize: number;
-}, {
-    page?: number | undefined;
-    pageSize?: number | undefined;
-}>;
+    page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    pageSize: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
 export declare const notificationListQuerySchema: z.ZodObject<{
-    page: z.ZodDefault<z.ZodNumber>;
-    pageSize: z.ZodDefault<z.ZodNumber>;
-} & {
-    status: z.ZodOptional<z.ZodEnum<["PENDING_SEND", "SENT", "FAILED", "READ", "CANCELLED"]>>;
-    notificationType: z.ZodOptional<z.ZodEnum<["EMAIL", "SMS", "PUSH", "IN_APP"]>>;
+    page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    pageSize: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    status: z.ZodOptional<z.ZodEnum<{
+        PENDING_SEND: "PENDING_SEND";
+        SENT: "SENT";
+        FAILED: "FAILED";
+        READ: "READ";
+        CANCELLED: "CANCELLED";
+    }>>;
+    notificationType: z.ZodOptional<z.ZodEnum<{
+        EMAIL: "EMAIL";
+        SMS: "SMS";
+        PUSH: "PUSH";
+        IN_APP: "IN_APP";
+    }>>;
     adapterUsed: z.ZodOptional<z.ZodString>;
     userId: z.ZodOptional<z.ZodString>;
     bodyTemplate: z.ZodOptional<z.ZodString>;
     subjectTemplate: z.ZodOptional<z.ZodString>;
     contextName: z.ZodOptional<z.ZodString>;
     tenant: z.ZodOptional<z.ZodString>;
-    requestedTemplateVersion: z.ZodOptional<z.ZodNumber>;
-    usedTemplateVersion: z.ZodOptional<z.ZodNumber>;
-    createdAtFrom: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    createdAtTo: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    sentAtFrom: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    sentAtTo: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    orderByField: z.ZodOptional<z.ZodEnum<["sendAfter", "sentAt", "readAt", "createdAt", "updatedAt"]>>;
-    orderByDirection: z.ZodOptional<z.ZodEnum<["asc", "desc"]>>;
-}, "strip", z.ZodTypeAny, {
-    page: number;
-    pageSize: number;
-    status?: "PENDING_SEND" | "SENT" | "FAILED" | "READ" | "CANCELLED" | undefined;
-    notificationType?: "EMAIL" | "SMS" | "PUSH" | "IN_APP" | undefined;
-    adapterUsed?: string | undefined;
-    userId?: string | undefined;
-    bodyTemplate?: string | undefined;
-    subjectTemplate?: string | undefined;
-    contextName?: string | undefined;
-    tenant?: string | undefined;
-    requestedTemplateVersion?: number | undefined;
-    usedTemplateVersion?: number | undefined;
-    createdAtFrom?: string | undefined;
-    createdAtTo?: string | undefined;
-    sentAtFrom?: string | undefined;
-    sentAtTo?: string | undefined;
-    orderByField?: "sendAfter" | "sentAt" | "readAt" | "createdAt" | "updatedAt" | undefined;
-    orderByDirection?: "asc" | "desc" | undefined;
-}, {
-    page?: number | undefined;
-    pageSize?: number | undefined;
-    status?: "PENDING_SEND" | "SENT" | "FAILED" | "READ" | "CANCELLED" | undefined;
-    notificationType?: "EMAIL" | "SMS" | "PUSH" | "IN_APP" | undefined;
-    adapterUsed?: string | undefined;
-    userId?: string | undefined;
-    bodyTemplate?: string | undefined;
-    subjectTemplate?: string | undefined;
-    contextName?: string | undefined;
-    tenant?: string | undefined;
-    requestedTemplateVersion?: number | undefined;
-    usedTemplateVersion?: number | undefined;
-    createdAtFrom?: string | undefined;
-    createdAtTo?: string | undefined;
-    sentAtFrom?: string | undefined;
-    sentAtTo?: string | undefined;
-    orderByField?: "sendAfter" | "sentAt" | "readAt" | "createdAt" | "updatedAt" | undefined;
-    orderByDirection?: "asc" | "desc" | undefined;
-}>;
+    requestedTemplateVersion: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    usedTemplateVersion: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    createdAtFrom: z.ZodOptional<z.ZodString>;
+    createdAtTo: z.ZodOptional<z.ZodString>;
+    sentAtFrom: z.ZodOptional<z.ZodString>;
+    sentAtTo: z.ZodOptional<z.ZodString>;
+    orderByField: z.ZodOptional<z.ZodEnum<{
+        sendAfter: "sendAfter";
+        sentAt: "sentAt";
+        readAt: "readAt";
+        createdAt: "createdAt";
+        updatedAt: "updatedAt";
+    }>>;
+    orderByDirection: z.ZodOptional<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+}, z.core.$strip>;
 /** Body of `POST /notifications/{id}/resend`. Optional: an omitted body regenerates the context. */
 export declare const resendBodySchema: z.ZodObject<{
     useStoredContext: z.ZodDefault<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    useStoredContext: boolean;
-}, {
-    useStoredContext?: boolean | undefined;
-}>;
+}, z.core.$strip>;
 export type NotificationListQueryInput = z.infer<typeof notificationListQuerySchema>;
 export type PaginationQueryInput = z.infer<typeof paginationQuerySchema>;
 export type ResendBodyInput = z.infer<typeof resendBodySchema>;

package/dist/exports.d.ts

@@ -1,14 +1,15 @@
 /**
  * Public entrypoint for mounting the API inside a host's own server, and for sharing the wire
  * contract with TypeScript clients.
+ *
+ * It imports no Node built-in, so it loads wherever `fetch` does, a browser included. The
+ * standalone server's pieces are on `./server`.
  */
 export { API_BASE_PATH, type AppDependencies, createApp } from './app.js';
-export { loadServerConfig, type ServerConfig } from './config.js';
 export * from './contract/types.js';
 export { ApiError, invalidRequest } from './errors.js';
-export { type Authenticated, type Authenticator, apiKeyAuthenticator, authenticated, } from './middleware/authenticate.js';
+export { type Authenticated, type Authenticator, apiKeyAuthenticator, authenticated, bearerToken, } from './middleware/authenticate.js';
 export { logUnhandledError, REQUEST_ID_HEADER, type UnhandledErrorHandler, } from './middleware/error-handler.js';
 export { createGitHubTemplateClientFromEnv, GitHubTemplateClient, } from './services/github-template-client.js';
 export type { TemplateSourceClient } from './services/notification-preview.js';
 export { asNotificationServicePort, type NotificationServicePort, } from './services/notification-service-port.js';
-export { createServiceProvider, loadNotificationService } from './services/service-loader.js';

package/dist/exports.js

@@ -1,14 +1,15 @@
 /**
  * Public entrypoint for mounting the API inside a host's own server, and for sharing the wire
  * contract with TypeScript clients.
+ *
+ * It imports no Node built-in, so it loads wherever `fetch` does, a browser included. The
+ * standalone server's pieces are on `./server`.
  */
 export { API_BASE_PATH, createApp } from './app.js';
-export { loadServerConfig } from './config.js';
 export * from './contract/types.js';
 export { ApiError, invalidRequest } from './errors.js';
-export { apiKeyAuthenticator, authenticated, } from './middleware/authenticate.js';
+export { apiKeyAuthenticator, authenticated, bearerToken, } from './middleware/authenticate.js';
 export { logUnhandledError, REQUEST_ID_HEADER, } from './middleware/error-handler.js';
 export { createGitHubTemplateClientFromEnv, GitHubTemplateClient, } from './services/github-template-client.js';
 export { asNotificationServicePort, } from './services/notification-service-port.js';
-export { createServiceProvider, loadNotificationService } from './services/service-loader.js';
 //# sourceMappingURL=exports.js.map

package/dist/exports.js.map

@@ -1 +1 @@
-{"version":3,"file":"exports.js","sourceRoot":"","sources":["../src/exports.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAwB,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAqB,MAAM,aAAa,CAAC;AAClE,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAGL,mBAAmB,EACnB,aAAa,GACd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,iCAAiC,EACjC,oBAAoB,GACrB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,yBAAyB,GAE1B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"exports.js","sourceRoot":"","sources":["../src/exports.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,aAAa,EAAwB,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1E,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAGL,mBAAmB,EACnB,aAAa,EACb,WAAW,GACZ,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,iCAAiC,EACjC,oBAAoB,GACrB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,yBAAyB,GAE1B,MAAM,yCAAyC,CAAC"}

package/dist/index.js

@@ -5,14 +5,29 @@
  * Installed as the package's `vintasend-api` command, for running the API on its own. A host that
  * already has a server mounts `createApp` instead and never loads this file.
  */
-import { serve } from '@hono/node-server';
 import { createApp } from './app.js';
-import { loadServerConfig } from './config.js';
 import { apiKeyAuthenticator } from './middleware/authenticate.js';
+import { createServiceProvider, loadServerConfig } from './server.js';
 import { createGitHubTemplateClientFromEnv } from './services/github-template-client.js';
-import { createServiceProvider } from './services/service-loader.js';
+/**
+ * `@hono/node-server`, which only this command uses. It is an optional peer dependency, so a host
+ * that mounts `createApp` in its own server does not install it.
+ */
+async function loadNodeServer() {
+    try {
+        return await import('@hono/node-server');
+    }
+    catch (error) {
+        const { code, message } = error;
+        if (code === 'ERR_MODULE_NOT_FOUND' && message?.includes("'@hono/node-server'")) {
+            throw new Error('The standalone server needs @hono/node-server: npm install @hono/node-server');
+        }
+        throw error;
+    }
+}
 async function main() {
     const config = loadServerConfig();
+    const { serve } = await loadNodeServer();
     const getService = createServiceProvider(config.serviceModule);
     const app = createApp({
         authenticate: apiKeyAuthenticator(config.apiKey),

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAE/D,MAAM,GAAG,GAAG,SAAS,CAAC;QACpB,YAAY,EAAE,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC;QAChD,UAAU;QACV,iBAAiB,EAAE,GAAG,EAAE,CAAC,iCAAiC,EAAE;QAC5D,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,MAAM,UAAU,EAAE,CAAC;IAEnB,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;QAC7E,OAAO,CAAC,IAAI,CAAC,uCAAuC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AAEzF;;;GAGG;AACH,KAAK,UAAU,cAAc;IAC3B,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAA4C,CAAC;QACvE,IAAI,IAAI,KAAK,sBAAsB,IAAI,OAAO,EAAE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAE/D,MAAM,GAAG,GAAG,SAAS,CAAC;QACpB,YAAY,EAAE,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC;QAChD,UAAU;QACV,iBAAiB,EAAE,GAAG,EAAE,CAAC,iCAAiC,EAAE;QAC5D,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,MAAM,UAAU,EAAE,CAAC;IAEnB,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;QAC7E,OAAO,CAAC,IAAI,CAAC,uCAAuC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/middleware/authenticate.d.ts

@@ -27,6 +27,14 @@ export type Authenticator = (c: Context) => Authenticated | Promise<Authenticate
 export declare function authenticateWith(authenticate: Authenticator): MiddlewareHandler;
 /** What the authenticator learned about this request's caller. */
 export declare function authenticated(c: Context): Authenticated;
+/**
+ * The token in an `Authorization: Bearer <token>` header, or `null` when there is none.
+ *
+ * The scheme is matched in any case, as RFC 9110 has it. For a host writing its own
+ * `Authenticator` around a token it verifies itself, such as the caller's own identity-provider
+ * token.
+ */
+export declare function bearerToken(header: string | undefined): string | null;
 /**
  * The shared-secret authenticator: every request must carry `Authorization: Bearer <apiKey>`.
  * It says nothing about who is calling.

package/dist/middleware/authenticate.js

@@ -45,12 +45,16 @@ async function safeEquals(a, b) {
     });
     return difference === 0;
 }
-function extractToken(header) {
-    if (!header) {
-        return undefined;
-    }
-    const match = header.match(/^Bearer\s+(.+)$/i);
-    return match?.[1]?.trim();
+/**
+ * The token in an `Authorization: Bearer <token>` header, or `null` when there is none.
+ *
+ * The scheme is matched in any case, as RFC 9110 has it. For a host writing its own
+ * `Authenticator` around a token it verifies itself, such as the caller's own identity-provider
+ * token.
+ */
+export function bearerToken(header) {
+    const token = header?.match(/^Bearer\s+(.+)$/i)?.[1]?.trim();
+    return token ? token : null;
 }
 /**
  * The shared-secret authenticator: every request must carry `Authorization: Bearer <apiKey>`.
@@ -58,7 +62,7 @@ function extractToken(header) {
  */
 export function apiKeyAuthenticator(apiKey) {
     return async (c) => {
-        const token = extractToken(c.req.header('authorization'));
+        const token = bearerToken(c.req.header('authorization'));
         if (!token || !(await safeEquals(token, apiKey))) {
             throw ApiError.unauthorized('A valid API key is required.');
         }

package/dist/middleware/authenticate.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../src/middleware/authenticate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAcxC,MAAM,aAAa,GAAG,kDAAkD,CAAC;AAEzE,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAAC,YAA2B;IAC1D,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,OAAQ,CAAC,CAAC,GAAG,CAAC,aAAa,CAA+B,IAAI,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,KAAK,UAAU,MAAM,CAAC,KAAa;IACjC,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,UAAU,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC3B,UAAU,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,OAAO,UAAU,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,MAA0B;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC/C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,KAAK,EAAE,CAAC,EAAE,EAAE;QACjB,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QAE1D,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,QAAQ,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../src/middleware/authenticate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAcxC,MAAM,aAAa,GAAG,kDAAkD,CAAC;AAEzE,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAAC,YAA2B;IAC1D,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,OAAQ,CAAC,CAAC,GAAG,CAAC,aAAa,CAA+B,IAAI,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,KAAK,UAAU,MAAM,CAAC,KAAa;IACjC,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,UAAU,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC3B,UAAU,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,OAAO,UAAU,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,MAA0B;IACpD,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7D,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,KAAK,EAAE,CAAC,EAAE,EAAE;QACjB,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QAEzD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,QAAQ,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/validation.d.ts

@@ -9,6 +9,6 @@ import type { ZodType } from 'zod';
  * refused when it is not.
  */
 export declare function validate<Target extends 'query' | 'json' | 'param', Schema extends ZodType>(target: Target, schema: Schema): import("hono").MiddlewareHandler<import("hono").Env, string, {
-    in: (undefined extends import("zod").input<Schema> ? true : false) extends true ? { [K in Target]?: (import("zod").input<Schema> extends infer T ? T extends import("zod").input<Schema> ? T extends import("hono").ValidationTargets[K] ? T : { [K2 in keyof T]?: import("hono").ValidationTargets[K][K2] | undefined; } : never : never) | undefined; } : { [K_1 in Target]: import("zod").input<Schema> extends infer T ? T extends import("zod").input<Schema> ? T extends import("hono").ValidationTargets[K_1] ? T : { [K2_1 in keyof T]: import("hono").ValidationTargets[K_1][K2_1]; } : never : never; };
-    out: { [K_2 in Target]: import("zod").output<Schema>; };
-}>;
+    in: (undefined extends (Schema extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<Schema> : Schema extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<Schema> : never) ? true : false) extends true ? { [K in Target]?: ([Schema extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<Schema> : Schema extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<Schema> : never] extends [import("hono").ValidationTargets[K]] ? import("hono").ValidationTargets[K] & (Schema extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<Schema> : Schema extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<Schema> : never) : import("hono/validator").InferInput<Schema extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<Schema> : Schema extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<Schema> : never, K, import("hono/types").ParsedFormValue>) | undefined; } : { [K_1 in Target]: [Schema extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<Schema> : Schema extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<Schema> : never] extends [import("hono").ValidationTargets[K_1]] ? import("hono").ValidationTargets[K_1] & (Schema extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<Schema> : Schema extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<Schema> : never) : import("hono/validator").InferInput<Schema extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<Schema> : Schema extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<Schema> : never, K_1, import("hono/types").ParsedFormValue>; };
+    out: { [K_2 in Target]: Schema extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").output<Schema> : Schema extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod").infer<Schema> : never; };
+}, never>;

package/dist/server.d.ts

@@ -0,0 +1,9 @@
+/**
+ * What the standalone server is built from: its environment configuration and the loader for the
+ * service module it names.
+ *
+ * Node only, and of no use to a host that mounts `createApp` itself, so it is not on the package
+ * entry: that one loads in a browser.
+ */
+export { loadServerConfig, type ServerConfig } from './config.js';
+export { createServiceProvider, loadNotificationService, type VintaSendServiceFactory, } from './services/service-loader.js';

package/dist/server.js

@@ -0,0 +1,10 @@
+/**
+ * What the standalone server is built from: its environment configuration and the loader for the
+ * service module it names.
+ *
+ * Node only, and of no use to a host that mounts `createApp` itself, so it is not on the package
+ * entry: that one loads in a browser.
+ */
+export { loadServerConfig } from './config.js';
+export { createServiceProvider, loadNotificationService, } from './services/service-loader.js';
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAqB,MAAM,aAAa,CAAC;AAClE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAExB,MAAM,8BAA8B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vintasend-api",
-  "version": "1.0.0-alpha5",
+  "version": "1.0.0-alpha7",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vintasoftware/vintasend-ts-api.git"
@@ -16,6 +16,10 @@
       "types": "./dist/exports.d.ts",
       "import": "./dist/exports.js"
     },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
+    },
     "./openapi.yaml": "./openapi.yaml",
     "./package.json": "./package.json"
   },
@@ -28,6 +32,7 @@
     "README.md",
     "LICENSE"
   ],
+  "sideEffects": false,
   "scripts": {
     "dev": "tsx watch src/index.ts",
     "build": "tsc",
@@ -39,20 +44,27 @@
     "format": "biome check --write ."
   },
   "dependencies": {
-    "@hono/node-server": "^1.14.0",
-    "@hono/zod-validator": "^0.4.3",
-    "hono": "^4.7.0",
-    "zod": "^3.24.2"
+    "@hono/zod-validator": "^0.9.1",
+    "hono": "^4.11.2",
+    "zod": "^4.6.5"
   },
   "peerDependencies": {
-    "vintasend": "^1.0.0-alpha5"
+    "@hono/node-server": "^1.14.0",
+    "vintasend": "^1.0.0-alpha7"
+  },
+  "peerDependenciesMeta": {
+    "@hono/node-server": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5.10",
+    "@hono/node-server": "^1.14.0",
     "@types/node": "^25.0.8",
+    "esbuild": "^0.28.2",
     "tsx": "^4.19.3",
     "typescript": "^5.9.3",
-    "vintasend": "1.0.0-alpha5",
+    "vintasend": "1.0.0-alpha7",
     "vitest": "^4.0.18"
   },
   "engines": {

package/dist/middleware/api-key-auth.d.ts

@@ -1,9 +0,0 @@
-/**
- * Shared-secret authentication.
- *
- * Every `/api/v1` request must carry `Authorization: Bearer <VINTASEND_API_KEY>`.
- * The dashboard calls the API from its server side only, so the key never
- * reaches a browser.
- */
-import type { MiddlewareHandler } from 'hono';
-export declare function apiKeyAuth(apiKey: string): MiddlewareHandler;

package/dist/middleware/api-key-auth.js

@@ -1,34 +0,0 @@
-/**
- * Shared-secret authentication.
- *
- * Every `/api/v1` request must carry `Authorization: Bearer <VINTASEND_API_KEY>`.
- * The dashboard calls the API from its server side only, so the key never
- * reaches a browser.
- */
-import { timingSafeEqual } from 'node:crypto';
-import { ApiError } from '../errors.js';
-function safeEquals(a, b) {
-    const left = Buffer.from(a);
-    const right = Buffer.from(b);
-    if (left.length !== right.length) {
-        return false;
-    }
-    return timingSafeEqual(left, right);
-}
-function extractToken(header) {
-    if (!header) {
-        return undefined;
-    }
-    const match = header.match(/^Bearer\s+(.+)$/i);
-    return match?.[1]?.trim();
-}
-export function apiKeyAuth(apiKey) {
-    return async (c, next) => {
-        const token = extractToken(c.req.header('authorization'));
-        if (!token || !safeEquals(token, apiKey)) {
-            throw new ApiError('UNAUTHORIZED', 'A valid API key is required.');
-        }
-        await next();
-    };
-}
-//# sourceMappingURL=api-key-auth.js.map

package/dist/middleware/api-key-auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-key-auth.js","sourceRoot":"","sources":["../../src/middleware/api-key-auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE7B,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,YAAY,CAAC,MAA0B;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC/C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QAE1D,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}