README

L4 — HTTP API surface for the AUSUS metadata graph.

Pure PSR-7/15. No framework dependency. Mounts as a single Psr\Http\Server\RequestHandlerInterface in front of any PSR-7 server (react/http, swoole, roadrunner, php-fpm, or php -S).

What it serves

The routes are the routes — no per-Entity controllers, no hand-rolled DTOs. Every endpoint dispatches into the same Invoker chain that the in-process kernel uses (RFC-005 §3).

URL contract — frozen

Error envelope

{ "ok": false, "error": { "kind": "<TypedKind>", "message": "…" } }

Usage

use Ausus\Api\Http\{Router, Emitter};
use Nyholm\Psr7\Factory\Psr17Factory;
use Nyholm\Psr7Server\ServerRequestCreator;

$factory = new Psr17Factory();
$creator = new ServerRequestCreator($factory, $factory, $factory, $factory);
$router  = new Router($graph, $driver, $auditSink, $factory, $factory);

Emitter::emit($router->handle($creator->fromGlobals()));

$graph comes from ausus/kernel's Compiler, $driver from ausus/persistence-sql, $auditSink likewise. The Router builds a fresh Invoker + ProjectionRenderer per request using the per-request tenant + actor; the policy engine, workflow runtime, effect dispatcher, and sequence counter are shared across requests.

Security notes (V0)

This package implements the transport layer only. It does NOT implement:

• Authentication — the X-Actor-* headers are a stub for the V0 browser demo; replace with a real auth middleware (JWT, session, OAuth) in front of the Router for any non-local deployment.
• Rate limiting / DOS protection — front with a reverse proxy.
• CSRF — the renderer's flow is API-only (no cookies, JSON bodies). Production deployments using cookies must add CSRF tokens.
• TLS — terminate TLS at your reverse proxy.

The CORS headers are permissive (Access-Control-Allow-Origin: *) for the V0 demo. Production must restrict to the allowed origin list.

License

MIT — see LICENSE.