@arcote.tech/arc-host 0.7.25 → 0.7.27

package/dist/src/context-handler.d.ts

@@ -1,6 +1,13 @@
 import { type ArcContextAny, type ArcEventAny, type DatabaseAdapter, LocalEventPublisher, MasterDataStorage, Model } from "@arcote.tech/arc";
 import type { ArcTelemetry } from "@arcote.tech/arc-otel";
 import type { EventAuthContext, SyncableEvent, TokenPayload } from "./types";
+/** Options for an in-process route invocation. */
+export interface ExecuteRouteOptions {
+    method?: "GET" | "POST" | "PUT" | "DELETE" | "PATCH";
+    body?: unknown;
+    headers?: Record<string, string>;
+    query?: Record<string, string>;
+}
 /**
  * Handles a single context on the host
  */
@@ -11,9 +18,23 @@ export declare class ContextHandler {
     private dataStorage;
     private eventPublisher;
     private eventDefinitions;
+    /**
+     * Per-token verification registry: tokenName → ArcToken (with its secret).
+     * Collected from every protectBy() in the context. Fail-closed: a token
+     * without a secret cannot verify any JWT (→ requests rejected).
+     */
+    private tokenRegistry;
     private hostEventIdCounter;
     private initialized;
     constructor(context: ArcContextAny, dbAdapter: Promise<DatabaseAdapter>, telemetry?: ArcTelemetry | undefined);
+    /**
+     * Verify a raw JWT cryptographically (HMAC-SHA256) against the secret of the
+     * token definition named in its payload, and check expiry. Returns the
+     * decoded payload or null. No unsigned fallback — forged/invalid/expired
+     * tokens are rejected. This is the single verification entry point for both
+     * the HTTP boundary and in-process dispatch.
+     */
+    verifyToken(token: string): Promise<TokenPayload | null>;
     /**
      * Initialize the context handler and run seed data if needed.
      */
@@ -36,6 +57,16 @@ export declare class ContextHandler {
     executeCommand(commandName: string, params: any, rawToken: string | null, options?: {
         internal?: boolean;
     }): Promise<any>;
+    /**
+     * Execute a route handler in-process by NAME (no TCP). Mirrors the HTTP
+     * routeHandler boundary: real JWT verification, the same public/protected
+     * gate, scoped context, then the handler with a synthetic Request. Returns
+     * the handler's Response (or a 401/403/404/405 when the gate rejects).
+     *
+     * Used by webhooks/route tests and any in-process caller that needs the full
+     * route boundary without binding a port.
+     */
+    executeRoute(routeName: string, options: ExecuteRouteOptions, rawToken: string | null): Promise<Response>;
     /**
      * Persist events from a client and return with host IDs
      */

package/dist/src/context-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-handler.d.ts","sourceRoot":"","sources":["../../src/context-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,EAGN,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE7E;;GAEG;AACH,qBAAa,cAAc;aASP,OAAO,EAAE,aAAa;IAEtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAV7B,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,cAAc,CAAsB;IAC5C,OAAO,CAAC,gBAAgB,CAAkC;IAC1D,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,WAAW,CAAS;gBAGV,OAAO,EAAE,aAAa,EACtC,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC,EAClB,SAAS,CAAC,EAAE,YAAY,YAAA;IAqB3C;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3B;;;OAGG;YACW,QAAQ;IA4BtB;;;;;;;;;OASG;IACG,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,GAAG,EACX,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAC/B,OAAO,CAAC,GAAG,CAAC;IAoEf;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,KAAK,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,GAAG,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;KACvC,CAAC,EACF,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,GAAG,IAAI,GACzB,OAAO,CAAC,aAAa,EAAE,CAAC;IA8C3B;;OAEG;IACG,cAAc,CAClB,eAAe,EAAE,MAAM,GAAG,IAAI,EAC9B,KAAK,EAAE,YAAY,GAAG,IAAI,GACzB,OAAO,CAAC,aAAa,EAAE,CAAC;IAkD3B;;OAEG;IACH,QAAQ,IAAI,KAAK,CAAC,aAAa,CAAC;IAIhC;;OAEG;IACH,cAAc,IAAI,iBAAiB;IAInC;;OAEG;IACH,mBAAmB,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC;IAI/C;;OAEG;IACH,iBAAiB,IAAI,mBAAmB;CAGzC"}
+{"version":3,"file":"context-handler.d.ts","sourceRoot":"","sources":["../../src/context-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,WAAW,EAGhB,KAAK,eAAe,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,EAIN,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE7E,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;IACrD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,cAAc;aAeP,OAAO,EAAE,aAAa;IAEtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAhB7B,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,cAAc,CAAsB;IAC5C,OAAO,CAAC,gBAAgB,CAAkC;IAC1D;;;;OAIG;IACH,OAAO,CAAC,aAAa,CAAkC;IACvD,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,WAAW,CAAS;gBAGV,OAAO,EAAE,aAAa,EACtC,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC,EAClB,SAAS,CAAC,EAAE,YAAY,YAAA;IAiC3C;;;;;;OAMG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IA4B9D;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3B;;;OAGG;YACW,QAAQ;IA4BtB;;;;;;;;;OASG;IACG,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,GAAG,EACX,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAC/B,OAAO,CAAC,GAAG,CAAC;IAoEf;;;;;;;;OAQG;IACG,YAAY,CAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,OAAO,CAAC,QAAQ,CAAC;IA4EpB;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,KAAK,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,GAAG,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;KACvC,CAAC,EACF,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,GAAG,IAAI,GACzB,OAAO,CAAC,aAAa,EAAE,CAAC;IA8C3B;;OAEG;IACG,cAAc,CAClB,eAAe,EAAE,MAAM,GAAG,IAAI,EAC9B,KAAK,EAAE,YAAY,GAAG,IAAI,GACzB,OAAO,CAAC,aAAa,EAAE,CAAC;IAkD3B;;OAEG;IACH,QAAQ,IAAI,KAAK,CAAC,aAAa,CAAC;IAIhC;;OAEG;IACH,cAAc,IAAI,iBAAiB;IAInC;;OAEG;IACH,mBAAmB,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC;IAI/C;;OAEG;IACH,iBAAiB,IAAI,mBAAmB;CAGzC"}

package/dist/src/create-server.d.ts

@@ -32,6 +32,23 @@ export interface ArcServerConfig {
      * scripty bez CORP, jeśli request leci bez credentials.
      */
     coep?: "unsafe-none" | "credentialless" | "require-corp";
+    /**
+     * Allowlist of origins permitted for credentialed CORS. When set, only these
+     * origins are reflected into `Access-Control-Allow-Origin` (with
+     * `Allow-Credentials: true`). When unset, the server reflects the request
+     * Origin but WITHOUT `Allow-Credentials` (no credentialed cross-origin reads).
+     */
+    corsOrigins?: string[];
+    /** Max request body size in bytes (default 10 MB). Larger → 413. */
+    maxRequestBodySize?: number;
+    /** Extra security headers merged onto every response (override defaults). */
+    securityHeaders?: Record<string, string>;
+    /**
+     * Accept the auth token from the `?token=` query string. Default false —
+     * tokens in URLs leak to logs/Referer. Clients send tokens via the
+     * `Authorization` header or (for WS) the `scope:auth` message.
+     */
+    allowTokenInQuery?: boolean;
     /** Optional OpenTelemetry instance. When provided, the HTTP fetch handler
      *  and WS message dispatch are wrapped in spans, with parent context
      *  extracted from `traceparent` (header / message field). All nested

package/dist/src/create-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-server.d.ts","sourceRoot":"","sources":["../../src/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAQ,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC;AAElC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAMjD,OAAO,KAAK,EACV,cAAc,EAGd,YAAY,EACb,MAAM,oBAAoB,CAAC;AAG5B,KAAK,aAAa,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,aAAa,CAAC;IACvB,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACzD,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,EAAE,aAAa,GAAG,gBAAgB,GAAG,cAAc,CAAC;IACzD;;;kEAG8D;IAC9D,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9B,cAAc,EAAE,cAAc,CAAC;IAC/B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,aAAa,EAAE,aAAa,CAAC;IAC7B,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,SAAS,CAAC,CAmQpB"}
+{"version":3,"file":"create-server.d.ts","sourceRoot":"","sources":["../../src/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAQ,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAMjD,OAAO,KAAK,EACV,cAAc,EAGd,YAAY,EACb,MAAM,oBAAoB,CAAC;AAG5B,KAAK,aAAa,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,aAAa,CAAC;IACvB,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACzD,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,EAAE,aAAa,GAAG,gBAAgB,GAAG,cAAc,CAAC;IACzD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;kEAG8D;IAC9D,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9B,cAAc,EAAE,cAAc,CAAC;IAC/B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,aAAa,EAAE,aAAa,CAAC;IAC7B,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,SAAS,CAAC,CAoRpB"}

package/dist/src/event-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"event-auth.d.ts","sourceRoot":"","sources":["../../src/event-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE3D;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,YAAY,GAAG,IAAI,EAC1B,KAAK,EAAE,WAAW,EAClB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAqCT;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,YAAY,GAAG,IAAI,EAC1B,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,GAAG,GACX,OAAO,CA+BT;AAmBD;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,YAAY,GAAG,IAAI,EAC1B,MAAM,EAAE,aAAa,EAAE,EACvB,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GACzC,aAAa,EAAE,CASjB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,YAAY,EAAE,EACtB,MAAM,EAAE,aAAa,EAAE,EACvB,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GACzC,aAAa,EAAE,CAejB"}
+{"version":3,"file":"event-auth.d.ts","sourceRoot":"","sources":["../../src/event-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE3D;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,YAAY,GAAG,IAAI,EAC1B,KAAK,EAAE,WAAW,EAClB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAqCT;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,YAAY,GAAG,IAAI,EAC1B,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,GAAG,GACX,OAAO,CA+BT;AA0BD;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,YAAY,GAAG,IAAI,EAC1B,MAAM,EAAE,aAAa,EAAE,EACvB,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GACzC,aAAa,EAAE,CASjB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,YAAY,EAAE,EACtB,MAAM,EAAE,aAAa,EAAE,EACvB,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GACzC,aAAa,EAAE,CAejB"}

package/dist/src/middleware/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/middleware/http.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAqB,MAAM,SAAS,CAAC;AAoCjE,wBAAgB,aAAa,CAAC,EAAE,EAAE,iBAAiB,GAAG,cAAc,CAQnE;AAMD,wBAAgB,cAAc,CAAC,EAAE,EAAE,cAAc,GAAG,cAAc,CA+BjE;AAMD,wBAAgB,YAAY,CAAC,EAAE,EAAE,cAAc,GAAG,cAAc,CAoC/D;AAMD,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,cAAc,GAAG,cAAc,CA4BnE;AAMD,wBAAgB,YAAY,CAAC,EAAE,EAAE,cAAc,GAAG,cAAc,CA8G/D;AAMD,wBAAgB,eAAe,CAC7B,EAAE,EAAE,cAAc,EAClB,EAAE,EAAE,iBAAiB,GACpB,cAAc,EAAE,CAQlB"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/middleware/http.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAqB,MAAM,SAAS,CAAC;AAsDjE,wBAAgB,aAAa,CAAC,EAAE,EAAE,iBAAiB,GAAG,cAAc,CAQnE;AAMD,wBAAgB,cAAc,CAAC,EAAE,EAAE,cAAc,GAAG,cAAc,CA+BjE;AAMD,wBAAgB,YAAY,CAAC,EAAE,EAAE,cAAc,GAAG,cAAc,CAmC/D;AAMD,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,cAAc,GAAG,cAAc,CA8BnE;AAMD,wBAAgB,YAAY,CAAC,EAAE,EAAE,cAAc,GAAG,cAAc,CA6G/D;AAMD,wBAAgB,eAAe,CAC7B,EAAE,EAAE,cAAc,EAClB,EAAE,EAAE,iBAAiB,GACpB,cAAc,EAAE,CAQlB"}

package/dist/src/middleware/types.d.ts

@@ -21,7 +21,7 @@ export type ArcHttpHandler = (req: Request, url: URL, ctx: ArcRequestContext) =>
 export interface ArcWsContext {
     contextHandler: ContextHandler;
     connectionManager: ConnectionManager;
-    verifyToken: (token: string) => TokenPayload | null;
+    verifyToken: (token: string) => Promise<TokenPayload | null>;
 }
 /**
  * WebSocket message handler.

package/dist/src/middleware/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/middleware/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE9D;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,iBAAiB,KACnB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC;CACrD;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,GAAG,EACZ,GAAG,EAAE,YAAY,KACd,OAAO,CAAC,OAAO,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/middleware/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE9D;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,iBAAiB,KACnB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CAC9D;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,GAAG,EACZ,GAAG,EAAE,YAAY,KACd,OAAO,CAAC,OAAO,CAAC,CAAC"}

package/package.json

@@ -4,11 +4,11 @@
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "type": "module",
-  "version": "0.7.25",
+  "version": "0.7.27",
   "private": false,
   "author": "Przemysław Krasiński [arcote.tech]",
   "dependencies": {
-    "@arcote.tech/arc-adapter-db-sqlite": "^0.7.25",
+    "@arcote.tech/arc-adapter-db-sqlite": "^0.7.27",
     "croner": "^9.0.0",
     "jsonwebtoken": "^9.0.2"
   },
@@ -24,8 +24,8 @@
     "@types/bun": "^1.2.0"
   },
   "peerDependencies": {
-    "@arcote.tech/arc": "^0.7.25",
-    "@arcote.tech/arc-otel": "^0.7.25"
+    "@arcote.tech/arc": "^0.7.27",
+    "@arcote.tech/arc-otel": "^0.7.27"
   },
   "peerDependenciesMeta": {
     "@arcote.tech/arc-otel": {

package/src/context-handler.ts

@@ -1,17 +1,29 @@
 import {
+  ArcAuthorizationError,
   type ArcContextAny,
   type ArcEventAny,
+  type ArcRouteAny,
+  type ArcTokenAny,
   type DatabaseAdapter,
   LocalEventPublisher,
   MasterDataStorage,
   Model,
   ScopedModel,
+  collectTokens,
   mutationExecutor,
 } from "@arcote.tech/arc";
 import type { ArcTelemetry } from "@arcote.tech/arc-otel";
 import { canTokenEmitEvent, filterEventsForToken } from "./event-auth";
 import type { EventAuthContext, SyncableEvent, TokenPayload } from "./types";
 
+/** Options for an in-process route invocation. */
+export interface ExecuteRouteOptions {
+  method?: "GET" | "POST" | "PUT" | "DELETE" | "PATCH";
+  body?: unknown;
+  headers?: Record<string, string>;
+  query?: Record<string, string>;
+}
+
 /**
  * Handles a single context on the host
  */
@@ -20,6 +32,12 @@ export class ContextHandler {
   private dataStorage: MasterDataStorage;
   private eventPublisher: LocalEventPublisher;
   private eventDefinitions = new Map<string, ArcEventAny>();
+  /**
+   * Per-token verification registry: tokenName → ArcToken (with its secret).
+   * Collected from every protectBy() in the context. Fail-closed: a token
+   * without a secret cannot verify any JWT (→ requests rejected).
+   */
+  private tokenRegistry = new Map<string, ArcTokenAny>();
   private hostEventIdCounter = 0;
   private initialized = false;
 
@@ -45,6 +63,53 @@ export class ContextHandler {
         this.eventDefinitions.set(element.name, element as ArcEventAny);
       }
     }
+
+    // Build the token registry once — the canonical, transport-agnostic source
+    // of JWT verification, shared by the HTTP server (createArcServer) and the
+    // in-process route dispatcher (executeRoute).
+    for (const tok of collectTokens(context)) {
+      this.tokenRegistry.set(tok.name, tok);
+      if (!tok.hasSecret) {
+        console.error(
+          `[ARC] SECURITY: token "${tok.name}" has no secret configured — its JWTs cannot be verified and will be rejected. Set .secret(process.env.…).`,
+        );
+      }
+    }
+  }
+
+  /**
+   * Verify a raw JWT cryptographically (HMAC-SHA256) against the secret of the
+   * token definition named in its payload, and check expiry. Returns the
+   * decoded payload or null. No unsigned fallback — forged/invalid/expired
+   * tokens are rejected. This is the single verification entry point for both
+   * the HTTP boundary and in-process dispatch.
+   */
+  async verifyToken(token: string): Promise<TokenPayload | null> {
+    let tokenName: string | undefined;
+    try {
+      const parts = token.split(".");
+      if (parts.length !== 3) return null;
+      const payload = JSON.parse(
+        atob(parts[1].replace(/-/g, "+").replace(/_/g, "/")),
+      );
+      tokenName = payload?.tokenName;
+    } catch {
+      return null;
+    }
+    if (!tokenName) return null;
+
+    const def = this.tokenRegistry.get(tokenName);
+    if (!def) return null;
+
+    const verified = await def.verifyJWT(token);
+    if (!verified) return null;
+
+    return {
+      tokenType: verified.tokenName,
+      params: verified.params || {},
+      iat: verified.iat,
+      exp: verified.exp,
+    };
   }
 
   /**
@@ -138,7 +203,7 @@ export class ContextHandler {
       // directly through `ctx.mutate.*` (bypassing this dispatcher) or pass
       // `{ internal: true }` (e.g. cron-scheduler).
       if (!options?.internal && (command as any).__isPrivate) {
-        throw new Error(
+        throw new ArcAuthorizationError(
           `Command '${commandName}' is private and not callable from a client.`,
         );
       }
@@ -172,6 +237,95 @@ export class ContextHandler {
     }
   }
 
+  /**
+   * Execute a route handler in-process by NAME (no TCP). Mirrors the HTTP
+   * routeHandler boundary: real JWT verification, the same public/protected
+   * gate, scoped context, then the handler with a synthetic Request. Returns
+   * the handler's Response (or a 401/403/404/405 when the gate rejects).
+   *
+   * Used by webhooks/route tests and any in-process caller that needs the full
+   * route boundary without binding a port.
+   */
+  async executeRoute(
+    routeName: string,
+    options: ExecuteRouteOptions,
+    rawToken: string | null,
+  ): Promise<Response> {
+    const element = this.context.get(routeName) as ArcRouteAny | undefined;
+    if (!element || typeof (element as any).getHandler !== "function") {
+      return Response.json({ error: "Route not found" }, { status: 404 });
+    }
+
+    const method = options.method ?? "POST";
+    const handler = element.getHandler(method as any);
+    if (!handler) {
+      return Response.json(
+        { error: `Method ${method} not allowed` },
+        { status: 405 },
+      );
+    }
+
+    const tokenPayload = rawToken ? await this.verifyToken(rawToken) : null;
+    // A presented-but-invalid token is rejected (never downgraded to anonymous).
+    if (rawToken && !tokenPayload) {
+      return Response.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    // Protection gate — identical semantics to middleware/http.ts routeHandler.
+    if (!element.isPublic && element.hasProtections) {
+      if (!tokenPayload) {
+        return Response.json({ error: "Unauthorized" }, { status: 401 });
+      }
+      let isAuthorized = false;
+      for (const protection of element.protections) {
+        if (protection.token.name === tokenPayload.tokenType) {
+          const mockTokenInstance = {
+            params: tokenPayload.params,
+            getTokenDefinition: () => protection.token,
+          };
+          if (await protection.check(mockTokenInstance as any)) {
+            isAuthorized = true;
+            break;
+          }
+        }
+      }
+      if (!isAuthorized) {
+        return Response.json({ error: "Forbidden" }, { status: 403 });
+      }
+    } else if (!element.isPublic && !element.hasProtections) {
+      if (!tokenPayload) {
+        return Response.json({ error: "Unauthorized" }, { status: 401 });
+      }
+    }
+
+    const scoped = new ScopedModel(this.model, "request");
+    if (rawToken) scoped.setToken(rawToken);
+
+    const authParams = tokenPayload
+      ? { params: tokenPayload.params, tokenName: tokenPayload.tokenType }
+      : undefined;
+    const routeContext = element.buildContext(scoped.getAdapters(), authParams);
+
+    const url = new URL(`http://harness.local${element.fullPath}`);
+    if (options.query) {
+      for (const [k, v] of Object.entries(options.query)) {
+        url.searchParams.set(k, v);
+      }
+    }
+    const headers = new Headers(options.headers ?? {});
+    if (!headers.has("Content-Type")) headers.set("Content-Type", "application/json");
+    const req = new Request(url, {
+      method,
+      headers,
+      body:
+        method === "GET" || options.body == null
+          ? undefined
+          : JSON.stringify(options.body),
+    });
+
+    return handler(routeContext, req, {}, url);
+  }
+
   /**
    * Persist events from a client and return with host IDs
    */

package/src/create-server.ts

@@ -1,7 +1,6 @@
 import type { ArcContextAny, DatabaseAdapter } from "@arcote.tech/arc";
 import type { ArcTelemetry, Span } from "@arcote.tech/arc-otel";
 import type { Server } from "bun";
-import jwt from "jsonwebtoken";
 import { ConnectionManager } from "./connection-manager";
 import { ContextHandler } from "./context-handler";
 import { CronScheduler } from "./cron-scheduler";
@@ -44,6 +43,23 @@ export interface ArcServerConfig {
    * scripty bez CORP, jeśli request leci bez credentials.
    */
   coep?: "unsafe-none" | "credentialless" | "require-corp";
+  /**
+   * Allowlist of origins permitted for credentialed CORS. When set, only these
+   * origins are reflected into `Access-Control-Allow-Origin` (with
+   * `Allow-Credentials: true`). When unset, the server reflects the request
+   * Origin but WITHOUT `Allow-Credentials` (no credentialed cross-origin reads).
+   */
+  corsOrigins?: string[];
+  /** Max request body size in bytes (default 10 MB). Larger → 413. */
+  maxRequestBodySize?: number;
+  /** Extra security headers merged onto every response (override defaults). */
+  securityHeaders?: Record<string, string>;
+  /**
+   * Accept the auth token from the `?token=` query string. Default false —
+   * tokens in URLs leak to logs/Referer. Clients send tokens via the
+   * `Authorization` header or (for WS) the `scope:auth` message.
+   */
+  allowTokenInQuery?: boolean;
   /** Optional OpenTelemetry instance. When provided, the HTTP fetch handler
    *  and WS message dispatch are wrapped in spans, with parent context
    *  extracted from `traceparent` (header / message field). All nested
@@ -69,10 +85,6 @@ export interface ArcServer {
 export async function createArcServer(
   config: ArcServerConfig,
 ): Promise<ArcServer> {
-  const jwtSecret =
-    config.jwtSecret ||
-    process.env.JWT_SECRET ||
-    "arc-host-secret-change-in-production";
   const port = config.port || 5005;
 
   // Init context handler — telemetry (if any) flows through so executeCommand
@@ -103,50 +115,50 @@ export async function createArcServer(
   // Apps z SQLite WASM/OPFS świadomie przełączają na require-corp przez
   // `coep` w ArcServerConfig.
   const coep = config.coep ?? "unsafe-none";
-  function buildCorsHeaders(req?: Request) {
-    const origin = req?.headers.get("Origin") || "*";
-    return {
-      "Access-Control-Allow-Origin": origin,
+  const corsOrigins = config.corsOrigins;
+  const maxRequestBodySize = config.maxRequestBodySize ?? 10 * 1024 * 1024;
+  const securityHeaders: Record<string, string> = {
+    "X-Content-Type-Options": "nosniff",
+    "X-Frame-Options": "DENY",
+    "Referrer-Policy": "no-referrer",
+    ...(config.securityHeaders ?? {}),
+  };
+
+  function buildCorsHeaders(req?: Request): Record<string, string> {
+    const origin = req?.headers.get("Origin") || null;
+    const headers: Record<string, string> = {
       "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
       "Access-Control-Allow-Headers":
         "Content-Type, Authorization, X-Arc-Scope, X-Arc-Tokens",
-      "Access-Control-Allow-Credentials": "true",
       // Cross-origin isolation — patrz `coep` w ArcServerConfig.
       "Cross-Origin-Opener-Policy": "same-origin",
       "Cross-Origin-Embedder-Policy": coep,
       "Cross-Origin-Resource-Policy": "cross-origin",
+      ...securityHeaders,
     };
-  }
-  const corsHeaders = buildCorsHeaders();
 
-  function verifyToken(token: string): TokenPayload | null {
-    try {
-      const decoded = jwt.verify(token, jwtSecret) as any;
-      if (decoded.tokenName && !decoded.tokenType) {
-        return {
-          tokenType: decoded.tokenName,
-          params: decoded.params || {},
-          iat: decoded.iat,
-          exp: decoded.exp,
-        };
-      }
-      return decoded as TokenPayload;
-    } catch {
-      try {
-        const parts = token.split(".");
-        if (parts.length !== 3) return null;
-        const payload = JSON.parse(atob(parts[1]));
-        return {
-          tokenType: payload.tokenName,
-          params: payload.params || {},
-          iat: payload.iat,
-          exp: payload.exp,
-        };
-      } catch {
-        return null;
+    if (corsOrigins && corsOrigins.length > 0) {
+      // Allowlist mode: reflect only listed origins, with credentials.
+      if (origin && corsOrigins.includes(origin)) {
+        headers["Access-Control-Allow-Origin"] = origin;
+        headers["Access-Control-Allow-Credentials"] = "true";
+        headers["Vary"] = "Origin";
       }
+      // Origin not allowed → no ACAO header (browser blocks the read).
+    } else {
+      // No allowlist: reflect origin for convenience but WITHOUT credentials
+      // (never combine an arbitrary reflected origin with Allow-Credentials).
+      headers["Access-Control-Allow-Origin"] = origin ?? "*";
+      if (origin) headers["Vary"] = "Origin";
     }
+    return headers;
   }
+  const corsHeaders = buildCorsHeaders();
+
+  // JWT verification is owned by the ContextHandler (single, transport-agnostic
+  // source — also used by in-process executeRoute). The HTTP boundary delegates.
+  const verifyToken = (token: string): Promise<TokenPayload | null> =>
+    contextHandler.verifyToken(token);
 
   // Build handler chains — Arc defaults + user-provided extras
   const defaultHttp = arcHttpHandlers(contextHandler, connectionManager);
@@ -183,10 +195,22 @@ export async function createArcServer(
       // (via runWithExtractedContext + startSpan) so nested handlers'
       // spans attach to this one as parent.
       const handleRequest = async (span: Span | undefined): Promise<Response> => {
+        // Reject oversized requests before reading the body (DoS guard).
+        const contentLength = Number(req.headers.get("Content-Length") ?? 0);
+        if (contentLength > maxRequestBodySize) {
+          return Response.json(
+            { error: "Payload too large" },
+            { status: 413, headers: corsHeaders },
+          );
+        }
+
         const authHeader = req.headers.get("Authorization");
-        let rawToken =
-          authHeader?.replace("Bearer ", "") ||
-          url.searchParams.get("token");
+        let rawToken: string | null = authHeader?.replace("Bearer ", "") || null;
+
+        // Token in query string is off by default (leaks to logs/Referer).
+        if (!rawToken && config.allowTokenInQuery) {
+          rawToken = url.searchParams.get("token");
+        }
 
         if (!rawToken) {
           const cookieHeader = req.headers.get("Cookie");
@@ -195,7 +219,16 @@ export async function createArcServer(
             if (match) rawToken = decodeURIComponent(match[1]);
           }
         }
-        const tokenPayload = rawToken ? verifyToken(rawToken) : null;
+        const tokenPayload = rawToken ? await verifyToken(rawToken) : null;
+
+        // A presented-but-invalid token (forged / wrong secret / expired) is
+        // rejected globally — never silently downgraded to anonymous.
+        if (rawToken && !tokenPayload) {
+          return Response.json(
+            { error: "Unauthorized" },
+            { status: 401, headers: corsHeaders },
+          );
+        }
 
         if (
           url.pathname === "/ws" &&

package/src/event-auth.ts

@@ -99,8 +99,15 @@ function checkConditionsMatch(
   data: Record<string, any>,
 ): boolean {
   for (const [key, expectedValue] of Object.entries(conditions)) {
-    const actualValue = data[key];
+    // An undefined expected value is NOT a real constraint — it would match any
+    // missing field (undefined === undefined), acting as a wildcard. A token
+    // whose scoping field (e.g. projectId) is absent must NOT gain access, so
+    // deny instead of treating undefined as "anything".
+    if (expectedValue === undefined) {
+      return false;
+    }
 
+    const actualValue = data[key];
     if (actualValue !== expectedValue) {
       return false;
     }

package/src/middleware/http.ts

@@ -1,9 +1,27 @@
 import type { ArcRouteAny } from "@arcote.tech/arc";
-import { ScopedModel } from "@arcote.tech/arc";
+import { ArcValidationError, arcErrorStatus, ScopedModel } from "@arcote.tech/arc";
 import type { ConnectionManager } from "../connection-manager";
 import type { ContextHandler } from "../context-handler";
 import type { ArcHttpHandler, ArcRequestContext } from "./types";
 
+// ---------------------------------------------------------------------------
+// Error → HTTP mapping
+//
+// Typed Arc errors map to 400/401/403 with safe bodies. Anything else is an
+// unexpected failure → 500 with a GENERIC message (never leak error.message
+// or stack to the client).
+// ---------------------------------------------------------------------------
+
+function errorBody(error: unknown): { status: number; body: Record<string, any> } {
+  const status = arcErrorStatus(error) ?? 500;
+  if (error instanceof ArcValidationError) {
+    return { status, body: { error: "Invalid parameters", fields: error.fields } };
+  }
+  if (status === 401) return { status, body: { error: "Unauthorized" } };
+  if (status === 403) return { status, body: { error: "Forbidden" } };
+  return { status: 500, body: { error: "Internal server error" } };
+}
+
 // ---------------------------------------------------------------------------
 // Shared
 // ---------------------------------------------------------------------------
@@ -76,11 +94,11 @@ export function commandHandler(ch: ContextHandler): ArcHttpHandler {
         headers: ctx.corsHeaders,
       });
     } catch (error) {
-      console.error(`[ARC] Command '${commandName}' error:`, error);
-      return Response.json(
-        { error: (error as Error).message },
-        { status: 500, headers: ctx.corsHeaders },
-      );
+      const { status, body } = errorBody(error);
+      if (status === 500) {
+        console.error(`[ARC] Command '${commandName}' error:`, error);
+      }
+      return Response.json(body, { status, headers: ctx.corsHeaders });
     }
   };
 }
@@ -119,10 +137,9 @@ export function queryHandler(ch: ContextHandler): ArcHttpHandler {
 
       return Response.json(result, { headers: ctx.corsHeaders });
     } catch (error) {
-      return Response.json(
-        { error: (error as Error).message },
-        { status: 500, headers: ctx.corsHeaders },
-      );
+      const { status, body } = errorBody(error);
+      if (status === 500) console.error(`[ARC] Query error:`, error);
+      return Response.json(body, { status, headers: ctx.corsHeaders });
     }
   };
 }
@@ -153,9 +170,11 @@ export function eventSyncHandler(ch: ContextHandler): ArcHttpHandler {
         { headers: ctx.corsHeaders },
       );
     } catch (error) {
+      const { status, body } = errorBody(error);
+      if (status === 500) console.error(`[ARC] Event sync error:`, error);
       return Response.json(
-        { success: false, error: (error as Error).message },
-        { status: 500, headers: ctx.corsHeaders },
+        { success: false, ...body },
+        { status, headers: ctx.corsHeaders },
       );
     }
   };
@@ -269,10 +288,9 @@ export function routeHandler(ch: ContextHandler): ArcHttpHandler {
         headers: newHeaders,
       });
     } catch (error) {
-      return Response.json(
-        { error: (error as Error).message },
-        { status: 500, headers: ctx.corsHeaders },
-      );
+      const { status, body: errBody } = errorBody(error);
+      if (status === 500) console.error(`[ARC] Route error:`, error);
+      return Response.json(errBody, { status, headers: ctx.corsHeaders });
     }
   };
 }

package/src/middleware/types.ts

@@ -28,7 +28,7 @@ export type ArcHttpHandler = (
 export interface ArcWsContext {
   contextHandler: ContextHandler;
   connectionManager: ConnectionManager;
-  verifyToken: (token: string) => TokenPayload | null;
+  verifyToken: (token: string) => Promise<TokenPayload | null>;
 }
 
 /**

package/src/middleware/ws.ts

@@ -28,7 +28,7 @@ export function cleanupClientSubs(clientId: string): void {
 export function scopeAuthHandler(): ArcWsHandler {
   return async (client, message, ctx) => {
     if (message.type !== "scope:auth") return false;
-    const decoded = ctx.verifyToken(message.token);
+    const decoded = await ctx.verifyToken(message.token);
     if (decoded) {
       ctx.connectionManager.setScopeToken(
         client.id,