@cogitator-ai/koa 0.8.6 → 0.10.0

package/README.md

@@ -32,7 +32,6 @@ const router = cogitatorApp({
 });
 
 app.use(router.routes());
-app.use(router.allowedMethods());
 
 app.listen(3000);
 ```
@@ -45,22 +44,28 @@ Creates a Koa Router with all Cogitator endpoints.
 
 **Options:**
 
-| Option               | Type                          | Description                                                                                                                            |
-| -------------------- | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
-| `cogitator`          | `Cogitator`                   | **Required.** Cogitator runtime instance                                                                                               |
-| `agents`             | `Record<string, Agent>`       | Named agents to expose                                                                                                                 |
-| `workflows`          | `Record<string, Workflow>`    | Named workflows                                                                                                                        |
-| `swarms`             | `Record<string, SwarmConfig>` | Named swarms                                                                                                                           |
-| `auth`               | `AuthFunction`                | `(ctx) => AuthContext \| undefined` (sync or async), receives the Koa Context, throw to answer `401 UNAUTHORIZED`                      |
-| `enableSwagger`      | `boolean`                     | Serve `/openapi.json` and Swagger UI at `/docs`                                                                                        |
-| `swagger`            | `SwaggerConfig`               | Swagger configuration                                                                                                                  |
-| `bodyLimit`          | `number`                      | Max JSON body size in bytes (default 1 MiB)                                                                                            |
-| `sseHeartbeatMs`     | `number`                      | How often SSE streams write a `: keep-alive` comment while a run is silent (default `5000`, `0` turns it off)                          |
-| `acceptContext`      | `boolean \| string[]`         | Keys of a run `context` clients may send: none by default, a list, or `true` for any (the model reads it as data from the application) |
-| `threadMessageRoles` | `ThreadMessageRole[]`         | Roles `POST /threads/:id/messages` accepts (default `user` and `assistant`)                                                            |
+| Option               | Type                                              | Description                                                                                                                                                      |
+| -------------------- | ------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `cogitator`          | `Cogitator`                                       | **Required.** Cogitator runtime instance                                                                                                                         |
+| `agents`             | `Record<string, Agent>`                           | Named agents to expose                                                                                                                                           |
+| `workflows`          | `Record<string, Workflow>`                        | Named workflows                                                                                                                                                  |
+| `swarms`             | `Record<string, SwarmConfig>`                     | Named swarms                                                                                                                                                     |
+| `auth`               | `AuthFunction`                                    | `(ctx) => AuthContext \| undefined` (sync or async), receives the Koa Context, throw to answer `401 UNAUTHORIZED`                                                |
+| `enableSwagger`      | `boolean`                                         | Serve `/openapi.json` and Swagger UI at `/docs`                                                                                                                  |
+| `swagger`            | `SwaggerConfig`                                   | Swagger configuration                                                                                                                                            |
+| `bodyLimit`          | `number`                                          | Max JSON body size in bytes (default 1 MiB)                                                                                                                      |
+| `sseHeartbeatMs`     | `number`                                          | How often SSE streams write a `: keep-alive` comment while a run is silent (default `5000`, `0` turns it off)                                                    |
+| `acceptContext`      | `boolean \| string[]`                             | Keys of a run `context` clients may send: none by default, a list, or `true` for any (the model reads it as data from the application)                           |
+| `threadMessageRoles` | `ThreadMessageRole[]`                             | Roles `POST /threads/:id/messages` accepts (default `user` and `assistant`)                                                                                      |
+| `limits`             | `RunLimits`                                       | `{ swarmTimeout?, workflowMaxIterations?, workflowMaxConcurrency? }`: caps on what a request may ask a swarm or workflow run for (see [Run limits](#run-limits)) |
+| `anonymous`          | `'allow' \| 'deny'`                               | Whether callers without a `userId` may use the API (default `'allow'`), `'deny'` answers `401 UNAUTHORIZED`                                                      |
+| `authorizeThread`    | `(auth, threadId) => boolean \| Promise<boolean>` | Decides whether a caller may touch a thread, on top of the owner check, `false` answers `403 THREAD_FORBIDDEN`                                                   |
+| `deps`               | `(ctx) => unknown \| Promise<unknown>`            | Builds the `deps` agent runs pass to their tools, from the Koa Context (see [Run deps](#run-deps))                                                               |
 
 WebSocket support is attached to the HTTP server with [`setupWebSocket`](#websocket), not through router options.
 
+The router answers `OPTIONS` for its own paths with `204` and the methods they serve in `Allow`, so it needs no `router.allowedMethods()`. A CORS middleware (such as `@koa/cors`) goes before the router, so it answers preflight requests itself.
+
 ## Request Handling
 
 - Request bodies are validated before anything reaches the runtime: `input` must contain more than whitespace (`""` and `"   "` are refused before the model is called), `context` an object, `threadId` a non-empty string, swarm `timeout` a positive number. Invalid bodies return `400 INVALID_INPUT` with the offending field in the message. The validator comes from `@cogitator-ai/server-shared`, so Express, Fastify, Hono and Koa refuse exactly the same bodies.
@@ -74,7 +79,8 @@ WebSocket support is attached to the HTTP server with [`setupWebSocket`](#websoc
 - The `start` event of an agent stream names the run's thread (the request's `threadId`, or a new one), and `finish` repeats it with the run's outcome, so a client that sent no thread continues the conversation with this one.
 - Swarm routes close each swarm they build once its run ends, so a distributed swarm leaves no Redis connections behind and its state expires. `GET /swarms` lists every agent, the router and pipeline stages included.
 - Thread routes use `cogitator.getMemory()`, which connects the configured memory adapter on first use, so threads can be read on a fresh server before any agent has run. Only a `Cogitator` without `memory` configured answers `503 UNAVAILABLE`.
-- `CogitatorError`s are returned with their HTTP status and code (for example `429 LLM_RATE_LIMITED`). Any other error is logged and returned as `500 Internal server error` (code `INTERNAL_ERROR`) without internal details; the same masking applies to SSE `error` events, `node_error`/`agent_error` stream events and WebSocket errors. A workflow that finishes with an error is answered like a thrown error (its `CogitatorError` status, otherwise `500`), never as a successful result. Missing optional packages (`@cogitator-ai/workflows`, `@cogitator-ai/swarms`) answer `501 UNIMPLEMENTED`.
+- `GET /threads/:id` answers the whole thread, or one page of it with `?limit=50`: the newest 50 messages (oldest first within the page) and a `nextCursor`. Pass it back as `?limit=50&cursor=<nextCursor>` for the 50 before them, until an answer has no `nextCursor`. Messages written in the same millisecond are neither skipped nor repeated across pages. A `limit` outside 1 to 1000 or a cursor the server did not give answers `400 INVALID_INPUT`.
+- Every error answer has the same envelope, `{ error: { message, code } }`, the one Express, Fastify, Hono and Next use. A `CogitatorError` is answered with its HTTP status and code (for example `429 LLM_RATE_LIMITED`), plus a `Retry-After` header in whole seconds when the provider said when to retry. A swarm that ran out of time answers `504 RUN_TIMEOUT`. Any other error is logged and answered as `500 Internal server error` (code `INTERNAL_ERROR`) without internal details, and the same masking applies to SSE `error` events, `node_error` and `agent_error` stream events and WebSocket errors. A workflow that finishes with an error is answered like a thrown error (its `CogitatorError` status, otherwise `500`), never as a successful result. Missing optional packages (`@cogitator-ai/workflows`, `@cogitator-ai/swarms`) answer `501 UNIMPLEMENTED`.
 - When the client disconnects, the running agent, workflow or swarm is aborted, for both JSON and SSE endpoints.
 - `GET /agents` returns each agent's `description` and never exposes its `instructions`.
 - `GET /tools` returns tool parameters as JSON Schema.
@@ -83,20 +89,21 @@ WebSocket support is attached to the HTTP server with [`setupWebSocket`](#websoc
 
 ### Agents
 
-| Method | Path                   | Description               |
-| ------ | ---------------------- | ------------------------- |
-| `GET`  | `/agents`              | List all agents           |
-| `POST` | `/agents/:name/run`    | Run agent (JSON response) |
-| `POST` | `/agents/:name/stream` | Run agent (SSE stream)    |
-| `POST` | `/agents/:name/resume` | Resume a paused run       |
+| Method | Path                          | Description                      |
+| ------ | ----------------------------- | -------------------------------- |
+| `GET`  | `/agents`                     | List all agents                  |
+| `POST` | `/agents/:name/run`           | Run agent (JSON response)        |
+| `POST` | `/agents/:name/stream`        | Run agent (SSE stream)           |
+| `POST` | `/agents/:name/resume`        | Resume a paused run              |
+| `POST` | `/agents/:name/resume/stream` | Resume a paused run (SSE stream) |
 
 ### Threads (Memory)
 
-| Method   | Path                    | Description           |
-| -------- | ----------------------- | --------------------- |
-| `GET`    | `/threads/:id`          | Get thread messages   |
-| `POST`   | `/threads/:id/messages` | Add message to thread |
-| `DELETE` | `/threads/:id`          | Delete thread         |
+| Method   | Path                    | Description                                      |
+| -------- | ----------------------- | ------------------------------------------------ |
+| `GET`    | `/threads/:id`          | Get thread messages, a page with `?limit&cursor` |
+| `POST`   | `/threads/:id/messages` | Add message to thread                            |
+| `DELETE` | `/threads/:id`          | Delete thread                                    |
 
 ### Workflows
 
@@ -156,6 +163,51 @@ When `auth` returns a `userId`, everything a caller does with threads is scoped
 - Another user's thread answers `403` with code `THREAD_ACCESS_DENIED`, and its messages are neither returned nor changed.
 - Threads created earlier without an owner (no `userId`) stay open only to callers without a `userId`, such as servers with no `auth` configured.
 
+### Anonymous callers
+
+By default a caller without a `userId` (no `auth`, or `auth` returned none) may use the API as an anonymous user. With `anonymous: 'deny'` such a caller gets `401 UNAUTHORIZED` on every API route. `/health`, `/ready`, `/openapi.json` and `/docs` stay open, so probes and API docs keep working. A path under the router that nothing answers gets `401` under `'deny'` too, so an anonymous caller cannot tell which paths exist, and `404 NOT_FOUND` in the error envelope under `'allow'`. WebSocket connections take the `anonymous` option of `setupWebSocket`, or the `anonymous` of its route context when the option is not set.
+
+### Thread authorization
+
+Core lets a caller touch only threads they own. `authorizeThread` adds your own rule on top, for example a tenant check:
+
+```typescript
+const router = cogitatorApp({
+  cogitator,
+  agents,
+  auth,
+  authorizeThread: (auth, threadId) => tenants.ownsThread(auth?.metadata?.tenant, threadId),
+});
+```
+
+It is called with what `auth` returned and the thread a request names: the body `threadId` of agent runs, streams and resumes and of swarm runs and streams, and the `:id` of `GET`, `DELETE` and `POST /threads/:id/messages`. It runs after the body is validated and before the owner check, and `false` answers `403 THREAD_FORBIDDEN` without starting a run. WebSocket runs and resumes are checked by the `authorizeThread` of the route context given to `setupWebSocket`, and a refusal is an `error` message.
+
+### Run deps
+
+`deps` builds what an agent's tools get as `context.deps` for one request: a database handle, the tenant, a client with the caller's credentials. The model never sees them, and they never come from the request body.
+
+```typescript
+const router = cogitatorApp({
+  cogitator,
+  agents,
+  deps: async (ctx) => ({ db: await pool.connect(), tenant: ctx.get('x-tenant') }),
+});
+```
+
+Agent runs, streams and resumes call it once per run. WebSocket runs take the `deps` option of `setupWebSocket`, called with the upgrade request.
+
+### Run limits
+
+`limits` caps what a request may ask a run for: `swarmTimeout` (ms) for swarm runs, `workflowMaxIterations` and `workflowMaxConcurrency` for workflow runs. A request that asks for more is held to the cap, and one that asks for nothing gets the cap. Each limit must be a positive integer, or `cogitatorApp` throws. The OpenAPI spec shows each limit as the default of its field. WebSocket runs take the `limits` of the route context given to `setupWebSocket`.
+
+```typescript
+const router = cogitatorApp({
+  cogitator,
+  swarms: { research: researchSwarm },
+  limits: { swarmTimeout: 120_000, workflowMaxIterations: 50, workflowMaxConcurrency: 4 },
+});
+```
+
 ### Approvals
 
 A tool with `requiresApproval` (`true`, or a function of the arguments) pauses the run before that turn executes:
@@ -178,6 +230,8 @@ await fetch('/agents/support/resume', {
 
 The body is `{ threadId, decisions?, defaultDecision? }`, where a decision is `{ approved: boolean, reason?: string }`; malformed bodies get `400 INVALID_INPUT`. The response has the same shape as `/run` and may pause again for calls left without a decision. The run resumes as the authenticated `userId`: a thread with no paused run answers `409 RUN_NOT_PAUSED`, and another user's paused run `403 THREAD_ACCESS_DENIED`. Over WebSocket, send `resume` with `{ name, threadId, decisions?, defaultDecision? }`; a paused run's `complete` event carries `status` and `pendingApprovals`.
 
+`POST /agents/:name/resume/stream` takes the same body and streams the rest of the run like `/stream`. `start` and `finish` name the resumed thread, and a body, agent or thread refused before the stream opens is answered as JSON, just like `/resume`. A thread with no paused run ends the open stream with an `error` event, `code: 'RUN_NOT_PAUSED'`, and disconnecting aborts the resume.
+
 ## Route Prefix
 
 ```typescript
@@ -189,7 +243,7 @@ const app = new Koa();
 const main = new Router();
 const api = cogitatorApp({ cogitator, agents });
 
-main.use('/api/v1', api.routes(), api.allowedMethods());
+main.use('/api/v1', api.routes());
 app.use(main.routes());
 ```
 
@@ -204,12 +258,11 @@ import { cogitatorApp, setupWebSocket } from '@cogitator-ai/koa';
 const app = new Koa();
 const router = cogitatorApp({ cogitator, agents });
 app.use(router.routes());
-app.use(router.allowedMethods());
 
 const server = createServer(app.callback());
 await setupWebSocket(
   server,
-  { runtime: cogitator, agents, workflows: {}, swarms: {} },
+  { runtime: cogitator, agents, workflows: {}, swarms: {}, limits: { swarmTimeout: 120_000 } },
   {
     path: '/ws',
     pingInterval: 30000,
@@ -221,13 +274,15 @@ await setupWebSocket(
       }
       return { userId: 'api' };
     },
+    anonymous: 'deny',
+    deps: (req) => ({ tenant: req.headers['x-tenant'] }),
   }
 );
 
 server.listen(3000);
 ```
 
-The router's `auth` option does not cover WebSocket connections, so pass `auth` to `setupWebSocket` to protect them: it receives the upgrade `IncomingMessage`, and throwing rejects the handshake with `401` (or `500` when the error carries a `status >= 500`). Upgrades on other paths are left to other `upgrade` listeners (or rejected with `404` when there are none), so the socket can share the HTTP server with other WebSocket servers. A client that does not answer a ping within `pingTimeout` (defaults to `pingInterval`) is terminated, and closing a connection aborts its active run.
+The router's `auth` option does not cover WebSocket connections, so pass `auth` to `setupWebSocket` to protect them: it receives the upgrade `IncomingMessage`, and throwing rejects the handshake with `401` (or `500` when the error carries a `status >= 500`). With `anonymous: 'deny'` a connection without a `userId` is refused with `401` too. `deps` builds the deps of each agent run on the connection from its upgrade request, called for each run. The route context can carry `limits` and `authorizeThread`, which WebSocket runs and resumes follow like the HTTP routes, and `anonymous`, which the handshake follows when the `anonymous` option is not set (the option wins). Its `deps` builds the deps of HTTP runs from a Koa `Context`, which an upgrade request does not have, so `setupWebSocket` ignores it and takes the `deps` option instead. Upgrades on other paths are left to other `upgrade` listeners (or rejected with `404` when there are none), so the socket can share the HTTP server with other WebSocket servers. A client that does not answer a ping within `pingTimeout` (defaults to `pingInterval`) is terminated, and closing a connection aborts its active run.
 
 **Message types:**
 
@@ -238,11 +293,11 @@ The router's `auth` option does not cover WebSocket connections, so pass `auth`
 | `stop`       | Cancels the current run                                                        |
 | `ping`       | Answered with `pong` (echoes `id`)                                             |
 
-| Server sends | Description                                                                                            |
-| ------------ | ------------------------------------------------------------------------------------------------------ |
-| `event`      | `token`, `reasoning`, `tool-call`, `tool-result`, `complete` (with the serialized result), `cancelled` |
-| `error`      | Invalid message, unknown resource, run already in progress, or a masked run failure                    |
-| `pong`       | Heartbeat reply                                                                                        |
+| Server sends | Description                                                                                                             |
+| ------------ | ----------------------------------------------------------------------------------------------------------------------- |
+| `event`      | `token`, `reasoning`, `tool-call`, `tool-result`, `complete` (with the serialized result), `cancelled`                  |
+| `error`      | Invalid message, unknown resource, a thread `authorizeThread` refused, run already in progress, or a masked run failure |
+| `pong`       | Heartbeat reply                                                                                                         |
 
 ## SSE Streaming
 
@@ -307,21 +362,28 @@ import {
 
 Built-in middleware stack (applied automatically by `cogitatorApp`):
 
-- **Error handler** — catches errors and returns structured `ErrorResponse`
-- **Body parser** — parses JSON for POST, PUT, PATCH requests (`bodyLimit`, 1 MiB by default, returns `413` above it). A body already parsed by upstream middleware such as `koa-bodyparser` is reused
-- **Context** — injects `RouteContext` with `runtime`, `agents`, `workflows`, `swarms` into Koa state
-- **Auth** — optional authentication via the `auth` callback
+- **Error handler**, catches errors and returns structured `ErrorResponse`
+- **Body parser**, parses JSON for POST, PUT, PATCH requests (`bodyLimit`, 1 MiB by default, returns `413` above it). A body already parsed by upstream middleware such as `koa-bodyparser` is reused
+- **Context**, injects `RouteContext` with `runtime`, `agents`, `workflows`, `swarms` into Koa state
+- **Auth**, optional authentication via the `auth` callback
+- **Anonymous policy**, after the health and docs routes, answers `401` to callers without a `userId` under `anonymous: 'deny'` (`createAnonymousMiddleware`)
+- **Unmatched paths**, a request no route serves skips the middleware above and goes on to the middleware after the router untouched. What nothing answers goes through auth and the anonymous policy and gets `404 NOT_FOUND` in the error envelope, or `401` under `anonymous: 'deny'`. A method a path does not take is answered the same way. Under a prefix, only paths under it are answered
 
 ## Key Types
 
 ```typescript
 import type {
-  RouteContext, // { runtime, agents, workflows, swarms }
+  RouteContext, // { runtime, agents, workflows, swarms, limits?, authorizeThread?, anonymous?, deps? }, deps is for HTTP runs only
   CogitatorAppOptions,
   AuthContext,
   AuthFunction,
+  DepsFunction,
+  RunLimits,
+  AnonymousPolicy,
+  AuthorizeThread,
   WebSocketConfig,
   WebSocketAuthFunction,
+  WebSocketDepsFunction,
   WebSocketRunPayload,
   BodyParserOptions,
   WorkflowStatusResponse,

package/dist/app.d.ts

@@ -1,4 +1,11 @@
 import Router from '@koa/router';
 import type { CogitatorAppOptions, CogitatorState } from './types.js';
+/**
+ * The Cogitator API as a Koa router. A request no route serves passes on to the middleware
+ * after the router, and what is left unanswered gets `404 NOT_FOUND` in the error envelope, or
+ * `401 UNAUTHORIZED` for an anonymous caller under `anonymous: 'deny'`.
+ *
+ * @throws Error when `opts.limits` holds a limit that is not a positive integer
+ */
 export declare function cogitatorApp(opts: CogitatorAppOptions): Router<CogitatorState>;
 //# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAiBtE,wBAAgB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAAC,cAAc,CAAC,CAgC9E"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAmBtE;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAAC,cAAc,CAAC,CAsC9E"}

package/dist/app.js

@@ -1,30 +1,47 @@
 import Router from '@koa/router';
-import { createContextMiddleware, createAuthMiddleware, createBodyParser, createErrorHandler, } from './middleware/index.js';
+import { createContextMiddleware, createAnonymousMiddleware, createAuthMiddleware, createBodyParser, createErrorHandler, } from './middleware/index.js';
 import { createHealthRoutes, createAgentRoutes, createThreadRoutes, createToolRoutes, createWorkflowRoutes, createSwarmRoutes, } from './routes/index.js';
 import { createSwaggerRoutes } from './swagger/index.js';
+import { forRoutes, routeUnmatched } from './middleware/unmatched.js';
+/**
+ * The Cogitator API as a Koa router. A request no route serves passes on to the middleware
+ * after the router, and what is left unanswered gets `404 NOT_FOUND` in the error envelope, or
+ * `401 UNAUTHORIZED` for an anonymous caller under `anonymous: 'deny'`.
+ *
+ * @throws Error when `opts.limits` holds a limit that is not a positive integer
+ */
 export function cogitatorApp(opts) {
     const router = new Router();
-    router.use(createErrorHandler());
-    router.use(createBodyParser({ limit: opts.bodyLimit }));
-    router.use(createContextMiddleware(opts));
-    if (opts.auth) {
-        router.use(createAuthMiddleware(opts.auth));
+    const errorHandler = createErrorHandler();
+    const context = createContextMiddleware(opts);
+    const authenticate = opts.auth ? [createAuthMiddleware(opts.auth)] : [];
+    const anonymous = createAnonymousMiddleware(opts.anonymous);
+    router.use(forRoutes(errorHandler));
+    router.use(forRoutes(createBodyParser({ limit: opts.bodyLimit })));
+    router.use(forRoutes(context));
+    for (const middleware of authenticate)
+        router.use(forRoutes(middleware));
+    const publicRouters = [createHealthRoutes()];
+    if (opts.enableSwagger) {
+        publicRouters.push(createSwaggerRoutes({
+            ...opts.swagger,
+            auth: opts.swagger?.auth ?? Boolean(opts.auth),
+            ...(opts.limits && { limits: opts.limits }),
+        }));
     }
-    const subrouters = [
-        createHealthRoutes(),
+    const apiRouters = [
         createAgentRoutes(),
         createThreadRoutes(),
         createToolRoutes(),
         createWorkflowRoutes(),
         createSwarmRoutes(),
     ];
-    if (opts.enableSwagger) {
-        subrouters.push(createSwaggerRoutes({ ...opts.swagger, auth: opts.swagger?.auth ?? Boolean(opts.auth) }));
-    }
-    for (const sub of subrouters) {
+    for (const sub of publicRouters)
         router.use(sub.routes());
-        router.use(sub.allowedMethods());
-    }
+    router.use(forRoutes(anonymous));
+    for (const sub of apiRouters)
+        router.use(sub.routes());
+    routeUnmatched(router, [errorHandler, context, ...authenticate, anonymous]);
     return router;
 }
 //# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,UAAU,YAAY,CAAC,IAAyB;IACpD,MAAM,MAAM,GAAG,IAAI,MAAM,EAAkB,CAAC;IAE5C,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACxD,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;IAE1C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,kBAAkB,EAAE;QACpB,iBAAiB,EAAE;QACnB,kBAAkB,EAAE;QACpB,gBAAgB,EAAE;QAClB,oBAAoB,EAAE;QACtB,iBAAiB,EAAE;KACpB,CAAC;IAEF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,UAAU,CAAC,IAAI,CACb,mBAAmB,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CACzF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAyB;IACpD,MAAM,MAAM,GAAG,IAAI,MAAM,EAAkB,CAAC;IAC5C,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,SAAS,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAE5D,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,YAAY;QAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IAEzE,MAAM,aAAa,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,aAAa,CAAC,IAAI,CAChB,mBAAmB,CAAC;YAClB,GAAG,IAAI,CAAC,OAAO;YACf,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,iBAAiB,EAAE;QACnB,kBAAkB,EAAE;QACpB,gBAAgB,EAAE;QAClB,oBAAoB,EAAE;QACtB,iBAAiB,EAAE;KACpB,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,aAAa;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,UAAU;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvD,cAAc,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,GAAG,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;IAE5E,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { cogitatorApp } from './app.js';
-export type { AuthContext, AuthFunction, CogitatorAppOptions, CogitatorState, RouteContext, WebSocketConfig, WebSocketAuthFunction, AgentListResponse, AgentRunRequest, AgentRunResponse, AgentResumeRequest, PendingApproval, ThreadResponse, AddMessageRequest, ToolListResponse, WorkflowListResponse, WorkflowRunRequest, WorkflowRunResponse, WorkflowStatusResponse, SwarmListResponse, SwarmRunRequest, SwarmRunResponse, BlackboardResponse, HealthResponse, ReadinessResponse, ReadinessCheckStatus, ErrorResponse, SwaggerConfig, WebSocketMessage, WebSocketResponse, WebSocketRunPayload, WebSocketResumePayload, } from './types.js';
-export { createContextMiddleware, createAuthMiddleware, createBodyParser, createErrorHandler, } from './middleware/index.js';
+export type { AuthContext, AuthFunction, CogitatorAppOptions, CogitatorState, RouteContext, WebSocketConfig, WebSocketAuthFunction, WebSocketDepsFunction, DepsFunction, RunLimits, AnonymousPolicy, AuthorizeThread, AgentListResponse, AgentRunRequest, AgentRunResponse, AgentResumeRequest, PendingApproval, ThreadResponse, AddMessageRequest, ToolListResponse, WorkflowListResponse, WorkflowRunRequest, WorkflowRunResponse, WorkflowStatusResponse, SwarmListResponse, SwarmRunRequest, SwarmRunResponse, BlackboardResponse, HealthResponse, ReadinessResponse, ReadinessCheckStatus, ErrorResponse, SwaggerConfig, WebSocketMessage, WebSocketResponse, WebSocketRunPayload, WebSocketResumePayload, } from './types.js';
+export { createContextMiddleware, createAnonymousMiddleware, createAuthMiddleware, createBodyParser, createErrorHandler, } from './middleware/index.js';
 export type { BodyParserOptions } from './middleware/body-parser.js';
 export { createHealthRoutes, createAgentRoutes, createThreadRoutes, createToolRoutes, createWorkflowRoutes, createSwarmRoutes, } from './routes/index.js';
 export { createSwaggerRoutes } from './swagger/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,YAAY,EACV,WAAW,EACX,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACpF,YAAY,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EACL,UAAU,EACV,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AAErC,YAAY,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,UAAU,EACV,WAAW,EACX,KAAK,GACN,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,YAAY,EACV,WAAW,EACX,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,YAAY,EACZ,SAAS,EACT,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACpF,YAAY,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EACL,UAAU,EACV,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AAErC,YAAY,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,UAAU,EACV,WAAW,EACX,KAAK,GACN,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -1,5 +1,5 @@
 export { cogitatorApp } from './app.js';
-export { createContextMiddleware, createAuthMiddleware, createBodyParser, createErrorHandler, } from './middleware/index.js';
+export { createContextMiddleware, createAnonymousMiddleware, createAuthMiddleware, createBodyParser, createErrorHandler, } from './middleware/index.js';
 export { createHealthRoutes, createAgentRoutes, createThreadRoutes, createToolRoutes, createWorkflowRoutes, createSwarmRoutes, } from './routes/index.js';
 export { createSwaggerRoutes } from './swagger/index.js';
 export { KoaStreamWriter, setupSSEHeaders } from './streaming/koa-stream-writer.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAqCxC,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAGpF,OAAO,EACL,UAAU,EACV,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AAqBrC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AA0CxC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAGpF,OAAO,EACL,UAAU,EACV,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AAqBrC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/middleware/auth.d.ts

@@ -1,4 +1,10 @@
 import type { Context, Next } from 'koa';
+import { type AnonymousPolicy } from '@cogitator-ai/server-shared';
 import type { AuthFunction } from '../types.js';
 export declare function createAuthMiddleware(authFn: AuthFunction): (ctx: Context, next: Next) => Promise<void>;
+/**
+ * Turns away callers without a `userId` when `anonymous` is `'deny'`, with
+ * `401 UNAUTHORIZED`. Routes registered before it, such as health and docs, stay open.
+ */
+export declare function createAnonymousMiddleware(anonymous: AnonymousPolicy | undefined): (ctx: Context, next: Next) => Promise<void>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AACzC,OAAO,KAAK,EAAe,YAAY,EAAkB,MAAM,aAAa,CAAC;AAE7E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,IACzC,KAAK,OAAO,EAAE,MAAM,IAAI,mBAiBvC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AACzC,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9F,OAAO,KAAK,EAAe,YAAY,EAAkB,MAAM,aAAa,CAAC;AAG7E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,IACzC,KAAK,OAAO,EAAE,MAAM,IAAI,mBAgBvC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,eAAe,GAAG,SAAS,IAChE,KAAK,OAAO,EAAE,MAAM,IAAI,mBAQvC"}

package/dist/middleware/auth.js

@@ -1,3 +1,5 @@
+import { UNAUTHORIZED, admitCaller } from '@cogitator-ai/server-shared';
+import { sendError } from '../utils/errors.js';
 export function createAuthMiddleware(authFn) {
     return async (ctx, next) => {
         let auth;
@@ -9,12 +11,25 @@ export function createAuthMiddleware(authFn) {
             if (status !== undefined && status >= 500) {
                 throw err;
             }
-            ctx.status = 401;
-            ctx.body = { error: { message: 'Unauthorized', code: 'UNAUTHORIZED' } };
+            sendError(ctx, { ...UNAUTHORIZED, message: 'Unauthorized' });
             return;
         }
         ctx.state.auth = auth;
         await next();
     };
 }
+/**
+ * Turns away callers without a `userId` when `anonymous` is `'deny'`, with
+ * `401 UNAUTHORIZED`. Routes registered before it, such as health and docs, stay open.
+ */
+export function createAnonymousMiddleware(anonymous) {
+    return async (ctx, next) => {
+        const refusal = admitCaller(ctx.state.auth?.userId, anonymous);
+        if (refusal) {
+            sendError(ctx, refusal);
+            return;
+        }
+        await next();
+    };
+}
 //# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,OAAO,KAAK,EAAE,GAAY,EAAE,IAAU,EAAE,EAAE;QACxC,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAI,GAAkC,EAAE,MAAM,CAAC;YAC3D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC1C,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC;YACxE,OAAO;QACT,CAAC;QAEA,GAAG,CAAC,KAAwB,CAAC,IAAI,GAAG,IAAI,CAAC;QAC1C,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAwB,MAAM,6BAA6B,CAAC;AAE9F,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,OAAO,KAAK,EAAE,GAAY,EAAE,IAAU,EAAE,EAAE;QACxC,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAI,GAAkC,EAAE,MAAM,CAAC;YAC3D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC1C,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAEA,GAAG,CAAC,KAAwB,CAAC,IAAI,GAAG,IAAI,CAAC;QAC1C,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAsC;IAC9E,OAAO,KAAK,EAAE,GAAY,EAAE,IAAU,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,WAAW,CAAE,GAAG,CAAC,KAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACnF,IAAI,OAAO,EAAE,CAAC;YACZ,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/body-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body-parser.d.ts","sourceRoot":"","sources":["../../src/middleware/body-parser.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAEzC,eAAO,MAAM,kBAAkB,QAAc,CAAC;AAI9C,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,iBAAsB,IAGhD,KAAK,OAAO,EAAE,MAAM,IAAI,mBA4BvC"}
+{"version":3,"file":"body-parser.d.ts","sourceRoot":"","sources":["../../src/middleware/body-parser.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAGzC,eAAO,MAAM,kBAAkB,QAAc,CAAC;AAI9C,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,iBAAsB,IAGhD,KAAK,OAAO,EAAE,MAAM,IAAI,mBA0BvC"}

package/dist/middleware/body-parser.js

@@ -1,4 +1,5 @@
 import { refuseNonJsonBody } from '@cogitator-ai/server-shared';
+import { invalidInput, sendError } from '../utils/errors.js';
 export const DEFAULT_BODY_LIMIT = 1024 * 1024;
 const BODY_METHODS = new Set(['POST', 'PUT', 'PATCH']);
 export function createBodyParser(options = {}) {
@@ -7,8 +8,7 @@ export function createBodyParser(options = {}) {
         const refusal = refuseNonJsonBody(ctx.method, ctx.headers);
         if (refusal) {
             await discardBody(ctx);
-            ctx.status = refusal.status;
-            ctx.body = { error: { message: refusal.message, code: refusal.code } };
+            sendError(ctx, refusal);
             return;
         }
         if (BODY_METHODS.has(ctx.method) && ctx.is('application/json') && !isBodyConsumed(ctx)) {
@@ -23,8 +23,7 @@ export function createBodyParser(options = {}) {
                     ctx.request.body = JSON.parse(raw);
                 }
                 catch {
-                    ctx.status = 400;
-                    ctx.body = { error: { message: 'Invalid JSON body', code: 'INVALID_INPUT' } };
+                    invalidInput(ctx, 'Invalid JSON body');
                     return;
                 }
             }

package/dist/middleware/body-parser.js.map

@@ -1 +1 @@
-{"version":3,"file":"body-parser.js","sourceRoot":"","sources":["../../src/middleware/body-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAGhE,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9C,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAM5E,MAAM,UAAU,gBAAgB,CAAC,UAA6B,EAAE;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,kBAAkB,CAAC;IAElD,OAAO,KAAK,EAAE,GAAY,EAAE,IAAU,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;YACvB,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC5B,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,OAAO;QACT,CAAC;QACD,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACvF,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,KAAK,EAAE,CAAC;gBAC9D,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;gBACvB,MAAM,IAAI,oBAAoB,EAAE,CAAC;YACnC,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvC,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gBACf,IAAI,CAAC;oBACF,GAAG,CAAC,OAAmD,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAClF,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;oBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,CAAC;oBAC9E,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,OAAO,CACJ,GAAG,CAAC,OAAmD,CAAC,IAAI,KAAK,SAAS;QAC3E,GAAG,CAAC,GAAG,CAAC,aAAa,CACtB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAEjE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtB,GAAG,CAAC,MAAM,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY,EAAE,KAAa;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACtB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC1B,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAE,EAAE;YACpC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,CAAC;QACX,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;gBACjB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;gBAClB,MAAM,CAAC,GAAG,EAAE;oBACV,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC;gBACvE,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC,CAAC;QAEtE,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,oBAAqB,SAAQ,KAAK;IAC7B,MAAM,GAAG,GAAG,CAAC;IACb,MAAM,GAAG,IAAI,CAAC;IAEvB;QACE,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,mBAAoB,SAAQ,KAAK;IAC5B,MAAM,GAAG,GAAG,CAAC;IACb,MAAM,GAAG,IAAI,CAAC;IAEvB;QACE,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF"}
+{"version":3,"file":"body-parser.js","sourceRoot":"","sources":["../../src/middleware/body-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9C,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAM5E,MAAM,UAAU,gBAAgB,CAAC,UAA6B,EAAE;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,kBAAkB,CAAC;IAElD,OAAO,KAAK,EAAE,GAAY,EAAE,IAAU,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;YACvB,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACvF,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,KAAK,EAAE,CAAC;gBAC9D,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;gBACvB,MAAM,IAAI,oBAAoB,EAAE,CAAC;YACnC,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvC,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gBACf,IAAI,CAAC;oBACF,GAAG,CAAC,OAAmD,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAClF,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;oBACvC,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,OAAO,CACJ,GAAG,CAAC,OAAmD,CAAC,IAAI,KAAK,SAAS;QAC3E,GAAG,CAAC,GAAG,CAAC,aAAa,CACtB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAEjE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtB,GAAG,CAAC,MAAM,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY,EAAE,KAAa;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACtB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC1B,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAE,EAAE;YACpC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,CAAC;QACX,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;gBACjB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;gBAClB,MAAM,CAAC,GAAG,EAAE;oBACV,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC;gBACvE,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC,CAAC;QAEtE,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,oBAAqB,SAAQ,KAAK;IAC7B,MAAM,GAAG,GAAG,CAAC;IACb,MAAM,GAAG,IAAI,CAAC;IAEvB;QACE,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,mBAAoB,SAAQ,KAAK;IAC5B,MAAM,GAAG,GAAG,CAAC;IACb,MAAM,GAAG,IAAI,CAAC;IAEvB;QACE,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF"}

package/dist/middleware/context.d.ts

@@ -1,4 +1,9 @@
 import type { Context, Next } from 'koa';
 import type { CogitatorAppOptions } from '../types.js';
+/**
+ * Sets the Cogitator state of each request.
+ *
+ * @throws Error when `opts.limits` holds a limit that is not a positive integer
+ */
 export declare function createContextMiddleware(opts: CogitatorAppOptions): (ctx: Context, next: Next) => Promise<void>;
 //# sourceMappingURL=context.d.ts.map

package/dist/middleware/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/middleware/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AACzC,OAAO,KAAK,EAAE,mBAAmB,EAAgC,MAAM,aAAa,CAAC;AAOrF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,mBAAmB,IAWjD,KAAK,OAAO,EAAE,MAAM,IAAI,mBAOvC"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/middleware/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AACzC,OAAO,KAAK,EAAE,mBAAmB,EAAgC,MAAM,aAAa,CAAC;AAQrF;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,mBAAmB,IAejD,KAAK,OAAO,EAAE,MAAM,IAAI,mBAOvC"}

package/dist/middleware/context.js

@@ -1,4 +1,9 @@
-import { DEFAULT_THREAD_MESSAGE_ROLES, generateId, resolveSseHeartbeatMs, } from '@cogitator-ai/server-shared';
+import { DEFAULT_THREAD_MESSAGE_ROLES, checkRunLimits, generateId, resolveSseHeartbeatMs, } from '@cogitator-ai/server-shared';
+/**
+ * Sets the Cogitator state of each request.
+ *
+ * @throws Error when `opts.limits` holds a limit that is not a positive integer
+ */
 export function createContextMiddleware(opts) {
     const routeCtx = {
         runtime: opts.cogitator,
@@ -8,6 +13,10 @@ export function createContextMiddleware(opts) {
         sseHeartbeatMs: resolveSseHeartbeatMs(opts.sseHeartbeatMs),
         acceptContext: opts.acceptContext ?? false,
         threadMessageRoles: opts.threadMessageRoles ?? DEFAULT_THREAD_MESSAGE_ROLES,
+        limits: checkRunLimits(opts.limits),
+        authorizeThread: opts.authorizeThread,
+        anonymous: opts.anonymous,
+        deps: opts.deps,
     };
     return async (ctx, next) => {
         const state = ctx.state;

package/dist/middleware/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/middleware/context.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,4BAA4B,EAC5B,UAAU,EACV,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AAErC,MAAM,UAAU,uBAAuB,CAAC,IAAyB;IAC/D,MAAM,QAAQ,GAAiB;QAC7B,OAAO,EAAE,IAAI,CAAC,SAAS;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;QAC/B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;QACzB,cAAc,EAAE,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC;QAC1D,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,KAAK;QAC1C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,4BAA4B;KAC5E,CAAC;IAEF,OAAO,KAAK,EAAE,GAAY,EAAE,IAAU,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAuB,CAAC;QAC1C,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC3B,KAAK,CAAC,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACpC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/middleware/context.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,UAAU,EACV,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAyB;IAC/D,MAAM,QAAQ,GAAiB;QAC7B,OAAO,EAAE,IAAI,CAAC,SAAS;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;QAC/B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;QACzB,cAAc,EAAE,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC;QAC1D,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,KAAK;QAC1C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,4BAA4B;QAC3E,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;QACnC,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC;IAEF,OAAO,KAAK,EAAE,GAAY,EAAE,IAAU,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAuB,CAAC;QAC1C,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC3B,KAAK,CAAC,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACpC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/error-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAGzC,wBAAgB,kBAAkB,KAClB,KAAK,OAAO,EAAE,MAAM,IAAI,mBAkDvC"}
+{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAIzC,wBAAgB,kBAAkB,KAClB,KAAK,OAAO,EAAE,MAAM,IAAI,mBA6BvC"}