@decentnetwork/beagle-service 0.0.0-stage → 0.1.0

package/dist/outbox.js

@@ -0,0 +1,314 @@
+import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { randomBytes } from "node:crypto";
+import { atomicWriteJson, msgOf, readJsonFile } from "./util.js";
+// ── splitting ───────────────────────────────────────────────────────────────
+//
+// A Carrier friend message that stays one packet carries at most 1024 bytes of
+// text. A friend that reads the delivery envelope gets
+// "\x1eDNPACK1:" + base64url(JSON {t:"msg", id, text}), so the JSON may be at
+// most floor((1024 - 9) * 3 / 4) = 761 bytes; an envelope-less friend gets the
+// text itself. Each part is cut to fit the tighter of the two, so it travels
+// as one packet on either road and to either kind of friend.
+const ENVELOPE_JSON_MAX = 761;
+const ID_RESERVE = "x".repeat(48);
+const fits = (text) => Buffer.byteLength(JSON.stringify({ t: "msg", id: ID_RESERVE, text })) <= ENVELOPE_JSON_MAX;
+/** Cut `text` into parts that each fit one message (about 700 bytes of
+ *  UTF-8), at a line break or a space where one is near. The parts joined
+ *  together are the text, unchanged. */
+export function splitText(text) {
+    if (fits(text))
+        return [text];
+    const cps = Array.from(text); // code points: never cut inside a surrogate pair
+    const parts = [];
+    let start = 0;
+    while (start < cps.length) {
+        let lo = 1;
+        let hi = Math.min(cps.length - start, ENVELOPE_JSON_MAX);
+        while (lo < hi) {
+            const mid = (lo + hi + 1) >> 1;
+            if (fits(cps.slice(start, start + mid).join("")))
+                lo = mid;
+            else
+                hi = mid - 1;
+        }
+        let n = lo;
+        if (start + n < cps.length) {
+            // Prefer to end the part after a line break, else after a space, when
+            // one lies in its last third.
+            const floor = Math.floor(n * (2 / 3));
+            let cut = -1;
+            for (let i = n - 1; i >= floor; i--) {
+                if (cps[start + i] === "\n") {
+                    cut = i + 1;
+                    break;
+                }
+            }
+            if (cut < 0) {
+                for (let i = n - 1; i >= floor; i--) {
+                    if (cps[start + i] === " ") {
+                        cut = i + 1;
+                        break;
+                    }
+                }
+            }
+            if (cut > 0)
+                n = cut;
+        }
+        parts.push(cps.slice(start, start + n).join(""));
+        start += n;
+    }
+    return parts;
+}
+/**
+ * Messages on their way out, kept in one JSON file.
+ *
+ * - A message is written to disk before `enqueue` returns and removed only
+ *   after a road took it, so a restart loses nothing.
+ * - Its `deliveryId` is fixed when it is queued. A retry, a second road or a
+ *   send repeated after a crash carries the same id, and a friend that reads
+ *   the delivery envelope shows it once.
+ * - One queue per recipient: a recipient's messages go in order, and an
+ *   unreachable recipient never holds up another.
+ * - The road (the rule the agentnet daemon uses): a session that has just
+ *   proven itself gets the message live, with a short wait for the
+ *   confirmation; otherwise, or when no confirmation comes, it is posted to
+ *   an Express node at once. Only when neither road takes it does it wait,
+ *   with a delay that doubles up to `maxDelayMs`.
+ * - What can never arrive is moved to the dead-letter file with the reason.
+ */
+export class Outbox {
+    #o;
+    #items;
+    #busy = new Set();
+    /** The message being sent to each recipient right now. */
+    #inFlight = new Map();
+    /** Recipients whose queue was dropped while a send was in flight, and why. */
+    #dropAfter = new Map();
+    #stopped = false;
+    #now;
+    #log;
+    #base;
+    #max;
+    #maxAge;
+    constructor(o) {
+        this.#o = o;
+        this.#now = o.now ?? Date.now;
+        this.#log = o.log ?? (() => { });
+        this.#base = o.baseDelayMs ?? 5_000;
+        this.#max = o.maxDelayMs ?? 10 * 60_000;
+        this.#maxAge = o.maxAgeMs ?? 72 * 3_600_000;
+        const loaded = readJsonFile(o.file, []);
+        this.#items = Array.isArray(loaded) ? loaded.filter((i) => i && typeof i.to === "string" && typeof i.text === "string" && typeof i.deliveryId === "string") : [];
+        // Whatever delay was running when the process ended is over.
+        for (const i of this.#items)
+            i.nextAt = 0;
+    }
+    list() {
+        return this.#items.map((i) => ({ ...i }));
+    }
+    deadLetters(limit = 500) {
+        let raw = "";
+        try {
+            raw = readFileSync(this.#o.deadFile, "utf8");
+        }
+        catch {
+            return [];
+        }
+        const out = [];
+        for (const line of raw.split("\n")) {
+            if (!line)
+                continue;
+            try {
+                out.push(JSON.parse(line));
+            }
+            catch {
+                /* a torn last line */
+            }
+        }
+        return out.slice(-limit);
+    }
+    #make(to, text) {
+        const id = `${this.#now().toString(36)}${randomBytes(9).toString("base64url")}`;
+        const texts = splitText(text);
+        const createdAt = new Date(this.#now()).toISOString();
+        return texts.map((t, part) => ({
+            id,
+            part,
+            parts: texts.length,
+            to,
+            text: t,
+            deliveryId: `bs-${id}-${part}`,
+            createdAt,
+            attempts: 0,
+            nextAt: 0,
+        }));
+    }
+    /** Put a text on disk for `to`. Synchronous: when it returns, the message survives a crash. */
+    enqueue(to, text) {
+        const items = this.#make(to, text);
+        this.#items.push(...items);
+        this.#persist();
+        return items.map((i) => ({ ...i }));
+    }
+    /** Record a message that cannot be sent at all, without queueing it. */
+    refuse(to, text, why) {
+        const items = this.#make(to, text);
+        for (const i of items)
+            this.#deadLetter(i, why);
+        return items;
+    }
+    /** Dead-letter everything queued for `to`. */
+    dropFor(to, why) {
+        // A message already on the wire is not called dead: it may well arrive.
+        // Its attempt finishes; only if it fails is it dead-lettered too.
+        const flying = this.#inFlight.get(to);
+        if (flying)
+            this.#dropAfter.set(to, why);
+        const mine = this.#items.filter((i) => i.to === to && i !== flying);
+        if (!mine.length)
+            return 0;
+        this.#items = this.#items.filter((i) => i.to !== to || i === flying);
+        this.#persist();
+        for (const i of mine)
+            this.#deadLetter(i, why);
+        return mine.length;
+    }
+    /** Something changed for `to` (accepted, connected): try now, not after the delay. */
+    kick(to) {
+        for (const i of this.#items)
+            if (i.to === to)
+                i.nextAt = 0;
+        void this.pump();
+    }
+    stop() {
+        this.#stopped = true;
+    }
+    /** Try the head of every recipient's queue that is due. */
+    async pump() {
+        if (this.#stopped)
+            return;
+        const t = this.#now();
+        const due = new Set();
+        const seen = new Set();
+        for (const i of this.#items) {
+            if (seen.has(i.to))
+                continue;
+            seen.add(i.to);
+            if (!this.#busy.has(i.to) && i.nextAt <= t)
+                due.add(i.to);
+        }
+        await Promise.all([...due].map((to) => this.#drain(to)));
+    }
+    async #drain(to) {
+        this.#busy.add(to);
+        try {
+            for (;;) {
+                if (this.#stopped)
+                    return;
+                const head = this.#items.find((i) => i.to === to);
+                if (!head || head.nextAt > this.#now())
+                    return;
+                if (!(await this.#deliver(head)))
+                    return;
+            }
+        }
+        catch (e) {
+            this.#log(`beagle-service: outbox for ${to.slice(0, 8)} failed: ${msgOf(e)}`);
+        }
+        finally {
+            this.#busy.delete(to);
+        }
+    }
+    /** true when the item left the queue (delivered or dead-lettered). */
+    async #deliver(item) {
+        const t = this.#o.transport;
+        const relation = t.relation(item.to);
+        if (relation === "none")
+            return this.#settleDead(item, "not-a-friend");
+        if (this.#now() - Date.parse(item.createdAt) > this.#maxAge) {
+            return this.#settleDead(item, relation === "pending" ? "not-a-friend" : "expired", item.lastError);
+        }
+        if (relation === "pending")
+            return this.#wait(item, "the friend request is not accepted yet");
+        let result;
+        this.#inFlight.set(item.to, item);
+        try {
+            result = await this.#road(item);
+        }
+        catch (e) {
+            const err = msgOf(e);
+            const dropped = this.#dropAfter.get(item.to);
+            if (dropped)
+                return this.#settleDead(item, dropped, err);
+            // The far side dropped us between the check and the send.
+            if (/not a friend/i.test(err) && t.relation(item.to) === "none")
+                return this.#settleDead(item, "not-a-friend", err);
+            return this.#wait(item, err);
+        }
+        finally {
+            this.#inFlight.delete(item.to);
+            this.#dropAfter.delete(item.to);
+        }
+        this.#remove(item);
+        this.#o.onDelivered?.({ id: item.id, deliveryId: item.deliveryId, to: item.to, ...result });
+        return true;
+    }
+    async #road(item) {
+        const t = this.#o.transport;
+        const { to, text, deliveryId } = item;
+        const live = async () => {
+            const how = await t.sendLive(to, text, deliveryId);
+            return { via: how === "offline" ? "offline" : "online", confirmed: how === "acked" };
+        };
+        const express = async () => {
+            await t.sendExpress(to, text, deliveryId);
+            return { via: "offline", confirmed: false };
+        };
+        const [first, second, a, b] = t.proven(to) ? [live, express, "live", "express"] : [express, live, "express", "live"];
+        try {
+            return await first();
+        }
+        catch (e1) {
+            try {
+                return await second();
+            }
+            catch (e2) {
+                throw new Error(`${a}: ${msgOf(e1)}; ${b}: ${msgOf(e2)}`);
+            }
+        }
+    }
+    #wait(item, error) {
+        item.attempts += 1;
+        item.lastError = error;
+        item.nextAt = this.#now() + Math.min(this.#max, this.#base * 2 ** Math.min(item.attempts - 1, 20));
+        this.#persist();
+        return false;
+    }
+    #settleDead(item, why, error) {
+        this.#remove(item);
+        this.#deadLetter(item, why, error);
+        return true;
+    }
+    #remove(item) {
+        const i = this.#items.indexOf(item);
+        if (i >= 0)
+            this.#items.splice(i, 1);
+        this.#persist();
+    }
+    #deadLetter(item, why, error) {
+        const letter = { at: new Date(this.#now()).toISOString(), why, ...(error ? { error } : {}), item: { ...item } };
+        try {
+            mkdirSync(dirname(this.#o.deadFile), { recursive: true });
+            appendFileSync(this.#o.deadFile, JSON.stringify(letter) + "\n", { mode: 0o600 });
+        }
+        catch (e) {
+            this.#log(`beagle-service: could not write the dead-letter file: ${msgOf(e)}`);
+        }
+        this.#log(`beagle-service: dead-letter (${why}) for ${item.to.slice(0, 8)}${error ? `: ${error}` : ""}`);
+        this.#o.onDead?.(letter);
+    }
+    #persist() {
+        atomicWriteJson(this.#o.file, this.#items);
+    }
+}

package/dist/routes.d.ts

@@ -0,0 +1,21 @@
+import type { AdapterOptions, Agent, Auth, Handlers, NodeHandler, RouteHandler, SessionConfig, UserRecord, Users } from "./types.js";
+import { type Logger } from "./util.js";
+/** The library's own fields only: a site's extra fields (a plan, notes) do
+ *  not reach the page unless the site says so with `publicUser`. */
+export declare function defaultPublicUser(user: UserRecord): Record<string, unknown>;
+export interface RoutesOptions {
+    auth: Auth;
+    users: Users;
+    session?: SessionConfig;
+    publicUser?: (user: UserRecord) => Record<string, unknown>;
+    agent: () => Agent | undefined;
+    log: Logger;
+}
+export declare function createRoutes(opts: RoutesOptions): {
+    handle: RouteHandler;
+    handlers: Handlers;
+    nodeHandler: (o?: AdapterOptions) => NodeHandler;
+    expressHandler: (o?: AdapterOptions) => NodeHandler;
+    nextApiHandler: (o?: AdapterOptions) => NodeHandler;
+    fetchHandler: (o?: AdapterOptions) => (request: Request) => Promise<Response>;
+};

package/dist/routes.js

@@ -0,0 +1,321 @@
+import { headerOf } from "./auth.js";
+import { msgOf } from "./util.js";
+const MAX_BODY_BYTES = 64 * 1024;
+const MESSAGES = {
+    "origin-not-allowed": "This origin is not on the site's list.",
+    "bad-request": "The request body is not what this route expects.",
+    "bad-nonce": "The nonce is unknown, expired or already used. Ask for a new one.",
+    "bad-signature": "The signature did not verify.",
+    "launch-expired": "The launch assertion is more than two minutes from now.",
+    "launch-replayed": "This launch assertion was already used.",
+    blocked: "This identity may not use the site.",
+    "register-required": "Registration is required to go on.",
+    "not-signed-in": "Not signed in.",
+    "invalid-fields": "Some registration fields are missing or not accepted.",
+    "not-found": "No such route.",
+    "method-not-allowed": "Wrong method for this route.",
+    "too-large": "The request body is too large.",
+    "server-error": "The server could not answer.",
+};
+/** The library's own fields only: a site's extra fields (a plan, notes) do
+ *  not reach the page unless the site says so with `publicUser`. */
+export function defaultPublicUser(user) {
+    const { userid, address, name, avatar, punkId, door, status, profile, firstSeen, lastSeen } = user;
+    return { userid, address, name, avatar, punkId, door, status, profile, firstSeen, lastSeen };
+}
+export function createRoutes(opts) {
+    const { auth, users, log } = opts;
+    const transport = opts.session?.transport ?? "cookie";
+    const publicUser = opts.publicUser ?? defaultPublicUser;
+    const lower = (req) => {
+        const headers = {};
+        for (const [k, v] of Object.entries(req.headers ?? {}))
+            headers[k.toLowerCase()] = v;
+        return { ...req, method: String(req.method || "GET").toUpperCase(), headers };
+    };
+    function baseHeaders(req) {
+        const h = {
+            "content-type": "application/json; charset=utf-8",
+            "cache-control": "no-store",
+            vary: "Origin",
+        };
+        // CORS for the listed origins only, so a page on one origin can call an
+        // API on another (with the cookie, or with a bearer token).
+        const origin = auth.allowedOrigin(req);
+        if (origin) {
+            h["access-control-allow-origin"] = origin;
+            h["access-control-allow-credentials"] = "true";
+        }
+        return h;
+    }
+    const answer = (req, status, body, extra = {}) => ({
+        status,
+        headers: { ...baseHeaders(req), ...extra },
+        body,
+    });
+    const refuse = (req, status, error, more = {}, extra = {}) => answer(req, status, { ok: false, error, message: MESSAGES[error], ...more }, extra);
+    const agentInfo = () => {
+        const a = opts.agent();
+        return a ? { agent: { userid: a.userid, address: a.address, name: a.nickname ?? null } } : {};
+    };
+    const wrongMethod = (req, want) => (req.method === want ? null : refuse(req, 405, "method-not-allowed", {}, { allow: `${want}, OPTIONS` }));
+    /** A state-changing request must come from one of the site's pages (the
+     *  browser sets Origin; page script cannot), or carry a bearer token, which
+     *  no other site can make a browser send. */
+    const fromOurPage = (req) => auth.allowedOrigin(req) !== null || /^bearer /i.test(headerOf(req, "authorization") ?? "");
+    // ── the six routes ────────────────────────────────────────────────────────
+    const nonce = async (raw) => {
+        const req = lower(raw);
+        return wrongMethod(req, "GET") ?? answer(req, 200, { ok: true, nonce: auth.issueNonce(), expiresIn: 120 });
+    };
+    async function establish(req, v) {
+        if (!v.ok)
+            return refuse(req, v.status, v.error);
+        const known = await users.get(v.userid);
+        if (known?.status === "blocked")
+            return refuse(req, 403, "blocked");
+        const user = await users.recordSignIn(v.userid, v.hints, { door: v.door });
+        if (user.status === "blocked")
+            return refuse(req, 403, "blocked");
+        const session = auth.mintSession(user.userid);
+        const registration = users.registration(user);
+        const extra = {};
+        if (transport !== "bearer")
+            extra["set-cookie"] = [auth.cookie(session.token, auth.allowedOrigin(req))];
+        const body = {
+            user: publicUser(user),
+            registration,
+            expiresAt: new Date(session.expiresAt).toISOString(),
+            ...(transport !== "cookie" ? { token: session.token } : {}),
+            ...agentInfo(),
+        };
+        // A visitor past the limit under `then: "refuse"` is told 403, and still
+        // gets the session: without it they could never prove who is registering.
+        // That session opens `register`, `logout` and nothing else.
+        if (registration.refused)
+            return refuse(req, 403, "register-required", body, extra);
+        return answer(req, 200, { ok: true, ...body }, extra);
+    }
+    const signIn = async (raw) => {
+        const req = lower(raw);
+        return wrongMethod(req, "POST") ?? establish(req, await auth.verifySignIn(auth.allowedOrigin(req), req.body));
+    };
+    const launch = async (raw) => {
+        const req = lower(raw);
+        return wrongMethod(req, "POST") ?? establish(req, await auth.verifyLaunch(auth.allowedOrigin(req), req.body));
+    };
+    const me = async (raw) => {
+        const req = lower(raw);
+        const bad = wrongMethod(req, "GET");
+        if (bad)
+            return bad;
+        const who = await auth.authenticate(req);
+        if (!who.ok) {
+            const more = who.user ? { user: publicUser(who.user), registration: who.registration, ...agentInfo() } : {};
+            return refuse(req, who.status, who.error, more);
+        }
+        return answer(req, 200, { ok: true, user: publicUser(who.user), registration: who.registration, ...agentInfo() });
+    };
+    const logout = async (raw) => {
+        const req = lower(raw);
+        const bad = wrongMethod(req, "POST");
+        if (bad)
+            return bad;
+        if (!fromOurPage(req))
+            return refuse(req, 403, "origin-not-allowed");
+        const token = auth.tokenOf(req);
+        if (token)
+            await auth.revoke(token);
+        const extra = {};
+        if (transport !== "bearer")
+            extra["set-cookie"] = [auth.cookie(null, auth.allowedOrigin(req))];
+        return answer(req, 200, { ok: true }, extra);
+    };
+    const register = async (raw) => {
+        const req = lower(raw);
+        const bad = wrongMethod(req, "POST");
+        if (bad)
+            return bad;
+        if (!fromOurPage(req))
+            return refuse(req, 403, "origin-not-allowed");
+        const who = await auth.authenticate(req, { allowUnregistered: true });
+        if (!who.ok)
+            return refuse(req, who.status, who.error);
+        if (!req.body || typeof req.body !== "object")
+            return refuse(req, 400, "bad-request");
+        const b = req.body;
+        const submitted = b.profile && typeof b.profile === "object" ? b.profile : b;
+        const r = await users.register(who.user.userid, submitted);
+        if (!r.ok) {
+            if (r.error === "invalid-fields")
+                return refuse(req, 400, "invalid-fields", { fields: r.fields });
+            return refuse(req, r.error === "blocked" ? 403 : 401, r.error === "blocked" ? "blocked" : "not-signed-in");
+        }
+        return answer(req, 200, { ok: true, user: publicUser(r.user), registration: users.registration(r.user), ...agentInfo() });
+    };
+    const handlers = { nonce, signIn, launch, me, logout, register };
+    // `/beagle` and `/beagle-launch` are the paths the Sign in with Beagle
+    // guide uses; a page written from it works unchanged.
+    const table = {
+        "/nonce": nonce,
+        "/sign-in": signIn,
+        "/beagle": signIn,
+        "/launch": launch,
+        "/beagle-launch": launch,
+        "/me": me,
+        "/logout": logout,
+        "/register": register,
+    };
+    const handle = async (raw) => {
+        const req = lower(raw);
+        try {
+            const path = "/" + String(req.path ?? "").split("?")[0].replace(/^\/+|\/+$/g, "");
+            const route = table[path];
+            if (!route)
+                return refuse(req, 404, "not-found");
+            if (req.method === "OPTIONS") {
+                return {
+                    status: 204,
+                    headers: {
+                        ...baseHeaders(req),
+                        "access-control-allow-methods": "GET, POST, OPTIONS",
+                        "access-control-allow-headers": "content-type, authorization",
+                        "access-control-max-age": "600",
+                    },
+                    body: null,
+                };
+            }
+            return await route(req);
+        }
+        catch (e) {
+            log(`beagle-service: ${req.method} ${req.path} failed: ${e?.stack ?? msgOf(e)}`);
+            return refuse(req, 500, "server-error");
+        }
+    };
+    // ── adapters ──────────────────────────────────────────────────────────────
+    /** "/nonce" for "/api/auth/nonce" under prefix "/api/auth"; null outside it. */
+    function below(prefix, url) {
+        const p = "/" + prefix.replace(/^\/+|\/+$/g, "");
+        let pathname;
+        try {
+            pathname = new URL(url, "http://x").pathname;
+        }
+        catch {
+            return null;
+        }
+        if (p === "/")
+            return pathname;
+        if (pathname === p)
+            return "/";
+        return pathname.startsWith(p + "/") ? pathname.slice(p.length) : null;
+    }
+    function readBody(req) {
+        // Express (`express.json()`) and Next.js have parsed it already.
+        if (req.body !== undefined && req.body !== null && typeof req.body === "object" && !Buffer.isBuffer(req.body)) {
+            return Promise.resolve({ ok: true, body: req.body });
+        }
+        if (typeof req.body === "string" || Buffer.isBuffer(req.body))
+            return Promise.resolve(parse(String(req.body)));
+        return new Promise((resolve) => {
+            const chunks = [];
+            let size = 0;
+            let done = false;
+            const finish = (r) => {
+                if (!done) {
+                    done = true;
+                    resolve(r);
+                }
+            };
+            req.on("data", (c) => {
+                size += c.length;
+                if (size > MAX_BODY_BYTES) {
+                    finish({ ok: false, error: "too-large", status: 413 });
+                    req.resume?.();
+                }
+                else
+                    chunks.push(c);
+            });
+            req.on("end", () => finish(parse(Buffer.concat(chunks).toString("utf8"))));
+            req.on("error", () => finish({ ok: false, error: "bad-request", status: 400 }));
+        });
+    }
+    function parse(raw) {
+        if (raw.length > MAX_BODY_BYTES)
+            return { ok: false, error: "too-large", status: 413 };
+        if (raw.trim() === "")
+            return { ok: true, body: undefined };
+        try {
+            return { ok: true, body: JSON.parse(raw) };
+        }
+        catch {
+            return { ok: false, error: "bad-request", status: 400 };
+        }
+    }
+    function write(res, r) {
+        res.statusCode = r.status;
+        for (const [k, v] of Object.entries(r.headers))
+            res.setHeader(k, v);
+        res.end(r.body === null ? undefined : JSON.stringify(r.body));
+    }
+    function nodeAdapter(o, fallThrough) {
+        const prefix = o.prefix ?? "/api/auth";
+        return async (req, res, next) => {
+            const headers = req.headers ?? {};
+            // Express strips the mount path from `url`; `originalUrl` keeps it.
+            const path = below(prefix, req.originalUrl ?? req.url ?? "/");
+            if (path === null) {
+                if (fallThrough && typeof next === "function")
+                    return void next();
+                return write(res, refuse(lower({ method: req.method, headers }), 404, "not-found"));
+            }
+            try {
+                let body;
+                if (req.method === "POST") {
+                    const b = await readBody(req);
+                    if (!b.ok)
+                        return write(res, refuse(lower({ method: req.method, headers }), b.status, b.error));
+                    body = b.body;
+                }
+                write(res, await handle({ method: req.method, path, headers, body }));
+            }
+            catch (e) {
+                log(`beagle-service: ${req.method} ${req.url} failed: ${e?.stack ?? msgOf(e)}`);
+                if (!res.headersSent)
+                    write(res, refuse(lower({ method: req.method, headers }), 500, "server-error"));
+            }
+        };
+    }
+    function fetchHandler(o = {}) {
+        const prefix = o.prefix ?? "/api/auth";
+        return async (request) => {
+            const headers = {};
+            request.headers.forEach((v, k) => (headers[k] = v));
+            const reply = (r) => {
+                const h = new Headers();
+                for (const [k, v] of Object.entries(r.headers))
+                    for (const one of Array.isArray(v) ? v : [v])
+                        h.append(k, one);
+                return new Response(r.body === null ? null : JSON.stringify(r.body), { status: r.status, headers: h });
+            };
+            const path = below(prefix, request.url);
+            if (path === null)
+                return reply(refuse(lower({ method: request.method, headers }), 404, "not-found"));
+            let body;
+            if (request.method === "POST") {
+                const b = parse(await request.text());
+                if (!b.ok)
+                    return reply(refuse(lower({ method: request.method, headers }), b.status, b.error));
+                body = b.body;
+            }
+            return reply(await handle({ method: request.method, path, headers, body }));
+        };
+    }
+    return {
+        handle,
+        handlers,
+        nodeHandler: (o = {}) => nodeAdapter(o, false),
+        expressHandler: (o = {}) => nodeAdapter(o, true),
+        nextApiHandler: (o = {}) => nodeAdapter(o, false),
+        fetchHandler,
+    };
+}

package/dist/stores.d.ts

@@ -0,0 +1,13 @@
+import type { StateStore, UserStore } from "./types.js";
+/** Users in one JSON file, `{ [userid]: record }`, rewritten atomically on
+ *  every change. The whole table is held in memory; good for a site with up to
+ *  some tens of thousands of users and one server process. */
+export declare function jsonFileUserStore(file: string): UserStore;
+/** Users in memory; gone when the process ends. For tests. */
+export declare function memoryUserStore(): UserStore;
+/** Used nonces, used launch assertions and revoked sessions in one JSON file,
+ *  written atomically before each answer. One server process. */
+export declare function jsonFileStateStore(file: string, now?: () => number): StateStore;
+/** The same in memory. A restart forgets it, which reopens launch replay for
+ *  two minutes; for tests. */
+export declare function memoryStateStore(now?: () => number): StateStore;