@dexto/server 1.13.5 → 1.14.0

package/dist/hono/index.cjs

@@ -126,10 +126,11 @@ function createDextoApp(options) {
       `\u26A0\uFE0F  Authentication disabled (disableAuth=true). createAuthMiddleware() skipped. Ensure external auth is in place.`
     );
   }
+  const httpAuthorization = disableAuth ? () => ({ allowed: true }) : (0, import_auth.createHttpAuthorization)();
   const app = new import_zod_openapi.OpenAPIHono({ strict: false });
   app.use("*", (0, import_cors.createCorsMiddleware)());
   if (!disableAuth) {
-    app.use("*", (0, import_auth.createAuthMiddleware)());
+    app.use("*", (0, import_auth.createAuthMiddleware)(httpAuthorization));
   }
   app.onError((err, ctx) => (0, import_error.handleHonoError)(ctx, err));
   const rawPrefix = apiPrefix ?? DEFAULT_API_PREFIX;
@@ -297,7 +298,7 @@ function createDextoApp(options) {
     fullApp.route("/", (0, import_static.createStaticRouter)(webRoot));
     fullApp.notFound((0, import_static.createSpaFallbackHandler)(webRoot, webUIConfig, normalizedPrefix));
   }
-  Object.assign(fullApp, { webhookSubscriber });
+  Object.assign(fullApp, { webhookSubscriber, httpAuthorization });
   return fullApp;
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/hono/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/hono/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAuB,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAEH,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EAA4B,KAAK,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACpG,OAAO,EAGH,KAAK,kBAAkB,EAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAKhF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAI1E,OAAO,KAAK,EAAE,QAAQ,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA6D7E,MAAM,MAAM,qBAAqB,GAAG;IAChC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,UAAU,CAAC;IACrB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C,YAAY,EAAE,MAAM,SAAS,CAAC;IAC9B,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C,aAAa,EAAE,qBAAqB,CAAC;IACrC,oBAAoB,EAAE,yBAAyB,CAAC;IAChD,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAGF,QAAA,MAAM,kBAAkB,EAAG,MAAe,CAAC;AAE3C,KAAK,YAAY,GAAG,eAAe,CAC/B,aAAa,CAAC,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,EACpD,SAAS,CACZ,CAAC;AACF,KAAK,eAAe,GAAG,eAAe,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC/F,KAAK,aAAa,GAAG,eAAe,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAEpG,KAAK,wBAAwB,GACvB,oBAAoB,GACpB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,GACpB,kBAAkB,CAAC;AAEzB,KAAK,uBAAuB,GACtB,eAAe,GACf,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,GAClB,sBAAsB,GACtB,qBAAqB,GACrB,kBAAkB,CAAC;AAEzB,KAAK,sBAAsB,GAAG,qBAAqB,GAAG,kBAAkB,GAAG,iBAAiB,CAAC;AAE7F,KAAK,kBAAkB,GACjB,sBAAsB,GACtB,eAAe,GACf,iBAAiB,GACjB,qBAAqB,GACrB,kBAAkB,GAClB,wBAAwB,GACxB,qBAAqB,CAAC;AAE5B,KAAK,sBAAsB,GACrB,wBAAwB,GACxB,uBAAuB,GACvB,sBAAsB,GACtB,kBAAkB,CAAC;AAEzB,KAAK,gBAAgB,GAAG,eAAe,CAAC,sBAAsB,EAAE,OAAO,kBAAkB,CAAC,CAAC;AAM3F,KAAK,eAAe,GAAG,YAAY,GAAG,eAAe,GAAG,aAAa,CAAC;AACtE,KAAK,SAAS,GAAG,eAAe,GAAG,gBAAgB,CAAC;AAEpD,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,QAAQ,CA6OvE;AAED,MAAM,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;AAGrD,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/hono/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAuB,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAEH,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EAA4B,KAAK,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACpG,OAAO,EAGH,KAAK,kBAAkB,EAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAShF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAI1E,OAAO,KAAK,EAAE,QAAQ,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA6D7E,MAAM,MAAM,qBAAqB,GAAG;IAChC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,UAAU,CAAC;IACrB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C,YAAY,EAAE,MAAM,SAAS,CAAC;IAC9B,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C,aAAa,EAAE,qBAAqB,CAAC;IACrC,oBAAoB,EAAE,yBAAyB,CAAC;IAChD,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAGF,QAAA,MAAM,kBAAkB,EAAG,MAAe,CAAC;AAE3C,KAAK,YAAY,GAAG,eAAe,CAC/B,aAAa,CAAC,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,EACpD,SAAS,CACZ,CAAC;AACF,KAAK,eAAe,GAAG,eAAe,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC/F,KAAK,aAAa,GAAG,eAAe,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAEpG,KAAK,wBAAwB,GACvB,oBAAoB,GACpB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,GACpB,kBAAkB,CAAC;AAEzB,KAAK,uBAAuB,GACtB,eAAe,GACf,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,GAClB,sBAAsB,GACtB,qBAAqB,GACrB,kBAAkB,CAAC;AAEzB,KAAK,sBAAsB,GAAG,qBAAqB,GAAG,kBAAkB,GAAG,iBAAiB,CAAC;AAE7F,KAAK,kBAAkB,GACjB,sBAAsB,GACtB,eAAe,GACf,iBAAiB,GACjB,qBAAqB,GACrB,kBAAkB,GAClB,wBAAwB,GACxB,qBAAqB,CAAC;AAE5B,KAAK,sBAAsB,GACrB,wBAAwB,GACxB,uBAAuB,GACvB,sBAAsB,GACtB,kBAAkB,CAAC;AAEzB,KAAK,gBAAgB,GAAG,eAAe,CAAC,sBAAsB,EAAE,OAAO,kBAAkB,CAAC,CAAC;AAM3F,KAAK,eAAe,GAAG,YAAY,GAAG,eAAe,GAAG,aAAa,CAAC;AACtE,KAAK,SAAS,GAAG,eAAe,GAAG,gBAAgB,CAAC;AAEpD,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,QAAQ,CAgPvE;AAED,MAAM,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;AAGrD,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/hono/index.js

@@ -37,7 +37,10 @@ import {
 import { handleHonoError } from "./middleware/error.js";
 import { prettyJsonMiddleware, redactionMiddleware } from "./middleware/redaction.js";
 import { createCorsMiddleware } from "./middleware/cors.js";
-import { createAuthMiddleware } from "./middleware/auth.js";
+import {
+  createAuthMiddleware,
+  createHttpAuthorization
+} from "./middleware/auth.js";
 import { existsSync, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
@@ -107,10 +110,11 @@ function createDextoApp(options) {
       `\u26A0\uFE0F  Authentication disabled (disableAuth=true). createAuthMiddleware() skipped. Ensure external auth is in place.`
     );
   }
+  const httpAuthorization = disableAuth ? () => ({ allowed: true }) : createHttpAuthorization();
   const app = new OpenAPIHono({ strict: false });
   app.use("*", createCorsMiddleware());
   if (!disableAuth) {
-    app.use("*", createAuthMiddleware());
+    app.use("*", createAuthMiddleware(httpAuthorization));
   }
   app.onError((err, ctx) => handleHonoError(ctx, err));
   const rawPrefix = apiPrefix ?? DEFAULT_API_PREFIX;
@@ -278,7 +282,7 @@ function createDextoApp(options) {
     fullApp.route("/", createStaticRouter(webRoot));
     fullApp.notFound(createSpaFallbackHandler(webRoot, webUIConfig, normalizedPrefix));
   }
-  Object.assign(fullApp, { webhookSubscriber });
+  Object.assign(fullApp, { webhookSubscriber, httpAuthorization });
   return fullApp;
 }
 export {

package/dist/hono/middleware/auth.cjs

@@ -18,58 +18,68 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var auth_exports = {};
 __export(auth_exports, {
-  createAuthMiddleware: () => createAuthMiddleware
+  createAuthMiddleware: () => createAuthMiddleware,
+  createHttpAuthorization: () => createHttpAuthorization,
+  createRequiredBearerAuthorization: () => createRequiredBearerAuthorization
 });
 module.exports = __toCommonJS(auth_exports);
 var import_core = require("@dexto/core");
 const PUBLIC_ROUTES = ["/health", "/.well-known/agent-card.json", "/openapi.json"];
-function createAuthMiddleware() {
+function createRequiredBearerAuthorization(apiKey, configurationMessage = "Server API key not configured.") {
+  return (header) => {
+    if (!apiKey) {
+      return {
+        allowed: false,
+        status: 500,
+        body: { error: "Configuration Error", message: configurationMessage }
+      };
+    }
+    const providedKey = header?.match(/^Bearer\s+(.+)$/i)?.[1];
+    if (!providedKey || providedKey !== apiKey) {
+      return {
+        allowed: false,
+        status: 401,
+        body: {
+          error: "Unauthorized",
+          message: "Invalid or missing API key. Provide Authorization: Bearer <api-key> header."
+        }
+      };
+    }
+    return { allowed: true };
+  };
+}
+function createHttpAuthorization() {
   const apiKey = process.env.DEXTO_SERVER_API_KEY;
   const isProduction = process.env.NODE_ENV === "production";
   const requireAuth = process.env.DEXTO_SERVER_REQUIRE_AUTH === "true";
+  if (!isProduction && !requireAuth) return () => ({ allowed: true });
   if (isProduction && !apiKey) {
     import_core.logger.warn(
-      `\u26A0\uFE0F  SECURITY WARNING: Running in production mode (NODE_ENV=production) without DEXTO_SERVER_API_KEY. Dexto Server API is UNPROTECTED. Set DEXTO_SERVER_API_KEY environment variable to secure your API.`
+      "Production HTTP authentication requires DEXTO_SERVER_API_KEY; protected requests will fail closed."
     );
   }
+  return createRequiredBearerAuthorization(
+    apiKey,
+    requireAuth ? "DEXTO_SERVER_REQUIRE_AUTH=true but DEXTO_SERVER_API_KEY not set. Set DEXTO_SERVER_API_KEY environment variable." : "NODE_ENV=production requires DEXTO_SERVER_API_KEY. Set DEXTO_SERVER_API_KEY environment variable to secure your API."
+  );
+}
+function createAuthMiddleware(authorize = createHttpAuthorization()) {
   return async (ctx, next) => {
     const path = ctx.req.path;
     if (PUBLIC_ROUTES.some((route) => path === route || path.startsWith(route))) {
       return next();
     }
-    if (!isProduction && !requireAuth) {
-      return next();
-    }
-    if (!apiKey) {
-      return ctx.json(
-        {
-          error: "Configuration Error",
-          message: requireAuth ? "DEXTO_SERVER_REQUIRE_AUTH=true but DEXTO_SERVER_API_KEY not set. Set DEXTO_SERVER_API_KEY environment variable." : "NODE_ENV=production requires DEXTO_SERVER_API_KEY. Set DEXTO_SERVER_API_KEY environment variable to secure your API."
-        },
-        500
-      );
-    }
-    const authHeader = ctx.req.header("Authorization");
-    const providedKey = authHeader?.replace(/^Bearer\s+/i, "");
-    if (!providedKey || providedKey !== apiKey) {
-      import_core.logger.warn("Unauthorized API access attempt", {
-        path,
-        hasKey: !!providedKey,
-        origin: ctx.req.header("origin"),
-        userAgent: ctx.req.header("user-agent")
-      });
-      return ctx.json(
-        {
-          error: "Unauthorized",
-          message: "Invalid or missing API key. Provide Authorization: Bearer <api-key> header."
-        },
-        401
-      );
+    const result = authorize(ctx.req.header("Authorization"));
+    if (!result.allowed) {
+      if (result.status === 401) import_core.logger.warn("Unauthorized API access attempt", { path });
+      return ctx.json(result.body, result.status);
     }
     await next();
   };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  createAuthMiddleware
+  createAuthMiddleware,
+  createHttpAuthorization,
+  createRequiredBearerAuthorization
 });

package/dist/hono/middleware/auth.d.ts

@@ -1,3 +1,17 @@
 import type { MiddlewareHandler } from 'hono';
-export declare function createAuthMiddleware(): MiddlewareHandler;
+export type HttpAuthorizationResult = {
+    allowed: true;
+} | {
+    allowed: false;
+    status: 401 | 500;
+    body: {
+        error: string;
+        message: string;
+    };
+};
+export type HttpAuthorization = (header: string | undefined) => HttpAuthorizationResult;
+/** Required bearer validation, independent of the development-mode server default. */
+export declare function createRequiredBearerAuthorization(apiKey: string | undefined, configurationMessage?: string): HttpAuthorization;
+export declare function createHttpAuthorization(): HttpAuthorization;
+export declare function createAuthMiddleware(authorize?: HttpAuthorization): MiddlewareHandler;
 //# sourceMappingURL=auth.d.ts.map

package/dist/hono/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/hono/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAuB9C,wBAAgB,oBAAoB,IAAI,iBAAiB,CAiExD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/hono/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAuB9C,MAAM,MAAM,uBAAuB,GAC7B;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEtF,MAAM,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,uBAAuB,CAAC;AAExF,sFAAsF;AACtF,wBAAgB,iCAAiC,CAC7C,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,oBAAoB,SAAmC,GACxD,iBAAiB,CAuBnB;AAED,wBAAgB,uBAAuB,IAAI,iBAAiB,CAgB3D;AAED,wBAAgB,oBAAoB,CAChC,SAAS,GAAE,iBAA6C,GACzD,iBAAiB,CAanB"}

package/dist/hono/middleware/auth.js

@@ -1,51 +1,59 @@
 import { logger } from "@dexto/core";
 const PUBLIC_ROUTES = ["/health", "/.well-known/agent-card.json", "/openapi.json"];
-function createAuthMiddleware() {
+function createRequiredBearerAuthorization(apiKey, configurationMessage = "Server API key not configured.") {
+  return (header) => {
+    if (!apiKey) {
+      return {
+        allowed: false,
+        status: 500,
+        body: { error: "Configuration Error", message: configurationMessage }
+      };
+    }
+    const providedKey = header?.match(/^Bearer\s+(.+)$/i)?.[1];
+    if (!providedKey || providedKey !== apiKey) {
+      return {
+        allowed: false,
+        status: 401,
+        body: {
+          error: "Unauthorized",
+          message: "Invalid or missing API key. Provide Authorization: Bearer <api-key> header."
+        }
+      };
+    }
+    return { allowed: true };
+  };
+}
+function createHttpAuthorization() {
   const apiKey = process.env.DEXTO_SERVER_API_KEY;
   const isProduction = process.env.NODE_ENV === "production";
   const requireAuth = process.env.DEXTO_SERVER_REQUIRE_AUTH === "true";
+  if (!isProduction && !requireAuth) return () => ({ allowed: true });
   if (isProduction && !apiKey) {
     logger.warn(
-      `\u26A0\uFE0F  SECURITY WARNING: Running in production mode (NODE_ENV=production) without DEXTO_SERVER_API_KEY. Dexto Server API is UNPROTECTED. Set DEXTO_SERVER_API_KEY environment variable to secure your API.`
+      "Production HTTP authentication requires DEXTO_SERVER_API_KEY; protected requests will fail closed."
     );
   }
+  return createRequiredBearerAuthorization(
+    apiKey,
+    requireAuth ? "DEXTO_SERVER_REQUIRE_AUTH=true but DEXTO_SERVER_API_KEY not set. Set DEXTO_SERVER_API_KEY environment variable." : "NODE_ENV=production requires DEXTO_SERVER_API_KEY. Set DEXTO_SERVER_API_KEY environment variable to secure your API."
+  );
+}
+function createAuthMiddleware(authorize = createHttpAuthorization()) {
   return async (ctx, next) => {
     const path = ctx.req.path;
     if (PUBLIC_ROUTES.some((route) => path === route || path.startsWith(route))) {
       return next();
     }
-    if (!isProduction && !requireAuth) {
-      return next();
-    }
-    if (!apiKey) {
-      return ctx.json(
-        {
-          error: "Configuration Error",
-          message: requireAuth ? "DEXTO_SERVER_REQUIRE_AUTH=true but DEXTO_SERVER_API_KEY not set. Set DEXTO_SERVER_API_KEY environment variable." : "NODE_ENV=production requires DEXTO_SERVER_API_KEY. Set DEXTO_SERVER_API_KEY environment variable to secure your API."
-        },
-        500
-      );
-    }
-    const authHeader = ctx.req.header("Authorization");
-    const providedKey = authHeader?.replace(/^Bearer\s+/i, "");
-    if (!providedKey || providedKey !== apiKey) {
-      logger.warn("Unauthorized API access attempt", {
-        path,
-        hasKey: !!providedKey,
-        origin: ctx.req.header("origin"),
-        userAgent: ctx.req.header("user-agent")
-      });
-      return ctx.json(
-        {
-          error: "Unauthorized",
-          message: "Invalid or missing API key. Provide Authorization: Bearer <api-key> header."
-        },
-        401
-      );
+    const result = authorize(ctx.req.header("Authorization"));
+    if (!result.allowed) {
+      if (result.status === 401) logger.warn("Unauthorized API access attempt", { path });
+      return ctx.json(result.body, result.status);
     }
     await next();
   };
 }
 export {
-  createAuthMiddleware
+  createAuthMiddleware,
+  createHttpAuthorization,
+  createRequiredBearerAuthorization
 };

package/dist/hono/node/index.cjs

@@ -23,10 +23,12 @@ __export(node_exports, {
 module.exports = __toCommonJS(node_exports);
 var import_node_http = require("node:http");
 var import_node_stream = require("node:stream");
+var import_auth = require("../middleware/auth.js");
 var import_core = require("@dexto/core");
 function createNodeServer(app, options) {
   const { getAgent: _getAgent } = options;
   const webhookSubscriber = app.webhookSubscriber;
+  const authorize = app.httpAuthorization ?? (0, import_auth.createHttpAuthorization)();
   const server = (0, import_node_http.createServer)(async (req, res) => {
     const disconnectController = new AbortController();
     const abortOnDisconnect = () => {
@@ -35,7 +37,13 @@ function createNodeServer(app, options) {
     req.on("aborted", abortOnDisconnect);
     res.on("close", abortOnDisconnect);
     try {
-      if (options.mcpHandlers && req.url?.startsWith("/mcp")) {
+      if (options.mcpHandlers && req.method !== "OPTIONS" && new URL(req.url ?? "/", "http://localhost").pathname === "/mcp") {
+        const authorization = authorize(req.headers.authorization);
+        if (!authorization.allowed) {
+          res.writeHead(authorization.status, { "Content-Type": "application/json" });
+          res.end(JSON.stringify(authorization.body));
+          return;
+        }
         if (req.method === "GET") {
           await options.mcpHandlers.handleGet(req, res);
           return;
@@ -44,38 +52,41 @@ function createNodeServer(app, options) {
           req.setEncoding("utf8");
           let body = "";
           const MAX_BODY_SIZE = 10 * 1024 * 1024;
-          req.on("data", (chunk) => {
+          for await (const chunk of req) {
             body += chunk;
             if (body.length > MAX_BODY_SIZE) {
-              req.destroy();
               res.statusCode = 413;
               res.end("Payload too large");
+              return;
             }
-          });
-          req.on("end", async () => {
-            try {
-              const parsed = body.length > 0 ? JSON.parse(body) : void 0;
-              await options.mcpHandlers.handlePost(req, res, parsed);
-            } catch (err) {
-              import_core.logger.error(`Failed to process MCP POST body: ${String(err)}`);
-              res.statusCode = 400;
-              res.end("Invalid JSON body");
-            }
-          });
-          req.on("error", (err) => {
-            import_core.logger.error(`Error reading MCP POST body: ${String(err)}`);
-            res.statusCode = 500;
-            res.end("Failed to read request body");
-          });
+          }
+          let parsed;
+          try {
+            parsed = body.length > 0 ? JSON.parse(body) : void 0;
+          } catch {
+            import_core.logger.error("Invalid MCP POST JSON");
+            res.statusCode = 400;
+            res.end("Invalid JSON body");
+            return;
+          }
+          await options.mcpHandlers.handlePost(req, res, parsed);
           return;
         }
+        if (req.method === "DELETE" && options.mcpHandlers.handleDelete) {
+          await options.mcpHandlers.handleDelete(req, res);
+          return;
+        }
+        res.writeHead(405, {
+          Allow: options.mcpHandlers.handleDelete ? "GET, POST, DELETE" : "GET, POST"
+        });
+        res.end("Method not allowed");
+        return;
       }
       const request = await toRequest(req, disconnectController.signal);
       const response = await app.fetch(request);
       await sendNodeResponse(res, response, disconnectController.signal);
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      import_core.logger.error(`Unhandled error in Node bridge: ${message}`, { error });
+    } catch {
+      import_core.logger.error("Unhandled request error in Node bridge");
       res.statusCode = 500;
       res.end("Internal Server Error");
     } finally {

package/dist/hono/node/index.d.ts

@@ -9,6 +9,7 @@ export type NodeBridgeOptions = {
     mcpHandlers?: {
         handlePost: (req: IncomingMessage, res: ServerResponse, body: unknown) => Promise<void> | void;
         handleGet: (req: IncomingMessage, res: ServerResponse) => Promise<void> | void;
+        handleDelete?: (req: IncomingMessage, res: ServerResponse) => Promise<void> | void;
     } | null;
 };
 export type NodeBridgeResult = {

package/dist/hono/node/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/hono/node/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAGpF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAKjF,MAAM,MAAM,iBAAiB,GAAG;IAC5B,QAAQ,EAAE,MAAM,UAAU,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE;QACV,UAAU,EAAE,CACR,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,OAAO,KACZ,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAC1B,SAAS,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;KAClF,GAAG,IAAI,CAAC;CACZ,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC3B,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACxC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;CAC9C,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CAoF5F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/hono/node/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAIpF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAKjF,MAAM,MAAM,iBAAiB,GAAG;IAC5B,QAAQ,EAAE,MAAM,UAAU,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE;QACV,UAAU,EAAE,CACR,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,OAAO,KACZ,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAC1B,SAAS,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAC/E,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;KACtF,GAAG,IAAI,CAAC;CACZ,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC3B,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACxC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;CAC9C,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CAkG5F"}

package/dist/hono/node/index.js

@@ -1,9 +1,11 @@
 import { createServer } from "node:http";
 import { Readable } from "node:stream";
+import { createHttpAuthorization } from "../middleware/auth.js";
 import { logger } from "@dexto/core";
 function createNodeServer(app, options) {
   const { getAgent: _getAgent } = options;
   const webhookSubscriber = app.webhookSubscriber;
+  const authorize = app.httpAuthorization ?? createHttpAuthorization();
   const server = createServer(async (req, res) => {
     const disconnectController = new AbortController();
     const abortOnDisconnect = () => {
@@ -12,7 +14,13 @@ function createNodeServer(app, options) {
     req.on("aborted", abortOnDisconnect);
     res.on("close", abortOnDisconnect);
     try {
-      if (options.mcpHandlers && req.url?.startsWith("/mcp")) {
+      if (options.mcpHandlers && req.method !== "OPTIONS" && new URL(req.url ?? "/", "http://localhost").pathname === "/mcp") {
+        const authorization = authorize(req.headers.authorization);
+        if (!authorization.allowed) {
+          res.writeHead(authorization.status, { "Content-Type": "application/json" });
+          res.end(JSON.stringify(authorization.body));
+          return;
+        }
         if (req.method === "GET") {
           await options.mcpHandlers.handleGet(req, res);
           return;
@@ -21,38 +29,41 @@ function createNodeServer(app, options) {
           req.setEncoding("utf8");
           let body = "";
           const MAX_BODY_SIZE = 10 * 1024 * 1024;
-          req.on("data", (chunk) => {
+          for await (const chunk of req) {
             body += chunk;
             if (body.length > MAX_BODY_SIZE) {
-              req.destroy();
               res.statusCode = 413;
               res.end("Payload too large");
+              return;
             }
-          });
-          req.on("end", async () => {
-            try {
-              const parsed = body.length > 0 ? JSON.parse(body) : void 0;
-              await options.mcpHandlers.handlePost(req, res, parsed);
-            } catch (err) {
-              logger.error(`Failed to process MCP POST body: ${String(err)}`);
-              res.statusCode = 400;
-              res.end("Invalid JSON body");
-            }
-          });
-          req.on("error", (err) => {
-            logger.error(`Error reading MCP POST body: ${String(err)}`);
-            res.statusCode = 500;
-            res.end("Failed to read request body");
-          });
+          }
+          let parsed;
+          try {
+            parsed = body.length > 0 ? JSON.parse(body) : void 0;
+          } catch {
+            logger.error("Invalid MCP POST JSON");
+            res.statusCode = 400;
+            res.end("Invalid JSON body");
+            return;
+          }
+          await options.mcpHandlers.handlePost(req, res, parsed);
           return;
         }
+        if (req.method === "DELETE" && options.mcpHandlers.handleDelete) {
+          await options.mcpHandlers.handleDelete(req, res);
+          return;
+        }
+        res.writeHead(405, {
+          Allow: options.mcpHandlers.handleDelete ? "GET, POST, DELETE" : "GET, POST"
+        });
+        res.end("Method not allowed");
+        return;
       }
       const request = await toRequest(req, disconnectController.signal);
       const response = await app.fetch(request);
       await sendNodeResponse(res, response, disconnectController.signal);
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      logger.error(`Unhandled error in Node bridge: ${message}`, { error });
+    } catch {
+      logger.error("Unhandled request error in Node bridge");
       res.statusCode = 500;
       res.end("Internal Server Error");
     } finally {

package/dist/hono/routes/agents.d.ts

@@ -6168,7 +6168,7 @@ export declare function createAgentsRouter(getAgent: GetAgentFn, context: Agents
                 stack?: string | undefined;
             };
             outputFormat: "json";
-            status: 400;
+            status: 500;
         } | {
             input: {
                 json: {
@@ -6212,7 +6212,7 @@ export declare function createAgentsRouter(getAgent: GetAgentFn, context: Agents
                 stack?: string | undefined;
             };
             outputFormat: "json";
-            status: 500;
+            status: 400;
         } | {
             input: {
                 json: {
@@ -6363,7 +6363,7 @@ export declare function createAgentsRouter(getAgent: GetAgentFn, context: Agents
                 stack?: string | undefined;
             };
             outputFormat: "json";
-            status: 400;
+            status: 500;
         } | {
             input: {
                 json: {
@@ -6397,7 +6397,7 @@ export declare function createAgentsRouter(getAgent: GetAgentFn, context: Agents
                 stack?: string | undefined;
             };
             outputFormat: "json";
-            status: 500;
+            status: 400;
         } | {
             input: {
                 json: {
@@ -6517,7 +6517,7 @@ export declare function createAgentsRouter(getAgent: GetAgentFn, context: Agents
                 stack?: string | undefined;
             };
             outputFormat: "json";
-            status: 400;
+            status: 500;
         } | {
             input: {
                 json: {
@@ -6551,7 +6551,7 @@ export declare function createAgentsRouter(getAgent: GetAgentFn, context: Agents
                 stack?: string | undefined;
             };
             outputFormat: "json";
-            status: 500;
+            status: 400;
         } | {
             input: {
                 json: {
@@ -6671,7 +6671,7 @@ export declare function createAgentsRouter(getAgent: GetAgentFn, context: Agents
                 stack?: string | undefined;
             };
             outputFormat: "json";
-            status: 400;
+            status: 500;
         } | {
             input: {
                 json: {
@@ -6705,7 +6705,7 @@ export declare function createAgentsRouter(getAgent: GetAgentFn, context: Agents
                 stack?: string | undefined;
             };
             outputFormat: "json";
-            status: 500;
+            status: 400;
         } | {
             input: {
                 json: {
@@ -6828,7 +6828,7 @@ export declare function createAgentsRouter(getAgent: GetAgentFn, context: Agents
                 stack?: string | undefined;
             };
             outputFormat: "json";
-            status: 400;
+            status: 500;
         } | {
             input: {
                 json: {
@@ -6866,7 +6866,7 @@ export declare function createAgentsRouter(getAgent: GetAgentFn, context: Agents
                 stack?: string | undefined;
             };
             outputFormat: "json";
-            status: 500;
+            status: 400;
         } | {
             input: {
                 json: {
@@ -7258,7 +7258,7 @@ export declare function createAgentsRouter(getAgent: GetAgentFn, context: Agents
                 stack?: string | undefined;
             };
             outputFormat: "json";
-            status: 400;
+            status: 500;
         } | {
             input: {
                 json: {
@@ -7291,7 +7291,7 @@ export declare function createAgentsRouter(getAgent: GetAgentFn, context: Agents
                 stack?: string | undefined;
             };
             outputFormat: "json";
-            status: 500;
+            status: 400;
         } | {
             input: {
                 json: {
@@ -7418,7 +7418,7 @@ export declare function createAgentsRouter(getAgent: GetAgentFn, context: Agents
                 stack?: string | undefined;
             };
             outputFormat: "json";
-            status: 400;
+            status: 500;
         } | {
             input: {
                 json: {
@@ -7451,7 +7451,7 @@ export declare function createAgentsRouter(getAgent: GetAgentFn, context: Agents
                 stack?: string | undefined;
             };
             outputFormat: "json";
-            status: 500;
+            status: 400;
         } | {
             input: {
                 json: {

package/dist/hono/routes/greeting.d.ts

@@ -301,17 +301,6 @@ declare const greetingRoute: {
 export declare function createGreetingRouter(getAgent: GetAgentFn): OpenAPIHono<import("hono/types").Env, {
     "/greeting": {
         $get: {
-            input: {
-                query: {
-                    sessionId?: string | undefined;
-                };
-            };
-            output: {
-                greeting?: string | undefined;
-            };
-            outputFormat: "json";
-            status: 200;
-        } | {
             input: {
                 query: {
                     sessionId?: string | undefined;
@@ -343,7 +332,18 @@ export declare function createGreetingRouter(getAgent: GetAgentFn): OpenAPIHono<
                 stack?: string | undefined;
             };
             outputFormat: "json";
-            status: 400;
+            status: 500;
+        } | {
+            input: {
+                query: {
+                    sessionId?: string | undefined;
+                };
+            };
+            output: {
+                greeting?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 200;
         } | {
             input: {
                 query: {
@@ -376,7 +376,7 @@ export declare function createGreetingRouter(getAgent: GetAgentFn): OpenAPIHono<
                 stack?: string | undefined;
             };
             outputFormat: "json";
-            status: 500;
+            status: 400;
         };
     };
 }, "/">;