@eidentic/server 0.1.1 → 0.2.0

package/dist/index.cjs

@@ -2085,6 +2085,18 @@ function createServer2(opts) {
   });
   const trustProxy = opts.trustProxy ?? false;
   const getClientKey = opts.getClientKey ? opts.getClientKey : (c) => defaultGetClientKey(c, trustProxy);
+  const onAuditEvent = opts.onAuditEvent;
+  const emitAudit = (event) => {
+    if (!onAuditEvent) return;
+    try {
+      onAuditEvent(event);
+    } catch {
+    }
+  };
+  const unauthorized = (c) => {
+    emitAudit({ type: "auth.failure", at: Date.now(), route: c.req.path });
+    return c.json({ error: "Unauthorized" }, 401);
+  };
   let _draining = false;
   const app = new import_hono.Hono({ strict: true });
   const base = opts.basePath ?? "";
@@ -2113,6 +2125,7 @@ function createServer2(opts) {
         if (retryAfterSec !== void 0) {
           c.header("Retry-After", String(retryAfterSec));
         }
+        emitAudit({ type: "ratelimit.exceeded", at: Date.now(), principalId: clientKey, route: c.req.path });
         return c.json({ error: "rate_limited", retryAfterMs: rl.retryAfterMs }, 429);
       }
       await next();
@@ -2150,6 +2163,7 @@ function createServer2(opts) {
       streamQuotaKey = getQuotaKey(principal, agentId);
       const qc = await quota.check(streamQuotaKey);
       if (!qc.ok) {
+        emitAudit({ type: "quota.exceeded", at: Date.now(), scopeKey: streamQuotaKey, ...qc.reason !== void 0 ? { reason: qc.reason } : {} });
         return c.json({ error: "quota_exceeded", reason: qc.reason, usage: qc.usage }, 402);
       }
       if (qc.warn) c.header("X-Eidentic-Quota-Warning", "soft-limit");
@@ -2256,6 +2270,7 @@ function createServer2(opts) {
     if (!rl.ok) {
       const retryAfterSec = rl.retryAfterMs !== void 0 ? Math.ceil(rl.retryAfterMs / 1e3) : void 0;
       if (retryAfterSec !== void 0) c.header("Retry-After", String(retryAfterSec));
+      emitAudit({ type: "ratelimit.exceeded", at: Date.now(), principalId: rlKey, route: c.req.path });
       return c.json({ error: "rate_limited", retryAfterMs: rl.retryAfterMs }, 429);
     }
     return null;
@@ -2265,7 +2280,7 @@ function createServer2(opts) {
     (0, import_body_limit.bodyLimit)({ maxSize: BODY_LIMIT }),
     async (c) => {
       const principal = await runAuth(auth, c.req.raw);
-      if (principal === null) return c.json({ error: "Unauthorized" }, 401);
+      if (principal === null) return unauthorized(c);
       const agentId = c.req.param("agentId");
       const rlErr = await checkPostAuthRateLimit(c, principal, agentId);
       if (rlErr) return rlErr;
@@ -2318,7 +2333,7 @@ function createServer2(opts) {
     (0, import_body_limit.bodyLimit)({ maxSize: BODY_LIMIT }),
     async (c) => {
       const principal = await runAuth(auth, c.req.raw);
-      if (principal === null) return c.json({ error: "Unauthorized" }, 401);
+      if (principal === null) return unauthorized(c);
       const agentId = c.req.param("agentId");
       const rlErr = await checkPostAuthRateLimit(c, principal, agentId);
       if (rlErr) return rlErr;
@@ -2367,7 +2382,7 @@ function createServer2(opts) {
     (0, import_body_limit.bodyLimit)({ maxSize: BODY_LIMIT }),
     async (c) => {
       const principal = await runAuth(auth, c.req.raw);
-      if (principal === null) return c.json({ error: "Unauthorized" }, 401);
+      if (principal === null) return unauthorized(c);
       const agentId = c.req.param("agentId");
       const rlErr = await checkPostAuthRateLimit(c, principal, agentId);
       if (rlErr) return rlErr;
@@ -2416,6 +2431,7 @@ function createServer2(opts) {
         asyncQuotaKey = getQuotaKey(principal, agentId);
         const qc = await quota.check(asyncQuotaKey);
         if (!qc.ok) {
+          emitAudit({ type: "quota.exceeded", at: Date.now(), scopeKey: asyncQuotaKey, ...qc.reason !== void 0 ? { reason: qc.reason } : {} });
           return c.json({ error: "quota_exceeded", reason: qc.reason, usage: qc.usage }, 402);
         }
         asyncQuotaReservation = qc.reservation;
@@ -2507,7 +2523,7 @@ function createServer2(opts) {
   r.get("/v1/agents/:agentId/runs/:runId/status", async (c) => {
     const principal = await runAuth(auth, c.req.raw);
     if (principal === null) {
-      return c.json({ error: "Unauthorized" }, 401);
+      return unauthorized(c);
     }
     const agentId = c.req.param("agentId");
     const agent = resolve(agentId);
@@ -2538,7 +2554,7 @@ function createServer2(opts) {
     r.get("/v1/agents/:agentId/sessions/:sessionId/events", async (c) => {
       const principal = await runAuth(auth, c.req.raw);
       if (principal === null) {
-        return c.json({ error: "Unauthorized" }, 401);
+        return unauthorized(c);
       }
       const agentId = c.req.param("agentId");
       const agent = resolve(agentId);
@@ -2567,7 +2583,7 @@ function createServer2(opts) {
   r.get("/v1/workflows", async (c) => {
     const principal = await runAuth(auth, c.req.raw);
     if (principal === null) {
-      return c.json({ error: "Unauthorized" }, 401);
+      return unauthorized(c);
     }
     const summaries = workflowRuns.list().filter((rec) => checkWorkflowOwnership(rec, principal)).map((rec) => ({
       id: rec.id,
@@ -2582,7 +2598,7 @@ function createServer2(opts) {
   r.get("/v1/workflows/:id", async (c) => {
     const principal = await runAuth(auth, c.req.raw);
     if (principal === null) {
-      return c.json({ error: "Unauthorized" }, 401);
+      return unauthorized(c);
     }
     const id = c.req.param("id");
     const rec = workflowRuns.get(id);

package/dist/index.d.cts

@@ -2,7 +2,7 @@ import * as hono from 'hono';
 import { Hono } from 'hono';
 import { cors } from 'hono/cors';
 import { Agent } from '@eidentic/core';
-import { RateLimiterPort, RateLimitResult, QuotaPort, QuotaLimits, QuotaCheck, StreamEvent, LoggerPort, Usage, CostBreakdown, AuthPrincipal, AuthPort } from '@eidentic/types';
+import { RateLimiterPort, RateLimitResult, QuotaPort, QuotaLimits, QuotaCheck, StreamEvent, LoggerPort, Usage, CostBreakdown, AuthPrincipal, AuthPort, AuditSink } from '@eidentic/types';
 export { AuthPort, AuthPrincipal, AuthRequest, QuotaCheck, QuotaLimits, QuotaPort, QuotaUsage, RateLimiterPort } from '@eidentic/types';
 import { WorkflowResult, WorkflowRunOwner, RecordOptions, WorkflowRunError, WorkflowRunRegistry, StepTrace } from '@eidentic/workflow';
 export { RecordOptions, WorkflowRunError, WorkflowRunOwner, WorkflowRunRegistry } from '@eidentic/workflow';
@@ -868,6 +868,14 @@ interface ServerOptions {
      * `principal.apiKey ?? principal.userId ?? principal.orgId ?? "anonymous"`.
      */
     quotaKey?: (principal: AuthPrincipal, agentId: string) => string;
+    /**
+     * Best-effort audit sink (§10.4/§15). When set, the server emits structured `AuditEvent`s for
+     * security-relevant rejections at the HTTP edge: `auth.failure` (401), `quota.exceeded` (402),
+     * and `ratelimit.exceeded` (429, both pre-auth and post-auth). This is the same `AuditEvent`
+     * stream `Agent` emits (`tool.call` / `permission.denied` / `erasure`) — wire the same sink to
+     * both for one unified audit log. A throwing sink is swallowed, never affecting a request.
+     */
+    onAuditEvent?: AuditSink;
     /**
      * Maximum number of characters allowed in the `input` field of /query and /runs
      * requests, and in a string `decision` on /resume requests.

package/dist/index.d.ts

@@ -2,7 +2,7 @@ import * as hono from 'hono';
 import { Hono } from 'hono';
 import { cors } from 'hono/cors';
 import { Agent } from '@eidentic/core';
-import { RateLimiterPort, RateLimitResult, QuotaPort, QuotaLimits, QuotaCheck, StreamEvent, LoggerPort, Usage, CostBreakdown, AuthPrincipal, AuthPort } from '@eidentic/types';
+import { RateLimiterPort, RateLimitResult, QuotaPort, QuotaLimits, QuotaCheck, StreamEvent, LoggerPort, Usage, CostBreakdown, AuthPrincipal, AuthPort, AuditSink } from '@eidentic/types';
 export { AuthPort, AuthPrincipal, AuthRequest, QuotaCheck, QuotaLimits, QuotaPort, QuotaUsage, RateLimiterPort } from '@eidentic/types';
 import { WorkflowResult, WorkflowRunOwner, RecordOptions, WorkflowRunError, WorkflowRunRegistry, StepTrace } from '@eidentic/workflow';
 export { RecordOptions, WorkflowRunError, WorkflowRunOwner, WorkflowRunRegistry } from '@eidentic/workflow';
@@ -868,6 +868,14 @@ interface ServerOptions {
      * `principal.apiKey ?? principal.userId ?? principal.orgId ?? "anonymous"`.
      */
     quotaKey?: (principal: AuthPrincipal, agentId: string) => string;
+    /**
+     * Best-effort audit sink (§10.4/§15). When set, the server emits structured `AuditEvent`s for
+     * security-relevant rejections at the HTTP edge: `auth.failure` (401), `quota.exceeded` (402),
+     * and `ratelimit.exceeded` (429, both pre-auth and post-auth). This is the same `AuditEvent`
+     * stream `Agent` emits (`tool.call` / `permission.denied` / `erasure`) — wire the same sink to
+     * both for one unified audit log. A throwing sink is swallowed, never affecting a request.
+     */
+    onAuditEvent?: AuditSink;
     /**
      * Maximum number of characters allowed in the `input` field of /query and /runs
      * requests, and in a string `decision` on /resume requests.

package/dist/index.js

@@ -1007,6 +1007,18 @@ function createServer(opts) {
   });
   const trustProxy = opts.trustProxy ?? false;
   const getClientKey = opts.getClientKey ? opts.getClientKey : (c) => defaultGetClientKey(c, trustProxy);
+  const onAuditEvent = opts.onAuditEvent;
+  const emitAudit = (event) => {
+    if (!onAuditEvent) return;
+    try {
+      onAuditEvent(event);
+    } catch {
+    }
+  };
+  const unauthorized = (c) => {
+    emitAudit({ type: "auth.failure", at: Date.now(), route: c.req.path });
+    return c.json({ error: "Unauthorized" }, 401);
+  };
   let _draining = false;
   const app = new Hono({ strict: true });
   const base = opts.basePath ?? "";
@@ -1035,6 +1047,7 @@ function createServer(opts) {
         if (retryAfterSec !== void 0) {
           c.header("Retry-After", String(retryAfterSec));
         }
+        emitAudit({ type: "ratelimit.exceeded", at: Date.now(), principalId: clientKey, route: c.req.path });
         return c.json({ error: "rate_limited", retryAfterMs: rl.retryAfterMs }, 429);
       }
       await next();
@@ -1072,6 +1085,7 @@ function createServer(opts) {
       streamQuotaKey = getQuotaKey(principal, agentId);
       const qc = await quota.check(streamQuotaKey);
       if (!qc.ok) {
+        emitAudit({ type: "quota.exceeded", at: Date.now(), scopeKey: streamQuotaKey, ...qc.reason !== void 0 ? { reason: qc.reason } : {} });
         return c.json({ error: "quota_exceeded", reason: qc.reason, usage: qc.usage }, 402);
       }
       if (qc.warn) c.header("X-Eidentic-Quota-Warning", "soft-limit");
@@ -1178,6 +1192,7 @@ function createServer(opts) {
     if (!rl.ok) {
       const retryAfterSec = rl.retryAfterMs !== void 0 ? Math.ceil(rl.retryAfterMs / 1e3) : void 0;
       if (retryAfterSec !== void 0) c.header("Retry-After", String(retryAfterSec));
+      emitAudit({ type: "ratelimit.exceeded", at: Date.now(), principalId: rlKey, route: c.req.path });
       return c.json({ error: "rate_limited", retryAfterMs: rl.retryAfterMs }, 429);
     }
     return null;
@@ -1187,7 +1202,7 @@ function createServer(opts) {
     bodyLimit({ maxSize: BODY_LIMIT }),
     async (c) => {
       const principal = await runAuth(auth, c.req.raw);
-      if (principal === null) return c.json({ error: "Unauthorized" }, 401);
+      if (principal === null) return unauthorized(c);
       const agentId = c.req.param("agentId");
       const rlErr = await checkPostAuthRateLimit(c, principal, agentId);
       if (rlErr) return rlErr;
@@ -1240,7 +1255,7 @@ function createServer(opts) {
     bodyLimit({ maxSize: BODY_LIMIT }),
     async (c) => {
       const principal = await runAuth(auth, c.req.raw);
-      if (principal === null) return c.json({ error: "Unauthorized" }, 401);
+      if (principal === null) return unauthorized(c);
       const agentId = c.req.param("agentId");
       const rlErr = await checkPostAuthRateLimit(c, principal, agentId);
       if (rlErr) return rlErr;
@@ -1289,7 +1304,7 @@ function createServer(opts) {
     bodyLimit({ maxSize: BODY_LIMIT }),
     async (c) => {
       const principal = await runAuth(auth, c.req.raw);
-      if (principal === null) return c.json({ error: "Unauthorized" }, 401);
+      if (principal === null) return unauthorized(c);
       const agentId = c.req.param("agentId");
       const rlErr = await checkPostAuthRateLimit(c, principal, agentId);
       if (rlErr) return rlErr;
@@ -1338,6 +1353,7 @@ function createServer(opts) {
         asyncQuotaKey = getQuotaKey(principal, agentId);
         const qc = await quota.check(asyncQuotaKey);
         if (!qc.ok) {
+          emitAudit({ type: "quota.exceeded", at: Date.now(), scopeKey: asyncQuotaKey, ...qc.reason !== void 0 ? { reason: qc.reason } : {} });
           return c.json({ error: "quota_exceeded", reason: qc.reason, usage: qc.usage }, 402);
         }
         asyncQuotaReservation = qc.reservation;
@@ -1429,7 +1445,7 @@ function createServer(opts) {
   r.get("/v1/agents/:agentId/runs/:runId/status", async (c) => {
     const principal = await runAuth(auth, c.req.raw);
     if (principal === null) {
-      return c.json({ error: "Unauthorized" }, 401);
+      return unauthorized(c);
     }
     const agentId = c.req.param("agentId");
     const agent = resolve(agentId);
@@ -1460,7 +1476,7 @@ function createServer(opts) {
     r.get("/v1/agents/:agentId/sessions/:sessionId/events", async (c) => {
       const principal = await runAuth(auth, c.req.raw);
       if (principal === null) {
-        return c.json({ error: "Unauthorized" }, 401);
+        return unauthorized(c);
       }
       const agentId = c.req.param("agentId");
       const agent = resolve(agentId);
@@ -1489,7 +1505,7 @@ function createServer(opts) {
   r.get("/v1/workflows", async (c) => {
     const principal = await runAuth(auth, c.req.raw);
     if (principal === null) {
-      return c.json({ error: "Unauthorized" }, 401);
+      return unauthorized(c);
     }
     const summaries = workflowRuns.list().filter((rec) => checkWorkflowOwnership(rec, principal)).map((rec) => ({
       id: rec.id,
@@ -1504,7 +1520,7 @@ function createServer(opts) {
   r.get("/v1/workflows/:id", async (c) => {
     const principal = await runAuth(auth, c.req.raw);
     if (principal === null) {
-      return c.json({ error: "Unauthorized" }, 401);
+      return unauthorized(c);
     }
     const id = c.req.param("id");
     const rec = workflowRuns.get(id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eidentic/server",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "type": "module",
   "license": "Apache-2.0",
   "publishConfig": {
@@ -31,9 +31,9 @@
     "ai": "^6.0.0",
     "cron-parser": "^5.5.0",
     "hono": "^4.12.0",
-    "@eidentic/core": "0.1.1",
-    "@eidentic/types": "0.1.1",
-    "@eidentic/workflow": "0.1.1"
+    "@eidentic/workflow": "0.1.2",
+    "@eidentic/core": "0.2.0",
+    "@eidentic/types": "0.2.0"
   },
   "optionalDependencies": {
     "@hono/node-server": "^2.0.0"