@enkaku/server 0.12.2 → 0.13.0

package/lib/access-control.d.ts

@@ -1,5 +1,12 @@
 import type { SignedToken } from '@enkaku/token';
-export type ProcedureAccessRecord = Record<string, boolean | Array<string>>;
+export type EncryptionPolicy = 'required' | 'optional' | 'none';
+export type ProcedureAccessConfig = {
+    allow?: boolean | Array<string>;
+    encryption?: EncryptionPolicy;
+};
+export type ProcedureAccessValue = boolean | Array<string> | ProcedureAccessConfig;
+export type ProcedureAccessRecord = Record<string, ProcedureAccessValue>;
+export declare function resolveEncryptionPolicy(procedure: string, record: ProcedureAccessRecord | undefined, globalPolicy: EncryptionPolicy): EncryptionPolicy;
 export type ProcedureAccessPayload = {
     iss: string;
     sub?: string;

package/lib/access-control.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-control.d.ts","sourceRoot":"","sources":["../src/access-control.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAEhD,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;AAE3E,MAAM,MAAM,sBAAsB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,WAAW,CAAC,sBAAsB,CAAC,EAC1C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAiCf;AAED,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CA4Bf"}
+{"version":3,"file":"access-control.d.ts","sourceRoot":"","sources":["../src/access-control.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAEhD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,CAAA;AAE/D,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IAC/B,UAAU,CAAC,EAAE,gBAAgB,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,qBAAqB,CAAA;AAElF,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;AAgBxE,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,qBAAqB,GAAG,SAAS,EACzC,YAAY,EAAE,gBAAgB,GAC7B,gBAAgB,CAYlB;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,WAAW,CAAC,sBAAsB,CAAC,EAC1C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAkCf;AAED,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CA4Bf"}

package/lib/access-control.js

@@ -1,23 +1,49 @@
 import { assertNonExpired, checkCapability, hasPartsMatch } from '@enkaku/capability';
+function getAllowValue(access) {
+    if (typeof access === 'boolean' || Array.isArray(access)) {
+        return access;
+    }
+    return access.allow ?? false;
+}
+function getEncryptionPolicy(access) {
+    if (typeof access === 'boolean' || Array.isArray(access)) {
+        return undefined;
+    }
+    return access.encryption;
+}
+export function resolveEncryptionPolicy(procedure, record, globalPolicy) {
+    if (record != null) {
+        for (const [pattern, accessValue] of Object.entries(record)){
+            if (hasPartsMatch(procedure, pattern)) {
+                const procedurePolicy = getEncryptionPolicy(accessValue);
+                if (procedurePolicy != null) {
+                    return procedurePolicy;
+                }
+            }
+        }
+    }
+    return globalPolicy;
+}
 export async function checkProcedureAccess(serverID, record, token, atTime) {
     const payload = token.payload;
     if (payload.prc == null) {
         throw new Error('No procedure to check');
     }
-    for (const [procedure, access] of Object.entries(record)){
+    for (const [procedure, accessValue] of Object.entries(record)){
         if (hasPartsMatch(payload.prc, procedure)) {
-            if (access === true) {
+            const allow = getAllowValue(accessValue);
+            if (allow === true) {
                 // Procedure can be publicly accessed
                 return;
             }
-            if (access === false) {
+            if (allow === false) {
                 continue;
             }
-            if (access.includes(payload.iss)) {
+            if (allow.includes(payload.iss)) {
                 // Issuer is allowed directly
                 return;
             }
-            if (payload.sub == null || !access.includes(payload.sub)) {
+            if (payload.sub == null || !allow.includes(payload.sub)) {
                 continue;
             }
             try {

package/lib/error.d.ts

@@ -1,4 +1,14 @@
 import type { ErrorReplyPayload } from '@enkaku/protocol';
+/**
+ * Error codes:
+ * - EK01: Handler execution failed
+ * - EK02: Access denied (authorization failure)
+ * - EK03: Server controller limit reached
+ * - EK04: Server handler concurrency limit reached
+ * - EK05: Request timeout (controller expired)
+ * - EK06: Message exceeds maximum size
+ * - EK07: Encryption required but message is not encrypted
+ */
 export type HandlerErrorParams<Code extends string = string, Data extends Record<string, unknown> = Record<string, unknown>> = {
     cause?: unknown;
     code: Code;

package/lib/error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../src/error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,MAAM,MAAM,kBAAkB,CAC5B,IAAI,SAAS,MAAM,GAAG,MAAM,EAC5B,IAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAC5D;IACF,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,IAAI,EAAE,IAAI,CAAA;IACV,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,qBAAa,YAAY,CACvB,IAAI,SAAS,MAAM,EACnB,IAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAC9D,SAAQ,KAAK;;IACb,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,MAAM,EAAE,IAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7F,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,GACrC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC;gBAWf,MAAM,EAAE,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC;IAOlD,IAAI,IAAI,IAAI,IAAI,CAEf;IAED,IAAI,IAAI,IAAI,IAAI,CAEf;IAED,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC;CAStD"}
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../src/error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEzD;;;;;;;;;GASG;AAEH,MAAM,MAAM,kBAAkB,CAC5B,IAAI,SAAS,MAAM,GAAG,MAAM,EAC5B,IAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAC5D;IACF,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,IAAI,EAAE,IAAI,CAAA;IACV,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,qBAAa,YAAY,CACvB,IAAI,SAAS,MAAM,EACnB,IAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAC9D,SAAQ,KAAK;;IACb,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,MAAM,EAAE,IAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7F,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,GACrC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC;gBAWf,MAAM,EAAE,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC;IAOlD,IAAI,IAAI,IAAI,IAAI,CAEf;IAED,IAAI,IAAI,IAAI,IAAI,CAEf;IAED,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC;CAStD"}

package/lib/handlers/channel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"channel.d.ts","sourceRoot":"","sources":["../../src/handlers/channel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,KAAK,EAGV,cAAc,EAGf,MAAM,aAAa,CAAA;AAGpB,MAAM,MAAM,gBAAgB,CAC1B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,QAAQ,GAAG,MAAM,IACjE,aAAa,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;AAEnE,wBAAgB,aAAa,CAC3B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,EAEzC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAC7B,GAAG,EAAE,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,GACzC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CA4CvB"}
+{"version":3,"file":"channel.d.ts","sourceRoot":"","sources":["../../src/handlers/channel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,KAAK,EAGV,cAAc,EAGf,MAAM,aAAa,CAAA;AAGpB,MAAM,MAAM,gBAAgB,CAC1B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,QAAQ,GAAG,MAAM,IACjE,aAAa,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;AAEnE,wBAAgB,aAAa,CAC3B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,EAEzC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAC7B,GAAG,EAAE,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,GACzC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAsEvB"}

package/lib/handlers/channel.js

@@ -1,4 +1,4 @@
-import { createPipe, writeTo } from '@enkaku/stream';
+import { createPipe, tap, writeTo } from '@enkaku/stream';
 import { executeHandler } from '../utils.js';
 export function handleChannel(ctx, msg) {
     const handler = ctx.handlers[msg.payload.prc];
@@ -22,19 +22,41 @@ export function handleChannel(ctx, msg) {
         if (controller.signal.aborted) {
             return;
         }
+        ctx.logger.trace('send value to channel {procedure} with ID {rid}', {
+            procedure: msg.payload.prc,
+            rid: msg.payload.rid
+        });
         await ctx.send({
             typ: 'receive',
             rid: msg.payload.rid,
             val
         });
     }));
+    const readable = sendStream.readable.pipeThrough(tap((value)=>{
+        ctx.logger.trace('received value from channel {procedure} with ID {rid}', {
+            procedure: msg.payload.prc,
+            rid: msg.payload.rid,
+            value
+        });
+    }));
     const handlerContext = {
         message: msg,
         param: msg.payload.prm,
-        readable: sendStream.readable,
+        readable,
         signal: controller.signal,
         writable: receiveStream.writable
     };
-    // @ts-expect-error context and handler types
-    return executeHandler(ctx, msg.payload, ()=>handler(handlerContext));
+    // Wrap execution to ensure stream cleanup on handler crash
+    return (async ()=>{
+        try {
+            // @ts-expect-error context and handler types
+            await executeHandler(ctx, msg.payload, ()=>handler(handlerContext));
+        } finally{
+            try {
+                await receiveStream.writable.close();
+            } catch  {
+            // Stream may already be closed
+            }
+        }
+    })();
 }

package/lib/handlers/event.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"event.d.ts","sourceRoot":"","sources":["../../src/handlers/event.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAEzF,OAAO,KAAK,EAAqC,cAAc,EAAE,MAAM,aAAa,CAAA;AAEpF,MAAM,MAAM,cAAc,CACxB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,QAAQ,GAAG,MAAM,IACjE,aAAa,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;AAEjE,wBAAgB,WAAW,CACzB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,EACzC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBhG"}
+{"version":3,"file":"event.d.ts","sourceRoot":"","sources":["../../src/handlers/event.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAGzF,OAAO,KAAK,EAAqC,cAAc,EAAE,MAAM,aAAa,CAAA;AAEpF,MAAM,MAAM,cAAc,CACxB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,QAAQ,GAAG,MAAM,IACjE,aAAa,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;AAEjE,wBAAgB,WAAW,CACzB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,EACzC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BhG"}

package/lib/handlers/event.js

@@ -1,21 +1,30 @@
 import { toPromise } from '@enkaku/async';
+import { HandlerError } from '../error.js';
 export function handleEvent(ctx, msg) {
     const handler = ctx.handlers[msg.payload.prc];
     if (handler == null) {
         return new Error(`No handler for procedure: ${msg.payload.prc}`);
     }
     ctx.logger.trace('handle event {procedure}', {
-        procedure: msg.payload.prc
+        procedure: msg.payload.prc,
+        data: msg.payload.data
     });
     const handlerContext = {
         message: msg,
         data: msg.payload.data
     };
     return toPromise(()=>handler(handlerContext)).catch((cause)=>{
+        const error = HandlerError.from(cause, {
+            code: 'EK01',
+            message: cause.message ?? 'Handler execution failed'
+        });
+        ctx.logger.debug('handler error for event {procedure}', {
+            procedure: msg.payload.prc,
+            data: msg.payload.data,
+            error
+        });
         ctx.events.emit('handlerError', {
-            error: new Error(`Error handling procedure: ${msg.payload.prc}`, {
-                cause
-            }),
+            error,
             payload: msg.payload
         });
     });

package/lib/handlers/request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/handlers/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAE3F,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,aAAa,CAAA;AAGjE,MAAM,MAAM,gBAAgB,CAC1B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,QAAQ,GAAG,MAAM,IACjE,aAAa,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;AAEnE,wBAAgB,aAAa,CAC3B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,EAEzC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAC7B,GAAG,EAAE,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,GACzC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBvB"}
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/handlers/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAE3F,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,aAAa,CAAA;AAGjE,MAAM,MAAM,gBAAgB,CAC1B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,QAAQ,GAAG,MAAM,IACjE,aAAa,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;AAEnE,wBAAgB,aAAa,CAC3B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,EAEzC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAC7B,GAAG,EAAE,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,GACzC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBvB"}

package/lib/handlers/request.js

@@ -6,7 +6,8 @@ export function handleRequest(ctx, msg) {
     }
     ctx.logger.trace('handle request {procedure} with ID {rid}', {
         procedure: msg.payload.prc,
-        rid: msg.payload.rid
+        rid: msg.payload.rid,
+        param: msg.payload.prm
     });
     const controller = new AbortController();
     ctx.controllers[msg.payload.rid] = controller;

package/lib/handlers/stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/handlers/stream.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,aAAa,EACb,kBAAkB,EAClB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,KAAK,EAAE,cAAc,EAA8B,MAAM,aAAa,CAAA;AAG7E,MAAM,MAAM,eAAe,CACzB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,QAAQ,GAAG,MAAM,IACjE,aAAa,CAAC,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;AAElE,wBAAgB,YAAY,CAC1B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,EACzC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCjG"}
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/handlers/stream.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,aAAa,EACb,kBAAkB,EAClB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,KAAK,EAAE,cAAc,EAA8B,MAAM,aAAa,CAAA;AAG7E,MAAM,MAAM,eAAe,CACzB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,QAAQ,GAAG,MAAM,IACjE,aAAa,CAAC,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;AAElE,wBAAgB,YAAY,CAC1B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,EACzC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAoDjG"}

package/lib/handlers/stream.js

@@ -16,6 +16,10 @@ export function handleStream(ctx, msg) {
         if (controller.signal.aborted) {
             return;
         }
+        ctx.logger.trace('send value to stream {procedure} with ID {rid}', {
+            procedure: msg.payload.prc,
+            rid: msg.payload.rid
+        });
         await ctx.send({
             typ: 'receive',
             rid: msg.payload.rid,
@@ -28,6 +32,17 @@ export function handleStream(ctx, msg) {
         signal: controller.signal,
         writable: receiveStream.writable
     };
-    // @ts-expect-error context and handler types
-    return executeHandler(ctx, msg.payload, ()=>handler(handlerContext));
+    // Wrap execution to ensure stream cleanup on handler crash
+    return (async ()=>{
+        try {
+            // @ts-expect-error context and handler types
+            await executeHandler(ctx, msg.payload, ()=>handler(handlerContext));
+        } finally{
+            try {
+                await receiveStream.writable.close();
+            } catch  {
+            // Stream may already be closed
+            }
+        }
+    })();
 }

package/lib/index.d.ts

@@ -9,7 +9,9 @@
  *
  * @module server
  */
-export type { ProcedureAccessRecord } from './access-control.js';
+export type { EncryptionPolicy, ProcedureAccessConfig, ProcedureAccessRecord, ProcedureAccessValue, } from './access-control.js';
+export { resolveEncryptionPolicy } from './access-control.js';
+export { createResourceLimiter, DEFAULT_RESOURCE_LIMITS, type ResourceLimiter, type ResourceLimits, } from './limits.js';
 export { type ServeParams, Server, type ServerParams, serve } from './server.js';
 export type { ChannelHandler, ChannelHandlerContext, EventHandler, EventHandlerContext, HandlerReturn, ProcedureHandlers, RequestHandler, RequestHandlerContext, ServerEmitter, ServerEvents, StreamHandler, StreamHandlerContext, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAChF,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,oBAAoB,GACrB,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,YAAY,EACV,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAChF,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,oBAAoB,GACrB,MAAM,YAAY,CAAA"}

package/lib/index.js

@@ -8,4 +8,6 @@
  * ```
  *
  * @module server
- */ export { Server, serve } from './server.js';
+ */ export { resolveEncryptionPolicy } from './access-control.js';
+export { createResourceLimiter, DEFAULT_RESOURCE_LIMITS } from './limits.js';
+export { Server, serve } from './server.js';

package/lib/limits.d.ts

@@ -0,0 +1,26 @@
+export type ResourceLimits = {
+    /** Maximum number of concurrent controllers (in-flight requests). Default: 10000 */
+    maxControllers: number;
+    /** Maximum number of concurrent handler executions. Default: 100 */
+    maxConcurrentHandlers: number;
+    /** Controller timeout in milliseconds. Default: 300000 (5 min) */
+    controllerTimeoutMs: number;
+    /** Cleanup timeout in milliseconds when disposing. Default: 30000 (30 sec) */
+    cleanupTimeoutMs: number;
+    /** Maximum size in bytes for any individual message payload. Default: 10485760 (10 MB) */
+    maxMessageSize: number;
+};
+export declare const DEFAULT_RESOURCE_LIMITS: ResourceLimits;
+export type ResourceLimiter = {
+    limits: ResourceLimits;
+    controllerCount: number;
+    activeHandlers: number;
+    canAddController: () => boolean;
+    addController: (rid: string) => void;
+    removeController: (rid: string) => void;
+    getExpiredControllers: () => Array<string>;
+    acquireHandler: () => boolean;
+    releaseHandler: () => void;
+};
+export declare function createResourceLimiter(options?: Partial<ResourceLimits>): ResourceLimiter;
+//# sourceMappingURL=limits.d.ts.map

package/lib/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG;IAC3B,oFAAoF;IACpF,cAAc,EAAE,MAAM,CAAA;IACtB,oEAAoE;IACpE,qBAAqB,EAAE,MAAM,CAAA;IAC7B,kEAAkE;IAClE,mBAAmB,EAAE,MAAM,CAAA;IAC3B,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,CAAA;IACxB,0FAA0F;IAC1F,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,eAAO,MAAM,uBAAuB,EAAE,cAMrC,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,cAAc,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;IACtB,gBAAgB,EAAE,MAAM,OAAO,CAAA;IAC/B,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IACpC,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IACvC,qBAAqB,EAAE,MAAM,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1C,cAAc,EAAE,MAAM,OAAO,CAAA;IAC7B,cAAc,EAAE,MAAM,IAAI,CAAA;CAC3B,CAAA;AAED,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,eAAe,CAiDxF"}

package/lib/limits.js

@@ -0,0 +1,56 @@
+export const DEFAULT_RESOURCE_LIMITS = {
+    maxControllers: 10000,
+    maxConcurrentHandlers: 100,
+    controllerTimeoutMs: 300000,
+    cleanupTimeoutMs: 30000,
+    maxMessageSize: 10485760
+};
+export function createResourceLimiter(options) {
+    const limits = {
+        ...DEFAULT_RESOURCE_LIMITS,
+        ...options
+    };
+    const controllers = new Map() // rid -> timestamp
+    ;
+    let handlerCount = 0;
+    return {
+        limits,
+        get controllerCount () {
+            return controllers.size;
+        },
+        get activeHandlers () {
+            return handlerCount;
+        },
+        canAddController () {
+            return controllers.size < limits.maxControllers;
+        },
+        addController (rid) {
+            controllers.set(rid, Date.now());
+        },
+        removeController (rid) {
+            controllers.delete(rid);
+        },
+        getExpiredControllers () {
+            const now = Date.now();
+            const expired = [];
+            for (const [rid, timestamp] of controllers){
+                if (now - timestamp > limits.controllerTimeoutMs) {
+                    expired.push(rid);
+                }
+            }
+            return expired;
+        },
+        acquireHandler () {
+            if (handlerCount >= limits.maxConcurrentHandlers) {
+                return false;
+            }
+            handlerCount++;
+            return true;
+        },
+        releaseHandler () {
+            if (handlerCount > 0) {
+                handlerCount--;
+            }
+        }
+    };
+}

package/lib/server.d.ts

@@ -2,9 +2,11 @@ import { Disposer } from '@enkaku/async';
 import { type Logger } from '@enkaku/log';
 import { type AnyClientMessageOf, type ProtocolDefinition, type ServerTransportOf } from '@enkaku/protocol';
 import { type Validator } from '@enkaku/schema';
-import { type ProcedureAccessRecord } from './access-control.js';
+import { type Identity } from '@enkaku/token';
+import { type EncryptionPolicy, type ProcedureAccessRecord } from './access-control.js';
+import { type ResourceLimiter, type ResourceLimits } from './limits.js';
 import type { ProcedureHandlers, ServerEmitter } from './types.js';
-export type AccessControlParams = {
+export type AccessControlParams = ({
     public: true;
     serverID?: string;
     access?: ProcedureAccessRecord;
@@ -12,10 +14,13 @@ export type AccessControlParams = {
     public: false;
     serverID: string;
     access: ProcedureAccessRecord;
+}) & {
+    encryptionPolicy?: EncryptionPolicy;
 };
 export type HandleMessagesParams<Protocol extends ProtocolDefinition> = AccessControlParams & {
     events: ServerEmitter;
     handlers: ProcedureHandlers<Protocol>;
+    limiter: ResourceLimiter;
     logger: Logger;
     signal: AbortSignal;
     transport: ServerTransportOf<Protocol>;
@@ -23,8 +28,10 @@ export type HandleMessagesParams<Protocol extends ProtocolDefinition> = AccessCo
 };
 export type ServerParams<Protocol extends ProtocolDefinition> = {
     access?: ProcedureAccessRecord;
+    encryptionPolicy?: EncryptionPolicy;
     handlers: ProcedureHandlers<Protocol>;
-    id?: string;
+    identity?: Identity;
+    limits?: Partial<ResourceLimits>;
     logger?: Logger;
     protocol?: Protocol;
     public?: boolean;

package/lib/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE7D,OAAO,EAAmB,KAAK,MAAM,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EACL,KAAK,kBAAkB,EAGvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EAAoB,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAKlF,OAAO,KAAK,EAIV,iBAAiB,EACjB,aAAa,EAEd,MAAM,YAAY,CAAA;AAQnB,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,qBAAqB,CAAA;CAAE,GACnE;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,CAAA;AAEtE,MAAM,MAAM,oBAAoB,CAAC,QAAQ,SAAS,kBAAkB,IAAI,mBAAmB,GAAG;IAC5F,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,WAAW,CAAA;IACnB,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACtC,SAAS,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAA;CACpD,CAAA;AA2JD,MAAM,MAAM,YAAY,CAAC,QAAQ,SAAS,kBAAkB,IAAI;IAC9D,MAAM,CAAC,EAAE,qBAAqB,CAAA;IAC9B,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACrC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,UAAU,CAAC,EAAE,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAA;CAChD,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAEjG,qBAAa,MAAM,CAAC,QAAQ,SAAS,kBAAkB,CAAE,SAAQ,QAAQ;;gBAS3D,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC;IAgD1C,IAAI,MAAM,IAAI,aAAa,CAE1B;IAED,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;CAiC3F;AAED,MAAM,MAAM,WAAW,CAAC,QAAQ,SAAS,kBAAkB,IAAI,IAAI,CACjE,YAAY,CAAC,QAAQ,CAAC,EACtB,YAAY,CACb,GAAG;IACF,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;CACvC,CAAA;AAED,wBAAgB,KAAK,CAAC,QAAQ,SAAS,kBAAkB,EACvD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,GAC5B,MAAM,CAAC,QAAQ,CAAC,CAGlB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE7D,OAAO,EAAmB,KAAK,MAAM,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EACL,KAAK,kBAAkB,EAGvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAEL,KAAK,QAAQ,EAId,MAAM,eAAe,CAAA;AAEtB,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAE3B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EAAyB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AAC9F,OAAO,KAAK,EAIV,iBAAiB,EACjB,aAAa,EAEd,MAAM,YAAY,CAAA;AAQnB,MAAM,MAAM,mBAAmB,GAAG,CAC9B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,qBAAqB,CAAA;CAAE,GACnE;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,CACrE,GAAG;IAAE,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAA;AAE3C,MAAM,MAAM,oBAAoB,CAAC,QAAQ,SAAS,kBAAkB,IAAI,mBAAmB,GAAG;IAC5F,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACrC,OAAO,EAAE,eAAe,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,WAAW,CAAA;IACnB,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACtC,SAAS,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAA;CACpD,CAAA;AA6SD,MAAM,MAAM,YAAY,CAAC,QAAQ,SAAS,kBAAkB,IAAI;IAC9D,MAAM,CAAC,EAAE,qBAAqB,CAAA;IAC9B,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACrC,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IAChC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,UAAU,CAAC,EAAE,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAA;CAChD,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAEjG,qBAAa,MAAM,CAAC,QAAQ,SAAS,kBAAkB,CAAE,SAAQ,QAAQ;;gBAU3D,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC;IAgF1C,IAAI,MAAM,IAAI,aAAa,CAE1B;IAED,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;CAoC3F;AAED,MAAM,MAAM,WAAW,CAAC,QAAQ,SAAS,kBAAkB,IAAI,IAAI,CACjE,YAAY,CAAC,QAAQ,CAAC,EACtB,YAAY,CACb,GAAG;IACF,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;CACvC,CAAA;AAED,wBAAgB,KAAK,CAAC,QAAQ,SAAS,kBAAkB,EACvD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,GAC5B,MAAM,CAAC,QAAQ,CAAC,CAGlB"}

package/lib/server.js

@@ -4,13 +4,15 @@ import { getEnkakuLogger } from '@enkaku/log';
 import { createClientMessageSchema } from '@enkaku/protocol';
 import { createValidator, ValidationError } from '@enkaku/schema';
 import { createUnsignedToken, isSignedToken } from '@enkaku/token';
-import { checkClientToken } from './access-control.js';
+import { checkClientToken, resolveEncryptionPolicy } from './access-control.js';
+import { HandlerError } from './error.js';
 import { handleChannel } from './handlers/channel.js';
 import { handleEvent } from './handlers/event.js';
 import { handleRequest } from './handlers/request.js';
 import { handleStream } from './handlers/stream.js';
+import { createResourceLimiter } from './limits.js';
 async function handleMessages(params) {
-    const { events, handlers, logger, signal, transport, validator } = params;
+    const { events, handlers, limiter, logger, signal, transport, validator } = params;
     const controllers = Object.create(null);
     const context = {
         controllers,
@@ -20,8 +22,34 @@ async function handleMessages(params) {
         send: (payload)=>transport.write(createUnsignedToken(payload))
     };
     const running = Object.create(null);
+    const encoder = new TextEncoder();
+    // Periodic cleanup of expired controllers
+    const cleanupInterval = setInterval(()=>{
+        const expired = limiter.getExpiredControllers();
+        for (const rid of expired){
+            const controller = controllers[rid];
+            if (controller != null) {
+                controller.abort('Timeout');
+                const error = new HandlerError({
+                    code: 'EK05',
+                    message: 'Request timeout'
+                });
+                context.send(error.toPayload(rid));
+                events.emit('handlerTimeout', {
+                    rid
+                });
+                limiter.removeController(rid);
+                limiter.releaseHandler();
+                delete controllers[rid];
+                delete running[rid];
+            } else {
+                limiter.removeController(rid);
+            }
+        }
+    }, Math.min(limiter.limits.controllerTimeoutMs, 10000));
     const disposer = new Disposer({
         dispose: async ()=>{
+            clearInterval(cleanupInterval);
             const interruption = new DisposeInterruption();
             // Abort all currently running handlers
             for (const controller of Object.values(controllers)){
@@ -53,23 +81,96 @@ async function handleMessages(params) {
         return result.value;
     } : (message)=>message;
     function processHandler(message, handle) {
+        const rid = message.payload.typ === 'event' ? Math.random().toString(36).slice(2) : message.payload.rid;
+        // Check controller limit
+        if (!limiter.canAddController()) {
+            const error = new HandlerError({
+                code: 'EK03',
+                message: 'Server controller limit reached'
+            });
+            if (message.payload.typ !== 'event') {
+                context.send(error.toPayload(rid));
+            }
+            events.emit('handlerError', {
+                error,
+                payload: message.payload
+            });
+            return;
+        }
+        // Check handler concurrency (synchronous fast path)
+        if (limiter.activeHandlers >= limiter.limits.maxConcurrentHandlers) {
+            const error = new HandlerError({
+                code: 'EK04',
+                message: 'Server handler limit reached'
+            });
+            if (message.payload.typ !== 'event') {
+                context.send(error.toPayload(rid));
+            }
+            events.emit('handlerError', {
+                error,
+                payload: message.payload
+            });
+            return;
+        }
+        limiter.addController(rid);
+        limiter.acquireHandler();
         const returned = handle();
         if (returned instanceof Error) {
-            const rid = message.payload.typ === 'event' ? undefined : message.payload.rid;
+            limiter.removeController(rid);
+            limiter.releaseHandler();
             events.emit('handlerError', {
-                error: returned,
-                payload: message.payload,
-                rid
+                error: HandlerError.from(returned, {
+                    code: 'EK01'
+                }),
+                payload: message.payload
             });
         } else {
-            const id = message.payload.typ === 'event' ? Math.random().toString(36).slice(2) : message.payload.rid;
-            running[id] = returned;
+            running[rid] = returned;
             returned.then(()=>{
-                delete running[id];
+                // Guard against double-release if timeout cleanup already handled this rid
+                if (running[rid] === returned) {
+                    limiter.removeController(rid);
+                    limiter.releaseHandler();
+                    delete running[rid];
+                }
             });
         }
     }
-    const process = params.public ? processHandler : async (message, handle)=>{
+    function checkMessageEncryption(message) {
+        const globalPolicy = params.encryptionPolicy ?? 'none';
+        if (globalPolicy === 'none') {
+            return true;
+        }
+        const procedure = message.payload.prc;
+        const effectivePolicy = procedure != null ? resolveEncryptionPolicy(procedure, params.access, globalPolicy) : globalPolicy;
+        if (effectivePolicy !== 'required') {
+            return true;
+        }
+        // Detect if message was encrypted: jwe-in-jws mode has a 'jwe' field in the payload
+        const payload = message.payload;
+        return 'jwe' in payload && typeof payload.jwe === 'string';
+    }
+    function handleEncryptionViolation(message) {
+        const error = new HandlerError({
+            code: 'EK07',
+            message: 'Encryption required but message is not encrypted'
+        });
+        if (message.payload.typ === 'event') {
+            events.emit('handlerError', {
+                error,
+                payload: message.payload
+            });
+        } else {
+            context.send(error.toPayload(message.payload.rid));
+        }
+    }
+    const process = params.public ? (message, handle)=>{
+        if (!checkMessageEncryption(message)) {
+            handleEncryptionViolation(message);
+            return;
+        }
+        processHandler(message, handle);
+    } : async (message, handle)=>{
         try {
             if (!params.public) {
                 if (!isSignedToken(message)) {
@@ -77,25 +178,30 @@ async function handleMessages(params) {
                 }
                 await checkClientToken(params.serverID, params.access, message);
             }
-        } catch (err) {
-            const errorMessage = err.message ?? 'Access denied';
+        } catch (cause) {
+            const error = new HandlerError({
+                cause,
+                code: 'EK02',
+                message: cause.message ?? 'Access denied'
+            });
             if (message.payload.typ === 'event') {
+                events.emit('eventAuthError', {
+                    error,
+                    payload: message.payload
+                });
                 events.emit('handlerError', {
-                    error: new Error(errorMessage, {
-                        cause: err
-                    }),
+                    error,
                     payload: message.payload
                 });
             } else {
-                context.send({
-                    typ: 'error',
-                    rid: message.payload.rid,
-                    code: 'EK02',
-                    msg: errorMessage
-                });
+                context.send(error.toPayload(message.payload.rid));
             }
             return;
         }
+        if (!checkMessageEncryption(message)) {
+            handleEncryptionViolation(message);
+            return;
+        }
         processHandler(message, handle);
     };
     async function handleNext() {
@@ -106,6 +212,22 @@ async function handleMessages(params) {
         }
         const msg = processMessage(next.value);
         if (msg != null) {
+            const msgSize = encoder.encode(JSON.stringify(msg.payload)).byteLength;
+            if (msgSize > limiter.limits.maxMessageSize) {
+                const error = new HandlerError({
+                    code: 'EK06',
+                    message: 'Message exceeds maximum size'
+                });
+                if ('rid' in msg.payload && msg.payload.rid != null) {
+                    context.send(error.toPayload(msg.payload.rid));
+                }
+                events.emit('handlerError', {
+                    error,
+                    payload: msg.payload
+                });
+                handleNext();
+                return;
+            }
             switch(msg.payload.typ){
                 case 'abort':
                     controllers[msg.payload.rid]?.abort(msg.payload.rsn);
@@ -131,7 +253,35 @@ async function handleMessages(params) {
                 case 'send':
                     {
                         const controller = controllers[msg.payload.rid];
-                        controller?.writer.write(msg.payload.val);
+                        if (controller == null) {
+                            logger.debug('received send for unknown channel {rid}', {
+                                rid: msg.payload.rid
+                            });
+                            break;
+                        }
+                        // In non-public mode, validate send messages
+                        if (!params.public) {
+                            if (!isSignedToken(msg)) {
+                                const error = new HandlerError({
+                                    code: 'EK02',
+                                    message: 'Channel send message must be signed'
+                                });
+                                context.send(error.toPayload(msg.payload.rid));
+                                break;
+                            }
+                            try {
+                                await checkClientToken(params.serverID, params.access, msg);
+                            } catch (cause) {
+                                const error = new HandlerError({
+                                    cause,
+                                    code: 'EK02',
+                                    message: cause.message ?? 'Send authorization denied'
+                                });
+                                context.send(error.toPayload(msg.payload.rid));
+                                break;
+                            }
+                        }
+                        controller.writer.write(msg.payload.val);
                         break;
                     }
                 case 'stream':
@@ -153,6 +303,7 @@ export class Server extends Disposer {
     #events;
     #handlers;
     #handling = [];
+    #limiter;
     #logger;
     #validator;
     constructor(params){
@@ -160,40 +311,63 @@ export class Server extends Disposer {
             dispose: async ()=>{
                 // Signal messages handler to stop execution and run cleanup logic
                 this.#abortController.abort();
-                // Dispose of all handling transports
-                await Promise.all(this.#handling.map(async (handling)=>{
-                    // Wait until all handlers are done - they might still need to flush messages to the transport
-                    await handling.done;
-                    // Dispose transport
-                    await handling.transport.dispose();
-                }));
+                const cleanupTimeout = this.#limiter.limits.cleanupTimeoutMs;
+                const timeoutPromise = new Promise((resolve)=>{
+                    setTimeout(resolve, cleanupTimeout);
+                });
+                // Race between graceful cleanup and timeout
+                const gracefulDone = await Promise.race([
+                    Promise.all(this.#handling.map(async (handling)=>{
+                        // Wait until all handlers are done - they might still need to flush messages to the transport
+                        await handling.done;
+                        // Dispose transport
+                        await handling.transport.dispose();
+                    })).then(()=>true),
+                    timeoutPromise.then(()=>false)
+                ]);
+                // Force dispose any remaining transports only if timed out
+                if (!gracefulDone) {
+                    for (const handling of this.#handling){
+                        try {
+                            await handling.transport.dispose();
+                        } catch  {
+                        // Ignore errors during forced cleanup
+                        }
+                    }
+                }
             },
             signal: params.signal
         });
         this.#abortController = new AbortController();
         this.#events = new EventEmitter();
         this.#handlers = params.handlers;
+        const serverID = params.identity?.id;
         this.#logger = params.logger ?? getEnkakuLogger('server', {
-            serverID: params.id ?? crypto.randomUUID()
+            serverID: serverID ?? crypto.randomUUID()
         });
-        if (params.id == null) {
+        if (serverID == null) {
             if (params.public) {
                 this.#accessControl = {
                     public: true,
-                    access: params.access
+                    access: params.access,
+                    encryptionPolicy: params.encryptionPolicy
                 };
             } else {
-                throw new Error('Invalid server parameters: either the server "id" must be provided or the "public" parameter must be set to true');
+                throw new Error('Invalid server parameters: either the server "identity" must be provided or the "public" parameter must be set to true');
             }
         } else {
             this.#accessControl = {
                 public: !!params.public,
-                serverID: params.id,
-                access: params.access ?? {}
+                serverID,
+                access: params.access ?? {},
+                encryptionPolicy: params.encryptionPolicy
             };
         }
+        this.#limiter = createResourceLimiter(params.limits);
         if (params.protocol != null) {
             this.#validator = createValidator(createClientMessageSchema(params.protocol));
+        } else {
+            this.#logger.warn('No protocol provided: message validation is disabled. Pass a protocol definition to enable runtime type checking.');
         }
         for (const transport of params.transports ?? []){
             this.handle(transport);
@@ -208,11 +382,13 @@ export class Server extends Disposer {
         const logger = options.logger ?? this.#logger.getChild('handler').with({
             transportID: crypto.randomUUID()
         });
+        const encryptionPolicy = this.#accessControl.encryptionPolicy;
         let accessControl;
         if (publicAccess) {
             accessControl = {
                 public: true,
-                access
+                access,
+                encryptionPolicy
             };
         } else {
             const serverID = this.#accessControl.serverID;
@@ -222,12 +398,14 @@ export class Server extends Disposer {
             accessControl = {
                 public: false,
                 serverID,
-                access
+                access,
+                encryptionPolicy
             };
         }
         const done = handleMessages({
             events: this.#events,
             handlers: this.#handlers,
+            limiter: this.#limiter,
             logger,
             signal: this.#abortController.signal,
             transport,

package/lib/types.d.ts

@@ -1,6 +1,7 @@
 import type { EventEmitter } from '@enkaku/event';
 import type { Logger } from '@enkaku/log';
 import type { AnyRequestProcedureDefinition, AnyServerPayloadOf, ChannelProcedureDefinition, DataOf, EventCallPayload, EventProcedureDefinition, Message, ProtocolDefinition, RequestCallPayload, RequestProcedureDefinition, ReturnOf, StreamProcedureDefinition } from '@enkaku/protocol';
+import type { HandlerError } from './error.js';
 export type RequestController = AbortController;
 export type ChannelController<Send = unknown> = AbortController & {
     writer: WritableStreamDefaultWriter<Send>;
@@ -35,13 +36,16 @@ export type ReceiveType<Protocol extends ProtocolDefinition, Procedure extends k
 export type ResultType<Protocol extends ProtocolDefinition, Procedure extends keyof Protocol & string> = Protocol[Procedure] extends AnyRequestProcedureDefinition ? DataOf<Protocol[Procedure]['result']> : never;
 export type SendType<Protocol extends ProtocolDefinition, Procedure extends keyof Protocol & string> = Protocol[Procedure] extends ChannelProcedureDefinition ? DataOf<Protocol[Procedure]['send']> : never;
 export type ServerEvents = {
+    eventAuthError: {
+        error: HandlerError<string>;
+        payload: Record<string, unknown>;
+    };
     handlerAbort: {
         rid: string;
     };
     handlerError: {
-        error: Error;
+        error: HandlerError<string>;
         payload: Record<string, unknown>;
-        rid?: string;
     };
     handlerTimeout: {
         rid: string;

package/lib/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EACV,6BAA6B,EAC7B,kBAAkB,EAClB,0BAA0B,EAC1B,MAAM,EACN,gBAAgB,EAChB,wBAAwB,EACxB,OAAO,EACP,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,EAC1B,QAAQ,EACR,yBAAyB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB,MAAM,MAAM,iBAAiB,GAAG,eAAe,CAAA;AAE/C,MAAM,MAAM,iBAAiB,CAAC,IAAI,GAAG,OAAO,IAAI,eAAe,GAAG;IAChE,MAAM,EAAE,2BAA2B,CAAC,IAAI,CAAC,CAAA;CAC1C,CAAA;AAED,MAAM,MAAM,iBAAiB,CAAC,IAAI,GAAG,OAAO,IAAI,iBAAiB,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;AAE3F,MAAM,MAAM,mBAAmB,CAC7B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,wBAAwB,GACpD;IACE,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAClF,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1C,GACD,KAAK,CAAA;AAET,MAAM,MAAM,YAAY,CACtB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,CAAC,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAE/E,MAAM,MAAM,qBAAqB,CAC/B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,6BAA6B,GACzD;IACE,OAAO,EAAE,OAAO,CACd,kBAAkB,CAChB,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAC3B,SAAS,EACT,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CACrC,CACF,CAAA;IACD,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;IAC3C,MAAM,EAAE,WAAW,CAAA;CACpB,GACD,KAAK,CAAA;AAET,MAAM,MAAM,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;AAEnG,MAAM,MAAM,cAAc,CACxB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,6BAA6B,GACzD,CACE,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAChD,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,GACjD,KAAK,CAAA;AAET,MAAM,MAAM,oBAAoB,CAC9B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,yBAAyB,GAAG,0BAA0B,GAClF,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG;IAC3C,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;CACjE,GACD,KAAK,CAAA;AAET,MAAM,MAAM,aAAa,CACvB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,yBAAyB,GAAG,0BAA0B,GAClF,CACE,OAAO,EAAE,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAC/C,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,GACjD,KAAK,CAAA;AAET,MAAM,MAAM,qBAAqB,CAC/B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,0BAA0B,GACtD,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG;IAC1C,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;CAC9D,GACD,KAAK,CAAA;AAET,MAAM,MAAM,cAAc,CACxB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,0BAA0B,GACtD,CACE,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAChD,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,GACjD,KAAK,CAAA;AAET,MAAM,MAAM,iBAAiB,CAAC,QAAQ,SAAS,kBAAkB,IAAI;KAClE,SAAS,IAAI,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,SAAS,wBAAwB,GACxF,CAAC,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,IAAI,GAC3D,QAAQ,CAAC,SAAS,CAAC,SAAS,0BAA0B,GACpD,CACE,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAChD,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,GACjD,QAAQ,CAAC,SAAS,CAAC,SAAS,yBAAyB,GACnD,CACE,OAAO,EAAE,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAC/C,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,GACjD,QAAQ,CAAC,SAAS,CAAC,SAAS,0BAA0B,GACpD,CACE,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAChD,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,GACjD,KAAK;CAChB,CAAA;AAED,MAAM,MAAM,aAAa,CACvB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,wBAAwB,GACpD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,GACnC,KAAK,CAAA;AAET,MAAM,MAAM,SAAS,CACnB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,6BAA6B,GACzD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,GACpC,KAAK,CAAA;AAET,MAAM,MAAM,WAAW,CACrB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,yBAAyB,GACrD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,GACtC,QAAQ,CAAC,SAAS,CAAC,SAAS,0BAA0B,GACpD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,GACtC,KAAK,CAAA;AAEX,MAAM,MAAM,UAAU,CACpB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,6BAA6B,GACzD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,GACrC,KAAK,CAAA;AAET,MAAM,MAAM,QAAQ,CAClB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,0BAA0B,GACtD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,GACnC,KAAK,CAAA;AAET,MAAM,MAAM,YAAY,GAAG;IACzB,YAAY,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7B,YAAY,EAAE;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC9E,cAAc,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/B,cAAc,EAAE;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAA;CACnD,CAAA;AAED,MAAM,MAAM,aAAa,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;AAEtD,MAAM,MAAM,cAAc,CAAC,QAAQ,SAAS,kBAAkB,IAAI;IAChE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAC9C,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/D,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EACV,6BAA6B,EAC7B,kBAAkB,EAClB,0BAA0B,EAC1B,MAAM,EACN,gBAAgB,EAChB,wBAAwB,EACxB,OAAO,EACP,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,EAC1B,QAAQ,EACR,yBAAyB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,MAAM,MAAM,iBAAiB,GAAG,eAAe,CAAA;AAE/C,MAAM,MAAM,iBAAiB,CAAC,IAAI,GAAG,OAAO,IAAI,eAAe,GAAG;IAChE,MAAM,EAAE,2BAA2B,CAAC,IAAI,CAAC,CAAA;CAC1C,CAAA;AAED,MAAM,MAAM,iBAAiB,CAAC,IAAI,GAAG,OAAO,IAAI,iBAAiB,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;AAE3F,MAAM,MAAM,mBAAmB,CAC7B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,wBAAwB,GACpD;IACE,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAClF,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1C,GACD,KAAK,CAAA;AAET,MAAM,MAAM,YAAY,CACtB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,CAAC,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAE/E,MAAM,MAAM,qBAAqB,CAC/B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,6BAA6B,GACzD;IACE,OAAO,EAAE,OAAO,CACd,kBAAkB,CAChB,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAC3B,SAAS,EACT,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CACrC,CACF,CAAA;IACD,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;IAC3C,MAAM,EAAE,WAAW,CAAA;CACpB,GACD,KAAK,CAAA;AAET,MAAM,MAAM,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;AAEnG,MAAM,MAAM,cAAc,CACxB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,6BAA6B,GACzD,CACE,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAChD,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,GACjD,KAAK,CAAA;AAET,MAAM,MAAM,oBAAoB,CAC9B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,yBAAyB,GAAG,0BAA0B,GAClF,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG;IAC3C,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;CACjE,GACD,KAAK,CAAA;AAET,MAAM,MAAM,aAAa,CACvB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,yBAAyB,GAAG,0BAA0B,GAClF,CACE,OAAO,EAAE,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAC/C,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,GACjD,KAAK,CAAA;AAET,MAAM,MAAM,qBAAqB,CAC/B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,0BAA0B,GACtD,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG;IAC1C,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;CAC9D,GACD,KAAK,CAAA;AAET,MAAM,MAAM,cAAc,CACxB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,0BAA0B,GACtD,CACE,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAChD,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,GACjD,KAAK,CAAA;AAET,MAAM,MAAM,iBAAiB,CAAC,QAAQ,SAAS,kBAAkB,IAAI;KAClE,SAAS,IAAI,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,SAAS,wBAAwB,GACxF,CAAC,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,IAAI,GAC3D,QAAQ,CAAC,SAAS,CAAC,SAAS,0BAA0B,GACpD,CACE,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAChD,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,GACjD,QAAQ,CAAC,SAAS,CAAC,SAAS,yBAAyB,GACnD,CACE,OAAO,EAAE,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAC/C,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,GACjD,QAAQ,CAAC,SAAS,CAAC,SAAS,0BAA0B,GACpD,CACE,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAChD,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,GACjD,KAAK;CAChB,CAAA;AAED,MAAM,MAAM,aAAa,CACvB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,wBAAwB,GACpD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,GACnC,KAAK,CAAA;AAET,MAAM,MAAM,SAAS,CACnB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,6BAA6B,GACzD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,GACpC,KAAK,CAAA;AAET,MAAM,MAAM,WAAW,CACrB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,yBAAyB,GACrD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,GACtC,QAAQ,CAAC,SAAS,CAAC,SAAS,0BAA0B,GACpD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,GACtC,KAAK,CAAA;AAEX,MAAM,MAAM,UAAU,CACpB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,6BAA6B,GACzD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,GACrC,KAAK,CAAA;AAET,MAAM,MAAM,QAAQ,CAClB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,IACvC,QAAQ,CAAC,SAAS,CAAC,SAAS,0BAA0B,GACtD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,GACnC,KAAK,CAAA;AAET,MAAM,MAAM,YAAY,GAAG;IACzB,cAAc,EAAE;QACd,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;QAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACjC,CAAA;IACD,YAAY,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7B,YAAY,EAAE;QACZ,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;QAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACjC,CAAA;IACD,cAAc,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/B,cAAc,EAAE;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAA;CACnD,CAAA;AAED,MAAM,MAAM,aAAa,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;AAEtD,MAAM,MAAM,cAAc,CAAC,QAAQ,SAAS,kBAAkB,IAAI;IAChE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAC9C,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/D,CAAA"}

package/lib/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAsB,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAGhG,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAO5D,wBAAsB,cAAc,CAClC,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,EACzC,MAAM,SAAS,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,EAEhF,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,EACjC,OAAO,EAAE,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,EACzD,OAAO,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC,CA4Bf"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAsB,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAGhG,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAO5D,wBAAsB,cAAc,CAClC,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,EACzC,MAAM,SAAS,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,EAEhF,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,EACjC,OAAO,EAAE,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,EACzD,OAAO,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC,CA6Cf"}

package/lib/utils.js

@@ -9,6 +9,12 @@ export async function executeHandler(context, payload, execute) {
     try {
         const val = await toPromise(execute);
         if (canSend(controller.signal)) {
+            context.logger.trace('send result to {type} {procedure} with ID {rid}', {
+                type: payload.typ,
+                procedure: payload.prc,
+                rid: payload.rid,
+                result: val
+            });
             await context.send({
                 typ: 'result',
                 rid: payload.rid,
@@ -16,17 +22,28 @@ export async function executeHandler(context, payload, execute) {
             });
         }
     } catch (cause) {
+        const error = HandlerError.from(cause, {
+            code: 'EK01',
+            message: 'Handler execution failed'
+        });
         if (canSend(controller.signal)) {
-            context.send(HandlerError.from(cause, {
-                code: 'EK01',
-                message: cause.message ?? 'Handler execution failed'
-            }).toPayload(payload.rid));
+            context.logger.trace('send error to {type} {procedure} with ID {rid}', {
+                type: payload.typ,
+                procedure: payload.prc,
+                rid: payload.rid,
+                error
+            });
+            context.send(error.toPayload(payload.rid));
+        } else {
+            context.logger.debug('handler error for {type} {procedure} with ID {rid} cannot be sent to client', {
+                type: payload.typ,
+                procedure: payload.prc,
+                rid: payload.rid,
+                error
+            });
         }
         context.events.emit('handlerError', {
-            error: new Error(`Error handling procedure: ${payload.prc}`, {
-                cause
-            }),
-            rid: payload.rid,
+            error,
             payload
         });
     } finally{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enkaku/server",
-  "version": "0.12.2",
+  "version": "0.13.0",
   "license": "MIT",
   "homepage": "https://enkaku.dev",
   "description": "Server logic for Enkaku RPC",
@@ -25,17 +25,17 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@enkaku/async": "^0.12.2",
-    "@enkaku/capability": "^0.12.1",
-    "@enkaku/event": "^0.12.1",
-    "@enkaku/protocol": "^0.12.1",
-    "@enkaku/log": "^0.12.0",
-    "@enkaku/schema": "^0.12.1",
-    "@enkaku/token": "^0.12.3",
-    "@enkaku/stream": "^0.12.4"
+    "@enkaku/capability": "^0.13.0",
+    "@enkaku/async": "^0.13.0",
+    "@enkaku/protocol": "^0.13.0",
+    "@enkaku/log": "^0.13.0",
+    "@enkaku/event": "^0.13.0",
+    "@enkaku/schema": "^0.13.0",
+    "@enkaku/token": "^0.13.0",
+    "@enkaku/stream": "^0.13.0"
   },
   "devDependencies": {
-    "@enkaku/transport": "^0.12.0"
+    "@enkaku/transport": "^0.13.0"
   },
   "scripts": {
     "build:clean": "del lib",