@enkaku/server 0.13.3 → 0.14.0

package/lib/access-control.d.ts

@@ -1,3 +1,4 @@
+import { type DelegationChainOptions } from '@enkaku/capability';
 import type { SignedToken } from '@enkaku/token';
 export type EncryptionPolicy = 'required' | 'optional' | 'none';
 export type ProcedureAccessConfig = {
@@ -14,6 +15,6 @@ export type ProcedureAccessPayload = {
     prc?: string;
     exp?: number;
 };
-export declare function checkProcedureAccess(serverID: string, record: ProcedureAccessRecord, token: SignedToken<ProcedureAccessPayload>, atTime?: number): Promise<void>;
-export declare function checkClientToken(serverID: string, record: ProcedureAccessRecord, token: SignedToken, atTime?: number): Promise<void>;
+export declare function checkProcedureAccess(serverID: string, record: ProcedureAccessRecord, token: SignedToken<ProcedureAccessPayload>, options?: DelegationChainOptions): Promise<void>;
+export declare function checkClientToken(serverID: string, record: ProcedureAccessRecord, token: SignedToken, options?: DelegationChainOptions): Promise<void>;
 //# sourceMappingURL=access-control.d.ts.map

package/lib/access-control.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-control.d.ts","sourceRoot":"","sources":["../src/access-control.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAEhD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,CAAA;AAE/D,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IAC/B,UAAU,CAAC,EAAE,gBAAgB,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,qBAAqB,CAAA;AAElF,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;AAgBxE,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,qBAAqB,GAAG,SAAS,EACzC,YAAY,EAAE,gBAAgB,GAC7B,gBAAgB,CAYlB;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,WAAW,CAAC,sBAAsB,CAAC,EAC1C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAkCf;AAED,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CA4Bf"}
+{"version":3,"file":"access-control.d.ts","sourceRoot":"","sources":["../src/access-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,sBAAsB,EAE5B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAEhD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,CAAA;AAE/D,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IAC/B,UAAU,CAAC,EAAE,gBAAgB,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,qBAAqB,CAAA;AAElF,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;AAgBxE,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,qBAAqB,GAAG,SAAS,EACzC,YAAY,EAAE,gBAAgB,GAC7B,gBAAgB,CAYlB;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,WAAW,CAAC,sBAAsB,CAAC,EAC1C,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,IAAI,CAAC,CA2Cf;AAED,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAiCf"}

package/lib/access-control.js

@@ -24,7 +24,7 @@ export function resolveEncryptionPolicy(procedure, record, globalPolicy) {
     }
     return globalPolicy;
 }
-export async function checkProcedureAccess(serverID, record, token, atTime) {
+export async function checkProcedureAccess(serverID, record, token, options) {
     const payload = token.payload;
     if (payload.prc == null) {
         throw new Error('No procedure to check');
@@ -51,14 +51,19 @@ export async function checkProcedureAccess(serverID, record, token, atTime) {
                 await checkCapability({
                     act: payload.prc,
                     res: serverID
-                }, payload, atTime);
+                }, payload, options);
                 return;
-            } catch  {}
+            } catch (err) {
+                const message = err instanceof Error ? err.message : '';
+                if (!message.startsWith('Invalid capability') && !message.startsWith('Invalid payload') && !message.startsWith('Invalid token')) {
+                    throw err;
+                }
+            }
         }
     }
     throw new Error('Access denied');
 }
-export async function checkClientToken(serverID, record, token, atTime) {
+export async function checkClientToken(serverID, record, token, options) {
     const payload = token.payload;
     const procedure = payload.prc;
     if (procedure == null) {
@@ -70,7 +75,7 @@ export async function checkClientToken(serverID, record, token, atTime) {
             throw new Error('Invalid audience');
         }
         if (payload.exp != null) {
-            assertNonExpired(payload, atTime);
+            assertNonExpired(payload, options?.atTime);
         }
         return;
     }
@@ -79,11 +84,11 @@ export async function checkClientToken(serverID, record, token, atTime) {
         await checkCapability({
             act: procedure,
             res: serverID
-        }, payload, atTime);
+        }, payload, options);
         return;
     }
     if (payload.aud !== serverID) {
         throw new Error('Invalid audience');
     }
-    await checkProcedureAccess(serverID, record, token, atTime);
+    await checkProcedureAccess(serverID, record, token, options);
 }

package/lib/handlers/channel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"channel.d.ts","sourceRoot":"","sources":["../../src/handlers/channel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,KAAK,EAGV,cAAc,EAGf,MAAM,aAAa,CAAA;AAGpB,MAAM,MAAM,gBAAgB,CAC1B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,QAAQ,GAAG,MAAM,IACjE,aAAa,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;AAEnE,wBAAgB,aAAa,CAC3B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,EAEzC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAC7B,GAAG,EAAE,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,GACzC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAiFvB"}
+{"version":3,"file":"channel.d.ts","sourceRoot":"","sources":["../../src/handlers/channel.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,KAAK,EAGV,cAAc,EAGf,MAAM,aAAa,CAAA;AAGpB,MAAM,MAAM,gBAAgB,CAC1B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,QAAQ,GAAG,MAAM,IACjE,aAAa,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;AAEnE,wBAAgB,aAAa,CAC3B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,EAEzC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAC7B,GAAG,EAAE,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,GACzC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CA6FvB"}

package/lib/handlers/channel.js

@@ -1,3 +1,4 @@
+import { AttributeKeys, getActiveSpan } from '@enkaku/otel';
 import { createPipe, tap, writeTo } from '@enkaku/stream';
 import { executeHandler } from '../utils.js';
 export function handleChannel(ctx, msg) {
@@ -18,6 +19,7 @@ export function handleChannel(ctx, msg) {
             param
         });
     }
+    const activeSpan = getActiveSpan();
     const sendStream = createPipe();
     const issuer = msg.payload.iss;
     const controller = Object.assign(new AbortController(), {
@@ -33,6 +35,11 @@ export function handleChannel(ctx, msg) {
         if (controller.signal.aborted) {
             return;
         }
+        if (activeSpan != null) {
+            activeSpan.addEvent('channel.message.sent', {
+                [AttributeKeys.MESSAGE_DIRECTION]: 'send'
+            });
+        }
         ctx.logger.trace('send value to channel {procedure} with ID {rid}: {val}', {
             procedure: msg.payload.prc,
             rid: msg.payload.rid,
@@ -45,6 +52,11 @@ export function handleChannel(ctx, msg) {
         });
     }));
     const readable = sendStream.readable.pipeThrough(tap((value)=>{
+        if (activeSpan != null) {
+            activeSpan.addEvent('channel.message.received', {
+                [AttributeKeys.MESSAGE_DIRECTION]: 'receive'
+            });
+        }
         ctx.logger.trace('received value from channel {procedure} with ID {rid}: {value}', {
             procedure: msg.payload.prc,
             rid: msg.payload.rid,

package/lib/handlers/stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/handlers/stream.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,aAAa,EACb,kBAAkB,EAClB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,KAAK,EAAE,cAAc,EAA8B,MAAM,aAAa,CAAA;AAG7E,MAAM,MAAM,eAAe,CACzB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,QAAQ,GAAG,MAAM,IACjE,aAAa,CAAC,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;AAElE,wBAAgB,YAAY,CAC1B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,EACzC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CA8DjG"}
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/handlers/stream.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,aAAa,EACb,kBAAkB,EAClB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,KAAK,EAAE,cAAc,EAA8B,MAAM,aAAa,CAAA;AAG7E,MAAM,MAAM,eAAe,CACzB,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,QAAQ,GAAG,MAAM,IACjE,aAAa,CAAC,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;AAElE,wBAAgB,YAAY,CAC1B,QAAQ,SAAS,kBAAkB,EACnC,SAAS,SAAS,MAAM,QAAQ,GAAG,MAAM,EACzC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAqEjG"}

package/lib/handlers/stream.js

@@ -1,3 +1,4 @@
+import { AttributeKeys, getActiveSpan } from '@enkaku/otel';
 import { createPipe, writeTo } from '@enkaku/stream';
 import { executeHandler } from '../utils.js';
 export function handleStream(ctx, msg) {
@@ -18,6 +19,7 @@ export function handleStream(ctx, msg) {
             param
         });
     }
+    const activeSpan = getActiveSpan();
     const controller = new AbortController();
     ctx.controllers[msg.payload.rid] = controller;
     const receiveStream = createPipe();
@@ -25,6 +27,11 @@ export function handleStream(ctx, msg) {
         if (controller.signal.aborted) {
             return;
         }
+        if (activeSpan != null) {
+            activeSpan.addEvent('stream.message.sent', {
+                [AttributeKeys.MESSAGE_DIRECTION]: 'send'
+            });
+        }
         ctx.logger.trace('send value to stream {procedure} with ID {rid}: {val}', {
             procedure: msg.payload.prc,
             rid: msg.payload.rid,

package/lib/server.d.ts

@@ -1,5 +1,7 @@
 import { Disposer } from '@enkaku/async';
+import type { VerifyTokenHook } from '@enkaku/capability';
 import { type Logger } from '@enkaku/log';
+import { type Tracer } from '@enkaku/otel';
 import { type AnyClientMessageOf, type ProtocolDefinition, type ServerTransportOf } from '@enkaku/protocol';
 import { type Validator } from '@enkaku/schema';
 import { type Identity } from '@enkaku/token';
@@ -7,15 +9,16 @@ import { type EncryptionPolicy, type ProcedureAccessRecord } from './access-cont
 import { type ResourceLimiter, type ResourceLimits } from './limits.js';
 import type { ProcedureHandlers, ServerEmitter } from './types.js';
 export type AccessControlParams = ({
-    public: true;
+    requireAuth: false;
     serverID?: string;
-    access?: ProcedureAccessRecord;
+    access: ProcedureAccessRecord;
 } | {
-    public: false;
+    requireAuth: true;
     serverID: string;
     access: ProcedureAccessRecord;
 }) & {
     encryptionPolicy?: EncryptionPolicy;
+    verifyToken?: VerifyTokenHook;
 };
 export type HandleMessagesParams<Protocol extends ProtocolDefinition> = AccessControlParams & {
     events: ServerEmitter;
@@ -23,11 +26,12 @@ export type HandleMessagesParams<Protocol extends ProtocolDefinition> = AccessCo
     limiter: ResourceLimiter;
     logger: Logger;
     signal: AbortSignal;
+    tracer: Tracer;
     transport: ServerTransportOf<Protocol>;
     validator?: Validator<AnyClientMessageOf<Protocol>>;
 };
 export type ServerParams<Protocol extends ProtocolDefinition> = {
-    access?: ProcedureAccessRecord;
+    accessControl?: false | true | ProcedureAccessRecord;
     encryptionPolicy?: EncryptionPolicy;
     getRandomID?: () => string;
     handlers: ProcedureHandlers<Protocol>;
@@ -35,14 +39,15 @@ export type ServerParams<Protocol extends ProtocolDefinition> = {
     limits?: Partial<ResourceLimits>;
     logger?: Logger;
     protocol?: Protocol;
-    public?: boolean;
+    tracer?: Tracer;
     signal?: AbortSignal;
     transports?: Array<ServerTransportOf<Protocol>>;
+    verifyToken?: VerifyTokenHook;
 };
 export type HandleOptions = {
-    access?: ProcedureAccessRecord;
+    accessControl?: false | true | ProcedureAccessRecord;
     logger?: Logger;
-    public?: boolean;
+    verifyToken?: VerifyTokenHook;
 };
 export declare class Server<Protocol extends ProtocolDefinition> extends Disposer {
     #private;

package/lib/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE7D,OAAO,EAAmB,KAAK,MAAM,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EACL,KAAK,kBAAkB,EAGvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAEL,KAAK,QAAQ,EAId,MAAM,eAAe,CAAA;AAEtB,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAE3B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EAAyB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AAC9F,OAAO,KAAK,EAIV,iBAAiB,EACjB,aAAa,EAEd,MAAM,YAAY,CAAA;AAYnB,MAAM,MAAM,mBAAmB,GAAG,CAC9B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,qBAAqB,CAAA;CAAE,GACnE;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,CACrE,GAAG;IAAE,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAA;AAE3C,MAAM,MAAM,oBAAoB,CAAC,QAAQ,SAAS,kBAAkB,IAAI,mBAAmB,GAAG;IAC5F,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACrC,OAAO,EAAE,eAAe,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,WAAW,CAAA;IACnB,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACtC,SAAS,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAA;CACpD,CAAA;AA2SD,MAAM,MAAM,YAAY,CAAC,QAAQ,SAAS,kBAAkB,IAAI;IAC9D,MAAM,CAAC,EAAE,qBAAqB,CAAA;IAC9B,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;IAC1B,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACrC,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IAChC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,UAAU,CAAC,EAAE,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAA;CAChD,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAEjG,qBAAa,MAAM,CAAC,QAAQ,SAAS,kBAAkB,CAAE,SAAQ,QAAQ;;gBAW3D,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC;IAiF1C,IAAI,MAAM,IAAI,aAAa,CAE1B;IAED,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;CAoC3F;AAED,MAAM,MAAM,WAAW,CAAC,QAAQ,SAAS,kBAAkB,IAAI,IAAI,CACjE,YAAY,CAAC,QAAQ,CAAC,EACtB,YAAY,CACb,GAAG;IACF,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;CACvC,CAAA;AAED,wBAAgB,KAAK,CAAC,QAAQ,SAAS,kBAAkB,EACvD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,GAC5B,MAAM,CAAC,QAAQ,CAAC,CAGlB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEzD,OAAO,EAAmB,KAAK,MAAM,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EASL,KAAK,MAAM,EAEZ,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,KAAK,kBAAkB,EAGvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAEL,KAAK,QAAQ,EAId,MAAM,eAAe,CAAA;AAEtB,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAE3B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EAAyB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AAC9F,OAAO,KAAK,EAIV,iBAAiB,EACjB,aAAa,EAEd,MAAM,YAAY,CAAA;AAcnB,MAAM,MAAM,mBAAmB,GAAG,CAC9B;IAAE,WAAW,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,GACxE;IAAE,WAAW,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,CACzE,GAAG;IAAE,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAAC,WAAW,CAAC,EAAE,eAAe,CAAA;CAAE,CAAA;AAE1E,MAAM,MAAM,oBAAoB,CAAC,QAAQ,SAAS,kBAAkB,IAAI,mBAAmB,GAAG;IAC5F,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACrC,OAAO,EAAE,eAAe,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,WAAW,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACtC,SAAS,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAA;CACpD,CAAA;AAieD,MAAM,MAAM,YAAY,CAAC,QAAQ,SAAS,kBAAkB,IAAI;IAC9D,aAAa,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,qBAAqB,CAAA;IACpD,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;IAC1B,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACrC,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IAChC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,UAAU,CAAC,EAAE,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC/C,WAAW,CAAC,EAAE,eAAe,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,aAAa,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,qBAAqB,CAAA;IACpD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,eAAe,CAAA;CAC9B,CAAA;AAED,qBAAa,MAAM,CAAC,QAAQ,SAAS,kBAAkB,CAAE,SAAQ,QAAQ;;gBAY3D,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC;IAiG1C,IAAI,MAAM,IAAI,aAAa,CAE1B;IAED,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;CAyD3F;AAED,MAAM,MAAM,WAAW,CAAC,QAAQ,SAAS,kBAAkB,IAAI,IAAI,CACjE,YAAY,CAAC,QAAQ,CAAC,EACtB,YAAY,CACb,GAAG;IACF,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;CACvC,CAAA;AAED,wBAAgB,KAAK,CAAC,QAAQ,SAAS,kBAAkB,EACvD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,GAC5B,MAAM,CAAC,QAAQ,CAAC,CAGlB"}

package/lib/server.js

@@ -1,6 +1,7 @@
 import { DisposeInterruption, Disposer } from '@enkaku/async';
 import { EventEmitter } from '@enkaku/event';
 import { getEnkakuLogger } from '@enkaku/log';
+import { AttributeKeys, createTracer, extractTraceContext, SpanNames, SpanStatusCode, setSpanOnContext, TraceFlags, withActiveContext } from '@enkaku/otel';
 import { createClientMessageSchema } from '@enkaku/protocol';
 import { createValidator, ValidationError } from '@enkaku/schema';
 import { createUnsignedToken, isSignedToken } from '@enkaku/token';
@@ -11,6 +12,7 @@ import { handleEvent } from './handlers/event.js';
 import { handleRequest } from './handlers/request.js';
 import { handleStream } from './handlers/stream.js';
 import { createResourceLimiter } from './limits.js';
+const defaultTracer = createTracer('server');
 function defaultRandomID() {
     return globalThis.crypto.randomUUID();
 }
@@ -70,6 +72,20 @@ async function handleMessages(params) {
     const processMessage = validator ? (message)=>{
         const result = validator(message);
         if (result instanceof ValidationError) {
+            const validationSpan = params.tracer.startSpan(SpanNames.SERVER_HANDLE, {
+                attributes: {
+                    [AttributeKeys.RPC_SYSTEM]: 'enkaku'
+                }
+            });
+            validationSpan.addEvent('enkaku.validation', {
+                [AttributeKeys.VALIDATION_SUCCESS]: false,
+                [AttributeKeys.VALIDATION_ERROR]: result.message
+            });
+            validationSpan.setStatus({
+                code: SpanStatusCode.ERROR,
+                message: 'Validation failed'
+            });
+            validationSpan.end();
             logger.debug('received invalid message', {
                 error: result
             });
@@ -167,26 +183,174 @@ async function handleMessages(params) {
             context.send(error.toPayload(message.payload.rid));
         }
     }
-    const process = params.public ? (message, handle)=>{
+    function getParentContext(message) {
+        const header = message.header;
+        return extractTraceContext(header);
+    }
+    function createHandleSpan(message) {
+        const parentCtx = getParentContext(message);
+        const procedure = message.payload.prc;
+        const rid = 'rid' in message.payload ? message.payload.rid : undefined;
+        // Build span links from client trace context
+        const header = message.header;
+        const links = [];
+        if (typeof header.tid === 'string' && typeof header.sid === 'string') {
+            links.push({
+                context: {
+                    traceId: header.tid,
+                    spanId: header.sid,
+                    traceFlags: TraceFlags.SAMPLED,
+                    isRemote: true
+                }
+            });
+        }
+        return params.tracer.startSpan(SpanNames.SERVER_HANDLE, {
+            attributes: {
+                [AttributeKeys.RPC_SYSTEM]: 'enkaku',
+                ...procedure != null ? {
+                    [AttributeKeys.RPC_PROCEDURE]: procedure
+                } : {},
+                ...rid != null ? {
+                    [AttributeKeys.RPC_REQUEST_ID]: rid
+                } : {}
+            },
+            links
+        }, parentCtx);
+    }
+    function wrapHandle(span, handle) {
+        return ()=>{
+            const spanCtx = setSpanOnContext(undefined, span);
+            const result = withActiveContext(spanCtx, ()=>{
+                const handlerSpan = params.tracer.startSpan(SpanNames.SERVER_HANDLER);
+                const handlerResult = handle();
+                if (handlerResult instanceof Error) {
+                    if ('code' in handlerResult) {
+                        handlerSpan.setAttribute(AttributeKeys.ERROR_CODE, handlerResult.code);
+                    }
+                    handlerSpan.setAttribute(AttributeKeys.ERROR_MESSAGE, handlerResult.message);
+                    handlerSpan.setStatus({
+                        code: SpanStatusCode.ERROR,
+                        message: handlerResult.message
+                    });
+                    handlerSpan.recordException(handlerResult);
+                    handlerSpan.end();
+                    return handlerResult;
+                }
+                handlerResult.then(()=>{
+                    handlerSpan.setStatus({
+                        code: SpanStatusCode.OK
+                    });
+                    handlerSpan.end();
+                }).catch((err)=>{
+                    if ('code' in err) {
+                        handlerSpan.setAttribute(AttributeKeys.ERROR_CODE, err.code);
+                    }
+                    handlerSpan.setAttribute(AttributeKeys.ERROR_MESSAGE, err.message);
+                    handlerSpan.setStatus({
+                        code: SpanStatusCode.ERROR,
+                        message: err.message
+                    });
+                    handlerSpan.recordException(err);
+                    handlerSpan.end();
+                });
+                return handlerResult;
+            });
+            if (result instanceof Error) {
+                if ('code' in result) {
+                    span.setAttribute(AttributeKeys.ERROR_CODE, result.code);
+                }
+                span.setAttribute(AttributeKeys.ERROR_MESSAGE, result.message);
+                span.setStatus({
+                    code: SpanStatusCode.ERROR,
+                    message: result.message
+                });
+                span.recordException(result);
+                span.end();
+                return result;
+            }
+            result.then(()=>{
+                span.setStatus({
+                    code: SpanStatusCode.OK
+                });
+                span.end();
+            }).catch((err)=>{
+                if ('code' in err) {
+                    span.setAttribute(AttributeKeys.ERROR_CODE, err.code);
+                }
+                span.setAttribute(AttributeKeys.ERROR_MESSAGE, err.message);
+                span.setStatus({
+                    code: SpanStatusCode.ERROR,
+                    message: err.message
+                });
+                span.recordException(err);
+                span.end();
+            });
+            return result;
+        };
+    }
+    const process = !params.requireAuth ? (message, handle)=>{
+        const span = createHandleSpan(message);
+        if (validator != null) {
+            span.addEvent('enkaku.validation', {
+                [AttributeKeys.VALIDATION_SUCCESS]: true
+            });
+        }
         if (!checkMessageEncryption(message)) {
+            span.setAttribute(AttributeKeys.AUTH_REASON, 'encryption_required');
+            span.setAttribute(AttributeKeys.ERROR_CODE, 'EK_ENCRYPTION');
+            span.setAttribute(AttributeKeys.ERROR_MESSAGE, 'Encryption required');
+            span.setStatus({
+                code: SpanStatusCode.ERROR,
+                message: 'Encryption required'
+            });
+            span.end();
             handleEncryptionViolation(message);
             return;
         }
-        processHandler(message, handle);
+        processHandler(message, wrapHandle(span, handle));
     } : async (message, handle)=>{
+        const span = createHandleSpan(message);
+        if (validator != null) {
+            span.addEvent('enkaku.validation', {
+                [AttributeKeys.VALIDATION_SUCCESS]: true
+            });
+        }
         try {
-            if (!params.public) {
-                if (!isSignedToken(message)) {
-                    throw new Error('Message is not signed');
-                }
-                await checkClientToken(params.serverID, params.access, message);
+            if (!isSignedToken(message)) {
+                span.setAttribute(AttributeKeys.AUTH_REASON, 'unsigned_message');
+                span.setAttribute(AttributeKeys.AUTH_ALLOWED, false);
+                throw new Error('Message is not signed');
             }
+            await checkClientToken(params.serverID, params.access, message, params.verifyToken != null ? {
+                verifyToken: params.verifyToken
+            } : undefined);
+            const did = message.payload.iss;
+            if (did != null) {
+                span.setAttribute(AttributeKeys.AUTH_DID, did);
+            }
+            span.setAttribute(AttributeKeys.AUTH_ALLOWED, true);
         } catch (cause) {
+            const did = isSignedToken(message) ? message.payload.iss : undefined;
+            if (did != null) {
+                span.setAttribute(AttributeKeys.AUTH_DID, did);
+            }
+            span.setAttribute(AttributeKeys.AUTH_ALLOWED, false);
+            if (!cause.message?.includes('unsigned')) {
+                span.setAttribute(AttributeKeys.AUTH_REASON, cause.message);
+            }
             const error = new HandlerError({
                 cause,
                 code: 'EK02',
                 message: cause.message ?? 'Access denied'
             });
+            span.setAttribute(AttributeKeys.ERROR_CODE, error.code);
+            span.setAttribute(AttributeKeys.ERROR_MESSAGE, error.message);
+            span.setStatus({
+                code: SpanStatusCode.ERROR,
+                message: error.message
+            });
+            span.recordException(error);
+            span.end();
             if (message.payload.typ === 'event') {
                 events.emit('eventAuthError', {
                     error,
@@ -202,10 +366,18 @@ async function handleMessages(params) {
             return;
         }
         if (!checkMessageEncryption(message)) {
+            span.setAttribute(AttributeKeys.AUTH_REASON, 'encryption_required');
+            span.setAttribute(AttributeKeys.ERROR_CODE, 'EK_ENCRYPTION');
+            span.setAttribute(AttributeKeys.ERROR_MESSAGE, 'Encryption required');
+            span.setStatus({
+                code: SpanStatusCode.ERROR,
+                message: 'Encryption required'
+            });
+            span.end();
             handleEncryptionViolation(message);
             return;
         }
-        processHandler(message, handle);
+        processHandler(message, wrapHandle(span, handle));
     };
     async function handleNext() {
         const next = await transport.read();
@@ -262,8 +434,8 @@ async function handleMessages(params) {
                             });
                             break;
                         }
-                        // In non-public mode, validate send messages against the channel owner
-                        if (!params.public) {
+                        // In authenticated mode, validate send messages against the channel owner
+                        if (params.requireAuth) {
                             if (!isSignedToken(msg)) {
                                 const error = new HandlerError({
                                     code: 'EK02',
@@ -307,6 +479,7 @@ export class Server extends Disposer {
     #handling = [];
     #limiter;
     #logger;
+    #tracer;
     #validator;
     constructor(params){
         super({
@@ -348,22 +521,37 @@ export class Server extends Disposer {
         this.#logger = params.logger ?? getEnkakuLogger('server', {
             serverID: serverID ?? this.#getRandomID()
         });
+        this.#tracer = params.tracer ?? defaultTracer;
+        const accessControl = params.accessControl;
         if (serverID == null) {
-            if (params.public) {
-                this.#accessControl = {
-                    public: true,
-                    access: params.access,
-                    encryptionPolicy: params.encryptionPolicy
-                };
-            } else {
-                throw new Error('Invalid server parameters: either the server "identity" must be provided or the "public" parameter must be set to true');
+            // No identity: accessControl must be explicitly false
+            if (accessControl !== false) {
+                throw new Error('Invalid server parameters: either "identity" must be provided or "accessControl" must be set to false');
             }
+            this.#accessControl = {
+                requireAuth: false,
+                access: {},
+                encryptionPolicy: params.encryptionPolicy,
+                verifyToken: params.verifyToken
+            };
+        } else if (accessControl === false) {
+            // Has identity but public access
+            this.#accessControl = {
+                requireAuth: false,
+                serverID,
+                access: {},
+                encryptionPolicy: params.encryptionPolicy,
+                verifyToken: params.verifyToken
+            };
         } else {
+            // Has identity with access control (true = server-only, record = granular)
+            const access = accessControl === true || accessControl == null ? {} : accessControl;
             this.#accessControl = {
-                public: !!params.public,
+                requireAuth: true,
                 serverID,
-                access: params.access ?? {},
-                encryptionPolicy: params.encryptionPolicy
+                access,
+                encryptionPolicy: params.encryptionPolicy,
+                verifyToken: params.verifyToken
             };
         }
         this.#limiter = createResourceLimiter(params.limits);
@@ -380,29 +568,38 @@ export class Server extends Disposer {
         return this.#events;
     }
     handle(transport, options = {}) {
-        const publicAccess = options.public ?? this.#accessControl.public;
-        const access = options.access ?? this.#accessControl.access ?? {};
+        const accessControlOverride = options.accessControl;
         const logger = options.logger ?? this.#logger.getChild('handler').with({
             transportID: this.#getRandomID()
         });
         const encryptionPolicy = this.#accessControl.encryptionPolicy;
         let accessControl;
-        if (publicAccess) {
+        if (accessControlOverride === false) {
             accessControl = {
-                public: true,
-                access,
-                encryptionPolicy
+                requireAuth: false,
+                access: this.#accessControl.access ?? {},
+                encryptionPolicy,
+                verifyToken: options.verifyToken ?? this.#accessControl.verifyToken
             };
-        } else {
+        } else if (accessControlOverride != null) {
+            // Override with true or ProcedureAccessRecord
             const serverID = this.#accessControl.serverID;
             if (serverID == null) {
-                return Promise.reject(new Error('Server ID is required to enable access control'));
+                return Promise.reject(new Error('Server identity is required to enable access control on transport'));
             }
+            const access = accessControlOverride === true ? {} : accessControlOverride;
             accessControl = {
-                public: false,
+                requireAuth: true,
                 serverID,
                 access,
-                encryptionPolicy
+                encryptionPolicy,
+                verifyToken: options.verifyToken ?? this.#accessControl.verifyToken
+            };
+        } else {
+            // Use server-level defaults
+            accessControl = {
+                ...this.#accessControl,
+                verifyToken: options.verifyToken ?? this.#accessControl.verifyToken
             };
         }
         const done = handleMessages({
@@ -411,6 +608,7 @@ export class Server extends Disposer {
             limiter: this.#limiter,
             logger,
             signal: this.#abortController.signal,
+            tracer: this.#tracer,
             transport,
             validator: this.#validator,
             ...accessControl

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enkaku/server",
-  "version": "0.13.3",
+  "version": "0.14.0",
   "license": "MIT",
   "homepage": "https://enkaku.dev",
   "description": "Server logic for Enkaku RPC",
@@ -25,17 +25,18 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@enkaku/async": "^0.13.0",
-    "@enkaku/event": "^0.13.0",
-    "@enkaku/capability": "^0.13.0",
-    "@enkaku/log": "^0.13.1",
-    "@enkaku/stream": "^0.13.0",
-    "@enkaku/protocol": "^0.13.0",
-    "@enkaku/token": "^0.13.0",
-    "@enkaku/schema": "^0.13.0"
+    "@enkaku/async": "^0.14.0",
+    "@enkaku/capability": "^0.14.0",
+    "@enkaku/otel": "^0.14.0",
+    "@enkaku/log": "^0.14.0",
+    "@enkaku/protocol": "^0.14.0",
+    "@enkaku/stream": "^0.14.0",
+    "@enkaku/event": "^0.14.0",
+    "@enkaku/schema": "^0.14.0",
+    "@enkaku/token": "^0.14.0"
   },
   "devDependencies": {
-    "@enkaku/transport": "^0.13.1"
+    "@enkaku/transport": "^0.14.0"
   },
   "scripts": {
     "build:clean": "del lib",