@grest-ts/http 0.0.47 → 0.0.49

package/dist/src/server/GGHttpServer.js

@@ -5,13 +5,17 @@ import { GGLocator, GGLocatorServiceType } from "@grest-ts/locator";
 import { GG_HTTP_SERVER } from "./GG_HTTP_SERVER.js";
 import { GGLog } from "@grest-ts/logger";
 import findMyWay from "find-my-way";
-import { describePermission, GG_NO_PERMISSIONS } from "@grest-ts/schema";
+import { checkWiresImplemented } from "./checkers/checkWiresImplemented.js";
+import { checkPermissionsAtStart } from "./checkers/checkPermissionsAtStart.js";
+import { checkWireConflicts } from "./checkers/checkWireConflicts.js";
+import "../schema/GGWireContextKey.node.js";
 export class GGHttpServer {
     _port;
     teardownPromise;
     scope;
     runtimeName;
     configuredPort;
+    cors;
     _onStart = [];
     _onTeardown = [];
     /**
@@ -19,14 +23,9 @@ export class GGHttpServer {
      * Framework-internal — only setupRoutes() (in GGHttpSchema.startServer.ts) should push here.
      */
     _registeredSchemas = [];
-    /**
-     * All GGHttpSchema instances registered on this server, in registration order.
-     * Available from the moment compose() begins; frozen (no further push allowed) once start() is called.
-     */
-    get registeredSchemas() {
-        return this._registeredSchemas;
-    }
+    _registeredWebSocketSchemas = [];
     httpServer;
+    _routeOwners = new Map();
     activeRequests = 0;
     router = findMyWay();
     static DEFAULT_CORS_HEADERS = ['Content-Type'];
@@ -38,6 +37,7 @@ export class GGHttpServer {
         this.runtimeName = GGLocator.getScope().serviceName;
         this.scope = GGLocator.getScope();
         this.configuredPort = config?.port ?? (process.env.PORT ? Number(process.env.PORT) : 0);
+        this.cors = config?.cors;
         GGLocator.getScope().setWithLifecycle(config?.key ?? GG_HTTP_SERVER, this, {
             type: GGLocatorServiceType.HTTP,
             start: this.start.bind(this),
@@ -51,14 +51,9 @@ export class GGHttpServer {
             }
             this.activeRequests++;
             try {
-                if (req.headers.origin) { // For browsers
-                    res.setHeader('Access-Control-Allow-Origin', '*');
-                    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS');
-                    res.setHeader('Access-Control-Allow-Headers', this._corsHeadersCache);
-                    if (this._corsExposeHeadersCache) {
-                        res.setHeader('Access-Control-Expose-Headers', this._corsExposeHeadersCache);
-                    }
-                }
+                const cors = corsResponseHeaders(req.headers.origin, this.cors, this._corsHeadersCache, this._corsExposeHeadersCache);
+                for (const name in cors)
+                    res.setHeader(name, cors[name]);
                 if (req.method === 'OPTIONS') {
                     res.writeHead(204);
                     res.end();
@@ -133,90 +128,39 @@ export class GGHttpServer {
     _registerSchema(schema) {
         this._registeredSchemas.push(schema);
     }
-    _registeredWebSocketSchemas = [];
     /**
-     * All GGWebSocketSchema instances registered on this server, in registration order.
-     * Populated automatically by GGWebSocketSchema.startServer() / .register().
+     * All GGHttpSchema instances registered on this server, in registration order.
+     * Available from the moment compose() begins; frozen (no further push allowed) once start() is called.
      */
-    get registeredWebSocketSchemas() {
-        return this._registeredWebSocketSchemas;
+    get registeredSchemas() {
+        return this._registeredSchemas;
     }
     /** @internal Called by GGWebSocketSchema.startServer(). Do not call directly. */
     _registerWebSocketSchema(schema) {
         this._registeredWebSocketSchemas.push(schema);
     }
-    _schemasWithResolver = new Set();
-    /** @internal Called by HTTP / WS register paths when a scope resolver is wired. */
-    _markResolverWired(schema) {
-        this._schemasWithResolver.add(schema);
+    /**
+     * All GGWebSocketSchema instances registered on this server, in registration order.
+     * Populated automatically by GGWebSocketSchema.startServer() / .register().
+     */
+    get registeredWebSocketSchemas() {
+        return this._registeredWebSocketSchemas;
     }
-    _checkPermissionsAtStart() {
-        const surfaces = [];
-        for (const schema of this._registeredSchemas) {
-            const resolverWired = this._schemasWithResolver.has(schema);
-            const methods = schema.contract?.methods ?? {};
-            for (const name of Object.keys(methods)) {
-                surfaces.push({
-                    label: `${schema.name}.${name}`,
-                    permission: methods[name].permission,
-                    resolverWired,
-                });
-            }
-        }
-        for (const ws of this._registeredWebSocketSchemas) {
-            const resolverWired = this._schemasWithResolver.has(ws);
-            const methods = ws.contract.clientToServer.methods;
-            for (const name of Object.keys(methods)) {
-                surfaces.push({
-                    label: `${ws.name}.${name}`,
-                    permission: methods[name].permission,
-                    resolverWired,
-                });
-            }
-            if (ws.connectPermission !== undefined) {
-                surfaces.push({
-                    label: `${ws.name} (connectPermission)`,
-                    permission: ws.connectPermission,
-                    resolverWired,
-                });
-            }
-        }
-        let strict = false;
-        const undeclared = [];
-        const orphaned = [];
-        for (const s of surfaces) {
-            if (s.permission !== undefined || s.resolverWired)
-                strict = true;
-            if (s.permission === undefined)
-                undeclared.push(s);
-            else if (s.permission !== GG_NO_PERMISSIONS && !s.resolverWired)
-                orphaned.push(s);
-        }
-        if (!strict)
-            return;
-        if (undeclared.length > 0) {
-            const lines = undeclared.map(s => `  ${s.label}`).join("\n");
-            throw new Error(`GGHttpServer: permission strict mode is active on this server ` +
-                `(at least one route declares a permission or has .usePermissions(...) wired), ` +
-                `but the following routes have no \`permission\` declared:\n\n` +
-                lines +
-                `\n\nFix: declare \`permission\` on every route — use \`GG_NO_PERMISSIONS\` for intentionally public ones.`);
-        }
-        if (orphaned.length > 0) {
-            const lines = orphaned.map(s => `  ${s.label}   requires ${describePermission(s.permission)}`).join("\n");
-            throw new Error(`GGHttpServer: these routes declare non-public permissions but their schema was ` +
-                `registered without a scope resolver:\n\n` +
-                lines +
-                `\n\nFix: call \`.usePermissions(yourResolver)\` on the GGHttp chain (or pass ` +
-                `\`permissionResolver\` to the WS schema config) before registering these routes.`);
+    registerRoute(method, path, handler, owner) {
+        const route = `${method} ${path}`;
+        const existing = this._routeOwners.get(route);
+        if (existing !== undefined) {
+            throw new Error(`GGHttpServer: route ${route} is declared by both ${existing} and ${owner ?? "another route"}. ` +
+                `Give each route a distinct path (change a pathPrefix or route path).`);
         }
-    }
-    registerRoute(method, path, handler) {
+        this._routeOwners.set(route, owner ?? path);
         this.router.on(method, path, handler);
     }
     async start() {
         Object.freeze(this._registeredSchemas);
-        this._checkPermissionsAtStart();
+        checkWireConflicts(this.registeredSchemas, this.registeredWebSocketSchemas);
+        checkWiresImplemented(this.registeredSchemas, this.registeredWebSocketSchemas);
+        checkPermissionsAtStart(this.registeredSchemas, this.registeredWebSocketSchemas);
         this._port = await new Promise((resolve) => {
             this.httpServer.listen(this.configuredPort, '0.0.0.0', () => {
                 const port = this.httpServer.address().port;
@@ -253,4 +197,34 @@ export class GGHttpServer {
         return this;
     }
 }
+/**
+ * Computes CORS response headers for a request Origin. Pure (no req/res) so it is
+ * unit-testable. Default (no config) = permissive `*`, no credentials. With config =
+ * allowlisted: only a matching Origin is echoed (never `*`), `credentials` adds
+ * Allow-Credentials, and Vary: Origin is always set so caches key on the origin.
+ */
+export function corsResponseHeaders(origin, cors, allowHeaders, exposeHeaders) {
+    if (!origin)
+        return {};
+    const headers = {};
+    if (cors) {
+        // Never reflect the literal "null" origin (sandboxed iframe / file:// / opaque
+        // origins) with credentials — the classic null-origin credential-leak footgun.
+        const allowed = origin !== "null" && (Array.isArray(cors.origins) ? cors.origins.includes(origin) : cors.origins(origin));
+        headers['Vary'] = 'Origin';
+        if (!allowed)
+            return headers;
+        headers['Access-Control-Allow-Origin'] = origin;
+        if (cors.credentials)
+            headers['Access-Control-Allow-Credentials'] = 'true';
+    }
+    else {
+        headers['Access-Control-Allow-Origin'] = '*';
+    }
+    headers['Access-Control-Allow-Methods'] = 'GET, POST, PUT, PATCH, DELETE, OPTIONS';
+    headers['Access-Control-Allow-Headers'] = allowHeaders;
+    if (exposeHeaders)
+        headers['Access-Control-Expose-Headers'] = exposeHeaders;
+    return headers;
+}
 //# sourceMappingURL=GGHttpServer.js.map

package/dist/src/server/GGHttpServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"GGHttpServer.js","sourceRoot":"","sources":["../../../src/server/GGHttpServer.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAa,cAAc,EAAC,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAC,SAAS,EAAgC,oBAAoB,EAAC,MAAM,mBAAmB,CAAC;AAChG,OAAO,EAAC,cAAc,EAAC,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAC,KAAK,EAAC,MAAM,kBAAkB,CAAC;AACvC,OAAO,SAAuB,MAAM,aAAa,CAAC;AAElD,OAAO,EAAC,kBAAkB,EAAE,iBAAiB,EAAiC,MAAM,kBAAkB,CAAC;AA4BvG,MAAM,OAAO,YAAY;IAEX,KAAK,CAAqB;IAC1B,eAAe,CAA4B;IAClC,KAAK,CAAiB;IACtB,WAAW,CAAS;IACtB,cAAc,CAAS;IAEvB,QAAQ,GAAsB,EAAE,CAAC;IACjC,WAAW,GAAsB,EAAE,CAAC;IAErD;;;OAGG;IACc,kBAAkB,GAA6B,EAAE,CAAC;IAEnE;;;OAGG;IACH,IAAI,iBAAiB;QACjB,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACnC,CAAC;IAEe,UAAU,CAAc;IAChC,cAAc,GAAG,CAAC,CAAC;IACnB,MAAM,GAAG,SAAS,EAA4B,CAAC;IAE/C,MAAM,CAAU,oBAAoB,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/C,YAAY,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,oBAAoB,CAAC,CAAC;IAC3E,iBAAiB,GAAW,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhE,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAChD,uBAAuB,GAAW,EAAE,CAAC;IAE7C,YAAY,MAAkC;QAE1C,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,cAAc,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAExF,SAAS,CAAC,QAAQ,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,IAAI,cAAc,EAAE,IAAI,EAAE;YACvE,IAAI,EAAE,oBAAoB,CAAC,IAAI;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;SACrC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,KAAK,EAAE,GAAyB,EAAE,GAAwB,EAAE,EAAE;YAC1E,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACvB,GAAG,CAAC,UAAU,GAAG,cAAc,CAAC,gCAAgC,CAAC;gBACjE,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACX,CAAC;YACD,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,IAAI,CAAC;gBACD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,eAAe;oBACrC,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;oBAClD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,wCAAwC,CAAC,CAAC;oBACxF,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBACtE,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;wBAC/B,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC;oBACjF,CAAC;gBACL,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC3B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACd,CAAC;qBAAM,CAAC;oBACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAoB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;oBACpE,IAAI,QAAQ,EAAE,CAAC;wBACX,MAAO,QAAQ,CAAC,OAA4C,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAC3E,CAAC;yBAAM,CAAC;wBACJ,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;oBACd,CAAC;gBACL,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACd,CAAC;oBAAS,CAAC;gBACP,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1B,CAAC;QACL,CAAC,CAAC;QAEF,IAAI,CAAC,UAAU,GAAG,MAAM,EAAE,GAAG;YACzB,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,EAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAC,EAAE,OAAO,CAAC;YAC3E,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACI,mBAAmB,CAAC,OAA0B;QACjD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACzB,OAAO,GAAG,IAAI,CAAC;YACnB,CAAC;QACL,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,yBAAyB,CAAC,OAA0B;QACvD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC/B,OAAO,GAAG,IAAI,CAAC;YACnB,CAAC;QACL,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,IAAI,IAAI;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,4EAA4E;IAC5E,wBAAwB;IACxB,4EAA4E;IAE5E,gFAAgF;IACzE,eAAe,CAAC,MAA8B;QACjD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAEgB,2BAA2B,GAAyB,EAAE,CAAC;IAExE;;;OAGG;IACH,IAAI,0BAA0B;QAC1B,OAAO,IAAI,CAAC,2BAA2B,CAAC;IAC5C,CAAC;IAED,iFAAiF;IAC1E,wBAAwB,CAAC,MAA0B;QACtD,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAEgB,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1D,mFAAmF;IAC5E,kBAAkB,CAAC,MAAc;QACpC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAEO,wBAAwB;QAE5B,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC;YAC/C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,QAAQ,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE;oBAC/B,UAAU,EAAG,OAAO,CAAC,IAAI,CAAsB,CAAC,UAAU;oBAC1D,aAAa;iBAChB,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAChD,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC;YACnD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,QAAQ,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,IAAI,EAAE;oBAC3B,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU;oBACpC,aAAa;iBAChB,CAAC,CAAC;YACP,CAAC;YACD,IAAI,EAAE,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACrC,QAAQ,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,sBAAsB;oBACvC,UAAU,EAAE,EAAE,CAAC,iBAAiB;oBAChC,aAAa;iBAChB,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QAED,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,MAAM,UAAU,GAAc,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,aAAa;gBAAE,MAAM,GAAG,IAAI,CAAC;YACjE,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;gBAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;iBAC9C,IAAI,CAAC,CAAC,UAAU,KAAK,iBAAiB,IAAI,CAAC,CAAC,CAAC,aAAa;gBAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7D,MAAM,IAAI,KAAK,CACX,gEAAgE;gBAChE,gFAAgF;gBAChF,+DAA+D;gBAC/D,KAAK;gBACL,2GAA2G,CAC9G,CAAC;QACN,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC3B,KAAK,CAAC,CAAC,KAAK,eAAe,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAChE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,MAAM,IAAI,KAAK,CACX,iFAAiF;gBACjF,0CAA0C;gBAC1C,KAAK;gBACL,+EAA+E;gBAC/E,kFAAkF,CACrF,CAAC;QACN,CAAC;IACL,CAAC;IAEM,aAAa,CAAC,MAAkB,EAAE,IAAY,EAAE,OAA8B;QACjF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAoB,EAAE,IAAI,EAAE,OAAiE,CAAC,CAAC;IAClH,CAAC;IAEM,KAAK,CAAC,KAAK;QACd,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACvC,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,EAAE;gBACxD,MAAM,IAAI,GAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAU,CAAC,IAAI,CAAC;gBACrD,OAAO,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,EAAE;YACpC,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,OAAO,EAAE,IAAI,CAAC,WAAW;SAC5B,CAAC,CAAC;IACP,CAAC;IAEM,KAAK,CAAC,QAAQ;QACjB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,eAAe,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE;YACtC,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAChE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,WAAW,GAAG,IAAI,CAAC;YACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;YACjD,OAAO,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC7D,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1D,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAEM,OAAO,CAAC,QAAoC;QAC/C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IAChB,CAAC;IAEM,UAAU,CAAC,QAAoC;QAClD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IAChB,CAAC"}
+{"version":3,"file":"GGHttpServer.js","sourceRoot":"","sources":["../../../src/server/GGHttpServer.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAa,cAAc,EAAC,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAC,SAAS,EAAgC,oBAAoB,EAAC,MAAM,mBAAmB,CAAC;AAChG,OAAO,EAAC,cAAc,EAAC,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAC,KAAK,EAAC,MAAM,kBAAkB,CAAC;AACvC,OAAO,SAAuB,MAAM,aAAa,CAAC;AAElD,OAAO,EAAC,qBAAqB,EAAC,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAC,uBAAuB,EAAC,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAC,kBAAkB,EAAC,MAAM,+BAA+B,CAAC;AACjE,OAAO,iCAAiC,CAAC;AAuDzC,MAAM,OAAO,YAAY;IAEX,KAAK,CAAqB;IAC1B,eAAe,CAA4B;IAClC,KAAK,CAAiB;IACtB,WAAW,CAAS;IACtB,cAAc,CAAS;IACvB,IAAI,CAAgB;IAEpB,QAAQ,GAAsB,EAAE,CAAC;IACjC,WAAW,GAAsB,EAAE,CAAC;IAErD;;;OAGG;IACc,kBAAkB,GAA6B,EAAE,CAAC;IAClD,2BAA2B,GAAyB,EAAE,CAAC;IAExD,UAAU,CAAc;IACvB,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,cAAc,GAAG,CAAC,CAAC;IACnB,MAAM,GAAG,SAAS,EAA4B,CAAC;IAE/C,MAAM,CAAU,oBAAoB,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/C,YAAY,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,oBAAoB,CAAC,CAAC;IAC3E,iBAAiB,GAAW,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhE,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAChD,uBAAuB,GAAW,EAAE,CAAC;IAE7C,YAAY,MAAkC;QAE1C,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,cAAc,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;QAEzB,SAAS,CAAC,QAAQ,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,IAAI,cAAc,EAAE,IAAI,EAAE;YACvE,IAAI,EAAE,oBAAoB,CAAC,IAAI;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;SACrC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,KAAK,EAAE,GAAyB,EAAE,GAAwB,EAAE,EAAE;YAC1E,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACvB,GAAG,CAAC,UAAU,GAAG,cAAc,CAAC,gCAAgC,CAAC;gBACjE,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACX,CAAC;YACD,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBACtH,KAAK,MAAM,IAAI,IAAI,IAAI;oBAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC3B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACd,CAAC;qBAAM,CAAC;oBACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAoB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;oBACpE,IAAI,QAAQ,EAAE,CAAC;wBACX,MAAO,QAAQ,CAAC,OAA4C,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAC3E,CAAC;yBAAM,CAAC;wBACJ,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;oBACd,CAAC;gBACL,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACd,CAAC;oBAAS,CAAC;gBACP,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1B,CAAC;QACL,CAAC,CAAC;QAEF,IAAI,CAAC,UAAU,GAAG,MAAM,EAAE,GAAG;YACzB,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,EAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAC,EAAE,OAAO,CAAC;YAC3E,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACI,mBAAmB,CAAC,OAA0B;QACjD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACzB,OAAO,GAAG,IAAI,CAAC;YACnB,CAAC;QACL,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,yBAAyB,CAAC,OAA0B;QACvD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC/B,OAAO,GAAG,IAAI,CAAC;YACnB,CAAC;QACL,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,IAAI,IAAI;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,4EAA4E;IAC5E,wBAAwB;IACxB,4EAA4E;IAE5E,gFAAgF;IACzE,eAAe,CAAC,MAA8B;QACjD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACH,IAAI,iBAAiB;QACjB,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACnC,CAAC;IAED,iFAAiF;IAC1E,wBAAwB,CAAC,MAA0B;QACtD,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACH,IAAI,0BAA0B;QAC1B,OAAO,IAAI,CAAC,2BAA2B,CAAC;IAC5C,CAAC;IAEM,aAAa,CAAC,MAAkB,EAAE,IAAY,EAAE,OAA8B,EAAE,KAAc;QACjG,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACX,uBAAuB,KAAK,wBAAwB,QAAQ,QAAQ,KAAK,IAAI,eAAe,IAAI;gBAChG,sEAAsE,CACzE,CAAC;QACN,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAoB,EAAE,IAAI,EAAE,OAAiE,CAAC,CAAC;IAClH,CAAC;IAEM,KAAK,CAAC,KAAK;QACd,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACvC,kBAAkB,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC5E,qBAAqB,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC/E,uBAAuB,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACjF,IAAI,CAAC,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,EAAE;gBACxD,MAAM,IAAI,GAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAU,CAAC,IAAI,CAAC;gBACrD,OAAO,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,EAAE;YACpC,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,OAAO,EAAE,IAAI,CAAC,WAAW;SAC5B,CAAC,CAAC;IACP,CAAC;IAEM,KAAK,CAAC,QAAQ;QACjB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,eAAe,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE;YACtC,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAChE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,WAAW,GAAG,IAAI,CAAC;YACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;YACjD,OAAO,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC7D,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1D,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAEM,OAAO,CAAC,QAAoC;QAC/C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IAChB,CAAC;IAEM,UAAU,CAAC,QAAoC;QAClD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IAChB,CAAC;;AAKL;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAC/B,MAA0B,EAC1B,IAA8B,EAC9B,YAAoB,EACpB,aAAqB;IAErB,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,IAAI,EAAE,CAAC;QACP,+EAA+E;QAC/E,+EAA+E;QAC/E,MAAM,OAAO,GAAG,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1H,OAAO,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC;QAC3B,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC;QAC7B,OAAO,CAAC,6BAA6B,CAAC,GAAG,MAAM,CAAC;QAChD,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,kCAAkC,CAAC,GAAG,MAAM,CAAC;IAC/E,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,6BAA6B,CAAC,GAAG,GAAG,CAAC;IACjD,CAAC;IACD,OAAO,CAAC,8BAA8B,CAAC,GAAG,wCAAwC,CAAC;IACnF,OAAO,CAAC,8BAA8B,CAAC,GAAG,YAAY,CAAC;IACvD,IAAI,aAAa;QAAE,OAAO,CAAC,+BAA+B,CAAC,GAAG,aAAa,CAAC;IAC5E,OAAO,OAAO,CAAC;AACnB,CAAC"}

package/dist/src/server/applyRequestMiddleware.d.ts

@@ -0,0 +1,11 @@
+import type http from "http";
+import type { GGTransportMiddleware } from "@grest-ts/context";
+/**
+ * Normalizes a Node request + parsed query into a GGInbound and runs the server-side
+ * pipeline: every parse() (populating context keys) before any process() (async
+ * validation), so a middleware can validate against a key an earlier one parsed.
+ * The cookie is taken only from the real request header — never from anywhere a
+ * client could forge — preserving the anti-spoof guarantee on every transport.
+ */
+export declare function applyRequestMiddleware(req: http.IncomingMessage, queryArgs: Record<string, string | string[]>, middlewares: readonly GGTransportMiddleware[]): Promise<void>;
+//# sourceMappingURL=applyRequestMiddleware.d.ts.map

package/dist/src/server/applyRequestMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applyRequestMiddleware.d.ts","sourceRoot":"","sources":["../../../src/server/applyRequestMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAY,qBAAqB,EAAC,MAAM,mBAAmB,CAAC;AAExE;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CACxC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,EAC5C,WAAW,EAAE,SAAS,qBAAqB,EAAE,GAC9C,OAAO,CAAC,IAAI,CAAC,CAgBf"}

package/dist/src/server/applyRequestMiddleware.js

@@ -0,0 +1,38 @@
+/**
+ * Normalizes a Node request + parsed query into a GGInbound and runs the server-side
+ * pipeline: every parse() (populating context keys) before any process() (async
+ * validation), so a middleware can validate against a key an earlier one parsed.
+ * The cookie is taken only from the real request header — never from anywhere a
+ * client could forge — preserving the anti-spoof guarantee on every transport.
+ */
+export async function applyRequestMiddleware(req, queryArgs, middlewares) {
+    if (middlewares.length === 0)
+        return;
+    const inbound = {
+        headers: flatten(req.headers),
+        cookie: typeof req.headers.cookie === "string" ? req.headers.cookie : undefined,
+        query: flatten(queryArgs)
+    };
+    for (const mw of middlewares)
+        mw.parse?.(inbound);
+    // finally: a rejecting process() (e.g. anonymous → NOT_AUTHORIZED) must still drop every
+    // ephemeral credential — including those an earlier wire already parsed — so no raw token
+    // outlives the failed request in context.
+    try {
+        for (const mw of middlewares)
+            await mw.process?.();
+    }
+    finally {
+        for (const mw of middlewares)
+            mw.clear?.();
+    }
+}
+function flatten(src) {
+    const out = {};
+    for (const key in src) {
+        const value = src[key];
+        out[key] = Array.isArray(value) ? value[0] : value;
+    }
+    return out;
+}
+//# sourceMappingURL=applyRequestMiddleware.js.map

package/dist/src/server/applyRequestMiddleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applyRequestMiddleware.js","sourceRoot":"","sources":["../../../src/server/applyRequestMiddleware.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,GAAyB,EACzB,SAA4C,EAC5C,WAA6C;IAE7C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACrC,MAAM,OAAO,GAAc;QACvB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAC7B,MAAM,EAAE,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC/E,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC;KAC5B,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,WAAW;QAAE,EAAE,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC;IAClD,yFAAyF;IACzF,0FAA0F;IAC1F,0CAA0C;IAC1C,IAAI,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,WAAW;YAAE,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;IACvD,CAAC;YAAS,CAAC;QACP,KAAK,MAAM,EAAE,IAAI,WAAW;YAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;IAC/C,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,GAAkD;IAC/D,MAAM,GAAG,GAAuC,EAAE,CAAC;IACnD,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/src/server/applyResponseMiddleware.d.ts

@@ -0,0 +1,12 @@
+import type http from "http";
+import type { GGTransportMiddleware } from "@grest-ts/context";
+/**
+ * Runs the transport chain's server-side response hook and writes the collected
+ * headers onto the Node response. Applied via setHeader (not writeHead) so a
+ * string[] value emits one header line per element — the only way to send
+ * multiple Set-Cookie headers — and so the codec's later writeHead(Content-*)
+ * merges rather than clobbers. Must run inside the request GGContext so a
+ * middleware can read per-request staged state.
+ */
+export declare function applyResponseMiddleware(res: http.ServerResponse, middlewares: readonly GGTransportMiddleware[] | undefined): void;
+//# sourceMappingURL=applyResponseMiddleware.d.ts.map

package/dist/src/server/applyResponseMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applyResponseMiddleware.d.ts","sourceRoot":"","sources":["../../../src/server/applyResponseMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAa,qBAAqB,EAAC,MAAM,mBAAmB,CAAC;AAEzE;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACnC,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,WAAW,EAAE,SAAS,qBAAqB,EAAE,GAAG,SAAS,GAC1D,IAAI,CAYN"}

package/dist/src/server/applyResponseMiddleware.js

@@ -0,0 +1,25 @@
+/**
+ * Runs the transport chain's server-side response hook and writes the collected
+ * headers onto the Node response. Applied via setHeader (not writeHead) so a
+ * string[] value emits one header line per element — the only way to send
+ * multiple Set-Cookie headers — and so the codec's later writeHead(Content-*)
+ * merges rather than clobbers. Must run inside the request GGContext so a
+ * middleware can read per-request staged state.
+ */
+export function applyResponseMiddleware(res, middlewares) {
+    if (!middlewares?.length || res.headersSent)
+        return;
+    let response;
+    for (const mw of middlewares) {
+        if (!mw.respond)
+            continue;
+        response ??= { headers: {} };
+        mw.respond(response);
+    }
+    if (!response)
+        return;
+    for (const name in response.headers) {
+        res.setHeader(name, response.headers[name]);
+    }
+}
+//# sourceMappingURL=applyResponseMiddleware.js.map

package/dist/src/server/applyResponseMiddleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applyResponseMiddleware.js","sourceRoot":"","sources":["../../../src/server/applyResponseMiddleware.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACnC,GAAwB,EACxB,WAAyD;IAEzD,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO;IACpD,IAAI,QAAgC,CAAC;IACrC,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE,CAAC,OAAO;YAAE,SAAS;QAC1B,QAAQ,KAAK,EAAC,OAAO,EAAE,EAAE,EAAC,CAAC;QAC3B,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAClC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;AACL,CAAC"}

package/dist/src/server/checkers/checkPermissionsAtStart.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Run at GGHttpServer.start() over the frozen schema graph. Three permission-coherence checks:
+ *
+ *  - strict-mode coverage: once any route declares a permission, every route on the server must
+ *    declare one (use GG_NO_PERMISSIONS for intentionally public routes).
+ *  - unsatisfiable route: a route requiring a non-public permission on a schema with no
+ *    permission-resolving wire (a .define()d wire whose handler exposes permissions()) can never
+ *    pass the gate — its pooled grants are always empty, so it is permanently FORBIDDEN.
+ *  - dead serverToClient permission: the gate has no caller identity for server-pushed messages,
+ *    so a non-public permission on a WS serverToClient method is silently ignored.
+ *
+ * Scopes come only from the schema's wires; there is no resolver wiring.
+ */
+import { GGContractMethod, GGPermission } from "@grest-ts/schema";
+import type { GGTransportMiddleware } from "@grest-ts/context";
+import "../../schema/GGWireContextKey.node";
+interface HttpSchemaLike {
+    name: string;
+    apiMiddlewares: readonly GGTransportMiddleware[];
+    contract?: {
+        methods: Record<string, GGContractMethod>;
+    };
+}
+interface WebSocketSchemaLike {
+    name: string;
+    middlewares: readonly GGTransportMiddleware[];
+    contract: {
+        clientToServer: {
+            methods: Record<string, GGContractMethod>;
+        };
+        serverToClient: {
+            methods: Record<string, GGContractMethod>;
+        };
+    };
+    connectPermission?: GGPermission;
+}
+export declare function checkPermissionsAtStart(httpSchemas: readonly HttpSchemaLike[], webSocketSchemas: readonly WebSocketSchemaLike[]): void;
+export {};
+//# sourceMappingURL=checkPermissionsAtStart.d.ts.map

package/dist/src/server/checkers/checkPermissionsAtStart.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkPermissionsAtStart.d.ts","sourceRoot":"","sources":["../../../../src/server/checkers/checkPermissionsAtStart.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAoB,gBAAgB,EAAE,YAAY,EAAC,MAAM,kBAAkB,CAAA;AAClF,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,mBAAmB,CAAA;AAE5D,OAAO,oCAAoC,CAAA;AAE3C,UAAU,cAAc;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,SAAS,qBAAqB,EAAE,CAAA;IAChD,QAAQ,CAAC,EAAE;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;KAAC,CAAA;CACzD;AAED,UAAU,mBAAmB;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,SAAS,qBAAqB,EAAE,CAAA;IAC7C,QAAQ,EAAE;QACN,cAAc,EAAE;YAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;SAAC,CAAA;QAC3D,cAAc,EAAE;YAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;SAAC,CAAA;KAC9D,CAAA;IACD,iBAAiB,CAAC,EAAE,YAAY,CAAA;CACnC;AAUD,wBAAgB,uBAAuB,CACnC,WAAW,EAAE,SAAS,cAAc,EAAE,EACtC,gBAAgB,EAAE,SAAS,mBAAmB,EAAE,GACjD,IAAI,CAkEN"}

package/dist/src/server/checkers/checkPermissionsAtStart.js

@@ -0,0 +1,82 @@
+/**
+ * Run at GGHttpServer.start() over the frozen schema graph. Three permission-coherence checks:
+ *
+ *  - strict-mode coverage: once any route declares a permission, every route on the server must
+ *    declare one (use GG_NO_PERMISSIONS for intentionally public routes).
+ *  - unsatisfiable route: a route requiring a non-public permission on a schema with no
+ *    permission-resolving wire (a .define()d wire whose handler exposes permissions()) can never
+ *    pass the gate — its pooled grants are always empty, so it is permanently FORBIDDEN.
+ *  - dead serverToClient permission: the gate has no caller identity for server-pushed messages,
+ *    so a non-public permission on a WS serverToClient method is silently ignored.
+ *
+ * Scopes come only from the schema's wires; there is no resolver wiring.
+ */
+import { GG_NO_PERMISSIONS } from "@grest-ts/schema";
+import { GGWireContextKey } from "../../schema/GGWireContextKey.js";
+import "../../schema/GGWireContextKey.node.js";
+function isNonPublic(permission) {
+    return permission !== undefined && permission !== GG_NO_PERMISSIONS;
+}
+function hasPermissionWire(wires) {
+    return wires.some(mw => mw instanceof GGWireContextKey && mw.hasPermissions());
+}
+export function checkPermissionsAtStart(httpSchemas, webSocketSchemas) {
+    const surfaces = [];
+    const deadServerToClient = [];
+    for (const schema of httpSchemas) {
+        const hasWire = hasPermissionWire(schema.apiMiddlewares);
+        const methods = schema.contract?.methods ?? {};
+        for (const name of Object.keys(methods)) {
+            surfaces.push({ label: `${schema.name}.${name}`, permission: methods[name].permission, hasWire });
+        }
+    }
+    for (const ws of webSocketSchemas) {
+        const hasWire = hasPermissionWire(ws.middlewares);
+        const methods = ws.contract.clientToServer.methods;
+        for (const name of Object.keys(methods)) {
+            surfaces.push({ label: `${ws.name}.${name}`, permission: methods[name].permission, hasWire });
+        }
+        if (ws.connectPermission !== undefined) {
+            surfaces.push({ label: `${ws.name} (connectPermission)`, permission: ws.connectPermission, hasWire });
+        }
+        const pushed = ws.contract.serverToClient.methods;
+        for (const name of Object.keys(pushed)) {
+            if (isNonPublic(pushed[name].permission))
+                deadServerToClient.push(`  ${ws.name}.${name}`);
+        }
+    }
+    if (deadServerToClient.length > 0) {
+        throw new Error(`GGHttpServer: these WebSocket serverToClient methods declare a non-public permission, ` +
+            `but server-pushed messages have no caller to gate — the permission is silently ignored:\n\n` +
+            deadServerToClient.join("\n") +
+            `\n\nFix: set \`permission: GG_NO_PERMISSIONS\` on serverToClient methods.`);
+    }
+    const unsatisfiable = surfaces.filter(s => isNonPublic(s.permission) && !s.hasWire);
+    if (unsatisfiable.length > 0) {
+        const lines = unsatisfiable.map(s => `  ${s.label}`).join("\n");
+        throw new Error(`GGHttpServer: these routes require a permission but their schema .use()s no wire that ` +
+            `resolves permissions — they can never pass the gate (permanently FORBIDDEN):\n\n` +
+            lines +
+            `\n\nFix: .use() an auth wire whose handler exposes permissions(), or set the route to ` +
+            `\`GG_NO_PERMISSIONS\` if it is meant to be public.`);
+    }
+    let strict = false;
+    const undeclared = [];
+    for (const s of surfaces) {
+        if (s.permission !== undefined)
+            strict = true;
+        if (s.permission === undefined)
+            undeclared.push(s);
+    }
+    if (!strict)
+        return;
+    if (undeclared.length > 0) {
+        const lines = undeclared.map(s => `  ${s.label}`).join("\n");
+        throw new Error(`GGHttpServer: permission strict mode is active on this server ` +
+            `(at least one route declares a permission), ` +
+            `but the following routes have no \`permission\` declared:\n\n` +
+            lines +
+            `\n\nFix: declare \`permission\` on every route — use \`GG_NO_PERMISSIONS\` for intentionally public ones.`);
+    }
+}
+//# sourceMappingURL=checkPermissionsAtStart.js.map

package/dist/src/server/checkers/checkPermissionsAtStart.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkPermissionsAtStart.js","sourceRoot":"","sources":["../../../../src/server/checkers/checkPermissionsAtStart.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAC,iBAAiB,EAAiC,MAAM,kBAAkB,CAAA;AAElF,OAAO,EAAC,gBAAgB,EAAC,MAAM,+BAA+B,CAAA;AAC9D,OAAO,oCAAoC,CAAA;AAkB3C,SAAS,WAAW,CAAC,UAAoC;IACrD,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,iBAAiB,CAAA;AACvE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAuC;IAC9D,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,YAAY,gBAAgB,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC,CAAA;AAClF,CAAC;AAED,MAAM,UAAU,uBAAuB,CACnC,WAAsC,EACtC,gBAAgD;IAGhD,MAAM,QAAQ,GAAc,EAAE,CAAA;IAC9B,MAAM,kBAAkB,GAAa,EAAE,CAAA;IAEvC,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;QACxD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAA;QAC9C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,EAAC,CAAC,CAAA;QACnG,CAAC;IACL,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,gBAAgB,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,CAAC,WAAW,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAA;QAClD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,EAAC,CAAC,CAAA;QAC/F,CAAC;QACD,IAAI,EAAE,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,sBAAsB,EAAE,UAAU,EAAE,EAAE,CAAC,iBAAiB,EAAE,OAAO,EAAC,CAAC,CAAA;QACvG,CAAC;QACD,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAA;QACjD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;gBAAE,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;QAC7F,CAAC;IACL,CAAC;IAED,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACX,wFAAwF;YACxF,6FAA6F;YAC7F,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,2EAA2E,CAC9E,CAAA;IACL,CAAC;IAED,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IACnF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/D,MAAM,IAAI,KAAK,CACX,wFAAwF;YACxF,kFAAkF;YAClF,KAAK;YACL,wFAAwF;YACxF,oDAAoD,CACvD,CAAA;IACL,CAAC;IAED,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,MAAM,UAAU,GAAc,EAAE,CAAA;IAChC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;YAAE,MAAM,GAAG,IAAI,CAAA;QAC7C,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACtD,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAM;IAEnB,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5D,MAAM,IAAI,KAAK,CACX,gEAAgE;YAChE,8CAA8C;YAC9C,+DAA+D;YAC/D,KAAK;YACL,2GAA2G,CAC9G,CAAA;IACL,CAAC;AACL,CAAC"}

package/dist/src/server/checkers/checkWireConflicts.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Run at GGHttpServer.start() over the frozen schema graph: the wires a single schema .use()s
+ * must not conflict with each other. Two conflicts are caught:
+ *   - same context-key name → both wires resolve to one storage slot; parse() of one clobbers
+ *     the value the other read.
+ *   - same inbound header / cookie → both wires read (and a client writes) the same transport
+ *     field; one silently overwrites the other in parse()/update().
+ * Both are per-schema: the same wire reused across different schemas is fine.
+ */
+import type { GGTransportMiddleware } from "@grest-ts/context";
+export declare function checkWireConflicts(httpSchemas: readonly {
+    name: string;
+    apiMiddlewares: readonly GGTransportMiddleware[];
+}[], webSocketSchemas: readonly {
+    name: string;
+    middlewares: readonly GGTransportMiddleware[];
+}[]): void;
+//# sourceMappingURL=checkWireConflicts.d.ts.map

package/dist/src/server/checkers/checkWireConflicts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkWireConflicts.d.ts","sourceRoot":"","sources":["../../../../src/server/checkers/checkWireConflicts.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,mBAAmB,CAAA;AAe5D,wBAAgB,kBAAkB,CAC9B,WAAW,EAAE,SAAS;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,SAAS,qBAAqB,EAAE,CAAA;CAAC,EAAE,EACxF,gBAAgB,EAAE,SAAS;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,SAAS,qBAAqB,EAAE,CAAA;CAAC,EAAE,GAC3F,IAAI,CAqCN"}

package/dist/src/server/checkers/checkWireConflicts.js

@@ -0,0 +1,43 @@
+import { GGWireContextKey } from "../../schema/GGWireContextKey.js";
+function transportKeys(mw) {
+    return [
+        ...Object.keys(mw.headers ?? {}).map(h => `header "${h.toLowerCase()}"`),
+        ...Object.keys(mw.cookieParams ?? {}).map(c => `cookie "${c}"`),
+    ];
+}
+export function checkWireConflicts(httpSchemas, webSocketSchemas) {
+    const schemas = [
+        ...httpSchemas.map(s => ({ name: s.name, wires: s.apiMiddlewares })),
+        ...webSocketSchemas.map(s => ({ name: s.name, wires: s.middlewares })),
+    ];
+    const conflicts = [];
+    for (const schema of schemas) {
+        const names = new Map();
+        const fields = new Map();
+        for (const mw of schema.wires) {
+            if (mw instanceof GGWireContextKey) {
+                if (names.has(mw.name)) {
+                    conflicts.push(`  ${schema.name}: two wires share context-key name "${mw.name}"`);
+                }
+                else {
+                    names.set(mw.name, mw);
+                }
+            }
+            for (const field of transportKeys(mw)) {
+                if (fields.has(field)) {
+                    conflicts.push(`  ${schema.name}: two wires bind the same ${field}`);
+                }
+                else {
+                    fields.set(field, mw);
+                }
+            }
+        }
+    }
+    if (conflicts.length > 0) {
+        throw new Error(`GGHttpServer: conflicting wires .use()d on one schema:\n\n` +
+            conflicts.join("\n") +
+            `\n\nFix: a schema must not .use() two wires that share a context-key name or read the ` +
+            `same header/cookie — one silently clobbers the other.`);
+    }
+}
+//# sourceMappingURL=checkWireConflicts.js.map

package/dist/src/server/checkers/checkWireConflicts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkWireConflicts.js","sourceRoot":"","sources":["../../../../src/server/checkers/checkWireConflicts.ts"],"names":[],"mappings":"AAUA,OAAO,EAAC,gBAAgB,EAAC,MAAM,+BAA+B,CAAA;AAO9D,SAAS,aAAa,CAAC,EAAyB;IAC5C,OAAO;QACH,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC;QACxE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;KAClE,CAAA;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAC9B,WAAwF,EACxF,gBAA0F;IAE1F,MAAM,OAAO,GAAiB;QAC1B,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,cAAc,EAAC,CAAC,CAAC;QAClE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,EAAC,CAAC,CAAC;KACvE,CAAA;IAED,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,EAA4B,CAAA;QACjD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAA;QAEvD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,EAAE,YAAY,gBAAgB,EAAE,CAAC;gBACjC,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrB,SAAS,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,uCAAuC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAA;gBACrF,CAAC;qBAAM,CAAC;oBACJ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC1B,CAAC;YACL,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpB,SAAS,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,6BAA6B,KAAK,EAAE,CAAC,CAAA;gBACxE,CAAC;qBAAM,CAAC;oBACJ,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;gBACzB,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACX,4DAA4D;YAC5D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YACpB,wFAAwF;YACxF,uDAAuD,CAC1D,CAAA;IACL,CAAC;AACL,CAAC"}

package/dist/src/server/checkers/checkWiresImplemented.d.ts

@@ -0,0 +1,11 @@
+interface HttpSchemaLike {
+    name: string;
+    apiMiddlewares: readonly unknown[];
+}
+interface WebSocketSchemaLike {
+    name: string;
+    middlewares: readonly unknown[];
+}
+export declare function checkWiresImplemented(httpSchemas: readonly HttpSchemaLike[], webSocketSchemas: readonly WebSocketSchemaLike[]): void;
+export {};
+//# sourceMappingURL=checkWiresImplemented.d.ts.map

package/dist/src/server/checkers/checkWiresImplemented.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkWiresImplemented.d.ts","sourceRoot":"","sources":["../../../../src/server/checkers/checkWiresImplemented.ts"],"names":[],"mappings":"AAOA,UAAU,cAAc;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,SAAS,OAAO,EAAE,CAAA;CACrC;AAED,UAAU,mBAAmB;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,SAAS,OAAO,EAAE,CAAA;CAClC;AAED,wBAAgB,qBAAqB,CACjC,WAAW,EAAE,SAAS,cAAc,EAAE,EACtC,gBAAgB,EAAE,SAAS,mBAAmB,EAAE,GACjD,IAAI,CAqBN"}

package/dist/src/server/checkers/checkWiresImplemented.js

@@ -0,0 +1,27 @@
+/**
+ * Run at GGHttpServer.start() over the frozen schema graph: every wire a schema
+ * .use()s and that is .define()d must have a .create()d handler on this runtime.
+ */
+import { GGWireContextKey } from "../../schema/GGWireContextKey.js";
+import { wireIsDefined } from "../../schema/GGWireContextKey.node.js";
+export function checkWiresImplemented(httpSchemas, webSocketSchemas) {
+    const surfaces = [
+        ...httpSchemas.map(s => ({ name: s.name, wires: s.apiMiddlewares })),
+        ...webSocketSchemas.map(s => ({ name: s.name, wires: s.middlewares })),
+    ];
+    const missing = [];
+    for (const surface of surfaces) {
+        for (const mw of surface.wires) {
+            if (mw instanceof GGWireContextKey && wireIsDefined(mw) && !mw.hasHandler()) {
+                missing.push(`  ${surface.name}  uses wire "${mw.name}"`);
+            }
+        }
+    }
+    if (missing.length > 0) {
+        throw new Error(`GGHttpServer: these schemas .use() a smart wire that was never implemented on this ` +
+            `runtime:\n\n` +
+            missing.join("\n") +
+            `\n\nFix: call \`${"<WIRE>"}.define(...).create(deps)\` in compose() before the server starts.`);
+    }
+}
+//# sourceMappingURL=checkWiresImplemented.js.map

package/dist/src/server/checkers/checkWiresImplemented.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkWiresImplemented.js","sourceRoot":"","sources":["../../../../src/server/checkers/checkWiresImplemented.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAC,gBAAgB,EAAC,MAAM,+BAA+B,CAAA;AAC9D,OAAO,EAAC,aAAa,EAAC,MAAM,oCAAoC,CAAA;AAYhE,MAAM,UAAU,qBAAqB,CACjC,WAAsC,EACtC,gBAAgD;IAEhD,MAAM,QAAQ,GAAgD;QAC1D,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,cAAc,EAAC,CAAC,CAAC;QAClE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,EAAC,CAAC,CAAC;KACvE,CAAA;IACD,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,EAAE,YAAY,gBAAgB,IAAI,aAAa,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC1E,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,gBAAgB,EAAE,CAAC,IAAI,GAAG,CAAC,CAAA;YAC7D,CAAC;QACL,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACX,qFAAqF;YACrF,cAAc;YACd,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAClB,mBAAmB,QAAQ,oEAAoE,CAClG,CAAA;IACL,CAAC;AACL,CAAC"}