@haverstack/server 0.8.0 → 0.9.1

package/dist/app.d.ts

@@ -0,0 +1,8 @@
+import { Hono } from 'hono';
+import type { Logger } from 'pino';
+import type { StackContext } from './stack.js';
+import type { Config } from './config.js';
+import type { AppEnv } from './types.js';
+export type { AppEnv };
+export declare function createApp(ctx: StackContext, config: Config, logger: Logger): Hono<AppEnv>;
+//# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAczC,YAAY,EAAE,MAAM,EAAE,CAAC;AAEvB,wBAAgB,SAAS,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CA8DzF"}

package/dist/app.js

@@ -0,0 +1,70 @@
+import { Hono } from 'hono';
+import { cors } from 'hono/cors';
+import { bodyLimit } from 'hono/body-limit';
+import { StackPayloadTooLargeError } from '@haverstack/core';
+import { authMiddleware } from './middleware/auth.js';
+import { errorMiddleware } from './middleware/errors.js';
+import { wellknownRoutes } from './routes/wellknown.js';
+import { healthRoutes } from './routes/health.js';
+import { recordRoutes } from './routes/records.js';
+import { changeRoutes } from './routes/changes.js';
+import { typeRoutes } from './routes/types.js';
+import { attachmentRoutes } from './routes/attachments.js';
+import { entityRoutes } from './routes/entity.js';
+import { tokenRoutes } from './routes/tokens.js';
+import { authRoutes } from './routes/auth.js';
+import { wireError } from './wireError.js';
+export function createApp(ctx, config, logger) {
+    const app = new Hono();
+    // Assign a unique request ID to every request and expose it on the response.
+    app.use(async (c, next) => {
+        const id = crypto.randomUUID();
+        c.set('requestId', id);
+        await next();
+        c.header('X-Request-Id', id);
+    });
+    app.use(cors({
+        origin: config.corsOrigins === '*'
+            ? '*'
+            : config.corsOrigins
+                ? config.corsOrigins.split(',').map((s) => s.trim())
+                : [],
+        allowMethods: ['GET', 'POST', 'PATCH', 'PUT', 'DELETE'],
+        // Last-Event-ID: a browser resuming GET /changes sends it as a plain
+        // header (fetch, not EventSource, per the feed's no-token-in-the-URL
+        // rule). Omitted here, a cross-origin resume never reaches the route
+        // that would answer it with `reset`.
+        allowHeaders: ['Authorization', 'Content-Type', 'Content-Disposition', 'Last-Event-ID'],
+        exposeHeaders: ['X-Request-Id', 'Content-Disposition'],
+    }));
+    app.onError(errorMiddleware(logger, ctx.stack));
+    app.use(authMiddleware(config.ownerToken, ctx));
+    // Global rather than per-prefix, so a route added later can't end up with
+    // no limit at all. POST /attachments is the one exception: it enforces its
+    // own, larger ceiling, and running this one first would reject legitimate
+    // uploads before that check ran. Thrown as a StackError so
+    // errorMiddleware produces the conforming body, like any other failure.
+    const jsonBodyLimit = bodyLimit({
+        maxSize: config.maxContentBytes,
+        onError: () => {
+            throw new StackPayloadTooLargeError(`Request body exceeds the ${config.maxContentBytes}-byte limit`);
+        },
+    });
+    app.use('*', async (c, next) => {
+        if (c.req.method === 'POST' && c.req.path === '/attachments')
+            return next();
+        return jsonBodyLimit(c, next);
+    });
+    app.route('/.well-known', wellknownRoutes(ctx, config));
+    app.route('/health', healthRoutes());
+    app.route('/records', recordRoutes(ctx, config.queryTimeoutMs));
+    app.route('/changes', changeRoutes(ctx, config, logger));
+    app.route('/types', typeRoutes(ctx));
+    app.route('/attachments', attachmentRoutes(ctx, config.maxAttachmentBytes));
+    app.route('/entity', entityRoutes(ctx));
+    app.route('/tokens', tokenRoutes(ctx));
+    app.route('/auth', authRoutes(ctx, config.authOrigin, logger));
+    app.notFound((c) => wireError(c, 404, 'not_found', 'Not found'));
+    return app;
+}
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAK7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAI3C,MAAM,UAAU,SAAS,CAAC,GAAiB,EAAE,MAAc,EAAE,MAAc;IACzE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAC;IAE/B,6EAA6E;IAC7E,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACvB,MAAM,IAAI,EAAE,CAAC;QACb,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACL,IAAI,CAAC;QACH,MAAM,EACJ,MAAM,CAAC,WAAW,KAAK,GAAG;YACxB,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,MAAM,CAAC,WAAW;gBAClB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACpD,CAAC,CAAC,EAAE;QACV,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC;QACvD,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,qCAAqC;QACrC,YAAY,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,qBAAqB,EAAE,eAAe,CAAC;QACvF,aAAa,EAAE,CAAC,cAAc,EAAE,qBAAqB,CAAC;KACvD,CAAC,CACH,CAAC;IACF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAEhD,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,2DAA2D;IAC3D,wEAAwE;IACxE,MAAM,aAAa,GAAG,SAAS,CAAC;QAC9B,OAAO,EAAE,MAAM,CAAC,eAAe;QAC/B,OAAO,EAAE,GAAG,EAAE;YACZ,MAAM,IAAI,yBAAyB,CACjC,4BAA4B,MAAM,CAAC,eAAe,aAAa,CAChE,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,IAAI,EAAE,CAAC;QAC5E,OAAO,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;IACrC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IAChE,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5E,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAE/D,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAEjE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,21 @@
+export type Config = {
+    port: number;
+    dbPath: string;
+    entityId: string | null;
+    ownerName: string | null;
+    ownerHandle: string | null;
+    timezone: string | undefined;
+    ownerToken: string;
+    corsOrigins: string;
+    baseUrl: string;
+    authOrigin: string;
+    maxAttachmentBytes: number;
+    maxContentBytes: number;
+    queryTimeoutMs: number;
+    queryWorkerPoolSize: number;
+    queryQueueLimit: number;
+    seedCommonsTypes: boolean;
+    shutdownTimeoutMs: number;
+};
+export declare function loadConfig(): Config;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAyBA,MAAM,MAAM,MAAM,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,wBAAgB,UAAU,IAAI,MAAM,CAkInC"}

package/dist/config.js

@@ -0,0 +1,115 @@
+import { isValidDid } from '@haverstack/core/did';
+import { authOriginFromUrl } from '@haverstack/core/wire';
+const DEFAULT_MAX_ATTACHMENT_BYTES = 50 * 1024 * 1024; // 50 MB
+const DEFAULT_MAX_CONTENT_BYTES = 1 * 1024 * 1024; // 1 MB
+const DEFAULT_QUERY_TIMEOUT_MS = 10_000;
+const DEFAULT_SHUTDOWN_TIMEOUT_MS = 10_000;
+const DEFAULT_QUERY_WORKER_POOL_SIZE = 2;
+// Each worker is a thread plus its own SQLite connection to the same file,
+// so an accidental extra zero here is expensive in a way the other limits
+// aren't. The ceiling is a sanity bound, not a tuning recommendation.
+const MAX_QUERY_WORKER_POOL_SIZE = 32;
+const DEFAULT_QUERY_QUEUE_LIMIT = 64;
+const MAX_QUERY_QUEUE_LIMIT = 10_000;
+function required(name) {
+    const val = process.env[name];
+    if (!val)
+        throw new Error(`Missing required environment variable: ${name}`);
+    return val;
+}
+function optional(name, fallback) {
+    return process.env[name] ?? fallback;
+}
+export function loadConfig() {
+    const dbPath = required('DB_PATH');
+    const entityId = process.env['ENTITY_ID'] ?? null;
+    if (entityId && !isValidDid(entityId)) {
+        throw new Error(`ENTITY_ID must be a DID (e.g. "did:key:z6Mk..."), got: "${entityId}". ` +
+            'See docs/spec/identity.md for how to generate one.');
+    }
+    const ownerName = process.env['OWNER_NAME'] ?? null;
+    const ownerHandle = process.env['OWNER_HANDLE'] ?? null;
+    // No default: an absent timezone stays undefined end to end rather than
+    // asserting knowledge the stack was never actually given. See
+    // docs/spec/wire-format.md § Discovery.
+    const timezone = process.env['TIMEZONE'] ?? undefined;
+    const port = parseInt(optional('PORT', '3000'), 10);
+    if (isNaN(port) || port < 1 || port > 65535) {
+        throw new Error(`Invalid PORT: ${process.env['PORT']}`);
+    }
+    const maxAttachmentBytes = parseInt(optional('MAX_ATTACHMENT_BYTES', String(DEFAULT_MAX_ATTACHMENT_BYTES)), 10);
+    if (isNaN(maxAttachmentBytes) || maxAttachmentBytes < 1) {
+        throw new Error(`Invalid MAX_ATTACHMENT_BYTES: ${process.env['MAX_ATTACHMENT_BYTES']}`);
+    }
+    const maxContentBytes = parseInt(optional('MAX_CONTENT_BYTES', String(DEFAULT_MAX_CONTENT_BYTES)), 10);
+    if (isNaN(maxContentBytes) || maxContentBytes < 1) {
+        throw new Error(`Invalid MAX_CONTENT_BYTES: ${process.env['MAX_CONTENT_BYTES']}`);
+    }
+    // Bounds a query *executing* on the worker pool, never its wait for a
+    // slot — that is QUERY_QUEUE_LIMIT's job, so ordinary contention makes a
+    // search slow rather than failed. See src/lib/queryWorker/pool.ts.
+    const queryTimeoutMs = parseInt(optional('QUERY_TIMEOUT_MS', String(DEFAULT_QUERY_TIMEOUT_MS)), 10);
+    if (isNaN(queryTimeoutMs) || queryTimeoutMs < 1) {
+        throw new Error(`Invalid QUERY_TIMEOUT_MS: ${process.env['QUERY_TIMEOUT_MS']}`);
+    }
+    const queryWorkerPoolSize = parseInt(optional('QUERY_WORKER_POOL_SIZE', String(DEFAULT_QUERY_WORKER_POOL_SIZE)), 10);
+    if (isNaN(queryWorkerPoolSize) ||
+        queryWorkerPoolSize < 1 ||
+        queryWorkerPoolSize > MAX_QUERY_WORKER_POOL_SIZE) {
+        throw new Error(`Invalid QUERY_WORKER_POOL_SIZE: ${process.env['QUERY_WORKER_POOL_SIZE']} ` +
+            `(expected 1-${MAX_QUERY_WORKER_POOL_SIZE})`);
+    }
+    // How many searches may wait for a worker before the pool sheds load
+    // with 503 `timeout` instead of queueing further. This is what keeps
+    // "slow under contention" from becoming an unbounded queue.
+    const queryQueueLimit = parseInt(optional('QUERY_QUEUE_LIMIT', String(DEFAULT_QUERY_QUEUE_LIMIT)), 10);
+    if (isNaN(queryQueueLimit) || queryQueueLimit < 1 || queryQueueLimit > MAX_QUERY_QUEUE_LIMIT) {
+        throw new Error(`Invalid QUERY_QUEUE_LIMIT: ${process.env['QUERY_QUEUE_LIMIT']} ` +
+            `(expected 1-${MAX_QUERY_QUEUE_LIMIT})`);
+    }
+    // How long shutdown() lets in-flight and keep-alive connections drain
+    // before forcing them closed and finishing the sequence anyway.
+    const shutdownTimeoutMs = parseInt(optional('SHUTDOWN_TIMEOUT_MS', String(DEFAULT_SHUTDOWN_TIMEOUT_MS)), 10);
+    if (isNaN(shutdownTimeoutMs) || shutdownTimeoutMs < 1) {
+        throw new Error(`Invalid SHUTDOWN_TIMEOUT_MS: ${process.env['SHUTDOWN_TIMEOUT_MS']}`);
+    }
+    // Opt-in: @haverstack/commons is Draft status, so its definitions may
+    // change in place, and a registered type shows up in GET /types and every
+    // app's type cache whether or not that app wants it. See
+    // docs/deployment.md § Schema Commons seeding.
+    const seedCommonsTypes = optional('SEED_COMMONS_TYPES', 'false') === 'true';
+    // Required rather than auto-detected: the handshake signs a payload
+    // scoped to this server's public origin, and taking that from a
+    // client-controlled header (Host, X-Forwarded-Host) would let a client
+    // pick the origin it signs for, reopening the relay attack the binding
+    // closes. See docs/spec/wire-format.md § Authentication.
+    const baseUrl = required('BASE_URL');
+    let authOrigin;
+    try {
+        authOrigin = authOriginFromUrl(baseUrl);
+    }
+    catch (err) {
+        throw new Error(`BASE_URL must be an absolute URL with an origin (e.g. "https://stack.example.com"), got: "${baseUrl}". ` +
+            (err instanceof Error ? err.message : String(err)), { cause: err });
+    }
+    return {
+        port,
+        dbPath,
+        entityId,
+        ownerName,
+        ownerHandle,
+        timezone,
+        ownerToken: required('OWNER_TOKEN'),
+        corsOrigins: optional('CORS_ORIGINS', ''),
+        baseUrl,
+        authOrigin,
+        maxAttachmentBytes,
+        maxContentBytes,
+        queryTimeoutMs,
+        queryWorkerPoolSize,
+        queryQueueLimit,
+        seedCommonsTypes,
+        shutdownTimeoutMs,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;AAC/D,MAAM,yBAAyB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;AAC1D,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,8BAA8B,GAAG,CAAC,CAAC;AACzC,2EAA2E;AAC3E,0EAA0E;AAC1E,sEAAsE;AACtE,MAAM,0BAA0B,GAAG,EAAE,CAAC;AACtC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AACrC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,QAAgB;IAC9C,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;AACvC,CAAC;AAsBD,MAAM,UAAU,UAAU;IACxB,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAEnC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;IAClD,IAAI,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,2DAA2D,QAAQ,KAAK;YACtE,oDAAoD,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;IACpD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC;IACxD,wEAAwE;IACxE,8DAA8D;IAC9D,wCAAwC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;IAEtD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,iBAAiB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,kBAAkB,GAAG,QAAQ,CACjC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC,4BAA4B,CAAC,CAAC,EACtE,EAAE,CACH,CAAC;IACF,IAAI,KAAK,CAAC,kBAAkB,CAAC,IAAI,kBAAkB,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,eAAe,GAAG,QAAQ,CAC9B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,yBAAyB,CAAC,CAAC,EAChE,EAAE,CACH,CAAC;IACF,IAAI,KAAK,CAAC,eAAe,CAAC,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,sEAAsE;IACtE,yEAAyE;IACzE,mEAAmE;IACnE,MAAM,cAAc,GAAG,QAAQ,CAC7B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC,EAC9D,EAAE,CACH,CAAC;IACF,IAAI,KAAK,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,mBAAmB,GAAG,QAAQ,CAClC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC,8BAA8B,CAAC,CAAC,EAC1E,EAAE,CACH,CAAC;IACF,IACE,KAAK,CAAC,mBAAmB,CAAC;QAC1B,mBAAmB,GAAG,CAAC;QACvB,mBAAmB,GAAG,0BAA0B,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mCAAmC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,GAAG;YACzE,eAAe,0BAA0B,GAAG,CAC/C,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,qEAAqE;IACrE,4DAA4D;IAC5D,MAAM,eAAe,GAAG,QAAQ,CAC9B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,yBAAyB,CAAC,CAAC,EAChE,EAAE,CACH,CAAC;IACF,IAAI,KAAK,CAAC,eAAe,CAAC,IAAI,eAAe,GAAG,CAAC,IAAI,eAAe,GAAG,qBAAqB,EAAE,CAAC;QAC7F,MAAM,IAAI,KAAK,CACb,8BAA8B,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG;YAC/D,eAAe,qBAAqB,GAAG,CAC1C,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,gEAAgE;IAChE,MAAM,iBAAiB,GAAG,QAAQ,CAChC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC,2BAA2B,CAAC,CAAC,EACpE,EAAE,CACH,CAAC;IACF,IAAI,KAAK,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,yDAAyD;IACzD,+CAA+C;IAC/C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC;IAE5E,oEAAoE;IACpE,gEAAgE;IAChE,uEAAuE;IACvE,uEAAuE;IACvE,yDAAyD;IACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,6FAA6F,OAAO,KAAK;YACvG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EACpD,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM;QACN,QAAQ;QACR,SAAS;QACT,WAAW;QACX,QAAQ;QACR,UAAU,EAAE,QAAQ,CAAC,aAAa,CAAC;QACnC,WAAW,EAAE,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;QACzC,OAAO;QACP,UAAU;QACV,kBAAkB;QAClB,eAAe;QACf,cAAc;QACd,mBAAmB;QACnB,eAAe;QACf,gBAAgB;QAChB,iBAAiB;KAClB,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @haverstack/server's library surface. The package is primarily an app
+ * (`dist/main.js`, run via `pnpm start` / the Docker image — see
+ * src/main.ts), but these exports let a consumer build and run the same
+ * Hono app in-process: embedding it behind their own listener, or driving a
+ * real instance in tests. See `@haverstack/server/testing` for the latter.
+ */
+export { createApp } from './app.js';
+export type { AppEnv } from './types.js';
+export { initStack } from './stack.js';
+export type { StackContext } from './stack.js';
+export { loadConfig } from './config.js';
+export type { Config } from './config.js';
+export { createShutdownHandler } from './shutdown.js';
+export type { ShutdownServer } from './shutdown.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,YAAY,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,12 @@
+/**
+ * @haverstack/server's library surface. The package is primarily an app
+ * (`dist/main.js`, run via `pnpm start` / the Docker image — see
+ * src/main.ts), but these exports let a consumer build and run the same
+ * Hono app in-process: embedding it behind their own listener, or driving a
+ * real instance in tests. See `@haverstack/server/testing` for the latter.
+ */
+export { createApp } from './app.js';
+export { initStack } from './stack.js';
+export { loadConfig } from './config.js';
+export { createShutdownHandler } from './shutdown.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC"}

package/dist/lib/changeStreams.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Tracks every open `GET /changes` SSE connection so shutdown can end them
+ * up front. `server.close()` (src/shutdown.ts) waits for open
+ * connections to drain on their own before its callback fires — fine for an
+ * ordinary request, but a change-feed connection is meant to stay open
+ * indefinitely, so left alone it would hold the drain open for the entire
+ * shutdown grace period every time. Closing each tracked stream as shutdown
+ * begins lets that drain finish immediately instead.
+ */
+export declare class ChangeStreamRegistry {
+    private readonly streams;
+    /** Register an open stream's close callback. Returns the deregister function. */
+    add(close: () => void): () => void;
+    /** Close every currently-open stream. Safe to call with none open. */
+    closeAll(): void;
+}
+//# sourceMappingURL=changeStreams.d.ts.map

package/dist/lib/changeStreams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changeStreams.d.ts","sourceRoot":"","sources":["../../src/lib/changeStreams.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IAEjD,iFAAiF;IACjF,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAKlC,sEAAsE;IACtE,QAAQ,IAAI,IAAI;CAGjB"}

package/{src/lib/changeStreams.ts → dist/lib/changeStreams.js}

@@ -8,16 +8,16 @@
  * begins lets that drain finish immediately instead.
  */
 export class ChangeStreamRegistry {
-  private readonly streams = new Set<() => void>();
-
-  /** Register an open stream's close callback. Returns the deregister function. */
-  add(close: () => void): () => void {
-    this.streams.add(close);
-    return () => this.streams.delete(close);
-  }
-
-  /** Close every currently-open stream. Safe to call with none open. */
-  closeAll(): void {
-    for (const close of this.streams) close();
-  }
+    streams = new Set();
+    /** Register an open stream's close callback. Returns the deregister function. */
+    add(close) {
+        this.streams.add(close);
+        return () => this.streams.delete(close);
+    }
+    /** Close every currently-open stream. Safe to call with none open. */
+    closeAll() {
+        for (const close of this.streams)
+            close();
+    }
 }
+//# sourceMappingURL=changeStreams.js.map

package/dist/lib/changeStreams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changeStreams.js","sourceRoot":"","sources":["../../src/lib/changeStreams.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,GAAG,IAAI,GAAG,EAAc,CAAC;IAEjD,iFAAiF;IACjF,GAAG,CAAC,KAAiB;QACnB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,sEAAsE;IACtE,QAAQ;QACN,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO;YAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;CACF"}

package/dist/lib/frameGate.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Bounds a change-feed connection's in-flight frame count. Each accepted
+ * send is paired with the write that delivers it; once `maxPending` sends
+ * are outstanding at once — a client that isn't draining as fast as
+ * changes arrive — the gate reports overflow instead of queuing further
+ * sends without bound.
+ *
+ * Close on overflow, never drop a frame silently: a client that can't tell
+ * it missed something can't repair it either, so dropping is worse than
+ * disconnecting and letting it reconnect and reconcile.
+ */
+export declare class FrameGate {
+    private readonly maxPending;
+    private readonly onOverflow;
+    private pending;
+    private overflowed;
+    constructor(maxPending: number, onOverflow: () => void);
+    /**
+     * Accepts one send if there's room, invoking `write` and tracking it
+     * until it settles. Returns whether it was accepted; a `false` return
+     * means this call (and every one after it) triggered — or already
+     * followed — overflow, and `onOverflow` has fired at most once.
+     */
+    send(write: () => Promise<unknown>): boolean;
+}
+//# sourceMappingURL=frameGate.d.ts.map

package/dist/lib/frameGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frameGate.d.ts","sourceRoot":"","sources":["../../src/lib/frameGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,qBAAa,SAAS;IAKlB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL7B,OAAO,CAAC,OAAO,CAAK;IACpB,OAAO,CAAC,UAAU,CAAS;gBAGR,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,IAAI;IAGzC;;;;;OAKG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO;CAe7C"}

package/dist/lib/frameGate.js

@@ -0,0 +1,44 @@
+/**
+ * Bounds a change-feed connection's in-flight frame count. Each accepted
+ * send is paired with the write that delivers it; once `maxPending` sends
+ * are outstanding at once — a client that isn't draining as fast as
+ * changes arrive — the gate reports overflow instead of queuing further
+ * sends without bound.
+ *
+ * Close on overflow, never drop a frame silently: a client that can't tell
+ * it missed something can't repair it either, so dropping is worse than
+ * disconnecting and letting it reconnect and reconcile.
+ */
+export class FrameGate {
+    maxPending;
+    onOverflow;
+    pending = 0;
+    overflowed = false;
+    constructor(maxPending, onOverflow) {
+        this.maxPending = maxPending;
+        this.onOverflow = onOverflow;
+    }
+    /**
+     * Accepts one send if there's room, invoking `write` and tracking it
+     * until it settles. Returns whether it was accepted; a `false` return
+     * means this call (and every one after it) triggered — or already
+     * followed — overflow, and `onOverflow` has fired at most once.
+     */
+    send(write) {
+        if (this.overflowed)
+            return false;
+        if (this.pending >= this.maxPending) {
+            this.overflowed = true;
+            this.onOverflow();
+            return false;
+        }
+        this.pending++;
+        write()
+            .catch(() => { })
+            .finally(() => {
+            this.pending--;
+        });
+        return true;
+    }
+}
+//# sourceMappingURL=frameGate.js.map

package/dist/lib/frameGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frameGate.js","sourceRoot":"","sources":["../../src/lib/frameGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,OAAO,SAAS;IAKD;IACA;IALX,OAAO,GAAG,CAAC,CAAC;IACZ,UAAU,GAAG,KAAK,CAAC;IAE3B,YACmB,UAAkB,EAClB,UAAsB;QADtB,eAAU,GAAV,UAAU,CAAQ;QAClB,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAEJ;;;;;OAKG;IACH,IAAI,CAAC,KAA6B;QAChC,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,KAAK,EAAE;aACJ,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;aACf,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/lib/json.d.ts

@@ -0,0 +1,10 @@
+import type { Context } from 'hono';
+import type { AppEnv } from '../types.js';
+/**
+ * `c.req.json()` throws a bare `SyntaxError` on malformed input, which isn't
+ * a `StackError` — left uncaught it falls through errorMiddleware's
+ * catch-all as an unlabeled 500 instead of the 400 `bad_request` every other
+ * structurally-invalid request gets (docs/spec/wire-format.md § 400 vs 422).
+ */
+export declare function readJson<T = unknown>(c: Context<AppEnv>): Promise<T>;
+//# sourceMappingURL=json.d.ts.map

package/dist/lib/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../src/lib/json.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAgB1E"}

package/dist/lib/json.js

@@ -0,0 +1,27 @@
+import { StackQueryError } from '@haverstack/core';
+/**
+ * `c.req.json()` throws a bare `SyntaxError` on malformed input, which isn't
+ * a `StackError` — left uncaught it falls through errorMiddleware's
+ * catch-all as an unlabeled 500 instead of the 400 `bad_request` every other
+ * structurally-invalid request gets (docs/spec/wire-format.md § 400 vs 422).
+ */
+export async function readJson(c) {
+    let parsed;
+    try {
+        parsed = await c.req.json();
+    }
+    catch (err) {
+        if (err instanceof SyntaxError)
+            throw new StackQueryError('Invalid JSON in request body');
+        throw err;
+    }
+    // `null`, a bare string or a number parses fine, but every call site
+    // indexes fields off the result, so a non-object reaches the handler and
+    // throws a bare TypeError — another unlabeled 500, unauthenticated on the
+    // /auth routes. Structurally invalid like malformed JSON, so a 400 too.
+    if (parsed === null || typeof parsed !== 'object') {
+        throw new StackQueryError('Request body must be a JSON object');
+    }
+    return parsed;
+}
+//# sourceMappingURL=json.js.map

package/dist/lib/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../src/lib/json.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGnD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAc,CAAkB;IAC5D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAK,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,WAAW;YAAE,MAAM,IAAI,eAAe,CAAC,8BAA8B,CAAC,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,qEAAqE;IACrE,yEAAyE;IACzE,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAW,CAAC;AACrB,CAAC"}

package/dist/lib/nonceStore.d.ts

@@ -0,0 +1,50 @@
+/** Conventional sibling path for the nonce store beside a stack's main .db file. */
+export declare const defaultNonceStorePath: (dbPath: string) => string;
+export type NonceRedeemResult = 'ok' | 'unknown' | 'expired';
+/**
+ * Single-use, DID-bound nonces for the DID challenge–response handshake
+ * (POST /auth/challenge, POST /auth/token). Core verifies signatures but
+ * deliberately doesn't run a server, so nonce storage, single-use
+ * enforcement, and DID binding are this server's own to implement — see
+ * docs/spec/wire-format.md § Authentication.
+ *
+ * Kept beside the token store (its own sibling file) rather than in the
+ * portable stack file or in memory, so a restart doesn't silently make
+ * every in-flight handshake unrecoverable. node:sqlite, like
+ * NativeTokenStore — no extra dependency.
+ */
+export declare class AuthNonceStore {
+    private readonly db;
+    private constructor();
+    static open(path: string): AuthNonceStore;
+    issue(did: string): {
+        nonce: string;
+        expiresAt: Date;
+    };
+    /**
+     * Checks and spends a nonce in one step — single-use means a redemption
+     * consumes it regardless of outcome, not merely observes it. A missing
+     * nonce and one bound to a different DID both report 'unknown': a server
+     * MUST NOT let a caller distinguish never-issued from already-spent, or
+     * spent-by-someone-else, since the difference only tells an attacker
+     * something.
+     *
+     * One `DELETE ... RETURNING` rather than a SELECT then a DELETE, which
+     * would be indivisible only for as long as nothing awaits between the two
+     * statements — an invariant no reader can see. The `did` predicate sits in
+     * the WHERE clause, so a mismatch deletes nothing.
+     */
+    redeem(did: string, nonce: string): NonceRedeemResult;
+    /**
+     * Seeds a nonce with a caller-chosen value rather than a random one.
+     * Production code never needs this — issue() is the only way a nonce is
+     * meant to come into existence — but a conformance fixture carrying a
+     * real signature is signed over one exact, fixed nonce value, so tests
+     * need a way to get that value into the store directly. Named for what
+     * it is so no production call site can reach for it without saying so.
+     */
+    seedForTesting(nonce: string, did: string, expiresAt: Date): void;
+    private sweepExpired;
+    close(): void;
+}
+//# sourceMappingURL=nonceStore.d.ts.map

package/dist/lib/nonceStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonceStore.d.ts","sourceRoot":"","sources":["../../src/lib/nonceStore.ts"],"names":[],"mappings":"AAWA,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,GAAI,QAAQ,MAAM,KAAG,MAA4B,CAAC;AAEpF,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,SAAS,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,qBAAa,cAAc;IACL,OAAO,CAAC,QAAQ,CAAC,EAAE;IAAvC,OAAO;IAEP,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc;IAkBzC,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE;IAUtD;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,iBAAiB;IASrD;;;;;;;OAOG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI;IAMjE,OAAO,CAAC,YAAY;IAIpB,KAAK,IAAI,IAAI;CAGd"}

package/dist/lib/nonceStore.js

@@ -0,0 +1,96 @@
+import { DatabaseSync } from 'node:sqlite';
+import { base64urlEncode } from '@haverstack/core/wire';
+// Matches the ~5-minute issued→expires gap in the handshake conformance
+// fixtures (@haverstack/conformance-fixtures' authChallengeFixtures).
+const NONCE_TTL_MS = 5 * 60 * 1000;
+// 18 raw bytes base64url-encodes to 24 characters — short, opaque, and
+// comfortably unguessable for a value that's live for minutes, not stored
+// long-term like a token.
+const NONCE_BYTES = 18;
+/** Conventional sibling path for the nonce store beside a stack's main .db file. */
+export const defaultNonceStorePath = (dbPath) => `${dbPath}.nonces`;
+/**
+ * Single-use, DID-bound nonces for the DID challenge–response handshake
+ * (POST /auth/challenge, POST /auth/token). Core verifies signatures but
+ * deliberately doesn't run a server, so nonce storage, single-use
+ * enforcement, and DID binding are this server's own to implement — see
+ * docs/spec/wire-format.md § Authentication.
+ *
+ * Kept beside the token store (its own sibling file) rather than in the
+ * portable stack file or in memory, so a restart doesn't silently make
+ * every in-flight handshake unrecoverable. node:sqlite, like
+ * NativeTokenStore — no extra dependency.
+ */
+export class AuthNonceStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    static open(path) {
+        const db = new DatabaseSync(path);
+        db.exec('PRAGMA journal_mode = WAL;');
+        db.exec(`CREATE TABLE IF NOT EXISTS nonces (
+        nonce TEXT PRIMARY KEY,
+        did TEXT NOT NULL,
+        expiresAt INTEGER NOT NULL
+      );`);
+        // sweepExpired() runs on every issue(), and POST /auth/challenge is
+        // unauthenticated — without this the sweep is a full table scan whose
+        // cost rises with the issue rate, so the endpoint would pay more the
+        // harder it is hit.
+        db.exec('CREATE INDEX IF NOT EXISTS idx_nonces_expiresAt ON nonces (expiresAt);');
+        return new AuthNonceStore(db);
+    }
+    issue(did) {
+        this.sweepExpired();
+        const nonce = base64urlEncode(crypto.getRandomValues(new Uint8Array(NONCE_BYTES)));
+        const expiresAt = new Date(Date.now() + NONCE_TTL_MS);
+        this.db
+            .prepare('INSERT INTO nonces (nonce, did, expiresAt) VALUES (?, ?, ?)')
+            .run(nonce, did, expiresAt.getTime());
+        return { nonce, expiresAt };
+    }
+    /**
+     * Checks and spends a nonce in one step — single-use means a redemption
+     * consumes it regardless of outcome, not merely observes it. A missing
+     * nonce and one bound to a different DID both report 'unknown': a server
+     * MUST NOT let a caller distinguish never-issued from already-spent, or
+     * spent-by-someone-else, since the difference only tells an attacker
+     * something.
+     *
+     * One `DELETE ... RETURNING` rather than a SELECT then a DELETE, which
+     * would be indivisible only for as long as nothing awaits between the two
+     * statements — an invariant no reader can see. The `did` predicate sits in
+     * the WHERE clause, so a mismatch deletes nothing.
+     */
+    redeem(did, nonce) {
+        const row = this.db
+            .prepare('DELETE FROM nonces WHERE nonce = ? AND did = ? RETURNING expiresAt')
+            .get(nonce, did);
+        if (!row)
+            return 'unknown';
+        if (Date.now() > row.expiresAt)
+            return 'expired';
+        return 'ok';
+    }
+    /**
+     * Seeds a nonce with a caller-chosen value rather than a random one.
+     * Production code never needs this — issue() is the only way a nonce is
+     * meant to come into existence — but a conformance fixture carrying a
+     * real signature is signed over one exact, fixed nonce value, so tests
+     * need a way to get that value into the store directly. Named for what
+     * it is so no production call site can reach for it without saying so.
+     */
+    seedForTesting(nonce, did, expiresAt) {
+        this.db
+            .prepare('INSERT OR REPLACE INTO nonces (nonce, did, expiresAt) VALUES (?, ?, ?)')
+            .run(nonce, did, expiresAt.getTime());
+    }
+    sweepExpired() {
+        this.db.prepare('DELETE FROM nonces WHERE expiresAt < ?').run(Date.now());
+    }
+    close() {
+        this.db.close();
+    }
+}
+//# sourceMappingURL=nonceStore.js.map

package/dist/lib/nonceStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonceStore.js","sourceRoot":"","sources":["../../src/lib/nonceStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,wEAAwE;AACxE,sEAAsE;AACtE,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,uEAAuE;AACvE,0EAA0E;AAC1E,0BAA0B;AAC1B,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,MAAM,SAAS,CAAC;AAIpF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,cAAc;IACY;IAArC,YAAqC,EAAgB;QAAhB,OAAE,GAAF,EAAE,CAAc;IAAG,CAAC;IAEzD,MAAM,CAAC,IAAI,CAAC,IAAY;QACtB,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACtC,EAAE,CAAC,IAAI,CACL;;;;SAIG,CACJ,CAAC;QACF,oEAAoE;QACpE,sEAAsE;QACtE,qEAAqE;QACrE,oBAAoB;QACpB,EAAE,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAClF,OAAO,IAAI,cAAc,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,GAAW;QACf,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACnF,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,6DAA6D,CAAC;aACtE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,GAAW,EAAE,KAAa;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,oEAAoE,CAAC;aAC7E,GAAG,CAAC,KAAK,EAAE,GAAG,CAAsC,CAAC;QACxD,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,KAAa,EAAE,GAAW,EAAE,SAAe;QACxD,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,wEAAwE,CAAC;aACjF,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1C,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;CACF"}

package/dist/lib/queryLimit.d.ts

@@ -0,0 +1,4 @@
+import type { StackQuery } from '@haverstack/core';
+export declare const MAX_QUERY_LIMIT = 1000;
+export declare function clampLimit(query: StackQuery): StackQuery;
+//# sourceMappingURL=queryLimit.d.ts.map

package/dist/lib/queryLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queryLimit.d.ts","sourceRoot":"","sources":["../../src/lib/queryLimit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKnD,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAGxD"}