@haverstack/server 0.8.0 → 0.9.1

package/dist/lib/resumeBuffer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resumeBuffer.d.ts","sourceRoot":"","sources":["../../src/lib/resumeBuffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEhF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D,MAAM,MAAM,WAAW,GAAG;IACxB,CAAC,EAAE,MAAM,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,KAAK,EAAE,gBAAgB,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,EAAE,CAAA;CAAE;AAC1C,4FAA4F;GAC1F;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE;AACxB,2EAA2E;GACzE;IAAE,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEjC,wGAAwG;AACxG,qBAAa,YAAY;IAYX,OAAO,CAAC,QAAQ,CAAC,KAAK;IAXlC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAuB;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2C;IAErE,wEAAwE;IACxE,SAAS,SAAK;IACd,2EAA2E;IAC3E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAQ;gBAER,KAAK,EAAE,MAAM;IAE1C,+EAA+E;IAC/E,UAAU,IAAI,MAAM;IAIpB;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,WAAW;IAmBzC,6DAA6D;IAC7D,aAAa,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,MAAM,IAAI;IAOjE;;;;OAIG;IACH,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,kBAAkB;CAK5C;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,6CAA6C;IAC7C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAgBnE;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;IACd,6GAA6G;IAC7G,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,oBAAoB;IAanB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAZjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAkC;IAC/D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqC;IACpE;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4C;gBAEzC,IAAI,EAAE,2BAA2B;IAE9D;;;;;;;;;;OAUG;IACG,OAAO,CACX,GAAG,EAAE,MAAM,EACX,gBAAgB,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,KAAK,OAAO,CAAC,WAAW,CAAC,GACnF,OAAO,CAAC,YAAY,CAAC;IAuCxB,uGAAuG;IACvG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAW1B,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,KAAK;IASb,kEAAkE;IAClE,QAAQ,IAAI,IAAI;CAQjB"}

package/dist/lib/resumeBuffer.js

@@ -0,0 +1,216 @@
+import { serializeChange } from '@haverstack/wire-types';
+import { encodeCursor } from './resumeCursor.js';
+/** One session+filter's resume buffer. Data and notification only — lifecycle lives in the registry. */
+export class ResumeBuffer {
+    depth;
+    id = crypto.randomUUID();
+    entries = [];
+    currentN = 0;
+    evictedUpTo = 0;
+    listeners = new Set();
+    /** Connections currently holding this buffer open. Registry-managed. */
+    liveCount = 0;
+    /** Set by the registry when liveCount drops to 0; cleared on reacquire. */
+    disconnectedAt = null;
+    constructor(depth) {
+        this.depth = depth;
+    }
+    /** The cursor naming this buffer's current position — what `ready` reports. */
+    headCursor() {
+        return encodeCursor(this.id, this.currentN);
+    }
+    /**
+     * Record one already-permission-filtered change, minting its cursor.
+     * Notifies every currently attached live connection with the same frame
+     * a replay would later produce.
+     */
+    append(change) {
+        this.currentN += 1;
+        const seq = encodeCursor(this.id, this.currentN);
+        const frame = serializeChange({ ...change, seq });
+        const entry = {
+            n: this.currentN,
+            recordId: change.recordId,
+            isPurge: change.kind === 'purged',
+            frame,
+        };
+        this.entries.push(entry);
+        if (this.entries.length > this.depth) {
+            const dropped = this.entries.shift();
+            if (dropped)
+                this.evictedUpTo = dropped.n;
+        }
+        for (const listener of this.listeners)
+            listener(entry);
+        return entry;
+    }
+    /** Attach a live connection. Returns the detach function. */
+    subscribeLive(listener) {
+        this.listeners.add(listener);
+        return () => {
+            this.listeners.delete(listener);
+        };
+    }
+    /**
+     * Everything after position `n`, or why that can't be answered. `n` is
+     * this server's own minted position, already decoded and matched to
+     * this buffer's id by the caller.
+     */
+    entriesAfter(n) {
+        if (n > this.currentN || n < 0)
+            return { status: 'cursor_expired' };
+        if (n < this.evictedUpTo)
+            return { status: 'overflow' };
+        return { status: 'ok', entries: this.entries.filter((e) => e.n > n) };
+    }
+}
+/**
+ * Reproducible across a reconnect that re-sends the same query params —
+ * order-independent on the parts of `filter` that don't carry order of
+ * their own (`typeId`/`kinds` are matched as sets, not sequences, so
+ * re-sending them in a different order must key the same buffer).
+ *
+ * Two filters that mean different things must never key the same buffer.
+ * A buffer opens exactly one `ScopedStack.subscribe()`, carrying the
+ * filter of whichever connection minted it, so a collision hands one of
+ * the two colliding connections the *other's* filter: either a silent gap
+ * (events it asked for and never hears about, with no `reset` to tell it
+ * so) or frames outside its filter, which "filtering is exact, not
+ * advisory" forbids. See docs/spec/wire-format.md § Change feed.
+ *
+ * Hence an object rather than a positional array: `JSON.stringify` drops
+ * an undefined *property* but renders an undefined *array element* as
+ * `null`, which would collapse "no parentId filter" onto `parentId: null`
+ * — "root records only", a filter the wire format defines. An absent part
+ * is an absent key, which no present value can imitate. Key order is fixed
+ * by construction below.
+ */
+export function resumeBufferKey(parts) {
+    const { filter } = parts;
+    const typeId = filter.typeId
+        ? [...(Array.isArray(filter.typeId) ? filter.typeId : [filter.typeId])].sort()
+        : undefined;
+    const kinds = filter.kinds ? [...filter.kinds].sort() : undefined;
+    return JSON.stringify({
+        principalId: parts.principalId,
+        subjectId: parts.subjectId,
+        includeRecords: parts.includeRecords,
+        includeUnlisted: parts.includeUnlisted,
+        ...(typeId !== undefined && { typeId }),
+        ...(filter.parentId !== undefined && { parentId: filter.parentId }),
+        ...(filter.entityId !== undefined && { entityId: filter.entityId }),
+        ...(kinds !== undefined && { kinds }),
+    });
+}
+/**
+ * Owns every live resume buffer, keyed by (session, filter, includeRecords).
+ * A buffer's underlying `ScopedStack.subscribe()` is opened once, when the
+ * buffer is first minted, and kept open — including across a gap with zero
+ * live connections — until the buffer itself is evicted.
+ */
+export class ResumeBufferRegistry {
+    opts;
+    buffers = new Map();
+    unsubscribes = new Map();
+    evictionTimers = new Map();
+    /**
+     * Buffers whose subscription is still opening. A key lands in `buffers`
+     * only once its `ScopedStack.subscribe()` has resolved, so this is what
+     * keeps two connections arriving in the same tick from opening two
+     * subscriptions for one key — they await the same attempt and share
+     * whichever way it settles.
+     */
+    acquiring = new Map();
+    constructor(opts) {
+        this.opts = opts;
+    }
+    /**
+     * Get this key's buffer, creating one and opening its scoped subscription
+     * if none is currently retained. `subscribeToStack` is called at most
+     * once per buffer instance.
+     *
+     * A failed subscription registers nothing: the next connection on this
+     * key retries it. Registering a buffer that nothing is feeding would
+     * hand every later connection on that key a `ready` frame followed by
+     * permanent silence — a gap with no `reset` to announce it, which is
+     * the one failure the feed contract calls untrustworthy.
+     */
+    async acquire(key, subscribeToStack) {
+        const existing = this.buffers.get(key);
+        if (existing) {
+            this.cancelEviction(key);
+            existing.liveCount += 1;
+            existing.disconnectedAt = null;
+            return existing;
+        }
+        const inFlight = this.acquiring.get(key);
+        if (inFlight) {
+            const buffer = await inFlight;
+            buffer.liveCount += 1;
+            return buffer;
+        }
+        const attempt = (async () => {
+            const buffer = new ResumeBuffer(this.opts.depth);
+            // Awaited before either map is touched — the handler closes over
+            // `buffer`, so anything the stack emits while this is in flight is
+            // already being recorded by the time the buffer becomes reachable.
+            const unsubscribe = await subscribeToStack((change) => {
+                buffer.append(change);
+            });
+            this.buffers.set(key, buffer);
+            this.unsubscribes.set(key, unsubscribe);
+            return buffer;
+        })();
+        this.acquiring.set(key, attempt);
+        try {
+            const buffer = await attempt;
+            buffer.liveCount += 1;
+            return buffer;
+        }
+        finally {
+            this.acquiring.delete(key);
+        }
+    }
+    /** Detach one connection from this key's buffer, starting its retention countdown once none remain. */
+    release(key) {
+        const buffer = this.buffers.get(key);
+        if (!buffer)
+            return;
+        buffer.liveCount = Math.max(0, buffer.liveCount - 1);
+        if (buffer.liveCount > 0)
+            return;
+        buffer.disconnectedAt = Date.now();
+        const timer = setTimeout(() => this.evict(key, buffer), this.opts.retentionMs);
+        timer.unref?.();
+        this.evictionTimers.set(key, timer);
+    }
+    cancelEviction(key) {
+        const timer = this.evictionTimers.get(key);
+        if (timer) {
+            clearTimeout(timer);
+            this.evictionTimers.delete(key);
+        }
+    }
+    evict(key, buffer) {
+        if (this.buffers.get(key) !== buffer)
+            return; // already replaced
+        if (buffer.liveCount > 0)
+            return; // reacquired since the timer was set
+        this.buffers.delete(key);
+        this.evictionTimers.delete(key);
+        this.unsubscribes.get(key)?.();
+        this.unsubscribes.delete(key);
+    }
+    /** Tear down every retained buffer immediately — for shutdown. */
+    closeAll() {
+        for (const timer of this.evictionTimers.values())
+            clearTimeout(timer);
+        this.evictionTimers.clear();
+        this.acquiring.clear();
+        for (const unsubscribe of this.unsubscribes.values())
+            unsubscribe();
+        this.unsubscribes.clear();
+        this.buffers.clear();
+    }
+}
+//# sourceMappingURL=resumeBuffer.js.map

package/dist/lib/resumeBuffer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resumeBuffer.js","sourceRoot":"","sources":["../../src/lib/resumeBuffer.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAiBjD,wGAAwG;AACxG,MAAM,OAAO,YAAY;IAYM;IAXpB,EAAE,GAAW,MAAM,CAAC,UAAU,EAAE,CAAC;IACzB,OAAO,GAAkB,EAAE,CAAC;IACrC,QAAQ,GAAG,CAAC,CAAC;IACb,WAAW,GAAG,CAAC,CAAC;IACP,SAAS,GAAG,IAAI,GAAG,EAAgC,CAAC;IAErE,wEAAwE;IACxE,SAAS,GAAG,CAAC,CAAC;IACd,2EAA2E;IAC3E,cAAc,GAAkB,IAAI,CAAC;IAErC,YAA6B,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAE9C,+EAA+E;IAC/E,UAAU;QACR,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAoB;QACzB,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QACnB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAClD,MAAM,KAAK,GAAgB;YACzB,CAAC,EAAE,IAAI,CAAC,QAAQ;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,IAAI,KAAK,QAAQ;YACjC,KAAK;SACN,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,OAAO;gBAAE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS;YAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6DAA6D;IAC7D,aAAa,CAAC,QAAsC;QAClD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,CAAS;QACpB,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACpE,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACxD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;IACxE,CAAC;CACF;AAWD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,eAAe,CAAC,KAA2B;IACzD,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM;QAC1B,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC9E,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;QACvC,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnE,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;KACtC,CAAC,CAAC;AACL,CAAC;AASD;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IAaF;IAZZ,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC1C,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;IACpE;;;;;;OAMG;IACc,SAAS,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEtE,YAA6B,IAAiC;QAAjC,SAAI,GAAJ,IAAI,CAA6B;IAAG,CAAC;IAElE;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CACX,GAAW,EACX,gBAAoF;QAEpF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YACzB,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC;YACxB,QAAQ,CAAC,cAAc,GAAG,IAAI,CAAC;YAC/B,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC;YAC9B,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;YACtB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjD,iEAAiE;YACjE,mEAAmE;YACnE,mEAAmE;YACnE,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,CAAC,MAAM,EAAE,EAAE;gBACpD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC9B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YACxC,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAEjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC7B,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;YACtB,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,uGAAuG;IACvG,OAAO,CAAC,GAAW;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,SAAS,GAAG,CAAC;YAAE,OAAO;QACjC,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/E,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAEO,cAAc,CAAC,GAAW;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,GAAW,EAAE,MAAoB;QAC7C,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM;YAAE,OAAO,CAAC,mBAAmB;QACjE,IAAI,MAAM,CAAC,SAAS,GAAG,CAAC;YAAE,OAAO,CAAC,qCAAqC;QACvE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC/B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,kEAAkE;IAClE,QAAQ;QACN,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;YAAE,WAAW,EAAE,CAAC;QACpE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/dist/lib/resumeCursor.d.ts

@@ -0,0 +1,16 @@
+export type DecodedCursor = {
+    bufferId: string;
+    n: number;
+};
+/** Mint a cursor naming one buffer's identity and position. */
+export declare function encodeCursor(bufferId: string, n: number): string;
+/**
+ * Decode a presented cursor. Returns null for anything that doesn't parse
+ * as `bufferId + ":" + a non-negative integer` — never throws. A
+ * charset-valid cursor naming garbage is the same "cannot be honored" case
+ * an unrecognized buffer id is: answered with a `reset` frame, not a 400.
+ * (A charset-*invalid* cursor is refused before this is ever called — see
+ * `src/routes/changes.ts`.)
+ */
+export declare function decodeCursor(seq: string): DecodedCursor | null;
+//# sourceMappingURL=resumeCursor.d.ts.map

package/dist/lib/resumeCursor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resumeCursor.d.ts","sourceRoot":"","sources":["../../src/lib/resumeCursor.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,CAAC,EAAE,MAAM,CAAC;CACX,CAAC;AAEF,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAe9D"}

package/{src/lib/resumeCursor.ts → dist/lib/resumeCursor.js}

@@ -11,17 +11,10 @@
  * ":" delimiter, since it never appears in the encoded output.
  */
 import { base64urlEncode, base64urlDecode } from '@haverstack/core/wire';
-
-export type DecodedCursor = {
-  bufferId: string;
-  n: number;
-};
-
 /** Mint a cursor naming one buffer's identity and position. */
-export function encodeCursor(bufferId: string, n: number): string {
-  return base64urlEncode(new TextEncoder().encode(`${bufferId}:${n}`));
+export function encodeCursor(bufferId, n) {
+    return base64urlEncode(new TextEncoder().encode(`${bufferId}:${n}`));
 }
-
 /**
  * Decode a presented cursor. Returns null for anything that doesn't parse
  * as `bufferId + ":" + a non-negative integer` — never throws. A
@@ -30,19 +23,24 @@ export function encodeCursor(bufferId: string, n: number): string {
  * (A charset-*invalid* cursor is refused before this is ever called — see
  * `src/routes/changes.ts`.)
  */
-export function decodeCursor(seq: string): DecodedCursor | null {
-  let text: string;
-  try {
-    text = new TextDecoder('utf-8', { fatal: true }).decode(base64urlDecode(seq));
-  } catch {
-    return null;
-  }
-  const colonIndex = text.lastIndexOf(':');
-  if (colonIndex === -1) return null;
-  const bufferId = text.slice(0, colonIndex);
-  const nText = text.slice(colonIndex + 1);
-  if (!/^\d+$/.test(nText)) return null;
-  const n = Number(nText);
-  if (!Number.isSafeInteger(n)) return null;
-  return { bufferId, n };
+export function decodeCursor(seq) {
+    let text;
+    try {
+        text = new TextDecoder('utf-8', { fatal: true }).decode(base64urlDecode(seq));
+    }
+    catch {
+        return null;
+    }
+    const colonIndex = text.lastIndexOf(':');
+    if (colonIndex === -1)
+        return null;
+    const bufferId = text.slice(0, colonIndex);
+    const nText = text.slice(colonIndex + 1);
+    if (!/^\d+$/.test(nText))
+        return null;
+    const n = Number(nText);
+    if (!Number.isSafeInteger(n))
+        return null;
+    return { bufferId, n };
 }
+//# sourceMappingURL=resumeCursor.js.map

package/dist/lib/resumeCursor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resumeCursor.js","sourceRoot":"","sources":["../../src/lib/resumeCursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAOzE,+DAA+D;AAC/D,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,CAAS;IACtD,OAAO,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,QAAQ,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACzB,CAAC"}

package/dist/lib/tokenSweep.d.ts

@@ -0,0 +1,17 @@
+import type { Logger } from 'pino';
+import type { StackTokenStore } from '@haverstack/core/wire';
+/**
+ * Delete tokens past their `expiresAt`.
+ *
+ * `lookupToken()` already refuses an expired token, so this changes no
+ * authorization outcome — it reclaims rows, and nothing else does: the
+ * store deletes only on an explicit `revokeToken()`. Since `POST
+ * /auth/token` is unauthenticated, strangers drive the row count, and
+ * unbounded growth costs disk and slows every `listTokens()` caller.
+ *
+ * Returns a throttled sweep — call it freely; it runs at most once per
+ * interval and never rejects, since failing to reclaim rows must not fail
+ * the request that happened to trigger it.
+ */
+export declare function createExpiredTokenSweeper(tokens: StackTokenStore, logger: Logger): () => Promise<void>;
+//# sourceMappingURL=tokenSweep.d.ts.map

package/dist/lib/tokenSweep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenSweep.d.ts","sourceRoot":"","sources":["../../src/lib/tokenSweep.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAM7D;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,MAAM,GACb,MAAM,OAAO,CAAC,IAAI,CAAC,CAmBrB"}

package/dist/lib/tokenSweep.js

@@ -0,0 +1,40 @@
+// Once an hour at most. The sweep is O(n) in tokens ever issued — cheap
+// relative to that interval, and never on the hot path twice in a row.
+const SWEEP_INTERVAL_MS = 60 * 60 * 1000;
+/**
+ * Delete tokens past their `expiresAt`.
+ *
+ * `lookupToken()` already refuses an expired token, so this changes no
+ * authorization outcome — it reclaims rows, and nothing else does: the
+ * store deletes only on an explicit `revokeToken()`. Since `POST
+ * /auth/token` is unauthenticated, strangers drive the row count, and
+ * unbounded growth costs disk and slows every `listTokens()` caller.
+ *
+ * Returns a throttled sweep — call it freely; it runs at most once per
+ * interval and never rejects, since failing to reclaim rows must not fail
+ * the request that happened to trigger it.
+ */
+export function createExpiredTokenSweeper(tokens, logger) {
+    let lastSweptAt = 0;
+    return async () => {
+        const now = Date.now();
+        if (now - lastSweptAt < SWEEP_INTERVAL_MS)
+            return;
+        // Claimed before the await, so two concurrent requests can't both start
+        // a sweep and race each other's revokeToken() calls.
+        lastSweptAt = now;
+        try {
+            const all = await tokens.listTokens();
+            const expired = all.filter((t) => t.expiresAt !== undefined && t.expiresAt.getTime() <= now);
+            for (const t of expired)
+                await tokens.revokeToken(t.id);
+            if (expired.length > 0) {
+                logger.info({ revoked: expired.length }, 'Swept expired tokens');
+            }
+        }
+        catch (err) {
+            logger.warn({ err }, 'Expired-token sweep failed');
+        }
+    };
+}
+//# sourceMappingURL=tokenSweep.js.map

package/dist/lib/tokenSweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenSweep.js","sourceRoot":"","sources":["../../src/lib/tokenSweep.ts"],"names":[],"mappings":"AAGA,wEAAwE;AACxE,uEAAuE;AACvE,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAuB,EACvB,MAAc;IAEd,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,WAAW,GAAG,iBAAiB;YAAE,OAAO;QAClD,wEAAwE;QACxE,qDAAqD;QACrD,WAAW,GAAG,GAAG,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC;YAC7F,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,4BAA4B,CAAC,CAAC;QACrD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/main.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":""}

package/dist/main.js

@@ -0,0 +1,46 @@
+import { serve } from '@hono/node-server';
+import pino from 'pino';
+import { loadConfig } from './config.js';
+import { initStack } from './stack.js';
+import { createApp } from './app.js';
+import { createShutdownHandler } from './shutdown.js';
+const logger = pino({
+    level: process.env['LOG_LEVEL'] ?? 'info',
+    transport: process.env['NODE_ENV'] !== 'production'
+        ? { target: 'pino-pretty', options: { colorize: true } }
+        : undefined,
+});
+// Set once initStack() resolves, so the fatal-error handler below can flush
+// a crash that happens after startup. Undefined before then: nothing to
+// flush yet.
+let ctx;
+async function main() {
+    const config = loadConfig();
+    ctx = await initStack(config, logger);
+    const app = createApp(ctx, config, logger);
+    logger.info({ dbPath: config.dbPath }, 'Stack initialized');
+    const server = serve({ fetch: app.fetch, port: config.port }, (info) => {
+        logger.info({ port: info.port }, 'Server listening');
+    });
+    const shutdown = createShutdownHandler(server, ctx, logger, config.shutdownTimeoutMs);
+    const onSignal = (signal) => {
+        shutdown(signal)
+            .then(() => process.exit(0))
+            .catch((err) => {
+            logger.error({ err }, 'Error during shutdown');
+            process.exit(1);
+        });
+    };
+    process.on('SIGTERM', () => onSignal('SIGTERM'));
+    process.on('SIGINT', () => onSignal('SIGINT'));
+}
+main().catch(async (err) => {
+    logger.error({ err }, 'Fatal startup error');
+    if (ctx) {
+        await ctx.stack.flush().catch((flushErr) => {
+            logger.error({ err: flushErr }, 'Failed to flush during fatal-error shutdown');
+        });
+    }
+    process.exit(1);
+});
+//# sourceMappingURL=main.js.map

package/dist/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAqB,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM;IACzC,SAAS,EACP,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;QACtC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACxD,CAAC,CAAC,SAAS;CAChB,CAAC,CAAC;AAEH,4EAA4E;AAC5E,wEAAwE;AACxE,aAAa;AACb,IAAI,GAA6B,CAAC;AAElC,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3C,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAE5D,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;QACrE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;QAClC,QAAQ,CAAC,MAAM,CAAC;aACb,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,uBAAuB,CAAC,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IACzB,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,qBAAqB,CAAC,CAAC;IAC7C,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE;YACzC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,6CAA6C,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/middleware/auth.d.ts

@@ -0,0 +1,25 @@
+import type { MiddlewareHandler } from 'hono';
+import type { TokenSession } from '@haverstack/core';
+import type { AppEnv } from '../types.js';
+import type { StackContext } from '../stack.js';
+/**
+ * Constant-time string equality, for comparing a presented credential
+ * against a configured secret. Exported so every comparison of the owner
+ * token uses the same one — `GET /changes` re-derives "is this the owner"
+ * to decide whether to arm its session re-check.
+ */
+export declare function safeCompare(a: string, b: string): boolean;
+export declare function authMiddleware(ownerToken: string, ctx: StackContext): MiddlewareHandler<AppEnv>;
+export declare function requireAuth(): MiddlewareHandler<AppEnv>;
+/**
+ * Whether a session is the stack owner acting alone: undelegated, and
+ * authenticated as the owner rather than merely delegated for it. Being the
+ * owner is never on its own sufficient under delegation — a delegated
+ * session with the owner as principal still fails this, matching
+ * `ScopedStack`'s own owner-only gates (e.g. hard delete). See
+ * docs/spec/access-control.md § Delegation.
+ */
+export declare function isOwnerActingAlone(auth: TokenSession | null, ownerEntityId: string): boolean;
+/** Gates a route to the owner acting alone; see `isOwnerActingAlone()`. */
+export declare function requireOwner(ownerEntityId: string): MiddlewareHandler<AppEnv>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAIzD;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAyB/F;AAED,wBAAgB,WAAW,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAKvD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAE5F;AAED,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAS7E"}

package/dist/middleware/auth.js

@@ -0,0 +1,74 @@
+import { timingSafeEqual } from 'node:crypto';
+import { StackPermissionError } from '@haverstack/core';
+import { wireError } from '../wireError.js';
+/**
+ * Constant-time string equality, for comparing a presented credential
+ * against a configured secret. Exported so every comparison of the owner
+ * token uses the same one — `GET /changes` re-derives "is this the owner"
+ * to decide whether to arm its session re-check.
+ */
+export function safeCompare(a, b) {
+    const ba = Buffer.from(a);
+    const bb = Buffer.from(b);
+    return ba.length === bb.length && timingSafeEqual(ba, bb);
+}
+export function authMiddleware(ownerToken, ctx) {
+    const ownerEntityId = ctx.stack.ownerEntityId;
+    return async (c, next) => {
+        const header = c.req.header('Authorization');
+        if (header === undefined) {
+            c.set('auth', null);
+        }
+        else if (!header.startsWith('Bearer ')) {
+            // A credential that isn't a bearer token (`Basic ...`, a missing
+            // space) is a 401, never a silent downgrade to anonymous.
+            return wireError(c, 401, 'unauthorized', 'Missing or invalid bearer token');
+        }
+        else {
+            const token = header.slice(7);
+            if (safeCompare(token, ownerToken)) {
+                c.set('auth', { principalId: ownerEntityId, subjectId: ownerEntityId });
+            }
+            else {
+                const session = await ctx.tokens.lookupToken(token);
+                // Unknown, expired, or revoked is distinct from "none offered",
+                // and must not read as anonymous on optional-auth routes.
+                if (!session)
+                    return wireError(c, 401, 'unauthorized', 'Missing or invalid bearer token');
+                c.set('auth', session);
+            }
+        }
+        await next();
+    };
+}
+export function requireAuth() {
+    return async (c, next) => {
+        if (!c.get('auth'))
+            return wireError(c, 401, 'unauthorized', 'Missing or invalid bearer token');
+        await next();
+    };
+}
+/**
+ * Whether a session is the stack owner acting alone: undelegated, and
+ * authenticated as the owner rather than merely delegated for it. Being the
+ * owner is never on its own sufficient under delegation — a delegated
+ * session with the owner as principal still fails this, matching
+ * `ScopedStack`'s own owner-only gates (e.g. hard delete). See
+ * docs/spec/access-control.md § Delegation.
+ */
+export function isOwnerActingAlone(auth, ownerEntityId) {
+    return auth?.principalId === ownerEntityId && auth?.subjectId === ownerEntityId;
+}
+/** Gates a route to the owner acting alone; see `isOwnerActingAlone()`. */
+export function requireOwner(ownerEntityId) {
+    return async (c, next) => {
+        const auth = c.get('auth');
+        if (!auth)
+            return wireError(c, 401, 'unauthorized', 'Missing or invalid bearer token');
+        if (!isOwnerActingAlone(auth, ownerEntityId)) {
+            throw new StackPermissionError('Owner access required');
+        }
+        await next();
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAIxD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,CAAS,EAAE,CAAS;IAC9C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,GAAiB;IAClE,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;IAE9C,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,iEAAiE;YACjE,0DAA0D;YAC1D,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,iCAAiC,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;gBACnC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;YAC1E,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACpD,gEAAgE;gBAChE,0DAA0D;gBAC1D,IAAI,CAAC,OAAO;oBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,iCAAiC,CAAC,CAAC;gBAC1F,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,iCAAiC,CAAC,CAAC;QAChG,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAyB,EAAE,aAAqB;IACjF,OAAO,IAAI,EAAE,WAAW,KAAK,aAAa,IAAI,IAAI,EAAE,SAAS,KAAK,aAAa,CAAC;AAClF,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,aAAqB;IAChD,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,iCAAiC,CAAC,CAAC;QACvF,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/errors.d.ts

@@ -0,0 +1,17 @@
+import type { ErrorHandler } from 'hono';
+import type { Logger } from 'pino';
+import { type Stack } from '@haverstack/core';
+import type { AppEnv } from '../types.js';
+/**
+ * Central error handler. `serializeError()` covers every core `StackError`
+ * (thrown directly by routes or surfaced from `Stack`/`ScopedStack`) with
+ * the wire-format's typed `{ error: { code, message } }` body. Anything
+ * else is an unanticipated bug: log it and return a bodyless 500 rather
+ * than guessing at a taxonomy it doesn't belong to.
+ *
+ * `stack` is the unscoped root Stack, used only to probe existence for the
+ * refusal log below — never to read content or bypass a permission check
+ * for the response itself.
+ */
+export declare function errorMiddleware(logger: Logger, stack: Stack): ErrorHandler<AppEnv>;
+//# sourceMappingURL=errors.d.ts.map

package/dist/middleware/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/middleware/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAEzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,EAA4C,KAAK,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAsDlF"}