@jini-ai/http-kit 0.3.1 → 0.3.3

package/dist/fastify/adapter.d.ts

@@ -1,31 +0,0 @@
-/**
- * The module's top orchestration layer: wires request parsing, the same-origin guard, a route's
- * `handle`, and response serialization into a single Fastify route handler. This is the only file
- * in this subtree that knows about Fastify's `request`/`reply` on the mounting side. Same job as
- * `../express/adapter.ts`'s `mountJsonRoute`, registered through Fastify's native
- * `fastify.route({ method, url, handler })` instead of Express's `app[method](path, handler)`.
- */
-import type { FastifyInstance } from 'fastify';
-import { type OriginContext } from './origin.js';
-import type { JsonRouteSpec } from '../types.js';
-/** Server startup state a mounted route needs to evaluate its same-origin guard. */
-export interface AdapterContext extends OriginContext {
-}
-/**
- * Identity function that pins a route spec's generic parameters at the definition site so
- * callers do not have to repeat them. The returned spec is consumed by `mountJsonRoute` (live)
- * and by tests (direct invocation of `route.parse` / `route.handle`).
- */
-export declare function defineJsonRoute<Input, Output, Deps>(spec: JsonRouteSpec<Input, Output, Deps>): JsonRouteSpec<Input, Output, Deps>;
-/**
- * Mounts one JsonRouteSpec on a Fastify instance. The Adapter is the only code here that knows
- * about request/reply; the route's parse and handle functions operate on `RouteInputContext` and
- * `Deps` respectively, so they are unit testable without Fastify.
- *
- * `exposeHeadRoute: false` is passed explicitly so a `GET` spec does not also register Fastify's
- * automatic `HEAD` sibling route — the Express version never registers one either, and a spec's
- * `handle` is not written to answer a bodyless `HEAD` request correctly (e.g. `daemonStatusRoute`
- * always returns a JSON body).
- */
-export declare function mountJsonRoute<Input, Output, Deps>(app: FastifyInstance, spec: JsonRouteSpec<Input, Output, Deps>, deps: Deps, adapter: AdapterContext): void;
-//# sourceMappingURL=adapter.d.ts.map

package/dist/fastify/adapter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/fastify/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAI7E,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAc,aAAa,EAAE,MAAM,aAAa,CAAC;AAE7D,oFAAoF;AACpF,MAAM,WAAW,cAAe,SAAQ,aAAa;CAAG;AAExD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EACjD,IAAI,EAAE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GACvC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAEpC;AAWD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAChD,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EACxC,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,cAAc,GACtB,IAAI,CA+BN"}

package/dist/fastify/adapter.js

@@ -1,64 +0,0 @@
-import { createApiError } from '@jini/protocol';
-import { rawInput } from './request.js';
-import { sendApiError, sendJson, statusForError } from './response.js';
-import { guardSameOrigin } from './origin.js';
-/**
- * Identity function that pins a route spec's generic parameters at the definition site so
- * callers do not have to repeat them. The returned spec is consumed by `mountJsonRoute` (live)
- * and by tests (direct invocation of `route.parse` / `route.handle`).
- */
-export function defineJsonRoute(spec) {
-    return spec;
-}
-/** Maps the shared, lower-case `HttpMethod` union to the upper-case method literal Fastify's `route()` expects. */
-const FASTIFY_METHOD = {
-    get: 'GET',
-    post: 'POST',
-    put: 'PUT',
-    delete: 'DELETE',
-    patch: 'PATCH',
-};
-/**
- * Mounts one JsonRouteSpec on a Fastify instance. The Adapter is the only code here that knows
- * about request/reply; the route's parse and handle functions operate on `RouteInputContext` and
- * `Deps` respectively, so they are unit testable without Fastify.
- *
- * `exposeHeadRoute: false` is passed explicitly so a `GET` spec does not also register Fastify's
- * automatic `HEAD` sibling route — the Express version never registers one either, and a spec's
- * `handle` is not written to answer a bodyless `HEAD` request correctly (e.g. `daemonStatusRoute`
- * always returns a JSON body).
- */
-export function mountJsonRoute(app, spec, deps, adapter) {
-    app.route({
-        method: FASTIFY_METHOD[spec.method],
-        url: spec.path,
-        exposeHeadRoute: false,
-        handler: async (req, reply) => {
-            try {
-                if (spec.requireSameOrigin) {
-                    const origin = guardSameOrigin(req, adapter);
-                    if (!origin.ok) {
-                        sendApiError(reply, statusForError(origin.error), origin.error);
-                        return;
-                    }
-                }
-                const parsed = spec.parse(rawInput(req));
-                if (!parsed.ok) {
-                    sendApiError(reply, statusForError(parsed.error), parsed.error);
-                    return;
-                }
-                const result = await spec.handle(parsed.value, deps);
-                if (!result.ok) {
-                    sendApiError(reply, statusForError(result.error), result.error);
-                    return;
-                }
-                sendJson(reply, spec.successStatus ?? 200, result.value);
-            }
-            catch (e) {
-                const message = e instanceof Error ? e.message : String(e);
-                sendApiError(reply, 500, createApiError('INTERNAL_ERROR', message));
-            }
-        },
-    });
-}
-//# sourceMappingURL=adapter.js.map

package/dist/fastify/adapter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../src/fastify/adapter.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,eAAe,EAAsB,MAAM,aAAa,CAAC;AAMlE;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAwC;IAExC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mHAAmH;AACnH,MAAM,cAAc,GAAoE;IACtF,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;CACf,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAoB,EACpB,IAAwC,EACxC,IAAU,EACV,OAAuB;IAEvB,GAAG,CAAC,KAAK,CAAC;QACR,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;QACnC,GAAG,EAAE,IAAI,CAAC,IAAI;QACd,eAAe,EAAE,KAAK;QACtB,OAAO,EAAE,KAAK,EAAE,GAAmB,EAAE,KAAmB,EAAE,EAAE;YAC1D,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;oBAC7C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;wBACf,YAAY,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;wBAChE,OAAO;oBACT,CAAC;gBACH,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,YAAY,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;oBAChE,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACrD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,YAAY,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;oBAChE,OAAO;gBACT,CAAC;gBACD,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,IAAI,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC3D,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,cAAc,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/fastify/agents.d.ts

@@ -1,13 +0,0 @@
-/**
- * @module fastify/agents
- *
- * Fastify-mounting glue for `../agents.js`'s `agentListRoute` — the exact same `JsonRouteSpec`
- * the Express mounting in `../agents.js` uses, just mounted through this subtree's own
- * `mountJsonRoute` instead.
- */
-import type { FastifyInstance } from 'fastify';
-import { type AgentsHttpDeps } from '../agents.js';
-import { type AdapterContext } from './adapter.js';
-/** Mounts `GET /api/agents` on `app` — the Fastify-native equivalent of `../agents.js`'s `registerAgentRoutes`. */
-export declare function registerAgentRoutes(app: FastifyInstance, deps: AgentsHttpDeps, adapter: AdapterContext): void;
-//# sourceMappingURL=agents.d.ts.map

package/dist/fastify/agents.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/fastify/agents.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnE,mHAAmH;AACnH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,CAE7G"}

package/dist/fastify/agents.js

@@ -1,7 +0,0 @@
-import { agentListRoute } from '../agents.js';
-import { mountJsonRoute } from './adapter.js';
-/** Mounts `GET /api/agents` on `app` — the Fastify-native equivalent of `../agents.js`'s `registerAgentRoutes`. */
-export function registerAgentRoutes(app, deps, adapter) {
-    mountJsonRoute(app, agentListRoute, deps, adapter);
-}
-//# sourceMappingURL=agents.js.map

package/dist/fastify/agents.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/fastify/agents.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,cAAc,EAAuB,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,cAAc,EAAuB,MAAM,cAAc,CAAC;AAEnE,mHAAmH;AACnH,MAAM,UAAU,mBAAmB,CAAC,GAAoB,EAAE,IAAoB,EAAE,OAAuB;IACrG,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC"}

package/dist/fastify/api-security-middleware.d.ts

@@ -1,64 +0,0 @@
-/**
- * @module fastify/api-security-middleware
- *
- * The two `/api` request gates a locally-bound daemon needs before any route handler runs:
- * bearer-token authentication (optional, active only when a token is configured) and cross-origin
- * rejection (always active). Same job and decision logic as `../express/api-security-middleware.ts`
- * (see that file's own doc for the full drop-list this was genericized from), reimplemented on
- * Fastify's native `onRequest` lifecycle hook (`app.addHook('onRequest', ...)`) in place of
- * Express's `app.use('/api', ...)` path-scoped middleware. Fastify has no first-class "scope this
- * hook to a URL prefix" primitive at the plain-instance level (that requires nesting the routes
- * themselves inside a `.register()` plugin with a `prefix`, which `mountPackHttp`'s pack-agnostic
- * mounting does not do), so both hooks below scope themselves manually by checking the request's
- * own path against the `/api` prefix before applying either gate — the observable behavior is
- * identical to the Express version's `app.use('/api', ...)` scoping.
- */
-import type { FastifyInstance } from 'fastify';
-import { type ApiTokenAuthEnvConfig } from '@jini/core';
-export interface ApiBearerAuthMiddlewareDeps {
-    /** Env var names for the token/disable flags. Defaults to `JINI_API_TOKEN` / `JINI_DISABLE_API_AUTH`. */
-    tokenConfig?: ApiTokenAuthEnvConfig;
-    /** Defaults to `process.env`. Threaded through so tests never have to mutate real process env. */
-    env?: NodeJS.ProcessEnv;
-}
-/**
- * Registers a bearer-token gate on every `/api/*` route, active only when
- * {@link isApiTokenMiddlewareEnabled} says a token is configured and auth hasn't been disabled.
- * When active: open-probe paths and loopback peers skip the check unconditionally; every other
- * request must send `Authorization: Bearer <token>` matching the configured token exactly, or the
- * request is rejected with 401 before reaching any route handler.
- *
- * @param app - The Fastify instance to register the gate on.
- * @param deps - See {@link ApiBearerAuthMiddlewareDeps}. Both fields are optional; omitting `deps`
- * entirely reads `JINI_API_TOKEN`/`JINI_DISABLE_API_AUTH` from real `process.env`.
- * @returns Nothing. Registers zero hooks (a deliberate no-op, not a bug) when no token is configured.
- * @complexity Setup is O(1). Each gated request is O(1) (one Set lookup, one regex match).
- * @overallScore 100/100
- */
-export declare function registerApiBearerAuthMiddleware(app: FastifyInstance, deps?: ApiBearerAuthMiddlewareDeps): void;
-export interface ApiOriginGuardMiddlewareDeps {
-    /** The host this daemon is bound to — compared against a request's `Host`/`Origin` headers. */
-    host: string;
-    /** Extra allow-listed origins (e.g. a reverse-proxy's public origin). Defaults to none. */
-    extraAllowedOrigins?: readonly string[];
-    /** Returns the daemon's resolved listen port, or a falsy value before it has resolved. */
-    getResolvedPort: () => number | null | undefined;
-    /** Defaults to `process.env`. Threaded through so `JINI_WEB_PORT` is testable without mutating real process env. */
-    env?: NodeJS.ProcessEnv;
-}
-/**
- * Registers an unconditional cross-origin gate on every `/api/*` route: non-browser clients (no
- * `Origin` header) and requests whose `Origin` resolves to a loopback, private-LAN, or explicitly
- * allow-listed origin are let through; everything else is rejected with 403. `Origin: null`
- * (typically a sandboxed iframe) is always rejected — see the Express version's doc for why the
- * origin daemon's safe-GET exemption for that case was dropped.
- *
- * @param app - The Fastify instance to register the gate on.
- * @param deps - See {@link ApiOriginGuardMiddlewareDeps}.
- * @returns Nothing. Unlike the bearer-token gate, this always registers its hook — there is
- * no "disabled" state.
- * @complexity Setup is O(1). Each gated request is O(p) in the number of allowed ports (typically 1-2).
- * @overallScore 100/100
- */
-export declare function registerApiOriginGuardMiddleware(app: FastifyInstance, deps: ApiOriginGuardMiddlewareDeps): void;
-//# sourceMappingURL=api-security-middleware.d.ts.map

package/dist/fastify/api-security-middleware.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-security-middleware.d.ts","sourceRoot":"","sources":["../../src/fastify/api-security-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAC7E,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAC;AAgBpB,MAAM,WAAW,2BAA2B;IAC1C,yGAAyG;IACzG,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,kGAAkG;IAClG,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAoBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,GAAE,2BAAgC,GAAG,IAAI,CAmClH;AAED,MAAM,WAAW,4BAA4B;IAC3C,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,0FAA0F;IAC1F,eAAe,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjD,oHAAoH;IACpH,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAWD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,4BAA4B,GAAG,IAAI,CAyC/G"}

package/dist/fastify/api-security-middleware.js

@@ -1,139 +0,0 @@
-import { apiTokenFromEnv, isApiTokenMiddlewareEnabled, } from '@jini/core';
-import { isLoopbackPeerAddress } from './local-daemon-request.js';
-import { allowedBrowserPorts, isAllowedBrowserOrigin } from '../origin-validation.js';
-/** Health/readiness/version probes stay reachable without a bearer token so monitoring never needs one. Both the mount-relative and `/api`-prefixed forms are kept for parity with the Express version's set (only the `/api`-prefixed forms are ever reachable here, since both hooks below already require the path to start with `/api` before this set is even consulted). */
-const OPEN_PROBE_PATHS = new Set([
-    '/health',
-    '/api/health',
-    '/ready',
-    '/api/ready',
-    '/version',
-    '/api/version',
-]);
-const BEARER_TOKEN_PATTERN = /^Bearer\s+(\S+)\s*$/i;
-const DEFAULT_TOKEN_CONFIG = {
-    tokenEnvVar: 'JINI_API_TOKEN',
-    disableEnvVar: 'JINI_DISABLE_API_AUTH',
-};
-/**
- * The request path with no query string — Fastify's `request.url` (unlike Express's
- * `request.path`) always includes the query string, so this strips it to match Express's
- * comparison semantics. `req.url` is typed as a required `string` on `FastifyRequest`
- * (never `undefined`), and `String.prototype.split` on a string separator always returns an
- * array with at least one element, so the `[0]` index is provably defined — the non-null
- * assertion documents that guarantee instead of masking it behind an unreachable `?? ''` fallback
- * that could never be exercised by a real request.
- */
-function requestPath(req) {
-    return req.url.split('?')[0];
-}
-/**
- * Registers a bearer-token gate on every `/api/*` route, active only when
- * {@link isApiTokenMiddlewareEnabled} says a token is configured and auth hasn't been disabled.
- * When active: open-probe paths and loopback peers skip the check unconditionally; every other
- * request must send `Authorization: Bearer <token>` matching the configured token exactly, or the
- * request is rejected with 401 before reaching any route handler.
- *
- * @param app - The Fastify instance to register the gate on.
- * @param deps - See {@link ApiBearerAuthMiddlewareDeps}. Both fields are optional; omitting `deps`
- * entirely reads `JINI_API_TOKEN`/`JINI_DISABLE_API_AUTH` from real `process.env`.
- * @returns Nothing. Registers zero hooks (a deliberate no-op, not a bug) when no token is configured.
- * @complexity Setup is O(1). Each gated request is O(1) (one Set lookup, one regex match).
- * @overallScore 100/100
- */
-export function registerApiBearerAuthMiddleware(app, deps = {}) {
-    const tokenConfig = deps.tokenConfig ?? DEFAULT_TOKEN_CONFIG;
-    const env = deps.env ?? process.env;
-    if (!isApiTokenMiddlewareEnabled(tokenConfig, env))
-        return;
-    const apiToken = apiTokenFromEnv(tokenConfig, env);
-    app.addHook('onRequest', (req, reply, done) => {
-        const path = requestPath(req);
-        if (!path.startsWith('/api')) {
-            done();
-            return;
-        }
-        if (OPEN_PROBE_PATHS.has(path)) {
-            done();
-            return;
-        }
-        // Loopback short-circuit: the desktop UI / local CLI never carry a bearer, and a reverse
-        // proxy in front of a non-loopback bind must always forward the real bearer itself — so this
-        // is intentionally not fooled by a proxied `X-Forwarded-For` header.
-        if (isLoopbackPeerAddress(req.socket?.remoteAddress)) {
-            done();
-            return;
-        }
-        const match = BEARER_TOKEN_PATTERN.exec(req.headers.authorization ?? '');
-        if (!match || match[1] !== apiToken) {
-            reply.code(401).send({
-                error: {
-                    code: 'API_TOKEN_REQUIRED',
-                    message: `Authorization: Bearer <${tokenConfig.tokenEnvVar}> required`,
-                },
-            });
-            return;
-        }
-        done();
-    });
-}
-/**
- * Chrome may strip the port from the `Origin` header on same-origin GET requests. Used only as a
- * narrow fallback for safe, idempotent GET requests once the exact-match check below has already
- * failed — mutating routes always require an exact origin/host match.
- */
-function isPortlessLoopbackOrigin(origin) {
-    return /^https?:\/\/(127\.0\.0\.1|localhost|\[::1\])$/.test(origin);
-}
-/**
- * Registers an unconditional cross-origin gate on every `/api/*` route: non-browser clients (no
- * `Origin` header) and requests whose `Origin` resolves to a loopback, private-LAN, or explicitly
- * allow-listed origin are let through; everything else is rejected with 403. `Origin: null`
- * (typically a sandboxed iframe) is always rejected — see the Express version's doc for why the
- * origin daemon's safe-GET exemption for that case was dropped.
- *
- * @param app - The Fastify instance to register the gate on.
- * @param deps - See {@link ApiOriginGuardMiddlewareDeps}.
- * @returns Nothing. Unlike the bearer-token gate, this always registers its hook — there is
- * no "disabled" state.
- * @complexity Setup is O(1). Each gated request is O(p) in the number of allowed ports (typically 1-2).
- * @overallScore 100/100
- */
-export function registerApiOriginGuardMiddleware(app, deps) {
-    const { host, getResolvedPort } = deps;
-    const extraAllowedOrigins = deps.extraAllowedOrigins ?? [];
-    const env = deps.env ?? process.env;
-    app.addHook('onRequest', (req, reply, done) => {
-        const path = requestPath(req);
-        if (!path.startsWith('/api')) {
-            done();
-            return;
-        }
-        const origin = req.headers.origin;
-        if (origin == null || origin === '') {
-            done();
-            return;
-        }
-        if (origin === 'null') {
-            reply.code(403).send({ error: 'Origin: null not allowed for this route' });
-            return;
-        }
-        // Fail-closed: block every browser origin until the daemon's real listen port is known, so a
-        // request arriving in the brief window before `.listen()` resolves can never be compared
-        // against a wrong or default port.
-        const resolvedPort = getResolvedPort();
-        if (!resolvedPort) {
-            reply.code(403).send({ error: 'Server initializing' });
-            return;
-        }
-        const ports = allowedBrowserPorts(resolvedPort, env);
-        if (!isAllowedBrowserOrigin(origin, req.headers.host, ports, host, [...extraAllowedOrigins])) {
-            if (req.method !== 'GET' || !isPortlessLoopbackOrigin(String(origin))) {
-                reply.code(403).send({ error: 'Cross-origin requests are not allowed' });
-                return;
-            }
-        }
-        done();
-    });
-}
-//# sourceMappingURL=api-security-middleware.js.map

package/dist/fastify/api-security-middleware.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-security-middleware.js","sourceRoot":"","sources":["../../src/fastify/api-security-middleware.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,eAAe,EACf,2BAA2B,GAE5B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,kXAAkX;AAClX,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,SAAS;IACT,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AASpD,MAAM,oBAAoB,GAA0B;IAClD,WAAW,EAAE,gBAAgB;IAC7B,aAAa,EAAE,uBAAuB;CACvC,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,GAAmB;IACtC,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAAoB,EAAE,OAAoC,EAAE;IAC1G,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,GAAG,CAAC;QAAE,OAAO;IAE3D,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACnD,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,GAAmB,EAAE,KAAmB,EAAE,IAA2B,EAAE,EAAE;QACjG,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,yFAAyF;QACzF,6FAA6F;QAC7F,qEAAqE;QACrE,IAAI,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;YACrD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE;oBACL,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,0BAA0B,WAAW,CAAC,WAAW,YAAY;iBACvE;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAaD;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,MAAc;IAC9C,OAAO,+CAA+C,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gCAAgC,CAAC,GAAoB,EAAE,IAAkC;IACvG,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEpC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,GAAmB,EAAE,KAAmB,EAAE,IAA2B,EAAE,EAAE;QACjG,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YACpC,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,6FAA6F;QAC7F,yFAAyF;QACzF,mCAAmC;QACnC,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;QACvC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,mBAAmB,CAAC,CAAC,EAAE,CAAC;YAC7F,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACtE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;gBACzE,OAAO;YACT,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/fastify/compat.d.ts

@@ -1,22 +0,0 @@
-/**
- * Legacy-shaped error helpers: build/send an `ApiError` from separate `code`/`message`/`init`
- * arguments, matching call sites that predate `JsonRouteSpec`/`mountJsonRoute` (e.g. a host
- * application's own hand-mounted routes). No internal dependencies. `sendApiError` here is
- * deliberately the same name as `response.ts`'s `ApiError`-object-taking `sendApiError` — they
- * are different signatures for the same "send an error" job at two call-site generations; the
- * package's `fastify/index.ts` barrel re-exports this one as `sendCompatApiError` to keep both
- * addressable without a collision. Deliberately duplicated from `../express/compat.ts` — see
- * `./response.ts`'s top-of-module doc for why this subtree does not import from `express/`.
- */
-import type { ApiError, ApiErrorCode, ApiErrorResponse } from '@jini/protocol';
-import type { FastifyReply } from 'fastify';
-/** Builds an `ApiError` from separate `code`/`message`/`init` arguments (legacy call shape). */
-export declare function createCompatApiError(code: ApiErrorCode, message: string, init?: Omit<ApiError, 'code' | 'message'>): ApiError;
-/** Wraps `createCompatApiError`'s result in the standard `{ error }` envelope. */
-export declare function createCompatApiErrorResponse(code: ApiErrorCode, message: string, init?: Omit<ApiError, 'code' | 'message'>): ApiErrorResponse;
-/**
- * Writes an `ApiError` response built from separate `code`/`message`/`init` arguments (legacy
- * call shape) with the given status code. Exported from `fastify/index.ts` as `sendCompatApiError`.
- */
-export declare function sendApiError(reply: FastifyReply, status: number, code: ApiErrorCode, message: string, init?: Omit<ApiError, 'code' | 'message'>): FastifyReply;
-//# sourceMappingURL=compat.d.ts.map

package/dist/fastify/compat.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"compat.d.ts","sourceRoot":"","sources":["../../src/fastify/compat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,gGAAgG;AAChG,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAM,GAC5C,QAAQ,CAEV;AAED,kFAAkF;AAClF,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAM,GAC5C,gBAAgB,CAElB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAM,GAC5C,YAAY,CAEd"}

package/dist/fastify/compat.js

@@ -1,16 +0,0 @@
-/** Builds an `ApiError` from separate `code`/`message`/`init` arguments (legacy call shape). */
-export function createCompatApiError(code, message, init = {}) {
-    return { code, message, ...init };
-}
-/** Wraps `createCompatApiError`'s result in the standard `{ error }` envelope. */
-export function createCompatApiErrorResponse(code, message, init = {}) {
-    return { error: createCompatApiError(code, message, init) };
-}
-/**
- * Writes an `ApiError` response built from separate `code`/`message`/`init` arguments (legacy
- * call shape) with the given status code. Exported from `fastify/index.ts` as `sendCompatApiError`.
- */
-export function sendApiError(reply, status, code, message, init = {}) {
-    return reply.code(status).send(createCompatApiErrorResponse(code, message, init));
-}
-//# sourceMappingURL=compat.js.map

package/dist/fastify/compat.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"compat.js","sourceRoot":"","sources":["../../src/fastify/compat.ts"],"names":[],"mappings":"AAaA,gGAAgG;AAChG,MAAM,UAAU,oBAAoB,CAClC,IAAkB,EAClB,OAAe,EACf,OAA2C,EAAE;IAE7C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,4BAA4B,CAC1C,IAAkB,EAClB,OAAe,EACf,OAA2C,EAAE;IAE7C,OAAO,EAAE,KAAK,EAAE,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAmB,EACnB,MAAc,EACd,IAAkB,EAClB,OAAe,EACf,OAA2C,EAAE;IAE7C,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AACpF,CAAC"}

package/dist/fastify/daemon-status.d.ts

@@ -1,22 +0,0 @@
-/**
- * @module fastify/daemon-status
- *
- * Mounts the generic daemon status + shutdown routes through the Fastify Adapter. The route
- * SPECS themselves (`daemonStatusRoute`/`daemonShutdownRoute` — pure `defineJsonRoute`-shaped
- * data plus framework-agnostic `parse`/`handle` functions, see `../daemon-status.ts`'s own doc
- * for their full provenance) are intentionally NOT duplicated here: they never reference Express
- * at runtime (`../daemon-status.ts` only imports `type { Express }` for its own
- * `registerDaemonStatusRoutes`'s parameter — a type-only import that TypeScript's
- * `verbatimModuleSyntax` erases from the compiled output entirely, so importing the specs from
- * that module does not pull the `express` package into this subtree at runtime). This file's own
- * job is only the Fastify-specific mounting wrapper, calling `./adapter.js`'s Fastify
- * `mountJsonRoute` instead of the Express one.
- */
-import type { FastifyInstance } from 'fastify';
-import { daemonShutdownRoute, daemonStatusRoute, type DaemonShutdownResponse, type DaemonStatusDeps, type DaemonStatusResponse } from '../daemon-status.js';
-import { type AdapterContext } from './adapter.js';
-export { daemonShutdownRoute, daemonStatusRoute };
-export type { DaemonShutdownResponse, DaemonStatusDeps, DaemonStatusResponse };
-/** Mounts both daemon-status routes on `app`. A pack's `http(app, services)` calls this directly. */
-export declare function registerDaemonStatusRoutes(app: FastifyInstance, deps: DaemonStatusDeps, adapter: AdapterContext): void;
-//# sourceMappingURL=daemon-status.d.ts.map

package/dist/fastify/daemon-status.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"daemon-status.d.ts","sourceRoot":"","sources":["../../src/fastify/daemon-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC;AAClD,YAAY,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;AAE/E,qGAAqG;AACrG,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,CAGtH"}

package/dist/fastify/daemon-status.js

@@ -1,9 +0,0 @@
-import { daemonShutdownRoute, daemonStatusRoute, } from '../daemon-status.js';
-import { mountJsonRoute } from './adapter.js';
-export { daemonShutdownRoute, daemonStatusRoute };
-/** Mounts both daemon-status routes on `app`. A pack's `http(app, services)` calls this directly. */
-export function registerDaemonStatusRoutes(app, deps, adapter) {
-    mountJsonRoute(app, daemonStatusRoute, deps, adapter);
-    mountJsonRoute(app, daemonShutdownRoute, deps, adapter);
-}
-//# sourceMappingURL=daemon-status.js.map

package/dist/fastify/daemon-status.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"daemon-status.js","sourceRoot":"","sources":["../../src/fastify/daemon-status.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAIlB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAuB,MAAM,cAAc,CAAC;AAEnE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC;AAGlD,qGAAqG;AACrG,MAAM,UAAU,0BAA0B,CAAC,GAAoB,EAAE,IAAsB,EAAE,OAAuB;IAC9G,cAAc,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACtD,cAAc,CAAC,GAAG,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC"}

package/dist/fastify/host-tools.d.ts

@@ -1,13 +0,0 @@
-/**
- * @module fastify/host-tools
- *
- * Fastify-mounting glue for `../host-tools.js`'s `hostEditorsRoute`/`openResourceInEditorRoute` —
- * the exact same `JsonRouteSpec` objects the Express mounting in `../host-tools.js` uses, just
- * mounted through this subtree's own `mountJsonRoute` instead.
- */
-import type { FastifyInstance } from 'fastify';
-import { type HostToolsOpenInDeps } from '../host-tools.js';
-import { type AdapterContext } from './adapter.js';
-/** Mounts `GET /api/editors` and `POST /api/resources/:resourceRef/open-in` on `app` — the Fastify-native equivalent of `../host-tools.js`'s `registerHostToolsRoutes`. */
-export declare function registerHostToolsRoutes(app: FastifyInstance, adapter: AdapterContext, openInDeps?: HostToolsOpenInDeps): void;
-//# sourceMappingURL=host-tools.d.ts.map

package/dist/fastify/host-tools.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"host-tools.d.ts","sourceRoot":"","sources":["../../src/fastify/host-tools.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAA+C,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzG,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnE,2KAA2K;AAC3K,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,cAAc,EACvB,UAAU,GAAE,mBAAwB,GACnC,IAAI,CAGN"}

package/dist/fastify/host-tools.js

@@ -1,8 +0,0 @@
-import { hostEditorsRoute, openResourceInEditorRoute } from '../host-tools.js';
-import { mountJsonRoute } from './adapter.js';
-/** Mounts `GET /api/editors` and `POST /api/resources/:resourceRef/open-in` on `app` — the Fastify-native equivalent of `../host-tools.js`'s `registerHostToolsRoutes`. */
-export function registerHostToolsRoutes(app, adapter, openInDeps = {}) {
-    mountJsonRoute(app, hostEditorsRoute, {}, adapter);
-    mountJsonRoute(app, openResourceInEditorRoute, openInDeps, adapter);
-}
-//# sourceMappingURL=host-tools.js.map

package/dist/fastify/host-tools.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"host-tools.js","sourceRoot":"","sources":["../../src/fastify/host-tools.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAA4B,MAAM,kBAAkB,CAAC;AACzG,OAAO,EAAE,cAAc,EAAuB,MAAM,cAAc,CAAC;AAEnE,2KAA2K;AAC3K,MAAM,UAAU,uBAAuB,CACrC,GAAoB,EACpB,OAAuB,EACvB,aAAkC,EAAE;IAEpC,cAAc,CAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACnD,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC"}

package/dist/fastify/index.d.ts

@@ -1,36 +0,0 @@
-/**
- * @module @jini/http/fastify
- *
- * The Fastify-native transport implementation: request parsing, response serialization, the
- * Fastify-mounting Adapter (`defineJsonRoute`/`mountJsonRoute`, built on `fastify.route(...)`),
- * the `/api` bearer-auth and origin-guard `onRequest` hooks, a loopback-only request guard, a
- * route-registration inventory/guard built on Fastify's native `onRoute` application hook, legacy-
- * shaped compat error helpers, the generic daemon-status/shutdown routes, and full Fastify
- * mounting for the runs/agents/host-tools route packs (`registerRunRoutes` including its SSE
- * event stream, `registerAgentRoutes`, `registerHostToolsRoutes`) — every one mounting the exact
- * same `JsonRouteSpec` objects (and, for the SSE stream, the exact same
- * `handleRunEventStreamRequest` core) the `express`/root-barrel Express mounting uses, so
- * `transport: 'fastify'` serves identical routes to the Express default, not a reduced set. Every
- * export here operates on Fastify's `FastifyRequest`/`FastifyReply`/`FastifyInstance` types.
- * Import the shared, framework-agnostic pieces (`Result`, `JsonRouteSpec`, origin-validation
- * predicates, `mountPackHttp`) from the package root instead of duplicating them here.
- */
-export type { AdapterContext } from './adapter.js';
-export { defineJsonRoute, mountJsonRoute } from './adapter.js';
-export type { ApiBearerAuthMiddlewareDeps, ApiOriginGuardMiddlewareDeps } from './api-security-middleware.js';
-export { registerApiBearerAuthMiddleware, registerApiOriginGuardMiddleware } from './api-security-middleware.js';
-export { createCompatApiError, createCompatApiErrorResponse, sendApiError as sendCompatApiError, } from './compat.js';
-export type { DaemonShutdownResponse, DaemonStatusDeps, DaemonStatusResponse, } from './daemon-status.js';
-export { daemonShutdownRoute, daemonStatusRoute, registerDaemonStatusRoutes } from './daemon-status.js';
-export { isLoopbackHostname, isLoopbackPeerAddress, localOriginFromHeader, normalizeLocalAuthority, requireLocalDaemonRequest, validateLocalDaemonRequest, } from './local-daemon-request.js';
-export type { OriginContext } from './origin.js';
-export { guardSameOrigin } from './origin.js';
-export { rawInput, validationError } from './request.js';
-export { registerRunStreamRoute } from './run-stream.js';
-export { sendApiError, sendJson, statusForError } from './response.js';
-export type { InstallRouteRegistrationGuardOptions, RouteRegistration } from './route-registration-guard.js';
-export { getRouteRegistrationInventory, guardedRouteKey, installRouteRegistrationGuard, } from './route-registration-guard.js';
-export { registerRunEventStream, registerRunRoutes } from './runs.js';
-export { registerAgentRoutes } from './agents.js';
-export { registerHostToolsRoutes } from './host-tools.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/fastify/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/fastify/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE/D,YAAY,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC9G,OAAO,EAAE,+BAA+B,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAMjH,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,YAAY,IAAI,kBAAkB,GACnC,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAExG,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEvE,YAAY,EAAE,oCAAoC,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAC7G,OAAO,EACL,6BAA6B,EAC7B,eAAe,EACf,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/fastify/index.js

@@ -1,18 +0,0 @@
-export { defineJsonRoute, mountJsonRoute } from './adapter.js';
-export { registerApiBearerAuthMiddleware, registerApiOriginGuardMiddleware } from './api-security-middleware.js';
-// Legacy-shaped compat error helpers (separate code/message/init call shape). `sendApiError`
-// below (from `response.ts`) takes a single `ApiError` object; this compat `sendApiError` takes
-// `(code, message, init)` — same job, different call-site generation, so it is re-exported here
-// under a distinct name to avoid a duplicate export.
-export { createCompatApiError, createCompatApiErrorResponse, sendApiError as sendCompatApiError, } from './compat.js';
-export { daemonShutdownRoute, daemonStatusRoute, registerDaemonStatusRoutes } from './daemon-status.js';
-export { isLoopbackHostname, isLoopbackPeerAddress, localOriginFromHeader, normalizeLocalAuthority, requireLocalDaemonRequest, validateLocalDaemonRequest, } from './local-daemon-request.js';
-export { guardSameOrigin } from './origin.js';
-export { rawInput, validationError } from './request.js';
-export { registerRunStreamRoute } from './run-stream.js';
-export { sendApiError, sendJson, statusForError } from './response.js';
-export { getRouteRegistrationInventory, guardedRouteKey, installRouteRegistrationGuard, } from './route-registration-guard.js';
-export { registerRunEventStream, registerRunRoutes } from './runs.js';
-export { registerAgentRoutes } from './agents.js';
-export { registerHostToolsRoutes } from './host-tools.js';
-//# sourceMappingURL=index.js.map

package/dist/fastify/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/fastify/index.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG/D,OAAO,EAAE,+BAA+B,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAEjH,6FAA6F;AAC7F,gGAAgG;AAChG,gGAAgG;AAChG,qDAAqD;AACrD,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,YAAY,IAAI,kBAAkB,GACnC,MAAM,aAAa,CAAC;AAOrB,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAExG,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGvE,OAAO,EACL,6BAA6B,EAC7B,eAAe,EACf,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/fastify/local-daemon-request.d.ts

@@ -1,43 +0,0 @@
-import type { FastifyReply, FastifyRequest } from 'fastify';
-interface LocalAuthority {
-    hostname: string;
-    port: string;
-}
-interface LocalDaemonValidation {
-    ok: true;
-    origin: string | null;
-}
-interface LocalDaemonValidationError {
-    ok: false;
-    message: string;
-    details: Record<string, string>;
-}
-/** Parses a `Host`-header-shaped authority string, rejecting anything with a path/userinfo/query. */
-export declare function normalizeLocalAuthority(value: unknown): LocalAuthority | null;
-/** True when `hostname` is `localhost`, an IPv6 loopback literal, or a `127.0.0.0/8` IPv4 literal. */
-export declare function isLoopbackHostname(hostname: unknown): boolean;
-/** True when `address` (typically `req.socket.remoteAddress`) is a loopback peer, unwrapping an IPv4-mapped IPv6 prefix first. */
-export declare function isLoopbackPeerAddress(address: unknown): boolean;
-/** Parses an `Origin` header value into its origin string, requiring a bare `scheme://loopback-host[:port]` with no path/query/userinfo. */
-export declare function localOriginFromHeader(value: unknown): string | null;
-/**
- * Validates that `req` is a loopback request: the TCP peer address, the `Host` header, and (when
- * present) the `Origin` header must all resolve to a loopback host.
- *
- * @param req - The incoming request.
- * @returns `{ ok: true, origin }` on success (`origin` is the validated `Origin` header value, or
- *   `null` when the request carried none); otherwise `{ ok: false, message, details }` naming which
- *   check failed.
- */
-export declare function validateLocalDaemonRequest(req: FastifyRequest): LocalDaemonValidation | LocalDaemonValidationError;
-/**
- * Fastify `onRequest` hook that rejects any non-loopback request with a 403, and otherwise sets
- * permissive same-machine CORS headers before calling `done()`.
- *
- * @param req - The incoming request.
- * @param reply - The reply to reject on, or set CORS headers on before continuing.
- * @param done - Called (with no error) when the request validates as loopback, continuing the hook chain.
- */
-export declare function requireLocalDaemonRequest(req: FastifyRequest, reply: FastifyReply, done: (err?: Error) => void): void;
-export {};
-//# sourceMappingURL=local-daemon-request.d.ts.map

package/dist/fastify/local-daemon-request.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"local-daemon-request.d.ts","sourceRoot":"","sources":["../../src/fastify/local-daemon-request.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG5D,UAAU,cAAc;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,qBAAqB;IAC7B,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,UAAU,0BAA0B;IAClC,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,qGAAqG;AACrG,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAkB7E;AAED,sGAAsG;AACtG,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAS7D;AAED,kIAAkI;AAClI,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAQ/D;AAED,4IAA4I;AAC5I,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAcnE;AAOD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,cAAc,GAAG,qBAAqB,GAAG,0BAA0B,CA4BlH;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAerH"}