@jini-ai/http-kit 0.3.3 → 0.3.6

package/dist/fastify/local-daemon-request.d.ts

@@ -0,0 +1,43 @@
+import type { FastifyReply, FastifyRequest } from 'fastify';
+interface LocalAuthority {
+    hostname: string;
+    port: string;
+}
+interface LocalDaemonValidation {
+    ok: true;
+    origin: string | null;
+}
+interface LocalDaemonValidationError {
+    ok: false;
+    message: string;
+    details: Record<string, string>;
+}
+/** Parses a `Host`-header-shaped authority string, rejecting anything with a path/userinfo/query. */
+export declare function normalizeLocalAuthority(value: unknown): LocalAuthority | null;
+/** True when `hostname` is `localhost`, an IPv6 loopback literal, or a `127.0.0.0/8` IPv4 literal. */
+export declare function isLoopbackHostname(hostname: unknown): boolean;
+/** True when `address` (typically `req.socket.remoteAddress`) is a loopback peer, unwrapping an IPv4-mapped IPv6 prefix first. */
+export declare function isLoopbackPeerAddress(address: unknown): boolean;
+/** Parses an `Origin` header value into its origin string, requiring a bare `scheme://loopback-host[:port]` with no path/query/userinfo. */
+export declare function localOriginFromHeader(value: unknown): string | null;
+/**
+ * Validates that `req` is a loopback request: the TCP peer address, the `Host` header, and (when
+ * present) the `Origin` header must all resolve to a loopback host.
+ *
+ * @param req - The incoming request.
+ * @returns `{ ok: true, origin }` on success (`origin` is the validated `Origin` header value, or
+ *   `null` when the request carried none); otherwise `{ ok: false, message, details }` naming which
+ *   check failed.
+ */
+export declare function validateLocalDaemonRequest(req: FastifyRequest): LocalDaemonValidation | LocalDaemonValidationError;
+/**
+ * Fastify `onRequest` hook that rejects any non-loopback request with a 403, and otherwise sets
+ * permissive same-machine CORS headers before calling `done()`.
+ *
+ * @param req - The incoming request.
+ * @param reply - The reply to reject on, or set CORS headers on before continuing.
+ * @param done - Called (with no error) when the request validates as loopback, continuing the hook chain.
+ */
+export declare function requireLocalDaemonRequest(req: FastifyRequest, reply: FastifyReply, done: (err?: Error) => void): void;
+export {};
+//# sourceMappingURL=local-daemon-request.d.ts.map

package/dist/fastify/local-daemon-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-daemon-request.d.ts","sourceRoot":"","sources":["../../src/fastify/local-daemon-request.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG5D,UAAU,cAAc;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,qBAAqB;IAC7B,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,UAAU,0BAA0B;IAClC,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,qGAAqG;AACrG,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAkB7E;AAED,sGAAsG;AACtG,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAS7D;AAED,kIAAkI;AAClI,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAQ/D;AAED,4IAA4I;AAC5I,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAcnE;AAOD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,cAAc,GAAG,qBAAqB,GAAG,0BAA0B,CA4BlH;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAerH"}

package/dist/fastify/local-daemon-request.js

@@ -0,0 +1,155 @@
+/**
+ * @module fastify/local-daemon-request
+ *
+ * A loopback-only request guard: validates that a request's peer address, `Host` header, and (if
+ * present) `Origin` header are all loopback, and sets the CORS headers a same-machine caller
+ * needs. Distinct from `./origin.js`'s `guardSameOrigin` (which checks a browser tab's origin
+ * against a configured allow-list) — this guard instead restricts an endpoint to same-machine
+ * callers only (e.g. a local companion process), regardless of origin allow-list configuration.
+ *
+ * The header-parsing/classification predicates (`normalizeLocalAuthority`, `isLoopbackHostname`,
+ * `isLoopbackPeerAddress`, `localOriginFromHeader`) are pure and operate on plain string/unknown
+ * values, not a framework request object — deliberately duplicated from
+ * `../express/local-daemon-request.ts` rather than shared; see `./response.ts`'s top-of-module
+ * doc for why this subtree does not import from `express/`. Only `validateLocalDaemonRequest`
+ * and `requireLocalDaemonRequest` below are Fastify-specific (they read `FastifyRequest`/
+ * `FastifyReply` instead of Express's `Request`/`Response`/`req.get(...)`).
+ */
+import net from 'node:net';
+import { sendApiError } from './compat.js';
+/** Parses a `Host`-header-shaped authority string, rejecting anything with a path/userinfo/query. */
+export function normalizeLocalAuthority(value) {
+    if (typeof value !== 'string')
+        return null;
+    const trimmed = value.trim();
+    if (!trimmed || /[\s/@]/.test(trimmed) || trimmed.includes(','))
+        return null;
+    try {
+        // The guard above already rejects any `/`, `@`, or whitespace in `trimmed`, and the WHATWG
+        // URL parser requires a non-empty host for an `http:` URL — so `parsed.hostname` is always
+        // non-empty and `parsed.pathname` is always `/` for every `trimmed` value that reaches this
+        // line without throwing. `hostname` below can still end up empty after stripping a trailing
+        // dot (e.g. `trimmed === '.'` parses to `parsed.hostname === '.'`), so that check stays.
+        const parsed = new URL(`http://${trimmed}`);
+        const hostname = parsed.hostname.toLowerCase().replace(/\.$/, '');
+        if (!hostname)
+            return null;
+        return { hostname, port: parsed.port };
+    }
+    catch {
+        return null;
+    }
+}
+/** True when `hostname` is `localhost`, an IPv6 loopback literal, or a `127.0.0.0/8` IPv4 literal. */
+export function isLoopbackHostname(hostname) {
+    const normalized = String(hostname || '')
+        .toLowerCase()
+        .replace(/^\[|\]$/g, '')
+        .replace(/\.$/, '');
+    if (normalized === 'localhost')
+        return true;
+    if (normalized === '::1' || normalized === '0:0:0:0:0:0:0:1')
+        return true;
+    if (net.isIP(normalized) === 4)
+        return normalized === '127.0.0.1' || normalized.startsWith('127.');
+    return false;
+}
+/** True when `address` (typically `req.socket.remoteAddress`) is a loopback peer, unwrapping an IPv4-mapped IPv6 prefix first. */
+export function isLoopbackPeerAddress(address) {
+    if (typeof address !== 'string')
+        return false;
+    const normalized = address.trim().toLowerCase().replace(/^\[|\]$/g, '');
+    if (!normalized)
+        return false;
+    if (normalized.startsWith('::ffff:'))
+        return isLoopbackPeerAddress(normalized.slice('::ffff:'.length));
+    if (normalized === '::1' || normalized === '0:0:0:0:0:0:0:1')
+        return true;
+    if (net.isIP(normalized) === 4)
+        return normalized === '127.0.0.1' || normalized.startsWith('127.');
+    return false;
+}
+/** Parses an `Origin` header value into its origin string, requiring a bare `scheme://loopback-host[:port]` with no path/query/userinfo. */
+export function localOriginFromHeader(value) {
+    if (typeof value !== 'string')
+        return null;
+    const trimmed = value.trim();
+    if (!trimmed || trimmed === 'null' || trimmed.includes(','))
+        return null;
+    try {
+        const parsed = new URL(trimmed);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+            return null;
+        if (parsed.pathname !== '/' || parsed.search || parsed.hash || parsed.username || parsed.password)
+            return null;
+        if (!isLoopbackHostname(parsed.hostname))
+            return null;
+        return parsed.origin;
+    }
+    catch {
+        return null;
+    }
+}
+/** Reads a single-value request header, collapsing Node's `string | string[] | undefined` shape (Fastify headers are Node's raw `IncomingHttpHeaders`) to the first value. */
+function headerValue(value) {
+    return Array.isArray(value) ? value[0] : value;
+}
+/**
+ * Validates that `req` is a loopback request: the TCP peer address, the `Host` header, and (when
+ * present) the `Origin` header must all resolve to a loopback host.
+ *
+ * @param req - The incoming request.
+ * @returns `{ ok: true, origin }` on success (`origin` is the validated `Origin` header value, or
+ *   `null` when the request carried none); otherwise `{ ok: false, message, details }` naming which
+ *   check failed.
+ */
+export function validateLocalDaemonRequest(req) {
+    if (!isLoopbackPeerAddress(req.socket?.remoteAddress)) {
+        return {
+            ok: false,
+            message: 'request peer must be a loopback address',
+            details: { peer: 'remoteAddress' },
+        };
+    }
+    const host = normalizeLocalAuthority(headerValue(req.headers.host));
+    if (!host || !isLoopbackHostname(host.hostname)) {
+        return {
+            ok: false,
+            message: 'request host must be a loopback daemon address',
+            details: { header: 'host' },
+        };
+    }
+    const originHeader = headerValue(req.headers.origin);
+    if (originHeader !== undefined && !localOriginFromHeader(originHeader)) {
+        return {
+            ok: false,
+            message: 'request origin must be a loopback daemon origin',
+            details: { header: 'origin' },
+        };
+    }
+    return { ok: true, origin: localOriginFromHeader(originHeader) };
+}
+/**
+ * Fastify `onRequest` hook that rejects any non-loopback request with a 403, and otherwise sets
+ * permissive same-machine CORS headers before calling `done()`.
+ *
+ * @param req - The incoming request.
+ * @param reply - The reply to reject on, or set CORS headers on before continuing.
+ * @param done - Called (with no error) when the request validates as loopback, continuing the hook chain.
+ */
+export function requireLocalDaemonRequest(req, reply, done) {
+    const validation = validateLocalDaemonRequest(req);
+    if (!validation.ok) {
+        sendApiError(reply, 403, 'FORBIDDEN', validation.message, { details: validation.details });
+        return;
+    }
+    reply.header('Vary', 'Origin');
+    if (validation.origin) {
+        reply.header('Access-Control-Allow-Origin', validation.origin);
+    }
+    reply.header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+    reply.header('Access-Control-Allow-Headers', 'Content-Type');
+    reply.header('Access-Control-Max-Age', '600');
+    done();
+}
+//# sourceMappingURL=local-daemon-request.js.map

package/dist/fastify/local-daemon-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-daemon-request.js","sourceRoot":"","sources":["../../src/fastify/local-daemon-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAkB3C,qGAAqG;AACrG,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7E,IAAI,CAAC;QACH,2FAA2F;QAC3F,2FAA2F;QAC3F,4FAA4F;QAC5F,4FAA4F;QAC5F,yFAAyF;QACzF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,kBAAkB,CAAC,QAAiB;IAClD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;SACtC,WAAW,EAAE;SACb,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,IAAI,UAAU,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACnG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kIAAkI;AAClI,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,qBAAqB,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACvG,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACnG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4IAA4I;AAC5I,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC7E,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/G,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8KAA8K;AAC9K,SAAS,WAAW,CAAC,KAAoC;IACvD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAmB;IAC5D,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,yCAAyC;YAClD,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;SACnC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,uBAAuB,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,gDAAgD;YACzD,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;SAC5B,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,CAAC;QACvE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,iDAAiD;YAC1D,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC9B,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,CAAC,YAAY,CAAC,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAmB,EAAE,KAAmB,EAAE,IAA2B;IAC7G,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,OAAO;IACT,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/B,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,CAAC,MAAM,CAAC,6BAA6B,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;IACnE,KAAK,CAAC,MAAM,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;IAC7D,KAAK,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;IAC9C,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/fastify/origin.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Same-origin security guard: wraps the shared, framework-agnostic `isLocalSameOrigin` in the
+ * module's `Result` pipeline so the Fastify Adapter can treat an origin failure the same as a
+ * parse/handle failure. `isLocalSameOrigin` is imported from the shared root (`../origin-validation.js`)
+ * rather than duplicated, since it operates on plain header values (not a framework `Request`) and
+ * is already framework-agnostic — see `../pack-http.ts`'s doc for the same reasoning applied there.
+ */
+import type { FastifyRequest } from 'fastify';
+import { type Result } from '../types.js';
+/** The subset of server startup state `guardSameOrigin` needs: the resolved local port. */
+export interface OriginContext {
+    resolvedPortRef: {
+        current: number;
+    };
+}
+/**
+ * Wraps `isLocalSameOrigin` so the Fastify Adapter can fold the origin decision into the same
+ * error-handling pipeline as parse/handle failures.
+ */
+export declare function guardSameOrigin(req: FastifyRequest, origin: OriginContext): Result<void>;
+//# sourceMappingURL=origin.d.ts.map

package/dist/fastify/origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.d.ts","sourceRoot":"","sources":["../../src/fastify/origin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG9C,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AAEnD,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACtC;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,CAKxF"}

package/dist/fastify/origin.js

@@ -0,0 +1,14 @@
+import { createApiError } from '@jini/protocol';
+import { isLocalSameOrigin } from '../origin-validation.js';
+import { err, ok } from '../types.js';
+/**
+ * Wraps `isLocalSameOrigin` so the Fastify Adapter can fold the origin decision into the same
+ * error-handling pipeline as parse/handle failures.
+ */
+export function guardSameOrigin(req, origin) {
+    if (isLocalSameOrigin(req, origin.resolvedPortRef.current)) {
+        return ok(undefined);
+    }
+    return err(createApiError('FORBIDDEN', 'cross-origin request rejected'));
+}
+//# sourceMappingURL=origin.js.map

package/dist/fastify/origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.js","sourceRoot":"","sources":["../../src/fastify/origin.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,aAAa,CAAC;AAOnD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAmB,EAAE,MAAqB;IACxE,IAAI,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,+BAA+B,CAAC,CAAC,CAAC;AAC3E,CAAC"}

package/dist/fastify/request.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Request-side normalization: turns a raw Fastify `FastifyRequest` into the framework-independent
+ * `RouteInputContext` the rest of the module operates on, and builds a standard `BAD_REQUEST`
+ * `ApiError` for validation failures. Deliberately duplicated from `../express/request.ts` — see
+ * `./response.ts`'s top-of-module doc for why this subtree does not import from `express/`.
+ */
+import type { FastifyRequest } from 'fastify';
+import { type ApiError, type ApiValidationIssue } from '@jini/protocol';
+import type { RouteInputContext } from '../types.js';
+/**
+ * Extracts `body`/`query`/`params` from a Fastify `FastifyRequest` into a `RouteInputContext`, so
+ * a route's `parse` function can be unit-tested without constructing a real `FastifyRequest`.
+ */
+export declare function rawInput(request: FastifyRequest): RouteInputContext;
+/**
+ * Builds a `BAD_REQUEST` `ApiError` for a failed parse. When `issues` is non-empty, attaches
+ * them as structured validation details so clients can render per-field errors.
+ */
+export declare function validationError(message: string, issues?: Pick<ApiValidationIssue, 'path' | 'message'>[]): ApiError;
+//# sourceMappingURL=request.d.ts.map

package/dist/fastify/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/fastify/request.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAkB,KAAK,QAAQ,EAAE,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACxF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,iBAAiB,CAMnE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC,EAAO,GAC1D,QAAQ,CAOV"}

package/dist/fastify/request.js

@@ -0,0 +1,25 @@
+import { createApiError } from '@jini/protocol';
+/**
+ * Extracts `body`/`query`/`params` from a Fastify `FastifyRequest` into a `RouteInputContext`, so
+ * a route's `parse` function can be unit-tested without constructing a real `FastifyRequest`.
+ */
+export function rawInput(request) {
+    return {
+        body: request.body,
+        query: (request.query ?? {}),
+        params: (request.params ?? {}),
+    };
+}
+/**
+ * Builds a `BAD_REQUEST` `ApiError` for a failed parse. When `issues` is non-empty, attaches
+ * them as structured validation details so clients can render per-field errors.
+ */
+export function validationError(message, issues = []) {
+    if (issues.length === 0) {
+        return createApiError('BAD_REQUEST', message);
+    }
+    return createApiError('BAD_REQUEST', message, {
+        details: { kind: 'validation', issues },
+    });
+}
+//# sourceMappingURL=request.js.map

package/dist/fastify/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/fastify/request.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,cAAc,EAA0C,MAAM,gBAAgB,CAAC;AAGxF;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAuB;IAC9C,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAA4B;QACvD,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAA2B;KACzD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,SAAyD,EAAE;IAE3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,cAAc,CAAC,aAAa,EAAE,OAAO,EAAE;QAC5C,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAiD;KACvF,CAAC,CAAC;AACL,CAAC"}

package/dist/fastify/response.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Response-side serialization: writes a plain JSON body or a standard `ApiError` envelope onto a
+ * Fastify `FastifyReply`, and maps an `ApiErrorCode` to its default HTTP status. No internal
+ * dependencies — this is the terminal step of the Fastify Adapter's error-handling pipeline.
+ *
+ * Deliberately duplicated from `../express/response.ts` rather than shared: both files implement
+ * the identical `ApiErrorCode` -> HTTP status mapping and error-envelope shape, but this
+ * subtree's whole point is to stay independent of `express/` (see `../../source-map.md`'s
+ * Fastify-transport section) — a Fastify-only consumer must be able to import this module without
+ * ever pulling in anything that even *type*-references the `express` package.
+ */
+import type { FastifyReply } from 'fastify';
+import { type ApiError } from '@jini/protocol';
+/** Writes `body` as JSON with the given status code. */
+export declare function sendJson(reply: FastifyReply, status: number, body: unknown): void;
+/** Writes an `ApiError`, wrapped in the standard `{ error }` envelope, with the given status code. */
+export declare function sendApiError(reply: FastifyReply, status: number, error: ApiError): void;
+/** Resolves the HTTP status to send for an `ApiError`, defaulting to 500 for unmapped codes. */
+export declare function statusForError(error: ApiError): number;
+//# sourceMappingURL=response.d.ts.map

package/dist/fastify/response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.d.ts","sourceRoot":"","sources":["../../src/fastify/response.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAA0B,KAAK,QAAQ,EAAqB,MAAM,gBAAgB,CAAC;AAE1F,wDAAwD;AACxD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAEjF;AAED,sGAAsG;AACtG,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,IAAI,CAEvF;AA8BD,gGAAgG;AAChG,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,CAEtD"}

package/dist/fastify/response.js

@@ -0,0 +1,41 @@
+import { createApiErrorResponse } from '@jini/protocol';
+/** Writes `body` as JSON with the given status code. */
+export function sendJson(reply, status, body) {
+    reply.code(status).send(body);
+}
+/** Writes an `ApiError`, wrapped in the standard `{ error }` envelope, with the given status code. */
+export function sendApiError(reply, status, error) {
+    reply.code(status).send(createApiErrorResponse(error));
+}
+/**
+ * @internal
+ * Default HTTP status per generic `ApiErrorCode`. Codes not listed here fall back to 500 in
+ * `statusForError` — deliberately conservative, since an unmapped code (including any
+ * product-specific code a consuming pack defines) is more likely a new server-side failure mode
+ * than a client error. Kept identical to `../express/response.ts`'s copy — see this file's
+ * top-of-module doc for why it is duplicated rather than imported.
+ */
+const ERROR_STATUS_BY_CODE = {
+    BAD_REQUEST: 400,
+    UNAUTHORIZED: 401,
+    FORBIDDEN: 403,
+    NOT_FOUND: 404,
+    CONFLICT: 409,
+    PAYLOAD_TOO_LARGE: 413,
+    UNSUPPORTED_MEDIA_TYPE: 415,
+    VALIDATION_FAILED: 422,
+    RATE_LIMITED: 429,
+    INTERNAL_ERROR: 500,
+    UPSTREAM_UNAVAILABLE: 502,
+    TOOL_TOKEN_MISSING: 401,
+    TOOL_TOKEN_INVALID: 401,
+    TOOL_TOKEN_EXPIRED: 401,
+    TOOL_ENDPOINT_DENIED: 403,
+    TOOL_OPERATION_DENIED: 403,
+    TOOL_NOT_AVAILABLE: 503,
+};
+/** Resolves the HTTP status to send for an `ApiError`, defaulting to 500 for unmapped codes. */
+export function statusForError(error) {
+    return ERROR_STATUS_BY_CODE[error.code] ?? 500;
+}
+//# sourceMappingURL=response.js.map

package/dist/fastify/response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.js","sourceRoot":"","sources":["../../src/fastify/response.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,sBAAsB,EAAoC,MAAM,gBAAgB,CAAC;AAE1F,wDAAwD;AACxD,MAAM,UAAU,QAAQ,CAAC,KAAmB,EAAE,MAAc,EAAE,IAAa;IACzE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,YAAY,CAAC,KAAmB,EAAE,MAAc,EAAE,KAAe;IAC/E,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAA0C;IAClE,WAAW,EAAE,GAAG;IAChB,YAAY,EAAE,GAAG;IACjB,SAAS,EAAE,GAAG;IACd,SAAS,EAAE,GAAG;IACd,QAAQ,EAAE,GAAG;IACb,iBAAiB,EAAE,GAAG;IACtB,sBAAsB,EAAE,GAAG;IAC3B,iBAAiB,EAAE,GAAG;IACtB,YAAY,EAAE,GAAG;IACjB,cAAc,EAAE,GAAG;IACnB,oBAAoB,EAAE,GAAG;IACzB,kBAAkB,EAAE,GAAG;IACvB,kBAAkB,EAAE,GAAG;IACvB,kBAAkB,EAAE,GAAG;IACvB,oBAAoB,EAAE,GAAG;IACzB,qBAAqB,EAAE,GAAG;IAC1B,kBAAkB,EAAE,GAAG;CACxB,CAAC;AAEF,gGAAgG;AAChG,MAAM,UAAU,cAAc,CAAC,KAAe;IAC5C,OAAO,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;AACjD,CAAC"}

package/dist/fastify/route-registration-guard.d.ts

@@ -0,0 +1,70 @@
+/**
+ * @module fastify/route-registration-guard
+ *
+ * Builds a queryable inventory of every route registered on a Fastify instance, and guards a
+ * caller-supplied set of "must register at most once" route keys against accidental duplicate
+ * registration — e.g. two packs each mounting `POST /api/runs` would otherwise silently shadow
+ * one another instead of failing loudly at composition time.
+ *
+ * Unlike the Express version (`../express/route-registration-guard.ts`, which monkey-patches
+ * `get`/`post`/etc. because Express has no first-class "a route was just registered" signal),
+ * Fastify exposes a built-in `onRoute` application hook that fires exactly once per registered
+ * route with the fully resolved `{ method, url }` — no monkey-patching needed. `guardedRouteKey`
+ * is deliberately duplicated (not imported) from the Express version; see
+ * `./response.ts`'s top-of-module doc for why this subtree does not import from `express/`.
+ */
+import type { FastifyInstance } from 'fastify';
+/** One recorded route registration: the HTTP verb and the literal string path it was mounted on. */
+export interface RouteRegistration {
+    method: string;
+    path: string;
+}
+/**
+ * Builds the `METHOD PATH` key used to check `guardedRouteKeys` membership.
+ *
+ * @param method - The HTTP method name (any case; normalized to upper-case in the key).
+ * @param path - The route's registered URL. Fastify's `onRoute` hook always supplies a string
+ * `url`, so (unlike the Express version) there is no non-string-path branch to guard against here.
+ * @param guardedRouteKeys - The set of `METHOD PATH` keys this call installed a duplicate-registration
+ * guard for.
+ * @returns The matching key if it is in `guardedRouteKeys`, otherwise `null`.
+ * @complexity O(1) — a single `Set` lookup.
+ * @overallScore 100/100
+ */
+export declare function guardedRouteKey(method: string, path: string, guardedRouteKeys: ReadonlySet<string>): string | null;
+export interface InstallRouteRegistrationGuardOptions {
+    /** `METHOD PATH` keys (e.g. `'POST /api/runs'`) that must be registered at most once on `app`. Defaults to none — installing the guard with no options only builds the inventory, it enforces nothing. */
+    guardedRouteKeys?: ReadonlySet<string>;
+}
+/**
+ * Registers a Fastify `onRoute` application hook that records every route registration into a
+ * per-app inventory (retrievable via {@link getRouteRegistrationInventory}) and throws if any
+ * `options.guardedRouteKeys` entry is registered a second time.
+ *
+ * A route registered for multiple HTTP methods at once (`method: ['GET', 'POST']`, or Fastify's
+ * own automatic `HEAD` sibling for a `GET` route when `exposeHeadRoute` is left at its default)
+ * produces one inventory entry and one guard check per method — mirroring how the Express version
+ * records one entry per distinct `app.get(...)`/`app.post(...)` call.
+ *
+ * @param app - The Fastify instance to instrument. Must not already have this guard installed
+ * (installing twice would double-register the `onRoute` hook and double-count the inventory — not
+ * guarded against here since every caller in this codebase calls this exactly once per app at
+ * composition time).
+ * @param options.guardedRouteKeys - See {@link InstallRouteRegistrationGuardOptions}.
+ * @returns Nothing — registers a hook on `app` and stashes its inventory under a well-known `Symbol.for` key.
+ * @throws If a `guardedRouteKeys` entry is registered more than once, at the moment of the second registration.
+ * @complexity O(1) setup; each `onRoute` firing is O(m) in the number of methods the route was registered for (typically 1).
+ * @overallScore 100/100
+ */
+export declare function installRouteRegistrationGuard(app: FastifyInstance, options?: InstallRouteRegistrationGuardOptions): void;
+/**
+ * Reads back every route {@link installRouteRegistrationGuard} recorded for `app`.
+ *
+ * @param app - An app the guard was installed on. Safe to call on an app with no guard installed
+ * (returns an empty array rather than throwing).
+ * @returns A fresh array copy each call — the caller can never mutate the guard's own internal inventory through the returned reference.
+ * @complexity O(n) in the number of routes registered so far.
+ * @overallScore 100/100
+ */
+export declare function getRouteRegistrationInventory(app: FastifyInstance): RouteRegistration[];
+//# sourceMappingURL=route-registration-guard.d.ts.map

package/dist/fastify/route-registration-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-registration-guard.d.ts","sourceRoot":"","sources":["../../src/fastify/route-registration-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,oGAAoG;AACpG,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAGlH;AAED,MAAM,WAAW,oCAAoC;IACnD,0MAA0M;IAC1M,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACxC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,oCAAyC,GACjD,IAAI,CAmBN;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,eAAe,GAAG,iBAAiB,EAAE,CAEvF"}

package/dist/fastify/route-registration-guard.js

@@ -0,0 +1,69 @@
+const routeInventorySymbol = Symbol.for('jini.routeRegistrationGuard.inventory');
+/**
+ * Builds the `METHOD PATH` key used to check `guardedRouteKeys` membership.
+ *
+ * @param method - The HTTP method name (any case; normalized to upper-case in the key).
+ * @param path - The route's registered URL. Fastify's `onRoute` hook always supplies a string
+ * `url`, so (unlike the Express version) there is no non-string-path branch to guard against here.
+ * @param guardedRouteKeys - The set of `METHOD PATH` keys this call installed a duplicate-registration
+ * guard for.
+ * @returns The matching key if it is in `guardedRouteKeys`, otherwise `null`.
+ * @complexity O(1) — a single `Set` lookup.
+ * @overallScore 100/100
+ */
+export function guardedRouteKey(method, path, guardedRouteKeys) {
+    const key = `${method.toUpperCase()} ${path}`;
+    return guardedRouteKeys.has(key) ? key : null;
+}
+/**
+ * Registers a Fastify `onRoute` application hook that records every route registration into a
+ * per-app inventory (retrievable via {@link getRouteRegistrationInventory}) and throws if any
+ * `options.guardedRouteKeys` entry is registered a second time.
+ *
+ * A route registered for multiple HTTP methods at once (`method: ['GET', 'POST']`, or Fastify's
+ * own automatic `HEAD` sibling for a `GET` route when `exposeHeadRoute` is left at its default)
+ * produces one inventory entry and one guard check per method — mirroring how the Express version
+ * records one entry per distinct `app.get(...)`/`app.post(...)` call.
+ *
+ * @param app - The Fastify instance to instrument. Must not already have this guard installed
+ * (installing twice would double-register the `onRoute` hook and double-count the inventory — not
+ * guarded against here since every caller in this codebase calls this exactly once per app at
+ * composition time).
+ * @param options.guardedRouteKeys - See {@link InstallRouteRegistrationGuardOptions}.
+ * @returns Nothing — registers a hook on `app` and stashes its inventory under a well-known `Symbol.for` key.
+ * @throws If a `guardedRouteKeys` entry is registered more than once, at the moment of the second registration.
+ * @complexity O(1) setup; each `onRoute` firing is O(m) in the number of methods the route was registered for (typically 1).
+ * @overallScore 100/100
+ */
+export function installRouteRegistrationGuard(app, options = {}) {
+    const guardedRouteKeys = options.guardedRouteKeys ?? new Set();
+    const seen = new Set();
+    const inventory = [];
+    app[routeInventorySymbol] = inventory;
+    app.addHook('onRoute', (routeOptions) => {
+        const methods = Array.isArray(routeOptions.method) ? routeOptions.method : [routeOptions.method];
+        for (const method of methods) {
+            inventory.push({ method: method.toUpperCase(), path: routeOptions.url });
+            const key = guardedRouteKey(method, routeOptions.url, guardedRouteKeys);
+            if (key) {
+                if (seen.has(key)) {
+                    throw new Error(`duplicate guarded route registration: ${key}`);
+                }
+                seen.add(key);
+            }
+        }
+    });
+}
+/**
+ * Reads back every route {@link installRouteRegistrationGuard} recorded for `app`.
+ *
+ * @param app - An app the guard was installed on. Safe to call on an app with no guard installed
+ * (returns an empty array rather than throwing).
+ * @returns A fresh array copy each call — the caller can never mutate the guard's own internal inventory through the returned reference.
+ * @complexity O(n) in the number of routes registered so far.
+ * @overallScore 100/100
+ */
+export function getRouteRegistrationInventory(app) {
+    return [...(app[routeInventorySymbol] ?? [])];
+}
+//# sourceMappingURL=route-registration-guard.js.map

package/dist/fastify/route-registration-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-registration-guard.js","sourceRoot":"","sources":["../../src/fastify/route-registration-guard.ts"],"names":[],"mappings":"AAuBA,MAAM,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,IAAY,EAAE,gBAAqC;IACjG,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC;IAC9C,OAAO,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAOD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,GAAoB,EACpB,UAAgD,EAAE;IAElD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,IAAI,GAAG,EAAU,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,SAAS,GAAwB,EAAE,CAAC;IACzC,GAAsD,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;IAE1F,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACjG,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC;YACzE,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACxE,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClB,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAC;gBAClE,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAAC,GAAoB;IAChE,OAAO,CAAC,GAAG,CAAE,GAAkE,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAChH,CAAC"}

package/dist/fastify/run-stream.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @module fastify/run-stream
+ *
+ * Fastify-specific mounting glue for the shared AG-UI SSE run-stream handler
+ * (`../run-stream.js`). `reply.raw`/`request.raw` give the exact underlying `http.ServerResponse`/
+ * `http.IncomingMessage` pair directly, so this file's only job is resolving the `runId` route
+ * param and handing those raw objects straight through — a few lines, not a reimplementation, per
+ * the design decision that motivated building the SSE primitive once instead of duplicating it
+ * per transport. `reply.hijack()` tells Fastify this handler is taking over the raw response
+ * itself, so Fastify's own reply lifecycle (which otherwise expects the handler to return a value
+ * for it to serialize, or call `reply.send(...)`) does not try to act on a response this handler
+ * already wrote to and ended directly.
+ */
+import type { FastifyInstance } from 'fastify';
+import { type RunStreamDeps } from '../run-stream.js';
+/** Mounts the AG-UI SSE run-stream route on `app`. A pack's `http(app, services)` calls this directly. */
+export declare function registerRunStreamRoute(app: FastifyInstance, deps: RunStreamDeps): void;
+//# sourceMappingURL=run-stream.d.ts.map

package/dist/fastify/run-stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-stream.d.ts","sourceRoot":"","sources":["../../src/fastify/run-stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAiD,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAErG,0GAA0G;AAC1G,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI,CAMtF"}

package/dist/fastify/run-stream.js

@@ -0,0 +1,10 @@
+import { handleRunStreamRequest, RUN_STREAM_ROUTE_PATH } from '../run-stream.js';
+/** Mounts the AG-UI SSE run-stream route on `app`. A pack's `http(app, services)` calls this directly. */
+export function registerRunStreamRoute(app, deps) {
+    app.get(RUN_STREAM_ROUTE_PATH, async (request, reply) => {
+        reply.hijack();
+        const runId = request.params.runId;
+        await handleRunStreamRequest(request.raw, reply.raw, runId, deps);
+    });
+}
+//# sourceMappingURL=run-stream.js.map

package/dist/fastify/run-stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-stream.js","sourceRoot":"","sources":["../../src/fastify/run-stream.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAsB,MAAM,kBAAkB,CAAC;AAErG,0GAA0G;AAC1G,MAAM,UAAU,sBAAsB,CAAC,GAAoB,EAAE,IAAmB;IAC9E,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACpF,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,KAAK,GAAI,OAAO,CAAC,MAA4B,CAAC,KAAK,CAAC;QAC1D,MAAM,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/fastify/runs.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @module fastify/runs
+ *
+ * Fastify-mounting glue for `../runs.js`'s route logic — every `JsonRouteSpec` (`runStartRoute`,
+ * `runListRoute`, `runStatusRoute`, `runCancelRoute`) and the SSE event-stream core
+ * (`handleRunEventStreamRequest`) are the exact same functions the Express mounting in `../runs.js`
+ * uses; nothing here re-implements route logic, only how a request reaches it and a response
+ * leaves it, mirroring the rest of this `fastify/` subtree.
+ */
+import type { FastifyInstance } from 'fastify';
+import type { RunHttpDeps } from '../runs.js';
+import { type AdapterContext } from './adapter.js';
+/** Mounts `GET /api/runs/:runId/events` on `app` via Fastify's native `route()` (matching `mountJsonRoute`'s own registration mechanism, unlike `fastify/run-stream.ts`'s `.get()` shorthand — kept consistent within this file since `registerRunRoutes` below mounts both through the same `app`), hijacking the reply so `handleRunEventStreamRequest` can write the raw SSE stream directly. */
+export declare function registerRunEventStream(app: FastifyInstance, deps: RunHttpDeps): void;
+/** Mounts create/status/cancel JSON endpoints and the SSE event stream as one run transport — the Fastify-native equivalent of `../runs.js`'s `registerRunRoutes`, mounting the identical `JsonRouteSpec` objects. */
+export declare function registerRunRoutes(app: FastifyInstance, deps: RunHttpDeps, adapter: AdapterContext): void;
+//# sourceMappingURL=runs.d.ts.map

package/dist/fastify/runs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runs.d.ts","sourceRoot":"","sources":["../../src/fastify/runs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAC7E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAWnE,oYAAoY;AACpY,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAWpF;AAED,sNAAsN;AACtN,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,CAMxG"}