@juspay/neurolink 13.8.14 → 13.8.15

package/dist/cli/utils/serverUtils.d.ts

@@ -16,6 +16,10 @@ export declare function readServerApiKeys(): string[];
  * Require one of `apiKeys` as `Authorization: Bearer <key>` or `X-API-Key`.
  * Health probes stay open so orchestrators can reach them, and the dev
  * playground header cannot bypass a key the operator configured.
+ *
+ * Every holder of a key gets the same `{ id: "api-key" }`, marked `shared` so
+ * the agent routes know it names no person and do not warn when a request
+ * names its own userId.
  */
 export declare function createServerApiKeyMiddleware(apiKeys: string[], basePath: string): MiddlewareDefinition;
 /**

package/dist/cli/utils/serverUtils.js

@@ -41,6 +41,10 @@ const matchesKey = (key, token) => key.length === token.length && timingSafeEqua
  * Require one of `apiKeys` as `Authorization: Bearer <key>` or `X-API-Key`.
  * Health probes stay open so orchestrators can reach them, and the dev
  * playground header cannot bypass a key the operator configured.
+ *
+ * Every holder of a key gets the same `{ id: "api-key" }`, marked `shared` so
+ * the agent routes know it names no person and do not warn when a request
+ * names its own userId.
  */
 export function createServerApiKeyMiddleware(apiKeys, basePath) {
     const keys = apiKeys.map((key) => Buffer.from(key, "utf8"));
@@ -53,7 +57,7 @@ export function createServerApiKeyMiddleware(apiKeys, basePath) {
         validate: async (token) => {
             const candidate = Buffer.from(token, "utf8");
             return keys.some((key) => matchesKey(key, candidate))
-                ? { id: "api-key" }
+                ? { id: "api-key", shared: true }
                 : null;
         },
         skipPaths: [`${basePath.replace(/\/+$/, "")}/health`],

package/dist/server/abstract/baseServerAdapter.d.ts

@@ -7,7 +7,7 @@ import { EventEmitter } from "events";
 import type { ExternalServerManager } from "../../mcp/externalServerManager.js";
 import type { MCPToolRegistry } from "../../mcp/toolRegistry.js";
 import type { NeuroLink } from "../../neurolink.js";
-import type { MiddlewareDefinition, RedactionConfig, RequiredServerAdapterConfig, RequiredShutdownConfig, RouteDefinition, ServerAdapterConfig, ServerAdapterEvents, ServerContext, ServerLifecycleState, ServerStatus, TrackedConnection } from "../../types/index.js";
+import type { MiddlewareDefinition, RedactionConfig, RequiredServerAdapterConfig, RequiredShutdownConfig, RouteDefinition, ServerAdapterConfig, ServerAdapterEvents, ServerCarriedContext, ServerContext, ServerLifecycleState, ServerStatus, TrackedConnection } from "../../types/index.js";
 /**
  * Abstract base class for server adapters
  * Provides common functionality and defines the interface for framework-specific implementations
@@ -28,6 +28,7 @@ export declare abstract class BaseServerAdapter extends EventEmitter {
     protected lifecycleState: ServerLifecycleState;
     protected activeConnections: Map<string, TrackedConnection>;
     protected readonly shutdownConfig: RequiredShutdownConfig;
+    private carryRequestedByRoutes;
     constructor(neurolink: NeuroLink, config?: ServerAdapterConfig);
     /**
      * Initialize the underlying server framework
@@ -155,6 +156,34 @@ export declare abstract class BaseServerAdapter extends EventEmitter {
      * Only registers health routes if disableBuiltInHealth is false (default)
      */
     protected registerBuiltInRoutes(): Promise<void>;
+    /**
+     * Ask the adapter to carry middleware state (`ctx.user` and the rest) to later
+     * middleware and the route handler, as the `carryMiddlewareState` option does.
+     * `registerAllRoutes()` calls it when given `perUserAuth`, which cannot work
+     * without the user in the handler. It takes effect for requests that start
+     * after the call, so call it before the server starts, as registering routes
+     * is.
+     */
+    enableMiddlewareStateCarry(): void;
+    /** Whether this adapter carries middleware state to the handler. */
+    protected carriesMiddlewareState(): boolean;
+    /**
+     * What middleware has set on its context that later middleware and the route
+     * handler must see. Each step gets a freshly built context, so unless this is
+     * parked in the framework's per-request storage an authenticated `ctx.user`
+     * set by middleware is gone before the handler runs. `undefined` when the
+     * adapter does not carry middleware state, so nothing is parked.
+     */
+    protected captureCarriedContext(ctx: ServerContext): ServerCarriedContext | undefined;
+    /**
+     * Put what `captureCarriedContext` saved onto a freshly built context, and
+     * mark the context as one that received the carry. The agent routes read the
+     * mark: a request that never used to reach its handler with `ctx.user` must
+     * not start being identified by it unless the server opts in. Does nothing
+     * when the adapter does not carry middleware state: the context stays the
+     * fresh one it always was, and unmarked.
+     */
+    protected restoreCarriedContext(ctx: ServerContext, carried: ServerCarriedContext | undefined): void;
     /**
      * Generate unique request ID
      */

package/dist/server/abstract/baseServerAdapter.js

@@ -7,6 +7,7 @@ import { EventEmitter } from "events";
 import { getMetricsAggregator, SpanSerializer, SpanStatus, SpanType, } from "../../observability/index.js";
 import { withTimeout } from "../../utils/errorHandling.js";
 import { logger } from "../../utils/logger.js";
+import { markContextCarried } from "../utils/carriedContextMark.js";
 import { tryImport } from "../../utils/tryImport.js";
 import { DrainTimeoutError, InvalidLifecycleStateError, MissingDependencyError, ServerAdapterError, ShutdownTimeoutError, } from "../errors.js";
 /**
@@ -33,6 +34,9 @@ export class BaseServerAdapter extends EventEmitter {
     lifecycleState = "uninitialized";
     activeConnections = new Map();
     shutdownConfig;
+    // Set by enableMiddlewareStateCarry(); the carryMiddlewareState option is the
+    // other way in.
+    carryRequestedByRoutes = false;
     constructor(neurolink, config = {}) {
         super();
         this.neurolink = neurolink;
@@ -101,6 +105,7 @@ export class BaseServerAdapter extends EventEmitter {
             enableSwagger: config.enableSwagger ?? false,
             disableBuiltInHealth: config.disableBuiltInHealth ?? false,
             shutdown: this.shutdownConfig,
+            carryMiddlewareState: config.carryMiddlewareState ?? false,
         };
     }
     /**
@@ -454,6 +459,72 @@ export class BaseServerAdapter extends EventEmitter {
             });
         }
     }
+    /**
+     * Ask the adapter to carry middleware state (`ctx.user` and the rest) to later
+     * middleware and the route handler, as the `carryMiddlewareState` option does.
+     * `registerAllRoutes()` calls it when given `perUserAuth`, which cannot work
+     * without the user in the handler. It takes effect for requests that start
+     * after the call, so call it before the server starts, as registering routes
+     * is.
+     */
+    enableMiddlewareStateCarry() {
+        this.carryRequestedByRoutes = true;
+    }
+    /** Whether this adapter carries middleware state to the handler. */
+    carriesMiddlewareState() {
+        return this.config.carryMiddlewareState || this.carryRequestedByRoutes;
+    }
+    /**
+     * What middleware has set on its context that later middleware and the route
+     * handler must see. Each step gets a freshly built context, so unless this is
+     * parked in the framework's per-request storage an authenticated `ctx.user`
+     * set by middleware is gone before the handler runs. `undefined` when the
+     * adapter does not carry middleware state, so nothing is parked.
+     */
+    captureCarriedContext(ctx) {
+        if (!this.carriesMiddlewareState()) {
+            return undefined;
+        }
+        return {
+            user: ctx.user,
+            session: ctx.session,
+            metadata: ctx.metadata,
+            abortSignal: ctx.abortSignal,
+            abortController: ctx.abortController,
+        };
+    }
+    /**
+     * Put what `captureCarriedContext` saved onto a freshly built context, and
+     * mark the context as one that received the carry. The agent routes read the
+     * mark: a request that never used to reach its handler with `ctx.user` must
+     * not start being identified by it unless the server opts in. Does nothing
+     * when the adapter does not carry middleware state: the context stays the
+     * fresh one it always was, and unmarked.
+     */
+    restoreCarriedContext(ctx, carried) {
+        if (!this.carriesMiddlewareState()) {
+            return;
+        }
+        markContextCarried(ctx);
+        if (!carried) {
+            return;
+        }
+        if (carried.user) {
+            ctx.user = carried.user;
+        }
+        if (carried.session) {
+            ctx.session = carried.session;
+        }
+        if (carried.metadata) {
+            ctx.metadata = { ...ctx.metadata, ...carried.metadata };
+        }
+        if (carried.abortSignal) {
+            ctx.abortSignal = carried.abortSignal;
+        }
+        if (carried.abortController) {
+            ctx.abortController = carried.abortController;
+        }
+    }
     /**
      * Generate unique request ID
      */

package/dist/server/adapters/expressAdapter.js

@@ -166,6 +166,7 @@ export class ExpressServerAdapter extends BaseServerAdapter {
             if (res.locals.responseHeaders) {
                 ctx.responseHeaders = { ...res.locals.responseHeaders };
             }
+            this.restoreCarriedContext(ctx, res.locals.carriedContext);
             // Emit request event
             this.emit("request", {
                 requestId,
@@ -366,9 +367,13 @@ export class ExpressServerAdapter extends BaseServerAdapter {
                 });
                 // Copy existing response headers to context
                 ctx.responseHeaders = { ...res.locals.responseHeaders };
+                this.restoreCarriedContext(ctx, res.locals.carriedContext);
                 // Execute middleware
                 try {
                     await middleware.handler(ctx, async () => {
+                        // What this middleware set (ctx.user included) is for the next
+                        // middleware and the route handler, which build their own contexts.
+                        res.locals.carriedContext = this.captureCarriedContext(ctx);
                         // After middleware execution, merge response headers back to res.locals
                         if (ctx.responseHeaders) {
                             Object.assign(res.locals.responseHeaders, ctx.responseHeaders);

package/dist/server/adapters/fastifyAdapter.d.ts

@@ -13,6 +13,7 @@ import type { MiddlewareDefinition, RouteDefinition, ServerAdapterConfig } from
 export declare class FastifyServerAdapter extends BaseServerAdapter {
     private app;
     private frameworkInitialized;
+    private connectionIds;
     constructor(neurolink: NeuroLink, config?: ServerAdapterConfig);
     /**
      * Initialize Fastify framework

package/dist/server/adapters/fastifyAdapter.js

@@ -16,6 +16,11 @@ import { isRawBodyContentType, isWebResponse, readWebResponse, } from "../utils/
 export class FastifyServerAdapter extends BaseServerAdapter {
     app = null;
     frameworkInitialized = false;
+    // The shutdown drain's record for each in-flight request. Fastify takes
+    // `request.id` from the caller's X-Request-ID, so that id can repeat across
+    // overlapping requests: a record named after it would be shared, and the
+    // first request to finish would untrack the other.
+    connectionIds = new WeakMap();
     constructor(neurolink, config = {}) {
         super(neurolink, config);
     }
@@ -239,6 +244,7 @@ export class FastifyServerAdapter extends BaseServerAdapter {
                 if (reqWithHeaders.responseHeaders) {
                     ctx.responseHeaders = { ...reqWithHeaders.responseHeaders };
                 }
+                this.restoreCarriedContext(ctx, reqWithHeaders.carriedContext);
                 // Emit request event
                 this.emit("request", {
                     requestId,
@@ -399,8 +405,12 @@ export class FastifyServerAdapter extends BaseServerAdapter {
             });
             // Copy existing response headers to context
             ctx.responseHeaders = { ...reqWithHeaders.responseHeaders };
+            this.restoreCarriedContext(ctx, reqWithHeaders.carriedContext);
             // Execute middleware
             await middleware.handler(ctx, async () => {
+                // What this middleware set (ctx.user included) is for the next
+                // middleware and the route handler, which build their own contexts.
+                reqWithHeaders.carriedContext = this.captureCarriedContext(ctx);
                 // After middleware execution, merge response headers back to request
                 if (ctx.responseHeaders) {
                     Object.assign(reqWithHeaders.responseHeaders, ctx.responseHeaders);
@@ -431,12 +441,15 @@ export class FastifyServerAdapter extends BaseServerAdapter {
         const startupTimeout = this.config.timeout || 30000;
         // Track connections via Fastify hooks (must be registered before listen)
         app.addHook("onRequest", async (request) => {
-            const connectionId = `conn-${request.id}`;
+            const connectionId = `conn-${this.generateRequestId()}`;
+            this.connectionIds.set(request, connectionId);
             this.trackConnection(connectionId, request.raw.socket, request.id);
         });
         app.addHook("onResponse", async (request) => {
-            const connectionId = `conn-${request.id}`;
-            this.untrackConnection(connectionId);
+            const connectionId = this.connectionIds.get(request);
+            if (connectionId) {
+                this.untrackConnection(connectionId);
+            }
         });
         try {
             await withTimeout(app.listen({ port, host }), startupTimeout, new ServerStartError(`Fastify server startup timed out after ${startupTimeout}ms`, undefined, port, host));

package/dist/server/adapters/honoAdapter.d.ts

@@ -16,6 +16,7 @@ export declare class HonoServerAdapter extends BaseServerAdapter {
     private rateLimitStore;
     private rateLimitCleanupInterval?;
     private requestContextStore;
+    private requestIds;
     private HTTPExceptionCtor;
     private streamSSEFn;
     private parseFormBody;
@@ -52,6 +53,11 @@ export declare class HonoServerAdapter extends BaseServerAdapter {
      * Register middleware with Hono
      */
     protected registerFrameworkMiddleware(middleware: MiddlewareDefinition): void;
+    /**
+     * The id of this request: the caller's `X-Request-ID` when sent, otherwise
+     * one generated on first use, and the same one on every later use.
+     */
+    private requestIdFor;
     /**
      * Start the Hono server
      */

package/dist/server/adapters/honoAdapter.js

@@ -6,6 +6,7 @@
 import { logger } from "../../utils/logger.js";
 import { AlreadyRunningError, ServerAdapterError, ServerStopError, wrapError, } from "../errors.js";
 import { BaseServerAdapter } from "../abstract/baseServerAdapter.js";
+import { markContextCarried } from "../utils/carriedContextMark.js";
 import { isErrorResponse } from "../utils/validation.js";
 import { isRawBodyContentType, isWebResponse, parseByteLimit, RawBodyTooLargeError, readBoundedRequestBody, } from "../utils/rawBody.js";
 /**
@@ -17,8 +18,17 @@ export class HonoServerAdapter extends BaseServerAdapter {
     server;
     rateLimitStore = new Map();
     rateLimitCleanupInterval;
-    // Store context by request ID for sharing between middleware and route handlers
-    requestContextStore = new Map();
+    // Context shared between middleware and the route handler. Keyed by the request
+    // object, never by the request id: the id can be the
+    // caller's own X-Request-ID, so two overlapping requests that send the same one
+    // would share a context, and the second would run with the first one's
+    // identity, headers and body. A WeakMap also frees an entry whose handler
+    // never ran.
+    requestContextStore = new WeakMap();
+    // One id per request, for logs and events: the caller's X-Request-ID when sent,
+    // otherwise generated once, so every step reports the same id. With no header
+    // every step used to invent its own.
+    requestIds = new WeakMap();
     // Populated by initializeFramework's dynamic imports; used by methods that
     // run after initialization (route registration, streaming) and so cannot
     // rely on initializeFramework's own local closure variables.
@@ -50,7 +60,7 @@ export class HonoServerAdapter extends BaseServerAdapter {
                     headers[name] = value;
                 });
                 const minCtx = {
-                    requestId: c.req.header("X-Request-ID") || this.generateRequestId(),
+                    requestId: this.requestIdFor(c),
                     method: c.req.method,
                     path: c.req.path,
                     headers,
@@ -162,7 +172,7 @@ export class HonoServerAdapter extends BaseServerAdapter {
         }
         // Global error handler
         this.app.onError((error, c) => {
-            const requestId = c.req.header("X-Request-ID") || this.generateRequestId();
+            const requestId = this.requestIdFor(c);
             this.logRequestError("HonoAdapter", requestId, error);
             this.emitRequestError({
                 requestId,
@@ -217,8 +227,11 @@ export class HonoServerAdapter extends BaseServerAdapter {
     registerFrameworkRoute(route) {
         const method = route.method.toLowerCase();
         this.app[method](route.path, async (c) => {
-            const requestId = c.req.header("X-Request-ID") || this.generateRequestId();
-            const connectionId = `conn-${requestId}`;
+            const requestId = this.requestIdFor(c);
+            // Not derived from the request id, which a caller may repeat: two
+            // overlapping requests would then share one record and the first to
+            // finish would untrack the other.
+            const connectionId = `conn-${this.generateRequestId()}`;
             const startTime = Date.now();
             // Track connection for graceful shutdown
             this.trackConnection(connectionId, undefined, requestId);
@@ -226,12 +239,30 @@ export class HonoServerAdapter extends BaseServerAdapter {
                 // Extract path parameters
                 const params = c.req.param();
                 // Reuse existing context from middleware if available, otherwise create new one
-                const created = this.requestContextStore.get(requestId) ||
-                    (await this.createRequestContext(c, requestId, params));
-                if (isWebResponse(created)) {
-                    return created;
+                const existingCtx = this.requestContextStore.get(c.req.raw);
+                // Middleware ran before the router matched this route, so the shared
+                // context carries no path parameters yet.
+                if (existingCtx) {
+                    existingCtx.params = params;
+                    // The one request the handler already got the middleware's context
+                    // for before this adapter carried it on every request: the caller
+                    // sent its own X-Request-ID, which the old store was keyed by. That
+                    // context stays unmarked, so the agent routes keep trusting its
+                    // ctx.user there. A context found for any other request exists only
+                    // because the server carries middleware state, is new to the
+                    // handler, and is marked.
+                    if (!c.req.header("X-Request-ID")) {
+                        markContextCarried(existingCtx);
+                    }
+                }
+                let ctx = existingCtx;
+                if (!ctx) {
+                    const created = await this.createRequestContext(c, requestId, params);
+                    if (isWebResponse(created)) {
+                        return created;
+                    }
+                    ctx = created;
                 }
-                const ctx = created;
                 // Emit request event
                 this.emit("request", {
                     requestId,
@@ -325,7 +356,7 @@ export class HonoServerAdapter extends BaseServerAdapter {
                 // Untrack connection when request completes
                 this.untrackConnection(connectionId);
                 // Clean up context store to prevent memory leaks
-                this.requestContextStore.delete(requestId);
+                this.requestContextStore.delete(c.req.raw);
             }
         });
     }
@@ -457,9 +488,9 @@ export class HonoServerAdapter extends BaseServerAdapter {
                 // Extract path parameters
                 const params = c.req.param();
                 // Get or generate request ID for context lookup
-                const requestId = c.req.header("X-Request-ID") || this.generateRequestId();
+                const requestId = this.requestIdFor(c);
                 // Reuse existing context from previous middleware if available
-                let ctx = this.requestContextStore.get(requestId);
+                let ctx = this.requestContextStore.get(c.req.raw);
                 if (!ctx) {
                     // Create new context for the first middleware
                     const created = await this.createRequestContext(c, requestId, params);
@@ -467,14 +498,34 @@ export class HonoServerAdapter extends BaseServerAdapter {
                         return created;
                     }
                     ctx = created;
-                    // Store context for sharing between middleware and route handlers
-                    this.requestContextStore.set(requestId, ctx);
+                    // Share the context between the middleware steps and the route
+                    // handler when the server carries middleware state, or when the
+                    // caller sent its own X-Request-ID: the one case the old store, keyed
+                    // by that header, ever found a context again. Otherwise every step
+                    // and the handler build their own, and storing this one would only
+                    // leave it behind.
+                    if (this.carriesMiddlewareState() || c.req.header("X-Request-ID")) {
+                        this.requestContextStore.set(c.req.raw, ctx);
+                    }
                 }
                 // Execute middleware
                 return middleware.handler(ctx, next);
             });
         }
     }
+    /**
+     * The id of this request: the caller's `X-Request-ID` when sent, otherwise
+     * one generated on first use, and the same one on every later use.
+     */
+    requestIdFor(c) {
+        const known = this.requestIds.get(c.req.raw);
+        if (known) {
+            return known;
+        }
+        const id = c.req.header("X-Request-ID") || this.generateRequestId();
+        this.requestIds.set(c.req.raw, id);
+        return id;
+    }
     /**
      * Start the Hono server
      */

package/dist/server/adapters/koaAdapter.js

@@ -261,6 +261,7 @@ export class KoaServerAdapter extends BaseServerAdapter {
             if (ctx.state.responseHeaders) {
                 serverCtx.responseHeaders = { ...ctx.state.responseHeaders };
             }
+            this.restoreCarriedContext(serverCtx, ctx.state.carriedContext);
             // Emit request event
             this.emit("request", {
                 requestId,
@@ -419,8 +420,12 @@ export class KoaServerAdapter extends BaseServerAdapter {
             });
             // Copy existing response headers to context
             serverCtx.responseHeaders = { ...ctx.state.responseHeaders };
+            this.restoreCarriedContext(serverCtx, ctx.state.carriedContext);
             // Execute middleware
             await middleware.handler(serverCtx, async () => {
+                // What this middleware set (ctx.user included) is for the next
+                // middleware and the route handler, which build their own contexts.
+                ctx.state.carriedContext = this.captureCarriedContext(serverCtx);
                 // After middleware execution, merge response headers back to ctx.state
                 if (serverCtx.responseHeaders) {
                     Object.assign(ctx.state.responseHeaders, serverCtx.responseHeaders);

package/dist/server/middleware/auth.js

@@ -35,6 +35,7 @@ export function isDevPlayground(headers) {
 export const DEV_PLAYGROUND_USER = {
     id: "playground",
     roles: ["developer"],
+    shared: true,
 };
 /**
  * Authentication result
@@ -76,6 +77,7 @@ export function createAuthMiddleware(config) {
                     id: DEV_PLAYGROUND_USER.id,
                     email: DEV_PLAYGROUND_USER.email,
                     roles: DEV_PLAYGROUND_USER.roles,
+                    shared: DEV_PLAYGROUND_USER.shared,
                 };
                 return next();
             }
@@ -95,6 +97,7 @@ export function createAuthMiddleware(config) {
                     id: result.id,
                     email: result.email,
                     roles: result.roles,
+                    shared: result.shared,
                 };
                 // Store additional metadata
                 if (result.metadata) {

package/dist/server/routes/agentRoutes.d.ts

@@ -6,11 +6,52 @@ import type { RouteGroup, ServerAgentRouteOptions } from "../../types/index.js";
 /**
  * Create agent routes
  *
+ * `options.perUserAuth` decides where a request's identity comes from; see
+ * `ServerAgentRouteOptions`. Authentication middleware that sets `ctx.user`
+ * does not change that on its own: one shared API key sets the same user for
+ * every caller, so trusting it as a person would give every client the same
+ * userId and no conversation memory. The converse is the operator's to act on:
+ * a server whose authentication identifies individual people must set
+ * `perUserAuth`, or any authenticated caller can name another userId and
+ * sessionId in the body.
+ *
+ * Unset, identity resolves as it did before the adapters carried `ctx.user` to
+ * the handler: the body's `userId` and `sessionId`, with one exception. On
+ * Hono, a request whose client sent its own `X-Request-ID` header reached the
+ * handler with the middleware's context, so an authenticated `ctx.user` (and
+ * `ctx.session`) won over the body there, and still does. A context the
+ * built-in adapters did not hand the carry to also keeps that rule: a custom
+ * adapter that sets `ctx.user` itself, or a handler called directly with a
+ * context the caller built. Only `perUserAuth` (with the server carrying
+ * middleware state) makes these routes take the user from `ctx.user`, and
+ * ignore the body's `userId`, on every built-in adapter and for every request.
+ *
+ * `perUserAuth` needs the user in the handler, which an adapter hands over on
+ * every request only when the server carries middleware state.
+ * `registerAllRoutes()` turns that on for the server when it is given
+ * `perUserAuth`. A caller that registers these routes itself with `perUserAuth`
+ * must create the server with `carryMiddlewareState: true`. Without it, a
+ * request has a user only on Hono when the client sent its own `X-Request-ID`
+ * (Hono then hands the handler the middleware's context regardless); every
+ * other request (Hono without that header, Express, Fastify, Koa) runs as
+ * anonymous, with no `userId` and no session.
+ *
+ * Without `perUserAuth`, and when the server carries middleware state, the
+ * routes log one warning per instance the first time a request whose body names
+ * a different `userId` than its `ctx.user` is served from the body, unless that
+ * user is marked `shared: true` (an identity for every holder of one
+ * credential, which the CLI's API-key middleware sets). Such a request is
+ * served from the body; the warning only tells the operator that per-person
+ * authentication is running without the flag that makes it hold. With the
+ * carry off the handler has no `ctx.user` on those requests, so there is
+ * nothing to compare and no warning. A request where `ctx.user` already won has
+ * nothing to warn about.
+ *
  * @param options - Limits for `input.images` / `input.files`:
  *   `allowedInputRoots` (default: none, every local-path attachment is
  *   refused), `maxInputBytes` per attachment (default 50 MiB),
  *   `maxInputAttachments` per request (default 20, images and files together)
  *   and `maxInputTotalBytes` per request (default 100 MiB, one budget shared by
- *   images and files).
+ *   images and files); and `perUserAuth` (described above).
  */
 export declare function createAgentRoutes(basePath?: string, options?: ServerAgentRouteOptions): RouteGroup;