@lostgradient/weft 0.2.0

package/dist/runtime/portable.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Runtime-agnostic primitives that all portable code uses instead of calling
+ * `Bun.*` directly. When running under Bun the fast native paths are used;
+ * otherwise standard Web APIs are preferred, with Node built-ins as a last
+ * resort (lazy-imported so browser bundles never pull in `node:*`).
+ *
+ * @module runtime/portable
+ */
+/** Identifies the JavaScript runtime hosting this process. */
+export type RuntimeKind = 'bun' | 'node' | 'browser' | 'edge';
+type PortableRuntimeTestOverrides = {
+    bun?: typeof globalThis.Bun | undefined;
+    process?: typeof globalThis.process | undefined;
+    window?: typeof globalThis.window | undefined;
+    document?: typeof globalThis.document | undefined;
+};
+export declare function setPortableRuntimeTestOverridesForTesting(overrides?: PortableRuntimeTestOverrides): void;
+/**
+ * Detect the current JavaScript runtime.
+ * Detection precedence is bun → node → browser → edge: a Bun process running
+ * under a Node shim still reports 'bun'; the function never falls through if
+ * `globalThis.Bun` is defined.
+ *
+ * @example
+ * ```ts
+ * import { detectRuntime } from '@lostgradient/weft';
+ *
+ * const runtime = detectRuntime();
+ * // Returns 'bun' | 'node' | 'browser' | 'edge'
+ * console.log(runtime); // e.g. 'bun' when running under Bun
+ * ```
+ */
+export declare function detectRuntime(): RuntimeKind;
+/**
+ * Pause execution for the given number of milliseconds.
+ *
+ * Uses `Bun.sleep` when available (microtask-friendly), otherwise wraps
+ * `setTimeout` in a `Promise`.
+ *
+ * @example
+ * ```ts
+ * import { sleep } from '@lostgradient/weft';
+ *
+ * async function poll() {
+ *   for (let i = 0; i < 3; i++) {
+ *     await sleep(100);
+ *     console.log('tick', i);
+ *   }
+ * }
+ * await poll();
+ * ```
+ */
+export declare function sleep(ms: number): Promise<void>;
+/**
+ * Hash a byte buffer to a 16-character hex string.
+ *
+ * Uses FNV-1a unconditionally across all runtimes for stable output.
+ * Hashes may be persisted to durable storage (event-log chains, tool-effect
+ * dedup), so runtime-specific algorithms would break cross-runtime reads.
+ *
+ * @example
+ * ```ts
+ * import { hashBytes } from '@lostgradient/weft';
+ *
+ * const data = new TextEncoder().encode('hello');
+ * const hash = hashBytes(data);
+ * console.log(hash.length);  // 16
+ * console.log(hashBytes(data) === hash); // true (deterministic)
+ * ```
+ */
+export declare function hashBytes(data: Uint8Array): string;
+/**
+ * Hash a string to a 16-character hex string.
+ *
+ * Uses FNV-1a unconditionally across all runtimes for stable output.
+ *
+ * @example
+ * ```ts
+ * import { hashString } from '@lostgradient/weft';
+ *
+ * const h1 = hashString('workflow-key');
+ * const h2 = hashString('workflow-key');
+ * console.log(h1 === h2);   // true (stable across calls)
+ * console.log(h1.length);   // 16
+ * ```
+ */
+export declare function hashString(data: string): string;
+/**
+ * Return the byte size of a file at the given path.
+ *
+ * - Bun: `Bun.file(path).size`
+ * - Node 22.5+: `node:fs` `statSync` loaded via `process.getBuiltinModule`
+ * - Missing files return `0` to match Bun's behavior (important for WAL
+ *   probing in the diagnostics module).
+ *
+ * Not available in browser/edge runtimes — throws if called there.
+ */
+export declare function fileSize(path: string): number;
+/**
+ * Gzip-compress a byte buffer synchronously.
+ *
+ * - Bun: `Bun.gzipSync`
+ * - Node 22.5+: `node:zlib` via `process.getBuiltinModule`
+ */
+export declare function gzipSync(data: Uint8Array): Uint8Array;
+/**
+ * Gunzip-decompress a byte buffer synchronously.
+ *
+ * - Bun: `Bun.gunzipSync`
+ * - Node 22.5+: `node:zlib` via `process.getBuiltinModule`
+ */
+export declare function gunzipSync(data: Uint8Array): Uint8Array;
+/**
+ * Load `node:zlib` if available for Node-side callers (used by compression.ts
+ * for brotli). Returns `undefined` in browsers so they can degrade cleanly.
+ * @internal
+ */
+export declare function tryLoadNodeZlib(): typeof import('node:zlib') | undefined;
+export {};

package/dist/runtime/portable.js

@@ -0,0 +1,90 @@
+let portableRuntimeTestOverrides;
+export function setPortableRuntimeTestOverridesForTesting(overrides) {
+  portableRuntimeTestOverrides = overrides;
+}
+function isBunRuntime() {
+  return typeof (portableRuntimeTestOverrides && "bun" in portableRuntimeTestOverrides ? portableRuntimeTestOverrides.bun : globalThis.Bun) < "u";
+}
+function getProcess() {
+  if (portableRuntimeTestOverrides && "process" in portableRuntimeTestOverrides)
+    return portableRuntimeTestOverrides.process;
+  return globalThis.process;
+}
+function isNodeRuntime() {
+  return typeof getProcess()?.versions?.node === "string";
+}
+function isBrowserRuntime() {
+  const windowValue = portableRuntimeTestOverrides && "window" in portableRuntimeTestOverrides ? portableRuntimeTestOverrides.window : globalThis.window, documentValue = portableRuntimeTestOverrides && "document" in portableRuntimeTestOverrides ? portableRuntimeTestOverrides.document : globalThis.document;
+  return typeof windowValue < "u" || typeof documentValue < "u";
+}
+const RUNTIME_DETECTORS = [
+  { kind: "bun", matches: isBunRuntime },
+  { kind: "node", matches: isNodeRuntime },
+  { kind: "browser", matches: isBrowserRuntime }
+];
+export function detectRuntime() {
+  for (const detector of RUNTIME_DETECTORS)
+    if (detector.matches())
+      return detector.kind;
+  return "edge";
+}
+export function sleep(ms) {
+  if (isBunRuntime())
+    return Bun.sleep(ms);
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+const FNV_OFFSET_BASIS_64 = 0xcbf29ce484222325n, FNV_PRIME_64 = 0x00000100000001b3n, MASK_64 = 0xffffffffffffffffn;
+function fnv1a64(data) {
+  let hash = FNV_OFFSET_BASIS_64;
+  for (let i = 0;i < data.length; i++) {
+    hash ^= BigInt(data[i]);
+    hash = hash * FNV_PRIME_64 & MASK_64;
+  }
+  return hash.toString(16).padStart(16, "0");
+}
+const textEncoder = new TextEncoder;
+export function hashBytes(data) {
+  return fnv1a64(data);
+}
+export function hashString(data) {
+  return fnv1a64(textEncoder.encode(data));
+}
+function loadNodeBuiltin(id) {
+  const getBuiltinModule = getProcess()?.getBuiltinModule;
+  if (typeof getBuiltinModule !== "function")
+    return;
+  return getBuiltinModule(id);
+}
+export function fileSize(path) {
+  if (isBunRuntime())
+    return Bun.file(path).size;
+  const fs = loadNodeBuiltin("node:fs");
+  if (!fs)
+    throw Error("fileSize() requires Bun or Node 22.5+ (process.getBuiltinModule). Not available in browser or edge runtimes.");
+  try {
+    return fs.statSync(path).size;
+  } catch (error) {
+    if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT")
+      return 0;
+    throw error;
+  }
+}
+function loadNodeZlib() {
+  const zlib = loadNodeBuiltin("node:zlib");
+  if (!zlib)
+    throw Error("gzip/gunzip require Bun or Node 22.5+ (process.getBuiltinModule). " + "Not available in browser or edge runtimes \u2014 use CompressionStream directly.");
+  return zlib;
+}
+export function gzipSync(data) {
+  if (isBunRuntime())
+    return new Uint8Array(Bun.gzipSync(new Uint8Array(data)));
+  return new Uint8Array(loadNodeZlib().gzipSync(data));
+}
+export function gunzipSync(data) {
+  if (isBunRuntime())
+    return new Uint8Array(Bun.gunzipSync(new Uint8Array(data)));
+  return new Uint8Array(loadNodeZlib().gunzipSync(data));
+}
+export function tryLoadNodeZlib() {
+  return loadNodeBuiltin("node:zlib");
+}

package/dist/server/api-catalog.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Generator for the `/.well-known/api-catalog` RFC 9264 linkset document.
+ *
+ * @module server/api-catalog
+ */
+export type ApiCatalogOptions = {
+    /** Absolute server origin, e.g. `https://api.example.com` */
+    readonly origin: string;
+};
+type LinksetLink = {
+    href: string;
+    type: string;
+};
+type LinksetEntry = {
+    anchor: string;
+    'service-desc': LinksetLink[];
+};
+type LinksetDocument = {
+    linkset: LinksetEntry[];
+};
+/**
+ * Generate an RFC 9264 linkset document describing the API discovery endpoints.
+ *
+ * All hrefs are absolute URLs built from `options.origin`. Links are sorted
+ * alphabetically by href for deterministic output.
+ */
+export declare function generateApiCatalog(options: ApiCatalogOptions): LinksetDocument;
+/**
+ * One-shot "publicOrigin not set" warner with private state. Tests can
+ * construct an isolated warner so they don't depend on a process-wide
+ * boolean — that was a maintainability smell flagged in review (test
+ * order could change, new test files could exercise the route without
+ * resetting, etc.).
+ */
+export type PublicOriginWarner = {
+    /** Emit the warning if it hasn't fired on this warner yet. */
+    warn(): void;
+    /** Re-arm the warner; primarily useful in tests. */
+    reset(): void;
+};
+/**
+ * Build a fresh `PublicOriginWarner`. State is captured in the closure;
+ * each instance is independent.
+ */
+export declare function createPublicOriginWarner(): PublicOriginWarner;
+/**
+ * Reset the default process-wide warning gate. **Test-only.**
+ * Production code never calls this; exported so tests can re-arm the
+ * warning between cases.
+ */
+export declare function resetPublicOriginWarningForTesting(): void;
+/**
+ * Called by the route handler when `publicOrigin` was not configured. Emits
+ * a one-shot warning so production deployments are nudged toward the
+ * `publicOrigin` option that bypasses header-derived origins entirely.
+ */
+export declare function warnIfPublicOriginUnset(): void;
+/**
+ * Extract the origin (scheme + host) from a `Request` object, validating
+ * each header before trusting it.
+ *
+ * **Security note.** Both `Host` and `X-Forwarded-Proto` are
+ * client-controllable (the latter via a misconfigured reverse proxy).
+ * Without validation, an attacker can poison `/.well-known/api-catalog`
+ * service-desc URLs by injecting a malicious `Host: evil.example` or a
+ * non-network protocol (`X-Forwarded-Proto: javascript`).
+ *
+ * Operators in production are strongly encouraged to set
+ * `serve({ publicOrigin: 'https://api.example.com' })` so this header path
+ * is never used. When `publicOrigin` is unset, this function falls back to
+ * the request URL's origin (which is the actual incoming connection's
+ * scheme/host pair as Bun resolved them, not header-derived) and only
+ * upgrades to header-derived values when the request URL does not include
+ * an authoritative origin (e.g. unit tests using relative URLs).
+ *
+ * Validation rules:
+ *   - `X-Forwarded-Proto` must be exactly `http` or `https`; anything else
+ *     is dropped.
+ *   - `Host` must match a conservative reg-name / IP-literal pattern with
+ *     optional port; anything else is dropped.
+ *   - When neither header is trustworthy, falls back to `localhost` over
+ *     `https` so the function never returns an attacker-controlled value.
+ */
+export declare function originFromRequest(request: Request): string;
+export {};

package/dist/server/api-catalog.js

@@ -0,0 +1,47 @@
+export function generateApiCatalog(options) {
+  const { origin } = options, links = [
+    { href: `${origin}/.well-known/mcp.json`, type: "application/json" },
+    { href: `${origin}/asyncapi.json`, type: "application/asyncapi+json" },
+    { href: `${origin}/openapi.json`, type: "application/openapi+json" },
+    { href: `${origin}/openrpc.json`, type: "application/json" }
+  ].toSorted((a, b) => a.href < b.href ? -1 : a.href > b.href ? 1 : 0);
+  return {
+    linkset: [
+      {
+        anchor: origin,
+        "service-desc": links
+      }
+    ]
+  };
+}
+const ALLOWED_FORWARDED_PROTOCOLS = new Set(["http", "https"]), HOST_HEADER_PATTERN = /^(?:[A-Za-z0-9._-]+(?::\d+)?|\[[0-9A-Fa-f:.]+\](?::\d+)?)$/, PUBLIC_ORIGIN_WARNING_TEXT = "[weft] discovery routes (`/.well-known/api-catalog`, `/.well-known/mcp.json`): `publicOrigin` is not configured. Absolute discovery URLs will be derived from the incoming request, which is safe for direct connections but vulnerable to Host-header poisoning when running behind a reverse proxy. Set `serve({ publicOrigin: 'https://api.example.com' })` in production.";
+export function createPublicOriginWarner() {
+  let alreadyWarned = !1;
+  return {
+    warn() {
+      if (alreadyWarned)
+        return;
+      alreadyWarned = !0;
+      console.warn(PUBLIC_ORIGIN_WARNING_TEXT);
+    },
+    reset() {
+      alreadyWarned = !1;
+    }
+  };
+}
+const DEFAULT_PUBLIC_ORIGIN_WARNER = createPublicOriginWarner();
+export function resetPublicOriginWarningForTesting() {
+  DEFAULT_PUBLIC_ORIGIN_WARNER.reset();
+}
+export function warnIfPublicOriginUnset() {
+  DEFAULT_PUBLIC_ORIGIN_WARNER.warn();
+}
+export function originFromRequest(request) {
+  try {
+    const requestUrl = new URL(request.url);
+    if (requestUrl.protocol === "https:" || requestUrl.protocol === "http:")
+      return `${requestUrl.protocol}//${requestUrl.host}`;
+  } catch {}
+  const rawHost = request.headers.get("host"), rawProto = request.headers.get("x-forwarded-proto"), proto = rawProto !== null && ALLOWED_FORWARDED_PROTOCOLS.has(rawProto.toLowerCase()) ? rawProto.toLowerCase() : "https", host = rawHost !== null && HOST_HEADER_PATTERN.test(rawHost) ? rawHost : "localhost";
+  return `${proto}://${host}`;
+}

package/dist/server/asyncapi-channels.d.ts

@@ -0,0 +1,40 @@
+import type { z } from 'zod';
+import type { DefinitionSchemaDirection } from '../core/types/definition-schema-to-json.ts';
+import type { ErasedOperation } from './operation-catalog.ts';
+/**
+ * Build the AsyncAPI channel object for a WebSocket subscription operation.
+ */
+export declare function buildWebSocketChannel(operation: ErasedOperation): Record<string, unknown>;
+/**
+ * Build the AsyncAPI channel object for an SSE stream operation.
+ *
+ * `restBindingPath` MUST be the operation's REST binding path translated to
+ * OpenAPI path-parameter syntax (e.g. `/v1/workflows/{id}/sse`). Without it
+ * the channel address falls back to a synthetic dotted-name-to-path
+ * conversion that does not match any wire endpoint — kept only as a
+ * non-failing default so a misconfigured registry produces a recognizable
+ * synthetic address rather than throwing during document generation.
+ */
+export declare function buildSseChannel(operation: ErasedOperation, restBindingPath: string | undefined): Record<string, unknown>;
+/**
+ * Build named component messages for a WebSocket subscription operation.
+ */
+export declare function buildWebSocketMessages(operation: ErasedOperation, definitionSchemaToJsonSchema: (schema: z.ZodType, direction?: DefinitionSchemaDirection) => Record<string, unknown>): Record<string, Record<string, unknown>>;
+/**
+ * Build named component messages for an SSE stream operation.
+ *
+ * The token message's `data:` line carries the operation's wire-encoded
+ * token text — for the only SSE operation today (`weft.workflows.streams.sse`)
+ * that is the raw `token` string from `mapTokenChunkToText`, NOT a JSON
+ * encoding of the operation's `eventSchema`. The `eventSchema` describes
+ * the logical per-element type for non-SSE callers (JSON-RPC envelopes
+ * carry the full object); SSE is a separate, plain-text wire.
+ *
+ * The schema below reflects the actual SSE wire. The `x-weft-event-schema`
+ * extension surfaces the logical schema for clients that need it.
+ */
+export declare function buildSseMessages(operation: ErasedOperation, definitionSchemaToJsonSchema: (schema: z.ZodType, direction?: DefinitionSchemaDirection) => Record<string, unknown>): Record<string, Record<string, unknown>>;
+/**
+ * Build an AsyncAPI operation entry for a stream or subscription operation.
+ */
+export declare function buildOperationEntry(operation: ErasedOperation, channelName: string, kind: 'subscription' | 'stream'): Record<string, unknown>;

package/dist/server/asyncapi-channels.js

@@ -0,0 +1,264 @@
+import { compareStrings } from "./json-schema-utilities.js";
+import { externalApiPath } from "./route-model.js";
+const JSON_RPC_VERSION = "2.0", EVENT_DELIVER_METHOD = "weft.events.deliver", EVENTS_TERMINATED_METHOD = "weft.events.terminated", UNSUBSCRIBE_METHOD = "weft.workflows.unsubscribe", JSON_RPC_ID_SCHEMA = {
+  oneOf: [{ type: "string" }, { type: "number" }, { type: "null" }]
+}, SUBSCRIPTION_TERMINATION_REASON_SCHEMA = {
+  enum: ["client-unsubscribed", "server-closed", "validation-failed"],
+  type: "string"
+};
+export function buildWebSocketChannel(operation) {
+  const messageNames = webSocketMessageNames(operation);
+  return {
+    address: externalApiPath("/jsonrpc"),
+    bindings: {
+      ws: {
+        method: "GET"
+      }
+    },
+    description: `JSON-RPC WebSocket subscription channel for ${operation.name}.`,
+    messages: messageReferenceMap(messageNames),
+    title: operation.summary,
+    "x-weft-operation-name": operation.name,
+    "x-weft-transport": "json-rpc-websocket"
+  };
+}
+export function buildSseChannel(operation, restBindingPath) {
+  const messageNames = sseMessageNames(operation);
+  return {
+    address: restBindingPath !== void 0 ? externalApiPath(restBindingPath) : `/x-weft-unbound/${operation.name.replaceAll(".", "/")}`,
+    description: `Server-Sent Events stream channel for ${operation.name}. Responses use text/event-stream; charset=utf-8.`,
+    messages: messageReferenceMap(messageNames),
+    title: operation.summary,
+    "x-weft-operation-name": operation.name,
+    "x-weft-transport": "server-sent-events"
+  };
+}
+export function buildWebSocketMessages(operation, definitionSchemaToJsonSchema) {
+  const names = webSocketMessageNames(operation), inputSchema = definitionSchemaToJsonSchema(operation.inputSchema), outputSchema = definitionSchemaToJsonSchema(operation.outputSchema, "output"), eventSchema = eventJsonSchema(operation, definitionSchemaToJsonSchema);
+  return {
+    [names.subscribeRequest]: {
+      name: names.subscribeRequest,
+      contentType: "application/json",
+      payload: jsonRpcRequestPayload(operation.name, inputSchema),
+      summary: `Subscribe to ${operation.name}.`
+    },
+    [names.subscribeAck]: {
+      name: names.subscribeAck,
+      contentType: "application/json",
+      payload: jsonRpcSuccessPayload(outputSchema),
+      summary: `Subscription acknowledgement for ${operation.name}.`
+    },
+    [names.eventDeliver]: {
+      name: names.eventDeliver,
+      contentType: "application/json",
+      payload: eventDeliverPayload(eventSchema),
+      summary: `Event delivery notification for ${operation.name}.`
+    },
+    [names.unsubscribeRequest]: {
+      name: names.unsubscribeRequest,
+      contentType: "application/json",
+      payload: jsonRpcRequestPayload(UNSUBSCRIBE_METHOD, {
+        additionalProperties: !1,
+        properties: {
+          subscriptionId: { type: "string" }
+        },
+        required: ["subscriptionId"],
+        type: "object"
+      }),
+      summary: `Unsubscribe from ${operation.name}.`
+    },
+    [names.terminated]: {
+      name: names.terminated,
+      contentType: "application/json",
+      payload: terminatedPayload(),
+      summary: `Subscription termination notification for ${operation.name}.`
+    },
+    [names.errorFrame]: {
+      name: names.errorFrame,
+      contentType: "application/json",
+      payload: jsonRpcErrorPayload(),
+      summary: `JSON-RPC error response for ${operation.name}.`
+    }
+  };
+}
+export function buildSseMessages(operation, definitionSchemaToJsonSchema) {
+  const names = sseMessageNames(operation), logicalEventSchema = eventJsonSchema(operation, definitionSchemaToJsonSchema);
+  return {
+    [names.tokenEvent]: {
+      name: names.tokenEvent,
+      contentType: "text/event-stream",
+      payload: { type: "string" },
+      summary: `SSE token event for ${operation.name}. The data: line carries the token text.`,
+      bindings: {
+        http: {
+          event: "token"
+        }
+      },
+      "x-weft-sse-frame": "event: token\\nid: <sequence>\\ndata: <token-text>\\n\\n",
+      "x-weft-event-schema": logicalEventSchema
+    },
+    [names.doneEvent]: {
+      name: names.doneEvent,
+      contentType: "text/event-stream",
+      payload: {
+        additionalProperties: !1,
+        properties: {},
+        type: "object"
+      },
+      summary: `SSE completion event for ${operation.name}.`,
+      bindings: {
+        http: {
+          event: "done"
+        }
+      },
+      "x-weft-sse-frame": "event: done\\n\\n"
+    },
+    [names.errorEvent]: {
+      name: names.errorEvent,
+      contentType: "text/event-stream",
+      payload: {
+        properties: {
+          code: { type: "string" },
+          data: {},
+          message: { type: "string" }
+        },
+        required: ["message"],
+        type: "object"
+      },
+      summary: `SSE error event for ${operation.name}.`,
+      bindings: {
+        http: {
+          event: "error"
+        }
+      },
+      "x-weft-sse-frame": "event: error\\ndata: <JSON Error>\\n\\n"
+    }
+  };
+}
+export function buildOperationEntry(operation, channelName, kind) {
+  const messageNames = kind === "subscription" ? Object.values(webSocketMessageNames(operation)) : Object.values(sseMessageNames(operation));
+  return {
+    action: "receive",
+    channel: { $ref: `#/channels/${jsonPointerEscape(channelName)}` },
+    messages: messageNames.map((name) => ({ $ref: `#/components/messages/${name}` })),
+    operationId: operation.name.replaceAll(".", "_"),
+    summary: operation.summary,
+    tags: [...operation.tags].toSorted().map((name) => ({ name }))
+  };
+}
+function operationPrefix(operation) {
+  return operation.name.replaceAll(".", "_");
+}
+function webSocketMessageNames(operation) {
+  const prefix = operationPrefix(operation);
+  return {
+    subscribeRequest: `${prefix}_subscribeRequest`,
+    subscribeAck: `${prefix}_subscribeAck`,
+    eventDeliver: `${prefix}_eventDeliver`,
+    unsubscribeRequest: `${prefix}_unsubscribeRequest`,
+    terminated: `${prefix}_terminated`,
+    errorFrame: `${prefix}_errorFrame`
+  };
+}
+function sseMessageNames(operation) {
+  const prefix = operationPrefix(operation);
+  return {
+    tokenEvent: `${prefix}_tokenEvent`,
+    doneEvent: `${prefix}_doneEvent`,
+    errorEvent: `${prefix}_errorEvent`
+  };
+}
+function messageReferenceMap(names) {
+  const references = {};
+  for (const [key, name] of Object.entries(names).toSorted(([left], [right]) => compareStrings(left, right)))
+    references[key] = { $ref: `#/components/messages/${name}` };
+  return references;
+}
+function jsonRpcRequestPayload(method, paramsSchema) {
+  return {
+    additionalProperties: !1,
+    properties: {
+      id: JSON_RPC_ID_SCHEMA,
+      jsonrpc: { const: JSON_RPC_VERSION, type: "string" },
+      method: { const: method, type: "string" },
+      params: paramsSchema
+    },
+    required: ["jsonrpc", "id", "method", "params"],
+    type: "object"
+  };
+}
+function jsonRpcSuccessPayload(resultSchema) {
+  return {
+    additionalProperties: !1,
+    properties: {
+      id: JSON_RPC_ID_SCHEMA,
+      jsonrpc: { const: JSON_RPC_VERSION, type: "string" },
+      result: resultSchema
+    },
+    required: ["jsonrpc", "id", "result"],
+    type: "object"
+  };
+}
+function eventDeliverPayload(eventSchema) {
+  return {
+    additionalProperties: !1,
+    properties: {
+      jsonrpc: { const: JSON_RPC_VERSION, type: "string" },
+      method: { const: EVENT_DELIVER_METHOD, type: "string" },
+      params: {
+        additionalProperties: !1,
+        properties: {
+          envelope: eventSchema,
+          subscriptionId: { type: "string" }
+        },
+        required: ["subscriptionId", "envelope"],
+        type: "object"
+      }
+    },
+    required: ["jsonrpc", "method", "params"],
+    type: "object"
+  };
+}
+function terminatedPayload() {
+  return {
+    additionalProperties: !1,
+    properties: {
+      jsonrpc: { const: JSON_RPC_VERSION, type: "string" },
+      method: { const: EVENTS_TERMINATED_METHOD, type: "string" },
+      params: {
+        additionalProperties: !1,
+        properties: {
+          fault: {
+            type: "object"
+          },
+          reason: SUBSCRIPTION_TERMINATION_REASON_SCHEMA,
+          subscriptionId: { type: "string" }
+        },
+        required: ["subscriptionId", "reason"],
+        type: "object"
+      }
+    },
+    required: ["jsonrpc", "method", "params"],
+    type: "object"
+  };
+}
+function jsonRpcErrorPayload() {
+  return {
+    additionalProperties: !1,
+    properties: {
+      error: { $ref: "#/components/schemas/JsonRpcError" },
+      id: JSON_RPC_ID_SCHEMA,
+      jsonrpc: { const: JSON_RPC_VERSION, type: "string" }
+    },
+    required: ["jsonrpc", "id", "error"],
+    type: "object"
+  };
+}
+function eventJsonSchema(operation, definitionSchemaToJsonSchema) {
+  if (operation.eventSchema === void 0)
+    return { type: "object" };
+  return definitionSchemaToJsonSchema(operation.eventSchema, "output");
+}
+function jsonPointerEscape(value) {
+  return value.replaceAll("~", "~0").replaceAll("/", "~1");
+}

package/dist/server/asyncapi.d.ts

@@ -0,0 +1,25 @@
+/**
+ * AsyncAPI 3.0 document generator driven by the operation registry.
+ *
+ * @module server/asyncapi
+ */
+import { type DiscoveryInfo } from './discovery-info.ts';
+import type { OperationRegistry } from './operation-catalog.ts';
+import { type UnknownRestBinding } from './rest-bindings.ts';
+export type AsyncApiOptions = {
+    registry: OperationRegistry;
+    /** REST bindings used to resolve SSE channel addresses. Defaults to `createLiveRestBindings()`. */
+    restBindings?: ReadonlyArray<UnknownRestBinding>;
+    title?: string;
+    version?: string;
+    discoveryInfo?: DiscoveryInfo;
+    serverUrl?: string;
+};
+/**
+ * Generate an AsyncAPI 3.0 document from the operation registry.
+ *
+ * Only discoverable operations with kind `subscription` or `stream` are
+ * listed. The returned object is deterministic: object keys are recursively
+ * sorted, and identical component messages are deduplicated by canonical JSON.
+ */
+export declare function generateAsyncApiDocument(options: AsyncApiOptions): Record<string, unknown>;