@lostgradient/weft 0.2.0

package/dist/server/asyncapi.js

@@ -0,0 +1,110 @@
+import { definitionSchemaToJsonSchema } from "../core/types/definition-schema-to-json.js";
+import { VERSION } from "../version.js";
+import {
+  buildOperationEntry,
+  buildSseChannel,
+  buildSseMessages,
+  buildWebSocketChannel,
+  buildWebSocketMessages
+} from "./asyncapi-channels.js";
+import { isDiscoverable } from "./discovery-filter.js";
+import { applyDiscoveryInfo } from "./discovery-info.js";
+import { compareStrings, isPlainObject, normalizeJsonObject } from "./json-schema-utilities.js";
+import { canonicalJson } from "./openapi-canonical-json.js";
+import { createLiveRestBindings } from "./rest-bindings.js";
+import { toOpenApiPath } from "./route-model.js";
+const JSON_RPC_ERROR_SCHEMA = {
+  additionalProperties: !1,
+  properties: {
+    code: { type: "number" },
+    data: {},
+    message: { type: "string" }
+  },
+  required: ["code", "message"],
+  type: "object"
+};
+export function generateAsyncApiDocument(options) {
+  const channels = {}, operations = {}, messages = {}, messageAliases = new Map, messageNamesByCanonical = new Map, asyncOperations = options.registry.list().filter(isAsyncApiOperation).toSorted((left, right) => compareStrings(left.name, right.name)), restBindings = options.restBindings ?? createLiveRestBindings(), sseAddressByOperationName = new Map;
+  for (const binding of restBindings)
+    if (binding.transportKind === "sse")
+      sseAddressByOperationName.set(binding.operationName, toOpenApiPath(binding.path));
+  for (const operation of asyncOperations) {
+    const channelName = channelNameForOperation(operation), operationName = operationNameForOperation(operation), channel = operation.kind === "subscription" ? buildWebSocketChannel(operation) : buildSseChannel(operation, sseAddressByOperationName.get(operation.name)), operationMessages = operation.kind === "subscription" ? buildWebSocketMessages(operation, definitionSchemaToJsonSchema) : buildSseMessages(operation, definitionSchemaToJsonSchema);
+    for (const [messageName, message] of Object.entries(operationMessages).toSorted(([left], [right]) => compareStrings(left, right))) {
+      const canonical = canonicalJson(message), existingName = messageNamesByCanonical.get(canonical), aliasedName = existingName ?? messageName;
+      messageAliases.set(messageName, aliasedName);
+      if (existingName === void 0) {
+        messageNamesByCanonical.set(canonical, messageName);
+        messages[messageName] = normalizeJsonObject(message);
+      }
+    }
+    channels[channelName] = channel;
+    operations[operationName] = buildOperationEntry(operation, channelName, operation.kind);
+  }
+  const document = {
+    asyncapi: "3.0.0",
+    info: buildAsyncApiInfo(options),
+    channels: replaceMessageReferences(channels, messageAliases),
+    operations: replaceMessageReferences(operations, messageAliases),
+    components: {
+      messages,
+      schemas: {
+        JsonRpcError: JSON_RPC_ERROR_SCHEMA
+      }
+    }
+  };
+  applyAsyncApiDocumentOptions(document, options);
+  return normalizeJsonObject(document);
+}
+function buildAsyncApiInfo(options) {
+  return applyDiscoveryInfo({
+    title: options.title ?? "Weft Workflow Engine",
+    version: options.version ?? VERSION
+  }, options.discoveryInfo);
+}
+function applyAsyncApiDocumentOptions(document, options) {
+  if (options.serverUrl !== void 0)
+    document.servers = {
+      default: createAsyncApiServer(options.serverUrl)
+    };
+  if (options.discoveryInfo?.externalDocs !== void 0)
+    document.externalDocs = { ...options.discoveryInfo.externalDocs };
+}
+function isAsyncApiOperation(operation) {
+  return isDiscoverable(operation) && (operation.kind === "subscription" || operation.kind === "stream");
+}
+function channelNameForOperation(operation) {
+  return operation.name.replaceAll(".", "/");
+}
+function operationNameForOperation(operation) {
+  return operation.name.replaceAll(".", "_");
+}
+function replaceMessageReferences(value, aliases) {
+  if (Array.isArray(value))
+    return value.map((entry) => replaceMessageReferences(entry, aliases));
+  if (!isPlainObject(value))
+    return value;
+  const reference = value.$ref;
+  if (typeof reference === "string" && reference.startsWith("#/components/messages/")) {
+    const messageName = reference.slice(22), aliasedName = aliases.get(messageName) ?? messageName;
+    return { ...value, $ref: `#/components/messages/${aliasedName}` };
+  }
+  const replaced = {};
+  for (const [key, entry] of Object.entries(value))
+    replaced[key] = replaceMessageReferences(entry, aliases);
+  return replaced;
+}
+function createAsyncApiServer(serverUrl) {
+  try {
+    const parsedServerUrl = new URL(serverUrl);
+    return {
+      host: parsedServerUrl.host,
+      protocol: parsedServerUrl.protocol === "https:" || parsedServerUrl.protocol === "wss:" ? "wss" : "ws"
+    };
+  } catch {
+    return {
+      host: serverUrl,
+      protocol: "ws"
+    };
+  }
+}

package/dist/server/attribute-filters.d.ts

@@ -0,0 +1,37 @@
+/**
+ * URL search-parameter parsers for `AttributeFilter` shapes.
+ *
+ * Both the `weft.workflows.list` REST binding (`extractInput` in
+ * `operations/list-workflows.ts`) and any future endpoint that
+ * accepts `attr.{name}=...` query parameters share these helpers.
+ *
+ * Single source of truth: a fix here lands in every caller without
+ * the drift hazard of duplicated parsing logic across operations.
+ *
+ * @module server/attribute-filters
+ */
+import type { AttributeFilter, SearchAttributeValue } from '../core/types.ts';
+type ParsedAttributeFilter = Omit<AttributeFilter, 'key'> & {
+    key: string;
+};
+/**
+ * Parse `attr.{name}={value}`, `attr.{name}.gt={value}`,
+ * `attr.{name}.lt={value}`, `attr.{name}.gte={value}`, and
+ * `attr.{name}.lte={value}` query parameters into a list of
+ * `AttributeFilter` records. Each filter aggregates exact-match
+ * and range constraints for one attribute key.
+ *
+ * Unknown operators after the second dot (e.g.
+ * `attr.foo.bogus={value}`) are silently skipped — the alternative
+ * (a 400) would let any client typo escalate into an unconstrained
+ * range scan, which is worse than the typo being ignored.
+ */
+export declare function parseAttributeFilters(params: URLSearchParams): ParsedAttributeFilter[];
+/**
+ * Infer a typed `SearchAttributeValue` from its URL-decoded string.
+ * Booleans and numbers parse first, otherwise the raw string is
+ * preserved. The empty string stays a string (it would otherwise
+ * coerce to `0` via `Number('')`).
+ */
+export declare function inferAttributeValue(raw: string): SearchAttributeValue;
+export {};

package/dist/server/attribute-filters.js

@@ -0,0 +1,39 @@
+export function parseAttributeFilters(params) {
+  const filterMap = new Map;
+  for (const [key, value] of params) {
+    if (!key.startsWith("attr."))
+      continue;
+    const rest = key.slice(5), dotIndex = rest.indexOf(".");
+    if (dotIndex === -1) {
+      const name = rest, existing = filterMap.get(name) ?? { key: name };
+      existing.value = inferAttributeValue(value);
+      filterMap.set(name, existing);
+    } else {
+      const name = rest.slice(0, dotIndex), operator = rest.slice(dotIndex + 1), existing = filterMap.get(name) ?? { key: name };
+      if (operator === "gt") {
+        existing.gt = inferAttributeValue(value);
+        filterMap.set(name, existing);
+      } else if (operator === "lt") {
+        existing.lt = inferAttributeValue(value);
+        filterMap.set(name, existing);
+      } else if (operator === "gte") {
+        existing.gte = inferAttributeValue(value);
+        filterMap.set(name, existing);
+      } else if (operator === "lte") {
+        existing.lte = inferAttributeValue(value);
+        filterMap.set(name, existing);
+      }
+    }
+  }
+  return [...filterMap.values()];
+}
+export function inferAttributeValue(raw) {
+  if (raw === "true")
+    return !0;
+  if (raw === "false")
+    return !1;
+  const asNumber = Number(raw);
+  if (!Number.isNaN(asNumber) && raw.trim() !== "")
+    return asNumber;
+  return raw;
+}

package/dist/server/authentication/api-key.d.ts

@@ -0,0 +1,3 @@
+import type { AuthorizationScope } from '../authorization-scope.ts';
+import type { AuthConfig, AuthResult } from './types.ts';
+export declare function tryAdmitApiKey(presentedKey: string, resolver: AuthConfig['resolveApiKeyPrincipal'], apiKeySet: Set<string> | null, defaultApiKeyScopes: ReadonlyArray<AuthorizationScope>): Promise<AuthResult | 'continue'>;

package/dist/server/authentication/api-key.js

@@ -0,0 +1,80 @@
+import { principalFromApiKey } from "../principal.js";
+function validateApiKeyPrincipalMethod(principal) {
+  if (principal.method !== "api-key") {
+    console.warn(`resolveApiKeyPrincipal returned principal with method "${principal.method}"; expected "api-key". Rejecting.`);
+    return !1;
+  }
+  return !0;
+}
+function rejectScopeSetMutation(name) {
+  return () => {
+    throw TypeError(`Cannot mutate scope set on admitted principal (attempted ${name})`);
+  };
+}
+function immutableScopeSet(source) {
+  const inner = new Set(source), guarded = {
+    has: (scope) => inner.has(scope),
+    get size() {
+      return inner.size;
+    },
+    forEach: (callback, thisArg) => inner.forEach((v, v2) => callback.call(thisArg, v, v2, guarded)),
+    keys: () => inner.keys(),
+    values: () => inner.values(),
+    entries: () => inner.entries(),
+    [Symbol.iterator]: () => inner[Symbol.iterator](),
+    add: rejectScopeSetMutation("add"),
+    delete: rejectScopeSetMutation("delete"),
+    clear: rejectScopeSetMutation("clear")
+  };
+  return Object.freeze(guarded);
+}
+function cloneClaims(claims) {
+  if (claims === void 0)
+    return;
+  return deepFreeze(structuredClone(claims));
+}
+function deepFreeze(value) {
+  if (typeof value !== "object" || value === null)
+    return value;
+  Object.freeze(value);
+  for (const key of Object.keys(value)) {
+    const child = value[key];
+    if (typeof child === "object" && child !== null && !Object.isFrozen(child))
+      deepFreeze(child);
+  }
+  return value;
+}
+function deepFreezeApiKeyPrincipal(principal) {
+  const guardedScopes = immutableScopeSet(principal.scopes), frozen = {
+    method: "api-key",
+    scopes: guardedScopes,
+    claims: cloneClaims(principal.claims),
+    subject: principal.subject,
+    hasScope(scope) {
+      return guardedScopes.has(scope);
+    }
+  };
+  return Object.freeze(frozen);
+}
+export async function tryAdmitApiKey(presentedKey, resolver, apiKeySet, defaultApiKeyScopes) {
+  if (resolver !== void 0) {
+    let resolved;
+    try {
+      resolved = await resolver(presentedKey);
+    } catch (error) {
+      console.warn("resolveApiKeyPrincipal threw:", error instanceof Error ? error.message : error);
+      resolved = null;
+    }
+    if (resolved !== null && validateApiKeyPrincipalMethod(resolved))
+      return { authenticated: !0, method: "api-key", principal: deepFreezeApiKeyPrincipal(resolved) };
+    return { authenticated: !1, error: "No valid credentials provided" };
+  }
+  if (apiKeySet?.has(presentedKey)) {
+    const principal = principalFromApiKey({
+      subject: "api-key-caller",
+      scopes: defaultApiKeyScopes
+    });
+    return { authenticated: !0, method: "api-key", principal: deepFreezeApiKeyPrincipal(principal) };
+  }
+  return "continue";
+}

package/dist/server/authentication/audit.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Structured authentication audit trail.
+ *
+ * Every authentication decision the server makes — admission or rejection —
+ * emits one structured event so operators have a compliance-grade record of who
+ * authenticated, by which method, against which request, and whether it
+ * succeeded. The event is deliberately free of secrets: it carries the
+ * authenticated subject and method, never the presented credential.
+ *
+ * The default sink writes a single JSON line to `console.info` (success) or
+ * `console.warn` (failure), which standard log shippers collect. Embedders that
+ * forward audit events to a SIEM supply their own {@link AuthAuditSink} via
+ * `serve({ auth: { auditSink } })`.
+ *
+ * @module server/authentication/audit
+ */
+import type { AuthMethod } from './types.ts';
+/**
+ * A single authentication audit record. Emitted once per authenticated request
+ * (including public-path bypass and rejection). Contains no credential
+ * material — `credentialFingerprint`, when present, is the one-way mask from
+ * {@link redactCredential}, suitable for correlating events about the same key
+ * without revealing it.
+ *
+ * @example
+ * ```ts
+ * import { type AuthAuditEvent } from '@lostgradient/weft/server';
+ *
+ * const event: AuthAuditEvent = {
+ *   outcome: 'success',
+ *   method: 'api-key',
+ *   subject: 'service-account-7',
+ *   path: '/v1/workflows',
+ *   httpMethod: 'POST',
+ *   timestamp: new Date().toISOString(),
+ * };
+ * void event;
+ * ```
+ */
+export type AuthAuditEvent = {
+    /** Whether the request was admitted (`success`) or rejected (`failure`). */
+    outcome: 'success' | 'failure';
+    /** Admission path that decided the request, or `unknown` when no method matched. */
+    method: AuthMethod | 'unknown';
+    /** Authenticated principal subject, when one was established. */
+    subject?: string;
+    /** Request path the decision applied to (already prefix-normalized). */
+    path: string;
+    /** HTTP method of the request. */
+    httpMethod: string;
+    /** ISO-8601 timestamp of the decision. */
+    timestamp: string;
+    /** Client-safe rejection reason on failure. Never contains credential bytes. */
+    reason?: string;
+    /** One-way masked fingerprint of the presented credential, for correlation. */
+    credentialFingerprint?: string;
+};
+/**
+ * Sink that receives every {@link AuthAuditEvent}. Supply a custom sink via
+ * `serve({ auth: { auditSink } })` to forward audit records to a SIEM or
+ * structured-logging pipeline; omit it to use {@link defaultAuthAuditSink}.
+ *
+ * Implementations must be non-throwing and fast — the sink runs inline on the
+ * authentication path. Failures inside a sink must not break request handling.
+ *
+ * @example
+ * ```ts
+ * import { type AuthAuditEvent, type AuthAuditSink } from '@lostgradient/weft/server';
+ *
+ * const collected: AuthAuditEvent[] = [];
+ * const sink: AuthAuditSink = (event) => collected.push(event);
+ * void sink;
+ * ```
+ */
+export type AuthAuditSink = (event: AuthAuditEvent) => void;
+/**
+ * Default {@link AuthAuditSink}: writes one structured JSON line per event,
+ * routing successes to `console.info` and failures to `console.warn`. The
+ * `weft.auth-audit` discriminator lets log processors filter the audit stream.
+ *
+ * @example
+ * ```ts
+ * import { defaultAuthAuditSink } from '@lostgradient/weft/server';
+ *
+ * defaultAuthAuditSink({
+ *   outcome: 'failure',
+ *   method: 'unknown',
+ *   path: '/v1/workflows',
+ *   httpMethod: 'GET',
+ *   timestamp: new Date().toISOString(),
+ *   reason: 'No valid credentials provided',
+ * });
+ * ```
+ */
+export declare function defaultAuthAuditSink(event: AuthAuditEvent): void;
+/**
+ * Inputs needed to build and emit an audit event for a single request. The
+ * raw `presentedCredential` is masked here — it is never stored on the event
+ * or passed to the sink in cleartext.
+ */
+export type AuthAuditContext = {
+    outcome: 'success' | 'failure';
+    method: AuthMethod | 'unknown';
+    subject: string | undefined;
+    request: Request;
+    reason?: string | undefined;
+    presentedCredential?: string | null | undefined;
+};
+/**
+ * Build an {@link AuthAuditEvent} from request context and hand it to `sink`,
+ * masking the presented credential first. A throwing sink is swallowed (and
+ * logged) so audit-emission failures never break request handling.
+ *
+ * @internal
+ */
+export declare function emitAuthAuditEvent(sink: AuthAuditSink, context: AuthAuditContext): void;

package/dist/server/authentication/audit.js

@@ -0,0 +1,25 @@
+import { redactCredential } from "./redaction.js";
+export function defaultAuthAuditSink(event) {
+  const line = JSON.stringify({ type: "weft.auth-audit", ...event });
+  if (event.outcome === "success")
+    console.info(line);
+  else
+    console.warn(line);
+}
+export function emitAuthAuditEvent(sink, context) {
+  const url = new URL(context.request.url), event = {
+    outcome: context.outcome,
+    method: context.method,
+    path: url.pathname,
+    httpMethod: context.request.method,
+    timestamp: new Date().toISOString(),
+    ...context.subject !== void 0 ? { subject: context.subject } : {},
+    ...context.reason !== void 0 ? { reason: context.reason } : {},
+    ...context.presentedCredential !== void 0 && context.presentedCredential !== null ? { credentialFingerprint: redactCredential(context.presentedCredential) } : {}
+  };
+  try {
+    sink(event);
+  } catch (error) {
+    console.error("[weft] auth audit sink threw:", error instanceof Error ? error.message : error);
+  }
+}

package/dist/server/authentication/crypto.d.ts

@@ -0,0 +1,7 @@
+import { type JWTAlgorithm, type JWTConfig, type JWTPayload } from './types.ts';
+/** Import a CryptoKey from JWT configuration for signature verification. */
+export declare function importJWTKey(config: JWTConfig): Promise<CryptoKey>;
+/** Sign a JWT payload. Primarily for testing. */
+export declare function signJWT(payload: JWTPayload, secret: string, algorithm?: JWTAlgorithm): Promise<string>;
+/** Verify a JWT token and return its decoded payload. */
+export declare function verifyJWT(token: string, key: CryptoKey, config: JWTConfig): Promise<JWTPayload>;

package/dist/server/authentication/crypto.js

@@ -0,0 +1,99 @@
+import {
+  DEFAULT_CLOCK_TOLERANCE
+} from "./types.js";
+const HMAC_IMPORT_PARAMS = {
+  HS256: { name: "HMAC", hash: "SHA-256" },
+  HS384: { name: "HMAC", hash: "SHA-384" },
+  HS512: { name: "HMAC", hash: "SHA-512" }
+}, RSA_IMPORT_PARAMS = {
+  RS256: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+  RS384: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-384" },
+  RS512: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-512" }
+}, ECDSA_IMPORT_PARAMS = {
+  ES256: { name: "ECDSA", namedCurve: "P-256" },
+  ES384: { name: "ECDSA", namedCurve: "P-384" },
+  ES512: { name: "ECDSA", namedCurve: "P-521" }
+};
+function getImportParams(algorithm) {
+  if (algorithm in HMAC_IMPORT_PARAMS)
+    return HMAC_IMPORT_PARAMS[algorithm];
+  if (algorithm in RSA_IMPORT_PARAMS)
+    return RSA_IMPORT_PARAMS[algorithm];
+  return ECDSA_IMPORT_PARAMS[algorithm];
+}
+function getVerifyParams(algorithm) {
+  if (algorithm.startsWith("ES"))
+    return { name: "ECDSA", hash: `SHA-${algorithm.slice(2)}` };
+  return getImportParams(algorithm);
+}
+function textToBuffer(text) {
+  const encoded = new TextEncoder().encode(text), buffer = new ArrayBuffer(encoded.byteLength);
+  new Uint8Array(buffer).set(encoded);
+  return buffer;
+}
+function binaryStringToBuffer(binary) {
+  const buffer = new ArrayBuffer(binary.length), view = new Uint8Array(buffer);
+  for (let i = 0;i < binary.length; i++)
+    view[i] = binary.charCodeAt(i);
+  return buffer;
+}
+function base64UrlDecode(input) {
+  const base64 = input.replace(/-/g, "+").replace(/_/g, "/"), padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+  return binaryStringToBuffer(atob(padded));
+}
+function base64UrlEncode(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function parsePEM(pem) {
+  const base64 = pem.replace(/-----[A-Z ]+-----/g, "").replace(/\s/g, "");
+  return binaryStringToBuffer(atob(base64));
+}
+export async function importJWTKey(config) {
+  const algorithm = config.algorithm ?? "HS256", params = getImportParams(algorithm);
+  if (algorithm.startsWith("HS")) {
+    if (!config.secret)
+      throw Error('JWT configuration requires "secret" for HMAC algorithms');
+    return crypto.subtle.importKey("raw", textToBuffer(config.secret), params, !1, ["verify"]);
+  }
+  if (!config.publicKey)
+    throw Error('JWT configuration requires "publicKey" for RSA/ECDSA algorithms');
+  return crypto.subtle.importKey("spki", parsePEM(config.publicKey), params, !1, ["verify"]);
+}
+export async function signJWT(payload, secret, algorithm = "HS256") {
+  const headerB64 = base64UrlEncode(textToBuffer(JSON.stringify({ alg: algorithm, typ: "JWT" }))), payloadB64 = base64UrlEncode(textToBuffer(JSON.stringify(payload))), signingInput = textToBuffer(`${headerB64}.${payloadB64}`), params = getImportParams(algorithm), key = await crypto.subtle.importKey("raw", textToBuffer(secret), params, !1, ["sign"]), signature = await crypto.subtle.sign(params, key, signingInput);
+  return `${headerB64}.${payloadB64}.${base64UrlEncode(signature)}`;
+}
+function validateTemporalClaims(payload, config) {
+  const now = Math.floor(Date.now() / 1000), tolerance = config.clockTolerance ?? DEFAULT_CLOCK_TOLERANCE;
+  if (typeof payload.exp === "number" && now > payload.exp + tolerance)
+    throw Error("JWT expired");
+  if (typeof payload.nbf === "number" && now < payload.nbf - tolerance)
+    throw Error("JWT not yet valid");
+}
+function validateClaimsIdentity(payload, config) {
+  if (config.issuer !== void 0 && payload.iss !== config.issuer)
+    throw Error(`Invalid issuer: expected "${config.issuer}", got "${String(payload.iss)}"`);
+  if (config.audience !== void 0) {
+    if (!(Array.isArray(payload.aud) ? payload.aud : [payload.aud]).includes(config.audience))
+      throw Error(`Invalid audience: expected "${config.audience}"`);
+  }
+}
+export async function verifyJWT(token, key, config) {
+  const parts = token.split(".");
+  if (parts.length !== 3)
+    throw Error("Invalid JWT format");
+  const [headerB64, payloadB64, signatureB64] = parts, header = JSON.parse(new TextDecoder().decode(base64UrlDecode(headerB64))), expectedAlgorithm = config.algorithm ?? "HS256";
+  if (header.alg !== expectedAlgorithm)
+    throw Error(`Algorithm mismatch: expected ${expectedAlgorithm}, got ${header.alg}`);
+  const signingInput = textToBuffer(`${headerB64}.${payloadB64}`), signature = base64UrlDecode(signatureB64), verifyParams = getVerifyParams(expectedAlgorithm);
+  if (!await crypto.subtle.verify(verifyParams, key, signature, signingInput))
+    throw Error("Invalid JWT signature");
+  const payload = JSON.parse(new TextDecoder().decode(base64UrlDecode(payloadB64)));
+  validateTemporalClaims(payload, config);
+  validateClaimsIdentity(payload, config);
+  return payload;
+}

package/dist/server/authentication/index.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Authentication middleware for the Weft HTTP server.
+ *
+ * Supports three authentication methods, all optional and configurable:
+ * - **API keys**: validated via `Authorization: Bearer <key>` or `X-API-Key` header
+ * - **JWT**: HMAC or RSA/ECDSA signature verification with claims validation
+ * - **mTLS**: mutual TLS at the transport layer (configured via Bun.serve tls options)
+ *
+ * @module server/authentication
+ */
+import { type AuthConfig, type Authenticator } from './types.ts';
+export { defaultAuthAuditSink, emitAuthAuditEvent, type AuthAuditContext, type AuthAuditEvent, type AuthAuditSink, } from './audit.ts';
+export { importJWTKey, signJWT, verifyJWT } from './crypto.ts';
+export { createRateLimiter, validateRateLimitConfig, type RateLimitConfig, type RateLimitDecision, type RateLimiter, } from './rate-limiter.ts';
+export { isSensitiveHeader, redactCredential, redactHeaders } from './redaction.ts';
+export { createRotatingApiKeyStore, type ApiKeyRegistration, type RotatingApiKeyStore, } from './rotating-api-key-store.ts';
+export { DEFAULT_CLOCK_TOLERANCE, DEFAULT_PUBLIC_PATHS, type AuthConfig, type AuthContext, type Authenticator, type AuthMethod, type AuthResult, type JWTAlgorithm, type JWTConfig, type JWTPayload, type MTLSConfig, } from './types.ts';
+/**
+ * Validate an `AuthConfig` eagerly, throwing on invalid combinations.
+ * Called synchronously in `serve()` so misconfigurations fail fast.
+ *
+ * @example
+ * ```ts
+ * import { validateAuthConfig } from '@lostgradient/weft';
+ *
+ * // Throws if config is invalid (e.g. missing secret for HS256)
+ * validateAuthConfig({
+ *   apiKeys: ['secret-key-1'],
+ * });
+ * console.log('Config is valid');
+ * ```
+ */
+export declare function validateAuthConfig(config: AuthConfig): void;
+/**
+ * Create an authenticator function from an auth configuration.
+ *
+ * The returned function checks each configured method in order:
+ * 1. Public path bypass
+ * 2. API key (O(1) set lookup)
+ * 3. JWT (signature + claims verification)
+ * 4. mTLS (transport-level — any request that reaches the handler is authenticated)
+ *
+ * @example
+ * ```ts
+ * import { createAuthenticator } from '@lostgradient/weft';
+ *
+ * const authenticate = await createAuthenticator({
+ *   apiKeys: ['my-secret-key'],
+ * });
+ * const request = new Request('http://localhost/v1/workflows', {
+ *   headers: { 'X-API-Key': 'my-secret-key' },
+ * });
+ * const result = await authenticate(request);
+ * console.log(result.authenticated); // true
+ * ```
+ */
+export declare function createAuthenticator(config: AuthConfig): Promise<Authenticator>;
+/**
+ * Build Bun.serve-compatible TLS options from an mTLS configuration.
+ * Returns `undefined` when no mTLS is configured.
+ */
+export declare function buildTLSOptions(config: AuthConfig | undefined): {
+    cert: string;
+    key: string;
+    ca: string | string[];
+    requestCert: boolean;
+    rejectUnauthorized: boolean;
+} | undefined;