@meekojs/meeko 0.0.3 → 0.0.4

package/dist/framework-server/auto-clients.js

@@ -0,0 +1,27 @@
+import { currentRequest } from "./context.js";
+/** Dynamic options prevent a module-level client from retaining any user's credentials. */
+export function createServerClientOptions() {
+    return {
+        baseUrl: () => currentRequest().context.request.url,
+        headers: () => {
+            const request = currentRequest().context.request;
+            const headers = new Headers();
+            for (const name of ["cookie", "authorization"]) {
+                const value = request.headers.get(name);
+                if (value !== null)
+                    headers.set(name, value);
+            }
+            headers.set("origin", new URL(request.url).origin);
+            return headers;
+        },
+        csrfToken: () => currentRequest().context.session.current?.csrfToken,
+        fetch: async (input, init) => {
+            const active = currentRequest();
+            const request = new Request(input, init);
+            if (active.serverFetch)
+                return active.serverFetch(request, active.context);
+            return fetch(request);
+        },
+    };
+}
+//# sourceMappingURL=auto-clients.js.map

package/dist/framework-server/auto-clients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-clients.js","sourceRoot":"","sources":["../../src/framework-server/auto-clients.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C,2FAA2F;AAC3F,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG;QACnD,OAAO,EAAE,GAAG,EAAE;YACZ,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YACjD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;YAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,CAAC;gBAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,KAAK,KAAK,IAAI;oBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;YACnD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,SAAS,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS;QACpE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACzC,IAAI,MAAM,CAAC,WAAW;gBAAE,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3E,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { currentRequest } from \"./context.js\";\nimport type { ClientOptions } from \"../framework/clients.js\";\n\n/** Dynamic options prevent a module-level client from retaining any user's credentials. */\nexport function createServerClientOptions(): ClientOptions {\n  return {\n    baseUrl: () => currentRequest().context.request.url,\n    headers: () => {\n      const request = currentRequest().context.request;\n      const headers = new Headers();\n      for (const name of [\"cookie\", \"authorization\"]) {\n        const value = request.headers.get(name);\n        if (value !== null) headers.set(name, value);\n      }\n      headers.set(\"origin\", new URL(request.url).origin);\n      return headers;\n    },\n    csrfToken: () => currentRequest().context.session.current?.csrfToken,\n    fetch: async (input, init) => {\n      const active = currentRequest();\n      const request = new Request(input, init);\n      if (active.serverFetch) return active.serverFetch(request, active.context);\n      return fetch(request);\n    },\n  };\n}\n"]}

package/dist/framework-server/context.d.ts

@@ -0,0 +1,21 @@
+import type { SessionHandle } from "./sessions.js";
+/** State belongs to one HTTP request and is never shared between users. */
+export interface RequestContext<TServices = unknown> {
+    readonly request: Request;
+    readonly requestId: string;
+    readonly signal: AbortSignal;
+    readonly services: TServices;
+    readonly session: SessionHandle;
+    readonly state: Map<string, unknown>;
+}
+export type ServerFetch = (request: Request, context: RequestContext) => Promise<Response>;
+interface ActiveRequest {
+    readonly context: RequestContext;
+    readonly serverFetch?: ServerFetch;
+}
+/** Binds automatic server clients to the current request across async work. */
+export declare function withRequestContext<T>(context: RequestContext, serverFetch: ServerFetch | undefined, run: () => T): T;
+export declare function currentRequest(): ActiveRequest;
+export declare function createRequestContext<TServices>(request: Request, services: TServices, session: SessionHandle): RequestContext<TServices>;
+export declare function useRequestState<T>(context: RequestContext, key: string, factory: () => T): T;
+export {};

package/dist/framework-server/context.js

@@ -0,0 +1,22 @@
+import { randomUUID } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
+const activeRequest = new AsyncLocalStorage();
+/** Binds automatic server clients to the current request across async work. */
+export function withRequestContext(context, serverFetch, run) {
+    return activeRequest.run({ context, ...(serverFetch ? { serverFetch } : {}) }, run);
+}
+export function currentRequest() {
+    const active = activeRequest.getStore();
+    if (!active)
+        throw new Error("Automatic server clients require an active Meeko request context");
+    return active;
+}
+export function createRequestContext(request, services, session) {
+    return { request, requestId: randomUUID(), signal: request.signal, services, session, state: new Map() };
+}
+export function useRequestState(context, key, factory) {
+    if (!context.state.has(key))
+        context.state.set(key, factory());
+    return context.state.get(key);
+}
+//# sourceMappingURL=context.js.map

package/dist/framework-server/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/framework-server/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAerD,MAAM,aAAa,GAAG,IAAI,iBAAiB,EAAiB,CAAC;AAE7D,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAI,OAAuB,EAAE,WAAoC,EAAE,GAAY;IAC/G,OAAO,aAAa,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACjG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAY,OAAgB,EAAE,QAAmB,EAAE,OAAsB;IAC3G,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;AAC3G,CAAC;AAED,MAAM,UAAU,eAAe,CAAI,OAAuB,EAAE,GAAW,EAAE,OAAgB;IACvF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAM,CAAC;AACrC,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport type { SessionHandle } from \"./sessions.js\";\n\n/** State belongs to one HTTP request and is never shared between users. */\nexport interface RequestContext<TServices = unknown> {\n  readonly request: Request;\n  readonly requestId: string;\n  readonly signal: AbortSignal;\n  readonly services: TServices;\n  readonly session: SessionHandle;\n  readonly state: Map<string, unknown>;\n}\n\nexport type ServerFetch = (request: Request, context: RequestContext) => Promise<Response>;\ninterface ActiveRequest { readonly context: RequestContext; readonly serverFetch?: ServerFetch }\nconst activeRequest = new AsyncLocalStorage<ActiveRequest>();\n\n/** Binds automatic server clients to the current request across async work. */\nexport function withRequestContext<T>(context: RequestContext, serverFetch: ServerFetch | undefined, run: () => T): T {\n  return activeRequest.run({ context, ...(serverFetch ? { serverFetch } : {}) }, run);\n}\n\nexport function currentRequest(): ActiveRequest {\n  const active = activeRequest.getStore();\n  if (!active) throw new Error(\"Automatic server clients require an active Meeko request context\");\n  return active;\n}\n\nexport function createRequestContext<TServices>(request: Request, services: TServices, session: SessionHandle): RequestContext<TServices> {\n  return { request, requestId: randomUUID(), signal: request.signal, services, session, state: new Map() };\n}\n\nexport function useRequestState<T>(context: RequestContext, key: string, factory: () => T): T {\n  if (!context.state.has(key)) context.state.set(key, factory());\n  return context.state.get(key) as T;\n}\n"]}

package/dist/framework-server/contracts.d.ts

@@ -0,0 +1,64 @@
+import type { RequestContext } from "./context.js";
+import { type SessionManager } from "./sessions.js";
+/** Valibot schemas implement this public Standard Schema contract. */
+export interface Schema<I = unknown, O = I> {
+    readonly "~standard": {
+        readonly version: 1;
+        readonly validate: (value: unknown) => {
+            value: O;
+            issues?: undefined;
+        } | {
+            issues: readonly unknown[];
+        } | Promise<{
+            value: O;
+            issues?: undefined;
+        } | {
+            issues: readonly unknown[];
+        }>;
+        readonly types?: {
+            readonly input: I;
+            readonly output: O;
+        } | undefined;
+    };
+}
+type Input<S> = S extends Schema<infer I, unknown> ? I : never;
+type Output<S> = S extends Schema<unknown, infer O> ? O : never;
+type OptionalOutput<S> = S extends Schema ? Output<S> : undefined;
+export declare class ApiError extends Error {
+    readonly code: string;
+    readonly status: number;
+    constructor(code: string, status: number, message?: string);
+}
+export interface ApiRouteDefinition<P extends Schema | undefined, Q extends Schema | undefined, B extends Schema | undefined, R extends Schema | undefined, S = unknown> {
+    params?: P;
+    query?: Q;
+    body?: B;
+    response?: R;
+    auth?: "required" | "optional";
+    contentType?: "json" | "response";
+    authorize?: (context: RequestContext<S>) => boolean | Promise<boolean>;
+    handler: (args: {
+        params: OptionalOutput<P>;
+        query: OptionalOutput<Q>;
+        body: OptionalOutput<B>;
+        context: RequestContext<S>;
+    }) => Promise<R extends Schema ? Output<R> : Response> | (R extends Schema ? Output<R> : Response);
+}
+export declare function defineApiRoute<P extends Schema | undefined = undefined, Q extends Schema | undefined = undefined, B extends Schema | undefined = undefined, R extends Schema | undefined = undefined, S = unknown>(definition: ApiRouteDefinition<P, Q, B, R, S>): ApiRouteDefinition<P, Q, B, R, S>;
+export interface RpcDefinition<I extends Schema, O extends Schema, S = unknown> {
+    input: I;
+    output: O;
+    auth?: "required" | "optional";
+    authorize?: (context: RequestContext<S>) => boolean | Promise<boolean>;
+    handler: (args: {
+        input: Output<I>;
+        context: RequestContext<S>;
+    }) => Promise<Input<O> | Output<O>> | Input<O> | Output<O>;
+}
+export declare function defineRpc<I extends Schema, O extends Schema, S = unknown>(definition: RpcDefinition<I, O, S>): RpcDefinition<I, O, S>;
+export declare function executeApiRoute<P extends Schema | undefined, Q extends Schema | undefined, B extends Schema | undefined, R extends Schema | undefined, S>(definition: ApiRouteDefinition<P, Q, B, R, S>, context: RequestContext<S>, sessions: SessionManager, rawParams?: unknown): Promise<Response>;
+export declare function executeRpc<I extends Schema, O extends Schema, S>(definition: RpcDefinition<I, O, S>, rawInput: unknown, context: RequestContext<S>, sessions: SessionManager): Promise<Output<O>>;
+export declare function errorResponse(error: unknown, requestId: string): Response;
+export declare function dispatchApiRoute<P extends Schema | undefined, Q extends Schema | undefined, B extends Schema | undefined, R extends Schema | undefined, S>(definition: ApiRouteDefinition<P, Q, B, R, S>, context: RequestContext<S>, sessions: SessionManager, params?: unknown): Promise<Response>;
+export declare function dispatchRpc<I extends Schema, O extends Schema, S>(definition: RpcDefinition<I, O, S>, context: RequestContext<S>, sessions: SessionManager): Promise<Response>;
+export {};

package/dist/framework-server/contracts.js

@@ -0,0 +1,129 @@
+import { serializeJson } from "../server.js";
+import { SessionSecurityError } from "./sessions.js";
+export class ApiError extends Error {
+    code;
+    status;
+    constructor(code, status, message = code) {
+        super(message);
+        this.code = code;
+        this.status = status;
+    }
+}
+export function defineApiRoute(definition) {
+    return definition;
+}
+export function defineRpc(definition) {
+    return definition;
+}
+async function validate(schema, value, label) {
+    const result = await schema["~standard"].validate(value);
+    if ("issues" in result && result.issues)
+        throw new ApiError(`INVALID_${label.toUpperCase()}`, label === "response" || label === "output" ? 500 : 400);
+    return result.value;
+}
+async function readJson(request, maxBytes = 1024 * 1024) {
+    if (!request.headers.get("content-type")?.toLowerCase().startsWith("application/json"))
+        throw new ApiError("UNSUPPORTED_MEDIA_TYPE", 415);
+    const reader = request.body?.getReader();
+    if (!reader)
+        throw new ApiError("INVALID_JSON", 400);
+    let length = 0;
+    const chunks = [];
+    try {
+        while (true) {
+            const next = await reader.read();
+            if (next.done)
+                break;
+            length += next.value.byteLength;
+            if (length > maxBytes)
+                throw new ApiError("BODY_TOO_LARGE", 413);
+            chunks.push(next.value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(length);
+    let position = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, position);
+        position += chunk.byteLength;
+    }
+    try {
+        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw new ApiError("INVALID_JSON", 400);
+    }
+}
+function queryObject(url) {
+    const result = Object.create(null);
+    for (const [key, value] of url.searchParams) {
+        const previous = result[key];
+        result[key] = previous === undefined ? value : Array.isArray(previous) ? [...previous, value] : [previous, value];
+    }
+    return result;
+}
+async function guard(definition, context, sessions, mutating) {
+    sessions.assertMutationAllowed(context.request, context.session, mutating);
+    if (definition.auth === "required" && !context.session.current)
+        throw new ApiError("UNAUTHENTICATED", 401);
+    if (definition.authorize && !(await definition.authorize(context)))
+        throw new ApiError("FORBIDDEN", 403);
+}
+export async function executeApiRoute(definition, context, sessions, rawParams = {}) {
+    await guard(definition, context, sessions);
+    const params = definition.params ? await validate(definition.params, rawParams, "params") : undefined;
+    const query = definition.query ? await validate(definition.query, queryObject(new URL(context.request.url)), "query") : undefined;
+    const body = definition.body ? await validate(definition.body, await readJson(context.request), "body") : undefined;
+    const result = await definition.handler({ params: params, query: query, body: body, context });
+    if (definition.contentType === "response") {
+        if (!(result instanceof Response))
+            throw new ApiError("INVALID_RESPONSE", 500);
+        return result;
+    }
+    if (!definition.response)
+        throw new ApiError("MISSING_RESPONSE_SCHEMA", 500);
+    const output = await validate(definition.response, result, "response");
+    return new Response(serializeJson(output), { headers: { "content-type": "application/json; charset=utf-8" } });
+}
+export async function executeRpc(definition, rawInput, context, sessions) {
+    await guard(definition, context, sessions, true);
+    const input = await validate(definition.input, rawInput, "input");
+    const result = await definition.handler({ input, context });
+    const output = await validate(definition.output, result, "output");
+    serializeJson(output);
+    return output;
+}
+export function errorResponse(error, requestId) {
+    const known = error instanceof ApiError ? error : error instanceof SessionSecurityError ? new ApiError(error.code, 403) : new ApiError("INTERNAL_ERROR", 500);
+    return new Response(serializeJson({ code: known.code, status: known.status, requestId }), { status: known.status, headers: { "content-type": "application/json; charset=utf-8", "x-request-id": requestId } });
+}
+function finish(response, context) {
+    response.headers.set("x-request-id", context.requestId);
+    if (context.session.cookieHeader)
+        response.headers.append("set-cookie", context.session.cookieHeader);
+    if (context.session.current)
+        response.headers.set("x-meeko-csrf-token", context.session.current.csrfToken);
+    return response;
+}
+export async function dispatchApiRoute(definition, context, sessions, params = {}) {
+    try {
+        return finish(await executeApiRoute(definition, context, sessions, params), context);
+    }
+    catch (error) {
+        return finish(errorResponse(error, context.requestId), context);
+    }
+}
+export async function dispatchRpc(definition, context, sessions) {
+    try {
+        if (context.request.method !== "POST")
+            throw new ApiError("METHOD_NOT_ALLOWED", 405);
+        const output = await executeRpc(definition, await readJson(context.request), context, sessions);
+        return finish(new Response(serializeJson(output), { headers: { "content-type": "application/json; charset=utf-8" } }), context);
+    }
+    catch (error) {
+        return finish(errorResponse(error, context.requestId), context);
+    }
+}
+//# sourceMappingURL=contracts.js.map

package/dist/framework-server/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../src/framework-server/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,oBAAoB,EAAuB,MAAM,eAAe,CAAC;AAe1E,MAAM,OAAO,QAAS,SAAQ,KAAK;IACL,IAAI;IAA0B,MAAM;IAAhE,YAA4B,IAAY,EAAkB,MAAc,EAAE,OAAO,GAAG,IAAI;QACtF,KAAK,CAAC,OAAO,CAAC,CAAC;oBADW,IAAI;sBAA0B,MAAM;IAEhE,CAAC;CACF;AAaD,MAAM,UAAU,cAAc,CAAsL,UAA6C;IAC/P,OAAO,UAAU,CAAC;AACpB,CAAC;AAUD,MAAM,UAAU,SAAS,CAAkD,UAAkC;IAC3G,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAmB,MAAS,EAAE,KAAc,EAAE,KAAa;IAChF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,QAAQ,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,QAAQ,CAAC,WAAW,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtJ,OAAQ,MAA+B,CAAC,KAAK,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAAgB,EAAE,QAAQ,GAAG,IAAI,GAAG,IAAI;IAC9D,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC1I,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM;YACrB,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAChC,IAAI,MAAM,GAAG,QAAQ;gBAAE,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC;IAAC,CAAC;IACzF,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAY,CAAC;IAAC,CAAC;IAC9F,MAAM,CAAC;QAAC,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAAC,CAAC;AACpD,CAAC;AAED,SAAS,WAAW,CAAC,GAAQ;IAC3B,MAAM,MAAM,GAAsC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,KAAK,CAAI,UAAsH,EAAE,OAA0B,EAAE,QAAwB,EAAE,QAAkB;IACtN,QAAQ,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3E,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAC3G,IAAI,UAAU,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AAC3G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAA4H,UAA6C,EAAE,OAA0B,EAAE,QAAwB,EAAE,SAAS,GAAY,EAAE;IAC3R,MAAM,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtG,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClI,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAA2B,EAAE,KAAK,EAAE,KAA0B,EAAE,IAAI,EAAE,IAAyB,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9J,IAAI,UAAU,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,MAAM,YAAY,QAAQ,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC/E,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ;QAAE,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACvE,OAAO,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,EAAE,CAAC,CAAC;AACjH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAwC,UAAkC,EAAE,QAAiB,EAAE,OAA0B,EAAE,QAAwB;IACjL,MAAM,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,SAAiB;IAC7D,MAAM,KAAK,GAAG,KAAK,YAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,oBAAoB,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC9J,OAAO,IAAI,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AACjN,CAAC;AAED,SAAS,MAAM,CAAC,QAAkB,EAAE,OAAuB;IACzD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,OAAO,CAAC,YAAY;QAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACtG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO;QAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3G,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAA4H,UAA6C,EAAE,OAA0B,EAAE,QAAwB,EAAE,MAAM,GAAY,EAAE;IACzR,IAAI,CAAC;QAAC,OAAO,MAAM,CAAC,MAAM,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IAAC,CAAC;IAC7F,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;IAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAwC,UAAkC,EAAE,OAA0B,EAAE,QAAwB;IAC/J,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChG,OAAO,MAAM,CAAC,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAClI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;IAAC,CAAC;AACtF,CAAC","sourcesContent":["import { serializeJson } from \"../server.js\";\nimport type { RequestContext } from \"./context.js\";\nimport { SessionSecurityError, type SessionManager } from \"./sessions.js\";\n\n/** Valibot schemas implement this public Standard Schema contract. */\nexport interface Schema<I = unknown, O = I> {\n  readonly \"~standard\": {\n    readonly version: 1;\n    readonly validate: (value: unknown) => { value: O; issues?: undefined } | { issues: readonly unknown[] } | Promise<{ value: O; issues?: undefined } | { issues: readonly unknown[] }>;\n    readonly types?: { readonly input: I; readonly output: O } | undefined;\n  };\n}\n\ntype Input<S> = S extends Schema<infer I, unknown> ? I : never;\ntype Output<S> = S extends Schema<unknown, infer O> ? O : never;\ntype OptionalOutput<S> = S extends Schema ? Output<S> : undefined;\n\nexport class ApiError extends Error {\n  constructor(public readonly code: string, public readonly status: number, message = code) {\n    super(message);\n  }\n}\n\nexport interface ApiRouteDefinition<P extends Schema | undefined, Q extends Schema | undefined, B extends Schema | undefined, R extends Schema | undefined, S = unknown> {\n  params?: P;\n  query?: Q;\n  body?: B;\n  response?: R;\n  auth?: \"required\" | \"optional\";\n  contentType?: \"json\" | \"response\";\n  authorize?: (context: RequestContext<S>) => boolean | Promise<boolean>;\n  handler: (args: { params: OptionalOutput<P>; query: OptionalOutput<Q>; body: OptionalOutput<B>; context: RequestContext<S> }) => Promise<R extends Schema ? Output<R> : Response> | (R extends Schema ? Output<R> : Response);\n}\n\nexport function defineApiRoute<P extends Schema | undefined = undefined, Q extends Schema | undefined = undefined, B extends Schema | undefined = undefined, R extends Schema | undefined = undefined, S = unknown>(definition: ApiRouteDefinition<P, Q, B, R, S>): ApiRouteDefinition<P, Q, B, R, S> {\n  return definition;\n}\n\nexport interface RpcDefinition<I extends Schema, O extends Schema, S = unknown> {\n  input: I;\n  output: O;\n  auth?: \"required\" | \"optional\";\n  authorize?: (context: RequestContext<S>) => boolean | Promise<boolean>;\n  handler: (args: { input: Output<I>; context: RequestContext<S> }) => Promise<Input<O> | Output<O>> | Input<O> | Output<O>;\n}\n\nexport function defineRpc<I extends Schema, O extends Schema, S = unknown>(definition: RpcDefinition<I, O, S>): RpcDefinition<I, O, S> {\n  return definition;\n}\n\nasync function validate<S extends Schema>(schema: S, value: unknown, label: string): Promise<Output<S>> {\n  const result = await schema[\"~standard\"].validate(value);\n  if (\"issues\" in result && result.issues) throw new ApiError(`INVALID_${label.toUpperCase()}`, label === \"response\" || label === \"output\" ? 500 : 400);\n  return (result as { value: Output<S> }).value;\n}\n\nasync function readJson(request: Request, maxBytes = 1024 * 1024): Promise<unknown> {\n  if (!request.headers.get(\"content-type\")?.toLowerCase().startsWith(\"application/json\")) throw new ApiError(\"UNSUPPORTED_MEDIA_TYPE\", 415);\n  const reader = request.body?.getReader();\n  if (!reader) throw new ApiError(\"INVALID_JSON\", 400);\n  let length = 0;\n  const chunks: Uint8Array[] = [];\n  try {\n    while (true) {\n      const next = await reader.read();\n      if (next.done) break;\n      length += next.value.byteLength;\n      if (length > maxBytes) throw new ApiError(\"BODY_TOO_LARGE\", 413);\n      chunks.push(next.value);\n    }\n  } finally { reader.releaseLock(); }\n  const bytes = new Uint8Array(length);\n  let position = 0;\n  for (const chunk of chunks) { bytes.set(chunk, position); position += chunk.byteLength; }\n  try { return JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes)) as unknown; }\n  catch { throw new ApiError(\"INVALID_JSON\", 400); }\n}\n\nfunction queryObject(url: URL): Record<string, string | string[]> {\n  const result: Record<string, string | string[]> = Object.create(null);\n  for (const [key, value] of url.searchParams) {\n    const previous = result[key];\n    result[key] = previous === undefined ? value : Array.isArray(previous) ? [...previous, value] : [previous, value];\n  }\n  return result;\n}\n\nasync function guard<S>(definition: { auth?: \"required\" | \"optional\"; authorize?: (context: RequestContext<S>) => boolean | Promise<boolean> }, context: RequestContext<S>, sessions: SessionManager, mutating?: boolean): Promise<void> {\n  sessions.assertMutationAllowed(context.request, context.session, mutating);\n  if (definition.auth === \"required\" && !context.session.current) throw new ApiError(\"UNAUTHENTICATED\", 401);\n  if (definition.authorize && !(await definition.authorize(context))) throw new ApiError(\"FORBIDDEN\", 403);\n}\n\nexport async function executeApiRoute<P extends Schema | undefined, Q extends Schema | undefined, B extends Schema | undefined, R extends Schema | undefined, S>(definition: ApiRouteDefinition<P, Q, B, R, S>, context: RequestContext<S>, sessions: SessionManager, rawParams: unknown = {}): Promise<Response> {\n  await guard(definition, context, sessions);\n  const params = definition.params ? await validate(definition.params, rawParams, \"params\") : undefined;\n  const query = definition.query ? await validate(definition.query, queryObject(new URL(context.request.url)), \"query\") : undefined;\n  const body = definition.body ? await validate(definition.body, await readJson(context.request), \"body\") : undefined;\n  const result = await definition.handler({ params: params as OptionalOutput<P>, query: query as OptionalOutput<Q>, body: body as OptionalOutput<B>, context });\n  if (definition.contentType === \"response\") {\n    if (!(result instanceof Response)) throw new ApiError(\"INVALID_RESPONSE\", 500);\n    return result;\n  }\n  if (!definition.response) throw new ApiError(\"MISSING_RESPONSE_SCHEMA\", 500);\n  const output = await validate(definition.response, result, \"response\");\n  return new Response(serializeJson(output), { headers: { \"content-type\": \"application/json; charset=utf-8\" } });\n}\n\nexport async function executeRpc<I extends Schema, O extends Schema, S>(definition: RpcDefinition<I, O, S>, rawInput: unknown, context: RequestContext<S>, sessions: SessionManager): Promise<Output<O>> {\n  await guard(definition, context, sessions, true);\n  const input = await validate(definition.input, rawInput, \"input\");\n  const result = await definition.handler({ input, context });\n  const output = await validate(definition.output, result, \"output\");\n  serializeJson(output);\n  return output;\n}\n\nexport function errorResponse(error: unknown, requestId: string): Response {\n  const known = error instanceof ApiError ? error : error instanceof SessionSecurityError ? new ApiError(error.code, 403) : new ApiError(\"INTERNAL_ERROR\", 500);\n  return new Response(serializeJson({ code: known.code, status: known.status, requestId }), { status: known.status, headers: { \"content-type\": \"application/json; charset=utf-8\", \"x-request-id\": requestId } });\n}\n\nfunction finish(response: Response, context: RequestContext): Response {\n  response.headers.set(\"x-request-id\", context.requestId);\n  if (context.session.cookieHeader) response.headers.append(\"set-cookie\", context.session.cookieHeader);\n  if (context.session.current) response.headers.set(\"x-meeko-csrf-token\", context.session.current.csrfToken);\n  return response;\n}\n\nexport async function dispatchApiRoute<P extends Schema | undefined, Q extends Schema | undefined, B extends Schema | undefined, R extends Schema | undefined, S>(definition: ApiRouteDefinition<P, Q, B, R, S>, context: RequestContext<S>, sessions: SessionManager, params: unknown = {}): Promise<Response> {\n  try { return finish(await executeApiRoute(definition, context, sessions, params), context); }\n  catch (error) { return finish(errorResponse(error, context.requestId), context); }\n}\n\nexport async function dispatchRpc<I extends Schema, O extends Schema, S>(definition: RpcDefinition<I, O, S>, context: RequestContext<S>, sessions: SessionManager): Promise<Response> {\n  try {\n    if (context.request.method !== \"POST\") throw new ApiError(\"METHOD_NOT_ALLOWED\", 405);\n    const output = await executeRpc(definition, await readJson(context.request), context, sessions);\n    return finish(new Response(serializeJson(output), { headers: { \"content-type\": \"application/json; charset=utf-8\" } }), context);\n  } catch (error) { return finish(errorResponse(error, context.requestId), context); }\n}\n"]}

package/dist/framework-server/discovery.d.ts

@@ -0,0 +1,40 @@
+import type { ServerFetch } from "./context.js";
+import type { SessionManager } from "./sessions.js";
+export type ApiMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+export interface ApiEndpoint {
+    readonly kind: "api";
+    readonly file: string;
+    readonly pathname: string;
+    readonly method: ApiMethod;
+    readonly clientKey: string;
+}
+export interface RpcEndpoint {
+    readonly kind: "rpc";
+    readonly file: string;
+    readonly pathname: string;
+    readonly id: string;
+}
+export interface SocketEndpoint {
+    readonly kind: "socket";
+    readonly file: string;
+    readonly name: string;
+    readonly pathname: string;
+}
+export interface ServerManifest {
+    readonly api: readonly ApiEndpoint[];
+    readonly rpc: readonly RpcEndpoint[];
+    readonly socket?: readonly SocketEndpoint[];
+}
+/** Static discovery is shared by development and production; no handler is executed here. */
+export declare function discoverServerManifest(projectRoot: string): Promise<ServerManifest>;
+/** Loads server-only channel definitions; callers pass the result to createSocketHub. */
+export declare function loadSocketChannels(manifest: Pick<ServerManifest, "socket">, load?: (file: string) => Promise<unknown>): Promise<Readonly<Record<string, unknown>>>;
+export interface ServerDispatcherOptions<S = unknown> {
+    manifest: ServerManifest;
+    sessions: SessionManager;
+    services: S | ((request: Request) => S | Promise<S>);
+    load?: (file: string) => Promise<unknown>;
+}
+export declare function createServerDispatcher<S>(options: ServerDispatcherOptions<S>): (request: Request) => Promise<Response>;
+/** SSR dispatch reuses the original session, services, state and request ID. */
+export declare function createLocalServerFetch<S>(options: Pick<ServerDispatcherOptions<S>, "manifest" | "sessions" | "load">): ServerFetch;

package/dist/framework-server/discovery.js

@@ -0,0 +1,252 @@
+import { readdir } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { join, relative, resolve, sep } from "node:path";
+import { pathToFileURL } from "node:url";
+import { createRequestContext } from "./context.js";
+import { ApiError, dispatchApiRoute, dispatchRpc, errorResponse } from "./contracts.js";
+function parts(pathname) {
+    return pathname.split("/").filter(Boolean).map((part, index, all) => {
+        if (/^\[\.\.\.[A-Za-z_$][\w$]*\]$/.test(part)) {
+            if (index !== all.length - 1)
+                throw new Error(`Catch-all must be last: ${pathname}`);
+            return { kind: "rest", value: part.slice(4, -1) };
+        }
+        if (/^\[[A-Za-z_$][\w$]*\]$/.test(part))
+            return { kind: "param", value: part.slice(1, -1) };
+        if (!/^[A-Za-z0-9_-]+$/.test(part))
+            throw new Error(`Invalid server route segment: ${part}`);
+        return { kind: "static", value: part };
+    });
+}
+function collisionKey(pathname) {
+    return parts(pathname).map((part) => part.kind === "static" ? part.value : part.kind === "param" ? "[]" : "[...]").join("/");
+}
+function clientKey(pathname) {
+    return parts(pathname).map((part) => part.kind === "static" ? part.value : part.kind === "param" ? `by${part.value[0].toUpperCase()}${part.value.slice(1)}` : `by${part.value[0].toUpperCase()}${part.value.slice(1)}`).join(".");
+}
+async function files(directory) {
+    let entries;
+    try {
+        entries = await readdir(directory, { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+    const found = [];
+    for (const entry of entries) {
+        if (entry.name.startsWith(".") || entry.name === "node_modules")
+            continue;
+        const file = join(directory, entry.name);
+        if (entry.isDirectory())
+            found.push(...await files(file));
+        else if (entry.isFile() && /\.(?:ts|js|mts|mjs)$/.test(entry.name) && !/\.(?:test|spec|d)\.(?:ts|js|mts|mjs)$/.test(entry.name))
+            found.push(file);
+    }
+    return found.sort();
+}
+function rel(root, file) {
+    return relative(root, file).split(sep).join("/").replace(/\.(?:ts|js|mts|mjs)$/, "");
+}
+function apiEndpoint(directory, file) {
+    const path = rel(directory, file);
+    const match = /^(.*)\.(get|post|put|patch|delete)$/.exec(path);
+    if (!match)
+        throw new Error(`API handler requires a method suffix: ${file}`);
+    const route = match[1].split("/");
+    if (route.at(-1) === "index")
+        route.pop();
+    const pathname = `/api${route.length ? `/${route.join("/")}` : ""}`;
+    parts(pathname);
+    return { kind: "api", file, pathname, method: match[2].toUpperCase(), clientKey: clientKey(pathname.slice(4)) };
+}
+function rpcEndpoint(directory, file) {
+    const path = rel(directory, file);
+    const route = path.split("/");
+    if (route.some((part) => !/^[A-Za-z_$][\w$]*$/.test(part)))
+        throw new Error(`Invalid RPC procedure name: ${file}`);
+    const id = route.join(".");
+    return { kind: "rpc", file, id, pathname: `/_meeko/rpc/${route.join("/")}` };
+}
+/** Static discovery is shared by development and production; no handler is executed here. */
+export async function discoverServerManifest(projectRoot) {
+    const root = resolve(projectRoot);
+    const apiRoot = join(root, "server", "api");
+    const rpcRoot = join(root, "server", "rpc");
+    const socketRoot = join(root, "server", "socket");
+    const api = (await files(apiRoot)).map((file) => apiEndpoint(apiRoot, file));
+    const rpc = (await files(rpcRoot)).map((file) => rpcEndpoint(rpcRoot, file));
+    const socket = (await files(socketRoot)).map((file) => {
+        const name = rel(socketRoot, file);
+        if (!/^[A-Za-z_$][\w$-]*$/.test(name))
+            throw new Error(`Invalid Socket channel name in ${file}; use a single named file`);
+        return { kind: "socket", file, name, pathname: `/_meeko/socket/${name}` };
+    });
+    const socketNames = new Map();
+    for (const endpoint of socket) {
+        const previous = socketNames.get(endpoint.name);
+        if (previous)
+            throw new Error(`Socket channel collision: ${previous} and ${endpoint.file} both resolve to ${endpoint.name}`);
+        socketNames.set(endpoint.name, endpoint.file);
+    }
+    const paths = new Map();
+    const keys = new Map();
+    for (const endpoint of api) {
+        const pathKey = `${endpoint.method} ${collisionKey(endpoint.pathname)}`;
+        const previous = paths.get(pathKey);
+        if (previous)
+            throw new Error(`API route collision: ${previous} and ${endpoint.file} both resolve to ${pathKey}`);
+        paths.set(pathKey, endpoint.file);
+        const key = `${endpoint.method} ${endpoint.clientKey}`;
+        const keyPrevious = keys.get(key);
+        if (keyPrevious)
+            throw new Error(`API client name collision: ${keyPrevious} and ${endpoint.file} both generate ${key}`);
+        keys.set(key, endpoint.file);
+    }
+    const ids = new Map();
+    for (const endpoint of rpc) {
+        const previous = ids.get(endpoint.id);
+        if (previous)
+            throw new Error(`RPC collision: ${previous} and ${endpoint.file} both resolve to ${endpoint.id}`);
+        ids.set(endpoint.id, endpoint.file);
+    }
+    return Object.freeze({ api: Object.freeze(api), rpc: Object.freeze(rpc), socket: Object.freeze(socket) });
+}
+/** Loads server-only channel definitions; callers pass the result to createSocketHub. */
+export async function loadSocketChannels(manifest, load = async (file) => import(pathToFileURL(file).href)) {
+    const channels = Object.create(null);
+    for (const endpoint of manifest.socket ?? []) {
+        const module = await load(endpoint.file);
+        if (!module || typeof module !== "object" || !("default" in module))
+            throw new Error(`${endpoint.file}: Socket channel requires a default export`);
+        channels[endpoint.name] = module.default;
+    }
+    return channels;
+}
+function decode(part) {
+    try {
+        const value = decodeURIComponent(part);
+        return value && value !== "." && value !== ".." && !value.includes("/") && !value.includes("\\") ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function match(pathname, pattern) {
+    const raw = pathname.split("/").filter(Boolean);
+    const path = raw.map(decode);
+    if (path.some((part) => part === undefined))
+        return undefined;
+    const patternParts = parts(pattern);
+    const params = Object.create(null);
+    let index = 0;
+    for (const part of patternParts) {
+        if (part.kind === "rest") {
+            if (index >= path.length)
+                return undefined;
+            params[part.value] = path.slice(index).join("/");
+            index = path.length;
+            break;
+        }
+        const value = path[index++];
+        if (value === undefined || (part.kind === "static" && part.value !== value))
+            return undefined;
+        if (part.kind === "param")
+            params[part.value] = value;
+    }
+    return index === path.length ? params : undefined;
+}
+function rank(endpoint) {
+    return parts(endpoint.pathname).map((part) => part.kind === "static" ? 3 : part.kind === "param" ? 2 : 1);
+}
+function compareApi(a, b) {
+    const left = rank(a);
+    const right = rank(b);
+    for (let index = 0; index < Math.max(left.length, right.length); index++) {
+        const score = (right[index] ?? 0) - (left[index] ?? 0);
+        if (score)
+            return score;
+    }
+    return a.pathname.localeCompare(b.pathname);
+}
+function exportedDefinition(module) {
+    if (module && typeof module === "object" && "default" in module)
+        return module.default;
+    throw new ApiError("INVALID_HANDLER", 500);
+}
+/** Dispatches API and RPC through the same request context and security pipeline. */
+function requestDispatcher(options) {
+    const api = [...options.manifest.api].sort(compareApi);
+    const load = options.load ?? (async (file) => import(pathToFileURL(file).href));
+    return async (context) => {
+        const request = context.request;
+        try {
+            const pathname = new URL(request.url).pathname;
+            if (pathname.startsWith("/_meeko/rpc/")) {
+                const endpoint = options.manifest.rpc.find((record) => record.pathname === pathname);
+                if (!endpoint)
+                    throw new ApiError("NOT_FOUND", 404);
+                if (request.method !== "POST")
+                    throw new ApiError("METHOD_NOT_ALLOWED", 405);
+                const definition = exportedDefinition(await load(endpoint.file));
+                return dispatchRpc(definition, context, options.sessions);
+            }
+            let allowed = [];
+            for (const endpoint of api) {
+                const params = match(pathname, endpoint.pathname);
+                if (!params)
+                    continue;
+                if (request.method !== endpoint.method) {
+                    allowed.push(endpoint.method);
+                    continue;
+                }
+                const definition = exportedDefinition(await load(endpoint.file));
+                return dispatchApiRoute(definition, context, options.sessions, params);
+            }
+            if (allowed.length) {
+                const response = errorResponse(new ApiError("METHOD_NOT_ALLOWED", 405), context.requestId);
+                response.headers.set("allow", [...new Set(allowed)].join(", "));
+                return response;
+            }
+            throw new ApiError("NOT_FOUND", 404);
+        }
+        catch (error) {
+            return errorResponse(error, context.requestId);
+        }
+    };
+}
+export function createServerDispatcher(options) {
+    const dispatch = requestDispatcher(options);
+    return async (request) => {
+        let requestId = randomUUID();
+        try {
+            const session = await options.sessions.load(request);
+            const services = typeof options.services === "function" ? await options.services(request) : options.services;
+            const context = createRequestContext(request, services, session);
+            requestId = context.requestId;
+            return dispatch(context);
+        }
+        catch (error) {
+            return errorResponse(error, requestId);
+        }
+    };
+}
+/** SSR dispatch reuses the original session, services, state and request ID. */
+export function createLocalServerFetch(options) {
+    const dispatch = requestDispatcher(options);
+    return async (request, active) => {
+        const source = active.request;
+        if (new URL(request.url).origin !== new URL(source.url).origin) {
+            return errorResponse(new ApiError("INVALID_ORIGIN", 403), active.requestId);
+        }
+        for (const name of ["cookie", "authorization"]) {
+            if (request.headers.get(name) !== source.headers.get(name)) {
+                return errorResponse(new ApiError("INVALID_CREDENTIALS", 403), active.requestId);
+            }
+        }
+        const context = { ...active, request, signal: request.signal };
+        return dispatch(context);
+    };
+}
+//# sourceMappingURL=discovery.js.map