@plitzi/sdk-server 0.37.2 → 0.37.4

package/dist/core/handlers/authRouteHandlers.js

@@ -1,4 +1,6 @@
+import { serverLog } from "../../helpers/serverLog.js";
 import { applySessionOutcome, authRoutes } from "../auth/routes.js";
+import { isDocumentNavigation, renewForNavigation } from "../auth/renewal.js";
 //#region src/core/handlers/authRouteHandlers.ts
 /**
 * Built field by field rather than spread: on several frameworks `hostname` is a getter on the request prototype,
@@ -37,28 +39,62 @@ var carrier = (req) => ({
 * Which flows actually answer is decided by the adapters, not here — no `createAccount`, no signup, and the route
 * reports 404 rather than failing at runtime. Mounting all of them is correct for a deployment that offers three.
 */
-var createAuthRouteHandlers = ({ api, cookies, csrf, onError }) => authRoutes({
-	api,
-	cookies,
-	csrf
-}).map(({ method, path, handler }) => ({
-	method,
-	path,
-	handle: async (req, res) => {
-		try {
-			const outcome = await handler(carrier(req));
-			applySessionOutcome(req, res, outcome, cookies, csrf);
-			res.status(outcome.ok ? outcome.status ?? 200 : outcome.status).json(outcome.body);
-		} catch (error) {
-			if (onError) onError(error, {
-				method,
-				path
-			});
-			else console.error(`[auth] ${method} ${path} failed:`, error);
-			res.status(500).json({ error: "Internal server error" });
+var createAuthRouteHandlers = ({ api, cookies, csrf, onError }) => {
+	const failed = (error, method, path, res) => {
+		if (onError) onError(error, {
+			method,
+			path
+		});
+		else serverLog.error("auth", `${method} ${path} failed`, error);
+		res.status(500).json({ error: "Internal server error" });
+	};
+	const flows = authRoutes({
+		api,
+		cookies,
+		csrf
+	}).map(({ method, path, handler }) => ({
+		method,
+		path,
+		handle: async (req, res) => {
+			try {
+				const outcome = await handler(carrier(req));
+				applySessionOutcome(req, res, outcome, cookies, csrf);
+				res.status(outcome.ok ? outcome.status ?? 200 : outcome.status).json(outcome.body);
+			} catch (error) {
+				failed(error, method, path, res);
+			}
 		}
-	}
-}));
+	}));
+	/**
+	* Renewal on the way to a page — see `renewForNavigation`. Answered with a status and a `Location` rather than a
+	* framework's `redirect`, so the set keeps asking a response for nothing beyond a status and a body; the body says
+	* the same thing, for whoever reads it. Anything but a whole-tab navigation is told to renew the usual way.
+	*/
+	const renewal = {
+		method: "GET",
+		path: "/refresh",
+		handle: async (req, res) => {
+			if (!isDocumentNavigation(req.headers)) {
+				res.setHeader("Allow", "POST");
+				res.status(405).json({ error: "Renew with POST" });
+				return;
+			}
+			try {
+				const location = await renewForNavigation(carrier(req), res, {
+					api,
+					cookies,
+					csrf
+				});
+				res.setHeader("Cache-Control", "no-store");
+				res.setHeader("Location", location);
+				res.status(303).json({ redirect: location });
+			} catch (error) {
+				failed(error, "GET", "/refresh", res);
+			}
+		}
+	};
+	return [...flows, renewal];
+};
 /**
 * {@link createAuthRouteHandlers}, hung on anything with `get` and `post`.
 *

package/dist/core/handlers/csrfMiddleware.d.ts

@@ -18,3 +18,26 @@ export interface CsrfMiddlewareOptions {
  * rather than a cookie, and it will never carry a token. Exempt it by path.
  */
 export declare const createCsrfMiddleware: (csrf: Csrf, cookies: SessionCookies, { exempt, errorKey }?: CsrfMiddlewareOptions) => (req: AuthedRequest, res: JsonResponse, next: () => void) => void;
+export interface OriginGuardOptions {
+    /**
+     * Origins this request may also come from, beyond the deployment's own — the ones the space credential it carries
+     * declares. `true` for a credential that declares any origin at all.
+     */
+    allowedFor?: (req: AuthedRequest) => readonly string[] | true | undefined;
+    /** Paths never guarded. A webhook carries no session cookie and is never refused anyway; this is for the rest. */
+    exempt?: (path: string) => boolean;
+    errorKey?: 'message' | 'error';
+}
+/**
+ * Cross-site request forgery refused by ORIGIN, for a router whose cookie-carried writes do not all send a token.
+ *
+ * A write is refused when a session COOKIE could have authenticated it (an unsafe method, no `Authorization`, the
+ * cookie present) and a browser says another site caused it — Fetch Metadata first, `Origin` exactly otherwise (see
+ * `Csrf.crossSite`). The deployment's own origins pass, and so do the ones a space credential on the request declares:
+ * a published site calling its own space is not forging anything. A client that is not a browser sends neither header
+ * and passes, as does anything with a bearer — neither has a victim's cookie to borrow.
+ *
+ * This is the guard OWASP calls Fetch Metadata / origin verification. It is what a token is for, without a token: the
+ * difference is only which clients can satisfy it, and every legitimate one here already does.
+ */
+export declare const createOriginGuardMiddleware: (csrf: Csrf, { allowedFor, exempt, errorKey }?: OriginGuardOptions) => (req: AuthedRequest, res: JsonResponse, next: () => void) => void;

package/dist/core/handlers/csrfMiddleware.js

@@ -1,4 +1,4 @@
-import { csrfFailureMessage } from "../auth/csrf.js";
+import { carrierOf, csrfFailureMessage } from "../auth/csrf.js";
 //#region src/core/handlers/csrfMiddleware.ts
 /**
 * The CSRF check as middleware, for a deployment with a router.
@@ -11,14 +11,11 @@ import { csrfFailureMessage } from "../auth/csrf.js";
 * rather than a cookie, and it will never carry a token. Exempt it by path.
 */
 var createCsrfMiddleware = (csrf, cookies, { exempt, errorKey = "message" } = {}) => (req, res, next) => {
-	if (exempt?.(req.path) || !csrf.required({
-		...req,
-		method: req.method
-	})) {
+	if (exempt?.(req.path) || !csrf.required(carrierOf(req))) {
 		next();
 		return;
 	}
-	const result = csrf.verify(req, cookies.resolveSessionToken(req));
+	const result = csrf.verify(carrierOf(req), cookies.resolveSessionToken(req));
 	if (result.ok) {
 		next();
 		return;
@@ -28,5 +25,32 @@ var createCsrfMiddleware = (csrf, cookies, { exempt, errorKey = "message" } = {}
 		reason: result.reason
 	});
 };
+/**
+* Cross-site request forgery refused by ORIGIN, for a router whose cookie-carried writes do not all send a token.
+*
+* A write is refused when a session COOKIE could have authenticated it (an unsafe method, no `Authorization`, the
+* cookie present) and a browser says another site caused it — Fetch Metadata first, `Origin` exactly otherwise (see
+* `Csrf.crossSite`). The deployment's own origins pass, and so do the ones a space credential on the request declares:
+* a published site calling its own space is not forging anything. A client that is not a browser sends neither header
+* and passes, as does anything with a bearer — neither has a victim's cookie to borrow.
+*
+* This is the guard OWASP calls Fetch Metadata / origin verification. It is what a token is for, without a token: the
+* difference is only which clients can satisfy it, and every legitimate one here already does.
+*/
+var createOriginGuardMiddleware = (csrf, { allowedFor, exempt, errorKey = "message" } = {}) => (req, res, next) => {
+	if (exempt?.(req.path) || !csrf.required(carrierOf(req))) {
+		next();
+		return;
+	}
+	const allowed = allowedFor?.(req);
+	if (allowed === true || !csrf.crossSite(carrierOf(req), allowed ?? [])) {
+		next();
+		return;
+	}
+	res.status(403).json({
+		[errorKey]: csrfFailureMessage.foreign,
+		reason: "foreign"
+	});
+};
 //#endregion
-export { createCsrfMiddleware };
+export { createCsrfMiddleware, createOriginGuardMiddleware };

package/dist/core/handlers/csrfMiddleware.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/handlers/oauthRouteHandlers.js

@@ -1,7 +1,8 @@
+import { serverLog } from "../../helpers/serverLog.js";
 import { authorizationServerMetadata, protectedResourceMetadata } from "../oauth/metadata.js";
 import { sendErrorJson } from "../oauth/respond.js";
-import { handleAuthorizeStart, handleAuthorizeSubmit } from "../oauth/authorize.js";
 import { handleRegister } from "../oauth/register.js";
+import { handleAuthorizeStart, handleAuthorizeSubmit } from "../oauth/authorize.js";
 import { handleRevoke, handleToken } from "../oauth/token.js";
 //#region src/core/handlers/oauthRouteHandlers.ts
 /**
@@ -51,7 +52,8 @@ var asRequest = (req) => {
 		headers: req.headers,
 		hostname: req.hostname,
 		protocol: protocol === "http" ? "http" : "https",
-		query: req.query ?? {}
+		query: req.query ?? {},
+		...req.ip ? { ip: req.ip } : {}
 	};
 };
 /** Query first, body second: a field posted by the grant form wins over one the client left in the URL. */
@@ -79,7 +81,7 @@ var createOAuthRouteHandlers = ({ config, onError }) => {
 				method,
 				path
 			});
-			else console.error(`[oauth] ${method} ${path} failed:`, error);
+			else serverLog.error("oauth", `${method} ${path} failed`, error);
 			sendErrorJson(asHelpers(res), 500, "server_error", "The authorization server failed to answer.");
 		}
 	};

package/dist/core/handlers/socialRouteHandlers.d.ts

@@ -12,7 +12,7 @@ export interface SocialRouteHandlersOptions {
      * proves WHO, and what a session is worth is the kernel's answer, not the provider's.
      */
     issueSession: (userId: number) => Promise<SSRSession>;
-    /** Reports a callback that threw. Without it the failure goes to `console.error`; the caller still gets a 500. */
+    /** Reports a callback that threw. Without it the failure goes to the server log at `error`; the caller still gets a 500. */
     onError?: (error: unknown, context: {
         method: string;
         path: string;

package/dist/core/handlers/socialRouteHandlers.js

@@ -1,3 +1,4 @@
+import { serverLog } from "../../helpers/serverLog.js";
 //#region src/core/handlers/socialRouteHandlers.ts
 /**
 * A provider id from the request.
@@ -35,7 +36,7 @@ var createSocialAuthRouteHandlers = ({ social, cookies, issueSession, onError })
 			onError(error, context);
 			return;
 		}
-		console.error(`[auth] ${context.method} ${context.path} failed:`, error);
+		serverLog.error("auth", `${context.method} ${context.path} failed`, error);
 	};
 	return [
 		{

package/dist/core/http/dispatcher.d.ts

@@ -4,4 +4,12 @@ import { Handler } from '../transports';
 import { SSRRequest, SSRResponseHelpers, SSRServerConfig } from '@plitzi/sdk-shared';
 import { IncomingMessage } from 'node:http';
 export type BuildContext<C extends BaseContext> = (raw: IncomingMessage, rawRes: RawResponse, req: SSRRequest, res: SSRResponseHelpers) => Omit<C, 'signal'>;
-export declare const makeHandler: <C extends BaseContext>(label: string, buildContext: BuildContext<C>, stages: Stage<C>[], compressionConfig?: SSRServerConfig["compression"]) => Handler;
+export type HandlerOptions = {
+    compression?: SSRServerConfig['compression'];
+    /**
+     * The paths that may switch protocols. An upgrade anywhere else is refused before the pipeline runs: a WebSocket
+     * opened on a page's address would otherwise render the page — and count a visit — to answer a socket.
+     */
+    upgrades?: (path: string) => boolean;
+};
+export declare const makeHandler: <C extends BaseContext>(label: string, buildContext: BuildContext<C>, stages: Stage<C>[], { compression: compressionConfig, upgrades }?: HandlerOptions) => Handler;

package/dist/core/http/dispatcher.js

@@ -1,5 +1,7 @@
+import { isLogged, serverLog } from "../../helpers/serverLog.js";
 import { clientIp, parseRequest } from "../requestParser.js";
 import { applySecurityHeaders } from "./securityHeaders.js";
+import { socketResponse } from "./socketResponse.js";
 import { resolveCompression } from "../../helpers/compress.js";
 import { buildResponseHelpers } from "../../helpers/buildResponseHelpers.js";
 //#region src/core/http/dispatcher.ts
@@ -11,7 +13,7 @@ var safePath = (url) => {
 };
 var errorText = (error) => error instanceof Error ? error.message : String(error);
 var statusOf = (rawRes, res) => rawRes.headersSent ? rawRes.statusCode : res.status;
-var runPipeline = async (raw, rawRes, buildContext, stages, server, compression) => {
+var runPipeline = async (raw, rawRes, buildContext, stages, server, compression, upgrade) => {
 	const startedAt = Date.now();
 	const req = parseRequest(raw);
 	const res = buildResponseHelpers(rawRes, req.headers["accept-encoding"], compression);
@@ -33,13 +35,16 @@ var runPipeline = async (raw, rawRes, buildContext, stages, server, compression)
 	});
 	const ctx = {
 		...buildContext(raw, rawRes, req, res),
-		signal: controller.signal
+		signal: controller.signal,
+		...upgrade ? { upgrade } : {}
 	};
 	const logger = ctx.config.logger;
 	const ip = logger ? clientIp(raw, req) : "";
 	const logRequest = (error) => {
 		if (!logger) return;
 		const status = statusOf(rawRes, res);
+		const failed = !!error || status >= 500;
+		if (!isLogged(ctx.config.logLevel ?? "error", failed ? "error" : "info")) return;
 		logger({
 			kind: "request",
 			server,
@@ -72,17 +77,39 @@ var runPipeline = async (raw, rawRes, buildContext, stages, server, compression)
 		throw error;
 	}
 };
-var makeHandler = (label, buildContext, stages, compressionConfig) => {
+var pathOf = (url) => (url ?? "/").split("?")[0];
+var makeHandler = (label, buildContext, stages, { compression: compressionConfig, upgrades } = {}) => {
 	const compression = resolveCompression(compressionConfig);
-	return (raw, rawRes) => {
-		runPipeline(raw, rawRes, buildContext, stages, label, compression).catch((err) => {
-			console.error(`[${label}] Unhandled error:`, err);
-			try {
-				if (!rawRes.headersSent) rawRes.writeHead(500, { "Content-Type": "text/plain" });
-				rawRes.end("Internal Server Error");
-			} catch {}
-		});
+	const fail = (rawRes) => (err) => {
+		serverLog.error(label, "Unhandled error", err);
+		try {
+			if (!rawRes.headersSent) rawRes.writeHead(500, { "Content-Type": "text/plain" });
+			rawRes.end("Internal Server Error");
+		} catch {}
+	};
+	const handler = (raw, rawRes) => {
+		runPipeline(raw, rawRes, buildContext, stages, label, compression).catch(fail(rawRes));
+	};
+	if (upgrades) handler.upgrade = (raw, socket, head) => {
+		const rawRes = socketResponse(socket);
+		if (!upgrades(pathOf(raw.url))) {
+			rawRes.writeHead(404, { "Content-Type": "text/plain" });
+			rawRes.end("Not Found");
+			return;
+		}
+		const upgrade = {
+			socket,
+			head,
+			taken: false
+		};
+		runPipeline(raw, rawRes, buildContext, stages, label, compression, upgrade).then(() => {
+			if (!upgrade.taken && !rawRes.writableFinished) {
+				rawRes.writeHead(404, { "Content-Type": "text/plain" });
+				rawRes.end("Not Found");
+			}
+		}).catch(fail(rawRes));
 	};
+	return handler;
 };
 //#endregion
 export { makeHandler };

package/dist/core/http/navigation.d.ts

@@ -7,5 +7,8 @@ import { SSRRequest } from '@plitzi/sdk-shared';
  * thing, so a navigation is answered with a redirect and the view re-renders through a GET. A fetch wants the body.
  */
 export declare const isNavigation: (req: SSRRequest) => boolean;
-/** Same-origin only: absolute URLs and protocol-relative `//host` are refused, to avoid an open redirect. */
-export declare const safeRedirectTarget: (req: SSRRequest) => string;
+/**
+ * Same-origin only: absolute URLs and protocol-relative `//host` are refused, to avoid an open redirect — and so is
+ * `/\host`, which a browser reads as `//host`.
+ */
+export declare const safeRedirectTarget: (req: SSRRequest, param?: string) => string;

package/dist/core/http/navigation.js

@@ -7,10 +7,13 @@
 * thing, so a navigation is answered with a redirect and the view re-renders through a GET. A fetch wants the body.
 */
 var isNavigation = (req) => req.headers["sec-fetch-mode"] === "navigate";
-/** Same-origin only: absolute URLs and protocol-relative `//host` are refused, to avoid an open redirect. */
-var safeRedirectTarget = (req) => {
-	const redirectParam = req.query["redirect"];
-	return redirectParam && redirectParam.startsWith("/") && !redirectParam.startsWith("//") ? redirectParam : "/";
+/**
+* Same-origin only: absolute URLs and protocol-relative `//host` are refused, to avoid an open redirect — and so is
+* `/\host`, which a browser reads as `//host`.
+*/
+var safeRedirectTarget = (req, param = "redirect") => {
+	const target = req.query[param];
+	return target && target.startsWith("/") && !/^\/[\\/]/u.test(target) ? target : "/";
 };
 //#endregion
 export { isNavigation, safeRedirectTarget };

package/dist/core/http/socketResponse.d.ts

@@ -0,0 +1,18 @@
+import { RawResponse } from '../../helpers/buildResponseHelpers';
+import { Duplex } from 'node:stream';
+/** A request asking to switch protocols, as the transport handed it over: the raw socket, and what was read past the headers. */
+export type UpgradeRequest = {
+    socket: Duplex;
+    head: Buffer;
+    /** Set by the stage that switched protocols: from then on the socket is its connection, not an HTTP response. */
+    taken: boolean;
+};
+/**
+ * An HTTP response written straight to a socket — what an upgrade request gets when it is NOT upgraded.
+ *
+ * An upgrade arrives with no `ServerResponse`: node hands over the socket and expects whoever listens to speak for
+ * it. Every stage of the pipeline writes to a `RawResponse`, so this is one: a refusal (a 403, a 404, a redirect)
+ * reaches the client as the stage wrote it, and the socket closes after it — a connection that asked to switch
+ * protocols and was answered in HTTP has nothing left to say.
+ */
+export declare const socketResponse: (socket: Duplex) => RawResponse;

package/dist/core/http/socketResponse.js

@@ -0,0 +1,59 @@
+import { STATUS_CODES } from "node:http";
+//#region src/core/http/socketResponse.ts
+/**
+* An HTTP response written straight to a socket — what an upgrade request gets when it is NOT upgraded.
+*
+* An upgrade arrives with no `ServerResponse`: node hands over the socket and expects whoever listens to speak for
+* it. Every stage of the pipeline writes to a `RawResponse`, so this is one: a refusal (a 403, a 404, a redirect)
+* reaches the client as the stage wrote it, and the socket closes after it — a connection that asked to switch
+* protocols and was answered in HTTP has nothing left to say.
+*/
+var socketResponse = (socket) => {
+	const headers = {};
+	const body = [];
+	let statusCode = 200;
+	let headersSent = false;
+	let finished = false;
+	const flush = () => {
+		if (finished) return;
+		finished = true;
+		headersSent = true;
+		const payload = Buffer.concat(body);
+		const lines = Object.entries({
+			...headers,
+			Connection: "close",
+			"Content-Length": payload.length
+		}).flatMap(([name, value]) => (Array.isArray(value) ? value : [value]).map((entry) => `${name}: ${String(entry)}`));
+		const head = `HTTP/1.1 ${statusCode} ${STATUS_CODES[statusCode] ?? ""}\r\n${lines.join("\r\n")}\r\n\r\n`;
+		socket.end(Buffer.concat([Buffer.from(head), payload]));
+	};
+	return {
+		get headersSent() {
+			return headersSent;
+		},
+		get statusCode() {
+			return statusCode;
+		},
+		get writableFinished() {
+			return finished;
+		},
+		setHeader: (name, value) => {
+			headers[name] = value;
+		},
+		getHeaders: () => ({ ...headers }),
+		writeHead: (code, extra) => {
+			statusCode = code;
+			Object.assign(headers, extra);
+		},
+		write: (chunk) => {
+			body.push(Buffer.from(chunk));
+		},
+		end: (chunk) => {
+			if (chunk !== void 0) body.push(Buffer.from(chunk));
+			flush();
+		},
+		once: (_event, listener) => socket.once("close", listener)
+	};
+};
+//#endregion
+export { socketResponse };

package/dist/core/http/sse.d.ts

@@ -0,0 +1,26 @@
+import { RawResponse } from '../../helpers/buildResponseHelpers';
+export type EventStream = {
+    /** Sends one event. Silently drops once the socket is gone — writing into a closed peer is not an error. */
+    send: (event: string, data: unknown) => void;
+    /** Ends the stream and stops the heartbeat. */
+    close: () => void;
+    /** Whether the peer is still there. */
+    isOpen: () => boolean;
+};
+export type EventStreamOptions = {
+    /** Called once when the peer is found gone — a failed write, or a peer that stopped reading. */
+    onAbort: () => void;
+    /** Headers besides the ones every event stream sends. */
+    headers?: Record<string, string>;
+    /** What an `EventSource` should wait before reconnecting, in milliseconds. */
+    retryMs: number;
+};
+/**
+ * Opens a Server-Sent Events response — an action's progress, a realtime channel.
+ *
+ * Written straight to the RAW response, never through the response helpers: those compress the body, set a
+ * Content-Length and end it in one go, which is precisely what a stream cannot do. `no-transform` says the same
+ * thing to every proxy in between, and `X-Accel-Buffering: no` says it to nginx, which otherwise holds frames
+ * until its buffer fills and turns a live stream into one late burst.
+ */
+export declare const openEventStream: (raw: RawResponse, { onAbort, headers, retryMs }: EventStreamOptions) => EventStream;

package/dist/core/http/sse.js

@@ -0,0 +1,78 @@
+//#region src/core/http/sse.ts
+/** How often a comment frame goes out. Short enough that a dead peer is noticed in seconds, long enough that an
+*  idle stream costs nothing worth counting. */
+var HEARTBEAT_MS = 15e3;
+/**
+* How much unread body may pile up before the stream is dropped.
+*
+* A `write` that answers `false` has been buffered rather than sent, which is normal for a moment and a leak
+* forever: a peer that stopped reading — a phone that slept, a proxy that wedged — otherwise has everything sent to
+* it accumulated in memory. The socket says nothing, so the only signal is this one.
+*/
+var MAX_BUFFERED_BYTES = 1e6;
+/** What the host has written but not yet handed to the socket. Node's own response reports it; the minimum raw
+*  response this server accepts does not have to, and a host that cannot say simply never trips the cap. */
+var bufferedBytes = (raw) => {
+	const { writableLength } = raw;
+	return typeof writableLength === "number" ? writableLength : 0;
+};
+/**
+* Opens a Server-Sent Events response — an action's progress, a realtime channel.
+*
+* Written straight to the RAW response, never through the response helpers: those compress the body, set a
+* Content-Length and end it in one go, which is precisely what a stream cannot do. `no-transform` says the same
+* thing to every proxy in between, and `X-Accel-Buffering: no` says it to nginx, which otherwise holds frames
+* until its buffer fills and turns a live stream into one late burst.
+*/
+var openEventStream = (raw, { onAbort, headers = {}, retryMs }) => {
+	let open = true;
+	raw.writeHead(200, {
+		"Content-Type": "text/event-stream; charset=utf-8",
+		"Cache-Control": "no-cache, no-transform",
+		Connection: "keep-alive",
+		"X-Accel-Buffering": "no",
+		...headers
+	});
+	raw.write(`retry: ${retryMs}\n\n`);
+	const drop = () => {
+		open = false;
+		clearInterval(heartbeat);
+		onAbort();
+	};
+	const heartbeat = setInterval(() => {
+		if (!open) return;
+		try {
+			raw.write(": ping\n\n");
+		} catch {
+			drop();
+		}
+	}, HEARTBEAT_MS);
+	const close = () => {
+		if (!open) return;
+		open = false;
+		clearInterval(heartbeat);
+		try {
+			raw.end();
+		} catch {}
+	};
+	return {
+		send: (event, data) => {
+			if (!open) return;
+			try {
+				raw.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+				if (bufferedBytes(raw) > MAX_BUFFERED_BYTES) {
+					drop();
+					try {
+						raw.end();
+					} catch {}
+				}
+			} catch {
+				drop();
+			}
+		},
+		close,
+		isOpen: () => open
+	};
+};
+//#endregion
+export { openEventStream };

package/dist/core/http/stages/authRoutes.js

@@ -2,6 +2,7 @@ import { readRawBody } from "../../requestParser.js";
 import { isNavigation, safeRedirectTarget } from "../navigation.js";
 import { clearSessionCookies, writeSessionCookies } from "../../auth/session.js";
 import { exchangeStage } from "./exchangeRoute.js";
+import { signInStage } from "./signInRoute.js";
 //#region src/core/http/stages/authRoutes.ts
 /**
 * Credentials as they arrive from a page: a posted form, or JSON from a script. Every field is handed to the
@@ -64,7 +65,8 @@ var logoutStage = async (ctx) => {
 var authRoutesStages = [
 	loginStage,
 	logoutStage,
-	exchangeStage
+	exchangeStage,
+	signInStage
 ];
 //#endregion
 export { authRoutesStages, loginStage, logoutStage };

package/dist/core/http/stages/exchangeRoute.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/http/stages/middlewares.d.ts

@@ -1,2 +1,2 @@
 import { SSRContext, Stage } from '../types';
-export declare const middlewaresStage: Stage<SSRContext>;
+export declare const createMiddlewaresStage: () => Stage<SSRContext>;

package/dist/core/http/stages/middlewares.js

@@ -3,15 +3,21 @@ import { authMiddleware } from "../../../middlewares/auth.js";
 import { basicAuthMiddleware } from "../../../middlewares/basicAuth.js";
 import { spaceDeploymentMiddleware } from "../../../middlewares/spaceDeployment.js";
 //#region src/core/http/stages/middlewares.ts
-var middlewaresStage = async (ctx) => {
-	const { config, req, res } = ctx;
-	const middlewares = [
-		spaceDeploymentMiddleware(config.adapters),
-		basicAuthMiddleware({ cacheTtlMs: config.cacheTtlMs }),
-		authMiddleware(config.adapters),
-		...config.middlewares || []
-	];
-	return await runMiddlewares(middlewares, req, res) || res.status !== 200;
+var createMiddlewaresStage = () => {
+	let built;
+	return async (ctx) => {
+		const { config, req, res } = ctx;
+		if (built?.config !== config) built = {
+			config,
+			chain: [
+				spaceDeploymentMiddleware(config.adapters),
+				basicAuthMiddleware({ cacheTtlMs: config.cacheTtlMs }),
+				authMiddleware(config.adapters),
+				...config.middlewares || []
+			]
+		};
+		return await runMiddlewares(built.chain, req, res) || res.status !== 200;
+	};
 };
 //#endregion
-export { middlewaresStage };
+export { createMiddlewaresStage };

package/dist/core/http/stages/middlewares.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/http/stages/oauth.js

@@ -1,10 +1,10 @@
 import { readRawBody } from "../../requestParser.js";
-import { authorizationServerMetadata, protectedResourceMetadata } from "../../oauth/metadata.js";
 import { getAccess } from "../../oauth/records.js";
+import { authorizationServerMetadata, protectedResourceMetadata } from "../../oauth/metadata.js";
 import { sendErrorJson, sendJson } from "../../oauth/respond.js";
+import { handleRegister } from "../../oauth/register.js";
 import { handleAuthorizeStart, handleAuthorizeSubmit } from "../../oauth/authorize.js";
 import { bearerOf, sendChallenge } from "../../oauth/challenge.js";
-import { handleRegister } from "../../oauth/register.js";
 import { handleRevoke, handleToken } from "../../oauth/token.js";
 //#region src/core/http/stages/oauth.ts
 var matchesWellKnown = (path, wellKnown) => path === wellKnown || path.startsWith(`${wellKnown}/`);

package/dist/core/http/stages/sessionRenewal.d.ts

@@ -0,0 +1,16 @@
+import { Auth } from '../../auth/createAuth';
+import { BaseContext, Stage } from '../types';
+/**
+ * Sends a page request from a half-lapsed session to renew first — to `url`, the renewal endpoint — so the server
+ * renders the visitor the browser is going to end up with. See `renewForNavigation` for the other half.
+ *
+ * `url` is a path when this server serves `/auth` itself, and an absolute URL when another host does; the page's
+ * own address travels as `redirect` accordingly, and the endpoint only sends the browser back to a host that shares
+ * the session's cookies. Only whole-tab `GET` navigations take part: a renewal rotates the session.
+ */
+export declare const createSessionRenewalStage: (url: string) => Stage<BaseContext>;
+/**
+ * The renewal endpoint, on a page server that serves `/auth` itself: `GET <basePath>/refresh`. The `POST` flow at the
+ * same path is the auth API stage's; this one only ever answers a whole-tab navigation.
+ */
+export declare const createRenewalEndpointStage: (auth: Auth) => Stage<BaseContext>;