@query-farm/vgi-rpc 0.6.3 → 0.7.0

package/dist/constants.d.ts

@@ -9,9 +9,23 @@ export declare const SERVER_ID_KEY = "vgi_rpc.server_id";
 export declare const REQUEST_ID_KEY = "vgi_rpc.request_id";
 export declare const PROTOCOL_NAME_KEY = "vgi_rpc.protocol_name";
 export declare const DESCRIBE_VERSION_KEY = "vgi_rpc.describe_version";
-export declare const DESCRIBE_VERSION = "3";
+export declare const PROTOCOL_HASH_KEY = "vgi_rpc.protocol_hash";
+export declare const DESCRIBE_VERSION = "4";
+/** Application protocol surface version. Carried on every request batch from
+ *  a client bound to a Protocol that declares `protocolVersion`; also emitted
+ *  in the __describe__ response metadata. Format: canonical semver
+ *  MAJOR.MINOR.PATCH. Enforced at the dispatch boundary on the server: exact
+ *  major+minor match required, patch ignored. Distinct from `REQUEST_VERSION`
+ *  (wire framing). Mirrors Python's `PROTOCOL_VERSION_KEY`. */
+export declare const PROTOCOL_VERSION_KEY = "vgi_rpc.protocol_version";
 export declare const DESCRIBE_METHOD_NAME = "__describe__";
 export declare const STATE_KEY = "vgi_rpc.stream_state#b64";
+export declare const CANCEL_KEY = "vgi_rpc.cancel";
 export declare const LOCATION_KEY = "vgi_rpc.location";
 export declare const LOCATION_SHA256_KEY = "vgi_rpc.location.sha256";
+export declare const RPC_ERROR_HEADER = "X-VGI-RPC-Error";
+/** Top-level metadata key on an EXCEPTION batch identifying the error category.
+ *  Hoisted by `buildErrorBatch` when the thrown error has a static or instance
+ *  `errorKind` property. Mirrors Python's `vgi_rpc.metadata.ERROR_KIND_KEY`. */
+export declare const ERROR_KIND_KEY = "vgi_rpc.error_kind";
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAGA,6DAA6D;AAE7D,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAC/C,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD,eAAO,MAAM,eAAe,wBAAwB,CAAC;AACrD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD,eAAO,MAAM,mBAAmB,4BAA4B,CAAC;AAC7D,eAAO,MAAM,eAAe,MAAM,CAAC;AAEnC,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD,eAAO,MAAM,cAAc,uBAAuB,CAAC;AAEnD,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AACzD,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAC/D,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAEnD,eAAO,MAAM,SAAS,6BAA6B,CAAC;AAEpD,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAC/C,eAAO,MAAM,mBAAmB,4BAA4B,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAGA,6DAA6D;AAE7D,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAC/C,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD,eAAO,MAAM,eAAe,wBAAwB,CAAC;AACrD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD,eAAO,MAAM,mBAAmB,4BAA4B,CAAC;AAC7D,eAAO,MAAM,eAAe,MAAM,CAAC;AAEnC,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD,eAAO,MAAM,cAAc,uBAAuB,CAAC;AAEnD,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AACzD,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAC/D,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AACzD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC;;;;;+DAK+D;AAC/D,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAE/D,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAEnD,eAAO,MAAM,SAAS,6BAA6B,CAAC;AACpD,eAAO,MAAM,UAAU,mBAAmB,CAAC;AAE3C,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAC/C,eAAO,MAAM,mBAAmB,4BAA4B,CAAC;AAE7D,eAAO,MAAM,gBAAgB,oBAAoB,CAAC;AAElD;;gFAEgF;AAChF,eAAO,MAAM,cAAc,uBAAuB,CAAC"}

package/dist/crypto.d.ts

@@ -0,0 +1,22 @@
+/** Thrown by {@link openBytes} for any envelope it cannot open — malformed,
+ *  tampered, wrong key, wrong AAD, wrong version, truncated, all surface the
+ *  same way so callers cannot distinguish failure modes via error content. */
+export declare class SealError extends Error {
+    constructor(message: string);
+}
+/** Normalise a key to 32 bytes by SHA-256 hashing when it isn't already 32B.
+ *  Mirrors Python's `normalize_key` so any callers can pass operator-provided
+ *  keys of arbitrary length without a separate stretching step. */
+export declare function normalizeKey(key: Uint8Array): Promise<Uint8Array>;
+export interface SealOptions {
+    /** Associated data bound at the crypto layer — typically a principal or
+     *  request-scoped identifier. Must match between seal and open. */
+    aad: Uint8Array;
+    /** Envelope version byte. Defaults to 1; carry through to {@link openBytes}. */
+    version?: number;
+}
+/** Seal `plaintext` under `key` with AEAD, returning the wire envelope. */
+export declare function sealBytes(plaintext: Uint8Array, key: Uint8Array, opts: SealOptions): Uint8Array;
+/** Open and verify an envelope produced by {@link sealBytes}. */
+export declare function openBytes(envelope: Uint8Array, key: Uint8Array, opts: SealOptions): Uint8Array;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AA8BA;;8EAE8E;AAC9E,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED;;mEAEmE;AACnE,wBAAsB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAIvE;AAED,MAAM,WAAW,WAAW;IAC1B;uEACmE;IACnE,GAAG,EAAE,UAAU,CAAC;IAChB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAe/F;AAED,iEAAiE;AACjE,wBAAgB,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAkB9F"}

package/dist/dispatch/describe.d.ts

@@ -1,14 +1,18 @@
-import { RecordBatch, Schema } from "@query-farm/apache-arrow";
+import { type VgiBatch } from "../arrow/index.js";
 import type { MethodDefinition } from "../types.js";
 /**
- * The schema for the __describe__ response, matching Python's _DESCRIBE_SCHEMA.
+ * Slim DESCRIBE_VERSION 4 schema. Python-flavoured fields (doc,
+ * param_types_json, param_defaults_json, param_docs_json) are not on the
+ * wire — Arrow IPC schema bytes are the authoritative type information;
+ * everything else is source-level metadata that callers should consult the
+ * Protocol class for.
  */
-export declare const DESCRIBE_SCHEMA: Schema<any>;
+export declare const DESCRIBE_SCHEMA: import("../arrow/types.js").VgiSchema;
 /**
  * Build the __describe__ response batch and metadata.
  */
-export declare function buildDescribeBatch(protocolName: string, methods: Map<string, MethodDefinition>, serverId: string): {
-    batch: RecordBatch;
+export declare function buildDescribeBatch(protocolName: string, methods: Map<string, MethodDefinition>, serverId: string, protocolVersion?: string): Promise<{
+    batch: VgiBatch;
     metadata: Map<string, string>;
-};
+}>;
 //# sourceMappingURL=describe.d.ts.map

package/dist/dispatch/describe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe.d.ts","sourceRoot":"","sources":["../../src/dispatch/describe.ts"],"names":[],"mappings":"AAGA,OAAO,EAKL,WAAW,EACX,MAAM,EAIP,MAAM,0BAA0B,CAAC;AASlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD;;GAEG;AACH,eAAO,MAAM,eAAe,aAa1B,CAAC;AAEH;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACtC,QAAQ,EAAE,MAAM,GACf;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAgHvD"}
+{"version":3,"file":"describe.d.ts","sourceRoot":"","sources":["../../src/dispatch/describe.ts"],"names":[],"mappings":"AAGA,OAAO,EAOL,KAAK,QAAQ,EAEd,MAAM,mBAAmB,CAAC;AAW3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,uCAS1B,CAAC;AAkEH;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACtC,QAAQ,EAAE,MAAM,EAChB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CAoF7D"}

package/dist/dispatch/stream.d.ts

@@ -1,5 +1,5 @@
 import { type ExternalLocationConfig } from "../external.js";
-import type { MethodDefinition } from "../types.js";
+import type { MethodDefinition, TransportKind } from "../types.js";
 import type { IpcStreamReader } from "../wire/reader.js";
 import type { IpcStreamWriter } from "../wire/writer.js";
 /**
@@ -17,5 +17,5 @@ import type { IpcStreamWriter } from "../wire/writer.js";
  * - Server writes output batch(es) for each input
  * - Stream ends when client closes input (EOS)
  */
-export declare function dispatchStream(method: MethodDefinition, params: Record<string, any>, writer: IpcStreamWriter, reader: IpcStreamReader, serverId: string, requestId: string | null, externalConfig?: ExternalLocationConfig): Promise<void>;
+export declare function dispatchStream(method: MethodDefinition, params: Record<string, any>, writer: IpcStreamWriter, reader: IpcStreamReader, serverId: string, requestId: string | null, externalConfig?: ExternalLocationConfig, kind?: TransportKind): Promise<void>;
 //# sourceMappingURL=stream.d.ts.map

package/dist/dispatch/stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/dispatch/stream.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,sBAAsB,EAAyB,MAAM,gBAAgB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAIzD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,cAAc,CAAC,EAAE,sBAAsB,GACtC,OAAO,CAAC,IAAI,CAAC,CA8Hf"}
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/dispatch/stream.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,sBAAsB,EAAyB,MAAM,gBAAgB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAIzD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,cAAc,CAAC,EAAE,sBAAsB,EACvC,IAAI,CAAC,EAAE,aAAa,GACnB,OAAO,CAAC,IAAI,CAAC,CA0Jf"}

package/dist/dispatch/unary.d.ts

@@ -1,10 +1,10 @@
 import { type ExternalLocationConfig } from "../external.js";
-import type { MethodDefinition } from "../types.js";
+import type { MethodDefinition, TransportKind } from "../types.js";
 import type { IpcStreamWriter } from "../wire/writer.js";
 /**
  * Dispatch a unary RPC call.
  * Calls the handler with parsed params, writes result or error batch.
  * Supports client-directed logging via ctx.clientLog().
  */
-export declare function dispatchUnary(method: MethodDefinition, params: Record<string, any>, writer: IpcStreamWriter, serverId: string, requestId: string | null, externalConfig?: ExternalLocationConfig): Promise<void>;
+export declare function dispatchUnary(method: MethodDefinition, params: Record<string, any>, writer: IpcStreamWriter, serverId: string, requestId: string | null, externalConfig?: ExternalLocationConfig, kind?: TransportKind): Promise<void>;
 //# sourceMappingURL=unary.d.ts.map

package/dist/dispatch/unary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unary.d.ts","sourceRoot":"","sources":["../../src/dispatch/unary.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,sBAAsB,EAAyB,MAAM,gBAAgB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,cAAc,CAAC,EAAE,sBAAsB,GACtC,OAAO,CAAC,IAAI,CAAC,CAiBf"}
+{"version":3,"file":"unary.d.ts","sourceRoot":"","sources":["../../src/dispatch/unary.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,sBAAsB,EAAyB,MAAM,gBAAgB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,cAAc,CAAC,EAAE,sBAAsB,EACvC,IAAI,CAAC,EAAE,aAAa,GACnB,OAAO,CAAC,IAAI,CAAC,CAiBf"}

package/dist/errors.d.ts

@@ -9,4 +9,50 @@ export declare class RpcError extends Error {
 export declare class VersionError extends Error {
     constructor(message: string);
 }
+/** Well-known values for the `vgi_rpc.error_kind` batch metadata key. Mirrors
+ *  Python's `vgi_rpc.metadata.ERROR_KIND_*` constants. */
+export declare const ERROR_KIND_METHOD_NOT_IMPLEMENTED = "method_not_implemented";
+export declare const ERROR_KIND_SESSION_LOST = "session_lost";
+export declare const ERROR_KIND_SERVER_DRAINING = "server_draining";
+export declare const ERROR_KIND_PROTOCOL_VERSION_MISMATCH = "protocol_version_mismatch";
+/** Raised when the client's declared `vgi_rpc.protocol_version` is
+ *  incompatible with the server's. Subclass of `VersionError` so existing
+ *  catch sites continue to write a typed error stream and keep serving.
+ *  Carries a directional message that tells the reader which side to
+ *  upgrade. Mirrors Python's `vgi_rpc.rpc.ProtocolVersionError`. */
+export declare class ProtocolVersionError extends VersionError {
+    static readonly errorKind = "protocol_version_mismatch";
+    readonly errorKind = "protocol_version_mismatch";
+    constructor(message: string);
+}
+/** Parse a canonical semver string into `[major, minor, patch]`. Throws on
+ *  any input that isn't `MAJOR.MINOR.PATCH` with non-negative integers and
+ *  no leading zeros (except literal `0`). No prereleases, no build metadata.
+ *  Mirrors Python's `vgi_rpc.metadata.parse_version`. */
+export declare function parseProtocolVersion(value: string): [number, number, number];
+/** Raised when a client invokes a method the server does not implement.
+ *
+ *  Mirrors Python's `vgi_rpc.rpc.MethodNotImplementedError`. The static
+ *  `errorKind` is hoisted onto the error batch metadata as
+ *  `vgi_rpc.error_kind` so clients can branch on the typed marker without
+ *  string-matching the message.
+ */
+export declare class MethodNotImplementedError extends Error {
+    static readonly errorKind = "method_not_implemented";
+    readonly errorKind = "method_not_implemented";
+    constructor(message: string);
+}
+/** Raised when a sticky session token is malformed, expired, evicted, or
+ *  bound to a different worker / principal. HTTP-only. */
+export declare class SessionLostError extends Error {
+    static readonly errorKind = "session_lost";
+    readonly errorKind = "session_lost";
+    constructor(message: string);
+}
+/** Raised when `ctx.openSession` is called while the server is draining. */
+export declare class ServerDrainingError extends Error {
+    static readonly errorKind = "server_draining";
+    readonly errorKind = "server_draining";
+    constructor(message: string);
+}
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA,qEAAqE;AACrE,qBAAa,QAAS,SAAQ,KAAK;aAEf,SAAS,EAAE,MAAM;aACjB,YAAY,EAAE,MAAM;aACpB,eAAe,EAAE,MAAM;gBAFvB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM;CAK1C;AAED,yEAAyE;AACzE,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA,qEAAqE;AACrE,qBAAa,QAAS,SAAQ,KAAK;aAEf,SAAS,EAAE,MAAM;aACjB,YAAY,EAAE,MAAM;aACpB,eAAe,EAAE,MAAM;gBAFvB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM;CAK1C;AAED,yEAAyE;AACzE,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI5B;AAED;0DAC0D;AAC1D,eAAO,MAAM,iCAAiC,2BAA2B,CAAC;AAC1E,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AACtD,eAAO,MAAM,0BAA0B,oBAAoB,CAAC;AAC5D,eAAO,MAAM,oCAAoC,8BAA8B,CAAC;AAEhF;;;;oEAIoE;AACpE,qBAAa,oBAAqB,SAAQ,YAAY;IACpD,MAAM,CAAC,QAAQ,CAAC,SAAS,+BAAwC;IACjE,QAAQ,CAAC,SAAS,+BAAwC;gBAC9C,OAAO,EAAE,MAAM;CAI5B;AAID;;;yDAGyD;AACzD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAU5E;AAED;;;;;;GAMG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,MAAM,CAAC,QAAQ,CAAC,SAAS,4BAAqC;IAC9D,QAAQ,CAAC,SAAS,4BAAqC;gBAC3C,OAAO,EAAE,MAAM;CAI5B;AAED;0DAC0D;AAC1D,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,MAAM,CAAC,QAAQ,CAAC,SAAS,kBAA2B;IACpD,QAAQ,CAAC,SAAS,kBAA2B;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,4EAA4E;AAC5E,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,MAAM,CAAC,QAAQ,CAAC,SAAS,qBAA8B;IACvD,QAAQ,CAAC,SAAS,qBAA8B;gBACpC,OAAO,EAAE,MAAM;CAI5B"}

package/dist/external.d.ts

@@ -6,12 +6,32 @@
  * The batch is replaced with a zero-row "pointer batch" containing the
  * download URL and SHA-256 checksum in metadata.
  */
-import { type RecordBatch, type Schema } from "@query-farm/apache-arrow";
+import { type VgiBatch, type VgiSchema } from "./arrow/index.js";
 /** Pluggable storage backend for uploading large batches. */
 export interface ExternalStorage {
     /** Upload IPC data and return a URL for retrieval. */
     upload(data: Uint8Array, contentEncoding: string): Promise<string>;
 }
+/** A pre-signed PUT/GET URL pair for client-side data upload. */
+export interface UploadUrl {
+    /** Pre-signed PUT URL the client uploads to. */
+    uploadUrl: string;
+    /** Pre-signed GET URL the server fetches from. */
+    downloadUrl: string;
+    /** Expiration time (UTC) for the URL pair. */
+    expiresAt: Date;
+}
+/**
+ * Generates pre-signed upload URL pairs for client-vended externalization.
+ *
+ * Implementations must be safe to call from multiple concurrent requests.
+ * Object lifecycle is the operator's responsibility — uploaded objects are
+ * not automatically deleted by vgi-rpc.
+ */
+export interface UploadUrlProvider {
+    /** Allocate one upload/download URL pair. */
+    generateUploadUrl(): Promise<UploadUrl> | UploadUrl;
+}
 /** Configuration for external storage of large batches. */
 export interface ExternalLocationConfig {
     /** Storage backend for uploading. */
@@ -29,17 +49,17 @@ export interface ExternalLocationConfig {
 /** Default validator that rejects non-HTTPS URLs. */
 export declare function httpsOnlyValidator(url: string): void;
 /** Returns true if the batch is a zero-row pointer to external data. */
-export declare function isExternalLocationBatch(batch: RecordBatch): boolean;
+export declare function isExternalLocationBatch(batch: VgiBatch): boolean;
 /** Create a zero-row pointer batch with location URL and optional SHA-256. */
-export declare function makeExternalLocationBatch(schema: Schema, url: string, sha256?: string): RecordBatch;
+export declare function makeExternalLocationBatch(schema: VgiSchema, url: string, sha256?: string): VgiBatch;
 /**
  * Maybe externalize a batch if it exceeds the threshold.
  * Returns the original batch unchanged if below threshold or no config.
  */
-export declare function maybeExternalizeBatch(batch: RecordBatch, config?: ExternalLocationConfig | null): Promise<RecordBatch>;
+export declare function maybeExternalizeBatch(batch: VgiBatch, config?: ExternalLocationConfig | null): Promise<VgiBatch>;
 /**
  * Resolve an external pointer batch by fetching the data from the URL.
  * Returns the original batch unchanged if not a pointer or no config.
  */
-export declare function resolveExternalLocation(batch: RecordBatch, config?: ExternalLocationConfig | null): Promise<RecordBatch>;
+export declare function resolveExternalLocation(batch: VgiBatch, config?: ExternalLocationConfig | null): Promise<VgiBatch>;
 //# sourceMappingURL=external.d.ts.map

package/dist/external.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external.d.ts","sourceRoot":"","sources":["../src/external.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,WAAW,EAA8C,KAAK,MAAM,EAAE,MAAM,0BAA0B,CAAC;AASrH,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,sDAAsD;IACtD,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACpE;AAED,2DAA2D;AAC3D,MAAM,WAAW,sBAAsB;IACrC,qCAAqC;IACrC,OAAO,EAAE,eAAe,CAAC;IACzB,wEAAwE;IACxE,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,mDAAmD;IACnD,WAAW,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,kFAAkF;IAClF,YAAY,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;CAC/C;AAQD,qDAAqD;AACrD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAKpD;AAoBD,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAKnE;AAMD,8EAA8E;AAC9E,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,WAAW,CAOnG;AA4BD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,sBAAsB,GAAG,IAAI,GACrC,OAAO,CAAC,WAAW,CAAC,CAyBtB;AAMD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,sBAAsB,GAAG,IAAI,GACrC,OAAO,CAAC,WAAW,CAAC,CA4CtB"}
+{"version":3,"file":"external.d.ts","sourceRoot":"","sources":["../src/external.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AAEH,OAAO,EAAoC,KAAK,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AASnG,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,sDAAsD;IACtD,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACpE;AAED,iEAAiE;AACjE,MAAM,WAAW,SAAS;IACxB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,iBAAiB,IAAI,OAAO,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;CACrD;AAED,2DAA2D;AAC3D,MAAM,WAAW,sBAAsB;IACrC,qCAAqC;IACrC,OAAO,EAAE,eAAe,CAAC;IACzB,wEAAwE;IACxE,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,mDAAmD;IACnD,WAAW,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,kFAAkF;IAClF,YAAY,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;CAC/C;AAQD,qDAAqD;AACrD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAKpD;AAoBD,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAKhE;AAMD,8EAA8E;AAC9E,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAOnG;AAmBD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,QAAQ,EACf,MAAM,CAAC,EAAE,sBAAsB,GAAG,IAAI,GACrC,OAAO,CAAC,QAAQ,CAAC,CAyBnB;AAMD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,QAAQ,EACf,MAAM,CAAC,EAAE,sBAAsB,GAAG,IAAI,GACrC,OAAO,CAAC,QAAQ,CAAC,CA6CnB"}

package/dist/http/bearer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../src/http/bearer.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD,sGAAsG;AACtG,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAErF;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GAAG,cAAc,CAW1F;AAWD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACxE,GAAG,cAAc,CAYjB;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,cAAc,EAAE,cAAc,EAAE,GAAG,cAAc,CAsBrF"}
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../src/http/bearer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD,sGAAsG;AACtG,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAErF;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GAAG,cAAc,CAW1F;AAQD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACxE,GAAG,cAAc,CAYjB;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,cAAc,EAAE,cAAc,EAAE,GAAG,cAAc,CAsBrF"}

package/dist/http/common.d.ts

@@ -1,16 +1,51 @@
-import { type RecordBatch, type Schema } from "@query-farm/apache-arrow";
+import { type VgiBatch, type VgiSchema } from "../arrow/index.js";
+import type { CookieSpec } from "../types.js";
 export declare const ARROW_CONTENT_TYPE = "application/vnd.apache.arrow.stream";
+export declare const SESSION_HEADER = "VGI-Session";
+export declare const SESSION_ACCEPT_HEADER = "VGI-Session-Accept";
+export declare const SESSION_CLOSE_HEADER = "VGI-Session-Close";
+export declare const STICKY_ENABLED_HEADER = "VGI-Sticky-Enabled";
+export declare const STICKY_DEFAULT_TTL_HEADER = "VGI-Sticky-Default-TTL";
+export declare const STICKY_ECHO_HEADERS_HEADER = "VGI-Sticky-Echo-Headers";
+/** Prefix the server uses to tell the client "echo this header on subsequent
+ *  requests in this session". Clients capture and replay
+ *  `VGI-Echo-<name>: <value>` as plain `<name>: <value>` for the session
+ *  lifetime — used for client-driven routing (e.g. `fly-force-instance-id`). */
+export declare const ECHO_HEADER_PREFIX = "VGI-Echo-";
+/** Framework-managed sticky session teardown endpoint path component.
+ *  `DELETE {prefix}/__session__` idempotently closes the session referenced
+ *  by the request's `VGI-Session` header. */
+export declare const SESSION_ENDPOINT = "__session__";
+/** Serialize a CookieSpec into a Set-Cookie header value. */
+export declare function formatSetCookieHeader(c: CookieSpec): string;
+/** Append Set-Cookie headers for each queued CookieSpec onto an existing Headers object. */
+export declare function appendCookieHeaders(headers: Headers, cookies: readonly CookieSpec[]): void;
 export declare class HttpRpcError extends Error {
     readonly statusCode: number;
     constructor(message: string, statusCode: number);
 }
-/** Serialize a schema + batches into a complete IPC stream as Uint8Array. */
-export declare function serializeIpcStream(schema: Schema, batches: RecordBatch[]): Uint8Array;
-/** Create a Response with Arrow IPC content type. Casts Uint8Array for TS lib compat. */
+/**
+ * Serialize a schema + batches into a complete IPC stream as Uint8Array.
+ *
+ * A single IPC stream is `[schema_msg, batch_msg, batch_msg, ..., EOS]`.
+ * Each backend implements `serializeBatches` to write that atomically —
+ * arrow-js via `RecordBatchStreamWriter`, flechette via `tablesToIPC`
+ * (added in our flechette fork). Naive concatenation of per-batch streams
+ * produces multiple EOS markers and breaks readers.
+ */
+export declare function serializeIpcStream(schema: VgiSchema, batches: VgiBatch[]): Uint8Array;
+/**
+ * Create a Response with Arrow IPC content type.
+ *
+ * Server errors (status 500) are translated to HTTP 200 with an
+ * ``X-VGI-RPC-Error: true`` header so that clients which discard
+ * response bodies on 5xx still receive the Arrow IPC error metadata.
+ * Client errors (400, 401, 404, 415) are passed through unchanged.
+ */
 export declare function arrowResponse(body: Uint8Array, status?: number, extraHeaders?: Headers): Response;
-/** Read schema + first batch from an IPC stream body. */
+/** Read schema + first batch from an IPC stream body via the facade. */
 export declare function readRequestFromBody(body: Uint8Array): Promise<{
-    schema: Schema;
-    batch: RecordBatch;
+    schema: VgiSchema;
+    batch: VgiBatch;
 }>;
 //# sourceMappingURL=common.d.ts.map

package/dist/http/common.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../src/http/common.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,WAAW,EAA8C,KAAK,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAGrH,eAAO,MAAM,kBAAkB,wCAAwC,CAAC;AAExE,qBAAa,YAAa,SAAQ,KAAK;aAGnB,UAAU,EAAE,MAAM;gBADlC,OAAO,EAAE,MAAM,EACC,UAAU,EAAE,MAAM;CAKrC;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,UAAU,CAQrF;AAED,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,SAAM,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,QAAQ,CAI9F;AAED,yDAAyD;AACzD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC,CAY3G"}
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../src/http/common.ts"],"names":[],"mappings":"AAGA,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,SAAS,EACf,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,eAAO,MAAM,kBAAkB,wCAAwC,CAAC;AAKxE,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAC5C,eAAO,MAAM,qBAAqB,uBAAuB,CAAC;AAC1D,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AACxD,eAAO,MAAM,qBAAqB,uBAAuB,CAAC;AAC1D,eAAO,MAAM,yBAAyB,2BAA2B,CAAC;AAClE,eAAO,MAAM,0BAA0B,4BAA4B,CAAC;AAEpE;;;gFAGgF;AAChF,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C;;6CAE6C;AAC7C,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAE9C,6DAA6D;AAC7D,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAiB3D;AAED,4FAA4F;AAC5F,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,IAAI,CAI1F;AAED,qBAAa,YAAa,SAAQ,KAAK;aAGnB,UAAU,EAAE,MAAM;gBADlC,OAAO,EAAE,MAAM,EACC,UAAU,EAAE,MAAM;CAKrC;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,UAAU,CAGrF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,SAAM,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,QAAQ,CAQ9F;AAED,wEAAwE;AACxE,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC,CAU3G"}

package/dist/http/dispatch.d.ts

@@ -1,18 +1,36 @@
 import type { AuthContext } from "../auth.js";
 import { type ExternalLocationConfig } from "../external.js";
 import type { MethodDefinition } from "../types.js";
+import { TransportKind } from "../types.js";
 import type { StateSerializer } from "./types.js";
 export interface DispatchContext {
-    signingKey: Uint8Array;
+    tokenKey: Uint8Array;
     tokenTtl: number;
     serverId: string;
+    /** Producer-only soft wire-cap (deprecated alias for the producer-loop
+     *  byte budget). Unary/exchange ignore this. */
     maxStreamResponseBytes?: number;
+    /** Soft wire-cap for producer streams; hard wire-cap for unary/exchange.
+     *  Externalised payloads do not count toward this. */
+    maxResponseBytes?: number;
+    /** Hard cap on bytes uploaded to external storage during one HTTP response. */
+    maxExternalizedResponseBytes?: number;
     stateSerializer: StateSerializer;
     authContext?: AuthContext;
     externalLocation?: ExternalLocationConfig;
+    /** Incoming HTTP request cookies.  Empty/absent on non-HTTP paths. */
+    cookies?: ReadonlyMap<string, string>;
+    /** Transport identifier surfaced to handlers via CallContext.kind.
+     *  Defaults to HTTP when unset (the only caller that overrides it is
+     *  the AF_UNIX launcher path). */
+    kind?: TransportKind;
+    /** Per-request sticky-session sink. Installed by the handler when sticky
+     *  is enabled and the dispatcher attaches it to the OutputCollector so
+     *  `ctx.session` / `ctx.openSession` / `ctx.closeSession` work. */
+    stickyContext?: import("../types.js").StickyContext;
 }
 /** Dispatch a __describe__ request. */
-export declare function httpDispatchDescribe(protocolName: string, methods: Map<string, MethodDefinition>, serverId: string): Response;
+export declare function httpDispatchDescribe(protocolName: string, methods: Map<string, MethodDefinition>, serverId: string, protocolVersion?: string): Promise<Response>;
 /** Dispatch a unary HTTP request. */
 export declare function httpDispatchUnary(method: MethodDefinition, body: Uint8Array, ctx: DispatchContext): Promise<Response>;
 /** Dispatch a stream init HTTP request (producer or exchange). */

package/dist/http/dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../src/http/dispatch.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9C,OAAO,EAAE,KAAK,sBAAsB,EAAyB,MAAM,gBAAgB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAQpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAUlD,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,UAAU,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;CAC3C;AAED,uCAAuC;AACvC,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACtC,QAAQ,EAAE,MAAM,GACf,QAAQ,CAIV;AAED,qCAAqC;AACrC,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,QAAQ,CAAC,CA0BnB;AAED,kEAAkE;AAClE,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,QAAQ,CAAC,CA2EnB;AAED,yFAAyF;AACzF,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,QAAQ,CAAC,CAqHnB"}
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../src/http/dispatch.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9C,OAAO,EACL,KAAK,sBAAsB,EAI5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAM7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAQlD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,UAAU,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB;oDACgD;IAChD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;0DACsD;IACtD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,eAAe,EAAE,eAAe,CAAC;IACjC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,sEAAsE;IACtE,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;sCAEkC;IAClC,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB;;uEAEmE;IACnE,aAAa,CAAC,EAAE,OAAO,aAAa,EAAE,aAAa,CAAC;CACrD;AA2BD,uCAAuC;AACvC,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACtC,QAAQ,EAAE,MAAM,EAChB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,QAAQ,CAAC,CAInB;AAED,qCAAqC;AACrC,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,QAAQ,CAAC,CA+FnB;AAED,kEAAkE;AAClE,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,QAAQ,CAAC,CAmGnB;AAED,yFAAyF;AACzF,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,QAAQ,CAAC,CAqMnB"}

package/dist/http/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/http/handler.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAa/C,OAAO,EAAE,KAAK,kBAAkB,EAAuB,MAAM,YAAY,CAAC;AAI1E;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkSpD"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/http/handler.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAoD/C,OAAO,EAAE,KAAK,kBAAkB,EAAuB,MAAM,YAAY,CAAC;AAwB1E;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAo7BpD"}

package/dist/http/index.d.ts

@@ -8,6 +8,7 @@ export type { JwtAuthenticateOptions } from "./jwt.js";
 export { jwtAuthenticate } from "./jwt.js";
 export type { CertValidateFn, XfccElement, XfccValidateFn } from "./mtls.js";
 export { mtlsAuthenticate, mtlsAuthenticateFingerprint, mtlsAuthenticateSubject, mtlsAuthenticateXfcc, parseXfcc, } from "./mtls.js";
+export { cookieAuthenticate } from "./oauth-pkce.js";
 export { type UnpackedToken, unpackStateToken } from "./token.js";
 export type { HttpHandlerOptions, StateSerializer } from "./types.js";
 export { jsonStateSerializer } from "./types.js";

package/dist/http/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAGA,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAC;AACxD,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,EACvB,oBAAoB,EACpB,SAAS,GACV,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,KAAK,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAClE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAGA,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAC;AACxD,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,EACvB,oBAAoB,EACpB,SAAS,GACV,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,KAAK,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAClE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC"}

package/dist/http/mtls.d.ts

@@ -1,6 +1,6 @@
-import { X509Certificate } from "node:crypto";
 import { AuthContext } from "../auth.js";
 import type { AuthenticateFn } from "./auth.js";
+type X509Certificate = any;
 /** A single element from an `x-forwarded-client-cert` header. */
 export interface XfccElement {
     hash: string | null;
@@ -75,4 +75,5 @@ export declare function mtlsAuthenticateSubject(options?: {
     allowedSubjects?: ReadonlySet<string> | null;
     checkExpiry?: boolean;
 }): AuthenticateFn;
+export {};
 //# sourceMappingURL=mtls.d.ts.map

package/dist/http/mtls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mtls.d.ts","sourceRoot":"","sources":["../../src/http/mtls.ts"],"names":[],"mappings":"AAGA,OAAO,EAAc,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMhD,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;IACvB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;CACnB;AAED,gGAAgG;AAChG,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,WAAW,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAE1F,mGAAmG;AACnG,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,eAAe,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AA2C3F;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,EAAE,CA0C5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE;IAC7C,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAClC,GAAG,cAAc,CA2BjB;AAkCD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,QAAQ,EAAE,cAAc,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,cAAc,CAUjB;AAID;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE;IACnD,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,cAAc,CAkBjB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,CAAC,EAAE;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC7C,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,cAAc,CAkCjB"}
+{"version":3,"file":"mtls.d.ts","sourceRoot":"","sources":["../../src/http/mtls.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMhD,KAAK,eAAe,GAAG,GAAG,CAAC;AAc3B,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;IACvB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;CACnB;AAED,gGAAgG;AAChG,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,WAAW,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAE1F,mGAAmG;AACnG,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,eAAe,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AA2C3F;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,EAAE,CA0C5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE;IAC7C,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAClC,GAAG,cAAc,CA2BjB;AAmCD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,QAAQ,EAAE,cAAc,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,cAAc,CAUjB;AAID;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE;IACnD,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,cAAc,CAmBjB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,CAAC,EAAE;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC7C,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,cAAc,CAkCjB"}

package/dist/http/oauth-pkce.d.ts

@@ -0,0 +1,141 @@
+import type { AuthenticateFn } from "./auth.js";
+/** Generate a 43-character URL-safe random code verifier (RFC 7636 S4.1). */
+export declare function generateCodeVerifier(): string;
+/** Compute S256 code challenge from a code verifier (RFC 7636 S4.2). */
+export declare function generateCodeChallenge(verifier: string): string;
+/** Generate a random state nonce for CSRF protection. */
+export declare function generateStateNonce(): string;
+/** Derive a separate HMAC key for OAuth session cookies. */
+export declare function deriveSessionKey(signingKey: Uint8Array): Uint8Array;
+/**
+ * Pack PKCE session data into a signed, base64-encoded cookie value.
+ *
+ * Wire format v4:
+ *   [1B version=4] [8B created_at uint64 LE]
+ *   [2B cv_len uint16 LE] [cv_len bytes code_verifier]
+ *   [2B state_len uint16 LE] [state_len bytes state_nonce]
+ *   [2B url_len uint16 LE] [url_len bytes original_url]
+ *   [2B rt_len uint16 LE] [rt_len bytes return_to]
+ *   [32B HMAC-SHA256(session_key, all above)]
+ */
+export declare function packOAuthCookie(codeVerifier: string, stateNonce: string, originalUrl: string, sessionKey: Uint8Array, createdAt?: number, returnTo?: string): string;
+export interface UnpackedOAuthCookie {
+    codeVerifier: string;
+    stateNonce: string;
+    originalUrl: string;
+    returnTo: string;
+}
+/**
+ * Unpack and verify a signed OAuth session cookie.
+ *
+ * @throws Error on tampered, expired, or malformed cookies.
+ */
+export declare function unpackOAuthCookie(cookieValue: string, sessionKey: Uint8Array, maxAge?: number): UnpackedOAuthCookie;
+export interface OidcEndpoints {
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+}
+/**
+ * Create a lazy-cached OIDC discovery function.
+ *
+ * Caches the Promise; resets on rejection so a transient failure is retried.
+ */
+export declare function createOidcDiscovery(issuer: string): () => Promise<OidcEndpoints | null>;
+export interface TokenExchangeResult {
+    token: string;
+    maxAge: number;
+    refreshToken: string | null;
+}
+/** Exchange an authorization code for a token via the token endpoint. */
+export declare function exchangeCodeForToken(tokenEndpoint: string, code: string, redirectUri: string, codeVerifier: string, clientId: string, clientSecret?: string, useIdToken?: boolean): Promise<TokenExchangeResult>;
+/** Validate the original URL is relative and within the expected prefix. */
+export declare function validateOriginalUrl(url: string, prefix: string): string;
+/** Validate an external return-to URL against an origin allowlist. */
+export declare function validateReturnTo(url: string, allowedOrigins?: ReadonlySet<string>): string;
+/** Parse the Cookie header from a Request into a Map. */
+export declare function parseCookies(request: Request): Map<string, string>;
+interface SetCookieOptions {
+    maxAge?: number;
+    path?: string;
+    secure?: boolean;
+    httpOnly?: boolean;
+    sameSite?: "Strict" | "Lax" | "None";
+}
+/** Build a Set-Cookie header string. */
+export declare function buildSetCookieHeader(name: string, value: string, options: SetCookieOptions): string;
+/** Render a user-friendly OAuth error page. */
+export declare function buildOAuthErrorPage(message: string, detail: string | null, retryUrl: string): string;
+/** Return HTML snippet (style + div + script) for user info display. */
+export declare function buildUserInfoHtml(prefix: string): string;
+/**
+ * Create an authenticate callback that reads a bearer token from a cookie.
+ *
+ * Extracts the token from the named cookie and delegates validation to the
+ * `innerAuth` authenticator by creating a new Request with an Authorization header.
+ */
+export declare function cookieAuthenticate(innerAuth: AuthenticateFn, cookieName?: string): AuthenticateFn;
+/** Configuration object produced by configureOAuthPkce. */
+export interface OAuthPkceConfig {
+    sessionKey: Uint8Array;
+    oidcDiscovery: () => Promise<OidcEndpoints | null>;
+    clientId: string;
+    clientSecret: string | undefined;
+    useIdToken: boolean;
+    prefix: string;
+    secureCookie: boolean;
+    redirectUri: string;
+    scope: string;
+    allowedReturnOrigins: ReadonlySet<string>;
+    cookieAuthenticate: AuthenticateFn;
+    userInfoHtml: string;
+}
+/** Options for configureOAuthPkce. */
+export interface OAuthPkceOptions {
+    signingKey: Uint8Array;
+    issuer: string;
+    clientId: string;
+    clientSecret?: string;
+    useIdToken?: boolean;
+    prefix: string;
+    secureCookie: boolean;
+    redirectUri: string;
+    scope?: string;
+    allowedReturnOrigins?: ReadonlySet<string>;
+}
+/**
+ * Resolve the OAuth PKCE `scope` string from available sources.
+ *
+ * Precedence:
+ *   1. `scopesSupported` from OAuth resource metadata (space-joined), when non-empty.
+ *   2. Explicit `optionsScope` override (e.g. `HttpHandlerOptions.oauthPkceScope`).
+ *   3. `undefined`, which lets `configureOAuthPkce` apply its built-in default of
+ *      `"openid email"`.
+ *
+ * Mirrors the Python reference behavior introduced in vgi-rpc v0.6.12: authorization
+ * requests should use the scopes the server publishes in its protected resource
+ * metadata, so clients ask for exactly what the resource advertises.
+ */
+export declare function resolvePkceScope(scopesSupported: readonly string[] | undefined, optionsScope: string | undefined): string | undefined;
+/** Factory function wiring all PKCE components. */
+export declare function configureOAuthPkce(opts: OAuthPkceOptions, innerAuth: AuthenticateFn): OAuthPkceConfig;
+/**
+ * Handle POST/OPTIONS {prefix}/_oauth/token — the PKCE token-exchange proxy.
+ *
+ * SPA PKCE clients cannot safely hold a client_secret, but some IdPs
+ * (notably Google) reject token-endpoint requests from "Web application"
+ * clients without one. This handler accepts authorization_code/refresh_token
+ * exchanges from a browser, injects the configured server-side
+ * client_secret, and forwards the request to the IdP's real token_endpoint.
+ * The IdP response is returned verbatim (status code + body).
+ */
+export declare function handleOAuthTokenProxy(request: Request, config: OAuthPkceConfig): Promise<Response>;
+/** Handle GET {prefix}/_oauth/callback — the redirect from the authorization server. */
+export declare function handleOAuthCallback(request: Request, config: OAuthPkceConfig): Promise<Response>;
+/** Handle GET {prefix}/_oauth/logout — clear auth cookie and redirect. */
+export declare function handleOAuthLogout(_request: Request, config: OAuthPkceConfig): Response;
+/** Redirect an unauthenticated browser GET to the OAuth authorization endpoint. Returns null if unable. */
+export declare function handleBrowserGetRedirect(request: Request, config: OAuthPkceConfig): Promise<Response | null>;
+/** If user is already authenticated and has _vgi_return_to, redirect immediately. Returns null otherwise. */
+export declare function handleEarlyReturnTo(request: Request, config: OAuthPkceConfig): Response | null;
+export {};
+//# sourceMappingURL=oauth-pkce.d.ts.map

package/dist/http/oauth-pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-pkce.d.ts","sourceRoot":"","sources":["../../src/http/oauth-pkce.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA2ChD,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,MAAM,CAG7C;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG9D;AAED,yDAAyD;AACzD,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAMD,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CAEnE;AAsBD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,UAAU,EACtB,SAAS,CAAC,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,CAsCR;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,UAAU,EACtB,MAAM,GAAE,MAAwB,GAC/B,mBAAmB,CAwDrB;AAMD,MAAM,WAAW,aAAa;IAC5B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAqBvF;AAMD,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,yEAAyE;AACzE,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,MAAM,EACrB,UAAU,CAAC,EAAE,OAAO,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAwD9B;AAMD,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAsBvE;AAMD,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,MAAM,CAsB1F;AAMD,yDAAyD;AACzD,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAYlE;AAED,UAAU,gBAAgB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CACtC;AAED,wCAAwC;AACxC,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAQnG;AAUD,+CAA+C;AAC/C,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAwBpG;AAyCD,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAOxD;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,GAAE,MAAyB,GAAG,cAAc,CAgBnH;AAMD,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,UAAU,CAAC;IACvB,aAAa,EAAE,MAAM,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,kBAAkB,EAAE,cAAc,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,sCAAsC;AACtC,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oBAAoB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,eAAe,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAC9C,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,GAAG,SAAS,CAKpB;AAED,mDAAmD;AACnD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,GAAG,eAAe,CAiBrG;AAuCD;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmFxG;AAMD,wFAAwF;AACxF,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CA6HtG;AAMD,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,GAAG,QAAQ,CAetF;AAMD,2GAA2G;AAC3G,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA+DlH;AAMD,6GAA6G;AAC7G,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,GAAG,QAAQ,GAAG,IAAI,CAmC9F"}

package/dist/http/pages.d.ts

@@ -3,6 +3,9 @@
  * Matches the styling of the Python and Go implementations.
  */
 import type { MethodDefinition } from "../types.js";
+export declare const LOGO_URL = "https://vgi-rpc-python.query.farm/assets/logo-hero.png";
+export declare const FONTS = "<link rel=\"preconnect\" href=\"https://fonts.googleapis.com\">\n<link rel=\"preconnect\" href=\"https://fonts.gstatic.com\" crossorigin>\n<link href=\"https://fonts.googleapis.com/css2?family=Inter:wght@400;600;700&family=JetBrains+Mono:wght@400;600&display=swap\" rel=\"stylesheet\">";
+export declare const ERROR_PAGE_STYLE = "<style>\nbody { font-family: 'Inter', system-ui, -apple-system, sans-serif; max-width: 600px;\n       margin: 0 auto; padding: 60px 20px 0; color: #2c2c1e; text-align: center;\n       background: #faf8f0; }\n.logo { margin-bottom: 24px; }\n.logo img { width: 120px; height: 120px; border-radius: 50%;\n             box-shadow: 0 4px 24px rgba(0,0,0,0.12); }\nh1 { color: #2d5016; margin-bottom: 8px; font-weight: 700; }\ncode { font-family: 'JetBrains Mono', monospace; background: #f0ece0;\n        padding: 2px 6px; border-radius: 3px; font-size: 0.9em; color: #2c2c1e; }\na { color: #2d5016; text-decoration: none; }\na:hover { color: #4a7c23; }\np { line-height: 1.7; color: #6b6b5a; }\n.detail { margin-top: 12px; padding: 12px 16px; background: #f0ece0;\n           border-radius: 6px; font-size: 0.9em; color: #6b6b5a; }\nfooter { margin-top: 48px; padding: 20px 0; border-top: 1px solid #f0ece0;\n          color: #6b6b5a; font-size: 0.85em; line-height: 1.8; }\nfooter a { color: #2d5016; font-weight: 600; }\nfooter a:hover { color: #4a7c23; }\n</style>";
 export declare function buildLandingPage(protocolName: string, serverId: string, describePath: string | null, repoUrl: string | null): string;
 export declare function buildNotFoundPage(prefix: string, protocolName: string): string;
 export declare function buildDescribePage(protocolName: string, serverId: string, methods: Map<string, MethodDefinition>, repoUrl: string | null): string;

package/dist/http/pages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pages.d.ts","sourceRoot":"","sources":["../../src/http/pages.ts"],"names":[],"mappings":"AAGA;;;GAGG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AA8BpD,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB,MAAM,CA2DR;AAMD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CA8B9E;AA4ED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACtC,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB,MAAM,CA8ER"}
+{"version":3,"file":"pages.d.ts","sourceRoot":"","sources":["../../src/http/pages.ts"],"names":[],"mappings":"AAGA;;;GAGG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,eAAO,MAAM,QAAQ,2DAA2D,CAAC;AAEjF,eAAO,MAAM,KAAK,kSAE6H,CAAC;AAEhJ,eAAO,MAAM,gBAAgB,4iCAmBpB,CAAC;AAwBV,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB,MAAM,CA2DR;AAMD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAwB9E;AA4ED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACtC,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB,MAAM,CA8ER"}