@relaycast/engine 12.2.1 → 12.4.0

package/dist/entrypoints/node.js

@@ -2,15 +2,32 @@ import { Hono } from 'hono';
 import { serve } from '@hono/node-server';
 import { WebSocketServer } from 'ws';
 import { createEngine } from '../engine.js';
+import { assertInternalSecretStrength } from '../engine/internalAdmin.js';
 import { jsonNotFound } from '../lib/httpResponse.js';
+import { safeTelemetrySink } from '../ports/telemetry.js';
+import { NoopTelemetrySink } from '../providers/noop-telemetry.js';
+import { observeAuthenticatedCredential } from '../lib/credentialNotice.js';
 import { createNodeRuntime, FILE_ROUTE_PREFIX, } from '../adapters/node/index.js';
 import { authenticateNodeWs, authenticateRealtimeWs, missingWsToken, queryOrBearerToken, } from '../engine/wsAuth.js';
+export { credentialConfigFromEnv } from '../config/credentialEnv.js';
+export { ConfigError } from '../bin/secretEnv.js';
 function toEngineSocket(ws) {
     return {
         send: (data) => ws.send(data),
         close: (code, reason) => ws.close(code, reason),
     };
 }
+/** A Fetch `Headers` view of a Node request's headers. */
+function requestHeaders(req) {
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(req.headers)) {
+        if (value === undefined)
+            continue;
+        for (const item of Array.isArray(value) ? value : [value])
+            headers.append(name, item);
+    }
+    return headers;
+}
 function rejectUpgrade(socket, status, message) {
     try {
         socket.write(`HTTP/1.1 ${status} ${message}\r\nConnection: close\r\n\r\n`);
@@ -30,6 +47,9 @@ function rejectUpgrade(socket, status, message) {
  */
 export function startServer(options) {
     const baseUrl = options.baseUrl ?? `http://localhost:${options.port}`;
+    // Refuse a weak admin secret before opening SQLite or starting the queue
+    // and sweeper, so a rejected config leaves nothing running.
+    assertInternalSecretStrength(options.config?.internalSecret);
     const runtime = createNodeRuntime({
         dbPath: options.dbPath,
         baseUrl,
@@ -43,7 +63,15 @@ export function startServer(options) {
         presence: options.presence,
         eventQueue: options.eventQueue,
     });
-    const engine = createEngine(runtime.deps);
+    let engine;
+    try {
+        engine = createEngine(runtime.deps);
+    }
+    catch (err) {
+        // Fail closed: never leave the DB handle and background workers behind.
+        runtime.close();
+        throw err;
+    }
     // Parent app: serve local files, then delegate everything else to the engine.
     const app = new Hono();
     app.all(FILE_ROUTE_PREFIX, (c) => runtime.fileHandler(c.req.raw));
@@ -54,6 +82,7 @@ export function startServer(options) {
     const wss = new WebSocketServer({ noServer: true });
     const { auth, db } = runtime.deps;
     const wsAuthDeps = { auth, db };
+    const telemetry = safeTelemetrySink(runtime.deps.telemetry ?? new NoopTelemetrySink());
     server.on('upgrade', (req, socket, head) => {
         const url = new URL(req.url ?? '/', baseUrl);
         if (url.pathname !== '/v1/ws' && url.pathname !== '/v1/node/ws') {
@@ -71,6 +100,7 @@ export function startServer(options) {
             rejectUpgrade(socket, error.status, error.upgradeMessage);
             return;
         }
+        const observed = () => new Request(url, { headers: requestHeaders(req) });
         void (async () => {
             if (url.pathname === '/v1/node/ws') {
                 const authResult = await authenticateNodeWs(wsAuthDeps, token);
@@ -78,6 +108,7 @@ export function startServer(options) {
                     rejectUpgrade(socket, authResult.status, authResult.upgradeMessage);
                     return;
                 }
+                observeAuthenticatedCredential(telemetry, observed(), token, authResult.node.workspaceId);
                 wss.handleUpgrade(req, socket, head, (ws) => {
                     const handle = runtime.realtime.attachNodeSocket(authResult.node.workspaceId, authResult.node.id, toEngineSocket(ws));
                     ws.on('message', (data) => { void handle.handleMessage(data.toString()); });
@@ -90,6 +121,7 @@ export function startServer(options) {
                 rejectUpgrade(socket, authResult.status, authResult.upgradeMessage);
                 return;
             }
+            observeAuthenticatedCredential(telemetry, observed(), token, authResult.workspace.id);
             wss.handleUpgrade(req, socket, head, (ws) => {
                 const handle = runtime.realtime.attachWorkspaceSocket(authResult.workspace.id, toEngineSocket(ws), authResult.observerToken);
                 ws.on('message', (data) => { void handle.handleMessage(data.toString()); });

package/dist/entrypoints/node.js.map

@@ -1 +1 @@
-{"version":3,"file":"node.js","sourceRoot":"","sources":["../../src/entrypoints/node.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAmB,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAA8B,MAAM,IAAI,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAMtD,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAKlB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,cAAc,EACd,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAyB7B,SAAS,cAAc,CAAC,EAAY;IAClC,OAAO;QACL,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAA2D,EAAE,MAAc,EAAE,OAAe;IACjH,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,IAAI,OAAO,+BAA+B,CAAC,CAAC;QAC3E,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,OAA2B;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1C,8EAA8E;IAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAErE,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAE/D,4DAA4D;IAC5D,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAClC,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAE/B,MAA4B,CAAC,EAAE,CAC9B,SAAS,EACT,CAAC,GAAoB,EAAE,MAAc,EAAE,IAAY,EAAE,EAAE;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YAChE,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;YAC/B,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;gBACnC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBAC/D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;oBACnB,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;oBAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAC9C,UAAU,CAAC,IAAI,CAAC,WAAW,EAC3B,UAAU,CAAC,IAAI,CAAC,EAAE,EAClB,cAAc,CAAC,EAAE,CAAC,CACnB,CAAC;oBACF,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC5E,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvD,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACnE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;gBACnB,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YAED,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CACnD,UAAU,CAAC,SAAS,CAAC,EAAE,EACvB,cAAc,CAAC,EAAE,CAAC,EAClB,UAAU,CAAC,aAAa,CACzB,CAAC;gBACF,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5E,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACxE,CAAC,CACF,CAAC;IAEF,OAAO;QACL,MAAM;QACN,OAAO;QACP,KAAK,CAAC,IAAI;YACR,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBACjC,MAAyD,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACpF,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../../src/entrypoints/node.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAmB,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAA8B,MAAM,IAAI,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAKtD,OAAO,EAAE,iBAAiB,EAAsB,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAKlB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,cAAc,EACd,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,uBAAuB,EAA4B,MAAM,4BAA4B,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAyBlD,SAAS,cAAc,CAAC,EAAY;IAClC,OAAO;QACL,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,SAAS,cAAc,CAAC,GAAoB;IAC1C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,MAA2D,EAAE,MAAc,EAAE,OAAe;IACjH,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,IAAI,OAAO,+BAA+B,CAAC,CAAC;QAC3E,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,OAA2B;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC;IACtE,yEAAyE;IACzE,4DAA4D;IAC5D,4BAA4B,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,iBAAiB,CAAC;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IAEH,IAAI,MAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,8EAA8E;IAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAErE,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAE/D,4DAA4D;IAC5D,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAClC,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,iBAAiB,EAAE,CAAC,CAAC;IAEtF,MAA4B,CAAC,EAAE,CAC9B,SAAS,EACT,CAAC,GAAoB,EAAE,MAAc,EAAE,IAAY,EAAE,EAAE;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YAChE,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;YAC/B,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1E,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;gBACnC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBAC/D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;oBACnB,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,8BAA8B,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC1F,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;oBAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAC9C,UAAU,CAAC,IAAI,CAAC,WAAW,EAC3B,UAAU,CAAC,IAAI,CAAC,EAAE,EAClB,cAAc,CAAC,EAAE,CAAC,CACnB,CAAC;oBACF,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC5E,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvD,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACnE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;gBACnB,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,8BAA8B,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAEtF,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CACnD,UAAU,CAAC,SAAS,CAAC,EAAE,EACvB,cAAc,CAAC,EAAE,CAAC,EAClB,UAAU,CAAC,aAAa,CACzB,CAAC;gBACF,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5E,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACxE,CAAC,CACF,CAAC;IAEF,OAAO;QACL,MAAM;QACN,OAAO;QACP,KAAK,CAAC,IAAI;YACR,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBACjC,MAAyD,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACpF,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/env.d.ts

@@ -42,6 +42,8 @@ export interface AppVariables {
      * only a fresh send with this denial.
      */
     messageAdmissionDenial?: AdmissionDenial;
+    /** The family of the credential that authenticated this request, once one has. */
+    authenticatedCredentialFamily?: 'legacy' | 'ar';
     /** The injected ports + providers + config for this deployment. */
     engine: EngineRuntime;
 }

package/dist/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EACV,QAAQ,EACR,WAAW,EACX,eAAe,EACf,YAAY,EACb,MAAM,kBAAkB,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,WAAW,aAAc,SAAQ,WAAW,EAAE,eAAe;IACjE,SAAS,EAAE,WAAW,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;IACrD,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,OAAO,UAAU,CAAC,YAAY,CAAC;IAC1C,KAAK,EAAE,OAAO,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC;IAC9C;+EAC2E;IAC3E,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,OAAO,KAAK,CAAC,YAAY,GAAG,SAAS,CAAC;IAC5C,aAAa,EAAE,OAAO,cAAc,CAAC,YAAY,GAAG,SAAS,CAAC;IAC9D,EAAE,EAAE,QAAQ,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,eAAe,CAAC;IACzC,mEAAmE;IACnE,MAAM,EAAE,aAAa,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChC,SAAS,EAAE,YAAY,CAAC;CACzB,CAAC"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EACV,QAAQ,EACR,WAAW,EACX,eAAe,EACf,YAAY,EACb,MAAM,kBAAkB,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,WAAW,aAAc,SAAQ,WAAW,EAAE,eAAe;IACjE,SAAS,EAAE,WAAW,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;IACrD,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,OAAO,UAAU,CAAC,YAAY,CAAC;IAC1C,KAAK,EAAE,OAAO,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC;IAC9C;+EAC2E;IAC3E,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,OAAO,KAAK,CAAC,YAAY,GAAG,SAAS,CAAC;IAC5C,aAAa,EAAE,OAAO,cAAc,CAAC,YAAY,GAAG,SAAS,CAAC;IAC9D,EAAE,EAAE,QAAQ,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,eAAe,CAAC;IACzC,kFAAkF;IAClF,6BAA6B,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;IAChD,mEAAmE;IACnE,MAAM,EAAE,aAAa,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChC,SAAS,EAAE,YAAY,CAAC;CACzB,CAAC"}

package/dist/gateway.d.ts

@@ -0,0 +1,11 @@
+export { parseArCredential } from './auth/credentials.js';
+export type { CredentialKind } from './auth/credentials.js';
+export { createCredentialTagSigner, parseCredentialKeyring } from './auth/credentialTags.js';
+export type { CredentialKeyring, CredentialTagSigner, CredentialTagger } from './auth/credentialTags.js';
+export { signFileToken, verifyFileToken } from './lib/fileTokens.js';
+export type { FileTokenPayload } from './lib/fileTokens.js';
+export type { ActorHttpRequest, ActorHttpResponse } from './adapters/actor/http.js';
+export { ACTOR_FILE_ROUTE, OBJECT_SIZE_HEADER } from './adapters/actor/files.js';
+/** A new workspace id: a snowflake, as every relaycast deployment uses. */
+export declare function generateWorkspaceId(): string;
+//# sourceMappingURL=gateway.d.ts.map

package/dist/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAC7F,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACzG,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACrE,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEjF,2EAA2E;AAC3E,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}

package/dist/gateway.js

@@ -0,0 +1,16 @@
+/**
+ * The pieces a stateless gateway in front of workspace actors needs, without
+ * the engine itself: parse an `ar_` credential and verify its tag with the
+ * keyring (no lookup), mint workspace ids (plain snowflakes) and their tags,
+ * serve signed file URLs, and forward requests as actor calls.
+ */
+import { generateId } from './engine/snowflake.js';
+export { parseArCredential } from './auth/credentials.js';
+export { createCredentialTagSigner, parseCredentialKeyring } from './auth/credentialTags.js';
+export { signFileToken, verifyFileToken } from './lib/fileTokens.js';
+export { ACTOR_FILE_ROUTE, OBJECT_SIZE_HEADER } from './adapters/actor/files.js';
+/** A new workspace id: a snowflake, as every relaycast deployment uses. */
+export function generateWorkspaceId() {
+    return generateId();
+}
+//# sourceMappingURL=gateway.js.map

package/dist/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAE7F,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGrE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEjF,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB;IACjC,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC"}

package/dist/index.d.ts

@@ -7,6 +7,8 @@ export type { EngineDeps, EnginePorts, EngineProviders, EngineConfig, EngineLogR
 export { observerAllowsEvent, type ObserverToken } from './engine/observerToken.js';
 export { createRegistrationAdmission, type RegistrationAdmission, } from './engine/registrationAdmission.js';
 export { SqliteApiKeyAuthProvider, hashToken } from './auth/index.js';
+export { createCredentialTagSigner, parseCredentialKeyring } from './auth/credentialTags.js';
+export type { CredentialKeyring, CredentialTagSigner, CredentialTagger } from './auth/credentialTags.js';
 export { NoopTelemetrySink } from './providers/noop-telemetry.js';
 export { configureEngineDiagnostics, currentEngineOperation, engineOperationOf, runWithEngineDiagnostics, } from './lib/engineDiagnostics.js';
 export { isValidStandardWebhookSecret, signStandardWebhook, verifyStandardWebhook, } from './lib/standardWebhook.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACtF,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC3F,eAAO,MAAM,cAAc,EAAG,OAAgB,CAAC;AAG/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGpE,YAAY,EACV,UAAU,EACV,WAAW,EACX,eAAe,EACf,YAAY,EACZ,eAAe,EACf,eAAe,EACf,QAAQ,EACR,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,WAAW,EACX,eAAe,EACf,WAAW,EACX,aAAa,EACb,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,EACV,WAAW,EACX,SAAS,EACT,KAAK,EACL,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,2BAA2B,EAC3B,aAAa,EACb,cAAc,GACf,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAIpF,OAAO,EACL,2BAA2B,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,mCAAmC,CAAC;AAG3C,OAAO,EAAE,wBAAwB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa,EAAE,MAAM,eAAe,CAAC;AACpE,YAAY,EAAE,EAAE,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,oBAAoB,EACpB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,qCAAqC,CAAC;AAC7C,YAAY,EACV,uBAAuB,EACvB,6BAA6B,EAC7B,gBAAgB,GACjB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAQ5D,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAIjG,OAAO,EAAE,yBAAyB,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAClG,YAAY,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,YAAY,EAAE,4BAA4B,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAMrF,OAAO,EACL,YAAY,EACZ,cAAc,EACd,aAAa,EACb,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAMvE,OAAO,EACL,YAAY,EACZ,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,YAAY,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAMjE,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,mBAAmB,EACnB,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAG7F,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACtF,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC3F,eAAO,MAAM,cAAc,EAAG,OAAgB,CAAC;AAG/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGpE,YAAY,EACV,UAAU,EACV,WAAW,EACX,eAAe,EACf,YAAY,EACZ,eAAe,EACf,eAAe,EACf,QAAQ,EACR,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,WAAW,EACX,eAAe,EACf,WAAW,EACX,aAAa,EACb,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,EACV,WAAW,EACX,SAAS,EACT,KAAK,EACL,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,2BAA2B,EAC3B,aAAa,EACb,cAAc,GACf,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAIpF,OAAO,EACL,2BAA2B,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,mCAAmC,CAAC;AAG3C,OAAO,EAAE,wBAAwB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAC7F,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACzG,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa,EAAE,MAAM,eAAe,CAAC;AACpE,YAAY,EAAE,EAAE,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,oBAAoB,EACpB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,qCAAqC,CAAC;AAC7C,YAAY,EACV,uBAAuB,EACvB,6BAA6B,EAC7B,gBAAgB,GACjB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAQ5D,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAIjG,OAAO,EAAE,yBAAyB,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAClG,YAAY,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,YAAY,EAAE,4BAA4B,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAMrF,OAAO,EACL,YAAY,EACZ,cAAc,EACd,aAAa,EACb,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAMvE,OAAO,EACL,YAAY,EACZ,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,YAAY,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAMjE,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,mBAAmB,EACnB,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAG7F,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}

package/dist/index.js

@@ -11,6 +11,7 @@ export { observerAllowsEvent } from './engine/observerToken.js';
 export { createRegistrationAdmission, } from './engine/registrationAdmission.js';
 // OSS default providers (self-host). Cloud injects its own.
 export { SqliteApiKeyAuthProvider, hashToken } from './auth/index.js';
+export { createCredentialTagSigner, parseCredentialKeyring } from './auth/credentialTags.js';
 export { NoopTelemetrySink } from './providers/noop-telemetry.js';
 export { configureEngineDiagnostics, currentEngineOperation, engineOperationOf, runWithEngineDiagnostics, } from './lib/engineDiagnostics.js';
 export { isValidStandardWebhookSecret, signStandardWebhook, verifyStandardWebhook, } from './lib/standardWebhook.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEtF,MAAM,CAAC,MAAM,cAAc,GAAG,OAAgB,CAAC;AAE/C,2DAA2D;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAqC3C,0EAA0E;AAC1E,gFAAgF;AAChF,+EAA+E;AAC/E,OAAO,EAAE,mBAAmB,EAAsB,MAAM,2BAA2B,CAAC;AAEpF,6EAA6E;AAC7E,0EAA0E;AAC1E,OAAO,EACL,2BAA2B,GAE5B,MAAM,mCAAmC,CAAC;AAE3C,4DAA4D;AAC5D,OAAO,EAAE,wBAAwB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAElC,yDAAyD;AACzD,OAAO,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAEzC,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,oBAAoB,EACpB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,qCAAqC,CAAC;AAM7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,wEAAwE;AACxE,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,yCAAyC;AACzC,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACjG,4EAA4E;AAC5E,8EAA8E;AAC9E,wEAAwE;AACxE,OAAO,EAAE,yBAAyB,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAElG,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAG5D,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,4CAA4C;AAC5C,OAAO,EACL,YAAY,EACZ,cAAc,EACd,aAAa,EACb,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAGhC,yEAAyE;AACzE,8EAA8E;AAC9E,4EAA4E;AAC5E,qBAAqB;AACrB,OAAO,EACL,YAAY,EACZ,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAK/B,yEAAyE;AACzE,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAE/B,yEAAyE;AACzE,+EAA+E;AAC/E,0CAA0C;AAC1C,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AAEnC,2EAA2E;AAC3E,+EAA+E;AAC/E,8BAA8B;AAC9B,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,mBAAmB,EACnB,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AAGrC,iBAAiB;AACjB,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEtF,MAAM,CAAC,MAAM,cAAc,GAAG,OAAgB,CAAC;AAE/C,2DAA2D;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAqC3C,0EAA0E;AAC1E,gFAAgF;AAChF,+EAA+E;AAC/E,OAAO,EAAE,mBAAmB,EAAsB,MAAM,2BAA2B,CAAC;AAEpF,6EAA6E;AAC7E,0EAA0E;AAC1E,OAAO,EACL,2BAA2B,GAE5B,MAAM,mCAAmC,CAAC;AAE3C,4DAA4D;AAC5D,OAAO,EAAE,wBAAwB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAE7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAElC,yDAAyD;AACzD,OAAO,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAEzC,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,oBAAoB,EACpB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,qCAAqC,CAAC;AAM7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,wEAAwE;AACxE,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,yCAAyC;AACzC,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACjG,4EAA4E;AAC5E,8EAA8E;AAC9E,wEAAwE;AACxE,OAAO,EAAE,yBAAyB,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAElG,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAG5D,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,4CAA4C;AAC5C,OAAO,EACL,YAAY,EACZ,cAAc,EACd,aAAa,EACb,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAGhC,yEAAyE;AACzE,8EAA8E;AAC9E,4EAA4E;AAC5E,qBAAqB;AACrB,OAAO,EACL,YAAY,EACZ,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAK/B,yEAAyE;AACzE,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAE/B,yEAAyE;AACzE,+EAA+E;AAC/E,0CAA0C;AAC1C,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AAEnC,2EAA2E;AAC3E,+EAA+E;AAC/E,8BAA8B;AAC9B,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,mBAAmB,EACnB,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AAGrC,iBAAiB;AACjB,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}

package/dist/lib/credentialNotice.d.ts

@@ -0,0 +1,32 @@
+import type { Context, MiddlewareHandler } from 'hono';
+import type { AppEnv } from '../env.js';
+import type { TelemetrySink } from '../ports/telemetry.js';
+/** Where the legacy-credential deprecation is documented (the `Link` header on legacy responses). */
+export declare const LEGACY_CREDENTIAL_DOCS_URL = "https://github.com/AgentWorkforce/relaycast#credential-upgrade";
+/** When the legacy credential family was deprecated: 2026-10-30T00:00:00Z. */
+export declare const LEGACY_CREDENTIALS_DEPRECATED_AT: Date;
+/** The RFC 9745 `Deprecation` value: a structured-field Date (`@<unix seconds>`). */
+export declare const LEGACY_CREDENTIAL_DEPRECATION: string;
+/**
+ * Note the credential that authenticated this request, at authentication time
+ * and whatever the request then does. It reports `request.authenticated` with
+ * the credential's family and kind (the observation carries the workspace and
+ * the origin client and version), once per request. A legacy credential marks
+ * the request so {@link legacyCredentialHeaders} deprecates its final response.
+ */
+export declare function noteAuthenticatedCredential(c: Context<AppEnv>, token: string, workspaceId: string): void;
+/**
+ * Report `request.authenticated` for a connect authenticated outside a Hono
+ * context (the Node server's native WebSocket upgrade), with the same facts
+ * and origin {@link noteAuthenticatedCredential} reports.
+ */
+export declare function observeAuthenticatedCredential(telemetry: TelemetrySink, request: Request, token: string, workspaceId: string): void;
+/**
+ * Deprecate the final response of a request a legacy credential authenticated,
+ * whatever its status: `Deprecation` (RFC 9745, the date the legacy family
+ * was deprecated), `Sunset` (RFC 8594, an HTTP-date) when
+ * `EngineConfig.legacyCredentialSunset` is set, and
+ * `Link: <docs>; rel="deprecation"`. A deployment that accepts only `ar_` credentials sends none.
+ */
+export declare const legacyCredentialHeaders: MiddlewareHandler<AppEnv>;
+//# sourceMappingURL=credentialNotice.d.ts.map

package/dist/lib/credentialNotice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialNotice.d.ts","sourceRoot":"","sources":["../../src/lib/credentialNotice.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGxC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D,qGAAqG;AACrG,eAAO,MAAM,0BAA0B,mEAAmE,CAAC;AAE3G,8EAA8E;AAC9E,eAAO,MAAM,gCAAgC,MAAkC,CAAC;AAEhF,qFAAqF;AACrF,eAAO,MAAM,6BAA6B,QAAsE,CAAC;AAEjH;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAQxG;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAgBnI;AAED;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,iBAAiB,CAAC,MAAM,CAY7D,CAAC"}

package/dist/lib/credentialNotice.js

@@ -0,0 +1,76 @@
+import { parseCredential } from '@relaycast/types';
+import { emitServerEvent } from './serverTelemetry.js';
+import { acceptsOnlyAr } from '../auth/credentials.js';
+import { extractOriginActor, requiredOriginInfo } from './origin.js';
+/** Where the legacy-credential deprecation is documented (the `Link` header on legacy responses). */
+export const LEGACY_CREDENTIAL_DOCS_URL = 'https://github.com/AgentWorkforce/relaycast#credential-upgrade';
+/** When the legacy credential family was deprecated: 2026-10-30T00:00:00Z. */
+export const LEGACY_CREDENTIALS_DEPRECATED_AT = new Date(Date.UTC(2026, 9, 30));
+/** The RFC 9745 `Deprecation` value: a structured-field Date (`@<unix seconds>`). */
+export const LEGACY_CREDENTIAL_DEPRECATION = `@${Math.floor(LEGACY_CREDENTIALS_DEPRECATED_AT.getTime() / 1000)}`;
+/**
+ * Note the credential that authenticated this request, at authentication time
+ * and whatever the request then does. It reports `request.authenticated` with
+ * the credential's family and kind (the observation carries the workspace and
+ * the origin client and version), once per request. A legacy credential marks
+ * the request so {@link legacyCredentialHeaders} deprecates its final response.
+ */
+export function noteAuthenticatedCredential(c, token, workspaceId) {
+    const parsed = parseCredential(token);
+    if (!parsed || c.get('authenticatedCredentialFamily'))
+        return;
+    c.set('authenticatedCredentialFamily', parsed.family);
+    emitServerEvent(c, workspaceId, 'request.authenticated', {
+        credential_family: parsed.family,
+        credential_kind: parsed.kind,
+    });
+}
+/**
+ * Report `request.authenticated` for a connect authenticated outside a Hono
+ * context (the Node server's native WebSocket upgrade), with the same facts
+ * and origin {@link noteAuthenticatedCredential} reports.
+ */
+export function observeAuthenticatedCredential(telemetry, request, token, workspaceId) {
+    const parsed = parseCredential(token);
+    if (!parsed)
+        return;
+    const origin = requiredOriginInfo(request);
+    try {
+        const pending = telemetry.capture({
+            kind: 'request.authenticated',
+            occurredAt: new Date().toISOString(),
+            workspaceId,
+            origin: { actor: extractOriginActor(request), client: origin.origin_client, version: origin.origin_version },
+            facts: { credential_family: parsed.family, credential_kind: parsed.kind },
+        });
+        if (pending)
+            void Promise.resolve(pending).catch(() => { });
+    }
+    catch {
+        // Host observation is best effort.
+    }
+}
+/**
+ * Deprecate the final response of a request a legacy credential authenticated,
+ * whatever its status: `Deprecation` (RFC 9745, the date the legacy family
+ * was deprecated), `Sunset` (RFC 8594, an HTTP-date) when
+ * `EngineConfig.legacyCredentialSunset` is set, and
+ * `Link: <docs>; rel="deprecation"`. A deployment that accepts only `ar_` credentials sends none.
+ */
+export const legacyCredentialHeaders = async (c, next) => {
+    await next();
+    if (c.get('authenticatedCredentialFamily') !== 'legacy' || acceptsOnlyAr(c.get('db')))
+        return;
+    const sunset = c.get('engine').config.legacyCredentialSunset;
+    try {
+        c.res.headers.set('Deprecation', LEGACY_CREDENTIAL_DEPRECATION);
+        if (sunset)
+            c.res.headers.set('Sunset', sunset.toUTCString());
+        c.res.headers.append('Link', `<${LEGACY_CREDENTIAL_DOCS_URL}>; rel="deprecation"`);
+    }
+    catch {
+        // A runtime's WebSocket upgrade response can have immutable headers; the
+        // connect is still reported through `request.authenticated`.
+    }
+};
+//# sourceMappingURL=credentialNotice.js.map

package/dist/lib/credentialNotice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialNotice.js","sourceRoot":"","sources":["../../src/lib/credentialNotice.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAErE,qGAAqG;AACrG,MAAM,CAAC,MAAM,0BAA0B,GAAG,gEAAgE,CAAC;AAE3G,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEhF,qFAAqF;AACrF,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,gCAAgC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;AAEjH;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,CAAkB,EAAE,KAAa,EAAE,WAAmB;IAChG,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC;QAAE,OAAO;IAC9D,CAAC,CAAC,GAAG,CAAC,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD,eAAe,CAAC,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE;QACvD,iBAAiB,EAAE,MAAM,CAAC,MAAM;QAChC,eAAe,EAAE,MAAM,CAAC,IAAI;KAC7B,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,SAAwB,EAAE,OAAgB,EAAE,KAAa,EAAE,WAAmB;IAC3H,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;YAChC,IAAI,EAAE,uBAAuB;YAC7B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,WAAW;YACX,MAAM,EAAE,EAAE,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,cAAc,EAAE;YAC5G,KAAK,EAAE,EAAE,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,EAAE;SAC1E,CAAC,CAAC;QACH,IAAI,OAAO;YAAE,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA8B,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAClF,MAAM,IAAI,EAAE,CAAC;IACb,IAAI,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO;IAC9F,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC;IAC7D,IAAI,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,6BAA6B,CAAC,CAAC;QAChE,IAAI,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9D,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,0BAA0B,sBAAsB,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,6DAA6D;IAC/D,CAAC;AACH,CAAC,CAAC"}

package/dist/lib/fileTokens.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Short-lived signed tokens for file upload/download URLs, built on WebCrypto
+ * so the signer (an engine host) and the verifier (a gateway that holds the
+ * blob store) can run on different runtimes and share only the secret.
+ *
+ * Token: `<base64url(JSON payload)>.<base64url(HMAC-SHA256(payload))>`.
+ */
+/**
+ * Whether `key` has the engine's storage-key shape: three non-empty segments
+ * (`<workspace_id>/<file_id>/<name>`), none of them `.` or `..`, no
+ * backslashes. Such a key stays inside its workspace and file directory
+ * wherever a store resolves keys as paths.
+ */
+export declare function isContainedStorageKey(key: string): boolean;
+export interface FileTokenPayload {
+    /** Engine storage key (`<workspaceId>/<fileId>/<name>`). */
+    key: string;
+    /** `stat` reads the stored size (`HEAD`), for upload completion. */
+    op: 'put' | 'get' | 'delete' | 'stat';
+    /** Expiry, epoch seconds. */
+    exp: number;
+    /** `put` only: the exact byte length the upload must have. */
+    size?: number;
+    /** `put` only: the content type the upload must declare. */
+    type?: string;
+}
+export declare function signFileToken(secret: string, payload: FileTokenPayload): Promise<string>;
+/** The payload of a valid, unexpired token; `null` for anything else. */
+export declare function verifyFileToken(secret: string, token: string | null | undefined, nowMs?: number): Promise<FileTokenPayload | null>;
+//# sourceMappingURL=fileTokens.d.ts.map

package/dist/lib/fileTokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileTokens.d.ts","sourceRoot":"","sources":["../../src/lib/fileTokens.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAI1D;AAED,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,EAAE,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACtC,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAqBD,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAK9F;AAED,yEAAyE;AACzE,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA8BlC"}

package/dist/lib/fileTokens.js

@@ -0,0 +1,76 @@
+/**
+ * Short-lived signed tokens for file upload/download URLs, built on WebCrypto
+ * so the signer (an engine host) and the verifier (a gateway that holds the
+ * blob store) can run on different runtimes and share only the secret.
+ *
+ * Token: `<base64url(JSON payload)>.<base64url(HMAC-SHA256(payload))>`.
+ */
+/**
+ * Whether `key` has the engine's storage-key shape: three non-empty segments
+ * (`<workspace_id>/<file_id>/<name>`), none of them `.` or `..`, no
+ * backslashes. Such a key stays inside its workspace and file directory
+ * wherever a store resolves keys as paths.
+ */
+export function isContainedStorageKey(key) {
+    if (key.includes('\\'))
+        return false;
+    const segments = key.split('/');
+    return segments.length === 3 && segments.every((segment) => segment !== '' && segment !== '.' && segment !== '..');
+}
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+function toBase64Url(bytes) {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function fromBase64Url(text) {
+    if (!/^[A-Za-z0-9_-]*$/.test(text))
+        throw new Error('invalid base64url');
+    const binary = atob(text.replace(/-/g, '+').replace(/_/g, '/'));
+    return Uint8Array.from(binary, (ch) => ch.charCodeAt(0));
+}
+function hmacKey(secret, usage) {
+    return crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, [usage]);
+}
+export async function signFileToken(secret, payload) {
+    if (!isContainedStorageKey(payload.key))
+        throw new Error(`Refusing to sign storage key outside its workspace/file prefix: ${payload.key}`);
+    const body = toBase64Url(encoder.encode(JSON.stringify(payload)));
+    const mac = await crypto.subtle.sign('HMAC', await hmacKey(secret, 'sign'), encoder.encode(body));
+    return `${body}.${toBase64Url(new Uint8Array(mac))}`;
+}
+/** The payload of a valid, unexpired token; `null` for anything else. */
+export async function verifyFileToken(secret, token, nowMs = Date.now()) {
+    if (!token)
+        return null;
+    const dot = token.lastIndexOf('.');
+    if (dot < 0)
+        return null;
+    const body = token.slice(0, dot);
+    try {
+        const valid = await crypto.subtle.verify('HMAC', await hmacKey(secret, 'verify'), fromBase64Url(token.slice(dot + 1)), encoder.encode(body));
+        if (!valid)
+            return null;
+        const payload = JSON.parse(decoder.decode(fromBase64Url(body)));
+        if (typeof payload.key !== 'string' ||
+            (payload.op !== 'put' && payload.op !== 'get' && payload.op !== 'delete' && payload.op !== 'stat') ||
+            typeof payload.exp !== 'number') {
+            return null;
+        }
+        if (payload.op === 'put' && (!Number.isSafeInteger(payload.size) || payload.size < 1 || typeof payload.type !== 'string'))
+            return null;
+        if (!isContainedStorageKey(payload.key))
+            return null;
+        if (payload.exp * 1000 < nowMs)
+            return null;
+        return payload.op === 'put'
+            ? { key: payload.key, op: payload.op, exp: payload.exp, size: payload.size, type: payload.type }
+            : { key: payload.key, op: payload.op, exp: payload.exp };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=fileTokens.js.map

package/dist/lib/fileTokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileTokens.js","sourceRoot":"","sources":["../../src/lib/fileTokens.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC;AACrH,CAAC;AAeD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,SAAS,WAAW,CAAC,KAAiB;IACpC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAChE,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,KAAwB;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,OAAyB;IAC3E,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3I,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAClG,OAAO,GAAG,IAAI,IAAI,WAAW,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,KAAgC,EAChC,QAAgB,IAAI,CAAC,GAAG,EAAE;IAE1B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACtC,MAAM,EACN,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAC/B,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EACnC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CACrB,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAA8B,CAAC;QAC7F,IACE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,CAAC,OAAO,CAAC,EAAE,KAAK,KAAK,IAAI,OAAO,CAAC,EAAE,KAAK,KAAK,IAAI,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,KAAK,MAAM,CAAC;YAClG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAC/B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAK,GAAG,CAAC,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACxI,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,GAAG,KAAK;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,OAAO,CAAC,EAAE,KAAK,KAAK;YACzB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;YAChG,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/httpError.d.ts

@@ -44,5 +44,5 @@ export declare function errorResponse(c: Context, err: unknown): Response & impo
         code: string;
         message: string;
     };
-}, -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">;
+}, 400 | -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">;
 //# sourceMappingURL=httpError.d.ts.map

package/dist/lib/httpResponse.d.ts

@@ -53,7 +53,7 @@ export declare function jsonOk<T>(c: Context, data: T, status?: ContentfulStatus
 }[K], bigint | readonly bigint[]> | undefined : import("hono/utils/types").JSONParsed<{
     ok: true;
     data: T;
-}[K], bigint | readonly bigint[]>; }, -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">;
+}[K], bigint | readonly bigint[]>; }, 400 | -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">;
 export declare function jsonSuccess(c: Context): Response & import("hono").TypedResponse<{
     ok: true;
     data: null;
@@ -79,7 +79,7 @@ export declare function jsonCreated<T>(c: Context, data: T): Response & import("
 }[K], bigint | readonly bigint[]> | undefined : import("hono/utils/types").JSONParsed<{
     ok: true;
     data: T;
-}[K], bigint | readonly bigint[]>; }, -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">;
+}[K], bigint | readonly bigint[]>; }, 400 | -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">;
 export declare function jsonNoContent(c: Context): Response & import("hono").TypedResponse<null, 204, "body">;
 export declare function jsonError(c: Context, code: string, message: string, status: ContentfulStatusCode): Response & import("hono").TypedResponse<{
     ok: false;
@@ -87,28 +87,28 @@ export declare function jsonError(c: Context, code: string, message: string, sta
         code: string;
         message: string;
     };
-}, -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">;
+}, 400 | -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">;
 export declare function jsonInvalidRequest(c: Context, message: string): Response & import("hono").TypedResponse<{
     ok: false;
     error: {
         code: string;
         message: string;
     };
-}, -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">;
+}, 400 | -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">;
 export declare function jsonNotFound(c: Context, code: string, message: string): Response & import("hono").TypedResponse<{
     ok: false;
     error: {
         code: string;
         message: string;
     };
-}, -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">;
+}, 400 | -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">;
 export declare function jsonMalformedBody(c: Context): Response & import("hono").TypedResponse<{
     ok: false;
     error: {
         code: string;
         message: string;
     };
-}, -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">;
+}, 400 | -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">;
 export declare function parseJsonBody<T>(c: Context, schema: SafeParseSchema<T>, invalidMessage: InvalidRequestMessage, options?: ParseJsonBodyOptions): Promise<ParsedRequestValue<T>>;
 export declare function parseOptionalJsonBody<T>(c: Context, schema: SafeParseSchema<T>, invalidMessage: InvalidRequestMessage, options?: ParseJsonBodyOptions): Promise<ParsedRequestValue<T>>;
 export declare function parseQueryParams<T>(c: Context, schema: SafeParseSchema<T>, invalidMessage: InvalidRequestMessage): ParsedRequestValue<T>;

package/dist/middleware/admission.d.ts

@@ -19,7 +19,7 @@ export declare function admissionDeniedResponse(c: Context, denial: AdmissionDen
         code: string;
         message: string;
     };
-}, -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">;
+}, 400 | -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">;
 /** Report a successful, non-replayed action to the host without holding the response. */
 export declare function reportCommitted(c: Context<AppEnv>, workspace: Workspace, action: AdmissionAction): void;
 /**

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAMxC,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAoE7C,UAAU,oBAAoB;IAC5B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAMD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,aAAa,GAAG,aAAa,EAAE,EACvC,OAAO,GAAE,oBAAyB,kEA+DnC;AAED,gDAAgD;AAChD,eAAO,MAAM,mBAAmB,gEAAkC,CAAC;AAEnE,wDAAwD;AACxD,eAAO,MAAM,WAAW,gEAA4B,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,aAAa,gEAA+B,CAAC;AAE1D,+CAA+C;AAC/C,eAAO,MAAM,iBAAiB,gEAA8B,CAAC;AAE7D,6CAA6C;AAC7C,eAAO,MAAM,gBAAgB,gEAA6B,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAQxC,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAwE7C,UAAU,oBAAoB;IAC5B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAMD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,aAAa,GAAG,aAAa,EAAE,EACvC,OAAO,GAAE,oBAAyB,kEAqDnC;AAED,gDAAgD;AAChD,eAAO,MAAM,mBAAmB,gEAAkC,CAAC;AAEnE,wDAAwD;AACxD,eAAO,MAAM,WAAW,gEAA4B,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,aAAa,gEAA+B,CAAC;AAE1D,+CAA+C;AAC/C,eAAO,MAAM,iBAAiB,gEAA8B,CAAC;AAE7D,6CAA6C;AAC7C,eAAO,MAAM,gBAAgB,gEAA6B,CAAC"}