@run402/functions 2.5.1 → 2.7.0

package/dist/lib/jwt.js

@@ -0,0 +1,196 @@
+/**
+ * Minimal HS256/HS512 JWT sign + verify built directly on `node:crypto`.
+ *
+ * Used internally by `@run402/functions` to verify project JWTs in
+ * `getUser`. Replaces a runtime dependency on the `jsonwebtoken` package
+ * (and its transitive tree `jws` / `jwa` / `ecdsa-sig-formatter` /
+ * `lodash.*` / `ms` / `semver` / `safe-buffer`), so this published SDK
+ * has zero crypto deps beyond `node:crypto`. The companion file in
+ * the private gateway package (`packages/gateway/src/lib/jwt.ts`) is
+ * intentionally a verbatim duplicate — the published SDK cannot pull
+ * from the workspace-private `@run402/shared`.
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+export class JsonWebTokenError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "JsonWebTokenError";
+    }
+}
+export class TokenExpiredError extends JsonWebTokenError {
+    expiredAt;
+    constructor(message, expiredAt) {
+        super(message);
+        this.name = "TokenExpiredError";
+        this.expiredAt = expiredAt;
+    }
+}
+export class NotBeforeError extends JsonWebTokenError {
+    date;
+    constructor(message, date) {
+        super(message);
+        this.name = "NotBeforeError";
+        this.date = date;
+    }
+}
+function b64urlEncode(input) {
+    const buf = typeof input === "string" ? Buffer.from(input, "utf8") : input;
+    return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function b64urlDecodeToBuffer(input) {
+    if (!/^[A-Za-z0-9_-]*$/.test(input))
+        throw new JsonWebTokenError("invalid token");
+    const norm = input.replace(/-/g, "+").replace(/_/g, "/");
+    const pad = norm.length % 4 === 0 ? "" : "=".repeat(4 - (norm.length % 4));
+    return Buffer.from(norm + pad, "base64");
+}
+const DURATION_RE = /^(-?\d+(?:\.\d+)?)\s*(s|sec|secs|seconds?|m|min|mins|minutes?|h|hr|hrs|hours?|d|days?|w|weeks?|y|years?)?$/i;
+function parseDurationSeconds(input) {
+    if (typeof input === "number") {
+        if (!Number.isFinite(input))
+            throw new TypeError(`Invalid expiresIn: ${input}`);
+        return Math.floor(input);
+    }
+    const m = DURATION_RE.exec(input.trim());
+    if (!m)
+        throw new TypeError(`Invalid expiresIn duration: ${input}`);
+    const n = parseFloat(m[1]);
+    const unit = (m[2] ?? "s").toLowerCase();
+    if (unit.startsWith("y"))
+        return Math.floor(n * 31_557_600);
+    if (unit.startsWith("w"))
+        return Math.floor(n * 604_800);
+    if (unit.startsWith("d"))
+        return Math.floor(n * 86_400);
+    if (unit.startsWith("h"))
+        return Math.floor(n * 3_600);
+    if (unit === "m" || unit.startsWith("min"))
+        return Math.floor(n * 60);
+    return Math.floor(n);
+}
+function hmacForAlg(alg) {
+    return alg === "HS256" ? "sha256" : "sha512";
+}
+export function sign(payload, secret, options) {
+    const alg = options?.algorithm ?? "HS256";
+    if (alg !== "HS256" && alg !== "HS512") {
+        throw new JsonWebTokenError(`Unsupported algorithm: ${alg}`);
+    }
+    if (typeof secret !== "string" || secret.length === 0) {
+        throw new JsonWebTokenError("secretOrPrivateKey must be provided");
+    }
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+        throw new JsonWebTokenError("payload must be a plain object");
+    }
+    const claims = { ...payload };
+    const noTimestamp = options?.noTimestamp ?? false;
+    if (!noTimestamp && claims.iat === undefined) {
+        claims.iat = Math.floor(Date.now() / 1000);
+    }
+    if (options?.expiresIn !== undefined) {
+        if (claims.exp !== undefined) {
+            throw new JsonWebTokenError("Bad options.expiresIn option the payload already has an exp property");
+        }
+        const offset = parseDurationSeconds(options.expiresIn);
+        const iatRef = typeof claims.iat === "number" ? claims.iat : Math.floor(Date.now() / 1000);
+        claims.exp = iatRef + offset;
+    }
+    const header = { alg, typ: "JWT" };
+    const headerB64 = b64urlEncode(JSON.stringify(header));
+    const payloadB64 = b64urlEncode(JSON.stringify(claims));
+    const sig = createHmac(hmacForAlg(alg), secret)
+        .update(`${headerB64}.${payloadB64}`)
+        .digest();
+    return `${headerB64}.${payloadB64}.${b64urlEncode(sig)}`;
+}
+export function verify(token, secret, options) {
+    if (typeof token !== "string" || token.length === 0) {
+        throw new JsonWebTokenError("jwt must be provided");
+    }
+    if (typeof secret !== "string" || secret.length === 0) {
+        throw new JsonWebTokenError("secret must be provided");
+    }
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        throw new JsonWebTokenError("jwt malformed");
+    const [headerB64, payloadB64, sigB64] = parts;
+    let header;
+    try {
+        header = JSON.parse(b64urlDecodeToBuffer(headerB64).toString("utf8"));
+    }
+    catch {
+        throw new JsonWebTokenError("invalid token");
+    }
+    const allowed = (options?.algorithms ?? ["HS256"]);
+    if (typeof header.alg !== "string" || !allowed.includes(header.alg)) {
+        throw new JsonWebTokenError("invalid algorithm");
+    }
+    if (header.alg !== "HS256" && header.alg !== "HS512") {
+        throw new JsonWebTokenError("invalid algorithm");
+    }
+    const expected = createHmac(hmacForAlg(header.alg), secret)
+        .update(`${headerB64}.${payloadB64}`)
+        .digest();
+    let got;
+    try {
+        got = b64urlDecodeToBuffer(sigB64);
+    }
+    catch {
+        throw new JsonWebTokenError("invalid signature");
+    }
+    if (got.length !== expected.length || !timingSafeEqual(got, expected)) {
+        throw new JsonWebTokenError("invalid signature");
+    }
+    let payload;
+    try {
+        payload = JSON.parse(b64urlDecodeToBuffer(payloadB64).toString("utf8"));
+    }
+    catch {
+        throw new JsonWebTokenError("invalid token");
+    }
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+        throw new JsonWebTokenError("invalid token");
+    }
+    const clockTolerance = options?.clockTolerance ?? 0;
+    const now = Math.floor(Date.now() / 1000);
+    if (typeof payload.exp === "number" && payload.exp + clockTolerance < now) {
+        throw new TokenExpiredError("jwt expired", new Date(payload.exp * 1000));
+    }
+    if (typeof payload.nbf === "number" && payload.nbf - clockTolerance > now) {
+        throw new NotBeforeError("jwt not active", new Date(payload.nbf * 1000));
+    }
+    if (options?.issuer !== undefined && payload.iss !== options.issuer) {
+        throw new JsonWebTokenError(`jwt issuer invalid. expected: ${options.issuer}`);
+    }
+    if (options?.audience !== undefined) {
+        const wantArr = Array.isArray(options.audience) ? options.audience : [options.audience];
+        const haveArr = Array.isArray(payload.aud)
+            ? payload.aud
+            : payload.aud !== undefined
+                ? [payload.aud]
+                : [];
+        if (!wantArr.some((w) => haveArr.includes(w))) {
+            throw new JsonWebTokenError("jwt audience invalid");
+        }
+    }
+    return payload;
+}
+export function decode(token) {
+    if (typeof token !== "string")
+        return null;
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return null;
+    try {
+        const decoded = JSON.parse(b64urlDecodeToBuffer(parts[1]).toString("utf8"));
+        if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded))
+            return null;
+        return decoded;
+    }
+    catch {
+        return null;
+    }
+}
+const jwt = { sign, verify, decode };
+export default jwt;
+//# sourceMappingURL=jwt.js.map

package/dist/lib/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/lib/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA4B1D,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,iBAAiB;IACtD,SAAS,CAAO;IAChB,YAAY,OAAe,EAAE,SAAe;QAC1C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,iBAAiB;IACnD,IAAI,CAAO;IACX,YAAY,OAAe,EAAE,IAAU;QACrC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,SAAS,YAAY,CAAC,KAAsB;IAC1C,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,WAAW,GAAG,6GAA6G,CAAC;AAElI,SAAS,oBAAoB,CAAC,KAAsB;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;IACpE,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;IACvD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAC,GAAuB;IACzC,OAAO,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,IAAI,CAClB,OAAe,EACf,MAAc,EACd,OAAqB;IAErB,MAAM,GAAG,GAAuB,OAAO,EAAE,SAAS,IAAI,OAAO,CAAC;IAC9D,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,iBAAiB,CAAC,qCAAqC,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,GAAI,OAAmC,EAAE,CAAC;IACpF,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,KAAK,CAAC;IAClD,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,iBAAiB,CACzB,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC3F,MAAM,CAAC,GAAG,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;SAC5C,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;SACpC,MAAM,EAAE,CAAC;IACZ,OAAO,GAAG,SAAS,IAAI,UAAU,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,MAAM,CACpB,KAAa,EACb,MAAc,EACd,OAAuB;IAEvB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,CAAC,CAAC;IACrE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IAE9C,IAAI,MAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAGnE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,CAA0B,CAAC;IAC5E,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QACrD,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;SACxD,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;SACpC,MAAM,EAAE,CAAC;IACZ,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAe,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,cAAc,GAAG,GAAG,EAAE,CAAC;QAC1E,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,cAAc,GAAG,GAAG,EAAE,CAAC;QAC1E,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACpE,MAAM,IAAI,iBAAiB,CAAC,iCAAiC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,OAAO,CAAC,GAAG;YACb,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS;gBACzB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;gBACf,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO,OAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,MAAM,CAAiB,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QACvF,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3F,OAAO,OAAY,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACrC,eAAe,GAAG,CAAC"}

package/dist/request-context.d.ts

@@ -0,0 +1,94 @@
+/**
+ * `getRun402Context(request)` — zero-dependency helper for **non-Astro**
+ * Node22 functions (plain webhook handlers, auth endpoints, admin tools)
+ * to read the per-request context the gateway already populates as
+ * `x-run402-*` request headers. Returns the same shape `Astro.locals.run402`
+ * exposes in `@run402/astro`, so Astro and plain-function code share one
+ * mental model.
+ *
+ * Why this exists: every non-Astro function in production today hand-rolls
+ * header parsing (`request.headers.get('x-run402-request-id')` ...). That's
+ * error-prone, untyped, and inconsistent — different functions read
+ * different headers, miss optional fields, mis-spell names. This helper
+ * centralizes the shape so:
+ *
+ *   - Adding a new request-context field is one place to update (here
+ *     and in `@run402/astro`'s `Run402Locals`).
+ *   - Header names stay private to the helper — if the gateway renames
+ *     `x-run402-*` to something else in v2, the helper signature is
+ *     unchanged.
+ *   - Plain functions get the same per-field typing Astro pages get.
+ *
+ * Header sources (all set by the gateway on the forwarded `Request`):
+ *
+ *   - `x-run402-request-id`     → `requestId`
+ *   - `x-run402-project-id`     → `projectId`
+ *   - `x-run402-release-id`     → `releaseId` (null if no active release)
+ *   - `x-run402-host`           → `host`
+ *   - `x-run402-locale`         → `locale` (null when no spec.i18n)
+ *   - `x-run402-default-locale` → `defaultLocale` (null when no spec.i18n)
+ *
+ * If the gateway didn't set a given header (rare — would mean the request
+ * bypassed the routed-http pipeline), the field is `null`. The helper
+ * never throws.
+ */
+/**
+ * Per-request context the gateway populates on routed-http invocations.
+ * Identical shape to `@run402/astro`'s `Run402Locals` so Astro and plain-
+ * function code can pass the value around interchangeably.
+ */
+export interface Run402RequestContext {
+    /** Gateway-assigned request id; flows to logs + error envelopes. */
+    requestId: string | null;
+    /** Project id this function is deployed under. */
+    projectId: string | null;
+    /** Active release id at request time; `null` until the first activation. */
+    releaseId: string | null;
+    /** Host portion of the request URL (e.g., `eagles.kychon.com`). */
+    host: string | null;
+    /** Negotiated locale per the release's `spec.i18n.detect` chain.
+     *  `null` when the release has no i18n slice. Byte-identical to a
+     *  `spec.i18n.locales[]` entry when non-null. */
+    locale: string | null;
+    /** Release's default locale (`spec.i18n.defaultLocale`).
+     *  `null` when the release has no i18n slice. */
+    defaultLocale: string | null;
+}
+/**
+ * Web-standard headers object — `Request.headers`, `Headers`, or a
+ * `Record<string, string>`. We accept the loose shape so callers don't
+ * have to construct a `Headers` instance just to read a few fields.
+ */
+type HeaderSource = {
+    get(name: string): string | null;
+} | {
+    headers: {
+        get(name: string): string | null;
+    };
+} | Record<string, string | string[] | undefined>;
+/**
+ * Read the Run402 per-request context off the inbound `Request`.
+ *
+ * Accepts either a `Request` directly, or any object with a `.headers`
+ * property exposing `.get(name)` (which covers AWS Lambda v2 event
+ * objects, Node `http.IncomingMessage` wrappers, etc.), or a plain
+ * `Record<string, string | string[]>` (which covers `event.headers`
+ * shapes from various function platforms).
+ *
+ * @example
+ *   // In a routed-http function (`@run402/functions`'s `routedHttp` helper):
+ *   export default routedHttp(async (req) => {
+ *     const { requestId, locale, host } = getRun402Context(req);
+ *     console.log(`[${requestId}] serving ${host} in ${locale ?? 'default'}`);
+ *     return text(`Hello, ${host}`);
+ *   });
+ *
+ *   // In a raw envelope handler (no routedHttp wrapper):
+ *   export const handler = async (event) => {
+ *     const ctx = getRun402Context(event);
+ *     ...
+ *   };
+ */
+export declare function getRun402Context(source: HeaderSource): Run402RequestContext;
+export {};
+//# sourceMappingURL=request-context.d.ts.map

package/dist/request-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../src/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,kDAAkD;IAClD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mEAAmE;IACnE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB;;qDAEiD;IACjD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;qDACiD;IACjD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;GAIG;AACH,KAAK,YAAY,GACb;IAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;CAAE,GACpC;IAAE,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CAAE,GACjD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,oBAAoB,CAU3E"}

package/dist/request-context.js

@@ -0,0 +1,114 @@
+/**
+ * `getRun402Context(request)` — zero-dependency helper for **non-Astro**
+ * Node22 functions (plain webhook handlers, auth endpoints, admin tools)
+ * to read the per-request context the gateway already populates as
+ * `x-run402-*` request headers. Returns the same shape `Astro.locals.run402`
+ * exposes in `@run402/astro`, so Astro and plain-function code share one
+ * mental model.
+ *
+ * Why this exists: every non-Astro function in production today hand-rolls
+ * header parsing (`request.headers.get('x-run402-request-id')` ...). That's
+ * error-prone, untyped, and inconsistent — different functions read
+ * different headers, miss optional fields, mis-spell names. This helper
+ * centralizes the shape so:
+ *
+ *   - Adding a new request-context field is one place to update (here
+ *     and in `@run402/astro`'s `Run402Locals`).
+ *   - Header names stay private to the helper — if the gateway renames
+ *     `x-run402-*` to something else in v2, the helper signature is
+ *     unchanged.
+ *   - Plain functions get the same per-field typing Astro pages get.
+ *
+ * Header sources (all set by the gateway on the forwarded `Request`):
+ *
+ *   - `x-run402-request-id`     → `requestId`
+ *   - `x-run402-project-id`     → `projectId`
+ *   - `x-run402-release-id`     → `releaseId` (null if no active release)
+ *   - `x-run402-host`           → `host`
+ *   - `x-run402-locale`         → `locale` (null when no spec.i18n)
+ *   - `x-run402-default-locale` → `defaultLocale` (null when no spec.i18n)
+ *
+ * If the gateway didn't set a given header (rare — would mean the request
+ * bypassed the routed-http pipeline), the field is `null`. The helper
+ * never throws.
+ */
+/**
+ * Read the Run402 per-request context off the inbound `Request`.
+ *
+ * Accepts either a `Request` directly, or any object with a `.headers`
+ * property exposing `.get(name)` (which covers AWS Lambda v2 event
+ * objects, Node `http.IncomingMessage` wrappers, etc.), or a plain
+ * `Record<string, string | string[]>` (which covers `event.headers`
+ * shapes from various function platforms).
+ *
+ * @example
+ *   // In a routed-http function (`@run402/functions`'s `routedHttp` helper):
+ *   export default routedHttp(async (req) => {
+ *     const { requestId, locale, host } = getRun402Context(req);
+ *     console.log(`[${requestId}] serving ${host} in ${locale ?? 'default'}`);
+ *     return text(`Hello, ${host}`);
+ *   });
+ *
+ *   // In a raw envelope handler (no routedHttp wrapper):
+ *   export const handler = async (event) => {
+ *     const ctx = getRun402Context(event);
+ *     ...
+ *   };
+ */
+export function getRun402Context(source) {
+    const get = pickHeaderGetter(source);
+    return {
+        requestId: nonEmpty(get("x-run402-request-id")),
+        projectId: nonEmpty(get("x-run402-project-id")),
+        releaseId: nonEmpty(get("x-run402-release-id")),
+        host: nonEmpty(get("x-run402-host")),
+        locale: nonEmpty(get("x-run402-locale")),
+        defaultLocale: nonEmpty(get("x-run402-default-locale")),
+    };
+}
+/**
+ * Resolve a `(name) => string | null` accessor regardless of which of
+ * the four supported input shapes the caller passed. Case-insensitive
+ * matching, because Node-style header maps preserve original casing
+ * while Web `Headers` lowercase on insert — the helper papers over the
+ * difference.
+ */
+function pickHeaderGetter(source) {
+    // Shape 1: object with `.get()` (e.g., `Headers` instance).
+    if (typeof source.get === "function") {
+        const g = source.get.bind(source);
+        return (name) => g(name) ?? g(name.toLowerCase()) ?? null;
+    }
+    // Shape 2: object with `.headers.get()` (e.g., `Request`).
+    const nested = source.headers;
+    if (nested && typeof nested.get === "function") {
+        const g = nested.get.bind(nested);
+        return (name) => g(name) ?? g(name.toLowerCase()) ?? null;
+    }
+    // Shape 3: plain object map. Build a lowercased lookup once so any
+    // casing in the input keys (`X-Run402-Request-Id`, `x-run402-request-id`,
+    // `X-RUN402-REQUEST-ID` ...) resolves identically.
+    const map = source;
+    const lowered = {};
+    for (const k of Object.keys(map)) {
+        lowered[k.toLowerCase()] = map[k];
+    }
+    return (name) => {
+        const v = lowered[name.toLowerCase()];
+        if (typeof v === "string")
+            return v;
+        if (Array.isArray(v) && v.length > 0) {
+            const first = v[0];
+            if (typeof first === "string")
+                return first;
+        }
+        return null;
+    };
+}
+function nonEmpty(v) {
+    if (v === null)
+        return null;
+    const trimmed = v.trim();
+    return trimmed.length === 0 ? null : trimmed;
+}
+//# sourceMappingURL=request-context.js.map

package/dist/request-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../src/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAmCH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAoB;IACnD,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC/C,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC/C,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC/C,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACpC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACxC,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;KACxD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,MAAoB;IAEpB,4DAA4D;IAC5D,IAAI,OAAQ,MAA4B,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC5D,MAAM,CAAC,GAAI,MAA+C,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;IAC5D,CAAC;IACD,2DAA2D;IAC3D,MAAM,MAAM,GAAI,MAA0C,CAAC,OAAO,CAAC;IACnE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;IAC5D,CAAC;IACD,mEAAmE;IACnE,0EAA0E;IAC1E,mDAAmD;IACnD,MAAM,GAAG,GAAG,MAAuD,CAAC;IACpE,MAAM,OAAO,GAAkD,EAAE,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAgB;IAChC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/C,CAAC"}

package/dist/runtime-context.d.ts

@@ -0,0 +1,152 @@
+/**
+ * SSR request context primitive — capability `functions-sdk-auth-model`.
+ *
+ * The SSR Lambda runtime establishes this context via `als.run(...)`
+ * BEFORE importing or executing the Astro server bundle (or any other
+ * user-supplied code). SDK functions that need request-scoped state
+ * (`db()`, `getUser()`, `cache.*`, `assets.*`, `email.*`, `ai.*`) read
+ * from `getCurrentContext()` rather than requiring explicit context
+ * parameters at the call site.
+ *
+ * The `active` flag exists because Node's AsyncLocalStorage propagates
+ * into timers, microtasks, and unawaited promises created inside
+ * `als.run()`. Without an explicit flag, a `setTimeout(() => db()..., 60_000)`
+ * scheduled inside a handler would, when the timer fires later, still
+ * observe an `als.getStore()` pointing at the (now-completed) request —
+ * leading to stale or incorrect SDK behavior. The SSR runtime sets
+ * `active.value = false` IMMEDIATELY after the response body is fully
+ * materialized; SDK functions check the flag and throw
+ * `R402_SDK_OUTSIDE_REQUEST_CONTEXT` when it's false.
+ *
+ * Likewise `cacheBypassTainted.value` is set to `true` by `getUser()`
+ * and payment-primitive SDK calls during render; the SSR runtime returns
+ * its final value to the gateway in the Lambda response metadata envelope
+ * (NOT via in-process ALS — the gateway runs in a different process).
+ *
+ * @see openspec/changes/astro-ssr-runtime/specs/functions-sdk-auth-model/spec.md
+ * @see openspec/changes/astro-ssr-runtime/specs/routed-http-functions/spec.md
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+/** The shape stored in AsyncLocalStorage. See the spec referenced above
+ *  for the canonical definition. */
+export interface RunRequestContext {
+    /** Unique per-request id; matches `x-run402-request-id`. */
+    requestId: string;
+    projectId: string;
+    releaseId: string;
+    /** v1.49-negotiated locale string. `null` when the active release has
+     *  no i18n slice. */
+    locale: string | null;
+    /** Echoed verbatim from the active release's `i18n.defaultLocale`,
+     *  `null` when the release has no i18n slice. */
+    defaultLocale: string | null;
+    /** Validated host from the routed-function envelope — NOT the raw
+     *  `Host` header. Cache-key host comes from here. */
+    host: string;
+    /** Request information SDK functions need (cookies for `getUser()`,
+     *  url for invalidate path-form, etc.). Body is intentionally absent
+     *  — user code reads body via the standard Web Request API passed to
+     *  the handler. */
+    request: {
+        method: string;
+        url: string;
+        headers: Record<string, string | string[] | undefined>;
+    };
+    /** Mutable ref: SDK functions that read request-scoped auth or invoke
+     *  payment primitives set `value = true`. The SSR Lambda runtime
+     *  returns the final value to the gateway in the response metadata
+     *  envelope. */
+    cacheBypassTainted: {
+        value: boolean;
+    };
+    /** Mutable ref: SSR runtime sets `value = false` after the response
+     *  body has been fully materialized. SDK functions check this AND
+     *  the store presence; either being false produces
+     *  `R402_SDK_OUTSIDE_REQUEST_CONTEXT`. */
+    active: {
+        value: boolean;
+    };
+}
+/** The shared ALS instance. Modules in @run402/functions read from
+ *  this; the SSR Lambda runtime (in @run402/astro) writes to it. */
+export declare const als: AsyncLocalStorage<RunRequestContext>;
+/**
+ * Read the current request context, or `undefined` if no SSR request
+ * is in flight. SDK functions check both this AND `active.value` to
+ * decide whether to honor the call.
+ */
+export declare function getCurrentContext(): RunRequestContext | undefined;
+/**
+ * Establish a request context and run a callback inside it. The SSR
+ * Lambda runtime calls this exactly once per invocation, wrapping the
+ * full `App.render(request)` + body-materialization sequence.
+ *
+ * The `active` flag is set to `true` initially; the caller (the SSR
+ * runtime) flips it to `false` after the response body is materialized.
+ * Don't call this from user code — it's the runtime's primitive.
+ */
+export declare function runWithContext<T>(context: Omit<RunRequestContext, "cacheBypassTainted" | "active"> & Partial<Pick<RunRequestContext, "cacheBypassTainted" | "active">>, callback: () => Promise<T> | T): Promise<T> | T;
+/**
+ * Throw a structured `R402_SDK_OUTSIDE_REQUEST_CONTEXT` error. Used by
+ * SDK functions when they're invoked with no ALS store OR while the
+ * context has been marked inactive.
+ *
+ * Per the api-error-envelope spec, the thrown error carries:
+ *   - `code: 'R402_SDK_OUTSIDE_REQUEST_CONTEXT'`
+ *   - `message`: names the SDK function and the cause
+ *   - `suggestedFix`: recommends moving the call inside a handler OR
+ *     not scheduling background work that outlives the response
+ *   - `docs`: `https://run402.com/errors/#R402_SDK_OUTSIDE_REQUEST_CONTEXT`
+ */
+export declare class Run402OutsideRequestContextError extends Error {
+    readonly code = "R402_SDK_OUTSIDE_REQUEST_CONTEXT";
+    readonly docs = "https://run402.com/errors/#R402_SDK_OUTSIDE_REQUEST_CONTEXT";
+    readonly suggestedFix: string;
+    readonly sdkFunction: string;
+    readonly cause: "no_context" | "context_inactive";
+    constructor(sdkFunction: string, cause: "no_context" | "context_inactive");
+}
+/**
+ * Assert that a request context is active. Returns the context on
+ * success; throws `Run402OutsideRequestContextError` on failure.
+ *
+ * SDK functions call this as the first line, e.g.:
+ *
+ *   const ctx = requireActiveContext("db");
+ *   // use ctx.projectId, ctx.request.headers, etc.
+ */
+export declare function requireActiveContext(sdkFunction: string): RunRequestContext;
+/**
+ * Flip the cache-bypass taint flag on the current context. Called by
+ * `getUser()` and payment-primitive SDK calls to signal that the
+ * rendered response depends on request-scoped auth state and therefore
+ * MUST NOT be cached publicly.
+ *
+ * No-op if there is no active context (rather than throwing — the taint
+ * is moot when there's no cache layer to inform).
+ */
+export declare function taintCacheBypass(): void;
+/**
+ * Canonical registry of SDK functions that are "payment primitives" for
+ * cache-taint purposes. Calling any of these inside an active request
+ * context MUST flip `cacheBypassTainted.value = true`. The set is
+ * defined here so the spec, runtime, and docs share one source of truth.
+ *
+ * To add a new payment primitive: append to this set AND ensure the
+ * function's implementation calls `taintCacheBypass()` on every entry.
+ *
+ * @see openspec/changes/astro-ssr-runtime/specs/functions-sdk-auth-model/spec.md
+ */
+export declare const PAYMENT_PRIMITIVES: ReadonlySet<string>;
+/**
+ * Helper for payment-primitive implementations. Wraps the body in a
+ * taint-on-entry call so the registry contract is enforced at the
+ * SDK layer rather than relying on each implementation to remember.
+ *
+ * Example:
+ *   export const requirePayment = withPaymentTaint("payments.require", async (opts) => {
+ *     // ... actual implementation
+ *   });
+ */
+export declare function withPaymentTaint<TArgs extends unknown[], TReturn>(name: string, impl: (...args: TArgs) => TReturn): (...args: TArgs) => TReturn;
+//# sourceMappingURL=runtime-context.d.ts.map

package/dist/runtime-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-context.d.ts","sourceRoot":"","sources":["../src/runtime-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD;oCACoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;yBACqB;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;qDACiD;IACjD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;yDACqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb;;;uBAGmB;IACnB,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;KACxD,CAAC;IACF;;;oBAGgB;IAChB,kBAAkB,EAAE;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IACvC;;;8CAG0C;IAC1C,MAAM,EAAE;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;CAC5B;AAED;oEACoE;AACpE,eAAO,MAAM,GAAG,sCAA6C,CAAC;AAE9D;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,iBAAiB,GAAG,SAAS,CAEjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAC9B,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,GAAG,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,GAAG,QAAQ,CAAC,CAAC,EACrI,QAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC7B,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAOhB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IACzD,QAAQ,CAAC,IAAI,sCAAsC;IACnD,QAAQ,CAAC,IAAI,iEAAiE;IAC9E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,kBAAkB,CAAC;gBAEtC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,kBAAkB;CAc1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,CAS3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAKvC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAUjD,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,SAAS,OAAO,EAAE,EAAE,OAAO,EAC/D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,OAAO,GAChC,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,OAAO,CAe7B"}