@spfn/core 0.2.0-beta.51 → 0.2.0-beta.53

package/dist/event/sse/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/event/sse/handler.ts","../../../src/event/sse/token-manager.ts"],"names":[],"mappings":";;;;;AAyBA,IAAM,SAAA,GAAY,MAAA,CAAO,KAAA,CAAM,gBAAgB,CAAA;AAyBxC,SAAS,gBAAA,CACZ,MAAA,EACA,MAAA,GAA2B,IAC3B,YAAA,EAEJ;AACI,EAAA,MAAM;AAAA,IACF,YAAA,GAAe,GAAA;AAAA,IACf,IAAA,EAAM;AAAA,GACV,GAAI,MAAA;AAEJ,EAAA,OAAO,OAAO,CAAA,KACd;AAEI,IAAA,MAAM,OAAA,GAAU,MAAM,iBAAA,CAAkB,CAAA,EAAG,YAAY,CAAA;AACvD,IAAA,IAAI,YAAY,KAAA,EAChB;AACI,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,yBAAA,IAA6B,GAAG,CAAA;AAAA,IAC3D;AACA,IAAA,IAAI,YAAY,IAAA,EAChB;AACI,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,0BAAA,IAA8B,GAAG,CAAA;AAAA,IAC5D;AACA,IAAA,IAAI,OAAA,EACJ;AACI,MAAA,CAAA,CAAE,GAAA,CAAI,cAAc,OAAO,CAAA;AAAA,IAC/B;AAGA,IAAA,MAAM,eAAA,GAAkB,qBAAqB,CAAC,CAAA;AAC9C,IAAA,IAAI,CAAC,eAAA,EACL;AACI,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,0BAAA,IAA8B,GAAG,CAAA;AAAA,IAC5D;AAGA,IAAA,MAAM,kBAAkB,MAAA,CAAO,UAAA;AAC/B,IAAA,MAAM,aAAA,GAAgB,gBAAgB,MAAA,CAAO,CAAA,CAAA,KAAK,CAAC,eAAA,CAAgB,QAAA,CAAS,CAAC,CAAC,CAAA;AAE9E,IAAA,IAAI,aAAA,CAAc,SAAS,CAAA,EAC3B;AACI,MAAA,OAAO,EAAE,IAAA,CAAK;AAAA,QACV,KAAA,EAAO,qBAAA;AAAA,QACP,aAAA;AAAA,QACA,WAAA,EAAa;AAAA,SACd,GAAG,CAAA;AAAA,IACV;AAGA,IAAA,MAAM,aAAA,GAAgB,MAAM,eAAA,CAAgB,OAAA,EAAS,iBAAiB,UAAU,CAAA;AAChF,IAAA,IAAI,kBAAkB,IAAA,EACtB;AACI,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,yCAAA,IAA6C,GAAG,CAAA;AAAA,IAC3E;AAEA,IAAA,SAAA,CAAU,MAAM,0BAAA,EAA4B;AAAA,MACxC,MAAA,EAAQ,aAAA;AAAA,MACR,SAAS,OAAA,IAAW,MAAA;AAAA,MACpB,QAAA,EAAU,EAAE,GAAA,CAAI,MAAA,CAAO,iBAAiB,CAAA,IAAK,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,WAAW;AAAA,KACxE,CAAA;AAGD,IAAA,CAAA,CAAE,MAAA,CAAO,qBAAqB,IAAI,CAAA;AAElC,IAAA,OAAO,SAAA,CAAU,CAAA,EAAG,OAAO,MAAA,KAC3B;AACI,MAAA,MAAM,eAA+B,EAAC;AACtC,MAAA,IAAI,SAAA,GAAY,CAAA;AAChB,MAAA,IAAI,cAAA,GAAiB,KAAA;AACrB,MAAA,IAAI,SAAA;AAEJ,MAAA,MAAM,UAAU,MAChB;AACI,QAAA,IAAI,cAAA,EAAgB;AACpB,QAAA,cAAA,GAAiB,IAAA;AACjB,QAAA,aAAA,CAAc,SAAS,CAAA;AACvB,QAAA,YAAA,CAAa,OAAA,CAAQ,CAAA,EAAA,KAAM,EAAA,EAAI,CAAA;AAC/B,QAAA,SAAA,CAAU,KAAK,gCAAA,EAAkC;AAAA,UAC7C,MAAA,EAAQ;AAAA,SACX,CAAA;AAAA,MACL,CAAA;AAEA,MAAA,KAAA,MAAW,aAAa,aAAA,EACxB;AACI,QAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA;AAExC,QAAA,IAAI,CAAC,QAAA,EACL;AACI,UAAA;AAAA,QACJ;AAEA,QAAA,MAAM,WAAA,GAAc,QAAA,CAAS,SAAA,CAAU,CAAC,OAAA,KACxC;AACI,UAAA,IAAI,cAAA,EAAgB;AAGpB,UAAA,IAAI,OAAA,IAAW,UAAA,EAAY,MAAA,GAAS,SAAmB,CAAA,EACvD;AACI,YAAA,IAAI,CAAC,UAAA,CAAW,MAAA,CAAO,SAAmB,CAAA,CAAE,OAAA,EAAS,OAAO,CAAA,EAC5D;AACI,cAAA;AAAA,YACJ;AAAA,UACJ;AAEA,UAAA,SAAA,EAAA;AAEA,UAAA,MAAM,OAAA,GAAU;AAAA,YACZ,KAAA,EAAO,SAAA;AAAA,YACP,IAAA,EAAM;AAAA,WACV;AAEA,UAAA,SAAA,CAAU,MAAM,mBAAA,EAAqB;AAAA,YACjC,KAAA,EAAO,SAAA;AAAA,YACP;AAAA,WACH,CAAA;AAED,UAAA,MAAA,CAAO,QAAA,CAAS;AAAA,YACZ,EAAA,EAAI,OAAO,SAAS,CAAA;AAAA,YACpB,KAAA,EAAO,SAAA;AAAA,YACP,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,WAC/B,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KACV;AACI,YAAA,SAAA,CAAU,KAAK,kBAAA,EAAoB;AAAA,cAC/B,KAAA,EAAO,SAAA;AAAA,cACP,SAAA;AAAA,cACA,OAAO,GAAA,CAAI;AAAA,aACd,CAAA;AACD,YAAA,OAAA,EAAQ;AAAA,UACZ,CAAC,CAAA;AAAA,QACL,CAAC,CAAA;AAED,QAAA,YAAA,CAAa,KAAK,WAAW,CAAA;AAAA,MACjC;AAEA,MAAA,SAAA,CAAU,KAAK,4BAAA,EAA8B;AAAA,QACzC,MAAA,EAAQ,aAAA;AAAA,QACR,mBAAmB,YAAA,CAAa;AAAA,OACnC,CAAA;AAGD,MAAA,MAAM,OAAO,QAAA,CAAS;AAAA,QAClB,KAAA,EAAO,WAAA;AAAA,QACP,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,UACjB,gBAAA,EAAkB,aAAA;AAAA,UAClB,SAAA,EAAW,KAAK,GAAA;AAAI,SACvB;AAAA,OACJ,CAAA;AAGD,MAAA,SAAA,GAAY,YAAY,MACxB;AACI,QAAA,IAAI,cAAA,EAAgB;AAEpB,QAAA,MAAA,CAAO,QAAA,CAAS;AAAA,UACZ,KAAA,EAAO,MAAA;AAAA,UACP,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,WAAW,IAAA,CAAK,GAAA,IAAO;AAAA,SACjD,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KACV;AACI,UAAA,SAAA,CAAU,KAAK,iBAAA,EAAmB;AAAA,YAC9B,OAAO,GAAA,CAAI;AAAA,WACd,CAAA;AACD,UAAA,OAAA,EAAQ;AAAA,QACZ,CAAC,CAAA;AAAA,MACL,GAAG,YAAY,CAAA;AAGf,MAAA,MAAM,WAAA,GAAc,CAAA,CAAE,GAAA,CAAI,GAAA,CAAI,MAAA;AAE9B,MAAA,OAAO,CAAC,WAAA,CAAY,OAAA,IAAW,CAAC,cAAA,EAChC;AACI,QAAA,MAAM,MAAA,CAAO,MAAM,YAAY,CAAA;AAAA,MACnC;AAGA,MAAA,OAAA,EAAQ;AAAA,IACZ,CAAA,EAAG,OAAO,GAAA,KACV;AACI,MAAA,SAAA,CAAU,MAAM,kBAAA,EAAoB;AAAA,QAChC,OAAO,GAAA,CAAI;AAAA,OACd,CAAA;AAAA,IACL,CAAC,CAAA;AAAA,EACL,CAAA;AACJ;AAWA,eAAe,iBAAA,CACX,GACA,YAAA,EAEJ;AACI,EAAA,IAAI,CAAC,YAAA,EACL;AACI,IAAA,OAAO,MAAA;AAAA,EACX;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA;AACjC,EAAA,IAAI,CAAC,KAAA,EACL;AACI,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,OAAO,MAAM,YAAA,CAAa,MAAA,CAAO,KAAK,CAAA;AAC1C;AAKA,SAAS,qBAAqB,CAAA,EAC9B;AACI,EAAA,MAAM,WAAA,GAAc,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AACxC,EAAA,IAAI,CAAC,WAAA,EACL;AACI,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,OAAO,WAAA,CAAY,MAAM,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,KAAK,CAAA,CAAE,MAAM,CAAA;AACnD;AAMA,eAAe,eAAA,CACX,OAAA,EACA,eAAA,EACA,UAAA,EAEJ;AACI,EAAA,IAAI,CAAC,OAAA,IAAW,CAAC,UAAA,EAAY,SAAA,EAC7B;AACI,IAAA,OAAO,eAAA;AAAA,EACX;AAEA,EAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAW,SAAA,CAAU,SAAS,eAAe,CAAA;AAEnE,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EACvB;AACI,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,OAAO,OAAA;AACX;AC/MA,IAAM,qBAAN,MACA;AAAA,EACY,MAAA,uBAAa,GAAA,EAAsB;AAAA,EAE3C,MAAM,GAAA,CAAI,KAAA,EAAe,IAAA,EACzB;AACI,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAA,EAAO,IAAI,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,QAAQ,KAAA,EACd;AACI,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA;AAClC,IAAA,IAAI,CAAC,IAAA,EACL;AACI,MAAA,OAAO,IAAA;AAAA,IACX;AAEA,IAAA,IAAA,CAAK,MAAA,CAAO,OAAO,KAAK,CAAA;AAExB,IAAA,OAAO,IAAA;AAAA,EACX;AAAA,EAEA,MAAM,OAAA,GACN;AACI,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AAErB,IAAA,KAAA,MAAW,CAAC,KAAA,EAAO,IAAI,CAAA,IAAK,KAAK,MAAA,EACjC;AACI,MAAA,IAAI,IAAA,CAAK,aAAa,GAAA,EACtB;AACI,QAAA,IAAA,CAAK,MAAA,CAAO,OAAO,KAAK,CAAA;AAAA,MAC5B;AAAA,IACJ;AAAA,EACJ;AACJ,CAAA;AAuBO,IAAM,kBAAN,MACP;AAAA,EAGI,YAAoB,KAAA,EACpB;AADoB,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EACnB;AAAA,EAHO,MAAA,GAAS,YAAA;AAAA,EAKjB,MAAM,GAAA,CAAI,KAAA,EAAe,IAAA,EACzB;AACI,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAA,CAAA,CAAM,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,IAAK,GAAI,CAAC,CAAA;AAC9E,IAAA,MAAM,KAAK,KAAA,CAAM,GAAA;AAAA,MACb,KAAK,MAAA,GAAS,KAAA;AAAA,MACd,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,MACnB,IAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AAAA,EAEA,MAAM,QAAQ,KAAA,EACd;AACI,IAAA,MAAM,GAAA,GAAM,KAAK,MAAA,GAAS,KAAA;AAG1B,IAAA,IAAI,GAAA,GAAqB,IAAA;AAEzB,IAAA,IAAI,IAAA,CAAK,MAAM,MAAA,EACf;AACI,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA;AAAA,IACrC,CAAA,MAEA;AACI,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC9B,MAAA,IAAI,GAAA,EACJ;AACI,QAAA,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAAA,MAC5B;AAAA,IACJ;AAEA,IAAA,IAAI,CAAC,GAAA,EACL;AACI,MAAA,OAAO,IAAA;AAAA,IACX;AAEA,IAAA,OAAO,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB;AAAA,EAEA,MAAM,OAAA,GACN;AAAA,EAEA;AACJ;AAMO,IAAM,kBAAN,MACP;AAAA,EACY,KAAA;AAAA,EACA,GAAA;AAAA,EACA,YAAA,GAAsD,IAAA;AAAA,EAE9D,YAAY,MAAA,EACZ;AACI,IAAA,IAAA,CAAK,GAAA,GAAM,QAAQ,GAAA,IAAO,GAAA;AAC1B,IAAA,IAAA,CAAK,KAAA,GAAQ,MAAA,EAAQ,KAAA,IAAS,IAAI,kBAAA,EAAmB;AAErD,IAAA,MAAM,eAAA,GAAkB,QAAQ,eAAA,IAAmB,GAAA;AACnD,IAAA,IAAA,CAAK,YAAA,GAAe,YAAY,MAAM,KAAK,KAAK,KAAA,CAAM,OAAA,IAAW,eAAe,CAAA;AAChF,IAAA,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAM,OAAA,EACZ;AACI,IAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,KAAK,CAAA;AAE5C,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,KAAA,EAAO;AAAA,MACxB,KAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK;AAAA,KAChC,CAAA;AAED,IAAA,OAAO,KAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,KAAA,EACb;AACI,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,KAAA,CAAM,QAAQ,KAAK,CAAA;AAE3C,IAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,KAAI,EACxC;AACI,MAAA,OAAO,IAAA;AAAA,IACX;AAEA,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,GACA;AACI,IAAA,IAAI,KAAK,YAAA,EACT;AACI,MAAA,aAAA,CAAc,KAAK,YAAY,CAAA;AAC/B,MAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AAAA,IACxB;AAAA,EACJ;AACJ","file":"index.js","sourcesContent":["/**\n * SSE Handler for Hono\n *\n * Creates SSE stream endpoint for event subscription\n *\n * @example\n * ```typescript\n * import { Hono } from 'hono';\n * import { createSSEHandler } from '@spfn/core/event/sse';\n * import { eventRouter } from './events';\n *\n * const app = new Hono();\n *\n * // GET /events/stream?events=userCreated,orderPlaced\n * app.get('/events/stream', createSSEHandler(eventRouter));\n * ```\n */\n\nimport type { Context } from 'hono';\nimport { streamSSE } from 'hono/streaming';\nimport { logger } from '@spfn/core/logger';\nimport type { EventRouterDef, InferEventNames } from '../router';\nimport type { SSEHandlerConfig, SSEHandlerAuthConfig } from './types';\nimport type { SSETokenManager } from './token-manager';\n\nconst sseLogger = logger.child('@spfn/core:sse');\n\n// Extend Hono context with SSE subject\ndeclare module 'hono'\n{\n    interface ContextVariableMap\n    {\n        sseSubject?: string;\n    }\n}\n\n/**\n * Create SSE handler for Hono\n *\n * Query parameters:\n * - events: Comma-separated list of event names to subscribe\n * - token: One-time auth token (when auth is enabled)\n *\n * @example\n * ```typescript\n * app.get('/events/stream', createSSEHandler(eventRouter, {\n *     pingInterval: 30000,\n * }));\n * ```\n */\nexport function createSSEHandler<TRouter extends EventRouterDef<any>>(\n    router: TRouter,\n    config: SSEHandlerConfig = {},\n    tokenManager?: SSETokenManager,\n)\n{\n    const {\n        pingInterval = 30000,\n        auth: authConfig,\n    } = config;\n\n    return async (c: Context) =>\n    {\n        // ── 1. Token Authentication ──\n        const subject = await authenticateToken(c, tokenManager);\n        if (subject === false)\n        {\n            return c.json({ error: 'Missing token parameter' }, 401);\n        }\n        if (subject === null)\n        {\n            return c.json({ error: 'Invalid or expired token' }, 401);\n        }\n        if (subject)\n        {\n            c.set('sseSubject', subject);\n        }\n\n        // ── 2. Parse events from query parameter ──\n        const requestedEvents = parseRequestedEvents(c);\n        if (!requestedEvents)\n        {\n            return c.json({ error: 'Missing events parameter' }, 400);\n        }\n\n        // ── 3. Validate event names ──\n        const validEventNames = router.eventNames as string[];\n        const invalidEvents = requestedEvents.filter(e => !validEventNames.includes(e));\n\n        if (invalidEvents.length > 0)\n        {\n            return c.json({\n                error: 'Invalid event names',\n                invalidEvents,\n                validEvents: validEventNames,\n            }, 400);\n        }\n\n        // ── 4. Subscription Authorization ──\n        const allowedEvents = await authorizeEvents(subject, requestedEvents, authConfig);\n        if (allowedEvents === null)\n        {\n            return c.json({ error: 'Not authorized for any requested events' }, 403);\n        }\n\n        sseLogger.debug('SSE connection requested', {\n            events: allowedEvents,\n            subject: subject || undefined,\n            clientIp: c.req.header('x-forwarded-for') || c.req.header('x-real-ip'),\n        });\n\n        // ── 5. SSE Stream ──\n        c.header('X-Accel-Buffering', 'no');\n\n        return streamSSE(c, async (stream) =>\n        {\n            const unsubscribes: (() => void)[] = [];\n            let messageId = 0;\n            let connectionDead = false;\n            let pingTimer: ReturnType<typeof setInterval>;\n\n            const cleanup = () =>\n            {\n                if (connectionDead) return;\n                connectionDead = true;\n                clearInterval(pingTimer);\n                unsubscribes.forEach(fn => fn());\n                sseLogger.info('SSE dead connection cleaned up', {\n                    events: allowedEvents,\n                });\n            };\n\n            for (const eventName of allowedEvents as InferEventNames<TRouter>[])\n            {\n                const eventDef = router.events[eventName];\n\n                if (!eventDef)\n                {\n                    continue;\n                }\n\n                const unsubscribe = eventDef.subscribe((payload: unknown) =>\n                {\n                    if (connectionDead) return;\n\n                    // ── Payload Filtering ──\n                    if (subject && authConfig?.filter?.[eventName as string])\n                    {\n                        if (!authConfig.filter[eventName as string](subject, payload))\n                        {\n                            return;\n                        }\n                    }\n\n                    messageId++;\n\n                    const message = {\n                        event: eventName,\n                        data: payload,\n                    };\n\n                    sseLogger.debug('SSE sending event', {\n                        event: eventName,\n                        messageId,\n                    });\n\n                    stream.writeSSE({\n                        id: String(messageId),\n                        event: eventName as string,\n                        data: JSON.stringify(message),\n                    }).catch((err) =>\n                    {\n                        sseLogger.warn('SSE write failed', {\n                            event: eventName,\n                            messageId,\n                            error: err.message,\n                        });\n                        cleanup();\n                    });\n                });\n\n                unsubscribes.push(unsubscribe);\n            }\n\n            sseLogger.info('SSE connection established', {\n                events: allowedEvents,\n                subscriptionCount: unsubscribes.length,\n            });\n\n            // Send initial connection message\n            await stream.writeSSE({\n                event: 'connected',\n                data: JSON.stringify({\n                    subscribedEvents: allowedEvents,\n                    timestamp: Date.now(),\n                }),\n            });\n\n            // Keep-alive ping\n            pingTimer = setInterval(() =>\n            {\n                if (connectionDead) return;\n\n                stream.writeSSE({\n                    event: 'ping',\n                    data: JSON.stringify({ timestamp: Date.now() }),\n                }).catch((err) =>\n                {\n                    sseLogger.warn('SSE ping failed', {\n                        error: err.message,\n                    });\n                    cleanup();\n                });\n            }, pingInterval);\n\n            // Wait for client disconnect using abort signal\n            const abortSignal = c.req.raw.signal;\n\n            while (!abortSignal.aborted && !connectionDead)\n            {\n                await stream.sleep(pingInterval);\n            }\n\n            // Cleanup (normal disconnect path)\n            cleanup();\n        }, async (err: Error) =>\n        {\n            sseLogger.error('SSE stream error', {\n                error: err.message,\n            });\n        });\n    };\n}\n\n// ============================================================================\n// Helper Functions\n// ============================================================================\n\n/**\n * Authenticate via one-time token\n * @returns subject string if authenticated, undefined if no auth required,\n *          false if token missing, null if token invalid/expired\n */\nasync function authenticateToken(\n    c: Context,\n    tokenManager?: SSETokenManager,\n): Promise<string | undefined | false | null>\n{\n    if (!tokenManager)\n    {\n        return undefined;\n    }\n\n    const token = c.req.query('token');\n    if (!token)\n    {\n        return false;\n    }\n\n    return await tokenManager.verify(token);\n}\n\n/**\n * Parse requested events from query parameter\n */\nfunction parseRequestedEvents(c: Context): string[] | null\n{\n    const eventsParam = c.req.query('events');\n    if (!eventsParam)\n    {\n        return null;\n    }\n\n    return eventsParam.split(',').map(e => e.trim());\n}\n\n/**\n * Authorize event subscription via auth hook\n * @returns allowed events array, or null if rejected\n */\nasync function authorizeEvents(\n    subject: string | undefined,\n    requestedEvents: string[],\n    authConfig?: SSEHandlerAuthConfig,\n): Promise<string[] | null>\n{\n    if (!subject || !authConfig?.authorize)\n    {\n        return requestedEvents;\n    }\n\n    const allowed = await authConfig.authorize(subject, requestedEvents);\n\n    if (allowed.length === 0)\n    {\n        return null;\n    }\n\n    return allowed;\n}\n","/**\n * SSE Token Manager\n *\n * Auth-agnostic token issuance and verification for SSE connections.\n * Issues one-time-use tokens with TTL for Token Exchange pattern.\n *\n * @example\n * ```typescript\n * const manager = new SSETokenManager({ ttl: 30000 });\n *\n * // Issue token for authenticated user\n * const token = await manager.issue('user-123');\n *\n * // Verify and consume token (one-time use)\n * const subject = await manager.verify(token); // 'user-123'\n * const again = await manager.verify(token);   // null (already consumed)\n *\n * // Cleanup on shutdown\n * manager.destroy();\n * ```\n */\n\nimport { randomBytes } from 'crypto';\n\n/**\n * Minimal cache client interface (compatible with ioredis Redis | Cluster)\n */\ntype CacheClient = {\n    set(key: string, value: string, ...args: any[]): Promise<any>;\n    getdel?(key: string): Promise<string | null>;\n    get(key: string): Promise<string | null>;\n    del(...keys: string[]): Promise<number>;\n};\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * Stored SSE token data\n */\nexport interface SSEToken\n{\n    token: string;\n    subject: string;\n    expiresAt: number;\n}\n\n/**\n * Token storage interface\n *\n * Implement this for custom storage backends (e.g., Redis for multi-instance).\n */\nexport interface SSETokenStore\n{\n    /** Store a token */\n    set(token: string, data: SSEToken): Promise<void>;\n\n    /** Get and delete a token (one-time use) */\n    consume(token: string): Promise<SSEToken | null>;\n\n    /** Remove expired tokens */\n    cleanup(): Promise<void>;\n}\n\n/**\n * SSETokenManager configuration\n */\nexport interface SSETokenManagerConfig\n{\n    /**\n     * Token time-to-live in milliseconds\n     * @default 30000\n     */\n    ttl?: number;\n\n    /**\n     * Custom token store (default: in-memory Map)\n     */\n    store?: SSETokenStore;\n\n    /**\n     * Cleanup interval in milliseconds\n     * @default 60000\n     */\n    cleanupInterval?: number;\n}\n\n// ============================================================================\n// InMemoryTokenStore\n// ============================================================================\n\nclass InMemoryTokenStore implements SSETokenStore\n{\n    private tokens = new Map<string, SSEToken>();\n\n    async set(token: string, data: SSEToken): Promise<void>\n    {\n        this.tokens.set(token, data);\n    }\n\n    async consume(token: string): Promise<SSEToken | null>\n    {\n        const data = this.tokens.get(token);\n        if (!data)\n        {\n            return null;\n        }\n\n        this.tokens.delete(token);\n\n        return data;\n    }\n\n    async cleanup(): Promise<void>\n    {\n        const now = Date.now();\n\n        for (const [token, data] of this.tokens)\n        {\n            if (data.expiresAt <= now)\n            {\n                this.tokens.delete(token);\n            }\n        }\n    }\n}\n\n// ============================================================================\n// CacheTokenStore (Redis/Valkey)\n// ============================================================================\n\n/**\n * Redis/Valkey-backed token store for multi-instance deployments.\n *\n * Uses SET EX for automatic TTL expiry and GETDEL for atomic one-time consumption.\n * No cleanup needed — Redis handles expiration automatically.\n *\n * @example\n * ```typescript\n * import { getCache } from '@spfn/core/cache';\n *\n * const cache = getCache();\n * if (cache) {\n *     const store = new CacheTokenStore(cache);\n *     const manager = new SSETokenManager({ store });\n * }\n * ```\n */\nexport class CacheTokenStore implements SSETokenStore\n{\n    private prefix = 'sse:token:';\n\n    constructor(private cache: CacheClient) \n    {}\n\n    async set(token: string, data: SSEToken): Promise<void>\n    {\n        const ttlSeconds = Math.max(1, Math.ceil((data.expiresAt - Date.now()) / 1000));\n        await this.cache.set(\n            this.prefix + token,\n            JSON.stringify(data),\n            'EX',\n            ttlSeconds,\n        );\n    }\n\n    async consume(token: string): Promise<SSEToken | null>\n    {\n        const key = this.prefix + token;\n\n        // GETDEL (Redis 6.2+) for atomic consume, fallback to GET+DEL\n        let raw: string | null = null;\n\n        if (this.cache.getdel)\n        {\n            raw = await this.cache.getdel(key);\n        }\n        else\n        {\n            raw = await this.cache.get(key);\n            if (raw)\n            {\n                await this.cache.del(key);\n            }\n        }\n\n        if (!raw)\n        {\n            return null;\n        }\n\n        return JSON.parse(raw) as SSEToken;\n    }\n\n    async cleanup(): Promise<void>\n    {\n        // No-op: Redis TTL handles expiration automatically\n    }\n}\n\n// ============================================================================\n// SSETokenManager\n// ============================================================================\n\nexport class SSETokenManager\n{\n    private store: SSETokenStore;\n    private ttl: number;\n    private cleanupTimer: ReturnType<typeof setInterval> | null = null;\n\n    constructor(config?: SSETokenManagerConfig)\n    {\n        this.ttl = config?.ttl ?? 30000;\n        this.store = config?.store ?? new InMemoryTokenStore();\n\n        const cleanupInterval = config?.cleanupInterval ?? 60000;\n        this.cleanupTimer = setInterval(() => void this.store.cleanup(), cleanupInterval);\n        this.cleanupTimer.unref();\n    }\n\n    /**\n     * Issue a new one-time-use token for the given subject\n     */\n    async issue(subject: string): Promise<string>\n    {\n        const token = randomBytes(32).toString('hex');\n\n        await this.store.set(token, {\n            token,\n            subject,\n            expiresAt: Date.now() + this.ttl,\n        });\n\n        return token;\n    }\n\n    /**\n     * Verify and consume a token\n     * @returns subject string if valid, null if invalid/expired/already consumed\n     */\n    async verify(token: string): Promise<string | null>\n    {\n        const data = await this.store.consume(token);\n\n        if (!data || data.expiresAt <= Date.now())\n        {\n            return null;\n        }\n\n        return data.subject;\n    }\n\n    /**\n     * Cleanup timer and resources\n     */\n    destroy(): void\n    {\n        if (this.cleanupTimer)\n        {\n            clearInterval(this.cleanupTimer);\n            this.cleanupTimer = null;\n        }\n    }\n}\n"]}
+{"version":3,"sources":["../../../src/event/sse/bounded-writer.ts","../../../src/event/sse/handler.ts","../../../src/event/sse/token-manager.ts"],"names":[],"mappings":";;;;;;;AAgDO,SAAS,mBAAA,CACZ,MAAA,EACA,QAAA,EACA,OAAA,EAEJ;AACI,EAAA,MAAM,UAAsB,EAAC;AAC7B,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,IAAI,MAAA,GAAS,KAAA;AAEb,EAAA,MAAM,QAAQ,YACd;AACI,IAAA,IAAI,YAAY,MAAA,EAChB;AACI,MAAA;AAAA,IACJ;AAEA,IAAA,QAAA,GAAW,IAAA;AAEX,IAAA,OAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,IAAK,CAAC,MAAA,EAC9B;AACI,MAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,EAAM;AAC5B,MAAA,IACA;AACI,QAAA,MAAM,MAAA,CAAO,SAAS,KAAK,CAAA;AAAA,MAC/B,SACO,GAAA,EACP;AACI,QAAA,QAAA,GAAW,KAAA;AACX,QAAA,OAAA,CAAQ,eAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAExD,QAAA;AAAA,MACJ;AAAA,IACJ;AAEA,IAAA,QAAA,GAAW,KAAA;AAAA,EACf,CAAA;AAEA,EAAA,OAAO;AAAA,IACH,QAAQ,KAAA,EACR;AACI,MAAA,IAAI,MAAA,EACJ;AACI,QAAA;AAAA,MACJ;AAEA,MAAA,OAAA,CAAQ,KAAK,KAAK,CAAA;AAIlB,MAAA,IAAI,OAAA,CAAQ,SAAS,QAAA,EACrB;AACI,QAAA,OAAA,CAAQ,yCAAyC,CAAA;AAEjD,QAAA;AAAA,MACJ;AAEA,MAAA,KAAK,KAAA,EAAM;AAAA,IACf,CAAA;AAAA,IAEA,KAAA,GACA;AACI,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,OAAA,CAAQ,MAAA,GAAS,CAAA;AAAA,IACrB,CAAA;AAAA,IAEA,IAAI,MAAA,GACJ;AACI,MAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,IACnB;AAAA,GACJ;AACJ;;;AC7FA,IAAM,SAAA,GAAY,MAAA,CAAO,KAAA,CAAM,gBAAgB,CAAA;AAG/C,IAAM,iBAAA,GAAoB,GAAA;AAyBnB,SAAS,gBAAA,CACZ,MAAA,EACA,MAAA,GAA2B,IAC3B,YAAA,EAEJ;AACI,EAAA,MAAM;AAAA;AAAA;AAAA;AAAA,IAIF,YAAA,GAAe,GAAA;AAAA,IACf,IAAA,EAAM,UAAA;AAAA,IACN,QAAA,GAAW;AAAA,GACf,GAAI,MAAA;AAEJ,EAAA,OAAO,OAAO,CAAA,KACd;AAEI,IAAA,MAAM,OAAA,GAAU,MAAM,iBAAA,CAAkB,CAAA,EAAG,YAAY,CAAA;AACvD,IAAA,IAAI,YAAY,KAAA,EAChB;AACI,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,yBAAA,IAA6B,GAAG,CAAA;AAAA,IAC3D;AACA,IAAA,IAAI,YAAY,IAAA,EAChB;AACI,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,0BAAA,IAA8B,GAAG,CAAA;AAAA,IAC5D;AACA,IAAA,IAAI,OAAA,EACJ;AACI,MAAA,CAAA,CAAE,GAAA,CAAI,cAAc,OAAO,CAAA;AAAA,IAC/B;AAGA,IAAA,MAAM,eAAA,GAAkB,qBAAqB,CAAC,CAAA;AAC9C,IAAA,IAAI,CAAC,eAAA,EACL;AACI,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,0BAAA,IAA8B,GAAG,CAAA;AAAA,IAC5D;AAGA,IAAA,MAAM,kBAAkB,MAAA,CAAO,UAAA;AAC/B,IAAA,MAAM,aAAA,GAAgB,gBAAgB,MAAA,CAAO,CAAA,CAAA,KAAK,CAAC,eAAA,CAAgB,QAAA,CAAS,CAAC,CAAC,CAAA;AAE9E,IAAA,IAAI,aAAA,CAAc,SAAS,CAAA,EAC3B;AACI,MAAA,OAAO,EAAE,IAAA,CAAK;AAAA,QACV,KAAA,EAAO,qBAAA;AAAA,QACP,aAAA;AAAA,QACA,WAAA,EAAa;AAAA,SACd,GAAG,CAAA;AAAA,IACV;AAGA,IAAA,MAAM,aAAA,GAAgB,MAAM,eAAA,CAAgB,OAAA,EAAS,iBAAiB,UAAU,CAAA;AAChF,IAAA,IAAI,kBAAkB,IAAA,EACtB;AACI,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,yCAAA,IAA6C,GAAG,CAAA;AAAA,IAC3E;AAEA,IAAA,SAAA,CAAU,MAAM,0BAAA,EAA4B;AAAA,MACxC,MAAA,EAAQ,aAAA;AAAA,MACR,SAAS,OAAA,IAAW,MAAA;AAAA,MACpB,QAAA,EAAU,EAAE,GAAA,CAAI,MAAA,CAAO,iBAAiB,CAAA,IAAK,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,WAAW;AAAA,KACxE,CAAA;AAGD,IAAA,CAAA,CAAE,MAAA,CAAO,qBAAqB,IAAI,CAAA;AAElC,IAAA,OAAO,SAAA,CAAU,CAAA,EAAG,OAAO,MAAA,KAC3B;AACI,MAAA,MAAM,eAA+B,EAAC;AACtC,MAAA,IAAI,SAAA,GAAY,CAAA;AAChB,MAAA,IAAI,cAAA,GAAiB,KAAA;AACrB,MAAA,IAAI,SAAA;AACJ,MAAA,IAAI,MAAA;AAEJ,MAAA,MAAM,OAAA,GAAU,CAAC,MAAA,KACjB;AACI,QAAA,IAAI,cAAA,EAAgB;AACpB,QAAA,cAAA,GAAiB,IAAA;AACjB,QAAA,aAAA,CAAc,SAAS,CAAA;AACvB,QAAA,YAAA,CAAa,OAAA,CAAQ,CAAA,EAAA,KAAM,EAAA,EAAI,CAAA;AAC/B,QAAA,MAAA,EAAQ,KAAA,EAAM;AACd,QAAA,SAAA,CAAU,KAAK,gCAAA,EAAkC;AAAA,UAC7C,MAAA,EAAQ,aAAA;AAAA,UACR;AAAA,SACH,CAAA;AAAA,MACL,CAAA;AAIA,MAAA,MAAA,GAAS,mBAAA,CAAoB,MAAA,EAAQ,QAAA,EAAU,CAAC,MAAA,KAChD;AACI,QAAA,SAAA,CAAU,KAAK,uBAAA,EAAyB,EAAE,MAAA,EAAQ,aAAA,EAAe,QAAQ,CAAA;AACzE,QAAA,OAAA,CAAQ,MAAM,CAAA;AAAA,MAClB,CAAC,CAAA;AAGD,MAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,QACX,KAAA,EAAO,WAAA;AAAA,QACP,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,UACjB,gBAAA,EAAkB,aAAA;AAAA,UAClB,SAAA,EAAW,KAAK,GAAA;AAAI,SACvB;AAAA,OACJ,CAAA;AAED,MAAA,KAAA,MAAW,aAAa,aAAA,EACxB;AACI,QAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA;AAExC,QAAA,IAAI,CAAC,QAAA,EACL;AACI,UAAA;AAAA,QACJ;AAEA,QAAA,MAAM,WAAA,GAAc,QAAA,CAAS,SAAA,CAAU,CAAC,OAAA,KACxC;AACI,UAAA,IAAI,cAAA,EAAgB;AAGpB,UAAA,IAAI,OAAA,IAAW,UAAA,EAAY,MAAA,GAAS,SAAmB,CAAA,EACvD;AACI,YAAA,IAAI,CAAC,UAAA,CAAW,MAAA,CAAO,SAAmB,CAAA,CAAE,OAAA,EAAS,OAAO,CAAA,EAC5D;AACI,cAAA;AAAA,YACJ;AAAA,UACJ;AAEA,UAAA,SAAA,EAAA;AAEA,UAAA,MAAM,OAAA,GAAU;AAAA,YACZ,KAAA,EAAO,SAAA;AAAA,YACP,IAAA,EAAM;AAAA,WACV;AAEA,UAAA,SAAA,CAAU,MAAM,mBAAA,EAAqB;AAAA,YACjC,KAAA,EAAO,SAAA;AAAA,YACP;AAAA,WACH,CAAA;AAED,UAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,YACX,EAAA,EAAI,OAAO,SAAS,CAAA;AAAA,YACpB,KAAA,EAAO,SAAA;AAAA,YACP,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,WAC/B,CAAA;AAAA,QACL,CAAC,CAAA;AAED,QAAA,YAAA,CAAa,KAAK,WAAW,CAAA;AAAA,MACjC;AAEA,MAAA,SAAA,CAAU,KAAK,4BAAA,EAA8B;AAAA,QACzC,MAAA,EAAQ,aAAA;AAAA,QACR,mBAAmB,YAAA,CAAa;AAAA,OACnC,CAAA;AAGD,MAAA,SAAA,GAAY,YAAY,MACxB;AACI,QAAA,IAAI,cAAA,EAAgB;AAEpB,QAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,UACX,KAAA,EAAO,MAAA;AAAA,UACP,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,WAAW,IAAA,CAAK,GAAA,IAAO;AAAA,SACjD,CAAA;AAAA,MACL,GAAG,YAAY,CAAA;AAGf,MAAA,MAAM,WAAA,GAAc,CAAA,CAAE,GAAA,CAAI,GAAA,CAAI,MAAA;AAE9B,MAAA,OAAO,CAAC,WAAA,CAAY,OAAA,IAAW,CAAC,cAAA,EAChC;AACI,QAAA,MAAM,MAAA,CAAO,MAAM,YAAY,CAAA;AAAA,MACnC;AAGA,MAAA,OAAA,EAAQ;AAAA,IACZ,CAAA,EAAG,OAAO,GAAA,KACV;AACI,MAAA,SAAA,CAAU,MAAM,kBAAA,EAAoB;AAAA,QAChC,OAAO,GAAA,CAAI;AAAA,OACd,CAAA;AAAA,IACL,CAAC,CAAA;AAAA,EACL,CAAA;AACJ;AAWA,eAAe,iBAAA,CACX,GACA,YAAA,EAEJ;AACI,EAAA,IAAI,CAAC,YAAA,EACL;AACI,IAAA,OAAO,MAAA;AAAA,EACX;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA;AACjC,EAAA,IAAI,CAAC,KAAA,EACL;AACI,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,OAAO,MAAM,YAAA,CAAa,MAAA,CAAO,KAAK,CAAA;AAC1C;AAKA,SAAS,qBAAqB,CAAA,EAC9B;AACI,EAAA,MAAM,WAAA,GAAc,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AACxC,EAAA,IAAI,CAAC,WAAA,EACL;AACI,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,OAAO,WAAA,CAAY,MAAM,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,KAAK,CAAA,CAAE,MAAM,CAAA;AACnD;AAMA,eAAe,eAAA,CACX,OAAA,EACA,eAAA,EACA,UAAA,EAEJ;AACI,EAAA,IAAI,CAAC,OAAA,IAAW,CAAC,UAAA,EAAY,SAAA,EAC7B;AACI,IAAA,OAAO,eAAA;AAAA,EACX;AAEA,EAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAW,SAAA,CAAU,SAAS,eAAe,CAAA;AAEnE,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EACvB;AACI,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,OAAO,OAAA;AACX;ACpNA,IAAM,qBAAN,MACA;AAAA,EACY,MAAA,uBAAa,GAAA,EAAsB;AAAA,EAE3C,MAAM,GAAA,CAAI,KAAA,EAAe,IAAA,EACzB;AACI,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAA,EAAO,IAAI,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,QAAQ,KAAA,EACd;AACI,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA;AAClC,IAAA,IAAI,CAAC,IAAA,EACL;AACI,MAAA,OAAO,IAAA;AAAA,IACX;AAEA,IAAA,IAAA,CAAK,MAAA,CAAO,OAAO,KAAK,CAAA;AAExB,IAAA,OAAO,IAAA;AAAA,EACX;AAAA,EAEA,MAAM,OAAA,GACN;AACI,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AAErB,IAAA,KAAA,MAAW,CAAC,KAAA,EAAO,IAAI,CAAA,IAAK,KAAK,MAAA,EACjC;AACI,MAAA,IAAI,IAAA,CAAK,aAAa,GAAA,EACtB;AACI,QAAA,IAAA,CAAK,MAAA,CAAO,OAAO,KAAK,CAAA;AAAA,MAC5B;AAAA,IACJ;AAAA,EACJ;AACJ,CAAA;AAuBO,IAAM,kBAAN,MACP;AAAA,EAGI,YAAoB,KAAA,EACpB;AADoB,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EACnB;AAAA,EAHO,MAAA,GAAS,YAAA;AAAA,EAKjB,MAAM,GAAA,CAAI,KAAA,EAAe,IAAA,EACzB;AACI,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAA,CAAA,CAAM,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,IAAK,GAAI,CAAC,CAAA;AAC9E,IAAA,MAAM,KAAK,KAAA,CAAM,GAAA;AAAA,MACb,KAAK,MAAA,GAAS,KAAA;AAAA,MACd,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,MACnB,IAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AAAA,EAEA,MAAM,QAAQ,KAAA,EACd;AACI,IAAA,MAAM,GAAA,GAAM,KAAK,MAAA,GAAS,KAAA;AAG1B,IAAA,IAAI,GAAA,GAAqB,IAAA;AAEzB,IAAA,IAAI,IAAA,CAAK,MAAM,MAAA,EACf;AACI,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA;AAAA,IACrC,CAAA,MAEA;AACI,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC9B,MAAA,IAAI,GAAA,EACJ;AACI,QAAA,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAAA,MAC5B;AAAA,IACJ;AAEA,IAAA,IAAI,CAAC,GAAA,EACL;AACI,MAAA,OAAO,IAAA;AAAA,IACX;AAEA,IAAA,OAAO,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB;AAAA,EAEA,MAAM,OAAA,GACN;AAAA,EAEA;AACJ;AAMO,IAAM,kBAAN,MACP;AAAA,EACY,KAAA;AAAA,EACA,GAAA;AAAA,EACA,YAAA,GAAsD,IAAA;AAAA,EAE9D,YAAY,MAAA,EACZ;AACI,IAAA,IAAA,CAAK,GAAA,GAAM,QAAQ,GAAA,IAAO,GAAA;AAC1B,IAAA,IAAA,CAAK,KAAA,GAAQ,MAAA,EAAQ,KAAA,IAAS,IAAI,kBAAA,EAAmB;AAErD,IAAA,MAAM,eAAA,GAAkB,QAAQ,eAAA,IAAmB,GAAA;AACnD,IAAA,IAAA,CAAK,YAAA,GAAe,YAAY,MAAM,KAAK,KAAK,KAAA,CAAM,OAAA,IAAW,eAAe,CAAA;AAChF,IAAA,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAM,OAAA,EACZ;AACI,IAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,KAAK,CAAA;AAE5C,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,KAAA,EAAO;AAAA,MACxB,KAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK;AAAA,KAChC,CAAA;AAED,IAAA,OAAO,KAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,KAAA,EACb;AACI,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,KAAA,CAAM,QAAQ,KAAK,CAAA;AAE3C,IAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,KAAI,EACxC;AACI,MAAA,OAAO,IAAA;AAAA,IACX;AAEA,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,GACA;AACI,IAAA,IAAI,KAAK,YAAA,EACT;AACI,MAAA,aAAA,CAAc,KAAK,YAAY,CAAA;AAC/B,MAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AAAA,IACxB;AAAA,EACJ;AACJ","file":"index.js","sourcesContent":["/**\n * Bounded SSE outbound writer\n *\n * Serializes writes to one SSE stream through a single drain loop that `await`s\n * each `writeSSE` — so a slow client applies real backpressure instead of letting\n * frames pile up unbounded in memory (OOM under a fast producer + slow consumer).\n *\n * The queue is per-connection, so a slow stream never blocks other connections.\n * When the queue exceeds `maxQueue`, the connection is closed (via `onClose`)\n * rather than silently dropping frames — dropping a chunk would corrupt an\n * ordered token/chat stream; the client reconnects and re-fetches instead.\n */\n\n/** A frame to write to the SSE stream (subset of Hono's SSEMessage). */\nexport interface SSEFrame\n{\n    data: string;\n    event?: string;\n    id?: string;\n}\n\n/** Minimal stream surface this writer needs (Hono's SSEStreamingApi satisfies it). */\nexport interface SSEWritable\n{\n    writeSSE(message: SSEFrame): Promise<void>;\n}\n\nexport interface BoundedWriter\n{\n    /** Queue a frame for delivery; closes the connection if the queue overflows. */\n    enqueue(frame: SSEFrame): void;\n\n    /** Stop draining and drop any queued frames (called on connection cleanup). */\n    close(): void;\n\n    /** Current queue depth (for tests/diagnostics). */\n    readonly queued: number;\n}\n\n/**\n * Create a bounded, backpressure-aware writer for one SSE stream.\n *\n * @param stream   the SSE stream (`writeSSE` returns a promise that resolves when\n *                 the socket has drained — that is what gives us backpressure)\n * @param maxQueue max frames buffered before the connection is closed\n * @param onClose  called once when the writer closes the connection (overflow or\n *                 a write error); the caller cleans up and logs\n */\nexport function createBoundedWriter(\n    stream: SSEWritable,\n    maxQueue: number,\n    onClose: (reason: string) => void,\n): BoundedWriter\n{\n    const pending: SSEFrame[] = [];\n    let flushing = false;\n    let closed = false;\n\n    const flush = async (): Promise<void> =>\n    {\n        if (flushing || closed)\n        {\n            return;\n        }\n\n        flushing = true;\n\n        while (pending.length > 0 && !closed)\n        {\n            const frame = pending.shift() as SSEFrame;\n            try\n            {\n                await stream.writeSSE(frame);\n            }\n            catch (err)\n            {\n                flushing = false;\n                onClose(err instanceof Error ? err.message : String(err));\n\n                return;\n            }\n        }\n\n        flushing = false;\n    };\n\n    return {\n        enqueue(frame: SSEFrame): void\n        {\n            if (closed)\n            {\n                return;\n            }\n\n            pending.push(frame);\n\n            // Slow consumer: the drain loop can't keep up, so the queue grew past\n            // the bound. Close rather than buffer unboundedly or drop silently.\n            if (pending.length > maxQueue)\n            {\n                onClose('outbound queue overflow (slow consumer)');\n\n                return;\n            }\n\n            void flush();\n        },\n\n        close(): void\n        {\n            closed = true;\n            pending.length = 0;\n        },\n\n        get queued(): number\n        {\n            return pending.length;\n        },\n    };\n}\n","/**\n * SSE Handler for Hono\n *\n * Creates SSE stream endpoint for event subscription\n *\n * @example\n * ```typescript\n * import { Hono } from 'hono';\n * import { createSSEHandler } from '@spfn/core/event/sse';\n * import { eventRouter } from './events';\n *\n * const app = new Hono();\n *\n * // GET /events/stream?events=userCreated,orderPlaced\n * app.get('/events/stream', createSSEHandler(eventRouter));\n * ```\n */\n\nimport type { Context } from 'hono';\nimport { streamSSE } from 'hono/streaming';\nimport { logger } from '@spfn/core/logger';\nimport type { EventRouterDef, InferEventNames } from '../router';\nimport type { SSEHandlerConfig, SSEHandlerAuthConfig } from './types';\nimport type { SSETokenManager } from './token-manager';\nimport { createBoundedWriter } from './bounded-writer';\n\nconst sseLogger = logger.child('@spfn/core:sse');\n\n/** Default outbound queue cap per connection before a slow consumer is dropped. */\nconst DEFAULT_MAX_QUEUE = 1000;\n\n// Extend Hono context with SSE subject\ndeclare module 'hono'\n{\n    interface ContextVariableMap\n    {\n        sseSubject?: string;\n    }\n}\n\n/**\n * Create SSE handler for Hono\n *\n * Query parameters:\n * - events: Comma-separated list of event names to subscribe\n * - token: One-time auth token (when auth is enabled)\n *\n * @example\n * ```typescript\n * app.get('/events/stream', createSSEHandler(eventRouter, {\n *     pingInterval: 30000,\n * }));\n * ```\n */\nexport function createSSEHandler<TRouter extends EventRouterDef<any>>(\n    router: TRouter,\n    config: SSEHandlerConfig = {},\n    tokenManager?: SSETokenManager,\n)\n{\n    const {\n        // 10s — keep-alive가 중간 프록시(GCP LB/nginx)의 idle 타임아웃(흔히 ~15-30s)보다 자주 와야\n        // 첫 ping 전 침묵 구간에 연결이 끊기지 않는다. 30s 기본은 idle 타임아웃보다 길어 SSE가\n        // 데이터 없는 동안 끊기던 문제가 있었다.\n        pingInterval = 10000,\n        auth: authConfig,\n        maxQueue = DEFAULT_MAX_QUEUE,\n    } = config;\n\n    return async (c: Context) =>\n    {\n        // ── 1. Token Authentication ──\n        const subject = await authenticateToken(c, tokenManager);\n        if (subject === false)\n        {\n            return c.json({ error: 'Missing token parameter' }, 401);\n        }\n        if (subject === null)\n        {\n            return c.json({ error: 'Invalid or expired token' }, 401);\n        }\n        if (subject)\n        {\n            c.set('sseSubject', subject);\n        }\n\n        // ── 2. Parse events from query parameter ──\n        const requestedEvents = parseRequestedEvents(c);\n        if (!requestedEvents)\n        {\n            return c.json({ error: 'Missing events parameter' }, 400);\n        }\n\n        // ── 3. Validate event names ──\n        const validEventNames = router.eventNames as string[];\n        const invalidEvents = requestedEvents.filter(e => !validEventNames.includes(e));\n\n        if (invalidEvents.length > 0)\n        {\n            return c.json({\n                error: 'Invalid event names',\n                invalidEvents,\n                validEvents: validEventNames,\n            }, 400);\n        }\n\n        // ── 4. Subscription Authorization ──\n        const allowedEvents = await authorizeEvents(subject, requestedEvents, authConfig);\n        if (allowedEvents === null)\n        {\n            return c.json({ error: 'Not authorized for any requested events' }, 403);\n        }\n\n        sseLogger.debug('SSE connection requested', {\n            events: allowedEvents,\n            subject: subject || undefined,\n            clientIp: c.req.header('x-forwarded-for') || c.req.header('x-real-ip'),\n        });\n\n        // ── 5. SSE Stream ──\n        c.header('X-Accel-Buffering', 'no');\n\n        return streamSSE(c, async (stream) =>\n        {\n            const unsubscribes: (() => void)[] = [];\n            let messageId = 0;\n            let connectionDead = false;\n            let pingTimer: ReturnType<typeof setInterval>;\n            let writer: ReturnType<typeof createBoundedWriter>;\n\n            const cleanup = (reason?: string) =>\n            {\n                if (connectionDead) return;\n                connectionDead = true;\n                clearInterval(pingTimer);\n                unsubscribes.forEach(fn => fn());\n                writer?.close();\n                sseLogger.info('SSE dead connection cleaned up', {\n                    events: allowedEvents,\n                    reason,\n                });\n            };\n\n            // All writes go through one bounded, backpressure-aware drain loop so a\n            // slow client can't pile frames up in memory (it's closed on overflow).\n            writer = createBoundedWriter(stream, maxQueue, (reason) =>\n            {\n                sseLogger.warn('SSE connection closed', { events: allowedEvents, reason });\n                cleanup(reason);\n            });\n\n            // Send initial connection message (first frame in the queue).\n            writer.enqueue({\n                event: 'connected',\n                data: JSON.stringify({\n                    subscribedEvents: allowedEvents,\n                    timestamp: Date.now(),\n                }),\n            });\n\n            for (const eventName of allowedEvents as InferEventNames<TRouter>[])\n            {\n                const eventDef = router.events[eventName];\n\n                if (!eventDef)\n                {\n                    continue;\n                }\n\n                const unsubscribe = eventDef.subscribe((payload: unknown) =>\n                {\n                    if (connectionDead) return;\n\n                    // ── Payload Filtering ──\n                    if (subject && authConfig?.filter?.[eventName as string])\n                    {\n                        if (!authConfig.filter[eventName as string](subject, payload))\n                        {\n                            return;\n                        }\n                    }\n\n                    messageId++;\n\n                    const message = {\n                        event: eventName,\n                        data: payload,\n                    };\n\n                    sseLogger.debug('SSE sending event', {\n                        event: eventName,\n                        messageId,\n                    });\n\n                    writer.enqueue({\n                        id: String(messageId),\n                        event: eventName as string,\n                        data: JSON.stringify(message),\n                    });\n                });\n\n                unsubscribes.push(unsubscribe);\n            }\n\n            sseLogger.info('SSE connection established', {\n                events: allowedEvents,\n                subscriptionCount: unsubscribes.length,\n            });\n\n            // Keep-alive ping\n            pingTimer = setInterval(() =>\n            {\n                if (connectionDead) return;\n\n                writer.enqueue({\n                    event: 'ping',\n                    data: JSON.stringify({ timestamp: Date.now() }),\n                });\n            }, pingInterval);\n\n            // Wait for client disconnect using abort signal\n            const abortSignal = c.req.raw.signal;\n\n            while (!abortSignal.aborted && !connectionDead)\n            {\n                await stream.sleep(pingInterval);\n            }\n\n            // Cleanup (normal disconnect path)\n            cleanup();\n        }, async (err: Error) =>\n        {\n            sseLogger.error('SSE stream error', {\n                error: err.message,\n            });\n        });\n    };\n}\n\n// ============================================================================\n// Helper Functions\n// ============================================================================\n\n/**\n * Authenticate via one-time token\n * @returns subject string if authenticated, undefined if no auth required,\n *          false if token missing, null if token invalid/expired\n */\nasync function authenticateToken(\n    c: Context,\n    tokenManager?: SSETokenManager,\n): Promise<string | undefined | false | null>\n{\n    if (!tokenManager)\n    {\n        return undefined;\n    }\n\n    const token = c.req.query('token');\n    if (!token)\n    {\n        return false;\n    }\n\n    return await tokenManager.verify(token);\n}\n\n/**\n * Parse requested events from query parameter\n */\nfunction parseRequestedEvents(c: Context): string[] | null\n{\n    const eventsParam = c.req.query('events');\n    if (!eventsParam)\n    {\n        return null;\n    }\n\n    return eventsParam.split(',').map(e => e.trim());\n}\n\n/**\n * Authorize event subscription via auth hook\n * @returns allowed events array, or null if rejected\n */\nasync function authorizeEvents(\n    subject: string | undefined,\n    requestedEvents: string[],\n    authConfig?: SSEHandlerAuthConfig,\n): Promise<string[] | null>\n{\n    if (!subject || !authConfig?.authorize)\n    {\n        return requestedEvents;\n    }\n\n    const allowed = await authConfig.authorize(subject, requestedEvents);\n\n    if (allowed.length === 0)\n    {\n        return null;\n    }\n\n    return allowed;\n}\n","/**\n * SSE Token Manager\n *\n * Auth-agnostic token issuance and verification for SSE connections.\n * Issues one-time-use tokens with TTL for Token Exchange pattern.\n *\n * @example\n * ```typescript\n * const manager = new SSETokenManager({ ttl: 30000 });\n *\n * // Issue token for authenticated user\n * const token = await manager.issue('user-123');\n *\n * // Verify and consume token (one-time use)\n * const subject = await manager.verify(token); // 'user-123'\n * const again = await manager.verify(token);   // null (already consumed)\n *\n * // Cleanup on shutdown\n * manager.destroy();\n * ```\n */\n\nimport { randomBytes } from 'crypto';\n\n/**\n * Minimal cache client interface (compatible with ioredis Redis | Cluster)\n */\ntype CacheClient = {\n    set(key: string, value: string, ...args: any[]): Promise<any>;\n    getdel?(key: string): Promise<string | null>;\n    get(key: string): Promise<string | null>;\n    del(...keys: string[]): Promise<number>;\n};\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * Stored SSE token data\n */\nexport interface SSEToken\n{\n    token: string;\n    subject: string;\n    expiresAt: number;\n}\n\n/**\n * Token storage interface\n *\n * Implement this for custom storage backends (e.g., Redis for multi-instance).\n */\nexport interface SSETokenStore\n{\n    /** Store a token */\n    set(token: string, data: SSEToken): Promise<void>;\n\n    /** Get and delete a token (one-time use) */\n    consume(token: string): Promise<SSEToken | null>;\n\n    /** Remove expired tokens */\n    cleanup(): Promise<void>;\n}\n\n/**\n * SSETokenManager configuration\n */\nexport interface SSETokenManagerConfig\n{\n    /**\n     * Token time-to-live in milliseconds\n     * @default 30000\n     */\n    ttl?: number;\n\n    /**\n     * Custom token store (default: in-memory Map)\n     */\n    store?: SSETokenStore;\n\n    /**\n     * Cleanup interval in milliseconds\n     * @default 60000\n     */\n    cleanupInterval?: number;\n}\n\n// ============================================================================\n// InMemoryTokenStore\n// ============================================================================\n\nclass InMemoryTokenStore implements SSETokenStore\n{\n    private tokens = new Map<string, SSEToken>();\n\n    async set(token: string, data: SSEToken): Promise<void>\n    {\n        this.tokens.set(token, data);\n    }\n\n    async consume(token: string): Promise<SSEToken | null>\n    {\n        const data = this.tokens.get(token);\n        if (!data)\n        {\n            return null;\n        }\n\n        this.tokens.delete(token);\n\n        return data;\n    }\n\n    async cleanup(): Promise<void>\n    {\n        const now = Date.now();\n\n        for (const [token, data] of this.tokens)\n        {\n            if (data.expiresAt <= now)\n            {\n                this.tokens.delete(token);\n            }\n        }\n    }\n}\n\n// ============================================================================\n// CacheTokenStore (Redis/Valkey)\n// ============================================================================\n\n/**\n * Redis/Valkey-backed token store for multi-instance deployments.\n *\n * Uses SET EX for automatic TTL expiry and GETDEL for atomic one-time consumption.\n * No cleanup needed — Redis handles expiration automatically.\n *\n * @example\n * ```typescript\n * import { getCache } from '@spfn/core/cache';\n *\n * const cache = getCache();\n * if (cache) {\n *     const store = new CacheTokenStore(cache);\n *     const manager = new SSETokenManager({ store });\n * }\n * ```\n */\nexport class CacheTokenStore implements SSETokenStore\n{\n    private prefix = 'sse:token:';\n\n    constructor(private cache: CacheClient) \n    {}\n\n    async set(token: string, data: SSEToken): Promise<void>\n    {\n        const ttlSeconds = Math.max(1, Math.ceil((data.expiresAt - Date.now()) / 1000));\n        await this.cache.set(\n            this.prefix + token,\n            JSON.stringify(data),\n            'EX',\n            ttlSeconds,\n        );\n    }\n\n    async consume(token: string): Promise<SSEToken | null>\n    {\n        const key = this.prefix + token;\n\n        // GETDEL (Redis 6.2+) for atomic consume, fallback to GET+DEL\n        let raw: string | null = null;\n\n        if (this.cache.getdel)\n        {\n            raw = await this.cache.getdel(key);\n        }\n        else\n        {\n            raw = await this.cache.get(key);\n            if (raw)\n            {\n                await this.cache.del(key);\n            }\n        }\n\n        if (!raw)\n        {\n            return null;\n        }\n\n        return JSON.parse(raw) as SSEToken;\n    }\n\n    async cleanup(): Promise<void>\n    {\n        // No-op: Redis TTL handles expiration automatically\n    }\n}\n\n// ============================================================================\n// SSETokenManager\n// ============================================================================\n\nexport class SSETokenManager\n{\n    private store: SSETokenStore;\n    private ttl: number;\n    private cleanupTimer: ReturnType<typeof setInterval> | null = null;\n\n    constructor(config?: SSETokenManagerConfig)\n    {\n        this.ttl = config?.ttl ?? 30000;\n        this.store = config?.store ?? new InMemoryTokenStore();\n\n        const cleanupInterval = config?.cleanupInterval ?? 60000;\n        this.cleanupTimer = setInterval(() => void this.store.cleanup(), cleanupInterval);\n        this.cleanupTimer.unref();\n    }\n\n    /**\n     * Issue a new one-time-use token for the given subject\n     */\n    async issue(subject: string): Promise<string>\n    {\n        const token = randomBytes(32).toString('hex');\n\n        await this.store.set(token, {\n            token,\n            subject,\n            expiresAt: Date.now() + this.ttl,\n        });\n\n        return token;\n    }\n\n    /**\n     * Verify and consume a token\n     * @returns subject string if valid, null if invalid/expired/already consumed\n     */\n    async verify(token: string): Promise<string | null>\n    {\n        const data = await this.store.consume(token);\n\n        if (!data || data.expiresAt <= Date.now())\n        {\n            return null;\n        }\n\n        return data.subject;\n    }\n\n    /**\n     * Cleanup timer and resources\n     */\n    destroy(): void\n    {\n        if (this.cleanupTimer)\n        {\n            clearInterval(this.cleanupTimer);\n            this.cleanupTimer = null;\n        }\n    }\n}\n"]}

package/dist/event/ws/client.d.ts

@@ -1,6 +1,6 @@
-import { W as WSRouterDef, k as WSSubscribeOptions, l as WSUnsubscribe, i as WSConnectionState, h as WSClientConfig } from '../../types-Cfj--lfr.js';
+import { W as WSRouterDef, k as WSSubscribeOptions, l as WSUnsubscribe, i as WSConnectionState, h as WSClientConfig } from '../../types-CKsmzaB8.js';
 import 'hono';
-import '../../token-manager-CyG7la3p.js';
+import '../../token-manager-C2Ag5-s8.js';
 import '@sinclair/typebox';
 
 /**

package/dist/event/ws/index.d.ts

@@ -1,6 +1,6 @@
-import { a as EventDef, S as SSETokenManager } from '../../token-manager-CyG7la3p.js';
-import { b as WSMessageHandlers, W as WSRouterDef, a as WSHandlerConfig } from '../../types-Cfj--lfr.js';
-export { c as WSAuthConfig, h as WSClientConfig, i as WSConnectionState, j as WSEventHandlers, d as WSHandlerAuthConfig, e as WSMessageContext, f as WSMessageHandlerFn, g as WSRawConnection, k as WSSubscribeOptions, l as WSUnsubscribe } from '../../types-Cfj--lfr.js';
+import { a as EventDef, S as SSETokenManager } from '../../token-manager-C2Ag5-s8.js';
+import { b as WSMessageHandlers, W as WSRouterDef, a as WSHandlerConfig } from '../../types-CKsmzaB8.js';
+export { c as WSAuthConfig, h as WSClientConfig, i as WSConnectionState, j as WSEventHandlers, d as WSHandlerAuthConfig, e as WSMessageContext, f as WSMessageHandlerFn, g as WSRawConnection, k as WSSubscribeOptions, l as WSUnsubscribe } from '../../types-CKsmzaB8.js';
 import { Server } from 'node:http';
 import '@sinclair/typebox';
 import 'hono';

package/dist/middleware/index.d.ts

@@ -1,4 +1,4 @@
-import { Context, Next } from 'hono';
+import { Context, Next, MiddlewareHandler } from 'hono';
 
 /**
  * Error Handler Middleware
@@ -161,4 +161,111 @@ declare function maskSensitiveData(obj: any, sensitiveFields: string[], seen?: W
  */
 declare function RequestLogger(options?: RequestLoggerOptions): (c: Context, next: Next) => Promise<void>;
 
-export { ErrorHandler, type ErrorHandlerOptions, type OnErrorContext, RequestLogger, type RequestLoggerConfig, type RequestLoggerOptions, maskSensitiveData };
+/**
+ * Proxy-guard middleware
+ *
+ * Verifies that an inbound request came through a trusted Next.js RPC proxy
+ * (HMAC signature) and/or from an allowed browser origin, then tags the request
+ * with a `clientType`. Lets the backend reject direct-to-backend calls that
+ * bypass the proxy.
+ *
+ * This does NOT replace user authentication (JWT) — it answers "what kind of
+ * client is this?", not "who is the user?". It also cannot stop a client from
+ * calling the proxy itself; that is the web's inherent limit (see
+ * PROXY-BACKEND-AUTH-SPEC.md). Mobile clients call the backend directly and are
+ * handled by a future attestation path, OR'd into this same check.
+ *
+ * @module middleware/proxy-guard
+ */
+
+/**
+ * How the request reached the backend.
+ * - `web`: verified via a trusted proxy signature
+ * - `untrusted`: could not be verified (only reached handlers in `tag` mode)
+ * - future: `ios` | `android` once attestation lands
+ */
+type ClientType = 'web' | 'untrusted' | (string & {});
+/**
+ * Enforcement mode.
+ * - `off`: middleware is a no-op (default — keeps existing apps working).
+ * - `tag`: verify and set `clientType`, but never reject (observe first).
+ * - `strict`: reject requests that fail verification.
+ */
+type ProxyGuardMode = 'off' | 'tag' | 'strict';
+/**
+ * Optional replay store. Returns `true` when the nonce is fresh (and records it),
+ * `false` when it has been seen before. Backed by Redis in multi-instance setups.
+ */
+interface NonceStore {
+    checkAndSet(nonce: string, ttlMs: number): Promise<boolean>;
+}
+interface ProxyGuardConfig {
+    /**
+     * Active shared HMAC secret, as `<keyId>:<secret>` (or a bare secret).
+     * Defaults to `env.SPFN_PROXY_SECRET`. Without it (and no previous keys),
+     * signatures cannot be verified and every request is tagged `untrusted`.
+     */
+    secret?: string;
+    /**
+     * Previous (grace) keys still accepted for verification during rotation, as a
+     * comma-separated list of `<keyId>:<secret>`. The proxy never signs with
+     * these — they exist only so in-flight requests signed with the prior key
+     * keep verifying until the rollout settles. Defaults to
+     * `env.SPFN_PROXY_SECRET_PREVIOUS`. Backend-only, so it can live in
+     * `.env.server` (never exposed to the Next.js process).
+     */
+    previousSecrets?: string;
+    /** Enforcement mode. @default 'off' */
+    mode?: ProxyGuardMode;
+    /** Allowed clock skew / replay window in ms. @default 30000 */
+    windowMs?: number;
+    /**
+     * Browser origin allowlist. When set, a request carrying an `Origin` header
+     * not in this list is rejected (strict) / tagged (tag). Requests without an
+     * `Origin` (server-to-server, mobile) skip this check and fall back to the
+     * signature.
+     */
+    allowedOrigins?: string[];
+    /** Optional Redis-backed nonce store for hard replay rejection (strict mode only). */
+    nonceStore?: NonceStore;
+    /** Paths to skip entirely (e.g. health checks). */
+    skipPaths?: string[];
+    /**
+     * Reject (413) once the streamed body exceeds this many bytes. Measured AS IT
+     * STREAMS — Content-Length is NOT trusted, so a missing/chunked/under-reported
+     * length can't bypass it. Bounds the per-request memory the guard buffers.
+     * Undefined = no cap (default). Multipart is exempt (unsigned).
+     */
+    maxBodyBytes?: number;
+}
+declare module 'hono' {
+    interface ContextVariableMap {
+        clientType?: ClientType;
+    }
+}
+/**
+ * Create the proxy-guard middleware.
+ *
+ * @example
+ * ```typescript
+ * export default defineServerConfig()
+ *     .proxyGuard({ mode: 'strict', allowedOrigins: ['https://app.example.com'] })
+ *     .routes(appRouter)
+ *     .build();
+ * ```
+ */
+declare function createProxyGuard(config?: ProxyGuardConfig): MiddlewareHandler;
+/** Minimal cache client (compatible with ioredis Redis | Cluster). */
+type CacheClient = {
+    set(key: string, value: string, ...args: any[]): Promise<any>;
+};
+/**
+ * Build a Redis-backed nonce store for hard replay rejection.
+ *
+ * Uses `SET key 1 PX ttl NX` — an atomic "set if absent". A fresh nonce returns
+ * 'OK'; a replayed one returns null. TTL keeps the key set bounded (only nonces
+ * within the replay window matter).
+ */
+declare function createCacheNonceStore(cache: CacheClient, prefix?: string): NonceStore;
+
+export { type ClientType, ErrorHandler, type ErrorHandlerOptions, type NonceStore, type OnErrorContext, type ProxyGuardConfig, type ProxyGuardMode, RequestLogger, type RequestLoggerConfig, type RequestLoggerOptions, createCacheNonceStore, createProxyGuard, maskSensitiveData };

package/dist/middleware/index.js

@@ -1,7 +1,7 @@
 import { SerializableError } from '@spfn/core/errors';
 import { logger } from '@spfn/core/logger';
 import { env } from '@spfn/core/config';
-import { randomBytes } from 'crypto';
+import { randomBytes, createHmac, createHash, timingSafeEqual } from 'crypto';
 
 // src/middleware/error-handler.ts
 var errorLogger = logger.child("@spfn/core:error-handler");
@@ -206,7 +206,249 @@ function RequestLogger(options) {
     }
   };
 }
+var PROXY_SIGNATURE_HEADER = "x-spfn-proxy-signature";
+var PROXY_TIMESTAMP_HEADER = "x-spfn-proxy-timestamp";
+var PROXY_NONCE_HEADER = "x-spfn-proxy-nonce";
+var PROXY_KEY_ID_HEADER = "x-spfn-proxy-key-id";
+var DEFAULT_KEY_ID = "default";
+function parseProxyKey(raw) {
+  const idx = raw.indexOf(":");
+  if (idx === -1) {
+    return { keyId: DEFAULT_KEY_ID, secret: raw };
+  }
+  return { keyId: raw.slice(0, idx) || DEFAULT_KEY_ID, secret: raw.slice(idx + 1) };
+}
+function parseProxyKeySet(raws) {
+  const keys = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of raws) {
+    if (!raw) {
+      continue;
+    }
+    for (const part of raw.split(",")) {
+      const trimmed = part.trim();
+      if (!trimmed) {
+        continue;
+      }
+      const key = parseProxyKey(trimmed);
+      if (!key.secret || seen.has(key.keyId)) {
+        continue;
+      }
+      seen.add(key.keyId);
+      keys.push(key);
+    }
+  }
+  return keys;
+}
+function buildCanonicalString(parts) {
+  return [parts.method.toUpperCase(), parts.path, parts.query, parts.timestamp, parts.nonce, parts.bodyHash].join("\n");
+}
+function hashBody(body) {
+  if (!body || body.length === 0) {
+    return "";
+  }
+  return typeof body === "string" ? createHash("sha256").update(body, "utf8").digest("hex") : createHash("sha256").update(body).digest("hex");
+}
+function computeSignature(secret, parts) {
+  return createHmac("sha256", secret).update(buildCanonicalString(parts)).digest("hex");
+}
+function safeEqualHex(a, b) {
+  const bufA = Buffer.from(a, "hex");
+  const bufB = Buffer.from(b, "hex");
+  if (bufA.length === 0 || bufA.length !== bufB.length) {
+    return false;
+  }
+  return timingSafeEqual(bufA, bufB);
+}
+function verifyProxyRequest(input) {
+  const { signature, timestamp, nonce, keyId } = input;
+  if (!signature || !timestamp || !nonce || !keyId) {
+    return { valid: false, reason: "missing-headers" };
+  }
+  const ts = Number(timestamp);
+  if (!Number.isFinite(ts)) {
+    return { valid: false, reason: "bad-timestamp" };
+  }
+  const now = input.now ?? Date.now();
+  const windowMs = input.windowMs ?? 3e4;
+  if (Math.abs(now - ts) > windowMs) {
+    return { valid: false, reason: "stale-timestamp" };
+  }
+  const key = input.keys.find((k) => k.keyId === keyId);
+  if (!key) {
+    return { valid: false, reason: "unknown-key" };
+  }
+  const expected = computeSignature(key.secret, {
+    method: input.method,
+    path: input.path,
+    query: input.query ?? "",
+    timestamp,
+    nonce,
+    bodyHash: hashBody(input.body)
+  });
+  if (!safeEqualHex(signature, expected)) {
+    return { valid: false, reason: "signature-mismatch" };
+  }
+  return { valid: true, nonce, keyId };
+}
+
+// src/middleware/proxy-guard.ts
+var guardLogger = logger.child("@spfn/core:proxy-guard");
+var BODY_OVERSIZE = Symbol("proxy-guard:body-oversize");
+var BODY_READ_ERROR = Symbol("proxy-guard:body-read-error");
+async function readRawBody(c, maxBytes) {
+  const method = c.req.method;
+  if (method === "GET" || method === "HEAD") {
+    return void 0;
+  }
+  const contentType = c.req.header("content-type") || "";
+  if (contentType.includes("multipart/form-data")) {
+    return void 0;
+  }
+  const stream = c.req.raw.clone().body;
+  if (!stream) {
+    return void 0;
+  }
+  const reader = stream.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      total += value.byteLength;
+      if (maxBytes !== void 0 && total > maxBytes) {
+        void reader.cancel().catch(() => void 0);
+        return BODY_OVERSIZE;
+      }
+      chunks.push(value);
+    }
+  } catch {
+    guardLogger.debug("Request body read failed (client abort?)");
+    return BODY_READ_ERROR;
+  }
+  return Buffer.concat(chunks);
+}
+function isOriginAllowed(c, allowedOrigins) {
+  if (!allowedOrigins || allowedOrigins.length === 0) {
+    return true;
+  }
+  const origin = c.req.header("origin");
+  if (!origin) {
+    return true;
+  }
+  return allowedOrigins.includes(origin);
+}
+function createProxyGuard(config = {}) {
+  const mode = config.mode ?? "off";
+  const windowMs = config.windowMs ?? 3e4;
+  const allowedOrigins = config.allowedOrigins;
+  const nonceStore = config.nonceStore;
+  const skipPaths = new Set(config.skipPaths ?? []);
+  const maxBodyBytes = config.maxBodyBytes;
+  const activeRaw = config.secret ?? env.SPFN_PROXY_SECRET;
+  const previousRaw = config.previousSecrets ?? env.SPFN_PROXY_SECRET_PREVIOUS;
+  const keys = parseProxyKeySet([activeRaw, previousRaw]);
+  if (mode === "strict" && keys.length === 0) {
+    throw new Error(
+      '[proxy-guard] mode "strict" requires a proxy key but none is configured (SPFN_PROXY_SECRET is empty/unset). Refusing to start with the guard open \u2014 set the secret, or use mode "tag" / "off".'
+    );
+  }
+  if (activeRaw && previousRaw) {
+    const activeId = parseProxyKey(activeRaw).keyId;
+    const collides = previousRaw.split(",").some((p) => p.trim() && parseProxyKey(p.trim()).keyId === activeId);
+    if (collides) {
+      guardLogger.warn(
+        'Previous proxy key shares keyId with the active key (likely bare secrets without a "keyId:" prefix) \u2014 grace key ignored, rotation will drop in-flight requests. Use "<keyId>:<secret>" on both keys.',
+        { keyId: activeId }
+      );
+    }
+  }
+  return async (c, next) => {
+    if (mode === "off" || skipPaths.has(c.req.path)) {
+      return next();
+    }
+    if (c.req.method === "OPTIONS" && c.req.header("access-control-request-method")) {
+      c.set("clientType", "untrusted");
+      return next();
+    }
+    if (!isOriginAllowed(c, allowedOrigins)) {
+      return reject(c, mode, next, "origin-not-allowed");
+    }
+    if (keys.length === 0) {
+      c.set("clientType", "untrusted");
+      return next();
+    }
+    const signature = c.req.header(PROXY_SIGNATURE_HEADER);
+    const timestamp = c.req.header(PROXY_TIMESTAMP_HEADER);
+    const nonce = c.req.header(PROXY_NONCE_HEADER);
+    const keyId = c.req.header(PROXY_KEY_ID_HEADER);
+    if (!signature || !timestamp || !nonce || !keyId) {
+      return reject(c, mode, next, "missing-headers");
+    }
+    const body = await readRawBody(c, maxBodyBytes);
+    if (body === BODY_OVERSIZE) {
+      if (mode === "strict") {
+        return c.json({ error: "Payload Too Large" }, 413);
+      }
+      c.set("clientType", "untrusted");
+      return next();
+    }
+    if (body === BODY_READ_ERROR) {
+      return reject(c, mode, next, "body-read-error");
+    }
+    const url = new URL(c.req.url);
+    const result = verifyProxyRequest({
+      keys,
+      method: c.req.method,
+      path: url.pathname,
+      query: url.search,
+      body,
+      signature,
+      timestamp,
+      nonce,
+      keyId,
+      windowMs
+    });
+    if (!result.valid) {
+      return reject(c, mode, next, result.reason);
+    }
+    if (nonceStore && result.nonce) {
+      try {
+        const fresh = await nonceStore.checkAndSet(result.nonce, windowMs * 2);
+        if (!fresh) {
+          return reject(c, mode, next, "nonce-replay");
+        }
+      } catch (err) {
+        guardLogger.warn("Nonce store unavailable \u2014 falling back to timestamp window", {
+          error: err.message
+        });
+      }
+    }
+    c.set("clientType", "web");
+    return next();
+  };
+}
+function createCacheNonceStore(cache, prefix = "spfn:proxy-nonce:") {
+  return {
+    async checkAndSet(nonce, ttlMs) {
+      const res = await cache.set(`${prefix}${nonce}`, "1", "PX", Math.ceil(ttlMs), "NX");
+      return res === "OK";
+    }
+  };
+}
+function reject(c, mode, next, reason) {
+  if (mode === "strict") {
+    guardLogger.warn("Rejected unverified request", { reason, path: c.req.path, method: c.req.method });
+    return c.json({ error: "Forbidden", message: "Request origin could not be verified" }, 403);
+  }
+  guardLogger.debug("Unverified request (would reject in strict mode)", { reason, path: c.req.path });
+  c.set("clientType", "untrusted");
+  return next();
+}
 
-export { ErrorHandler, RequestLogger, maskSensitiveData };
+export { ErrorHandler, RequestLogger, createCacheNonceStore, createProxyGuard, maskSensitiveData };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map