@supacloud/elysia 0.18.0 → 0.19.0

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/index.ts
-import { Elysia as Elysia2 } from "elysia";
+import { Elysia as Elysia3 } from "elysia";
 import { decodeCommandPreview } from "@supacloud/contracts";
 
 // src/command-errors.ts
@@ -36,6 +36,628 @@ function commandErrorStatus(code) {
   }
 }
 
+// src/http-policy.ts
+class HttpPolicyConfigurationError extends Error {
+  code = "HTTP_POLICY_CONFIGURATION_INVALID";
+}
+function compileHttpPolicies(route, path, registry = {}) {
+  const declarations = route.data?.httpPolicies;
+  if (declarations === undefined)
+    return [];
+  const fail = () => {
+    throw new HttpPolicyConfigurationError(`Invalid HTTP policy configuration for ${route.method} ${path}`);
+  };
+  if (!Array.isArray(declarations))
+    return fail();
+  return Array.from(declarations, (value, index) => {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      return fail();
+    const declaration = value;
+    if (typeof declaration.name !== "string" || Object.keys(declaration).some((key) => key !== "name" && key !== "options") || !Object.hasOwn(registry, declaration.name))
+      return fail();
+    const factory = registry[declaration.name];
+    if (typeof factory !== "function")
+      return fail();
+    const policy = factory(declaration.options, Object.freeze({
+      method: route.method,
+      path,
+      ...route.command === undefined ? {} : { command: route.command }
+    }));
+    if (typeof policy !== "function")
+      return fail();
+    if (policy.terminal && index !== declarations.length - 1)
+      return fail();
+    if (policy.afterResponse !== undefined && typeof policy.afterResponse !== "function")
+      return fail();
+    if (policy.mapResponse !== undefined && typeof policy.mapResponse !== "function")
+      return fail();
+    return policy;
+  });
+}
+
+// src/http-telemetry.ts
+import { Elysia, StatusMap } from "elysia";
+var requestIds = new WeakMap;
+function httpRequestId(request) {
+  return requestIds.get(request);
+}
+function createHttpTelemetry(observe) {
+  const starts = new WeakMap;
+  return new Elysia().onRequest(({ request, set }) => {
+    const supplied = request.headers.get("x-request-id");
+    const requestId = supplied && /^[A-Za-z0-9._:-]{1,128}$/.test(supplied) ? supplied : crypto.randomUUID();
+    starts.set(request, { time: performance.now(), requestId });
+    requestIds.set(request, requestId);
+    set.headers["x-request-id"] = requestId;
+  }).onError(() => {
+    return;
+  }).onAfterResponse(async ({ request, response, set, route }) => {
+    const start = starts.get(request);
+    if (!start)
+      return;
+    starts.delete(request);
+    const status = response instanceof Response ? response.status : typeof set.status === "number" ? set.status : StatusMap[set.status ?? "OK"];
+    try {
+      await observe(Object.freeze({
+        requestId: start.requestId,
+        method: request.method,
+        route: route ?? "<unmatched>",
+        status,
+        durationMs: performance.now() - start.time
+      }));
+    } catch {}
+  }).as("global");
+}
+// src/identity.ts
+import { createRemoteJWKSet, jwtVerify, errors } from "jose";
+function httpsUrl(value) {
+  const url = new URL(value);
+  if (url.protocol !== "https:" || url.username || url.password || url.hash) {
+    throw new TypeError("Identity endpoints must be HTTPS URLs without credentials or fragments");
+  }
+  return url;
+}
+function createSupAuthRequestContext(options) {
+  httpsUrl(options.issuer);
+  const jwksUrl = httpsUrl(options.jwksUrl);
+  if (!options.audience.trim() || !options.projectId.trim() || !options.clientId?.trim()) {
+    throw new TypeError("SupAuth audience, clientId and projectId are required");
+  }
+  const algorithms = [...options.algorithms ?? ["ES256", "RS256"]];
+  if (!algorithms.length || algorithms.some((value) => value !== "ES256" && value !== "RS256")) {
+    throw new TypeError("SupAuth requires ES256 or RS256");
+  }
+  const { issuer, audience, clientId, projectId, resolveAccess } = options;
+  const keyResolver = options.keyResolver ?? createRemoteJWKSet(jwksUrl, { timeoutDuration: 5000 });
+  return async (request) => {
+    const match = request.headers.get("authorization")?.match(/^Bearer ([^\s]+)$/i);
+    const token = match?.[1];
+    if (!token || token.length > 16384)
+      throw unauthenticated();
+    let subject;
+    try {
+      const { payload } = await jwtVerify(token, keyResolver, {
+        issuer,
+        audience,
+        algorithms,
+        requiredClaims: ["sub", "exp", "iat"]
+      });
+      if (typeof payload.sub !== "string" || !payload.sub.trim() || payload.sub.length > 1024 || /[\u0000-\u001f\u007f]/.test(payload.sub)) {
+        throw unauthenticated();
+      }
+      const application = payload.client_id ?? payload.azp;
+      if (application !== clientId || payload.role !== "authenticated" || payload.client_id !== undefined && payload.client_id !== clientId || payload.azp !== undefined && payload.azp !== clientId) {
+        throw unauthenticated();
+      }
+      subject = payload.sub;
+    } catch (error) {
+      if (error instanceof ApplicationError || error instanceof errors.JWTClaimValidationFailed || error instanceof errors.JWTExpired || error instanceof errors.JWTInvalid || error instanceof errors.JWSInvalid || error instanceof errors.JWSSignatureVerificationFailed || error instanceof errors.JOSEAlgNotAllowed || error instanceof errors.JOSENotSupported || error instanceof errors.JWKSNoMatchingKey)
+        throw unauthenticated();
+      throw new ApplicationError("Identity verification service unavailable", {
+        status: 503,
+        code: "AUTHENTICATION_UNAVAILABLE"
+      });
+    }
+    const identity = { authenticated: true, subject, issuer, clientId };
+    Object.defineProperty(identity, "accessToken", { value: token, enumerable: false });
+    Object.freeze(identity);
+    let access;
+    try {
+      access = await resolveAccess(identity, request);
+    } catch {
+      throw new ApplicationError("Application access service unavailable", {
+        status: 503,
+        code: "APPLICATION_ACCESS_UNAVAILABLE"
+      });
+    }
+    if (!access || access.projectId !== projectId || typeof access.tenantId !== "string" || !access.tenantId.trim() || !Array.isArray(access.permissions) || access.permissions.some((permission) => typeof permission !== "string" || !permission.trim())) {
+      throw new ApplicationError("Application access denied", { status: 403, code: "APPLICATION_ACCESS_DENIED" });
+    }
+    const context = createSupaCloudRequestContext(request);
+    return {
+      ...context,
+      identity,
+      access: Object.freeze({
+        projectId,
+        tenantId: access.tenantId,
+        permissions: Object.freeze([...new Set(access.permissions)])
+      })
+    };
+  };
+}
+function unauthenticated() {
+  return new ApplicationError("Authenticated user context is required", {
+    status: 401,
+    code: "AUTHENTICATION_REQUIRED"
+  });
+}
+
+// src/http-response-cache.ts
+import { mapResponse } from "elysia/adapter/web-standard/handler";
+function mayStore({ http, response }) {
+  if (response === null || typeof response !== "object" || response instanceof Response || !Array.isArray(response) && Object.getPrototypeOf(response) !== Object.prototype)
+    return false;
+  if (http.set.status !== undefined && http.set.status !== 200 && http.set.status !== "OK")
+    return false;
+  if (http.set.cookie && Object.keys(http.set.cookie).length)
+    return false;
+  const headers = new Headers(http.set.headers);
+  for (const name of headers.keys()) {
+    if (!["content-type", "x-request-id", "ratelimit-limit", "ratelimit-remaining"].includes(name))
+      return false;
+  }
+  return !headers.has("content-type") || headers.get("content-type").split(";")[0].trim() === "application/json";
+}
+async function boundedBody(response, maxBytes) {
+  const reader = response.body?.getReader();
+  if (!reader)
+    return;
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const next = await reader.read();
+      if (next.done)
+        break;
+      size += next.value.byteLength;
+      if (size > maxBytes) {
+        reader.cancel().catch(() => {});
+        return;
+      }
+      chunks.push(next.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(bytes);
+}
+function createCachePolicy(options) {
+  const misses = new WeakMap;
+  const snapshots = new WeakMap;
+  const policy = async ({ http }) => {
+    const context = options.requireAccess(http.request);
+    if (http.request.headers.has("range") || http.request.headers.has("if-none-match") || http.request.headers.has("if-modified-since") || /(?:no-cache|no-store|max-age\s*=\s*0)/i.test(http.request.headers.get("cache-control") ?? ""))
+      return;
+    const headers = [...http.request.headers].filter(([name]) => name !== "x-request-id").sort(([a], [b]) => a.localeCompare(b));
+    const key = await policyKey([
+      "cache",
+      options.namespace,
+      options.route,
+      ...principalKey(context),
+      [...context.access.permissions].sort(),
+      http.request.url,
+      headers
+    ]);
+    let entry, generation;
+    try {
+      generation = await options.store.generation();
+      if (typeof generation !== "string" || !generation.length || generation.length > 128)
+        throw new Error("Invalid cache generation");
+      entry = await options.store.get(key, generation);
+    } catch {
+      throw new ApplicationError("Cache service unavailable", { status: 503, code: "HTTP_CACHE_UNAVAILABLE" });
+    }
+    if (entry && entry.expiresAt > Date.now()) {
+      if (typeof entry.body !== "string" || entry.contentType !== "application/json" || new TextEncoder().encode(entry.body).byteLength > options.maxBodyBytes) {
+        throw new ApplicationError("Cache service unavailable", { status: 503, code: "HTTP_CACHE_UNAVAILABLE" });
+      }
+      return new Response(entry.body, {
+        headers: { "content-type": "application/json", "cache-control": "private, no-store" }
+      });
+    }
+    misses.set(http.request, { key, generation });
+  };
+  policy.terminal = true;
+  policy.mapResponse = async (context) => {
+    if (!misses.has(context.http.request) || !mayStore(context))
+      return;
+    const response = await mapResponse(context.response, context.http.set, context.http.request);
+    const body = boundedBody(response.clone(), options.maxBodyBytes).catch(() => {
+      try {
+        options.onWriteError();
+      } catch {}
+      return;
+    });
+    snapshots.set(context.http.request, { response, body });
+    return response;
+  };
+  policy.afterResponse = async (context) => {
+    const miss = misses.get(context.http.request);
+    const snapshot = snapshots.get(context.http.request);
+    misses.delete(context.http.request);
+    snapshots.delete(context.http.request);
+    if (!miss || !snapshot || context.response !== snapshot.response || snapshot.response.status !== 200)
+      return;
+    const headers = snapshot.response.headers;
+    if ([...headers.keys()].some((name) => !["content-type", "x-request-id", "ratelimit-limit", "ratelimit-remaining"].includes(name)))
+      return;
+    try {
+      const body = await snapshot.body;
+      if (body === undefined)
+        return;
+      await options.store.set(miss.key, { body, contentType: "application/json", expiresAt: Date.now() + options.ttlMs }, miss.generation);
+    } catch {
+      try {
+        options.onWriteError();
+      } catch {}
+    }
+  };
+  return policy;
+}
+
+// src/http-policy-suite.ts
+function policyOptions(value, allowed) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !allowed.includes(key))) {
+    throw new HttpPolicyConfigurationError("Invalid built-in HTTP policy options");
+  }
+  return value;
+}
+function positiveInteger(value, max) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0 || value > max) {
+    throw new HttpPolicyConfigurationError("HTTP policy numeric option is out of range");
+  }
+  return value;
+}
+async function policyKey(parts) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify(parts)));
+  return Array.from(new Uint8Array(digest), (value) => value.toString(16).padStart(2, "0")).join("");
+}
+function principalKey(context) {
+  return [
+    context.identity.issuer,
+    context.identity.clientId,
+    context.identity.subject,
+    context.access.projectId,
+    context.access.tenantId
+  ];
+}
+function createHttpPolicySuite(options) {
+  const verify = createSupAuthRequestContext(options.auth);
+  const verified = new WeakMap;
+  const requestContext = async (request) => {
+    verified.delete(request);
+    if (!request.headers.has("authorization")) {
+      const base = createSupaCloudRequestContext(request);
+      return { ...base, identity: Object.freeze({ authenticated: false }) };
+    }
+    const context = await verify(request);
+    verified.set(request, context);
+    return context;
+  };
+  const requireAccess = (request) => {
+    const context = verified.get(request);
+    if (!context)
+      throw new ApplicationError("Authentication required", {
+        status: 401,
+        code: "AUTHENTICATION_REQUIRED"
+      });
+    return context;
+  };
+  const registry = {
+    authenticated: (value) => {
+      if (value !== undefined)
+        throw new HttpPolicyConfigurationError("authenticated does not accept options");
+      return ({ http }) => {
+        requireAccess(http.request);
+      };
+    },
+    tenant: (value) => {
+      const { param } = policyOptions(value, ["param"]);
+      if (typeof param !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(param)) {
+        throw new HttpPolicyConfigurationError("tenant requires a route parameter name");
+      }
+      return ({ http }) => {
+        const context = requireAccess(http.request);
+        if (http.params[param] !== context.access.tenantId) {
+          throw new ApplicationError("Tenant access denied", { status: 403, code: "TENANT_ACCESS_DENIED" });
+        }
+      };
+    },
+    permission: (value) => {
+      const { allOf } = policyOptions(value, ["allOf"]);
+      if (!Array.isArray(allOf) || !allOf.length || Array.from(allOf).some((permission) => typeof permission !== "string" || !permission.trim())) {
+        throw new HttpPolicyConfigurationError("permission requires non-empty allOf permissions");
+      }
+      const required = [...new Set(allOf)];
+      return ({ http }) => {
+        const access = requireAccess(http.request).access;
+        if (!required.every((permission) => access.permissions.includes(permission))) {
+          throw new ApplicationError("Permission denied", { status: 403, code: "PERMISSION_DENIED" });
+        }
+      };
+    },
+    rateLimit: (value, route) => {
+      const config = policyOptions(value, ["limit", "windowMs"]);
+      const limit = positiveInteger(config.limit, 1e9);
+      const windowMs = positiveInteger(config.windowMs, 86400000);
+      const store = options.rateLimitStore;
+      if (!store)
+        throw new HttpPolicyConfigurationError("rateLimit requires an explicit store");
+      return async ({ http }) => {
+        const context = requireAccess(http.request);
+        const key = await policyKey(["rate", route.method, route.path, ...principalKey(context), limit, windowMs]);
+        let result;
+        try {
+          result = await store.consume(key, limit, windowMs);
+        } catch {
+          throw new ApplicationError("Rate limit service unavailable", { status: 503, code: "RATE_LIMIT_UNAVAILABLE" });
+        }
+        if (typeof result?.allowed !== "boolean" || !Number.isSafeInteger(result.remaining) || result.remaining < 0 || result.remaining > limit || !Number.isFinite(result.resetAt)) {
+          throw new ApplicationError("Rate limit service unavailable", { status: 503, code: "RATE_LIMIT_UNAVAILABLE" });
+        }
+        http.set.headers["ratelimit-limit"] = String(limit);
+        http.set.headers["ratelimit-remaining"] = String(result.remaining);
+        if (!result.allowed) {
+          const retryAfter = Math.max(1, Math.ceil((result.resetAt - Date.now()) / 1000));
+          return new Response("Too Many Requests", { status: 429, headers: { "retry-after": String(retryAfter) } });
+        }
+      };
+    },
+    cache: (value, route) => {
+      if (route.method !== "GET" || route.command) {
+        throw new HttpPolicyConfigurationError("cache is restricted to GET queries, never commands");
+      }
+      const config = policyOptions(value, ["ttlMs", "maxBodyBytes"]);
+      const ttlMs = positiveInteger(config.ttlMs, 86400000);
+      const maxBodyBytes = positiveInteger(config.maxBodyBytes ?? 262144, 16777216);
+      if (!options.cacheStore)
+        throw new HttpPolicyConfigurationError("cache requires an explicit store");
+      if (typeof options.cacheNamespace !== "string" || !/^[A-Za-z0-9._:-]{1,128}$/.test(options.cacheNamespace)) {
+        throw new HttpPolicyConfigurationError("cache requires an explicit deployment cacheNamespace");
+      }
+      return createCachePolicy({
+        store: options.cacheStore,
+        requireAccess,
+        ttlMs,
+        maxBodyBytes,
+        route: `${route.method} ${route.path}`,
+        namespace: options.cacheNamespace,
+        onWriteError: options.onCacheWriteError ?? (() => console.warn("supacloud: HTTP cache write failed"))
+      });
+    }
+  };
+  return { requestContext, httpPolicies: registry };
+}
+// src/http-policy-stores.ts
+function capacity(value) {
+  if (!Number.isSafeInteger(value) || value <= 0)
+    throw new TypeError("Store capacity must be a positive integer");
+}
+function createMemoryHttpRateLimitStore(options = {}) {
+  const maxEntries = options.maxEntries ?? 1e4;
+  capacity(maxEntries);
+  const now = options.now ?? Date.now;
+  const entries = new Map;
+  return {
+    consume(key, limit, windowMs) {
+      capacity(limit);
+      capacity(windowMs);
+      const time = now();
+      let entry = entries.get(key);
+      if (!entry || entry.resetAt <= time) {
+        if (!entry && entries.size >= maxEntries) {
+          for (const [expiredKey, value] of entries) {
+            if (value.resetAt <= time)
+              entries.delete(expiredKey);
+          }
+          if (entries.size >= maxEntries)
+            throw new Error("Rate limit store capacity exhausted");
+        }
+        entry = { used: 0, resetAt: time + windowMs };
+        entries.set(key, entry);
+      }
+      const allowed = entry.used < limit;
+      if (allowed)
+        entry.used++;
+      return { allowed, remaining: Math.max(0, limit - entry.used), resetAt: entry.resetAt };
+    }
+  };
+}
+function createMemoryHttpCacheStore(options = {}) {
+  const maxEntries = options.maxEntries ?? 1000, maxBytes = options.maxBytes ?? 8 * 1024 * 1024;
+  capacity(maxEntries);
+  capacity(maxBytes);
+  const now = options.now ?? Date.now;
+  const entries = new Map;
+  let generation = crypto.randomUUID();
+  let bytes = 0;
+  const remove = (key) => {
+    bytes -= entries.get(key)?.bytes ?? 0;
+    entries.delete(key);
+  };
+  return {
+    generation: () => generation,
+    get(key, expected) {
+      if (expected !== generation)
+        return;
+      const entry = entries.get(key);
+      if (!entry)
+        return;
+      if (entry.value.expiresAt <= now()) {
+        remove(key);
+        return;
+      }
+      entries.delete(key);
+      entries.set(key, entry);
+      return { ...entry.value };
+    },
+    set(key, value, expected) {
+      if (expected !== generation)
+        return;
+      const size = new TextEncoder().encode(key + value.body + value.contentType).byteLength;
+      if (size > maxBytes || value.expiresAt <= now())
+        return;
+      remove(key);
+      while (entries.size >= maxEntries || bytes + size > maxBytes) {
+        const oldest = entries.keys().next().value;
+        if (oldest === undefined)
+          break;
+        remove(oldest);
+      }
+      entries.set(key, { value: { ...value }, bytes: size });
+      bytes += size;
+    },
+    clear() {
+      generation = crypto.randomUUID();
+      entries.clear();
+      bytes = 0;
+    }
+  };
+}
+// src/http-policy-postgres.ts
+var HTTP_POLICY_STORE_SQL = `
+CREATE SCHEMA IF NOT EXISTS supacloud_http;
+REVOKE ALL ON SCHEMA supacloud_http FROM PUBLIC;
+CREATE TABLE IF NOT EXISTS supacloud_http.rate_limits (
+  key text PRIMARY KEY CHECK (key ~ '^[a-f0-9]{64}$'),
+  used bigint NOT NULL CHECK (used > 0),
+  reset_at timestamptz NOT NULL
+);
+CREATE INDEX IF NOT EXISTS http_rate_limit_expiry ON supacloud_http.rate_limits(reset_at);
+CREATE TABLE IF NOT EXISTS supacloud_http.response_cache (
+  key text PRIMARY KEY CHECK (key ~ '^[a-f0-9]{64}$'),
+  body text NOT NULL CHECK (octet_length(body) <= 16777216),
+  expires_at timestamptz NOT NULL,
+  generation uuid NOT NULL
+);
+ALTER TABLE supacloud_http.response_cache ADD COLUMN IF NOT EXISTS generation uuid
+  NOT NULL DEFAULT '00000000-0000-0000-0000-000000000000';
+CREATE TABLE IF NOT EXISTS supacloud_http.cache_generation (
+  singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
+  generation uuid NOT NULL DEFAULT gen_random_uuid()
+);
+INSERT INTO supacloud_http.cache_generation(singleton) VALUES (true) ON CONFLICT DO NOTHING;
+CREATE INDEX IF NOT EXISTS http_response_cache_expiry ON supacloud_http.response_cache(expires_at);
+REVOKE ALL ON ALL TABLES IN SCHEMA supacloud_http FROM PUBLIC;
+CREATE OR REPLACE FUNCTION supacloud_http.consume_rate_limit(p_key text, p_limit bigint, p_window_ms integer)
+RETURNS TABLE(allowed boolean, remaining bigint, reset_at_ms numeric)
+LANGUAGE plpgsql SET search_path = pg_catalog, supacloud_http AS $rate$
+DECLARE
+  entry supacloud_http.rate_limits%ROWTYPE;
+  observed_at timestamptz;
+BEGIN
+  IF p_limit < 1 OR p_limit > 1000000000 OR p_window_ms < 1 OR p_window_ms > 86400000 THEN
+    RAISE EXCEPTION 'Invalid rate limit window';
+  END IF;
+  LOOP
+    INSERT INTO supacloud_http.rate_limits(key, used, reset_at)
+      VALUES (p_key, 1, '-infinity') ON CONFLICT DO NOTHING;
+    SELECT * INTO entry FROM supacloud_http.rate_limits WHERE key=p_key FOR UPDATE;
+    EXIT WHEN FOUND;
+    -- Expiry pruning may remove a conflicting row before we acquire its lock.
+  END LOOP;
+  observed_at := clock_timestamp();
+  IF entry.reset_at <= observed_at THEN
+    entry.used := 1;
+    entry.reset_at := observed_at + p_window_ms * interval '1 millisecond';
+  ELSE
+    entry.used := least(entry.used + 1, p_limit + 1);
+  END IF;
+  UPDATE supacloud_http.rate_limits SET used=entry.used, reset_at=entry.reset_at WHERE key=p_key;
+  RETURN QUERY SELECT entry.used <= p_limit, greatest(p_limit-entry.used,0),
+    extract(epoch FROM entry.reset_at)*1000;
+END
+$rate$;
+REVOKE ALL ON FUNCTION supacloud_http.consume_rate_limit(text,bigint,integer) FROM PUBLIC;
+`;
+function validKey(key) {
+  if (!/^[a-f0-9]{64}$/.test(key))
+    throw new TypeError("HTTP store keys must be SHA-256 digests");
+}
+function createPostgresHttpPolicyStores(database) {
+  const rateLimitStore = {
+    async consume(key, limit, windowMs) {
+      validKey(key);
+      if (!Number.isSafeInteger(limit) || limit <= 0 || limit > 1e9 || !Number.isSafeInteger(windowMs) || windowMs <= 0 || windowMs > 86400000) {
+        throw new TypeError("Invalid rate limit window");
+      }
+      const [row] = await database.query("SELECT * FROM supacloud_http.consume_rate_limit($1,$2,$3)", [key, limit, windowMs]);
+      if (!row || typeof row.allowed !== "boolean")
+        throw new Error("Invalid rate limit storage result");
+      return { allowed: row.allowed, remaining: Number(row.remaining), resetAt: Number(row.reset_at_ms) };
+    }
+  };
+  const cacheStore = {
+    async generation() {
+      const [row] = await database.query("SELECT generation FROM supacloud_http.cache_generation WHERE singleton", []);
+      if (!row || typeof row.generation !== "string")
+        throw new Error("Invalid cache generation");
+      return row.generation;
+    },
+    async get(key, generation) {
+      validKey(key);
+      const [row] = await database.query(`
+        SELECT body, extract(epoch FROM expires_at) * 1000 AS expires_at_ms
+        FROM supacloud_http.response_cache AS cache
+        JOIN supacloud_http.cache_generation AS current ON cache.generation = current.generation
+        WHERE key = $1 AND cache.generation = $2::uuid AND expires_at > clock_timestamp()
+      `, [key, generation]);
+      if (!row)
+        return;
+      if (typeof row.body !== "string")
+        throw new Error("Invalid cache storage result");
+      return { body: row.body, contentType: "application/json", expiresAt: Number(row.expires_at_ms) };
+    },
+    async set(key, value, generation) {
+      validKey(key);
+      if (value.contentType !== "application/json" || typeof value.body !== "string" || new TextEncoder().encode(value.body).byteLength > 16777216 || !Number.isSafeInteger(value.expiresAt) || value.expiresAt <= 0) {
+        throw new TypeError("Invalid cache entry");
+      }
+      await database.query(`
+        WITH current AS MATERIALIZED (
+          SELECT generation FROM supacloud_http.cache_generation
+          WHERE singleton AND generation=$4::uuid FOR SHARE
+        )
+        INSERT INTO supacloud_http.response_cache (key, body, expires_at, generation)
+        SELECT $1, $2, to_timestamp($3 / 1000.0), generation FROM current
+        ON CONFLICT (key) DO UPDATE SET body = excluded.body,
+          expires_at = excluded.expires_at, generation = excluded.generation
+      `, [key, value.body, value.expiresAt, generation]);
+    },
+    async clear() {
+      await database.query(`
+        WITH advanced AS (
+          UPDATE supacloud_http.cache_generation SET generation=gen_random_uuid() WHERE singleton RETURNING generation
+        )
+        DELETE FROM supacloud_http.response_cache WHERE EXISTS(SELECT 1 FROM advanced)
+      `, []);
+    }
+  };
+  return {
+    rateLimitStore,
+    cacheStore,
+    async prune() {
+      await database.query("DELETE FROM supacloud_http.rate_limits WHERE reset_at <= clock_timestamp()", []);
+      await database.query("DELETE FROM supacloud_http.response_cache WHERE expires_at <= clock_timestamp()", []);
+    }
+  };
+}
 // src/execution.ts
 async function observeExecution(observer, event, next) {
   const emit = (phase, durationMs) => {
@@ -74,7 +696,7 @@ function executionTrace(context) {
 // src/schema_contract.ts
 import {
   getSchemaValidator,
-  StatusMap,
+  StatusMap as StatusMap2,
   ElysiaCustomStatusResponse
 } from "elysia";
 function defineRouteContract(schemas) {
@@ -156,7 +778,7 @@ function responseStatusOf(value, configuredStatus) {
   if (typeof configuredStatus === "number")
     return configuredStatus;
   if (typeof configuredStatus === "string") {
-    const mapped = StatusMap[configuredStatus];
+    const mapped = StatusMap2[configuredStatus];
     if (typeof mapped === "number")
       return mapped;
   }
@@ -296,7 +918,7 @@ function defineJsonContract(schemas, request, options = {}) {
 }
 
 // src/documentation.ts
-import { Elysia } from "elysia";
+import { Elysia as Elysia2 } from "elysia";
 function normalizePath(value, fallback) {
   const path = value ?? fallback;
   if (!path.trim() || !path.startsWith("/") || path.includes("?") || path.includes("#")) {
@@ -373,7 +995,7 @@ function renderViewerPage(title, resourcePath, mode) {
 </html>`;
 }
 function createDocumentationPlugin(options = {}) {
-  const app = new Elysia({ name: "supacloud:documentation" });
+  const app = new Elysia2({ name: "supacloud:documentation" });
   const paths = new Set;
   const reserve = (path) => {
     if (paths.has(path))
@@ -408,6 +1030,39 @@ function createDocumentationPlugin(options = {}) {
   }
   return app;
 }
+
+// src/command-binding.ts
+function bindCompiledCommand(options) {
+  const { module, command, governance, observer, handler, decode, preview } = options;
+  return {
+    execute: (input, context) => executeCompiledCommand({
+      module,
+      command,
+      governance,
+      observer,
+      decode,
+      input,
+      request: context.request,
+      requestContext: context.requestContext,
+      services: context.services,
+      scope: context.scope,
+      handler: (value) => handler(value, context)
+    }),
+    ...preview ? {
+      preview: (input, context) => previewCompiledCommand({
+        module,
+        command,
+        governance,
+        input,
+        request: context.request,
+        requestContext: context.requestContext,
+        services: context.services,
+        scope: context.scope,
+        preview: (value) => preview(value, context)
+      })
+    } : {}
+  };
+}
 // src/persistent-command.ts
 import {
   CommandError,
@@ -434,81 +1089,6 @@ function createPersistentCommandAdapter(command, options) {
     }
   };
 }
-// src/identity.ts
-import { createRemoteJWKSet, jwtVerify, errors } from "jose";
-function httpsUrl(value) {
-  const url = new URL(value);
-  if (url.protocol !== "https:" || url.username || url.password || url.hash) {
-    throw new TypeError("Identity endpoints must be HTTPS URLs without credentials or fragments");
-  }
-  return url;
-}
-function createSupAuthRequestContext(options) {
-  httpsUrl(options.issuer);
-  const jwksUrl = httpsUrl(options.jwksUrl);
-  if (!options.audience.trim() || !options.projectId.trim() || !options.clientId?.trim()) {
-    throw new TypeError("SupAuth audience, clientId and projectId are required");
-  }
-  const algorithms = [...options.algorithms ?? ["ES256", "RS256"]];
-  if (!algorithms.length || algorithms.some((value) => value !== "ES256" && value !== "RS256")) {
-    throw new TypeError("SupAuth requires ES256 or RS256");
-  }
-  const { issuer, audience, clientId, projectId, resolveAccess } = options;
-  const keyResolver = options.keyResolver ?? createRemoteJWKSet(jwksUrl, { timeoutDuration: 5000 });
-  return async (request) => {
-    const match = request.headers.get("authorization")?.match(/^Bearer ([^\s]+)$/i);
-    const token = match?.[1];
-    if (!token || token.length > 16384)
-      throw unauthenticated();
-    let subject;
-    try {
-      const { payload } = await jwtVerify(token, keyResolver, {
-        issuer,
-        audience,
-        algorithms,
-        requiredClaims: ["sub", "exp", "iat"]
-      });
-      if (typeof payload.sub !== "string" || !payload.sub.trim() || payload.sub.length > 1024 || /[\u0000-\u001f\u007f]/.test(payload.sub)) {
-        throw unauthenticated();
-      }
-      const application = payload.client_id ?? payload.azp;
-      if (application !== clientId || payload.role !== "authenticated" || payload.client_id !== undefined && payload.client_id !== clientId || payload.azp !== undefined && payload.azp !== clientId) {
-        throw unauthenticated();
-      }
-      subject = payload.sub;
-    } catch (error) {
-      if (error instanceof ApplicationError || error instanceof errors.JWTClaimValidationFailed || error instanceof errors.JWTExpired || error instanceof errors.JWTInvalid || error instanceof errors.JWSInvalid || error instanceof errors.JWSSignatureVerificationFailed || error instanceof errors.JOSEAlgNotAllowed || error instanceof errors.JOSENotSupported || error instanceof errors.JWKSNoMatchingKey)
-        throw unauthenticated();
-      throw new ApplicationError("Identity verification service unavailable", {
-        status: 503,
-        code: "AUTHENTICATION_UNAVAILABLE"
-      });
-    }
-    const identity = { authenticated: true, subject, issuer, clientId };
-    Object.defineProperty(identity, "accessToken", { value: token, enumerable: false });
-    Object.freeze(identity);
-    const access = await resolveAccess(identity, request);
-    if (!access || access.projectId !== projectId || typeof access.tenantId !== "string" || !access.tenantId.trim() || !Array.isArray(access.permissions) || access.permissions.some((permission) => typeof permission !== "string" || !permission.trim())) {
-      throw new ApplicationError("Application access denied", { status: 403, code: "APPLICATION_ACCESS_DENIED" });
-    }
-    const context = createSupaCloudRequestContext(request);
-    return {
-      ...context,
-      identity,
-      access: Object.freeze({
-        projectId,
-        tenantId: access.tenantId,
-        permissions: Object.freeze([...new Set(access.permissions)])
-      })
-    };
-  };
-}
-function unauthenticated() {
-  return new ApplicationError("Authenticated user context is required", {
-    status: 401,
-    code: "AUTHENTICATION_REQUIRED"
-  });
-}
 // src/feature.ts
 function assertFeatureTransition(spec, state, event) {
   const transition = Object.hasOwn(spec.transitions, event) ? spec.transitions[event] : undefined;
@@ -1386,6 +1966,19 @@ function validatedJsonResponse(validate, value, init) {
     headers.set("content-type", "application/json");
   return new Response(body, { ...init, headers });
 }
+var httpPluginIds = new WeakMap;
+var nextHttpPluginId = 0;
+function contextPlugin(http) {
+  let seed = http ? httpPluginIds.get(http) : 0;
+  if (http && seed === undefined) {
+    seed = ++nextHttpPluginId;
+    httpPluginIds.set(http, seed);
+  }
+  return new Elysia3({ name: "supacloud:http-context", seed }).use(http ?? new Elysia3).as("scoped");
+}
+function mountHttp(http, name, normalize = true) {
+  return new Elysia3({ name, normalize }).use(contextPlugin(http));
+}
 function decodeJobContract(schema, value, boundary) {
   if (schema === undefined)
     return value;
@@ -1422,7 +2015,7 @@ function bearerToken(request) {
 var createSupaCloudRequestContext = (request) => {
   const subject = safeHeaderValue(request.headers.get(VERIFIED_JWT_SUBJECT_HEADER), 1024);
   const accessToken = subject ? bearerToken(request) : undefined;
-  const requestId = safeHeaderValue(request.headers.get(EXECUTION_ID_HEADER), 256) ?? safeHeaderValue(request.headers.get("x-request-id"), 256) ?? crypto.randomUUID();
+  const requestId = httpRequestId(request) ?? safeHeaderValue(request.headers.get(EXECUTION_ID_HEADER), 256) ?? safeHeaderValue(request.headers.get("x-request-id"), 256) ?? crypto.randomUUID();
   const idempotencyKey = safeHeaderValue(request.headers.get(IDEMPOTENCY_KEY_HEADER), 512);
   const identity = {
     authenticated: subject !== undefined,
@@ -1737,7 +2330,9 @@ function createModulePlugin(compiled, services, ctxFactory = defaultRequestConte
     "data",
     "input",
     "result",
-    "request"
+    "request",
+    "parse",
+    "allowDeleteBody"
   ]);
   for (const controller of compiled.controllers) {
     for (const route of controller.routes) {
@@ -1745,6 +2340,9 @@ function createModulePlugin(compiled, services, ctxFactory = defaultRequestConte
       if (!supportedMethods.has(route.method) || unsupported.length > 0) {
         throw new ApplicationError(`Unsupported compiled route ${route.method} ${controller.path}${route.path}` + (unsupported.length > 0 ? `: ${unsupported.join(", ")}` : ""), { code: "ROUTE_DESCRIPTOR_UNSUPPORTED" });
       }
+      if (route.parse !== undefined && route.parse !== "none" || route.parse === "none" && (route.body !== undefined || route.contract?.body !== "domain" || !route.contract.evidence?.trim()) || route.allowDeleteBody !== undefined && (route.allowDeleteBody !== true || route.method !== "DELETE" || route.body === undefined)) {
+        throw new ApplicationError(`Invalid compiled body policy on ${route.method} ${controller.path}${route.path}`, { code: "ROUTE_DESCRIPTOR_UNSUPPORTED" });
+      }
     }
   }
   const hasCommandRoutes = compiled.controllers.some((controller) => controller.routes.some((route) => route.command !== undefined));
@@ -1765,7 +2363,11 @@ function createModulePlugin(compiled, services, ctxFactory = defaultRequestConte
   const requestContexts = new WeakMap;
   const governanceExecutor = options.commandGovernance ? createCommandExecutor(options.commandGovernance, options.onExecution) : undefined;
   const commandExecutor = options.commandExecutor && governanceExecutor ? composeCommandExecutors(options.commandExecutor, governanceExecutor) : options.commandExecutor ?? governanceExecutor;
-  const plugin = new Elysia2({ name: `supacloud:${compiled.name}`, normalize: options.normalize ?? true }).decorate("services", services);
+  const plugin = mountHttp(options.http, `supacloud:${compiled.name}`, options.normalize ?? true).resolve(async (context) => {
+    const requestContext = await ctxFactory(context.request, context);
+    requestContexts.set(context.request, requestContext);
+    return { services, requestContext };
+  });
   const createRequestScope = compiled.createRequestScope;
   const requestScopes = new WeakMap;
   if (compiled.destroyRequestScope) {
@@ -1782,11 +2384,6 @@ function createModulePlugin(compiled, services, ctxFactory = defaultRequestConte
       }
     });
   }
-  plugin.resolve(async ({ request }) => {
-    const requestContext = await ctxFactory(request);
-    requestContexts.set(request, requestContext);
-    return { requestContext };
-  });
   plugin.onError(async ({ code, error, request }) => {
     const context = {
       request,
@@ -1796,12 +2393,77 @@ function createModulePlugin(compiled, services, ctxFactory = defaultRequestConte
     const mapped = await options.errorMapper?.(error, context);
     return mapped ?? defaultErrorResponse(error, code);
   });
+  const routeRegistrar = plugin;
   for (const controller of compiled.controllers) {
     for (const route of controller.routes) {
       const path = joinPaths(controller.path, route.path);
-      const schema = toElysiaRouteSchema(route);
+      const documentation = route.data?.openapi;
+      const hidden = documentation !== null && typeof documentation === "object" && "hide" in documentation && documentation.hide === true;
+      const schema = {
+        ...toElysiaRouteSchema(route),
+        ...route.parse === "none" ? { parse: "none" } : {},
+        ...route.title || hidden ? { detail: {
+          ...route.title ? { summary: route.title } : {},
+          ...hidden ? { hide: true } : {}
+        } } : {}
+      };
+      const policies = compileHttpPolicies(route, path, options.httpPolicies);
+      if (policies.length > 0) {
+        Object.assign(schema, {
+          beforeHandle: async (context) => {
+            for (const policy of policies) {
+              const result = await policy({
+                http: context,
+                requestContext: requestContexts.get(context.request)
+              });
+              if (result instanceof Response)
+                return result;
+              if (result !== undefined) {
+                throw new Error("HTTP policies must return Response or undefined");
+              }
+            }
+          }
+        });
+      }
+      const responsePolicies = policies.filter((policy) => policy.afterResponse);
+      const mappingPolicies = policies.filter((policy) => policy.mapResponse);
+      if (mappingPolicies.length > 0) {
+        Object.assign(schema, {
+          mapResponse: async (context) => {
+            let response = context.response;
+            let mapped;
+            for (const policy of mappingPolicies) {
+              const result = await policy.mapResponse({
+                http: context,
+                requestContext: requestContexts.get(context.request),
+                response
+              });
+              if (result !== undefined) {
+                if (!(result instanceof Response))
+                  throw new Error("HTTP response policies must return Response or undefined");
+                mapped = result;
+                response = result;
+              }
+            }
+            return mapped;
+          }
+        });
+      }
+      if (responsePolicies.length > 0) {
+        Object.assign(schema, {
+          afterResponse: async (context) => {
+            for (const policy of responsePolicies) {
+              await policy.afterResponse({
+                http: context,
+                requestContext: requestContexts.get(context.request),
+                response: context.response
+              });
+            }
+          }
+        });
+      }
       const handler = async (ctx) => {
-        const requestContext = ctx.requestContext ?? await ctxFactory(ctx.request);
+        const requestContext = requestContexts.get(ctx.request);
         const execute = async () => {
           const requestScope = createRequestScope ? await createRequestScope(services, requestContext, imported) : undefined;
           if (requestScope && compiled.destroyRequestScope)
@@ -1893,25 +2555,25 @@ function createModulePlugin(compiled, services, ctxFactory = defaultRequestConte
       };
       switch (route.method) {
         case "GET":
-          plugin.get(path, handler, schema);
+          routeRegistrar.get(path, handler, schema);
           break;
         case "POST":
-          plugin.post(path, handler, schema);
+          routeRegistrar.post(path, handler, schema);
           break;
         case "PUT":
-          plugin.put(path, handler, schema);
+          routeRegistrar.put(path, handler, schema);
           break;
         case "PATCH":
-          plugin.patch(path, handler, schema);
+          routeRegistrar.patch(path, handler, schema);
           break;
         case "DELETE":
-          plugin.delete(path, handler, schema);
+          routeRegistrar.delete(path, handler, schema);
           break;
         case "HEAD":
-          plugin.head(path, handler, schema);
+          routeRegistrar.head(path, handler, schema);
           break;
         case "OPTIONS":
-          plugin.options(path, handler, schema);
+          routeRegistrar.options(path, handler, schema);
           break;
       }
     }
@@ -2013,16 +2675,16 @@ function isPublicApplicationError(error) {
   return error.expose === true && typeof error.status === "number" && Number.isInteger(error.status) && error.status >= 400 && error.status <= 599 && typeof error.code === "string" && error.code.length > 0;
 }
 function createApplication(options) {
-  const app = new Elysia2({ name: options.name ?? "supacloud:app", normalize: options.normalize ?? true });
+  const app = new Elysia3({ name: options.name ?? "supacloud:app", normalize: options.normalize ?? true });
   if (options.documentation)
     app.use(createDocumentationPlugin(options.documentation));
   const configuredContextFactory = options.requestContext ?? defaultRequestContext;
   const contextCache = new WeakMap;
-  const ctxFactory = (request) => {
+  const ctxFactory = (request, context) => {
     const cached = contextCache.get(request);
     if (cached)
       return cached;
-    const pending = Promise.resolve(configuredContextFactory(request));
+    const pending = Promise.resolve(configuredContextFactory(request, context));
     contextCache.set(request, pending);
     return pending;
   };
@@ -2032,7 +2694,7 @@ function createApplication(options) {
     imported[module.name] = services;
     app.use(createModulePlugin(module, services, ctxFactory, options, imported));
   }
-  return app;
+  return app.use(contextPlugin(options.http));
 }
 function createTestApp(options) {
   return createApplication(options);
@@ -2040,6 +2702,8 @@ function createTestApp(options) {
 export {
   ApplicationError,
   EXECUTION_ID_HEADER,
+  HTTP_POLICY_STORE_SQL,
+  HttpPolicyConfigurationError,
   IDEMPOTENCY_KEY_HEADER,
   SchemaContractError,
   SupaCloudWorker,
@@ -2048,16 +2712,22 @@ export {
   WorkerRegistrationError,
   assertFeatureTransition,
   assertResponseStatusDeclared,
+  bindCompiledCommand,
   composeAspects,
   composeCommandExecutors,
   createApplication,
   createCommandAuthorizationAdapter,
   createCommandExecutor,
   createDocumentationPlugin,
+  createHttpPolicySuite,
+  createHttpTelemetry,
+  createMemoryHttpCacheStore,
+  createMemoryHttpRateLimitStore,
   createMemoryPolicy,
   createMemorySandbox,
   createModulePlugin,
   createPersistentCommandAdapter,
+  createPostgresHttpPolicyStores,
   createQueueWorkerTransport,
   createSchemaDecoder,
   createSupAuthRequestContext,