actor-ts 0.9.1 → 0.10.0

package/dist/http/backend/HttpServerBackend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"HttpServerBackend.d.ts","sourceRoot":"","sources":["../../../src/http/backend/HttpServerBackend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEzE,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAAC;CAC9E;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,MAAM,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,wFAAwF;IACxF,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAE9C,4EAA4E;IAC5E,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAE3D,yDAAyD;IACzD,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC;IAExF,kDAAkD;IAClD,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC;CAC3G"}
+{"version":3,"file":"HttpServerBackend.d.ts","sourceRoot":"","sources":["../../../src/http/backend/HttpServerBackend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAErE,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAAC;CAC9E;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACvE,kFAAkF;IAClF,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,sBAAsB,KAAK,IAAI,CAAC;CACnF;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,MAAM,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,wFAAwF;IACxF,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAE9C,4EAA4E;IAC5E,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAE3D,yDAAyD;IACzD,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC;IAExF,kDAAkD;IAClD,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC;IAE1G;;;;OAIG;IACH,iBAAiB,CAAC,CAAC,GAAG,EAAE,0BAA0B,GAAG,IAAI,CAAC;CAC3D"}

package/dist/http/index.d.ts

@@ -1,16 +1,22 @@
 export { HttpExtension, HttpExtensionId } from './HttpExtension.js';
 export type { ServerBuilder } from './HttpExtension.js';
-export { concat, complete, completeJson, completeText, compile, del, get, head, options, patch, path, pathParam, pathPrefix, post, put, queryParam, redirect, reject, } from './Route.js';
-export type { CompiledRoute, Route } from './Route.js';
+export { concat, complete, completeJson, completeText, compile, del, get, head, options, patch, path, pathParam, pathPrefix, post, put, queryParam, redirect, reject, withMiddleware, } from './Route.js';
+export type { CompiledRoute, CompiledWebSocketRoute, CompiledEndpoint, Middleware, Route, WebSocketConnectHandler, } from './Route.js';
+export { BearerTokenAuth, IpAllowlist } from './middleware/index.js';
+export type { BearerTokenAuthOptions, IpAllowlistOptions } from './middleware/index.js';
 export { entity, marshal, pickRequestSerializer, pickResponseSerializer } from './Marshalling.js';
 export { HttpClient } from './HttpClient.js';
 export type { HttpClientRequest, HttpClientResponse } from './HttpClient.js';
 export { FastifyBackend } from './backend/FastifyBackend.js';
 export { ExpressBackend } from './backend/ExpressBackend.js';
-export type { ExpressBackendOptions } from './backend/ExpressBackend.js';
+export { ExpressBackendOptions, ExpressBackendOptionsBuilder } from './backend/ExpressBackendOptions.js';
+export type { ExpressBackendOptionsType } from './backend/ExpressBackendOptions.js';
 export { HonoBackend } from './backend/HonoBackend.js';
-export type { HonoBackendOptions } from './backend/HonoBackend.js';
-export type { HttpServerBackend, RouteRegistration, ServerBinding, } from './backend/HttpServerBackend.js';
+export { HonoBackendOptions, HonoBackendOptionsBuilder } from './backend/HonoBackendOptions.js';
+export type { HonoBackendOptionsType } from './backend/HonoBackendOptions.js';
+export type { HttpServerBackend, RouteRegistration, WebSocketRouteRegistration, ServerBinding, } from './backend/HttpServerBackend.js';
+export type { WebSocketSocketAdapter, WebSocketListeners } from './ws/SocketAdapter.js';
+export * from './ws/index.js';
 export { HttpError, Status, } from './types.js';
 export type { HttpMethod, HttpRequest, HttpResponse } from './types.js';
 export { rateLimit, idempotent, cached } from './cache/index.js';

package/dist/http/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EACL,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,KAAK,EACL,IAAI,EACJ,SAAS,EACT,UAAU,EACV,IAAI,EACJ,GAAG,EACH,UAAU,EACV,QAAQ,EACR,MAAM,GACP,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEvD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAElG,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,YAAY,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,GACd,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,SAAS,EACT,MAAM,GACP,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAGxE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACjE,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EACL,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,KAAK,EACL,IAAI,EACJ,SAAS,EACT,UAAU,EACV,IAAI,EACJ,GAAG,EACH,UAAU,EACV,QAAQ,EACR,MAAM,EACN,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,aAAa,EACb,sBAAsB,EACtB,gBAAgB,EAChB,UAAU,EACV,KAAK,EACL,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACrE,YAAY,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAExF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAElG,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACzG,YAAY,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAChG,YAAY,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,0BAA0B,EAC1B,aAAa,GACd,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAGxF,cAAc,eAAe,CAAC;AAE9B,OAAO,EACL,SAAS,EACT,MAAM,GACP,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAGxE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACjE,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC"}

package/dist/http/index.js

@@ -1,10 +1,17 @@
 export { HttpExtension, HttpExtensionId } from './HttpExtension.js';
-export { concat, complete, completeJson, completeText, compile, del, get, head, options, patch, path, pathParam, pathPrefix, post, put, queryParam, redirect, reject, } from './Route.js';
+export { concat, complete, completeJson, completeText, compile, del, get, head, options, patch, path, pathParam, pathPrefix, post, put, queryParam, redirect, reject, withMiddleware, } from './Route.js';
+// Auth + IP-allowlist middleware (#312).  Exported from
+// `./middleware/index.js`; barrel re-exports both for convenience.
+export { BearerTokenAuth, IpAllowlist } from './middleware/index.js';
 export { entity, marshal, pickRequestSerializer, pickResponseSerializer } from './Marshalling.js';
 export { HttpClient } from './HttpClient.js';
 export { FastifyBackend } from './backend/FastifyBackend.js';
 export { ExpressBackend } from './backend/ExpressBackend.js';
+export { ExpressBackendOptions, ExpressBackendOptionsBuilder } from './backend/ExpressBackendOptions.js';
 export { HonoBackend } from './backend/HonoBackend.js';
+export { HonoBackendOptions, HonoBackendOptionsBuilder } from './backend/HonoBackendOptions.js';
+// Typed WebSocket stack — websocket() directive, server actor, codecs.
+export * from './ws/index.js';
 export { HttpError, Status, } from './types.js';
 // HTTP caching middleware (response-cache, rate-limit, idempotency-key).
 export { rateLimit, idempotent, cached } from './cache/index.js';

package/dist/http/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGpE,OAAO,EACL,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,KAAK,EACL,IAAI,EACJ,SAAS,EACT,UAAU,EACV,IAAI,EACJ,GAAG,EACH,UAAU,EACV,QAAQ,EACR,MAAM,GACP,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAElG,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAQvD,OAAO,EACL,SAAS,EACT,MAAM,GACP,MAAM,YAAY,CAAC;AAGpB,yEAAyE;AACzE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGpE,OAAO,EACL,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,KAAK,EACL,IAAI,EACJ,SAAS,EACT,UAAU,EACV,IAAI,EACJ,GAAG,EACH,UAAU,EACV,QAAQ,EACR,MAAM,EACN,cAAc,GACf,MAAM,YAAY,CAAC;AAUpB,wDAAwD;AACxD,mEAAmE;AACnE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGrE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAElG,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAEzG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAUhG,uEAAuE;AACvE,cAAc,eAAe,CAAC;AAE9B,OAAO,EACL,SAAS,EACT,MAAM,GACP,MAAM,YAAY,CAAC;AAGpB,yEAAyE;AACzE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/http/middleware/BearerToken.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Shared-secret bearer-token authentication middleware (#312).
+ *
+ * Use this to gate routes that need to be accessible only to operators
+ * holding a pre-shared secret — typically the destructive management
+ * endpoints (`/cluster/down`, `/cluster/leave`).  Comparison is
+ * constant-time so an attacker probing tokens can't distinguish
+ * "first character wrong" from "last character wrong" by timing.
+ */
+import type { Middleware } from '../Route.js';
+export interface BearerTokenAuthOptions {
+    /**
+     * Acceptable tokens — at least one must match the
+     * `Authorization: Bearer <token>` header.  Multiple entries support
+     * rotation: emit a new token, deploy clients with the new token,
+     * then drop the old entry.
+     */
+    readonly tokens: ReadonlyArray<string>;
+    /**
+     * Header name to read the token from.  Default: `'authorization'`.
+     * HTTP header names are lower-cased by the framework — pass them
+     * lower-case here too.
+     */
+    readonly headerName?: string;
+    /**
+     * Realm advertised in `WWW-Authenticate` on 401.  Default: `'actor-ts'`.
+     */
+    readonly realm?: string;
+}
+/**
+ * Build a `Middleware` that 401s every request unless the
+ * `Authorization: Bearer <token>` header carries one of the configured
+ * tokens.  Pass it to `withMiddleware(BearerTokenAuth({tokens: [...]}), route)`.
+ *
+ *     const protected = withMiddleware(
+ *       BearerTokenAuth({ tokens: [process.env.MGMT_TOKEN!] }),
+ *       path('cluster', concat(
+ *         path('down', post(handleDown)),
+ *         path('leave', post(handleLeave)),
+ *       )),
+ *     );
+ */
+export declare function BearerTokenAuth(opts: BearerTokenAuthOptions): Middleware;
+//# sourceMappingURL=BearerToken.d.ts.map

package/dist/http/middleware/BearerToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BearerToken.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/BearerToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,UAAU,CA+CxE"}

package/dist/http/middleware/BearerToken.js

@@ -0,0 +1,72 @@
+/**
+ * Shared-secret bearer-token authentication middleware (#312).
+ *
+ * Use this to gate routes that need to be accessible only to operators
+ * holding a pre-shared secret — typically the destructive management
+ * endpoints (`/cluster/down`, `/cluster/leave`).  Comparison is
+ * constant-time so an attacker probing tokens can't distinguish
+ * "first character wrong" from "last character wrong" by timing.
+ */
+import { timingSafeEqual } from 'node:crypto';
+import { HttpError, Status } from '../types.js';
+/**
+ * Build a `Middleware` that 401s every request unless the
+ * `Authorization: Bearer <token>` header carries one of the configured
+ * tokens.  Pass it to `withMiddleware(BearerTokenAuth({tokens: [...]}), route)`.
+ *
+ *     const protected = withMiddleware(
+ *       BearerTokenAuth({ tokens: [process.env.MGMT_TOKEN!] }),
+ *       path('cluster', concat(
+ *         path('down', post(handleDown)),
+ *         path('leave', post(handleLeave)),
+ *       )),
+ *     );
+ */
+export function BearerTokenAuth(opts) {
+    if (opts.tokens.length === 0) {
+        throw new Error('BearerTokenAuth: tokens must be a non-empty list');
+    }
+    const headerName = (opts.headerName ?? 'authorization').toLowerCase();
+    const realm = opts.realm ?? 'actor-ts';
+    // Pre-encode tokens once for constant-time comparison.
+    const expected = opts.tokens.map((t) => new TextEncoder().encode(t));
+    return async (req, next) => {
+        const header = req.headers[headerName];
+        if (!header) {
+            throw new HttpError(Status.Unauthorized, 'missing Authorization header', {
+                wwwAuthenticate: `Bearer realm="${realm}"`,
+            });
+        }
+        // Header value must look like `Bearer <token>`.  Reject anything else
+        // to avoid accidental matches against scheme-prefixed values.
+        const match = /^Bearer\s+(.+)$/.exec(header);
+        if (!match) {
+            throw new HttpError(Status.Unauthorized, 'authorization scheme must be Bearer', {
+                wwwAuthenticate: `Bearer realm="${realm}"`,
+            });
+        }
+        const presented = new TextEncoder().encode(match[1].trim());
+        let matched = false;
+        // We MUST iterate every expected token regardless of an early match
+        // so the total comparison time is constant across the (legit-token,
+        // wrong-token, no-token) outcomes.  `timingSafeEqual` itself is
+        // constant-time only when buffers are the same length, so we
+        // length-mismatch any mismatched-length comparison after a probe.
+        for (const candidate of expected) {
+            const equal = candidate.length === presented.length
+                && timingSafeEqual(candidate, presented);
+            // OR the result without short-circuiting.  `||=` on a boolean
+            // doesn't short-circuit at the bytecode level here because both
+            // operands are already evaluated above.
+            if (equal)
+                matched = true;
+        }
+        if (!matched) {
+            throw new HttpError(Status.Unauthorized, 'invalid bearer token', {
+                wwwAuthenticate: `Bearer realm="${realm}"`,
+            });
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=BearerToken.js.map

package/dist/http/middleware/BearerToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BearerToken.js","sourceRoot":"","sources":["../../../src/http/middleware/BearerToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAuBhD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC;IAEvC,uDAAuD;IACvD,MAAM,QAAQ,GAAiB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnF,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,8BAA8B,EAAE;gBACvE,eAAe,EAAE,iBAAiB,KAAK,GAAG;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,qCAAqC,EAAE;gBAC9E,eAAe,EAAE,iBAAiB,KAAK,GAAG;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,oEAAoE;QACpE,oEAAoE;QACpE,gEAAgE;QAChE,6DAA6D;QAC7D,kEAAkE;QAClE,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;mBAC9C,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC3C,8DAA8D;YAC9D,gEAAgE;YAChE,wCAAwC;YACxC,IAAI,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,sBAAsB,EAAE;gBAC/D,eAAe,EAAE,iBAAiB,KAAK,GAAG;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/http/middleware/IpAllowlist.d.ts

@@ -0,0 +1,45 @@
+/**
+ * CIDR-based IP allowlist middleware (#312).
+ *
+ * Restricts a route subtree to clients whose IP falls inside one of
+ * the configured CIDRs.  Defence-in-depth on top of bearer-token auth
+ * (`BearerTokenAuth`): even if a token leaks, the attacker also needs
+ * to be on an allowlisted network to use it.
+ *
+ * Supports both IPv4 and IPv6 CIDRs in standard notation:
+ *   - `'10.0.0.0/8'` — RFC 1918 private space
+ *   - `'127.0.0.1/32'` — single host
+ *   - `'::1/128'` — IPv6 loopback
+ *   - `'fd00::/8'` — IPv6 ULA range
+ *
+ * IPv4-mapped IPv6 addresses (`::ffff:a.b.c.d`) are normalised so an
+ * IPv4 CIDR matches a request coming over a dual-stack socket.
+ *
+ * **Source of truth for the client IP** is the underlying socket
+ * (`req.remoteAddress`).  Operators behind a trusted reverse proxy
+ * (Cloudflare, AWS ALB, NGINX) that strip + set
+ * `x-forwarded-for` must pass a custom `getClientIp` that reads the
+ * header — the default DOES NOT trust `x-forwarded-for` because that
+ * header is client-spoofable when there's no proxy in front.
+ */
+import type { HttpRequest } from '../types.js';
+import type { Middleware } from '../Route.js';
+export interface IpAllowlistOptions {
+    /**
+     * One or more CIDR strings.  At least one must match the resolved
+     * client IP or the request gets a 403.
+     */
+    readonly allow: ReadonlyArray<string>;
+    /**
+     * Override the IP-extraction step.  Default: `req.remoteAddress`.
+     * Common override for deployments behind a trusted proxy:
+     *
+     *     getClientIp: (req) => req.headers['x-forwarded-for']?.split(',')[0]?.trim()
+     *
+     * Returning `null` / `undefined` makes the request fail closed
+     * (403) — no IP means no decision means deny.
+     */
+    readonly getClientIp?: (req: HttpRequest) => string | null | undefined;
+}
+export declare function IpAllowlist(opts: IpAllowlistOptions): Middleware;
+//# sourceMappingURL=IpAllowlist.d.ts.map

package/dist/http/middleware/IpAllowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IpAllowlist.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/IpAllowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACxE;AAUD,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,UAAU,CAkBhE"}

package/dist/http/middleware/IpAllowlist.js

@@ -0,0 +1,148 @@
+/**
+ * CIDR-based IP allowlist middleware (#312).
+ *
+ * Restricts a route subtree to clients whose IP falls inside one of
+ * the configured CIDRs.  Defence-in-depth on top of bearer-token auth
+ * (`BearerTokenAuth`): even if a token leaks, the attacker also needs
+ * to be on an allowlisted network to use it.
+ *
+ * Supports both IPv4 and IPv6 CIDRs in standard notation:
+ *   - `'10.0.0.0/8'` — RFC 1918 private space
+ *   - `'127.0.0.1/32'` — single host
+ *   - `'::1/128'` — IPv6 loopback
+ *   - `'fd00::/8'` — IPv6 ULA range
+ *
+ * IPv4-mapped IPv6 addresses (`::ffff:a.b.c.d`) are normalised so an
+ * IPv4 CIDR matches a request coming over a dual-stack socket.
+ *
+ * **Source of truth for the client IP** is the underlying socket
+ * (`req.remoteAddress`).  Operators behind a trusted reverse proxy
+ * (Cloudflare, AWS ALB, NGINX) that strip + set
+ * `x-forwarded-for` must pass a custom `getClientIp` that reads the
+ * header — the default DOES NOT trust `x-forwarded-for` because that
+ * header is client-spoofable when there's no proxy in front.
+ */
+import { HttpError, Status } from '../types.js';
+export function IpAllowlist(opts) {
+    if (opts.allow.length === 0) {
+        throw new Error('IpAllowlist: `allow` must be a non-empty list of CIDRs');
+    }
+    const parsed = opts.allow.map(parseCidr);
+    const getClientIp = opts.getClientIp ?? ((req) => req.remoteAddress);
+    return async (req, next) => {
+        const rawIp = getClientIp(req);
+        if (!rawIp) {
+            throw new HttpError(Status.Forbidden, 'IP not allowed (no client address)');
+        }
+        const matched = parsed.some((cidr) => ipMatches(rawIp, cidr));
+        if (!matched) {
+            throw new HttpError(Status.Forbidden, `IP not allowed: ${rawIp}`);
+        }
+        return next();
+    };
+}
+/* ------------------------------- internals ------------------------------- */
+/** Parse a `<address>/<prefix>` CIDR.  Throws on syntactically-invalid input. */
+function parseCidr(cidr) {
+    const slash = cidr.lastIndexOf('/');
+    if (slash < 0) {
+        throw new Error(`IpAllowlist: missing prefix length in CIDR "${cidr}"`);
+    }
+    const addr = cidr.slice(0, slash);
+    const prefixStr = cidr.slice(slash + 1);
+    const prefixBits = Number(prefixStr);
+    if (!Number.isInteger(prefixBits) || prefixBits < 0) {
+        throw new Error(`IpAllowlist: invalid prefix length in CIDR "${cidr}"`);
+    }
+    const ipv6 = addr.includes(':');
+    const totalBits = ipv6 ? 128 : 32;
+    if (prefixBits > totalBits) {
+        throw new Error(`IpAllowlist: prefix /${prefixBits} exceeds ${totalBits} bits in CIDR "${cidr}"`);
+    }
+    const fullMask = (BigInt(1) << BigInt(totalBits)) - BigInt(1);
+    const hostMask = fullMask >> BigInt(prefixBits);
+    const ipBn = ipToBigInt(addr, ipv6);
+    const network = ipBn & ~hostMask & fullMask;
+    return { ipv6, network, prefixBits, totalBits };
+}
+/** True if `ip` falls inside `cidr`.  Handles v4-in-v6 normalisation. */
+function ipMatches(ip, cidr) {
+    // IPv4-mapped IPv6 (`::ffff:a.b.c.d`) — strip the prefix so a plain
+    // IPv4 CIDR can match a dual-stack socket peer.
+    const stripped = stripV4Mapped(ip);
+    const requestIpv6 = stripped.includes(':');
+    if (requestIpv6 !== cidr.ipv6)
+        return false;
+    let candidate;
+    try {
+        candidate = ipToBigInt(stripped, requestIpv6);
+    }
+    catch {
+        return false; // unparseable address can't match any CIDR
+    }
+    const fullMask = (BigInt(1) << BigInt(cidr.totalBits)) - BigInt(1);
+    const hostMask = fullMask >> BigInt(cidr.prefixBits);
+    return (candidate & ~hostMask & fullMask) === cidr.network;
+}
+function stripV4Mapped(ip) {
+    // `::ffff:1.2.3.4` (RFC 4291 v4-mapped) or `::1.2.3.4` (deprecated v4-compat).
+    if (ip.toLowerCase().startsWith('::ffff:') && ip.includes('.')) {
+        return ip.slice('::ffff:'.length);
+    }
+    if (ip.startsWith('::') && ip.length > 2 && ip.includes('.') && !ip.toLowerCase().includes('ffff')) {
+        return ip.slice(2);
+    }
+    return ip;
+}
+function ipToBigInt(ip, isV6) {
+    if (!isV6)
+        return ipv4ToBigInt(ip);
+    return ipv6ToBigInt(ip);
+}
+function ipv4ToBigInt(ip) {
+    const parts = ip.split('.');
+    if (parts.length !== 4)
+        throw new Error(`IpAllowlist: invalid IPv4 "${ip}"`);
+    let n = BigInt(0);
+    for (const p of parts) {
+        const v = Number(p);
+        if (!Number.isInteger(v) || v < 0 || v > 255) {
+            throw new Error(`IpAllowlist: invalid IPv4 octet in "${ip}"`);
+        }
+        n = (n << BigInt(8)) | BigInt(v);
+    }
+    return n;
+}
+function ipv6ToBigInt(ip) {
+    // Expand `::` to the full 8-group form.  Standard library doesn't
+    // expose a parser; this implementation handles all RFC 5952 forms
+    // we care about (with one `::` shorthand at most).
+    const halves = ip.split('::');
+    if (halves.length > 2)
+        throw new Error(`IpAllowlist: invalid IPv6 (multiple "::") in "${ip}"`);
+    const left = halves[0] === '' ? [] : halves[0].split(':');
+    const right = halves[1] === undefined ? [] : (halves[1] === '' ? [] : halves[1].split(':'));
+    // Fill the middle with zeros so total length is 8 groups.
+    const missing = 8 - (left.length + right.length);
+    if (missing < 0 && halves.length === 1) {
+        // No `::` shorthand — must already be 8 groups.
+    }
+    else if (missing < 0) {
+        throw new Error(`IpAllowlist: IPv6 "${ip}" has too many groups`);
+    }
+    const groups = halves.length === 1
+        ? ip.split(':')
+        : [...left, ...new Array(missing).fill('0'), ...right];
+    if (groups.length !== 8) {
+        throw new Error(`IpAllowlist: IPv6 "${ip}" did not expand to 8 groups (got ${groups.length})`);
+    }
+    let n = BigInt(0);
+    for (const g of groups) {
+        if (!/^[0-9a-fA-F]{1,4}$/.test(g)) {
+            throw new Error(`IpAllowlist: invalid IPv6 group "${g}" in "${ip}"`);
+        }
+        n = (n << BigInt(16)) | BigInt(parseInt(g, 16));
+    }
+    return n;
+}
+//# sourceMappingURL=IpAllowlist.js.map

package/dist/http/middleware/IpAllowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IpAllowlist.js","sourceRoot":"","sources":["../../../src/http/middleware/IpAllowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA8BhD,MAAM,UAAU,WAAW,CAAC,IAAwB;IAClD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAErE,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,iFAAiF;AACjF,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,IAAI,UAAU,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,wBAAwB,UAAU,YAAY,SAAS,kBAAkB,IAAI,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AAClD,CAAC;AAED,yEAAyE;AACzE,SAAS,SAAS,CAAC,EAAU,EAAE,IAAgB;IAC7C,oEAAoE;IACpE,gDAAgD;IAChD,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,WAAW,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAE,2CAA2C;IAC5D,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrD,OAAO,CAAC,SAAS,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,+EAA+E;IAC/E,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnG,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,EAAU,EAAE,IAAa;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,YAAY,CAAC,EAAE,CAAC,CAAC;IACnC,OAAO,YAAY,CAAC,EAAE,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IAC7E,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,kEAAkE;IAClE,kEAAkE;IAClE,mDAAmD;IACnD,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,EAAE,GAAG,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7F,0DAA0D;IAC1D,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,gDAAgD;IAClD,CAAC;SAAM,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC;QAChC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;QACf,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sBAAsB,EAAE,qCAAqC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/http/middleware/index.d.ts

@@ -0,0 +1,5 @@
+export { BearerTokenAuth } from './BearerToken.js';
+export type { BearerTokenAuthOptions } from './BearerToken.js';
+export { IpAllowlist } from './IpAllowlist.js';
+export type { IpAllowlistOptions } from './IpAllowlist.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/http/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,YAAY,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/http/middleware/index.js

@@ -0,0 +1,3 @@
+export { BearerTokenAuth } from './BearerToken.js';
+export { IpAllowlist } from './IpAllowlist.js';
+//# sourceMappingURL=index.js.map

package/dist/http/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/http/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/http/types.d.ts

@@ -13,6 +13,15 @@ export interface HttpRequest {
     readonly params: Readonly<Record<string, string>>;
     /** Raw bytes of the request body (undefined for GET / HEAD). */
     readonly body: Uint8Array | null;
+    /**
+     * Optional remote IP address of the client as the server saw it
+     * (NOT the value of `x-forwarded-for` — that's a header the client
+     * can spoof unless a trusted proxy stripped + replaced it).  Backends
+     * SHOULD populate this from the underlying socket peer; consumers
+     * that need to trust a forwarded header MUST do so explicitly (see
+     * `IpAllowlist`'s `getClientIp` option).
+     */
+    readonly remoteAddress?: string;
 }
 export interface HttpResponse {
     readonly status: number;

package/dist/http/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/http/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;IACxE,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,yEAAyE;IACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,IAAI,CAAC;IACpD,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,yEAAyE;AACzE,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;IAejB,gGAAgG;;;;;;CAMxF,CAAC;AAEX,4EAA4E;AAC5E,qBAAa,SAAU,SAAQ,KAAK;aAEhB,MAAM,EAAE,MAAM;aAEd,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAFzC,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM,EACC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,YAAA;CAK5D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/http/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;IACxE,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,yEAAyE;IACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,IAAI,CAAC;IACpD,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,yEAAyE;AACzE,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;IAejB,gGAAgG;;;;;;CAMxF,CAAC;AAEX,4EAA4E;AAC5E,qBAAa,SAAU,SAAQ,KAAK;aAEhB,MAAM,EAAE,MAAM;aAEd,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAFzC,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM,EACC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,YAAA;CAK5D"}

package/dist/http/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/http/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAwBH,yEAAyE;AACzE,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,EAAE,EAAE,GAAG;IACP,OAAO,EAAE,GAAG;IACZ,QAAQ,EAAE,GAAG;IACb,SAAS,EAAE,GAAG;IACd,gBAAgB,EAAE,GAAG;IACrB,KAAK,EAAE,GAAG;IACV,WAAW,EAAE,GAAG;IAChB,UAAU,EAAE,GAAG;IACf,YAAY,EAAE,GAAG;IACjB,SAAS,EAAE,GAAG;IACd,QAAQ,EAAE,GAAG;IACb,gBAAgB,EAAE,GAAG;IACrB,QAAQ,EAAE,GAAG;IACb,oBAAoB,EAAE,GAAG;IACzB,gGAAgG;IAChG,mBAAmB,EAAE,GAAG;IACxB,eAAe,EAAE,GAAG;IACpB,mBAAmB,EAAE,GAAG;IACxB,UAAU,EAAE,GAAG;IACf,kBAAkB,EAAE,GAAG;CACf,CAAC;AAEX,4EAA4E;AAC5E,MAAM,OAAO,SAAU,SAAQ,KAAK;IAEhB;IAEA;IAHlB,YACkB,MAAc,EAC9B,OAAe,EACC,KAAyC;QAEzD,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,WAAM,GAAN,MAAM,CAAQ;QAEd,UAAK,GAAL,KAAK,CAAoC;QAGzD,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/http/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAiCH,yEAAyE;AACzE,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,EAAE,EAAE,GAAG;IACP,OAAO,EAAE,GAAG;IACZ,QAAQ,EAAE,GAAG;IACb,SAAS,EAAE,GAAG;IACd,gBAAgB,EAAE,GAAG;IACrB,KAAK,EAAE,GAAG;IACV,WAAW,EAAE,GAAG;IAChB,UAAU,EAAE,GAAG;IACf,YAAY,EAAE,GAAG;IACjB,SAAS,EAAE,GAAG;IACd,QAAQ,EAAE,GAAG;IACb,gBAAgB,EAAE,GAAG;IACrB,QAAQ,EAAE,GAAG;IACb,oBAAoB,EAAE,GAAG;IACzB,gGAAgG;IAChG,mBAAmB,EAAE,GAAG;IACxB,eAAe,EAAE,GAAG;IACpB,mBAAmB,EAAE,GAAG;IACxB,UAAU,EAAE,GAAG;IACf,kBAAkB,EAAE,GAAG;CACf,CAAC;AAEX,4EAA4E;AAC5E,MAAM,OAAO,SAAU,SAAQ,KAAK;IAEhB;IAEA;IAHlB,YACkB,MAAc,EAC9B,OAAe,EACC,KAAyC;QAEzD,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,WAAM,GAAN,MAAM,CAAQ;QAEd,UAAK,GAAL,KAAK,CAAoC;QAGzD,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF"}

package/dist/http/ws/ConnectionWiring.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Shared connection-wiring layer.  Everything that turns an accepted
+ * upgrade into a live actor-backed connection lives here, so the three
+ * HTTP backends stay thin (they only produce a
+ * {@link WebSocketSocketAdapter}).
+ *
+ * This file grows across the WebSocket work:
+ *   - {@link ConnectionTracker} / {@link trackSocket} — shutdown bookkeeping
+ *     (used by `HttpExtension.bind`'s unbind path).
+ *   - `wireConnection` — spawns the per-connection session actor and
+ *     attaches listeners synchronously (added with the actor layer).
+ */
+import type { ActorSystem } from '../../ActorSystem.js';
+import type { HttpRequest } from '../types.js';
+import type { WebSocketSocketAdapter } from './SocketAdapter.js';
+import { type WsServerRef } from './WsMessages.js';
+import type { WsCodec } from './WsCodec.js';
+import type { ResolvedWsPolicy } from './WsPolicy.js';
+/**
+ * Tracks the live server-side sockets of one binding so `unbind()` can
+ * close them.  Without this a long-lived WebSocket keeps the HTTP
+ * server's `close()` pending forever (the process refuses to exit).
+ */
+export declare class ConnectionTracker {
+    private readonly sockets;
+    add(socket: WebSocketSocketAdapter): void;
+    remove(socket: WebSocketSocketAdapter): void;
+    get size(): number;
+    /** Send a polite close frame to every tracked socket (best-effort). */
+    closeAll(code?: number, reason?: string): void;
+    /** Hard-terminate every tracked socket and forget them all (shutdown). */
+    terminateAll(): void;
+}
+/**
+ * Register `socket` with `tracker` and return a thin wrapper whose
+ * `setListeners` chains tracker removal into `onClose`.  The tracker
+ * always holds the *original* socket, so `closeAll` / `terminateAll`
+ * act on the real thing; the wrapper only ensures we stop tracking a
+ * socket once it closes on its own.
+ */
+export declare function trackSocket(tracker: ConnectionTracker, socket: WebSocketSocketAdapter): WebSocketSocketAdapter;
+/**
+ * Turn one accepted upgrade into a live actor-backed connection.  Called
+ * synchronously from the backend's upgrade callback (via the route's
+ * `connect` handler).
+ *
+ * It does NOT spawn or attach anything itself — instead it tells the hub
+ * a {@link WsAcceptSignal} carrying the per-connection actor's `Props`, so
+ * the hub spawns that actor as its OWN child (`server → conn-N`).  The
+ * child then creates the {@link WsConnection}, reports `connected`, and
+ * attaches the socket listeners in its `preStart`.
+ *
+ * First-frame race: the socket adapter attaches its native listeners
+ * synchronously at upgrade and BUFFERS inbound frames until the child's
+ * `setListeners` runs — so nothing is lost between upgrade and the child
+ * becoming ready.
+ */
+export declare function wireConnection<TOut, TIn, TSelf = never>(_system: ActorSystem, hub: WsServerRef<TOut, TIn, TSelf>, req: HttpRequest, socket: WebSocketSocketAdapter, codec: WsCodec<TOut, TIn>, policy: ResolvedWsPolicy): void;
+//# sourceMappingURL=ConnectionWiring.d.ts.map

package/dist/http/ws/ConnectionWiring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConnectionWiring.d.ts","sourceRoot":"","sources":["../../../src/http/ws/ConnectionWiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGtD;;;;GAIG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAE7D,GAAG,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI;IAIzC,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI;IAI5C,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,uEAAuE;IACvE,QAAQ,CAAC,IAAI,SAAO,EAAE,MAAM,SAAK,GAAG,IAAI;IAUxC,0EAA0E;IAC1E,YAAY,IAAI,IAAI;CAWrB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,sBAAsB,GAC7B,sBAAsB,CA2BxB;AAID;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,KAAK,EACrD,OAAO,EAAE,WAAW,EACpB,GAAG,EAAE,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,EAClC,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,sBAAsB,EAC9B,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EACzB,MAAM,EAAE,gBAAgB,GACvB,IAAI,CAeN"}