raffel 0.1.2

package/dist/middleware/auth.js

@@ -0,0 +1,413 @@
+/**
+ * Authentication Middleware
+ *
+ * Flexible authentication middleware supporting multiple strategies:
+ * - Bearer token (JWT, OAuth tokens)
+ * - API Key
+ * - Custom strategies
+ */
+import { RaffelError } from '../core/index.js';
+/**
+ * Create a bearer token authentication strategy
+ */
+export function createBearerStrategy(options) {
+    const { verify, headerName = 'authorization', tokenPrefix = 'Bearer ' } = options;
+    return {
+        name: 'bearer',
+        async authenticate(envelope) {
+            const authHeader = envelope.metadata?.[headerName] || envelope.metadata?.['Authorization'];
+            if (!authHeader || typeof authHeader !== 'string') {
+                return null; // Strategy doesn't apply
+            }
+            if (!authHeader.startsWith(tokenPrefix)) {
+                return null; // Not a bearer token
+            }
+            const token = authHeader.slice(tokenPrefix.length);
+            return verify(token);
+        },
+    };
+}
+/**
+ * Create an API key authentication strategy
+ */
+export function createApiKeyStrategy(options) {
+    const { verify, headerName = 'x-api-key' } = options;
+    return {
+        name: 'api-key',
+        async authenticate(envelope) {
+            const apiKey = envelope.metadata?.[headerName];
+            if (!apiKey || typeof apiKey !== 'string') {
+                return null; // Strategy doesn't apply
+            }
+            return verify(apiKey);
+        },
+    };
+}
+/**
+ * Simple static API key strategy for development/internal use
+ */
+export function createStaticApiKeyStrategy(validKeys) {
+    return createApiKeyStrategy({
+        async verify(apiKey) {
+            const result = validKeys.get(apiKey);
+            return result || { authenticated: false };
+        },
+    });
+}
+/**
+ * Create a cookie session authentication strategy
+ *
+ * Works with:
+ * - Simple session cookies
+ * - Signed cookies (HMAC-SHA256)
+ * - Chunked cookies (for large JWT sessions)
+ *
+ * @example
+ * ```ts
+ * const cookieAuth = createCookieSessionStrategy({
+ *   cookieName: 'session',
+ *   secret: process.env.COOKIE_SECRET,
+ *   validate: async (sessionId) => {
+ *     const session = await redis.get(`session:${sessionId}`)
+ *     if (!session) return null
+ *     return { authenticated: true, principal: session.userId, claims: session }
+ *   }
+ * })
+ * ```
+ */
+export function createCookieSessionStrategy(options) {
+    const { cookieName = 'session', secret, validate, chunked = false } = options;
+    return {
+        name: 'cookie-session',
+        async authenticate(envelope, ctx) {
+            // Get cookie header from metadata
+            const cookieHeader = envelope.metadata?.['cookie'] || envelope.metadata?.['Cookie'];
+            if (!cookieHeader || typeof cookieHeader !== 'string') {
+                return null; // No cookies
+            }
+            // Parse cookies
+            const cookies = parseCookies(cookieHeader);
+            let sessionId;
+            if (chunked) {
+                // Reassemble chunked cookies
+                sessionId = getChunkedCookie(cookies, cookieName);
+            }
+            else {
+                sessionId = cookies[cookieName];
+            }
+            if (!sessionId) {
+                return null; // No session cookie
+            }
+            // Verify signature if secret provided
+            if (secret) {
+                const verified = verifySignedCookie(sessionId, secret);
+                if (!verified) {
+                    return { authenticated: false }; // Invalid signature
+                }
+                sessionId = verified;
+            }
+            // Validate session
+            return validate(sessionId);
+        },
+    };
+}
+/**
+ * Parse cookie header into key-value pairs
+ */
+function parseCookies(cookieHeader) {
+    const cookies = {};
+    for (const cookie of cookieHeader.split(';')) {
+        const [name, ...valueParts] = cookie.trim().split('=');
+        if (name) {
+            cookies[name.trim()] = decodeURIComponent(valueParts.join('='));
+        }
+    }
+    return cookies;
+}
+/**
+ * Get chunked cookie value (reassembles cookie.0, cookie.1, etc.)
+ */
+function getChunkedCookie(cookies, name) {
+    const chunksCountKey = `${name}.__chunks`;
+    const chunksCount = parseInt(cookies[chunksCountKey] || '0', 10);
+    if (chunksCount === 0) {
+        // Not chunked, try regular cookie
+        return cookies[name];
+    }
+    const chunks = [];
+    for (let i = 0; i < chunksCount; i++) {
+        const chunk = cookies[`${name}.${i}`];
+        if (!chunk)
+            return undefined; // Missing chunk
+        chunks.push(chunk);
+    }
+    return chunks.join('');
+}
+/**
+ * Verify signed cookie (format: value.signature)
+ */
+function verifySignedCookie(signedValue, secret) {
+    const lastDot = signedValue.lastIndexOf('.');
+    if (lastDot === -1)
+        return null;
+    const value = signedValue.slice(0, lastDot);
+    const signature = signedValue.slice(lastDot + 1);
+    // Compute expected signature
+    const expectedSignature = computeHmacSignature(value, secret);
+    // Constant-time comparison
+    if (signature.length !== expectedSignature.length)
+        return null;
+    let valid = true;
+    for (let i = 0; i < signature.length; i++) {
+        if (signature[i] !== expectedSignature[i])
+            valid = false;
+    }
+    return valid ? value : null;
+}
+/**
+ * Compute HMAC-SHA256 signature (base64url encoded)
+ */
+function computeHmacSignature(value, secret) {
+    // Use Node.js crypto
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const crypto = require('crypto');
+    return crypto.createHmac('sha256', secret).update(value).digest('base64url');
+}
+/**
+ * Create an enhanced bearer token strategy with query param support
+ *
+ * This is useful for EventSource/SSE connections where you can't set
+ * custom headers. The token can be passed via query param instead.
+ *
+ * @example
+ * ```ts
+ * const bearerAuth = createEnhancedBearerStrategy({
+ *   extractFrom: ['header', 'query'],
+ *   queryParam: 'token',
+ *   verify: async (token) => {
+ *     const decoded = jwt.verify(token, secret)
+ *     return { authenticated: true, principal: decoded.sub, claims: decoded }
+ *   }
+ * })
+ *
+ * // Works with:
+ * // Authorization: Bearer <token>
+ * // GET /stream?token=<token>
+ * ```
+ */
+export function createEnhancedBearerStrategy(options) {
+    const { verify, headerName = 'authorization', tokenPrefix = 'Bearer ', queryParam = 'token', extractFrom = ['header'], } = options;
+    return {
+        name: 'bearer-enhanced',
+        async authenticate(envelope, ctx) {
+            let token;
+            // Try header first
+            if (extractFrom.includes('header')) {
+                const authHeader = envelope.metadata?.[headerName] || envelope.metadata?.['Authorization'];
+                if (authHeader && typeof authHeader === 'string' && authHeader.startsWith(tokenPrefix)) {
+                    token = authHeader.slice(tokenPrefix.length);
+                }
+            }
+            // Try query param if not found in header
+            if (!token && extractFrom.includes('query')) {
+                // Query params might be in metadata or in a parsed query object
+                const metadata = envelope.metadata;
+                const queryObj = metadata?.['query'];
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                const ctxQuery = ctx.query;
+                const queryToken = metadata?.[queryParam] || queryObj?.[queryParam] || ctxQuery?.[queryParam];
+                if (queryToken && typeof queryToken === 'string') {
+                    token = queryToken;
+                }
+            }
+            if (!token) {
+                return null; // No token found
+            }
+            return verify(token);
+        },
+    };
+}
+/**
+ * Create an enhanced API key strategy with query param support
+ *
+ * @example
+ * ```ts
+ * const apiKeyAuth = createEnhancedApiKeyStrategy({
+ *   extractFrom: ['header', 'query'],
+ *   queryParam: 'apiKey',
+ *   verify: async (key) => {
+ *     const apiKey = await db.apiKeys.findByKey(key)
+ *     if (!apiKey) return null
+ *     return { authenticated: true, principal: apiKey.ownerId, claims: { scopes: apiKey.scopes } }
+ *   }
+ * })
+ *
+ * // Works with:
+ * // X-API-Key: <key>
+ * // GET /stream?apiKey=<key>
+ * ```
+ */
+export function createEnhancedApiKeyStrategy(options) {
+    const { verify, headerName = 'x-api-key', queryParam = 'apiKey', extractFrom = ['header'] } = options;
+    return {
+        name: 'api-key-enhanced',
+        async authenticate(envelope, ctx) {
+            let apiKey;
+            // Try header first
+            if (extractFrom.includes('header')) {
+                const headerKey = envelope.metadata?.[headerName] || envelope.metadata?.['X-API-Key'];
+                if (headerKey && typeof headerKey === 'string') {
+                    apiKey = headerKey;
+                }
+            }
+            // Try query param if not found in header
+            if (!apiKey && extractFrom.includes('query')) {
+                const metadata = envelope.metadata;
+                const queryObj = metadata?.['query'];
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                const ctxQuery = ctx.query;
+                const queryKey = metadata?.[queryParam] || queryObj?.[queryParam] || ctxQuery?.[queryParam];
+                if (queryKey && typeof queryKey === 'string') {
+                    apiKey = queryKey;
+                }
+            }
+            if (!apiKey) {
+                return null; // No API key found
+            }
+            return verify(apiKey);
+        },
+    };
+}
+/**
+ * Create the authentication interceptor
+ */
+export function createAuthMiddleware(options) {
+    const { strategies, publicProcedures = [], onError } = options;
+    return async (envelope, ctx, next) => {
+        // Check if procedure is public
+        if (publicProcedures.includes(envelope.procedure)) {
+            return next();
+        }
+        // Try each strategy in order
+        let authResult = null;
+        for (const strategy of strategies) {
+            try {
+                authResult = await strategy.authenticate(envelope, ctx);
+                if (authResult)
+                    break;
+            }
+            catch (error) {
+                if (onError) {
+                    onError(error, envelope);
+                }
+                // Continue to next strategy on error
+            }
+        }
+        // Check authentication result
+        if (!authResult) {
+            throw new RaffelError('UNAUTHENTICATED', 'Authentication required');
+        }
+        if (!authResult.authenticated) {
+            throw new RaffelError('UNAUTHENTICATED', 'Invalid credentials');
+        }
+        // Attach auth context
+        const authContext = {
+            authenticated: true,
+            principal: authResult.principal,
+            claims: {
+                ...authResult.claims,
+                roles: authResult.roles,
+            },
+        };
+        ctx.auth = authContext;
+        return next();
+    };
+}
+/**
+ * Get roles from auth context
+ */
+function getRoles(auth) {
+    if (!auth?.claims?.roles)
+        return [];
+    if (Array.isArray(auth.claims.roles))
+        return auth.claims.roles;
+    return [];
+}
+/**
+ * Create authorization middleware (role-based access control)
+ */
+export function createAuthzMiddleware(options) {
+    const { rules, defaultAllow = false } = options;
+    function matchProcedure(pattern, procedure) {
+        if (pattern === '*')
+            return true;
+        if (pattern.endsWith('.*')) {
+            const prefix = pattern.slice(0, -2);
+            return procedure.startsWith(prefix + '.');
+        }
+        return pattern === procedure;
+    }
+    return async (envelope, ctx, next) => {
+        const auth = ctx.auth;
+        // Find matching rules
+        const matchingRules = rules.filter((rule) => matchProcedure(rule.procedure, envelope.procedure));
+        // If no rules match, use default policy
+        if (matchingRules.length === 0) {
+            if (!defaultAllow) {
+                throw new RaffelError('PERMISSION_DENIED', `Access denied to ${envelope.procedure}`);
+            }
+            return next();
+        }
+        // Check all matching rules
+        for (const rule of matchingRules) {
+            let allowed = false;
+            // Check roles
+            if (rule.roles && rule.roles.length > 0) {
+                const userRoles = getRoles(auth);
+                allowed = rule.roles.some((role) => userRoles.includes(role));
+            }
+            // Check custom function
+            if (rule.check) {
+                allowed = await rule.check(ctx);
+            }
+            if (!allowed) {
+                throw new RaffelError('PERMISSION_DENIED', `Access denied to ${envelope.procedure}`);
+            }
+        }
+        return next();
+    };
+}
+/**
+ * Helper to require authentication on context
+ */
+export function requireAuth(ctx) {
+    const auth = ctx.auth;
+    if (!auth || !auth.authenticated || !auth.principal) {
+        throw new RaffelError('UNAUTHENTICATED', 'Authentication required');
+    }
+    return auth;
+}
+/**
+ * Helper to check if user has a specific role
+ */
+export function hasRole(ctx, role) {
+    const auth = ctx.auth;
+    return getRoles(auth).includes(role);
+}
+/**
+ * Helper to check if user has any of the specified roles
+ */
+export function hasAnyRole(ctx, roles) {
+    const auth = ctx.auth;
+    const userRoles = getRoles(auth);
+    return roles.some((role) => userRoles.includes(role));
+}
+/**
+ * Helper to check if user has all of the specified roles
+ */
+export function hasAllRoles(ctx, roles) {
+    const auth = ctx.auth;
+    const userRoles = getRoles(auth);
+    return roles.every((role) => userRoles.includes(role));
+}
+//# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAyD9C;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA2B;IAC9D,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,eAAe,EAAE,WAAW,GAAG,SAAS,EAAE,GAAG,OAAO,CAAA;IAEjF,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,YAAY,CAAC,QAAkB;YACnC,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC,eAAe,CAAC,CAAA;YAE1F,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAClD,OAAO,IAAI,CAAA,CAAC,yBAAyB;YACvC,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAA,CAAC,qBAAqB;YACnC,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;YAClD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;KACF,CAAA;AACH,CAAC;AAYD;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAsB;IACzD,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,WAAW,EAAE,GAAG,OAAO,CAAA;IAEpD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,KAAK,CAAC,YAAY,CAAC,QAAkB;YACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,CAAA;YAE9C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAA,CAAC,yBAAyB;YACvC,CAAC;YAED,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;QACvB,CAAC;KACF,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAkC;IAC3E,OAAO,oBAAoB,CAAC;QAC1B,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACpC,OAAO,MAAM,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAA;QAC3C,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAoBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAA6B;IACvE,MAAM,EAAE,UAAU,GAAG,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,OAAO,CAAA;IAE7E,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,YAAY,CAAC,QAAkB,EAAE,GAAY;YACjD,kCAAkC;YAClC,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAA;YAEnF,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;gBACtD,OAAO,IAAI,CAAA,CAAC,aAAa;YAC3B,CAAC;YAED,gBAAgB;YAChB,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;YAE1C,IAAI,SAA6B,CAAA;YAEjC,IAAI,OAAO,EAAE,CAAC;gBACZ,6BAA6B;gBAC7B,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;YACnD,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;YACjC,CAAC;YAED,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,CAAA,CAAC,oBAAoB;YAClC,CAAC;YAED,sCAAsC;YACtC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;gBACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAA,CAAC,oBAAoB;gBACtD,CAAC;gBACD,SAAS,GAAG,QAAQ,CAAA;YACtB,CAAC;YAED,mBAAmB;YACnB,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAA;QAC5B,CAAC;KACF,CAAA;AACH,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,YAAoB;IACxC,MAAM,OAAO,GAA2B,EAAE,CAAA;IAE1C,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACtD,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAA+B,EAAE,IAAY;IACrE,MAAM,cAAc,GAAG,GAAG,IAAI,WAAW,CAAA;IACzC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAA;IAEhE,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;QACtB,kCAAkC;QAClC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAA;IACtB,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAA,CAAC,gBAAgB;QAC7C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACxB,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,WAAmB,EAAE,MAAc;IAC7D,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAC5C,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAE/B,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;IAEhD,6BAA6B;IAC7B,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAE7D,2BAA2B;IAC3B,IAAI,SAAS,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAC9D,IAAI,KAAK,GAAG,IAAI,CAAA;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,iBAAiB,CAAC,CAAC,CAAC;YAAE,KAAK,GAAG,KAAK,CAAA;IAC1D,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7B,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,KAAa,EAAE,MAAc;IACzD,qBAAqB;IACrB,8DAA8D;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAA4B,CAAA;IAC3D,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAC9E,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAmC;IAC9E,MAAM,EACJ,MAAM,EACN,UAAU,GAAG,eAAe,EAC5B,WAAW,GAAG,SAAS,EACvB,UAAU,GAAG,OAAO,EACpB,WAAW,GAAG,CAAC,QAAQ,CAAC,GACzB,GAAG,OAAO,CAAA;IAEX,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK,CAAC,YAAY,CAAC,QAAkB,EAAE,GAAY;YACjD,IAAI,KAAyB,CAAA;YAE7B,mBAAmB;YACnB,IAAI,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC,eAAe,CAAC,CAAA;gBAC1F,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;oBACvF,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;gBAC9C,CAAC;YACH,CAAC;YAED,yCAAyC;YACzC,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5C,gEAAgE;gBAChE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAA+C,CAAA;gBACzE,MAAM,QAAQ,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAwC,CAAA;gBAC3E,8DAA8D;gBAC9D,MAAM,QAAQ,GAAI,GAAW,CAAC,KAA4C,CAAA;gBAE1E,MAAM,UAAU,GAAG,QAAQ,EAAE,CAAC,UAAU,CAAC,IAAI,QAAQ,EAAE,CAAC,UAAU,CAAC,IAAI,QAAQ,EAAE,CAAC,UAAU,CAAC,CAAA;gBAE7F,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;oBACjD,KAAK,GAAG,UAAU,CAAA;gBACpB,CAAC;YACH,CAAC;YAED,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAA,CAAC,iBAAiB;YAC/B,CAAC;YAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;KACF,CAAA;AACH,CAAC;AAoBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAA8B;IACzE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,WAAW,EAAE,UAAU,GAAG,QAAQ,EAAE,WAAW,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,OAAO,CAAA;IAErG,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,KAAK,CAAC,YAAY,CAAC,QAAkB,EAAE,GAAY;YACjD,IAAI,MAA0B,CAAA;YAE9B,mBAAmB;YACnB,IAAI,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAA;gBACrF,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC/C,MAAM,GAAG,SAAS,CAAA;gBACpB,CAAC;YACH,CAAC;YAED,yCAAyC;YACzC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAA+C,CAAA;gBACzE,MAAM,QAAQ,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAwC,CAAA;gBAC3E,8DAA8D;gBAC9D,MAAM,QAAQ,GAAI,GAAW,CAAC,KAA4C,CAAA;gBAE1E,MAAM,QAAQ,GAAG,QAAQ,EAAE,CAAC,UAAU,CAAC,IAAI,QAAQ,EAAE,CAAC,UAAU,CAAC,IAAI,QAAQ,EAAE,CAAC,UAAU,CAAC,CAAA;gBAE3F,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAC7C,MAAM,GAAG,QAAQ,CAAA;gBACnB,CAAC;YACH,CAAC;YAED,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAA,CAAC,mBAAmB;YACjC,CAAC;YAED,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;QACvB,CAAC;KACF,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,MAAM,EAAE,UAAU,EAAE,gBAAgB,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE9D,OAAO,KAAK,EAAE,QAAkB,EAAE,GAAY,EAAE,IAA4B,EAAE,EAAE;QAC9E,+BAA+B;QAC/B,IAAI,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAClD,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QAED,6BAA6B;QAC7B,IAAI,UAAU,GAAsB,IAAI,CAAA;QAExC,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;gBACvD,IAAI,UAAU;oBAAE,MAAK;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,KAAc,EAAE,QAAQ,CAAC,CAAA;gBACnC,CAAC;gBACD,qCAAqC;YACvC,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAA;QACrE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;YAC9B,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAA;QACjE,CAAC;QAED,sBAAsB;QACtB,MAAM,WAAW,GAAgB;YAC/B,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,MAAM,EAAE;gBACN,GAAG,UAAU,CAAC,MAAM;gBACpB,KAAK,EAAE,UAAU,CAAC,KAAK;aACxB;SACF,CAGA;QAAC,GAAW,CAAC,IAAI,GAAG,WAAW,CAAA;QAEhC,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA;AACH,CAAC;AAwBD;;GAEG;AACH,SAAS,QAAQ,CAAC,IAA6B;IAC7C,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK;QAAE,OAAO,EAAE,CAAA;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAA;IAC9D,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,KAAK,EAAE,GAAG,OAAO,CAAA;IAE/C,SAAS,cAAc,CAAC,OAAe,EAAE,SAAiB;QACxD,IAAI,OAAO,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YACnC,OAAO,SAAS,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;QAC3C,CAAC;QACD,OAAO,OAAO,KAAK,SAAS,CAAA;IAC9B,CAAC;IAED,OAAO,KAAK,EAAE,QAAkB,EAAE,GAAY,EAAE,IAA4B,EAAE,EAAE;QAC9E,MAAM,IAAI,GAAI,GAAW,CAAC,IAA+B,CAAA;QAEzD,sBAAsB;QACtB,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;QAEhG,wCAAwC;QACxC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,oBAAoB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;YACtF,CAAC;YACD,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QAED,2BAA2B;QAC3B,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,OAAO,GAAG,KAAK,CAAA;YAEnB,cAAc;YACd,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;gBAChC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;YAC/D,CAAC;YAED,wBAAwB;YACxB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACjC,CAAC;YAED,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,oBAAoB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;YACtF,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,GAAY,EAAE,IAAY;IAChD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,KAAe;IACtD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAChC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,KAAe;IACvD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAChC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;AACxD,CAAC"}

package/dist/middleware/compose.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Middleware Composition Helpers
+ *
+ * Utilities for combining multiple interceptors.
+ */
+import type { Interceptor, Envelope, Context } from '../types/index.js';
+/**
+ * Compose multiple interceptors into one (left-to-right execution order)
+ *
+ * The first interceptor in the list will be the outermost (runs first).
+ * The last interceptor will be closest to the handler.
+ *
+ * @example
+ * ```typescript
+ * // auth runs first, then validation, then rateLimit
+ * const middleware = compose(auth, validation, rateLimit)
+ * ```
+ *
+ * @param interceptors - Interceptors to compose (left-to-right order)
+ * @returns A single composed interceptor
+ */
+export declare function compose(...interceptors: Interceptor[]): Interceptor;
+/**
+ * Create a conditional interceptor that only runs if predicate is true
+ *
+ * @example
+ * ```typescript
+ * const adminOnly = when(
+ *   (envelope) => envelope.procedure.startsWith('admin.'),
+ *   requireAdmin
+ * )
+ * ```
+ *
+ * @param predicate - Function that returns true if interceptor should run
+ * @param interceptor - Interceptor to conditionally run
+ * @returns A conditional interceptor
+ */
+export declare function when(predicate: (envelope: Envelope, ctx: Context) => boolean, interceptor: Interceptor): Interceptor;
+/**
+ * Create an interceptor that only runs for specific procedures
+ *
+ * @example
+ * ```typescript
+ * const usersRateLimit = forProcedures(['users.create', 'users.update'], rateLimit)
+ * ```
+ *
+ * @param procedures - List of procedure names to match
+ * @param interceptor - Interceptor to run for matching procedures
+ * @returns A procedure-filtered interceptor
+ */
+export declare function forProcedures(procedures: string[], interceptor: Interceptor): Interceptor;
+/**
+ * Create an interceptor that only runs for procedures matching a pattern
+ *
+ * @example
+ * ```typescript
+ * const adminRateLimit = forPattern('admin.*', strictRateLimit)
+ * ```
+ *
+ * @param pattern - Glob pattern (supports * and **)
+ * @param interceptor - Interceptor to run for matching procedures
+ * @returns A pattern-filtered interceptor
+ */
+export declare function forPattern(pattern: string, interceptor: Interceptor): Interceptor;
+/**
+ * Create an interceptor that skips specific procedures
+ *
+ * @example
+ * ```typescript
+ * const authWithExclusions = except(['health.check', 'system.ping'], authMiddleware)
+ * ```
+ *
+ * @param procedures - List of procedure names to skip
+ * @param interceptor - Interceptor to run for non-matching procedures
+ * @returns An exclusion-filtered interceptor
+ */
+export declare function except(procedures: string[], interceptor: Interceptor): Interceptor;
+/**
+ * Create an interceptor that runs a different interceptor based on a condition
+ *
+ * @example
+ * ```typescript
+ * const rateLimiter = branch(
+ *   (envelope, ctx) => ctx.auth?.authenticated,
+ *   authenticatedRateLimit,  // 1000 req/min
+ *   anonymousRateLimit       // 100 req/min
+ * )
+ * ```
+ *
+ * @param predicate - Function to determine which branch to take
+ * @param onTrue - Interceptor to run if predicate is true
+ * @param onFalse - Interceptor to run if predicate is false
+ * @returns A branching interceptor
+ */
+export declare function branch(predicate: (envelope: Envelope, ctx: Context) => boolean, onTrue: Interceptor, onFalse: Interceptor): Interceptor;
+/**
+ * Create a no-op interceptor (passthrough)
+ *
+ * Useful as a placeholder or default value.
+ */
+export declare const passthrough: Interceptor;
+//# sourceMappingURL=compose.d.ts.map

package/dist/middleware/compose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/middleware/compose.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAEvE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,OAAO,CAAC,GAAG,YAAY,EAAE,WAAW,EAAE,GAAG,WAAW,CAqBnE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,IAAI,CAClB,SAAS,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,EACxD,WAAW,EAAE,WAAW,GACvB,WAAW,CAOb;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAAE,EACpB,WAAW,EAAE,WAAW,GACvB,WAAW,CAGb;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,WAAW,GACvB,WAAW,CAGb;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,MAAM,CACpB,UAAU,EAAE,MAAM,EAAE,EACpB,WAAW,EAAE,WAAW,GACvB,WAAW,CAGb;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,MAAM,CACpB,SAAS,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,EACxD,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,WAAW,GACnB,WAAW,CAOb;AAED;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAE,WAA+C,CAAA"}

package/dist/middleware/compose.int.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Middleware Compose Tests
+ *
+ * Tests for middleware composition helpers.
+ */
+export {};
+//# sourceMappingURL=compose.int.test.d.ts.map

package/dist/middleware/compose.int.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.int.test.d.ts","sourceRoot":"","sources":["../../src/middleware/compose.int.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}