stitchkit 0.2.0 → 0.4.0

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,WAAW,EACX,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,KAAK,UAAU,EACf,SAAS,GACV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,UAAU,EACf,WAAW,EACX,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EACL,SAAS,EACT,eAAe,EACf,aAAa,EACb,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,KAAK,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrE,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,EACd,SAAS,EACT,QAAQ,EACR,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,UAAU,EACV,YAAY,GACb,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,WAAW,EACX,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,OAAO,EACP,SAAS,GACV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,UAAU,EACf,WAAW,EACX,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,KAAK,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,YAAY,GACb,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EACL,KAAK,eAAe,EACpB,SAAS,EACT,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,KAAK,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrE,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,EACd,SAAS,EACT,QAAQ,EACR,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,UAAU,EACV,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,YAAY,EACjB,wBAAwB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,aAAa,GACd,MAAM,aAAa,CAAC"}

package/dist/server/index.js

@@ -1,16 +1,42 @@
 import {
   parseSSE,
   streamSSE
-} from "../index-n7bmdwmz.js";
+} from "../index-d4rwrjbc.js";
 import {
+  createAuthHook,
+  createBearerResolver,
+  defineCookie,
+  deriveCodeChallenge,
+  extractToken,
+  parseCookies,
+  serializeCookie,
+  signJwt,
+  verifyJwt,
+  verifyPkce
+} from "../index-1cf8jkhf.js";
+import {
+  inputIsQuery
+} from "../index-48ffdxgk.js";
+import {
+  jsonSchemaFields,
+  toJsonSchema
+} from "../index-0ed3bx43.js";
+import {
+  composeWebSocketHandlers,
   corsHeaders,
   corsPreflightResponse,
   createHandler,
+  createImplement,
   createServer,
+  createSocketIOServer,
+  implement,
   parseMultipart,
-  staticRoute
-} from "../index-v2z2v3mq.js";
-import"../index-a35v22fh.js";
+  socketIoLane,
+  staticRoute,
+  webSocketLane
+} from "../index-3qmtdfpa.js";
+import"../index-x3fcszf8.js";
+import"../index-vhdvv00d.js";
 import {
   AppError,
   appError,
@@ -20,13 +46,19 @@ import {
   notFound,
   rateLimited,
   unauthorized
-} from "../index-kckky6zw.js";
+} from "../index-afzt3nmx.js";
 import {
   extractIp,
   generateTraceId,
   getClientInfo,
+  resolveSocketIp,
   resolveTraceId
-} from "../index-ke4mx4ea.js";
+} from "../index-mwmpw6j1.js";
+import"../index-kzfs85xp.js";
+import {
+  isRecord
+} from "../index-809wc1tt.js";
+import"../index-37x76zdn.js";
 // src/server/swept-map.ts
 function createSweptMap(options) {
   const store = new Map;
@@ -85,7 +117,7 @@ function cacheHeaders(maxAge, scope = "public") {
   };
 }
 // src/server/event-bus.ts
-function createEventBus() {
+function createEventBus(options = {}) {
   const subscriptions = new Map;
   function add(event, fn, once) {
     let set = subscriptions.get(event);
@@ -109,11 +141,12 @@ function createEventBus() {
           set.delete(sub);
         try {
           const result = sub.fn(data);
-          if (result instanceof Promise)
-            result.catch(() => {
-              return;
-            });
-        } catch {}
+          if (result instanceof Promise) {
+            result.catch((err) => options.onListenerError?.(err, event));
+          }
+        } catch (err) {
+          options.onListenerError?.(err, event);
+        }
       }
     },
     on(event, handler) {
@@ -136,163 +169,150 @@ function createEventBus() {
     }
   };
 }
-// src/server/implement.ts
-function implement(contract, handlers) {
-  const methods = {};
-  const groupScope = contract.meta.scope ?? "public";
-  for (const [key, endpoint] of Object.entries(contract.endpoints)) {
-    const typedHandler = handlers[key];
-    methods[key] = {
-      method: endpoint.method,
-      path: endpoint.path,
-      desc: endpoint.desc,
-      toolName: "toolName" in endpoint ? endpoint.toolName : undefined,
-      expose: endpoint.expose,
-      scope: endpoint.scope ?? groupScope,
-      paramsSchema: endpoint.params,
-      inputSchema: endpoint.input,
-      outputSchema: endpoint.output,
-      multipart: endpoint.multipart,
-      handler: (ctx) => typedHandler(ctx)
-    };
-  }
-  return {
-    name: contract.meta.prefix,
-    prefix: contract.meta.prefix,
-    scope: groupScope,
-    methods
-  };
+// src/server/openapi.ts
+var ERROR_ENVELOPE_SCHEMA = {
+  type: "object",
+  properties: {
+    error: {
+      type: "object",
+      properties: {
+        code: { type: "string" },
+        message: { type: "string" },
+        details: {},
+        hint: { type: "string" }
+      },
+      required: ["code"]
+    }
+  },
+  required: ["error"]
+};
+function joinPath(...parts) {
+  const joined = parts.filter((p) => Boolean(p)).map((part) => part.replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
+  return `/${joined}`;
 }
-function createImplement() {
-  return (contract, handlers) => implement(contract, handlers);
+function toOpenApiPath(path) {
+  return path.replace(/:([^/]+)/g, "{$1}");
 }
-// src/server/middleware/cookies.ts
-function parseCookies(header) {
-  if (!header)
+function safeJson(schema, io) {
+  if (!schema)
+    return {};
+  try {
+    return toJsonSchema(schema, io, "any");
+  } catch {
     return {};
-  const cookies = {};
-  for (const pair of header.split(";")) {
-    const [key, ...rest] = pair.split("=");
-    if (!key)
-      continue;
-    const raw = rest.join("=").trim();
-    try {
-      cookies[key.trim()] = decodeURIComponent(raw);
-    } catch {
-      cookies[key.trim()] = raw;
-    }
   }
-  return cookies;
 }
-function serializeCookie(name, value, opts = {}) {
-  let cookie = `${name}=${encodeURIComponent(value)}`;
-  if (opts.maxAge !== undefined)
-    cookie += `; Max-Age=${opts.maxAge}`;
-  if (opts.path)
-    cookie += `; Path=${opts.path}`;
-  if (opts.domain)
-    cookie += `; Domain=${opts.domain}`;
-  if (opts.secure)
-    cookie += "; Secure";
-  if (opts.httpOnly)
-    cookie += "; HttpOnly";
-  if (opts.sameSite)
-    cookie += `; SameSite=${opts.sameSite}`;
-  return cookie;
-}
-function defineCookie(config) {
-  const { name, ...options } = config;
+function errorResponse(description) {
   return {
-    get(req) {
-      return parseCookies(req.headers.get("cookie"))[name];
-    },
-    set(value) {
-      return serializeCookie(name, value, options);
-    },
-    clear() {
-      return serializeCookie(name, "", { ...options, maxAge: 0 });
-    }
+    description,
+    content: { "application/json": { schema: ERROR_ENVELOPE_SCHEMA } }
   };
 }
-
-// src/server/middleware/auth.ts
-function decodeBase64Url(segment) {
-  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
-  const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, "=");
-  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
-}
-async function verifyJwt(token, secret) {
-  const [headerB64, payloadB64, signatureB64] = token.split(".");
-  if (!headerB64 || !payloadB64 || !signatureB64)
-    throw unauthorized("Invalid token format");
-  let header;
-  let payload;
-  let signature;
-  try {
-    const decoder = new TextDecoder;
-    header = JSON.parse(decoder.decode(decodeBase64Url(headerB64)));
-    payload = JSON.parse(decoder.decode(decodeBase64Url(payloadB64)));
-    signature = decodeBase64Url(signatureB64);
-  } catch {
-    throw unauthorized("Malformed token");
-  }
-  if (header.alg !== "HS256")
-    throw unauthorized("Unsupported token algorithm");
-  const encoder = new TextEncoder;
-  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
-  const data = encoder.encode(`${headerB64}.${payloadB64}`);
-  const valid = await crypto.subtle.verify("HMAC", key, signature, data);
-  if (!valid)
-    throw unauthorized("Invalid token signature");
-  const now = Date.now() / 1000;
-  if (typeof payload.exp === "number" && payload.exp < now) {
-    throw unauthorized("Token expired");
-  }
-  if (typeof payload.nbf === "number" && payload.nbf > now) {
-    throw unauthorized("Token not yet valid");
-  }
-  return payload;
-}
-function extractToken(req, cookieName) {
-  const authHeader = req.headers.get("authorization");
-  if (authHeader?.startsWith("Bearer "))
-    return authHeader.slice(7);
-  if (cookieName) {
-    const cookies = parseCookies(req.headers.get("cookie"));
-    return cookies[cookieName] ?? null;
+function errorResponses(scope) {
+  const responses = {
+    "400": errorResponse("Validation error"),
+    "500": errorResponse("Server error")
+  };
+  if (scope && scope !== "public") {
+    responses["401"] = errorResponse("Unauthorized");
+    responses["403"] = errorResponse("Forbidden");
   }
-  return null;
+  return responses;
 }
-function createAuthHook(config) {
-  const onAnonymous = config.onAnonymous ?? (() => unauthorized());
-  const onForbidden = config.onForbidden ?? (() => forbidden());
-  return async (ctx, endpoint) => {
-    if (!(ctx.req instanceof Request))
-      return;
-    const identity = await config.resolve(ctx);
-    config.inject?.(ctx, identity);
-    const scope = endpoint.scope ?? config.defaultScope;
-    if (!scope)
-      return;
-    const rule = config.rules[scope];
-    if (!rule || rule === "public")
-      return;
-    if (!identity) {
-      onAnonymous();
-      return;
+function generateOpenApiDocument(config) {
+  const groups = [
+    ...(config.services ?? []).map((service) => ({ pathPrefix: undefined, service })),
+    ...(config.groups ?? []).flatMap((group) => group.services.map((service) => ({ pathPrefix: group.pathPrefix, service })))
+  ];
+  const paths = {};
+  for (const { pathPrefix, service } of groups) {
+    for (const [key, method] of Object.entries(service.methods)) {
+      if (method.expose && !method.expose.includes("HTTP"))
+        continue;
+      const servicePath = joinPath("/", service.prefix, method.path === "/" ? "" : method.path);
+      const fullPath = toOpenApiPath(pathPrefix ? joinPath(pathPrefix, servicePath) : servicePath);
+      const parameters = [];
+      for (const field of jsonSchemaFields(safeJson(method.paramsSchema, "input"))) {
+        parameters.push({
+          name: field.name,
+          in: "path",
+          required: true,
+          schema: field.schema,
+          ...field.description && { description: field.description }
+        });
+      }
+      const inputInQuery = inputIsQuery(method.method);
+      if (inputInQuery && method.inputSchema) {
+        for (const field of jsonSchemaFields(safeJson(method.inputSchema, "input"))) {
+          parameters.push({
+            name: field.name,
+            in: "query",
+            required: field.required,
+            schema: field.schema,
+            ...field.description && { description: field.description }
+          });
+        }
+      }
+      const responses = { ...errorResponses(method.scope) };
+      if (method.outputSchema) {
+        responses["200"] = {
+          description: "Success",
+          content: { "application/json": { schema: safeJson(method.outputSchema, "output") } }
+        };
+      } else {
+        responses["204"] = { description: "No content" };
+      }
+      const operation = {
+        summary: method.desc,
+        operationId: `${service.name}_${key}`,
+        ...parameters.length > 0 && { parameters },
+        responses
+      };
+      if (!inputInQuery && (method.inputSchema || method.multipart)) {
+        if (method.multipart) {
+          const inputJson = safeJson(method.inputSchema, "input");
+          const baseProps = isRecord(inputJson.properties) ? inputJson.properties : {};
+          const baseRequired = Array.isArray(inputJson.required) ? inputJson.required : [];
+          operation.requestBody = {
+            required: true,
+            content: {
+              "multipart/form-data": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    ...baseProps,
+                    [method.multipart]: { type: "string", format: "binary" }
+                  },
+                  required: [...baseRequired, method.multipart]
+                }
+              }
+            }
+          };
+        } else if (method.inputSchema) {
+          const required = jsonSchemaFields(safeJson(method.inputSchema, "input")).some((f) => f.required);
+          operation.requestBody = {
+            required,
+            content: { "application/json": { schema: safeJson(method.inputSchema, "input") } }
+          };
+        }
+      }
+      const pathItem = paths[fullPath] ?? {};
+      pathItem[method.method.toLowerCase()] = operation;
+      paths[fullPath] = pathItem;
     }
-    if (rule === "authenticated")
-      return;
-    if (!await rule(identity, ctx))
-      onForbidden();
+  }
+  return {
+    openapi: "3.1.0",
+    info: config.info,
+    ...config.servers && { servers: config.servers },
+    paths
   };
 }
-function createBearerResolver(config) {
-  return async (req) => {
-    const token = extractToken(req);
-    if (!token)
-      return null;
-    return config.lookup(token, req);
+function openApiRoute(path, document) {
+  return {
+    method: "GET",
+    path,
+    handler: () => Response.json(document)
   };
 }
 // src/server/rate-limit.ts
@@ -301,6 +321,7 @@ function refillBucket(entry, config, now) {
   entry.tokens = Math.min(config.max, entry.tokens + elapsed / config.window * config.max);
   entry.lastRefill = now;
 }
+var MAX_BUCKETS = 1e5;
 function createRateLimiter() {
   const { store: buckets, destroy } = createSweptMap({
     intervalMs: 60000,
@@ -310,15 +331,26 @@ function createRateLimiter() {
     destroy,
     check(key, config) {
       const now = Date.now();
-      let entry = buckets.get(key);
-      if (!entry) {
-        entry = { tokens: config.max, lastRefill: now };
+      const entry = buckets.get(key);
+      if (entry) {
+        buckets.delete(key);
         buckets.set(key, entry);
+        refillBucket(entry, config, now);
+        if (entry.tokens < 1)
+          return false;
+        entry.tokens -= 1;
+        return true;
+      }
+      if (buckets.size >= MAX_BUCKETS) {
+        const lru = buckets.keys().next().value;
+        if (lru !== undefined)
+          buckets.delete(lru);
       }
-      refillBucket(entry, config, now);
-      if (entry.tokens < 1)
+      const fresh = { tokens: config.max, lastRefill: now };
+      buckets.set(key, fresh);
+      if (fresh.tokens < 1)
         return false;
-      entry.tokens -= 1;
+      fresh.tokens -= 1;
       return true;
     },
     remaining(key, config) {
@@ -330,55 +362,32 @@ function createRateLimiter() {
     }
   };
 }
-// src/server/socket-io.ts
-import { Server as BunEngine } from "@socket.io/bun-engine";
-import { Server as SocketIOServer } from "socket.io";
-function createSocketIOServer(config) {
-  const path = config.path ?? "/socket.io/";
-  const io = new SocketIOServer({
-    path,
-    cors: {
-      origin: config.cors.origin,
-      credentials: config.cors.credentials ?? true,
-      methods: ["GET", "POST"]
-    },
-    transports: config.transports ?? ["websocket", "polling"],
-    pingTimeout: config.pingTimeout ?? 20000,
-    pingInterval: config.pingInterval ?? 1e4
-  });
-  const engine = new BunEngine({ path });
-  io.bind(engine);
-  const { websocket } = engine.handler();
-  const route = {
-    method: "ALL",
-    path: `${path.replace(/\/+$/, "")}/*`,
-    handler: (req, ctx) => {
-      if (!ctx.server) {
-        throw new Error("[stitchkit] createSocketIOServer route needs a running Bun server — mount it via createServer.");
-      }
-      return engine.handleRequest(req, ctx.server);
-    }
-  };
-  return { io, websocket, route };
-}
 export {
+  webSocketLane,
+  verifyPkce,
   verifyJwt,
   unauthorized,
   streamSSE,
   staticRoute,
+  socketIoLane,
+  signJwt,
   serializeCookie,
   resolveTraceId,
+  resolveSocketIp,
   rateLimited,
   parseSSE,
   parseMultipart,
   parseCookies,
+  openApiRoute,
   notFound,
   implement,
   getClientInfo,
   generateTraceId,
+  generateOpenApiDocument,
   forbidden,
   extractToken,
   extractIp,
+  deriveCodeChallenge,
   defineCookie,
   createSocketIOServer,
   createServer,
@@ -392,6 +401,7 @@ export {
   corsPreflightResponse,
   corsHeaders,
   conflict,
+  composeWebSocketHandlers,
   cacheHeaders,
   badRequest,
   appError,

package/dist/server/logger.d.ts

@@ -1,4 +1,5 @@
-export declare function elapsedMs(startTime: bigint): number;
+/** Elapsed milliseconds since a `performance.now()` mark. */
+export declare function elapsedMs(startTime: number): number;
 /** Map an HTTP status to a log level. */
 export declare function levelForStatus(status: number): 'error' | 'warn' | 'info';
 /** The structured fields shared by every completed-request log line. */
@@ -11,11 +12,11 @@ export declare function buildLogFields(method: string, path: string, status: num
 };
 export interface RequestLog {
     traceId: string;
-    startTime: bigint;
+    startTime: number;
 }
 export declare function shouldLog(pathname: string, method: string): boolean;
 /** Open the timing window for a request. Development prints a `→` line. */
-export declare function logIncoming(req: Request, pathname: string, traceId: string): RequestLog;
+export declare function logIncoming(req: Request, pathname: string, traceId: string, ipAddress?: string): RequestLog;
 /** Close a request. Development: `←` line. Production: one structured JSON line. */
-export declare function logOutgoing(req: Request, pathname: string, status: number, log: RequestLog): void;
+export declare function logOutgoing(req: Request, pathname: string, status: number, log: RequestLog, ipAddress?: string): void;
 //# sourceMappingURL=logger.d.ts.map

package/dist/server/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/server/logger.ts"],"names":[],"mappings":"AA0CA,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,yCAAyC;AACzC,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAIxE;AAED,wEAAwE;AACxE,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAEvF;AA0BD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAGnE;AAED,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CASvF;AAED,oFAAoF;AACpF,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,UAAU,GACd,IAAI,CAoBN"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/server/logger.ts"],"names":[],"mappings":"AAwCA,6DAA6D;AAC7D,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnD;AAQD,yCAAyC;AACzC,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAIxE;AAED,wEAAwE;AACxE,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAEvF;AA0BD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAGnE;AAED,2EAA2E;AAC3E,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,UAAU,CASZ;AAED,oFAAoF;AACpF,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,UAAU,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,IAAI,CAoBN"}

package/dist/server/middleware/auth.d.ts

@@ -3,7 +3,33 @@ import type { MethodDef } from '../types';
 export interface JwtPayload {
     [key: string]: unknown;
 }
-export declare function verifyJwt(token: string, secret: string): Promise<JwtPayload>;
+/** Tuning for `verifyJwt`. */
+export interface VerifyJwtOptions {
+    /** Clock-skew tolerance for `exp` / `nbf`, in seconds. Default `60`. */
+    leewaySeconds?: number;
+    /** Required `iss` claim — the token is rejected on mismatch. */
+    issuer?: string;
+    /** Required `aud` claim — the token is rejected if it does not carry it. */
+    audience?: string;
+}
+export declare function verifyJwt(token: string, secret: string, options?: VerifyJwtOptions): Promise<JwtPayload>;
+/** Tuning for `signJwt`. */
+export interface SignJwtOptions {
+    /** Lifetime in seconds — sets `exp` to now + this. Omit for no expiry. */
+    expiresInSec?: number;
+    /** `iss` claim. */
+    issuer?: string;
+    /** `aud` claim. */
+    audience?: string;
+    /** `sub` claim. */
+    subject?: string;
+}
+/**
+ * Sign a payload as an HS256 JWT — the issuing counterpart of `verifyJwt`.
+ * Used to mint OAuth access tokens whose audience binds them to one resource.
+ * `iat` is always set; `exp` / `iss` / `aud` / `sub` follow `options`.
+ */
+export declare function signJwt(payload: JwtPayload, secret: string, options?: SignJwtOptions): Promise<string>;
 export declare function extractToken(req: Request, cookieName?: string): string | null;
 /**
  * Per-scope access predicate. `endpoint.scope` selects which rule applies:
@@ -17,6 +43,14 @@ export type AuthRule<TIdentity> = 'public' | 'authenticated' | ((identity: Await
 export interface AuthHookConfig<TIdentity> {
     /** Resolve the request identity — cookie / bearer + DB lookup. */
     resolve: (ctx: RuntimeContext) => Promise<TIdentity | null>;
+    /**
+     * Resolve identity on a non-HTTP context (a tool call) where there is no
+     * `req`. The transport (MCP / agent) has already authenticated the caller;
+     * this locates the identity it injected into `ctx` (via `buildMcpServer`'s
+     * `context`). Without it, a scoped tool call with no `req` **fails closed**
+     * — the scope rule sees no identity and `onAnonymous` rejects the call.
+     */
+    resolveFromContext?: (ctx: RuntimeContext) => TIdentity | null | Promise<TIdentity | null>;
     /** Access rule per scope; `endpoint.scope` is the key. */
     rules: Record<string, AuthRule<TIdentity>>;
     /** Scope applied when an endpoint declares none. */
@@ -35,6 +69,12 @@ export type AuthHook = (ctx: RuntimeContext, endpoint: MethodDef) => Promise<voi
  * Identity resolution and the scope vocabulary stay in the project; the
  * project annotates its `rules` object with `satisfies Record<MyScope, …>` to
  * keep scope coverage exhaustive.
+ *
+ * The hook runs on both surfaces: as `createServer`'s `beforeHandle` (HTTP) and
+ * as a tool mount's `lifecycle.beforeHandle` (MCP / agent). On HTTP it resolves
+ * identity from `ctx.req` via `resolve`; on a tool call — where there is no
+ * `req` — it uses `resolveFromContext`. If `resolveFromContext` is omitted, a
+ * scoped tool call has no identity and **fails closed** (never silently passes).
  */
 export declare function createAuthHook<TIdentity>(config: AuthHookConfig<TIdentity>): AuthHook;
 /**

package/dist/server/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAG1C,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AASD,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA4ClF;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU7E;AAUD;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,CAAC,SAAS,IAC1B,QAAQ,GACR,eAAe,GACf,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAExF,MAAM,WAAW,cAAc,CAAC,SAAS;IACvC,kEAAkE;IAClE,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC5D,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3C,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC;IAC5E,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,KAAK,CAAC;IAC1B,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,KAAK,CAAC;CAC3B;AAED,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnF;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,SAAS,CAAC,GAAG,QAAQ,CAuBrF;AAID;;;;GAIG;AACH,MAAM,WAAW,oBAAoB,CAAC,SAAS;IAC7C,4EAA4E;IAC5E,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;CACpE;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAC5C,MAAM,EAAE,oBAAoB,CAAC,SAAS,CAAC,GACtC,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAM7C"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAG1C,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,8BAA8B;AAC9B,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAiBD,wBAAsB,SAAS,CAC7B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,UAAU,CAAC,CAgErB;AAED,4BAA4B;AAC5B,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAQD;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,OAAO,EAAE,UAAU,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,CA+BjB;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU7E;AAUD;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,CAAC,SAAS,IAC1B,QAAQ,GACR,eAAe,GACf,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAExF,MAAM,WAAW,cAAc,CAAC,SAAS;IACvC,kEAAkE;IAClE,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC3F,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3C,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC;IAC5E,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,KAAK,CAAC;IAC1B,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,KAAK,CAAC;CAC3B;AAED,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnF;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,SAAS,CAAC,GAAG,QAAQ,CAgCrF;AAID;;;;GAIG;AACH,MAAM,WAAW,oBAAoB,CAAC,SAAS;IAC7C,4EAA4E;IAC5E,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;CACpE;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAC5C,MAAM,EAAE,oBAAoB,CAAC,SAAS,CAAC,GACtC,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAM7C"}

package/dist/server/middleware/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/cookies.ts"],"names":[],"mappings":"AAAA,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAc1E;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CACtC;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,aAAkB,GACvB,MAAM,CASR;AAED,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,GAAG,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IACtC,+EAA+E;IAC/E,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,gEAAgE;IAChE,KAAK,IAAI,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAahF"}
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/cookies.ts"],"names":[],"mappings":"AAEA,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkB1E;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CACtC;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,aAAkB,GACvB,MAAM,CASR;AAED,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,GAAG,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IACtC,+EAA+E;IAC/E,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,gEAAgE;IAChE,KAAK,IAAI,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAahF"}

package/dist/server/middleware/cors.d.ts

@@ -4,6 +4,13 @@ export interface CorsConfig {
     methods?: string;
     headers?: string;
 }
+/**
+ * Reject an unsafe CORS config at construction. `credentials: true` with a
+ * wildcard origin would reflect *any* caller's `Origin` with
+ * `Allow-Credentials: true` — every site could make authenticated cross-origin
+ * requests. Credentials require an explicit origin allow-list.
+ */
+export declare function assertCorsConfig(config: CorsConfig): void;
 export declare function corsHeaders(config: CorsConfig, requestOrigin?: string | null): Record<string, string>;
 export declare function corsPreflightResponse(config: CorsConfig, req: Request): Response;
 //# sourceMappingURL=cors.d.ts.map

package/dist/server/middleware/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/cors.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,UAAU,EAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCxB;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,GAAG,QAAQ,CAKhF"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/cors.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAOzD;AAoBD,wBAAgB,WAAW,CACzB,MAAM,EAAE,UAAU,EAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsBxB;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,GAAG,QAAQ,CAKhF"}

package/dist/server/middleware/pkce.d.ts

@@ -0,0 +1,17 @@
+/**
+ * PKCE (RFC 7636) verification for the OAuth authorization-code flow. The client
+ * sends a `code_challenge` at `/authorize` and the matching `code_verifier` at
+ * `/token`; the server confirms they correspond so an intercepted code is
+ * useless without the verifier.
+ */
+/** The only PKCE method OAuth 2.1 permits for public clients. */
+export type PkceMethod = 'S256';
+/** Derive the S256 `code_challenge` from a `code_verifier`. */
+export declare function deriveCodeChallenge(verifier: string): Promise<string>;
+/**
+ * Verify a `code_verifier` against the stored S256 `code_challenge`. S256 is the
+ * only method OAuth 2.1 permits for public clients — `plain` is intentionally
+ * not supported (it offers no protection against a leaked challenge).
+ */
+export declare function verifyPkce(verifier: string, challenge: string): Promise<boolean>;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/server/middleware/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/pkce.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,iEAAiE;AACjE,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAQhC,+DAA+D;AAC/D,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG3E;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAItF"}