stitchkit 0.93.0 → 0.94.1

package/dist/index-d9pk3td4.js

@@ -0,0 +1,326 @@
+// src/internal/channel.ts
+import { z } from "zod";
+var PositiveSafeIntegerSchema = z.number().int().positive().safe();
+var BoundedChannelPolicySchema = z.enum(["ordered", "latest"]);
+var BoundedChannelStateSchema = z.enum(["open", "draining", "closed", "failed"]);
+var BoundedChannelSnapshotSchema = z.object({
+  state: BoundedChannelStateSchema,
+  policy: BoundedChannelPolicySchema,
+  queuedItems: z.number().int().nonnegative(),
+  queuedBytes: z.number().int().nonnegative(),
+  waitingReader: z.boolean(),
+  offered: z.number().int().nonnegative(),
+  delivered: z.number().int().nonnegative(),
+  queued: z.number().int().nonnegative(),
+  coalesced: z.number().int().nonnegative(),
+  refused: z.number().int().nonnegative(),
+  discarded: z.number().int().nonnegative()
+}).strict().readonly();
+
+class BoundedChannelReaderError extends Error {
+  constructor() {
+    super("A bounded channel permits only one pending next() call");
+    this.name = "BoundedChannelReaderError";
+  }
+}
+function createBoundedChannel(config) {
+  const policy = BoundedChannelPolicySchema.parse(config.policy);
+  const maxItems = PositiveSafeIntegerSchema.parse(config.maxItems);
+  const maxBytes = PositiveSafeIntegerSchema.parse(config.maxBytes);
+  const queue = [];
+  let state = "open";
+  let queuedBytes = 0;
+  let waiting;
+  let failure;
+  let hasFailure = false;
+  let offered = 0;
+  let delivered = 0;
+  let queued = 0;
+  let coalesced = 0;
+  let refused = 0;
+  let discarded = 0;
+  const removeAbortListener = () => {
+    config.signal?.removeEventListener("abort", abortChannel);
+  };
+  const snapshot = () => BoundedChannelSnapshotSchema.parse({
+    state,
+    policy,
+    queuedItems: queue.length,
+    queuedBytes,
+    waitingReader: waiting !== undefined,
+    offered,
+    delivered,
+    queued,
+    coalesced,
+    refused,
+    discarded
+  });
+  const clearQueue = () => {
+    discarded += queue.length;
+    queue.length = 0;
+    queuedBytes = 0;
+  };
+  const settleClosed = () => {
+    if (state !== "draining" || queue.length > 0)
+      return;
+    state = "closed";
+    removeAbortListener();
+    const reader = waiting;
+    waiting = undefined;
+    reader?.resolve({ done: true, value: undefined });
+  };
+  const close = (options = {}) => {
+    if (state === "closed" || state === "failed")
+      return snapshot();
+    const mode = options.mode ?? "drain";
+    if (mode !== "drain" && mode !== "discard") {
+      throw new TypeError("Bounded channel close mode must be drain or discard");
+    }
+    if (mode === "discard") {
+      clearQueue();
+      state = "closed";
+      removeAbortListener();
+      const reader = waiting;
+      waiting = undefined;
+      reader?.resolve({ done: true, value: undefined });
+      return snapshot();
+    }
+    state = "draining";
+    settleClosed();
+    return snapshot();
+  };
+  function abortChannel() {
+    close({ mode: "discard" });
+  }
+  const channel = {
+    [Symbol.asyncIterator]() {
+      return channel;
+    },
+    offer(value) {
+      offered += 1;
+      if (state !== "open") {
+        refused += 1;
+        return { outcome: "refused", reason: "not-open" };
+      }
+      const bytes = config.sizeOf(value);
+      if (!Number.isSafeInteger(bytes) || bytes < 0) {
+        throw new TypeError("Bounded channel sizeOf() must return a non-negative safe integer");
+      }
+      if (bytes > maxBytes) {
+        refused += 1;
+        return { outcome: "refused", reason: "item-too-large" };
+      }
+      const reader = waiting;
+      if (reader) {
+        waiting = undefined;
+        delivered += 1;
+        reader.resolve({ done: false, value });
+        return { outcome: "delivered" };
+      }
+      if (policy === "latest" && queue.length > 0) {
+        const previous = queue[0];
+        if (!previous)
+          throw new Error("Bounded latest channel lost its pending value");
+        queue[0] = { value, bytes };
+        queuedBytes += bytes - previous.bytes;
+        coalesced += 1;
+        return { outcome: "coalesced", replaced: 1 };
+      }
+      if (queue.length >= maxItems) {
+        refused += 1;
+        return { outcome: "refused", reason: "item-capacity" };
+      }
+      if (queuedBytes + bytes > maxBytes) {
+        refused += 1;
+        return { outcome: "refused", reason: "byte-capacity" };
+      }
+      queue.push({ value, bytes });
+      queuedBytes += bytes;
+      queued += 1;
+      return { outcome: "queued" };
+    },
+    next() {
+      if (hasFailure)
+        return Promise.reject(failure);
+      const next = queue.shift();
+      if (next) {
+        queuedBytes -= next.bytes;
+        delivered += 1;
+        settleClosed();
+        return Promise.resolve({ done: false, value: next.value });
+      }
+      if (state === "closed" || state === "draining") {
+        settleClosed();
+        return Promise.resolve({ done: true, value: undefined });
+      }
+      if (waiting)
+        return Promise.reject(new BoundedChannelReaderError);
+      return new Promise((resolve, reject) => {
+        waiting = { resolve, reject };
+      });
+    },
+    return() {
+      close({ mode: "discard" });
+      return Promise.resolve({ done: true, value: undefined });
+    },
+    throw(error) {
+      channel.fail(error);
+      return Promise.reject(error);
+    },
+    close,
+    fail(error) {
+      if (state === "closed" || state === "failed")
+        return snapshot();
+      failure = error;
+      hasFailure = true;
+      state = "failed";
+      clearQueue();
+      removeAbortListener();
+      const reader = waiting;
+      waiting = undefined;
+      reader?.reject(error);
+      return snapshot();
+    },
+    getSnapshot: snapshot
+  };
+  if (config.signal?.aborted)
+    abortChannel();
+  else
+    config.signal?.addEventListener("abort", abortChannel, { once: true });
+  return channel;
+}
+var CreditWindowSnapshotSchema = z.object({
+  state: z.enum(["open", "closed"]),
+  capacityBytes: PositiveSafeIntegerSchema,
+  availableBytes: z.number().int().nonnegative(),
+  leasedBytes: z.number().int().nonnegative(),
+  acquired: z.number().int().nonnegative(),
+  refused: z.number().int().nonnegative(),
+  replenishedBytes: z.number().int().nonnegative(),
+  waiting: z.number().int().nonnegative()
+}).strict().readonly();
+function createCreditWindow(config) {
+  const capacityBytes = PositiveSafeIntegerSchema.parse(config.capacityBytes);
+  let availableBytes = capacityBytes;
+  let state = "open";
+  let acquired = 0;
+  let refused = 0;
+  let replenishedBytes = 0;
+  const waiters = new Set;
+  const snapshot = () => CreditWindowSnapshotSchema.parse({
+    state,
+    capacityBytes,
+    availableBytes,
+    leasedBytes: capacityBytes - availableBytes,
+    acquired,
+    refused,
+    replenishedBytes,
+    waiting: waiters.size
+  });
+  const serveWaiters = () => {
+    for (const waiter of waiters) {
+      if (waiter.bytes > availableBytes)
+        return;
+      waiter.settle({ outcome: "leased", lease: lease(waiter.bytes) });
+    }
+  };
+  const lease = (requested) => {
+    availableBytes -= requested;
+    acquired += 1;
+    let leaseReleased = false;
+    return {
+      bytes: requested,
+      get released() {
+        return leaseReleased;
+      },
+      release() {
+        if (leaseReleased)
+          return;
+        leaseReleased = true;
+        availableBytes += requested;
+        replenishedBytes += requested;
+        if (availableBytes > capacityBytes) {
+          throw new Error("Credit window accounting exceeded its capacity");
+        }
+        serveWaiters();
+      }
+    };
+  };
+  const tryLease = (requested) => {
+    if (state === "closed")
+      return { outcome: "refused", reason: "closed" };
+    if (requested > capacityBytes) {
+      return { outcome: "refused", reason: "larger-than-window" };
+    }
+    if (requested > availableBytes) {
+      return { outcome: "refused", reason: "insufficient-credit" };
+    }
+    return { outcome: "leased", lease: lease(requested) };
+  };
+  const acquireNow = (requested) => {
+    const result = tryLease(requested);
+    if (result.outcome === "refused")
+      refused += 1;
+    return result;
+  };
+  const acquireWaiting = (requested, options) => {
+    const timeoutMs = options.timeoutMs === undefined ? undefined : PositiveSafeIntegerSchema.parse(options.timeoutMs);
+    const immediate = tryLease(requested);
+    if (immediate.outcome === "leased")
+      return Promise.resolve(immediate);
+    if (immediate.reason !== "insufficient-credit") {
+      refused += 1;
+      return Promise.resolve({ outcome: "refused", reason: immediate.reason });
+    }
+    if (options.signal?.aborted) {
+      refused += 1;
+      return Promise.resolve({ outcome: "refused", reason: "aborted" });
+    }
+    return new Promise((resolve) => {
+      let settled = false;
+      let timer;
+      const waiter = {
+        bytes: requested,
+        settle(result) {
+          if (settled)
+            return;
+          settled = true;
+          if (timer !== undefined)
+            clearTimeout(timer);
+          options.signal?.removeEventListener("abort", onAbort);
+          waiters.delete(waiter);
+          if (result.outcome === "refused")
+            refused += 1;
+          resolve(result);
+        }
+      };
+      function onAbort() {
+        waiter.settle({ outcome: "refused", reason: "aborted" });
+      }
+      waiters.add(waiter);
+      options.signal?.addEventListener("abort", onAbort, { once: true });
+      if (timeoutMs !== undefined) {
+        timer = setTimeout(() => {
+          waiter.settle({ outcome: "refused", reason: "timed-out" });
+        }, timeoutMs);
+      }
+    });
+  };
+  function acquire(bytes, options) {
+    const requested = PositiveSafeIntegerSchema.parse(bytes);
+    return options === undefined ? acquireNow(requested) : acquireWaiting(requested, options);
+  }
+  return {
+    acquire,
+    close() {
+      state = "closed";
+      for (const waiter of [...waiters]) {
+        waiter.settle({ outcome: "refused", reason: "closed" });
+      }
+      return snapshot();
+    },
+    getSnapshot: snapshot
+  };
+}
+
+export { BoundedChannelPolicySchema, BoundedChannelStateSchema, BoundedChannelSnapshotSchema, BoundedChannelReaderError, createBoundedChannel, CreditWindowSnapshotSchema, createCreditWindow };

package/dist/index-dce5wxcq.js

@@ -0,0 +1,63 @@
+// src/realtime/request.ts
+import { z } from "zod";
+var RealtimeRequestPhaseSchema = z.enum([
+  "engine-handoff",
+  "engine-ack-received",
+  "settled",
+  "timeout",
+  "disconnected"
+]);
+var RealtimeRequestPhaseEventSchema = z.object({
+  requestId: z.string().min(1),
+  event: z.string().min(1),
+  phase: RealtimeRequestPhaseSchema,
+  elapsedMs: z.number().nonnegative()
+}).strict();
+
+class RealtimeRequestTimeoutError extends Error {
+  code = "REALTIME_REQUEST_TIMEOUT";
+  event;
+  timeoutMs;
+  constructor(event, timeoutMs) {
+    super(`Realtime request "${event}" timed out after ${timeoutMs}ms`);
+    this.name = "RealtimeRequestTimeoutError";
+    this.event = event;
+    this.timeoutMs = timeoutMs;
+  }
+}
+
+class RealtimeRequestDisconnectedError extends Error {
+  code = "REALTIME_REQUEST_DISCONNECTED";
+  event;
+  constructor(event) {
+    super(`Realtime request "${event}" was interrupted by disconnect`);
+    this.name = "RealtimeRequestDisconnectedError";
+    this.event = event;
+  }
+}
+
+class RealtimeRequestInvalidAcknowledgementError extends Error {
+  code = "REALTIME_REQUEST_INVALID_ACKNOWLEDGEMENT";
+  event;
+  constructor(event, cause) {
+    super(`Realtime request "${event}" received an invalid acknowledgement`, { cause });
+    this.name = "RealtimeRequestInvalidAcknowledgementError";
+    this.event = event;
+  }
+}
+
+class RealtimeRequestRejectedError extends Error {
+  code = "REALTIME_REQUEST_REJECTED";
+  event;
+  reason;
+  issues;
+  constructor(event, reason, detail, issues) {
+    super(`Realtime request "${event}" was rejected by the peer (${reason}): ${detail}`);
+    this.name = "RealtimeRequestRejectedError";
+    this.event = event;
+    this.reason = reason;
+    this.issues = issues;
+  }
+}
+
+export { RealtimeRequestPhaseSchema, RealtimeRequestPhaseEventSchema, RealtimeRequestTimeoutError, RealtimeRequestDisconnectedError, RealtimeRequestInvalidAcknowledgementError, RealtimeRequestRejectedError };

package/dist/index-e01r054k.js

@@ -0,0 +1,105 @@
+import {
+  deriveCodeChallenge
+} from "./index-hr4tzbwq.js";
+import {
+  base64UrlToBytes,
+  bytesToBase64Url
+} from "./index-rxfy4cq7.js";
+import {
+  unauthorized
+} from "./index-2vtcmrj9.js";
+import {
+  safeJsonParse
+} from "./index-kzfs85xp.js";
+import {
+  isRecord
+} from "./index-hffjpmq9.js";
+
+// src/server/middleware/jwt.ts
+var MAX_TOKEN_BYTES = 8192;
+async function verifyJwt(token, secret, options = {}) {
+  if (!secret)
+    throw new Error("verifyJwt: a non-empty secret is required");
+  if (token.length > MAX_TOKEN_BYTES)
+    throw unauthorized("Token too large");
+  const [headerB64, payloadB64, signatureB64] = token.split(".");
+  if (!headerB64 || !payloadB64 || !signatureB64)
+    throw unauthorized("Invalid token format");
+  let header;
+  let payloadRaw;
+  let signature;
+  try {
+    const decoder = new TextDecoder;
+    header = JSON.parse(decoder.decode(base64UrlToBytes(headerB64)));
+    payloadRaw = safeJsonParse(decoder.decode(base64UrlToBytes(payloadB64)));
+    signature = base64UrlToBytes(signatureB64);
+  } catch {
+    throw unauthorized("Malformed token");
+  }
+  if (!isRecord(payloadRaw))
+    throw unauthorized("Malformed token");
+  const payload = payloadRaw;
+  if (header.alg !== "HS256")
+    throw unauthorized("Unsupported token algorithm");
+  const encoder = new TextEncoder;
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
+  const data = encoder.encode(`${headerB64}.${payloadB64}`);
+  const valid = await crypto.subtle.verify("HMAC", key, signature, data);
+  if (!valid)
+    throw unauthorized("Invalid token signature");
+  const leeway = options.leewaySeconds ?? 60;
+  const now = Date.now() / 1000;
+  if ("exp" in payload) {
+    if (typeof payload.exp !== "number")
+      throw unauthorized("Malformed token");
+    if (payload.exp < now - leeway)
+      throw unauthorized("Token expired");
+  }
+  if ("nbf" in payload) {
+    if (typeof payload.nbf !== "number")
+      throw unauthorized("Malformed token");
+    if (payload.nbf > now + leeway)
+      throw unauthorized("Token not yet valid");
+  }
+  if (options.issuer !== undefined && payload.iss !== options.issuer) {
+    throw unauthorized("Token issuer mismatch");
+  }
+  if (options.audience !== undefined) {
+    const aud = payload.aud;
+    const ok = Array.isArray(aud) ? aud.includes(options.audience) : aud === options.audience;
+    if (!ok)
+      throw unauthorized("Token audience mismatch");
+  }
+  return payload;
+}
+async function signJwt(payload, secret, options = {}) {
+  if (!secret)
+    throw new Error("signJwt: a non-empty secret is required");
+  const now = Math.floor(Date.now() / 1000);
+  const claims = {
+    ...payload,
+    iat: now,
+    ...options.expiresInSec !== undefined && { exp: now + options.expiresInSec },
+    ...options.issuer !== undefined && { iss: options.issuer },
+    ...options.audience !== undefined && { aud: options.audience },
+    ...options.subject !== undefined && { sub: options.subject }
+  };
+  const encoder = new TextEncoder;
+  const headerB64 = bytesToBase64Url(encoder.encode(JSON.stringify({ alg: "HS256", typ: "JWT" })));
+  const payloadB64 = bytesToBase64Url(encoder.encode(JSON.stringify(claims)));
+  const signingInput = `${headerB64}.${payloadB64}`;
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(signingInput));
+  const signatureB64 = bytesToBase64Url(new Uint8Array(signature));
+  return `${signingInput}.${signatureB64}`;
+}
+
+// src/server/middleware/pkce.ts
+async function verifyPkce(verifier, challenge) {
+  if (!verifier || !challenge)
+    return false;
+  const derived = await deriveCodeChallenge(verifier);
+  return derived === challenge;
+}
+
+export { verifyJwt, signJwt, verifyPkce };