stitchkit 0.93.0 → 0.94.1

package/dist/server/middleware/auth.d.ts

@@ -1,35 +1,5 @@
-import type { RuntimeContext } from '../../contract/index.js';
+import type { RuntimeContext } from '../../contract/runtime-context.js';
 import type { AuthorizationContext, OperationIdentity } from '../types.js';
-export interface JwtPayload {
-    [key: string]: unknown;
-}
-/** Tuning for `verifyJwt`. */
-export interface VerifyJwtOptions {
-    /** Clock-skew tolerance for `exp` / `nbf`, in seconds. Default `60`. */
-    leewaySeconds?: number;
-    /** Required `iss` claim — the token is rejected on mismatch. */
-    issuer?: string;
-    /** Required `aud` claim — the token is rejected if it does not carry it. */
-    audience?: string;
-}
-export declare function verifyJwt(token: string, secret: string, options?: VerifyJwtOptions): Promise<JwtPayload>;
-/** Tuning for `signJwt`. */
-export interface SignJwtOptions {
-    /** Lifetime in seconds — sets `exp` to now + this. Omit for no expiry. */
-    expiresInSec?: number;
-    /** `iss` claim. */
-    issuer?: string;
-    /** `aud` claim. */
-    audience?: string;
-    /** `sub` claim. */
-    subject?: string;
-}
-/**
- * Sign a payload as an HS256 JWT — the issuing counterpart of `verifyJwt`.
- * Used to mint OAuth access tokens whose audience binds them to one resource.
- * `iat` is always set; `exp` / `iss` / `aud` / `sub` follow `options`.
- */
-export declare function signJwt(payload: JwtPayload, secret: string, options?: SignJwtOptions): Promise<string>;
 export declare function extractToken(req: Request, cookieName?: string): string | null;
 /**
  * Per-scope access predicate. `endpoint.scope` selects which rule applies:

package/dist/server/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAUrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAGxE,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,8BAA8B;AAC9B,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAKD,wBAAsB,SAAS,CAC7B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,UAAU,CAAC,CAgErB;AAED,4BAA4B;AAC5B,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,OAAO,EAAE,UAAU,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,CA+BjB;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU7E;AAUD;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE3D,MAAM,MAAM,QAAQ,CAAC,SAAS,IAC1B,QAAQ,GACR,eAAe,GACf,CAAC,CACC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,EAC5B,GAAG,EAAE,cAAc,KAChB,OAAO,GAAG,oBAAoB,GAAG,OAAO,CAAC,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC;AAEnF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,cAAc,CAC7B,SAAS,EACT,OAAO,SAAS,oBAAoB,GAAG,oBAAoB;IAE3D,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC1B,2FAA2F;IAC3F,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,KAAK,CAAA;KAAE,CAAC;CAC5F;AAED,iFAAiF;AACjF,MAAM,MAAM,SAAS,CAAC,SAAS,IAAI,MAAM,CACvC,MAAM,EACN,QAAQ,CAAC,SAAS,CAAC,GAAG,cAAc,CAAC,SAAS,EAAE,oBAAoB,CAAC,CACtE,CAAC;AAEF;;;;;;;;GAQG;AACH,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,SAAS;IAAE,IAAI,EAAE,MAAM,KAAK,CAAA;CAAE,GAAG,KAAK,GAAG,MAAM,CAAC;AAE5E,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,SAAS;IACrC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,MAAM,OAAO,SAAS,MAAM,CAAC;CAC5D,GACG,OAAO,GACP,MAAM,CAAC;AAEX,KAAK,UAAU,CAAC,KAAK,IAAI,KAAK,SAAS,CAAC,GAAG,IAAI,EAAE,MAAM,MAAM,KAAK,MAAM,OAAO,GAC3E,OAAO,CAAC,OAAO,CAAC,GAChB,IAAI,CAAC;AAET,KAAK,kBAAkB,CAAC,KAAK,IAC3B,UAAU,CAAC,KAAK,CAAC,SAAS,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;AAE/F,KAAK,SAAS,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,OAAO,GAAG,MAAM,CAAC,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC;AACzE,KAAK,UAAU,CAAC,CAAC,EAAE,CAAC,SAAS,WAAW,IAAI,CAAC,SAAS,CAAC,GACnD,CAAC,SAAS,MAAM,CAAC,GACf,CAAC,CAAC,CAAC,CAAC,GACJ,KAAK,GACP,KAAK,CAAC;AACV,KAAK,iBAAiB,CAAC,CAAC,IAAI;KACzB,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK;CAClE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhB,KAAK,oBAAoB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GACzD,MAAM,GACN;KACG,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;CAC9C,GAAG;KACD,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;CACtE,CAAC;AAEN,KAAK,gBAAgB,CAAC,KAAK,IACzB,IAAI,SAAS,UAAU,CAAC,KAAK,CAAC,GAC1B,OAAO,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,GACxD,oBAAoB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;AAEtD,KAAK,YAAY,CAAC,CAAC,IAAI,OAAO,CAC5B;KACG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;CACxD,CAAC,MAAM,CAAC,CAAC,EACV,MAAM,CACP,CAAC;AAEF,KAAK,WAAW,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,SAAS,WAAW,IAAI,CAAC,SAAS,MAAM,aAAa,GACzF,CAAC,SAAS,YAAY,CAAC,aAAa,CAAC,GACnC,aAAa,CAAC,CAAC,CAAC,GAChB,CAAC,SAAS,MAAM,KAAK,GACnB,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,GAC/C,aAAa,CAAC,CAAC,CAAC,GACpB,CAAC,SAAS,MAAM,KAAK,GACnB,KAAK,CAAC,CAAC,CAAC,GACR,KAAK,CAAC;AAEZ,KAAK,kBAAkB,CAAC,KAAK,SAAS,MAAM,EAAE,aAAa,SAAS,MAAM,IAAI;KAC3E,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,aAAa,CAAC,GAAG,WAAW,CACnE,KAAK,EACL,aAAa,EACb,CAAC,CACF;CACF,GAAG;KACD,CAAC,IAAI,OAAO,CACX,OAAO,CAAC,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,MAAM,CAAC,EAClD,YAAY,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,aAAa,CAAC,CAClD,CAAC,CAAC,EAAE,WAAW,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;CAC1C,CAAC;AAEF,KAAK,iBAAiB,CAAC,MAAM,IAAI,kBAAkB,CACjD,QAAQ,CAAC,MAAM,CAAC,EAChB,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CACjC,CAAC;AAEF,MAAM,MAAM,UAAU,CAAC,MAAM,IAAI;KAC9B,CAAC,IAAI,MAAM,MAAM,GAAG,MAAM,GAAG,QAAQ,SAAS,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,GAC7E,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GACrC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;CACjC,CAAC;AAEF,MAAM,WAAW,cAAc,CAC7B,SAAS,EACT,MAAM,SAAS,SAAS,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC;IAE1D,kEAAkE;IAClE,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC3F,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC;IAC5E,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,KAAK,CAAC;IAC1B,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,KAAK,CAAC;CAC3B;AAUD,MAAM,WAAW,QAAQ;IACvB,CAAC,GAAG,EAAE,oBAAoB,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,QAAA,MAAM,mBAAmB,EAAE,OAAO,MAA6C,CAAC;AAoBhF;;;;GAIG;AACH,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAE,SAAQ,QAAQ;IACtF,6DAA6D;IAC7D,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE,MAAM,OAAO,GAAG,SAAS,CAAC;CAC3D;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,CAAC,KAAK,SAAS,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IACzE,KAAK,SAAS,cAAc,CAAC,MAAM,OAAO,CAAC,GAAG,OAAO,GAAG,KAAK,CAAC;AAEhE,KAAK,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEzD,KAAK,aAAa,CAAC,MAAM,SAAS,SAAS,UAAU,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,MAAM,KAAK,GACzF,KAAK,SAAS,UAAU,GACtB,UAAU,CAAC,KAAK,CAAC,GACjB,KAAK,GACP,KAAK,CAAC;AAEV,KAAK,qBAAqB,CACxB,MAAM,SAAS,SAAS,UAAU,EAAE,EACpC,MAAM,SAAS,WAAW,IACxB,MAAM,CAAC,MAAM,CAAC,SAAS,MAAM,KAAK,GAClC,KAAK,SAAS,UAAU,GACtB,MAAM,SAAS,MAAM,UAAU,CAAC,KAAK,CAAC,GACpC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GACzB,KAAK,GACP,KAAK,GACP,KAAK,CAAC;AAEV,KAAK,eAAe,CAAC,CAAC,IAAI,CAAC,SAAS,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAErE,KAAK,oBAAoB,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GACxE,MAAM,GACN;KACG,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;CAC5C,GAAG;KACD,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;CACpE,CAAC;AAEN,2EAA2E;AAC3E,MAAM,MAAM,kBAAkB,CAAC,MAAM,SAAS,SAAS,UAAU,EAAE,IAAI;KACpE,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,oBAAoB,CAChE,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CACtC;CACF,CAAC;AAEF,MAAM,WAAW,sBAAsB,CACrC,MAAM,SAAS,SAAS,CAAC,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC;IAErD,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,YAAY,CAAC,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;CACjD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EACT,KAAK,CAAC,MAAM,SAAS,SAAS,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,EAChE,MAAM,EAAE,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAiE/E;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,MAAM,SAAS,SAAS,CAAC,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC,EAC1F,MAAM,EAAE,sBAAsB,CAAC,MAAM,CAAC,GACrC,cAAc,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CA2E5C;AAID;;;;GAIG;AACH,MAAM,WAAW,oBAAoB,CAAC,SAAS;IAC7C,4EAA4E;IAC5E,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;CACpE;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAC5C,MAAM,EAAE,oBAAoB,CAAC,SAAS,CAAC,GACtC,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAM7C"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAMrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAGxE,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU7E;AAUD;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE3D,MAAM,MAAM,QAAQ,CAAC,SAAS,IAC1B,QAAQ,GACR,eAAe,GACf,CAAC,CACC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,EAC5B,GAAG,EAAE,cAAc,KAChB,OAAO,GAAG,oBAAoB,GAAG,OAAO,CAAC,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC;AAEnF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,cAAc,CAC7B,SAAS,EACT,OAAO,SAAS,oBAAoB,GAAG,oBAAoB;IAE3D,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC1B,2FAA2F;IAC3F,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,KAAK,CAAA;KAAE,CAAC;CAC5F;AAED,iFAAiF;AACjF,MAAM,MAAM,SAAS,CAAC,SAAS,IAAI,MAAM,CACvC,MAAM,EACN,QAAQ,CAAC,SAAS,CAAC,GAAG,cAAc,CAAC,SAAS,EAAE,oBAAoB,CAAC,CACtE,CAAC;AAEF;;;;;;;;GAQG;AACH,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,SAAS;IAAE,IAAI,EAAE,MAAM,KAAK,CAAA;CAAE,GAAG,KAAK,GAAG,MAAM,CAAC;AAE5E,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,SAAS;IACrC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,MAAM,OAAO,SAAS,MAAM,CAAC;CAC5D,GACG,OAAO,GACP,MAAM,CAAC;AAEX,KAAK,UAAU,CAAC,KAAK,IAAI,KAAK,SAAS,CAAC,GAAG,IAAI,EAAE,MAAM,MAAM,KAAK,MAAM,OAAO,GAC3E,OAAO,CAAC,OAAO,CAAC,GAChB,IAAI,CAAC;AAET,KAAK,kBAAkB,CAAC,KAAK,IAC3B,UAAU,CAAC,KAAK,CAAC,SAAS,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;AAE/F,KAAK,SAAS,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,OAAO,GAAG,MAAM,CAAC,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC;AACzE,KAAK,UAAU,CAAC,CAAC,EAAE,CAAC,SAAS,WAAW,IAAI,CAAC,SAAS,CAAC,GACnD,CAAC,SAAS,MAAM,CAAC,GACf,CAAC,CAAC,CAAC,CAAC,GACJ,KAAK,GACP,KAAK,CAAC;AACV,KAAK,iBAAiB,CAAC,CAAC,IAAI;KACzB,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK;CAClE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhB,KAAK,oBAAoB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GACzD,MAAM,GACN;KACG,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;CAC9C,GAAG;KACD,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;CACtE,CAAC;AAEN,KAAK,gBAAgB,CAAC,KAAK,IACzB,IAAI,SAAS,UAAU,CAAC,KAAK,CAAC,GAC1B,OAAO,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,GACxD,oBAAoB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;AAEtD,KAAK,YAAY,CAAC,CAAC,IAAI,OAAO,CAC5B;KACG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;CACxD,CAAC,MAAM,CAAC,CAAC,EACV,MAAM,CACP,CAAC;AAEF,KAAK,WAAW,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,SAAS,WAAW,IAAI,CAAC,SAAS,MAAM,aAAa,GACzF,CAAC,SAAS,YAAY,CAAC,aAAa,CAAC,GACnC,aAAa,CAAC,CAAC,CAAC,GAChB,CAAC,SAAS,MAAM,KAAK,GACnB,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,GAC/C,aAAa,CAAC,CAAC,CAAC,GACpB,CAAC,SAAS,MAAM,KAAK,GACnB,KAAK,CAAC,CAAC,CAAC,GACR,KAAK,CAAC;AAEZ,KAAK,kBAAkB,CAAC,KAAK,SAAS,MAAM,EAAE,aAAa,SAAS,MAAM,IAAI;KAC3E,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,aAAa,CAAC,GAAG,WAAW,CACnE,KAAK,EACL,aAAa,EACb,CAAC,CACF;CACF,GAAG;KACD,CAAC,IAAI,OAAO,CACX,OAAO,CAAC,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,MAAM,CAAC,EAClD,YAAY,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,aAAa,CAAC,CAClD,CAAC,CAAC,EAAE,WAAW,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;CAC1C,CAAC;AAEF,KAAK,iBAAiB,CAAC,MAAM,IAAI,kBAAkB,CACjD,QAAQ,CAAC,MAAM,CAAC,EAChB,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CACjC,CAAC;AAEF,MAAM,MAAM,UAAU,CAAC,MAAM,IAAI;KAC9B,CAAC,IAAI,MAAM,MAAM,GAAG,MAAM,GAAG,QAAQ,SAAS,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,GAC7E,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GACrC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;CACjC,CAAC;AAEF,MAAM,WAAW,cAAc,CAC7B,SAAS,EACT,MAAM,SAAS,SAAS,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC;IAE1D,kEAAkE;IAClE,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC3F,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC;IAC5E,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,KAAK,CAAC;IAC1B,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,KAAK,CAAC;CAC3B;AAUD,MAAM,WAAW,QAAQ;IACvB,CAAC,GAAG,EAAE,oBAAoB,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,QAAA,MAAM,mBAAmB,EAAE,OAAO,MAA6C,CAAC;AAoBhF;;;;GAIG;AACH,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAE,SAAQ,QAAQ;IACtF,6DAA6D;IAC7D,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE,MAAM,OAAO,GAAG,SAAS,CAAC;CAC3D;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,CAAC,KAAK,SAAS,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IACzE,KAAK,SAAS,cAAc,CAAC,MAAM,OAAO,CAAC,GAAG,OAAO,GAAG,KAAK,CAAC;AAEhE,KAAK,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEzD,KAAK,aAAa,CAAC,MAAM,SAAS,SAAS,UAAU,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,MAAM,KAAK,GACzF,KAAK,SAAS,UAAU,GACtB,UAAU,CAAC,KAAK,CAAC,GACjB,KAAK,GACP,KAAK,CAAC;AAEV,KAAK,qBAAqB,CACxB,MAAM,SAAS,SAAS,UAAU,EAAE,EACpC,MAAM,SAAS,WAAW,IACxB,MAAM,CAAC,MAAM,CAAC,SAAS,MAAM,KAAK,GAClC,KAAK,SAAS,UAAU,GACtB,MAAM,SAAS,MAAM,UAAU,CAAC,KAAK,CAAC,GACpC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GACzB,KAAK,GACP,KAAK,GACP,KAAK,CAAC;AAEV,KAAK,eAAe,CAAC,CAAC,IAAI,CAAC,SAAS,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAErE,KAAK,oBAAoB,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GACxE,MAAM,GACN;KACG,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;CAC5C,GAAG;KACD,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;CACpE,CAAC;AAEN,2EAA2E;AAC3E,MAAM,MAAM,kBAAkB,CAAC,MAAM,SAAS,SAAS,UAAU,EAAE,IAAI;KACpE,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,oBAAoB,CAChE,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CACtC;CACF,CAAC;AAEF,MAAM,WAAW,sBAAsB,CACrC,MAAM,SAAS,SAAS,CAAC,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC;IAErD,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,YAAY,CAAC,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;CACjD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EACT,KAAK,CAAC,MAAM,SAAS,SAAS,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,EAChE,MAAM,EAAE,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAiE/E;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,MAAM,SAAS,SAAS,CAAC,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC,EAC1F,MAAM,EAAE,sBAAsB,CAAC,MAAM,CAAC,GACrC,cAAc,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CA2E5C;AAID;;;;GAIG;AACH,MAAM,WAAW,oBAAoB,CAAC,SAAS;IAC7C,4EAA4E;IAC5E,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;CACpE;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAC5C,MAAM,EAAE,oBAAoB,CAAC,SAAS,CAAC,GACtC,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAM7C"}

package/dist/server/middleware/cors.d.ts

@@ -69,4 +69,21 @@ export declare function assertCorsConfig(config: CorsConfig): void;
 export declare function isOriginAllowed(config: CorsConfig | undefined, requestOrigin: string | null | undefined): boolean;
 export declare function corsHeaders(config: CorsConfig, requestOrigin?: string | null): Record<string, string>;
 export declare function corsPreflightResponse(config: CorsConfig, req: Request): Response;
+/** The CORS headers for one request — none when the handler has no CORS config. */
+export declare function requestCorsHeaders(cors: CorsConfig | undefined, req: Request): Record<string, string>;
+/**
+ * Apply CORS headers to a response produced outside the framework (a raw route,
+ * a binary endpoint or an `onError` hook).
+ *
+ * Headers are mutated **in place**. Rebuilding with `new Response(res.body, …)`
+ * silently corrupts partial responses: on Bun, reading `.body` of a response
+ * built from `Bun.file().slice()` re-reads the *whole* file, so a `206` keeps
+ * its honest `Content-Range` and `Content-Length` while the payload becomes the
+ * entire file — a client stitching ranges gets garbage.
+ *
+ * A rebuild survives only as the fallback: WHATWG marks `Response.redirect()`
+ * headers immutable (Node throws; Bun currently allows the set), and a redirect
+ * has no body to corrupt.
+ */
+export declare function applyCors(res: Response, cors: CorsConfig | undefined, req: Request): Response;
 //# sourceMappingURL=cors.d.ts.map

package/dist/server/middleware/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/cors.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,qEAC6B,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,2BAA2B,qHAC4E,CAAC;AAErH;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAoBzD;AAwBD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,OAAO,CAMT;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,UAAU,EAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA4BxB;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,GAAG,QAAQ,CAKhF"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/cors.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,qEAC6B,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,2BAA2B,qHAC4E,CAAC;AAErH;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAoBzD;AAwBD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,OAAO,CAMT;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,UAAU,EAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA4BxB;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,GAAG,QAAQ,CAKhF;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,UAAU,GAAG,SAAS,EAC5B,GAAG,EAAE,OAAO,GACX,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGxB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,UAAU,GAAG,SAAS,EAC5B,GAAG,EAAE,OAAO,GACX,QAAQ,CAeV"}

package/dist/server/middleware/jwt.d.ts

@@ -0,0 +1,31 @@
+export interface JwtPayload {
+    [key: string]: unknown;
+}
+/** Tuning for `verifyJwt`. */
+export interface VerifyJwtOptions {
+    /** Clock-skew tolerance for `exp` / `nbf`, in seconds. Default `60`. */
+    leewaySeconds?: number;
+    /** Required `iss` claim — the token is rejected on mismatch. */
+    issuer?: string;
+    /** Required `aud` claim — the token is rejected if it does not carry it. */
+    audience?: string;
+}
+export declare function verifyJwt(token: string, secret: string, options?: VerifyJwtOptions): Promise<JwtPayload>;
+/** Tuning for `signJwt`. */
+export interface SignJwtOptions {
+    /** Lifetime in seconds — sets `exp` to now + this. Omit for no expiry. */
+    expiresInSec?: number;
+    /** `iss` claim. */
+    issuer?: string;
+    /** `aud` claim. */
+    audience?: string;
+    /** `sub` claim. */
+    subject?: string;
+}
+/**
+ * Sign a payload as an HS256 JWT — the issuing counterpart of `verifyJwt`.
+ * Used to mint OAuth access tokens whose audience binds them to one resource.
+ * `iat` is always set; `exp` / `iss` / `aud` / `sub` follow `options`.
+ */
+export declare function signJwt(payload: JwtPayload, secret: string, options?: SignJwtOptions): Promise<string>;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/server/middleware/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/jwt.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,8BAA8B;AAC9B,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAKD,wBAAsB,SAAS,CAC7B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,UAAU,CAAC,CAgErB;AAED,4BAA4B;AAC5B,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,OAAO,EAAE,UAAU,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,CA+BjB"}

package/dist/server/middleware/trust-fence.d.ts

@@ -46,7 +46,7 @@
  *
  * → ADR 0151.
  */
-import type { StitchLogger } from '../../logger.js';
+import type { StitchLogger } from '../../internal/logger.js';
 import type { SocketIORequestPolicy } from '../socket-io-config.js';
 import type { LifecycleHooks } from '../types.js';
 /** Which admission point refused. */

package/dist/server/middleware/trust-fence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trust-fence.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/trust-fence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,qCAAqC;AACrC,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE1C,MAAM,MAAM,kBAAkB;AAC5B,yEAAyE;AACvE,cAAc;AAChB,wEAAwE;GACtE,gBAAgB;AAClB,iEAAiE;GAC/D,iBAAiB;AACnB,4DAA4D;GAC1D,YAAY,CAAC;AAEjB,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC;IACrD,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAC7C,oFAAoF;IACpF,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;CACpE;AAyDD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAM1D;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CA6GrE"}
+{"version":3,"file":"trust-fence.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/trust-fence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,qCAAqC;AACrC,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE1C,MAAM,MAAM,kBAAkB;AAC5B,yEAAyE;AACvE,cAAc;AAChB,wEAAwE;GACtE,gBAAgB;AAClB,iEAAiE;GAC/D,iBAAiB;AACnB,4DAA4D;GAC1D,YAAY,CAAC;AAEjB,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC;IACrD,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAC7C,oFAAoF;IACpF,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;CACpE;AAyDD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAM1D;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CA6GrE"}

package/dist/server/multipart-reader.d.ts

@@ -0,0 +1,22 @@
+export declare const DEFAULT_MAX_HEADER_BYTES: number;
+export declare const decoder: TextDecoder;
+export interface ParsedHeaders {
+    name: string;
+    filename?: string;
+    contentType?: string;
+    declaredSize?: number;
+}
+export interface MultipartPart extends ParsedHeaders {
+    stream: ReadableStream<Uint8Array>;
+    consumed(): boolean;
+}
+export declare function parseBoundary(req: Request): string;
+export declare class MultipartStreamReader {
+    #private;
+    constructor(req: Request, boundary: string, maxRequestBytes: number);
+    start(): Promise<void>;
+    nextPart(): Promise<MultipartPart | null>;
+    cancel(reason?: unknown): void;
+    release(): void;
+}
+//# sourceMappingURL=multipart-reader.d.ts.map

package/dist/server/multipart-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multipart-reader.d.ts","sourceRoot":"","sources":["../../src/server/multipart-reader.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,wBAAwB,QAAY,CAAC;AAGlD,eAAO,MAAM,OAAO,aAAoB,CAAC;AAiBzC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAc,SAAQ,aAAa;IAClD,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACnC,QAAQ,IAAI,OAAO,CAAC;CACrB;AA6BD,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CASlD;AAsFD,qBAAa,qBAAqB;;IAWhC,YAAY,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAMlE;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAO3B;IAEK,QAAQ,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CA8B9C;IAED,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAI7B;IAED,OAAO,IAAI,IAAI,CAEd;CA0EF"}

package/dist/server/multipart.d.ts

@@ -1,4 +1,4 @@
-import type { MultipartDescriptor } from '../contract/index.js';
+import type { MultipartDescriptor } from '../contract/client-types.js';
 import type { MultipartReceiver } from './types.js';
 export interface MultipartLifecycle {
     rollback(): Promise<void>;

package/dist/server/multipart.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"multipart.d.ts","sourceRoot":"","sources":["../../src/server/multipart.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAuB,MAAM,aAAa,CAAC;AAG5E,OAAO,KAAK,EAAE,iBAAiB,EAA2B,MAAM,SAAS,CAAC;AAyB1E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,EAAE,OAAO,CAAC;CACjB;AA2XD;;;GAGG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,UAAU,EAAE,mBAAmB,EAC/B,YAAY,CAAC,EAAE;IAAE,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAA;CAAE,EACjD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAC5C,OAAO,CAAC,eAAe,CAAC,CAoH1B"}
+{"version":3,"file":"multipart.d.ts","sourceRoot":"","sources":["../../src/server/multipart.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAuB,MAAM,0BAA0B,CAAC;AAQzF,OAAO,KAAK,EAAE,iBAAiB,EAA2B,MAAM,SAAS,CAAC;AAK1E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,EAAE,OAAO,CAAC;CACjB;AAqGD;;;GAGG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,UAAU,EAAE,mBAAmB,EAC/B,YAAY,CAAC,EAAE;IAAE,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAA;CAAE,EACjD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAC5C,OAAO,CAAC,eAAe,CAAC,CAoH1B"}

package/dist/server/oauth/cimd.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Client ID Metadata Documents: a `client_id` that is an https URL names a
+ * document the client publishes, fetched over a pinned, bounded connection and
+ * cached with its HTTP freshness — positive and negative entries in separate,
+ * bounded pools, resolutions rate-limited per client and overall.
+ */
+import { z } from 'zod';
+import type { ApplicationType, RegisteredClient } from './provider.js';
+export declare function isPlainDisplayCharacter(character: string): boolean;
+declare const CimdClientMetadataSchema: z.ZodObject<{
+    client_id: z.ZodURL;
+    redirect_uris: z.ZodArray<z.ZodURL>;
+    client_name: z.ZodString;
+    token_endpoint_auth_method: z.ZodLiteral<"none">;
+    application_type: z.ZodOptional<z.ZodEnum<{
+        native: "native";
+        web: "web";
+    }>>;
+}, z.core.$strip>;
+/** Validated Client ID Metadata Document (CIMD) wire shape. */
+export type CimdClientMetadata = z.infer<typeof CimdClientMetadataSchema>;
+export interface CimdFetchPolicy {
+    /** Maximum metadata document size. Default 64 KiB. */
+    maxBytes?: number;
+    /** DNS, connection and response timeout. Default 5 seconds. */
+    timeoutMs?: number;
+    /** Redirect hops, each re-resolved and re-validated. Default 3. */
+    maxRedirects?: number;
+}
+export interface CimdCachePolicy {
+    /**
+     * Maximum cache entries — positive and negative entries each get their OWN
+     * pool of this size, so a flood of failing lookups cannot evict warmed
+     * clients and warmed clients cannot reset a failing client's backoff.
+     * Default 256.
+     */
+    maxEntries?: number;
+    /** Freshness when the response carries no cache directives. Default 5 minutes. */
+    defaultTtlMs?: number;
+    /** Upper bound for origin-provided freshness. Default 1 hour. */
+    maxTtlMs?: number;
+    /** Short fail-closed cache for invalid/unavailable documents. Default 10 seconds. */
+    negativeTtlMs?: number;
+    /** Maximum uncached metadata resolutions per window, server-wide. Default 120. */
+    maxResolutions?: number;
+    /**
+     * Maximum uncached resolutions per window for ONE `client_id` — a single
+     * client whose document disables caching burns its own budget, not the
+     * server's. Default 10.
+     */
+    maxResolutionsPerClient?: number;
+    /** Resolution-rate window in milliseconds. Default 60 seconds. */
+    resolutionWindowMs?: number;
+}
+/** Injectable CIMD network boundary. Production uses the pinned-IP implementation. */
+export interface CimdFetchResponse {
+    status: number;
+    headers: Headers;
+    body: Uint8Array;
+    url: URL;
+}
+export interface CimdClientMetadataFetcher {
+    fetch(url: URL, headers: Record<string, string>): Promise<CimdFetchResponse>;
+}
+export interface CimdCacheEvent {
+    clientId: string;
+    status: 'hit' | 'miss' | 'revalidated' | 'negative';
+    freshnessMs?: number;
+}
+/** Build the production SSRF-safe, IP-pinned CIMD fetcher. */
+export declare function createSecureClientMetadataFetcher(policy?: CimdFetchPolicy): CimdClientMetadataFetcher;
+export declare const DEFAULT_CIMD_MAX_BYTES: number;
+export declare function absoluteClientUrl(clientId: string): URL | null;
+export declare function responseFreshness(headers: Headers, policy: CimdCachePolicy, now: number): {
+    freshnessMs: number;
+    store: boolean;
+};
+export declare function createCimdResolver(options: {
+    cache?: CimdCachePolicy;
+    fetcher: CimdClientMetadataFetcher;
+    now?: () => number;
+    onCacheEvent?: (event: CimdCacheEvent) => void;
+}): (clientId: string) => Promise<RegisteredClient>;
+export declare function isRegistrableRedirectUri(value: string, applicationType?: ApplicationType): boolean;
+export declare function isLoopbackRedirectUri(value: string): boolean;
+export {};
+/** Append query params to a redirect URI without clobbering its own query. */
+//# sourceMappingURL=cimd.d.ts.map

package/dist/server/oauth/cimd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.d.ts","sourceRoot":"","sources":["../../../src/server/oauth/cimd.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEpE,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CASlE;AAED,QAAA,MAAM,wBAAwB;;;;;;;;;iBAa5B,CAAC;AAEH,+DAA+D;AAC/D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,kEAAkE;IAClE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;CACV;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC9E;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,CAAC;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,8DAA8D;AAC9D,wBAAgB,iCAAiC,CAC/C,MAAM,GAAE,eAAoB,GAC3B,yBAAyB,CAc3B;AAED,eAAO,MAAM,sBAAsB,QAAY,CAAC;AA4BhD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAM9D;AA2BD,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,eAAe,EACvB,GAAG,EAAE,MAAM,GACV;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAmCzC;AAkBD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAC1C,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,yBAAyB,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;CAChD,cA2KyB,MAAM,KAAG,OAAO,CAAC,gBAAgB,CAAC,CAO3D;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAYT;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAS5D;;AAED,8EAA8E"}

package/dist/server/oauth/endpoints.d.ts

@@ -0,0 +1,39 @@
+import type { RawRoute } from '../types.js';
+import type { OAuthClientRegistrationConfig, OAuthProviderConfig, RegisteredClient } from './provider.js';
+export interface OAuthEndpointContext {
+    readonly config: OAuthProviderConfig;
+    /** Access-token lifetime in seconds. */
+    readonly ttl: number;
+    readonly paths: {
+        readonly register: string;
+        readonly authorize: string;
+        readonly token: string;
+    };
+    readonly dcrRegistry: NonNullable<OAuthClientRegistrationConfig['dcr']> | undefined;
+    readonly cimdEnabled: boolean;
+    resolveClient(clientId: string): Promise<RegisteredClient | null>;
+    redirectToClient(uri: string, params: Record<string, string>): Response;
+    issueAccessToken(userId: string, audience: string, clientId: string, scope?: string): Promise<string>;
+}
+/**
+ * True for a registrable redirect URI. `https` is always allowed; `http` ONLY on
+ * a loopback host (RFC 8252 §7.3 — native apps), so a self-registered client
+ * cannot receive the authorization code in the clear at an attacker-controlled
+ * address.
+ *
+ * `applicationType` is the OpenID Connect DCR hint (SEP-837): a `web` client is
+ * held to https-only (loopback is meaningless for it and a common
+ * misconfiguration), a `native` client keeps the loopback allowance. Omitted —
+ * the permissive default, so a client that never sends the field behaves
+ * exactly as before.
+ */
+export declare function redirectWith(uri: string, params: Record<string, string>): Response;
+/** RFC 8414 discovery: what this server supports, and where. */
+export declare function metadataRoute(ctx: OAuthEndpointContext): RawRoute;
+/** RFC 7591 Dynamic Client Registration, for public clients only. */
+export declare function registerRoute(ctx: OAuthEndpointContext): RawRoute;
+/** `/authorize`: PKCE S256, an exact redirect URI, one resource, then the user's consent. */
+export declare function authorizeRoute(ctx: OAuthEndpointContext): RawRoute;
+/** `/token`: the authorization-code and refresh-token grants, both single-use. */
+export declare function tokenRoute(ctx: OAuthEndpointContext): RawRoute;
+//# sourceMappingURL=endpoints.d.ts.map

package/dist/server/oauth/endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../../../src/server/oauth/endpoints.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAOzC,OAAO,KAAK,EAGV,6BAA6B,EAC7B,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,6BAA6B,CAAC,KAAK,CAAC,CAAC,GAAG,SAAS,CAAC;IACpF,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAClE,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC;IACxE,gBAAgB,CACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAAC;CACpB;AAiCD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,QAAQ,CAIlF;AAmBD,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,GAAG,EAAE,oBAAoB,GAAG,QAAQ,CA8BjE;AAED,qEAAqE;AACrE,wBAAgB,aAAa,CAAC,GAAG,EAAE,oBAAoB,GAAG,QAAQ,CA6EjE;AAED,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,GAAG,EAAE,oBAAoB,GAAG,QAAQ,CAiIlE;AAED,kFAAkF;AAClF,wBAAgB,UAAU,CAAC,GAAG,EAAE,oBAAoB,GAAG,QAAQ,CAkG9D"}

package/dist/server/oauth/metadata.d.ts

@@ -0,0 +1,28 @@
+import type { RawRoute } from '../types.js';
+/**
+ * OAuth 2.0 Protected Resource Metadata (RFC 9728). An MCP server acting as a
+ * resource server publishes this so a client, after a `401`, can discover which
+ * authorization server(s) issue tokens for it.
+ */
+export interface ProtectedResourceConfig {
+    /** Canonical resource identifier — the MCP server URL (RFC 8707 audience). */
+    resource: string;
+    /** Issuer URL(s) of the authorization server(s) that mint tokens for it. */
+    authorizationServers: string[];
+    /** Scopes the resource understands — advertised, not enforced here. */
+    scopesSupported?: string[];
+}
+/** Well-known prefix for the protected-resource metadata document (RFC 9728). */
+export declare const PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource";
+/** Absolute URL of the protected-resource metadata for a given resource. */
+export declare function protectedResourceMetadataUrl(resource: string): string;
+/** The `WWW-Authenticate` header value a protected `401` must carry (RFC 9728 §5.1). */
+export declare function wwwAuthenticateHeader(resource: string): string;
+/**
+ * A `RawRoute` serving the RFC 9728 protected-resource metadata at the path
+ * advertised by `protectedResourceMetadataUrl(config.resource)`. Mount it
+ * alongside the MCP handler; set the matching `protectedResource` on
+ * `createMcpHandler` so the `401` points here.
+ */
+export declare function oauthProtectedResourceRoute(config: ProtectedResourceConfig): RawRoute;
+//# sourceMappingURL=metadata.d.ts.map

package/dist/server/oauth/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../src/server/oauth/metadata.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,0CAA0C,CAAC;AAa/E,4EAA4E;AAC5E,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9D;AASD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,uBAAuB,GAAG,QAAQ,CAqBrF"}

package/dist/server/oauth/provider.d.ts

@@ -0,0 +1,117 @@
+import type { RawRoute } from '../types.js';
+import { type CimdCacheEvent, type CimdCachePolicy, type CimdClientMetadataFetcher } from './cimd.js';
+/**
+ * OpenID Connect DCR `application_type` (SEP-837). A `native` client (desktop /
+ * CLI) may register an `http` loopback redirect; a `web` client may not — the
+ * mismatch is the usual cause of a `redirect_uri` rejection for CLI clients.
+ */
+export type ApplicationType = 'native' | 'web';
+/** A client as registered via DCR. Public clients (PKCE) carry no secret. */
+export interface RegisteredClient {
+    clientId: string;
+    redirectUris: string[];
+    clientName?: string;
+    /** The `application_type` the client declared, when it declared one. */
+    applicationType?: ApplicationType;
+}
+/** Metadata posted to `/register` (RFC 7591) before a client id is assigned. */
+export interface ClientMetadata {
+    redirectUris: string[];
+    clientName?: string;
+    tokenEndpointAuthMethod?: string;
+    /** `native` (desktop / CLI, loopback allowed) or `web` (https only). */
+    applicationType?: ApplicationType;
+}
+export interface OAuthClientRegistrationConfig {
+    /** Exact application-owned clients take precedence over network discovery. */
+    preRegistered?: {
+        get(clientId: string): Promise<RegisteredClient | null>;
+    };
+    /** URL-based metadata. Enabled with secure defaults when omitted. */
+    cimd?: false | {
+        cache?: CimdCachePolicy;
+        fetcher?: CimdClientMetadataFetcher;
+        /** Cache/revalidation telemetry; metadata contents are never emitted. */
+        onCacheEvent?: (event: CimdCacheEvent) => void;
+    };
+    /** Dynamic registration. Disabled when omitted or `false`. */
+    dcr?: false | {
+        register(metadata: ClientMetadata): Promise<RegisteredClient>;
+        get(clientId: string): Promise<RegisteredClient | null>;
+    };
+}
+/** State persisted between `/authorize` and `/token`, keyed by the auth code. */
+export interface AuthCodeData {
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    /** Always `S256` — `/authorize` rejects any other method (OAuth 2.1, public client). */
+    codeChallengeMethod: 'S256';
+    resource: string;
+    scope?: string;
+    userId: string;
+    expiresAt: number;
+}
+/** State persisted for a refresh token. */
+export interface RefreshData {
+    clientId: string;
+    resource: string;
+    scope?: string;
+    userId: string;
+}
+/** The parsed `/authorize` request handed to the domain login/consent step. */
+export interface AuthRequest {
+    clientId: string;
+    redirectUri: string;
+    scope?: string;
+    resource: string;
+    state?: string;
+    clientName?: string;
+    clientOrigin?: string;
+    applicationType?: ApplicationType;
+    /** True only for an HTTP loopback redirect used by a native client. */
+    isLoopbackRedirect: boolean;
+}
+export interface OAuthProviderConfig {
+    /** Authorization-server issuer — its own origin, e.g. `https://api.example.com`. */
+    issuer: string;
+    /** HMAC secret used to sign access-token JWTs. */
+    signingSecret: string;
+    /** Canonical resource id (MCP URL) — the access-token `aud`. */
+    resource: string;
+    /** Access-token lifetime in seconds. Default `3600`. */
+    accessTokenTtlSec?: number;
+    /** Scopes advertised in server metadata. */
+    scopesSupported?: string[];
+    /** Path prefix for the OAuth endpoints. Default `/oauth`. */
+    basePath?: string;
+    /** Client discovery policy. Default: CIMD enabled, DCR disabled. */
+    clientRegistration?: OAuthClientRegistrationConfig;
+    /** Single-use authorization-code store. `take` must atomically read+delete. */
+    codes: {
+        save(code: string, data: AuthCodeData): Promise<void>;
+        take(code: string): Promise<AuthCodeData | null>;
+    };
+    /** Optional refresh-token store. Omit to disable the refresh grant. */
+    refreshTokens?: {
+        save(token: string, data: RefreshData): Promise<void>;
+        take(token: string): Promise<RefreshData | null>;
+    };
+    /**
+     * Authenticate the user and capture consent for an `/authorize` request.
+     * Return the authenticated user and exact approved scope subset, or a
+     * `Response` to drive the browser through the domain's own login first.
+     */
+    authorizeUser(req: Request, authRequest: AuthRequest): Promise<{
+        userId: string;
+        approvedScopes: readonly string[];
+    } | Response>;
+}
+/**
+ * Build the OAuth 2.1 authorization-server routes for an MCP resource. Mount the
+ * returned routes in the server's `rawRoutes`, alongside
+ * `oauthProtectedResourceRoute` and an MCP handler whose `protectedResource`
+ * names this issuer.
+ */
+export declare function mountOAuthProvider(config: OAuthProviderConfig): RawRoute[];
+//# sourceMappingURL=provider.d.ts.map

package/dist/server/oauth/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/server/oauth/provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAG/B,MAAM,QAAQ,CAAC;AAYhB;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,MAAM,WAAW,6BAA6B;IAC5C,8EAA8E;IAC9E,aAAa,CAAC,EAAE;QACd,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;KACzD,CAAC;IACF,qEAAqE;IACrE,IAAI,CAAC,EACD,KAAK,GACL;QACE,KAAK,CAAC,EAAE,eAAe,CAAC;QACxB,OAAO,CAAC,EAAE,yBAAyB,CAAC;QACpC,yEAAyE;QACzE,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;KAChD,CAAC;IACN,8DAA8D;IAC9D,GAAG,CAAC,EACA,KAAK,GACL;QACE,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC9D,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;KACzD,CAAC;CACP;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,wFAAwF;IACxF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,uEAAuE;IACvE,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,aAAa,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,4CAA4C;IAC5C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,6BAA6B,CAAC;IACnD,+EAA+E;IAC/E,KAAK,EAAE;QACL,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;KAClD,CAAC;IACF,uEAAuE;IACvE,aAAa,CAAC,EAAE;QACd,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;KAClD,CAAC;IAEF;;;;OAIG;IACH,aAAa,CACX,GAAG,EAAE,OAAO,EACZ,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,QAAQ,CAAC,CAAC;CAC9E;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,GAAG,QAAQ,EAAE,CA4E1E"}

package/dist/server/realtime.d.ts

@@ -1,6 +1,6 @@
 import type { DefaultEventsMap, Socket, Server as SocketIOServer } from 'socket.io';
 import type { SocketEventMap } from '../browser/socket-io.js';
-import type { StitchLogger } from '../logger.js';
+import type { StitchLogger } from '../internal/logger.js';
 import type { RealtimeContract, RealtimeEventRegistry, RealtimeRejectedEventHook } from '../realtime/contract.js';
 import { type ValidatedRealtimeSocket } from '../realtime/socket.js';
 export interface RealtimeServerConnection<TServerToClient extends RealtimeEventRegistry, TClientToServer extends RealtimeEventRegistry, TData = any> {

package/dist/server/realtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"realtime.d.ts","sourceRoot":"","sources":["../../src/server/realtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,WAAW,CAAC;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACrB,yBAAyB,EAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,wBAAwB,CACvC,eAAe,SAAS,qBAAqB,EAC7C,eAAe,SAAS,qBAAqB,EAC7C,KAAK,GAAG,GAAG;IAEX;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACrE,MAAM,EAAE,uBAAuB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAClE,EAAE,CACA,IAAI,EAAE,MAAM,GACX,IAAI,CAAC,uBAAuB,CAAC,qBAAqB,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,cAAc,CAC7B,eAAe,SAAS,qBAAqB,EAC7C,eAAe,SAAS,qBAAqB,EAC7C,KAAK,GAAG,GAAG;IAEX,YAAY,CACV,OAAO,EAAE,CACP,UAAU,EAAE,wBAAwB,CAAC,eAAe,EAAE,eAAe,EAAE,KAAK,CAAC,KAC1E,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GACxB,MAAM,IAAI,CAAC;IACd,IAAI,EAAE,uBAAuB,CAAC,qBAAqB,EAAE,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9E,EAAE,CACA,IAAI,EAAE,MAAM,GACX,IAAI,CAAC,uBAAuB,CAAC,qBAAqB,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,oBAAoB,CAAC,KAAK,GAAG,GAAG;IAC/C,EAAE,EAAE,cAAc,CAAC,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;CAC7E;AAED,wBAAgB,kBAAkB,CAChC,KAAK,CAAC,eAAe,SAAS,qBAAqB,EACnD,KAAK,CAAC,eAAe,SAAS,qBAAqB,EACnD,KAAK,GAAG,GAAG,EAEX,QAAQ,EAAE,gBAAgB,CAAC,eAAe,EAAE,eAAe,CAAC,EAC5D,MAAM,EAAE,oBAAoB,CAAC,KAAK,CAAC,EACnC,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,yBAAyB,CAAC;IAAC,MAAM,CAAC,EAAE,YAAY,CAAA;CAAO,GAC9E,cAAc,CAAC,eAAe,EAAE,eAAe,EAAE,KAAK,CAAC,CAwCzD"}
+{"version":3,"file":"realtime.d.ts","sourceRoot":"","sources":["../../src/server/realtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,WAAW,CAAC;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACrB,yBAAyB,EAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,wBAAwB,CACvC,eAAe,SAAS,qBAAqB,EAC7C,eAAe,SAAS,qBAAqB,EAC7C,KAAK,GAAG,GAAG;IAEX;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACrE,MAAM,EAAE,uBAAuB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAClE,EAAE,CACA,IAAI,EAAE,MAAM,GACX,IAAI,CAAC,uBAAuB,CAAC,qBAAqB,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,cAAc,CAC7B,eAAe,SAAS,qBAAqB,EAC7C,eAAe,SAAS,qBAAqB,EAC7C,KAAK,GAAG,GAAG;IAEX,YAAY,CACV,OAAO,EAAE,CACP,UAAU,EAAE,wBAAwB,CAAC,eAAe,EAAE,eAAe,EAAE,KAAK,CAAC,KAC1E,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GACxB,MAAM,IAAI,CAAC;IACd,IAAI,EAAE,uBAAuB,CAAC,qBAAqB,EAAE,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9E,EAAE,CACA,IAAI,EAAE,MAAM,GACX,IAAI,CAAC,uBAAuB,CAAC,qBAAqB,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,oBAAoB,CAAC,KAAK,GAAG,GAAG;IAC/C,EAAE,EAAE,cAAc,CAAC,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;CAC7E;AAED,wBAAgB,kBAAkB,CAChC,KAAK,CAAC,eAAe,SAAS,qBAAqB,EACnD,KAAK,CAAC,eAAe,SAAS,qBAAqB,EACnD,KAAK,GAAG,GAAG,EAEX,QAAQ,EAAE,gBAAgB,CAAC,eAAe,EAAE,eAAe,CAAC,EAC5D,MAAM,EAAE,oBAAoB,CAAC,KAAK,CAAC,EACnC,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,yBAAyB,CAAC;IAAC,MAAM,CAAC,EAAE,YAAY,CAAA;CAAO,GAC9E,cAAc,CAAC,eAAe,EAAE,eAAe,EAAE,KAAK,CAAC,CAwCzD"}

package/dist/server/request-completion.d.ts

@@ -0,0 +1,16 @@
+/**
+ * A request's timing window: the incoming breadcrumb when it opens, and the
+ * one completion line plus observability row when it closes.
+ */
+import type { CompleteRequest, HandlerState } from './handler-state.js';
+/** What the window needs to know about the request it times. */
+export interface RequestWindow {
+    req: Request;
+    url: URL;
+    traceId: string;
+    startedAt: bigint;
+    ipAddress: string | undefined;
+}
+/** Open the window — writes the incoming breadcrumb — and return its closer. */
+export declare function openRequestCompletion<TServer>(state: HandlerState<TServer>, window: RequestWindow): CompleteRequest;
+//# sourceMappingURL=request-completion.d.ts.map

package/dist/server/request-completion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-completion.d.ts","sourceRoot":"","sources":["../../src/server/request-completion.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAgBrE,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,OAAO,EAC3C,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,EAC5B,MAAM,EAAE,aAAa,GACpB,eAAe,CA+EjB"}

package/dist/server/response-metadata.d.ts

@@ -1,4 +1,4 @@
-import type { ResponseMetadata } from '../contract/index.js';
+import type { ResponseMetadata } from '../contract/define.js';
 /** Create one isolated outbound collector for a response-metadata handler. */
 export declare function createResponseMetadata(): ResponseMetadata;
 /**

package/dist/server/response-metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"response-metadata.d.ts","sourceRoot":"","sources":["../../src/server/response-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAiBpD,8EAA8E;AAC9E,wBAAgB,sBAAsB,IAAI,gBAAgB,CAEzD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,gBAAgB,GAAG,SAAS,EACtC,gBAAgB,EAAE,MAAM,GACvB,IAAI,CAqBN"}
+{"version":3,"file":"response-metadata.d.ts","sourceRoot":"","sources":["../../src/server/response-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAiB3D,8EAA8E;AAC9E,wBAAgB,sBAAsB,IAAI,gBAAgB,CAEzD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,gBAAgB,GAAG,SAAS,EACtC,gBAAgB,EAAE,MAAM,GACvB,IAAI,CAqBN"}

package/dist/server/route-table.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The handler's route table, compiled and checked once at construction: group
+ * mounting, route validation and the startup report of shadowed routes.
+ * Matching itself lives in `router.ts`.
+ */
+import { type RouteMap } from './router.js';
+import type { HandlerConfig } from './types.js';
+export declare function compileRouteTable<TServer>(config: HandlerConfig<TServer>, warn: (line: string) => void): RouteMap;
+//# sourceMappingURL=route-table.d.ts.map

package/dist/server/route-table.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-table.d.ts","sourceRoot":"","sources":["../../src/server/route-table.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAIL,KAAK,QAAQ,EAGd,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,wBAAgB,iBAAiB,CAAC,OAAO,EACvC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAC9B,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC3B,QAAQ,CA6BV"}

package/dist/server/stream.d.ts

@@ -6,17 +6,4 @@
  * message into the stream.
  */
 export declare function streamSSE(generator: AsyncGenerator<unknown>): Response;
-/** Options for `parseSSE`. */
-export interface ParseSSEOptions {
-    /** Maximum bytes retained for one SSE line. Default 1 MiB. */
-    maxLineBytes?: number;
-    /** Called for invalid UTF-8/JSON; without it parsing fails closed. */
-    onParseError?: (raw: string, error: Error) => void;
-}
-/**
- * Parse a Server-Sent Events `Response` body into an async generator of JSON
- * values — the client counterpart of `streamSSE`. Stops at the `[DONE]`
- * sentinel; the stream lock is released on every exit path.
- */
-export declare function parseSSE<T>(response: Response, options?: ParseSSEOptions): AsyncGenerator<T>;
 //# sourceMappingURL=stream.d.ts.map

package/dist/server/stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/server/stream.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,QAAQ,CA2CtE;AAED,8BAA8B;AAC9B,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CACpD;AAED;;;;GAIG;AACH,wBAAuB,QAAQ,CAAC,CAAC,EAC/B,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,eAAe,GACxB,cAAc,CAAC,CAAC,CAAC,CAuBnB"}
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/server/stream.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,QAAQ,CA2CtE"}