Serving

CallerVerifier

type declared in verify.ts

Turns a request's bearer into the verified caller, or throws the 401 LeafError.

(request: Request) => Promise<Omit<LeafCaller, 'requestId' | 'runId'>>

createCallerVerifier

function declared in verify.ts

(auth: FetchHandlerAuth) => CallerVerifier

createFetchHandler

function declared in serve.ts

Returns the request handler that serves the whole plugin. POST on a command's route decodes the input, runs its handler, and writes the JSON result or the NDJSON stream; a LeafError becomes its error envelope and any other exception a 500 handler_failed.

Given one definition without a version, GET returns the install archive at any path, and routes are served where the handler is mounted. Given a list of definitions, one per supported major, or one definition with a version, each major N is served under <mount>/v<N>/: GET <mount>/versions answers {latest, supported}, GET <mount>/v<N>/ returns major N's archive, whose routes carry the /v<N> prefix. Archives carry an ETag and answer 304 on a matching If-None-Match.

(plugins: PluginDefinition | readonly PluginDefinition[], options?: FetchHandlerOptions) => (request: Request) => Promise<Response>

FetchHandlerAuth

interface declared in verify.ts

Verifies outbound tokens minted by the directory at issuer for the provider at audience.

FetchHandlerOptions

interface declared in serve.ts

How the Fetch handler authenticates, advertises itself, and reports unhandled errors.

LeafAnswerEvent

interface declared in serve.ts

RequestIdentity

type declared in serve.ts

null is used only by legacy static-token plugins without a verified caller.

Readonly<{ sub: string; grantee: string; }> | null

RequestStore

interface declared in serve.ts

Persistence is owned by the provider, including an atomic answer + receipt outbox write.