Standards
The specifications Kizuna follows, what each one governs, and what it deliberately leaves out.
Kizuna is spec-driven. It tries to follow these specifications as closely as it can.
HTTP
| Standard | What it governs |
|---|---|
| RFC 9110 HTTP Semantics | Methods, status codes, headers, content negotiation, and which methods are safe and idempotent |
| RFC 5789 PATCH Method | The PATCH method, which RFC 9110 does not define, and its unsafe and non-idempotent semantics |
| RFC 9457 Problem Details | The body of every error response, as type, title, status, detail, and instance |
| RFC 3986 URI Syntax | Percent-encoding of path parameters, and exact path matching, so /users/1 and /users/1/ are distinct resources |
| RFC 8594 Sunset Header | The Sunset response header and the sunset link relation, announcing when a route will be removed and where its retirement policy lives |
| RFC 9745 Deprecation Header | The Deprecation response header and the deprecation link relation, carrying the date a route became deprecated and a link to its documentation |
| RFC 9111 HTTP Caching | The Cache-Control and Vary response headers a response's cache policy sends |
| RFC 5861 Stale Content | The stale-while-revalidate and stale-if-error cache directives |
| RFC 8246 Immutable Responses | The immutable cache directive |
| RFC 9110 Conditional Requests | The ETag a response's etag sends, the If-None-Match it is compared against, and the 304 Not Modified a match answers with |
| Server-sent events WHATWG HTML | The text/event-stream framing of a route's stream response: event, data, id, retry, and comment lines |
Every GET route answers HEAD too. RFC 9110 §9.3.2 defines HEAD as GET without the content, so Kizuna serves it from the path's GET route: same status and headers, a Content-Length, no body. A declared HEAD route takes the path instead, and HEAD joins GET in every Allow header. The derived route stays out of the OpenAPI document and the clients; the generator's derivedHead option opts it in.
OpenAPI
| Standard | What it governs |
|---|---|
| OpenAPI 3.1.0 | The document @kizunajs/openapi generates from your routes |
See OpenAPI for the generator and the reference UI it serves.
Authentication
An API that verifies tokens rather than issuing them is a resource server, and Kizuna serves the documents and challenges one owes its clients.
| Standard | What it governs |
|---|---|
| OAuth 2.1 | The resource server model Kizuna implements |
| RFC 9728 Protected Resource Metadata | The discovery document served at /.well-known/oauth-protected-resource |
| RFC 8414 Authorization Server Metadata | An identity's issuer |
| RFC 8707 Resource Indicators | The canonical resource URI, and the audience a guard checks a token against |
| RFC 6750 Bearer Token Usage | The WWW-Authenticate challenge, including insufficient_scope |
See authentication for identities and guards, and access control for permissions and roles.
Model Context Protocol
| Standard | What it governs |
|---|---|
| Model Context Protocol | The MCP endpoint, its tools, and their input and output schemas |
| MCP authorization | Serving the endpoint as an OAuth 2.1 resource server |
See MCP for the endpoint, and tools for declaring your own.
No standard covers streamed tool calls. MCP deliberately has none, having replaced interactive tool flows with multi round-trip requests in its 2026-07-28 revision, so the tool_call, tool_result and tool_error events a streamed response carries are Kizuna's own vocabulary. Their framing follows the WHATWG server-sent events specification like any other stream.
Deliberate omissions
| Omission | Why |
|---|---|
TRACE is absent from Method | Disabled in production everywhere, and unsupported by the frameworks Kizuna mounts on |
| Support for Standard Schema | Routes take Zod alone, see Zod |