@absol-labs/agent 0.3.2 → 0.5.0

package/dist/gateway/caller-auth-gateway.d.ts

@@ -0,0 +1,106 @@
+import { type Address, type Hex } from "viem";
+import { type SignedInvocationCapability } from "../capability/invocation-capability.js";
+/**
+ * Seller-side caller-auth gateway (metrik-agent#63, impl of #62 part 1/2).
+ *
+ * Authorizes an incoming service request ONLY when it carries a valid
+ * `InvocationCapability` (see `../capability/invocation-capability.ts`) whose
+ * signer is the buyer of an active, funded, non-expired `StreamEscrowV2`
+ * stream matching this gateway's configured `serviceRef` - and the capability
+ * itself is unexpired, unreplayed, and bound to the exact method+path being
+ * called. Revocation is automatic: once a stream is closed/expired/reclaimed,
+ * the on-chain read step below fails closed and access stops with no extra
+ * bookkeeping.
+ */
+/** Machine-readable, closed set of rejection reasons - every failure mode is distinct. */
+export type CallerAuthDenialReason = "missing-capability-header" | "malformed-capability-header" | "capability-expired" | "invalid-signature" | "method-mismatch" | "path-mismatch" | "service-ref-mismatch" | "nonce-replayed" | "stream-not-found" | "buyer-mismatch" | "stream-not-active" | "stream-expired" | "stream-not-funded";
+export interface CallerAuthDecision {
+    readonly authorized: boolean;
+    readonly reason?: CallerAuthDenialReason;
+    /** Set only when `authorized === false`. */
+    readonly httpStatus?: 402 | 403;
+    /** Set only when `authorized === true`. */
+    readonly stream?: GatewayStreamView;
+    /** The decoded (but not necessarily valid) capability, when one was present. */
+    readonly capability?: SignedInvocationCapability;
+}
+/** The minimal on-chain stream fields the gateway needs to authorize a call. */
+export interface GatewayStreamView {
+    readonly buyer: Address;
+    readonly serviceRef: Hex;
+    readonly deposit: bigint;
+    readonly claimedCumulative: bigint;
+    readonly expiresAt: number;
+    readonly status: "active" | "closed";
+}
+/** Pluggable on-chain stream reader, so the gateway is testable without a live RPC. */
+export interface StreamReader {
+    getStream(streamId: Hex): Promise<GatewayStreamView>;
+}
+export declare class UnknownStreamGatewayError extends Error {
+    constructor(message: string, options?: {
+        readonly cause?: unknown;
+    });
+}
+/** Default `StreamReader`: real, read-only `MetrikClient.getStreamV2` (no wallet, no writes). */
+export declare function createSdkStreamReader(options: {
+    readonly escrowAddress: Address;
+    readonly rpcUrl: string;
+}): StreamReader;
+/** Single-use nonce replay protection. */
+export interface NonceReplayCache {
+    /** Returns `true` (and records the nonce) IFF it has not been consumed before. Fails closed on a repeat. */
+    consume(nonce: Hex, expiresAtSeconds: number): boolean;
+}
+/**
+ * In-memory replay cache. Sufficient for a single-instance reference gateway;
+ * a multi-instance deployment should back this with a shared store (Redis,
+ * etc.) via the same `NonceReplayCache` interface.
+ */
+export declare class InMemoryNonceReplayCache implements NonceReplayCache {
+    private readonly seen;
+    consume(nonce: Hex, expiresAtSeconds: number): boolean;
+    private sweep;
+}
+export interface CallerAuthGatewayConfig {
+    /** The `StreamEscrowV2` this gateway's streams settle on. */
+    readonly escrowAddress: Address;
+    /** RPC used for the default `StreamReader` (ignored if `streamReader` is supplied). */
+    readonly rpcUrl?: string;
+    /** The service this gateway fronts. Every request's stream AND capability must match it. */
+    readonly serviceRef: Hex;
+    /** Chain id for EIP-712 domain separation. Default `84532` (Base Sepolia). */
+    readonly chainId?: number;
+    /** Capability header name. Default {@link CAPABILITY_HEADER_NAME}. */
+    readonly headerName?: string;
+    /** Override the on-chain reader (tests inject a fake; default is the real SDK reader). */
+    readonly streamReader?: StreamReader;
+    /** Override the replay cache (tests inject a fake; default is in-memory). */
+    readonly nonceCache?: NonceReplayCache;
+    /** Injectable clock (unix seconds), for tests. */
+    readonly now?: () => number;
+}
+export interface CallerAuthRequestInput {
+    /** Lower-cased-lookup-safe header map (e.g. Node's `IncomingMessage.headers`). */
+    readonly headers: Readonly<Record<string, string | undefined>>;
+    readonly method: string;
+    /** The request path (query/fragment are ignored - only the path is bound). */
+    readonly path: string;
+}
+/**
+ * Authorizes requests against stream-bound `InvocationCapability` headers.
+ * Framework-agnostic: `authorize()` takes a plain `{headers, method, path}`
+ * triple so it can front any HTTP server (Node `http`, Express, Fastify, ...).
+ * See `./http-server.ts` for a ready-to-run reverse-proxy reference server.
+ */
+export declare class CallerAuthGateway {
+    private readonly streamReader;
+    private readonly nonceCache;
+    private readonly headerName;
+    private readonly domain;
+    private readonly serviceRef;
+    private readonly now;
+    constructor(config: CallerAuthGatewayConfig);
+    authorize(request: CallerAuthRequestInput): Promise<CallerAuthDecision>;
+}
+//# sourceMappingURL=caller-auth-gateway.d.ts.map

package/dist/gateway/caller-auth-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-auth-gateway.d.ts","sourceRoot":"","sources":["../../src/gateway/caller-auth-gateway.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAEhE,OAAO,EAOL,KAAK,0BAA0B,EAChC,MAAM,wCAAwC,CAAC;AAEhD;;;;;;;;;;;GAWG;AAEH,0FAA0F;AAC1F,MAAM,MAAM,sBAAsB,GAC9B,2BAA2B,GAC3B,6BAA6B,GAC7B,oBAAoB,GACpB,mBAAmB,GACnB,iBAAiB,GACjB,eAAe,GACf,sBAAsB,GACtB,gBAAgB,GAChB,kBAAkB,GAClB,gBAAgB,GAChB,mBAAmB,GACnB,gBAAgB,GAChB,mBAAmB,CAAC;AAExB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC;IACzC,4CAA4C;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IAChC,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,gFAAgF;IAChF,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;CAClD;AAED,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACtC;AAED,uFAAuF;AACvF,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACtD;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAIpE;AAED,iGAAiG;AACjG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GAAG,YAAY,CAyBf;AAED,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,4GAA4G;IAC5G,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC;CACxD;AAED;;;;GAIG;AACH,qBAAa,wBAAyB,YAAW,gBAAgB;IAC/D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAElD,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO;IAUtD,OAAO,CAAC,KAAK;CAQd;AAED,MAAM,WAAW,uBAAuB;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,uFAAuF;IACvF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,4FAA4F;IAC5F,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,0FAA0F;IAC1F,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,kDAAkD;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC/D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAM;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,MAAM,EAAE,uBAAuB;IAkCrC,SAAS,CACb,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,kBAAkB,CAAC;CAgF/B"}

package/dist/gateway/caller-auth-gateway.js

@@ -0,0 +1,189 @@
+import { MetrikClient } from "@absol-labs/sdk";
+import { isAddress, isHex } from "viem";
+import { CAPABILITY_HEADER_NAME, decodeCapabilityHeader, hashInvocationPath, InvalidCapabilityHeaderError, recoverInvocationCapabilitySigner, } from "../capability/invocation-capability.js";
+export class UnknownStreamGatewayError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "UnknownStreamGatewayError";
+    }
+}
+/** Default `StreamReader`: real, read-only `MetrikClient.getStreamV2` (no wallet, no writes). */
+export function createSdkStreamReader(options) {
+    const metrik = MetrikClient.baseSepolia({
+        escrow: options.escrowAddress,
+        rpcUrl: options.rpcUrl,
+    });
+    return {
+        async getStream(streamId) {
+            try {
+                const stream = await metrik.getStreamV2(streamId);
+                return {
+                    buyer: stream.buyer,
+                    serviceRef: stream.serviceRef,
+                    deposit: stream.deposit,
+                    claimedCumulative: stream.claimedCumulative,
+                    expiresAt: stream.expiresAt,
+                    status: stream.status,
+                };
+            }
+            catch (cause) {
+                throw new UnknownStreamGatewayError(`failed to read stream ${streamId}: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+            }
+        },
+    };
+}
+/**
+ * In-memory replay cache. Sufficient for a single-instance reference gateway;
+ * a multi-instance deployment should back this with a shared store (Redis,
+ * etc.) via the same `NonceReplayCache` interface.
+ */
+export class InMemoryNonceReplayCache {
+    seen = new Map();
+    consume(nonce, expiresAtSeconds) {
+        this.sweep();
+        const key = nonce.toLowerCase();
+        if (this.seen.has(key)) {
+            return false;
+        }
+        this.seen.set(key, expiresAtSeconds);
+        return true;
+    }
+    sweep() {
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        for (const [key, expiresAtSeconds] of this.seen) {
+            if (expiresAtSeconds < nowSeconds) {
+                this.seen.delete(key);
+            }
+        }
+    }
+}
+/**
+ * Authorizes requests against stream-bound `InvocationCapability` headers.
+ * Framework-agnostic: `authorize()` takes a plain `{headers, method, path}`
+ * triple so it can front any HTTP server (Node `http`, Express, Fastify, ...).
+ * See `./http-server.ts` for a ready-to-run reverse-proxy reference server.
+ */
+export class CallerAuthGateway {
+    streamReader;
+    nonceCache;
+    headerName;
+    domain;
+    serviceRef;
+    now;
+    constructor(config) {
+        if (!isAddress(config.escrowAddress)) {
+            throw new Error("escrowAddress must be an EVM address");
+        }
+        if (!isHex(config.serviceRef, { strict: true }) ||
+            config.serviceRef.length !== 66) {
+            throw new Error("serviceRef must be a 32-byte hex value");
+        }
+        if (config.streamReader === undefined && config.rpcUrl === undefined) {
+            throw new Error("rpcUrl is required unless an explicit streamReader is supplied");
+        }
+        this.serviceRef = config.serviceRef;
+        this.headerName = (config.headerName ?? CAPABILITY_HEADER_NAME).toLowerCase();
+        this.streamReader =
+            config.streamReader ??
+                createSdkStreamReader({
+                    escrowAddress: config.escrowAddress,
+                    rpcUrl: config.rpcUrl,
+                });
+        this.nonceCache = config.nonceCache ?? new InMemoryNonceReplayCache();
+        this.domain = {
+            chainId: config.chainId ?? 84532,
+            verifyingContract: config.escrowAddress,
+        };
+        this.now = config.now ?? (() => Math.floor(Date.now() / 1000));
+    }
+    async authorize(request) {
+        const headerValue = lookupHeader(request.headers, this.headerName);
+        if (headerValue === undefined || headerValue.length === 0) {
+            return deny("missing-capability-header", 403);
+        }
+        let capability;
+        try {
+            capability = decodeCapabilityHeader(headerValue);
+        }
+        catch (error) {
+            if (error instanceof InvalidCapabilityHeaderError) {
+                return deny("malformed-capability-header", 403);
+            }
+            throw error;
+        }
+        const nowSeconds = this.now();
+        if (nowSeconds >= capability.expiry) {
+            return deny("capability-expired", 403, capability);
+        }
+        let signer;
+        try {
+            signer = await recoverInvocationCapabilitySigner(capability, this.domain, capability.signature);
+        }
+        catch {
+            return deny("invalid-signature", 403, capability);
+        }
+        if (signer.toLowerCase() !== capability.buyer.toLowerCase()) {
+            return deny("invalid-signature", 403, capability);
+        }
+        if (capability.method.toUpperCase() !== request.method.toUpperCase()) {
+            return deny("method-mismatch", 403, capability);
+        }
+        const expectedPathHash = hashInvocationPath(request.path);
+        if (expectedPathHash.toLowerCase() !== capability.pathHash.toLowerCase()) {
+            return deny("path-mismatch", 403, capability);
+        }
+        if (capability.serviceRef.toLowerCase() !== this.serviceRef.toLowerCase()) {
+            return deny("service-ref-mismatch", 403, capability);
+        }
+        // Consume the nonce BEFORE the on-chain read: the replay check is the
+        // cheapest gate and must fail closed even if the RPC is slow/unavailable.
+        if (!this.nonceCache.consume(capability.nonce, capability.expiry)) {
+            return deny("nonce-replayed", 403, capability);
+        }
+        let stream;
+        try {
+            stream = await this.streamReader.getStream(capability.streamId);
+        }
+        catch {
+            return deny("stream-not-found", 403, capability);
+        }
+        if (stream.buyer.toLowerCase() !== capability.buyer.toLowerCase()) {
+            return deny("buyer-mismatch", 403, capability);
+        }
+        if (stream.serviceRef.toLowerCase() !== this.serviceRef.toLowerCase()) {
+            return deny("service-ref-mismatch", 403, capability);
+        }
+        if (stream.status !== "active") {
+            return deny("stream-not-active", 403, capability);
+        }
+        if (nowSeconds >= stream.expiresAt) {
+            return deny("stream-expired", 403, capability);
+        }
+        if (stream.deposit <= stream.claimedCumulative) {
+            return deny("stream-not-funded", 402, capability);
+        }
+        return { authorized: true, stream, capability };
+    }
+}
+function deny(reason, httpStatus, capability) {
+    return {
+        authorized: false,
+        reason,
+        httpStatus,
+        ...(capability === undefined ? {} : { capability }),
+    };
+}
+function lookupHeader(headers, name) {
+    // Header maps may or may not already be lower-cased by the caller's framework;
+    // normalize defensively so a differently-cased key still resolves.
+    if (headers[name] !== undefined) {
+        return headers[name];
+    }
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() === name) {
+            return value;
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=caller-auth-gateway.js.map

package/dist/gateway/caller-auth-gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-auth-gateway.js","sourceRoot":"","sources":["../../src/gateway/caller-auth-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,KAAK,EAA0B,MAAM,MAAM,CAAC;AAEhE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,4BAA4B,EAC5B,iCAAiC,GAGlC,MAAM,wCAAwC,CAAC;AAyDhD,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe,EAAE,OAAsC;QACjE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,iGAAiG;AACjG,MAAM,UAAU,qBAAqB,CAAC,OAGrC;IACC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC;QACtC,MAAM,EAAE,OAAO,CAAC,aAAa;QAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,QAAQ;YACtB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAClD,OAAO;oBACL,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;oBAC3C,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,yBAAyB,CACjC,yBAAyB,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC9F,EAAE,KAAK,EAAE,CACV,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAQD;;;;GAIG;AACH,MAAM,OAAO,wBAAwB;IAClB,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,OAAO,CAAC,KAAU,EAAE,gBAAwB;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK;QACX,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,gBAAgB,GAAG,UAAU,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;CACF;AA6BD;;;;;GAKG;AACH,MAAM,OAAO,iBAAiB;IACX,YAAY,CAAe;IAC3B,UAAU,CAAmB;IAC7B,UAAU,CAAS;IACnB,MAAM,CAAkC;IACxC,UAAU,CAAM;IAChB,GAAG,CAAe;IAEnC,YAAY,MAA+B;QACzC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,IACE,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC3C,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,EAAE,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,CAChB,MAAM,CAAC,UAAU,IAAI,sBAAsB,CAC5C,CAAC,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC,YAAY;YACf,MAAM,CAAC,YAAY;gBACnB,qBAAqB,CAAC;oBACpB,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,MAAM,EAAE,MAAM,CAAC,MAAgB;iBAChC,CAAC,CAAC;QACL,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,wBAAwB,EAAE,CAAC;QACtE,IAAI,CAAC,MAAM,GAAG;YACZ,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK;YAChC,iBAAiB,EAAE,MAAM,CAAC,aAAa;SACxC,CAAC;QACF,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,SAAS,CACb,OAA+B;QAE/B,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,UAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,UAAU,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBAClD,OAAO,IAAI,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE9B,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,iCAAiC,CAC9C,UAAU,EACV,IAAI,CAAC,MAAM,EACX,UAAU,CAAC,SAAgB,CAC5B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,gBAAgB,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,UAAU,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACvD,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,KAAY,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,MAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,UAAU,CAAC,QAAe,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,UAAU,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAClD,CAAC;CACF;AAED,SAAS,IAAI,CACX,MAA8B,EAC9B,UAAqB,EACrB,UAAuC;IAEvC,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,MAAM;QACN,UAAU;QACV,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,OAAqD,EACrD,IAAY;IAEZ,+EAA+E;IAC/E,mEAAmE;IACnE,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/gateway/http-server.d.ts

@@ -0,0 +1,49 @@
+import { type Server } from "node:http";
+import { type Address, type Hex } from "viem";
+import { CallerAuthGateway } from "./caller-auth-gateway.js";
+export interface CallerAuthGatewayServerConfig {
+    readonly gateway: CallerAuthGateway;
+    /** Base URL of the real service this gateway fronts (e.g. `https://svc.example.com`). */
+    readonly upstreamUrl: string;
+    /** Extra request-timeout for the upstream fetch, in ms. Default 30000. */
+    readonly upstreamTimeoutMs?: number;
+}
+export interface CallerAuthGatewayServer {
+    readonly httpServer: Server;
+    listen(port: number, host?: string): Promise<{
+        port: number;
+        host: string;
+    }>;
+    close(): Promise<void>;
+}
+export declare function createCallerAuthGatewayServer(config: CallerAuthGatewayServerConfig): CallerAuthGatewayServer;
+export interface CallerAuthGatewayEnvConfig {
+    readonly host: string;
+    readonly port: number;
+    readonly escrowAddress: Address;
+    readonly rpcUrl: string;
+    readonly serviceRef: Hex;
+    readonly chainId: number;
+    readonly upstreamUrl: string;
+    readonly headerName?: string;
+}
+/**
+ * Parses the gateway's env contract:
+ * - `METRIK_GATEWAY_ESCROW_ADDRESS` (required) - the `StreamEscrowV2` this
+ *   gateway checks streams against.
+ * - `METRIK_GATEWAY_RPC_URL` (required) - RPC used for the read-only stream check.
+ * - `METRIK_GATEWAY_SERVICE_REF` (required) - bytes32 `serviceRef` this gateway fronts.
+ * - `METRIK_GATEWAY_UPSTREAM_URL` (required) - the real service to proxy to on pass.
+ * - `METRIK_GATEWAY_CHAIN_ID` (optional) - default `84532` (Base Sepolia).
+ * - `METRIK_GATEWAY_HEADER_NAME` (optional) - default `x-metrik-capability`.
+ * - `PORT` / `METRIK_GATEWAY_PORT` (optional) - default `8787`.
+ * - `METRIK_GATEWAY_HOST` (optional) - default `0.0.0.0`.
+ *
+ * Fail-closed: throws if any required var is missing or malformed.
+ */
+export declare function parseCallerAuthGatewayEnvConfig(env?: NodeJS.ProcessEnv): CallerAuthGatewayEnvConfig;
+/** Builds and starts the reference gateway server entirely from the environment. */
+export declare function startCallerAuthGatewayServerFromEnv(env?: NodeJS.ProcessEnv): Promise<CallerAuthGatewayServer & {
+    readonly boundPort: number;
+}>;
+//# sourceMappingURL=http-server.d.ts.map

package/dist/gateway/http-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../../src/gateway/http-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,MAAM,EAEZ,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAoB,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAEhE,OAAO,EACL,iBAAiB,EAElB,MAAM,0BAA0B,CAAC;AA8BlC,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,yFAAyF;IACzF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,6BAA6B,GACpC,uBAAuB,CAsCzB;AAmID,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,0BAA0B,CAuC5B;AAUD,oFAAoF;AACpF,wBAAsB,mCAAmC,CACvD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,uBAAuB,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBnE"}

package/dist/gateway/http-server.js

@@ -0,0 +1,227 @@
+import { createServer, } from "node:http";
+import { isAddress, isHex } from "viem";
+import { CallerAuthGateway, } from "./caller-auth-gateway.js";
+/**
+ * Reference standalone reverse-proxy gateway server (metrik-agent#63).
+ *
+ * A seller runs this in front of their real HTTP service. Every request must
+ * carry a valid `InvocationCapability` header (see
+ * `../capability/invocation-capability.ts`); on pass, the request is proxied
+ * to `upstreamUrl` verbatim and its response is returned unmodified. On fail,
+ * a `402`/`403` with a machine-readable JSON reason is returned and the
+ * upstream is never touched.
+ */
+/** Maximum buffered request body size (bytes) - bounds memory per request. */
+const MAX_BODY_BYTES = 16 * 1024 * 1024;
+/** Hop-by-hop headers that must never be forwarded verbatim to the upstream. */
+const HOP_BY_HOP_HEADERS = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "host",
+    "content-length",
+]);
+export function createCallerAuthGatewayServer(config) {
+    const upstreamBase = new URL(config.upstreamUrl);
+    const upstreamTimeoutMs = config.upstreamTimeoutMs ?? 30_000;
+    const httpServer = createServer((req, res) => {
+        handleRequest(req, res, config.gateway, upstreamBase, upstreamTimeoutMs).catch((error) => {
+            logError("unhandled request error", error);
+            if (!res.headersSent) {
+                writeJsonError(res, 500, "internal-error");
+            }
+            else {
+                res.end();
+            }
+        });
+    });
+    return {
+        httpServer,
+        listen: (port, host = "0.0.0.0") => new Promise((resolve, reject) => {
+            const onError = (error) => reject(error);
+            httpServer.once("error", onError);
+            httpServer.listen(port, host, () => {
+                httpServer.removeListener("error", onError);
+                const address = httpServer.address();
+                resolve({ port: address.port, host });
+            });
+        }),
+        close: () => new Promise((resolve, reject) => {
+            httpServer.close((error) => (error ? reject(error) : resolve()));
+        }),
+    };
+}
+async function handleRequest(req, res, gateway, upstreamBase, upstreamTimeoutMs) {
+    const requestUrl = new URL(req.url ?? "/", "http://localhost");
+    const method = req.method ?? "GET";
+    const headers = normalizeIncomingHeaders(req.headers);
+    const decision = await gateway.authorize({
+        headers,
+        method,
+        path: requestUrl.pathname,
+    });
+    if (!decision.authorized) {
+        writeJsonError(res, decision.httpStatus ?? 403, decision.reason ?? "unauthorized");
+        return;
+    }
+    let body;
+    if (method !== "GET" && method !== "HEAD") {
+        body = await readBody(req);
+    }
+    const upstreamHeaders = new Headers();
+    for (const [key, value] of Object.entries(headers)) {
+        if (value === undefined || HOP_BY_HOP_HEADERS.has(key)) {
+            continue;
+        }
+        upstreamHeaders.set(key, value);
+    }
+    const upstreamUrl = new URL(requestUrl.pathname + requestUrl.search, upstreamBase);
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), upstreamTimeoutMs);
+    try {
+        const upstreamResponse = await fetch(upstreamUrl, {
+            method,
+            headers: upstreamHeaders,
+            ...(body === undefined ? {} : { body }),
+            signal: controller.signal,
+        });
+        res.writeHead(upstreamResponse.status, headersToObject(upstreamResponse.headers));
+        const buffer = Buffer.from(await upstreamResponse.arrayBuffer());
+        res.end(buffer);
+    }
+    catch (error) {
+        logError("upstream request failed", error);
+        writeJsonError(res, 502, "upstream-unavailable");
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+function normalizeIncomingHeaders(headers) {
+    const normalized = {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (value === undefined)
+            continue;
+        normalized[key.toLowerCase()] = Array.isArray(value) ? value[0] : value;
+    }
+    return normalized;
+}
+function headersToObject(headers) {
+    const result = {};
+    headers.forEach((value, key) => {
+        if (HOP_BY_HOP_HEADERS.has(key.toLowerCase()))
+            return;
+        result[key] = value;
+    });
+    return result;
+}
+class BodyTooLargeError extends Error {
+}
+async function readBody(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buffer = chunk;
+        size += buffer.length;
+        if (size > MAX_BODY_BYTES) {
+            throw new BodyTooLargeError("request body too large");
+        }
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks);
+}
+function writeJsonError(res, status, reason) {
+    if (res.headersSent) {
+        res.end();
+        return;
+    }
+    res
+        .writeHead(status, { "Content-Type": "application/json" })
+        .end(JSON.stringify({ authorized: false, reason }));
+}
+function logError(context, error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`[metrik-caller-auth-gateway] ${context}: ${message}`);
+}
+/**
+ * Parses the gateway's env contract:
+ * - `METRIK_GATEWAY_ESCROW_ADDRESS` (required) - the `StreamEscrowV2` this
+ *   gateway checks streams against.
+ * - `METRIK_GATEWAY_RPC_URL` (required) - RPC used for the read-only stream check.
+ * - `METRIK_GATEWAY_SERVICE_REF` (required) - bytes32 `serviceRef` this gateway fronts.
+ * - `METRIK_GATEWAY_UPSTREAM_URL` (required) - the real service to proxy to on pass.
+ * - `METRIK_GATEWAY_CHAIN_ID` (optional) - default `84532` (Base Sepolia).
+ * - `METRIK_GATEWAY_HEADER_NAME` (optional) - default `x-metrik-capability`.
+ * - `PORT` / `METRIK_GATEWAY_PORT` (optional) - default `8787`.
+ * - `METRIK_GATEWAY_HOST` (optional) - default `0.0.0.0`.
+ *
+ * Fail-closed: throws if any required var is missing or malformed.
+ */
+export function parseCallerAuthGatewayEnvConfig(env = process.env) {
+    const escrowAddress = requireEnv(env, "METRIK_GATEWAY_ESCROW_ADDRESS");
+    if (!isAddress(escrowAddress)) {
+        throw new Error("METRIK_GATEWAY_ESCROW_ADDRESS must be an EVM address");
+    }
+    const rpcUrl = requireEnv(env, "METRIK_GATEWAY_RPC_URL");
+    const serviceRef = requireEnv(env, "METRIK_GATEWAY_SERVICE_REF");
+    if (!isHex(serviceRef, { strict: true }) || serviceRef.length !== 66) {
+        throw new Error("METRIK_GATEWAY_SERVICE_REF must be a 32-byte hex value");
+    }
+    const upstreamUrl = requireEnv(env, "METRIK_GATEWAY_UPSTREAM_URL");
+    // eslint-disable-next-line no-new -- validates the URL is well-formed.
+    new URL(upstreamUrl);
+    const chainIdRaw = env.METRIK_GATEWAY_CHAIN_ID ?? "84532";
+    const chainId = Number(chainIdRaw);
+    if (!Number.isInteger(chainId) || chainId <= 0) {
+        throw new Error(`invalid METRIK_GATEWAY_CHAIN_ID: ${chainIdRaw}`);
+    }
+    const portRaw = env.METRIK_GATEWAY_PORT ?? env.PORT ?? "8787";
+    const port = Number(portRaw);
+    if (!Number.isInteger(port) || port < 0 || port > 65535) {
+        throw new Error(`invalid port: ${portRaw}`);
+    }
+    const host = env.METRIK_GATEWAY_HOST ?? "0.0.0.0";
+    const headerName = env.METRIK_GATEWAY_HEADER_NAME;
+    return {
+        host,
+        port,
+        escrowAddress,
+        rpcUrl,
+        serviceRef,
+        chainId,
+        upstreamUrl,
+        ...(headerName === undefined ? {} : { headerName }),
+    };
+}
+function requireEnv(env, name) {
+    const value = env[name];
+    if (value === undefined || value.trim().length === 0) {
+        throw new Error(`${name} is required (fail-closed)`);
+    }
+    return value;
+}
+/** Builds and starts the reference gateway server entirely from the environment. */
+export async function startCallerAuthGatewayServerFromEnv(env = process.env) {
+    const config = parseCallerAuthGatewayEnvConfig(env);
+    const gateway = new CallerAuthGateway({
+        escrowAddress: config.escrowAddress,
+        rpcUrl: config.rpcUrl,
+        serviceRef: config.serviceRef,
+        chainId: config.chainId,
+        ...(config.headerName === undefined
+            ? {}
+            : { headerName: config.headerName }),
+    });
+    const server = createCallerAuthGatewayServer({
+        gateway,
+        upstreamUrl: config.upstreamUrl,
+    });
+    const { port } = await server.listen(config.port, config.host);
+    return Object.assign(server, { boundPort: port });
+}
+//# sourceMappingURL=http-server.js.map

package/dist/gateway/http-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-server.js","sourceRoot":"","sources":["../../src/gateway/http-server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAIb,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,SAAS,EAAE,KAAK,EAA0B,MAAM,MAAM,CAAC;AAEhE,OAAO,EACL,iBAAiB,GAElB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;GASG;AAEH,8EAA8E;AAC9E,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;IACT,MAAM;IACN,gBAAgB;CACjB,CAAC,CAAC;AAgBH,MAAM,UAAU,6BAA6B,CAC3C,MAAqC;IAErC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC;IAE7D,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,aAAa,CACX,GAAG,EACH,GAAG,EACH,MAAM,CAAC,OAAO,EACd,YAAY,EACZ,iBAAiB,CAClB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAChB,QAAQ,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,UAAU;QACV,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS,EAAE,EAAE,CACjC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9B,MAAM,OAAO,GAAG,CAAC,KAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChD,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;gBACjC,UAAU,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAiB,CAAC;gBACpD,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACxC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACJ,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAoB,EACpB,GAAmB,EACnB,OAA0B,EAC1B,YAAiB,EACjB,iBAAyB;IAEzB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACnC,MAAM,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEtD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC;QACvC,OAAO;QACP,MAAM;QACN,IAAI,EAAE,UAAU,CAAC,QAAQ;KAC1B,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,cAAc,CACZ,GAAG,EACH,QAAQ,CAAC,UAAU,IAAI,GAAG,EAC1B,QAAQ,CAAC,MAAM,IAAI,cAAc,CAClC,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,IAAwB,CAAC;IAC7B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,SAAS;QACX,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,UAAU,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,EACvC,YAAY,CACb,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;YAChD,MAAM;YACN,OAAO,EAAE,eAAe;YACxB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACvC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,GAAG,CAAC,SAAS,CACX,gBAAgB,CAAC,MAAM,EACvB,eAAe,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAC1C,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC;QACjE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAC3C,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;IACnD,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAmC;IAEnC,MAAM,UAAU,GAAuC,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1E,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7B,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO;QACtD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,iBAAkB,SAAQ,KAAK;CAAG;AAExC,KAAK,UAAU,QAAQ,CAAC,GAAoB;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAe,CAAC;QAC/B,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC;QACtB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;YAC1B,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc,CACrB,GAAmB,EACnB,MAAc,EACd,MAI0B;IAE1B,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IACD,GAAG;SACA,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;SACzD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe,EAAE,KAAc;IAC/C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,CAAC,KAAK,CAAC,gCAAgC,OAAO,KAAK,OAAO,EAAE,CAAC,CAAC;AACvE,CAAC;AAeD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,+BAA+B,CAC7C,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;IACvE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IACnE,uEAAuE;IACvE,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAErB,MAAM,UAAU,GAAG,GAAG,CAAC,uBAAuB,IAAI,OAAO,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,mBAAmB,IAAI,SAAS,CAAC;IAClD,MAAM,UAAU,GAAG,GAAG,CAAC,0BAA0B,CAAC;IAElD,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,aAAa;QACb,MAAM;QACN,UAAU;QACV,OAAO;QACP,WAAW;QACX,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB,EAAE,IAAY;IACtD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4BAA4B,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;QACpC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;KACvC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,6BAA6B,CAAC;QAC3C,OAAO;QACP,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC"}

package/dist/gateway/server-entry.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=server-entry.d.ts.map

package/dist/gateway/server-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-entry.d.ts","sourceRoot":"","sources":["../../src/gateway/server-entry.ts"],"names":[],"mappings":""}

package/dist/gateway/server-entry.js

@@ -0,0 +1,30 @@
+import { startCallerAuthGatewayServerFromEnv } from "./http-server.js";
+/**
+ * Runnable entrypoint for the reference caller-auth gateway (metrik-agent#63).
+ * Reads all configuration from the environment (see
+ * {@link parseCallerAuthGatewayEnvConfig}) and refuses to start if required
+ * config is missing (fail-closed).
+ *
+ * Start with: `pnpm gateway` (or `node dist/gateway/server-entry.js`).
+ */
+async function main() {
+    const server = await startCallerAuthGatewayServerFromEnv();
+    const host = process.env.METRIK_GATEWAY_HOST ?? "0.0.0.0";
+    console.error(`[metrik-caller-auth-gateway] listening on http://${host}:${server.boundPort}`);
+    const shutdown = (signal) => {
+        console.error(`[metrik-caller-auth-gateway] ${signal} received — shutting down`);
+        server
+            .close()
+            .then(() => process.exit(0))
+            .catch(() => process.exit(1));
+    };
+    process.on("SIGINT", () => shutdown("SIGINT"));
+    process.on("SIGTERM", () => shutdown("SIGTERM"));
+}
+main().catch((error) => {
+    console.error(error instanceof Error
+        ? error.message
+        : "failed to start caller-auth gateway server");
+    process.exit(1);
+});
+//# sourceMappingURL=server-entry.js.map

package/dist/gateway/server-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-entry.js","sourceRoot":"","sources":["../../src/gateway/server-entry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kBAAkB,CAAC;AAEvE;;;;;;;GAOG;AACH,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,MAAM,mCAAmC,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,SAAS,CAAC;IAC1D,OAAO,CAAC,KAAK,CACX,oDAAoD,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAC/E,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;QAClC,OAAO,CAAC,KAAK,CACX,gCAAgC,MAAM,2BAA2B,CAClE,CAAC;QACF,MAAM;aACH,KAAK,EAAE;aACP,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aAC3B,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CACX,KAAK,YAAY,KAAK;QACpB,CAAC,CAAC,KAAK,CAAC,OAAO;QACf,CAAC,CAAC,4CAA4C,CACjD,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}