@agenthippo-ai/agenthippo 0.1.0 → 0.2.3-dataplane

package/out/cli/data-plane/gateway.js

@@ -0,0 +1,195 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TURN_NONCE_ENV = exports.DATA_MCP_URL_ENV = void 0;
+exports.startDataGateway = startDataGateway;
+/**
+ * Data-plane MCP gateway — a streamable-HTTP MCP server inside the serve (broker) process,
+ * bound to 127.0.0.1 (secure-obo-design §3.1/§3.2).
+ *
+ * Every request must present `Authorization: Bearer <turn nonce>`; the nonce resolves in
+ * the TurnRegistry to a verified {userId, sessionKey}. The credential is then selected
+ * SERVER-SIDE from the broker at call time (§5 step 7) — no parameter in the MCP request
+ * can name a user or a credential. Unknown/expired nonce ⇒ 401, fail closed.
+ *
+ * What nonce theft buys is documented in §3.3: loopback-only, turn-scoped, tool-surface-
+ * only access as the user the model was already acting for.
+ */
+const http = __importStar(require("http"));
+const index_js_1 = require("@modelcontextprotocol/sdk/server/index.js");
+const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
+const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
+const serve_hardening_1 = require("../serve-hardening");
+const registry_1 = require("./registry");
+/** Loopback URL of the data-plane gateway; set per turn into the engine child env. */
+exports.DATA_MCP_URL_ENV = 'AGENTHIPPO_DATA_MCP_URL';
+/** The turn capability. Per-spawn env only; never written to any shared file. */
+exports.TURN_NONCE_ENV = 'AGENTHIPPO_TURN_NONCE';
+function bearerToken(header) {
+    const m = header?.match(/^Bearer\s+(\S+)$/i);
+    return m?.[1];
+}
+/** sha256 prefix for audit lines — never log a raw nonce (secure-obo-design §11). */
+function noncePrefix(nonce) {
+    return nonce ? (0, registry_1.hashNonce)(nonce).slice(0, 12) : 'none';
+}
+async function startDataGateway(opts) {
+    const server = http.createServer(async (req, res) => {
+        try {
+            const urlPath = req.url?.split('?')[0] ?? '';
+            if (urlPath !== '/mcp') {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'not found' }));
+                return;
+            }
+            if (req.method !== 'POST') {
+                // Stateless transport: one POST per JSON-RPC exchange; no GET stream, no sessions.
+                res.writeHead(405, { 'Content-Type': 'application/json', 'Allow': 'POST' });
+                res.end(JSON.stringify({ error: 'method not allowed' }));
+                return;
+            }
+            const nonce = bearerToken(req.headers.authorization);
+            const turn = nonce ? opts.registry.resolve(nonce) : undefined;
+            if (!turn) {
+                // Expired / unknown / missing — a stale engine subprocess fails CLOSED here
+                // instead of ever using a stale user's credential (§3.2).
+                opts.audit?.('unauthorized', 'nonce_reject', {
+                    reason: nonce ? 'unknown_or_expired' : 'missing',
+                    nonce_sha256_prefix: noncePrefix(nonce),
+                });
+                res.writeHead(401, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({
+                    jsonrpc: '2.0',
+                    error: { code: -32001, message: 'Unauthorized: missing, unknown, or expired turn nonce' },
+                    id: null,
+                }));
+                return;
+            }
+            opts.logger?.info(`[DataPlane] authorized request user=${turn.userId} session=${turn.sessionKey}`);
+            let body;
+            try {
+                body = JSON.parse(await (0, serve_hardening_1.readBodyWithCap)(req));
+            }
+            catch {
+                res.writeHead(400, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ jsonrpc: '2.0', error: { code: -32700, message: 'Parse error' }, id: null }));
+                return;
+            }
+            // Fresh stateless server+transport per request (SDK stateless pattern) so a request
+            // carries exactly its own turn's authority and nothing outlives the response.
+            const mcp = buildTurnScopedMcpServer(opts, turn);
+            const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
+            res.on('close', () => {
+                void transport.close();
+                void mcp.close();
+            });
+            await mcp.connect(transport);
+            await transport.handleRequest(req, res, body);
+        }
+        catch (err) {
+            opts.logger?.warn(`[DataPlane] gateway error: ${err instanceof Error ? err.message : String(err)}`);
+            if (!res.headersSent) {
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+            }
+            res.end(JSON.stringify({ jsonrpc: '2.0', error: { code: -32603, message: 'Internal error' }, id: null }));
+        }
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        // Loopback ONLY — the gateway must never be reachable off-box.
+        server.listen(0, '127.0.0.1', () => resolve());
+    });
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+        throw new Error('Data gateway failed to bind a loopback port');
+    }
+    const url = `http://127.0.0.1:${address.port}/mcp`;
+    opts.logger?.info(`[DataPlane] gateway listening at ${url}`);
+    return {
+        url,
+        close: () => new Promise((resolve) => server.close(() => resolve())),
+    };
+}
+function buildTurnScopedMcpServer(opts, turn) {
+    const server = new index_js_1.Server({ name: 'agenthippo-data-gateway', version: '1.0.0' }, { capabilities: { tools: {} } });
+    server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => ({
+        tools: await opts.connector.listTools(),
+    }));
+    server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
+        const toolName = request.params.name;
+        // Server-side credential selection at call time (§5 step 7): the registry entry's
+        // verified userId picks the credential — never anything in the MCP request.
+        let secretRef;
+        try {
+            const credential = await opts.broker.acquire(turn.userId, turn.inboundToken);
+            secretRef = credential.secretRef;
+            opts.audit?.(turn.sessionKey, 'tool_authorize', { tool: toolName, userId: turn.userId, provider: opts.broker.provider.name });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            opts.audit?.(turn.sessionKey, 'tool_deny', { tool: toolName, userId: turn.userId, reason: 'acquire_failed', error: message });
+            return {
+                content: [{ type: 'text', text: JSON.stringify({ ok: false, error: `credential acquire failed (fail-closed): ${message}` }) }],
+                isError: true,
+            };
+        }
+        try {
+            return await opts.connector.callTool(toolName, request.params.arguments ?? {}, { userId: turn.userId, credential: secretRef });
+        }
+        catch (err) {
+            // Mid-turn credential expiry: drop the cache, re-acquire once, retry once (§5).
+            const message = err instanceof Error ? err.message : String(err);
+            if (/401|unauthoriz|expired/i.test(message)) {
+                opts.broker.invalidate(turn.userId);
+                try {
+                    const retryCred = await opts.broker.acquire(turn.userId, turn.inboundToken);
+                    return await opts.connector.callTool(toolName, request.params.arguments ?? {}, { userId: turn.userId, credential: retryCred.secretRef });
+                }
+                catch {
+                    // fall through to the original error below
+                }
+            }
+            opts.audit?.(turn.sessionKey, 'tool_deny', { tool: toolName, userId: turn.userId, reason: 'call_failed', error: message });
+            return {
+                content: [{ type: 'text', text: JSON.stringify({ ok: false, error: message }) }],
+                isError: true,
+            };
+        }
+    });
+    return server;
+}

package/out/cli/data-plane/index.js

@@ -0,0 +1,137 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DataPlane = exports.EGRESS_URL_ENV = exports.startEgressBroker = exports.TURN_NONCE_ENV = exports.DATA_MCP_URL_ENV = exports.startDataGateway = exports.TURN_META_KEY = exports.ConnectorHost = exports.identityProvider = exports.passthroughProvider = exports.resolveProvider = exports.CredentialBroker = exports.DEFAULT_TURN_DEADLINE_MS = exports.hashNonce = exports.TurnRegistry = void 0;
+exports.resolveDataPlaneConfig = resolveDataPlaneConfig;
+/**
+ * DataPlane — orchestration of the credential broker + data-plane gateway
+ * (secure-obo-design §3): TurnRegistry + CredentialBroker + broker-owned connector
+ * subprocess + loopback streamable-HTTP MCP gateway.
+ *
+ * serve starts one DataPlane at boot when the pack declares `spec.dataPlane`, then
+ * registers each verified turn to get `{ AGENTHIPPO_TURN_NONCE }` for the engine's
+ * per-spawn env. The pack's MCP config points at `${env:AGENTHIPPO_DATA_MCP_URL}` with
+ * `bearerTokenEnv: AGENTHIPPO_TURN_NONCE` — turn-invariant bytes, per-turn authority.
+ */
+const path = __importStar(require("path"));
+const registry_1 = require("./registry");
+const broker_1 = require("./broker");
+const connector_host_1 = require("./connector-host");
+const gateway_1 = require("./gateway");
+var registry_2 = require("./registry");
+Object.defineProperty(exports, "TurnRegistry", { enumerable: true, get: function () { return registry_2.TurnRegistry; } });
+Object.defineProperty(exports, "hashNonce", { enumerable: true, get: function () { return registry_2.hashNonce; } });
+Object.defineProperty(exports, "DEFAULT_TURN_DEADLINE_MS", { enumerable: true, get: function () { return registry_2.DEFAULT_TURN_DEADLINE_MS; } });
+var broker_2 = require("./broker");
+Object.defineProperty(exports, "CredentialBroker", { enumerable: true, get: function () { return broker_2.CredentialBroker; } });
+Object.defineProperty(exports, "resolveProvider", { enumerable: true, get: function () { return broker_2.resolveProvider; } });
+Object.defineProperty(exports, "passthroughProvider", { enumerable: true, get: function () { return broker_2.passthroughProvider; } });
+Object.defineProperty(exports, "identityProvider", { enumerable: true, get: function () { return broker_2.identityProvider; } });
+var connector_host_2 = require("./connector-host");
+Object.defineProperty(exports, "ConnectorHost", { enumerable: true, get: function () { return connector_host_2.ConnectorHost; } });
+Object.defineProperty(exports, "TURN_META_KEY", { enumerable: true, get: function () { return connector_host_2.TURN_META_KEY; } });
+var gateway_2 = require("./gateway");
+Object.defineProperty(exports, "startDataGateway", { enumerable: true, get: function () { return gateway_2.startDataGateway; } });
+Object.defineProperty(exports, "DATA_MCP_URL_ENV", { enumerable: true, get: function () { return gateway_2.DATA_MCP_URL_ENV; } });
+Object.defineProperty(exports, "TURN_NONCE_ENV", { enumerable: true, get: function () { return gateway_2.TURN_NONCE_ENV; } });
+var egress_1 = require("./egress");
+Object.defineProperty(exports, "startEgressBroker", { enumerable: true, get: function () { return egress_1.startEgressBroker; } });
+Object.defineProperty(exports, "EGRESS_URL_ENV", { enumerable: true, get: function () { return egress_1.EGRESS_URL_ENV; } });
+/**
+ * Resolve the pack's data-plane declaration. The connector path resolves against the PACK
+ * SOURCE directory (operator-authored, broker trust domain) — not the agent-readable
+ * workspace copy.
+ */
+function resolveDataPlaneConfig(spec, packPath) {
+    const dp = spec?.dataPlane;
+    const connector = dp?.connector?.trim();
+    if (!connector) {
+        return undefined;
+    }
+    return {
+        connectorPath: path.isAbsolute(connector) ? connector : path.join(packPath, connector),
+        provider: dp?.provider?.trim() || undefined,
+    };
+}
+class DataPlane {
+    url;
+    registry;
+    broker;
+    connector;
+    gateway;
+    constructor(url, registry, broker, connector, gateway) {
+        this.url = url;
+        this.registry = registry;
+        this.broker = broker;
+        this.connector = connector;
+        this.gateway = gateway;
+    }
+    static async start(cfg, opts) {
+        // Reuse serve's shared registry when given, so one nonce grants BOTH data and egress
+        // capabilities (secure-obo-design §7.6 step 2). Standalone (probe/tests) get their own.
+        const registry = opts?.registry ?? new registry_1.TurnRegistry();
+        const broker = new broker_1.CredentialBroker((0, broker_1.resolveProvider)(cfg.provider));
+        const connector = await connector_host_1.ConnectorHost.spawn({ connectorPath: cfg.connectorPath, logger: opts?.logger });
+        try {
+            const gateway = await (0, gateway_1.startDataGateway)({ registry, broker, connector, logger: opts?.logger, audit: opts?.audit });
+            return new DataPlane(gateway.url, registry, broker, connector, gateway);
+        }
+        catch (err) {
+            await connector.close();
+            throw err;
+        }
+    }
+    /**
+     * Register a verified turn. Returns the per-spawn env for the engine and the release()
+     * to call in the turn's `finally`. The gateway URL itself is boot-stable and rides
+     * process.env (see serve), keeping codex's config.toml turn-invariant.
+     */
+    registerTurn(reg) {
+        const { nonce, release } = this.registry.register(reg);
+        return {
+            nonce,
+            env: { [gateway_1.TURN_NONCE_ENV]: nonce, [gateway_1.DATA_MCP_URL_ENV]: this.url },
+            release,
+        };
+    }
+    async close() {
+        await this.gateway.close();
+        await this.connector.close();
+    }
+}
+exports.DataPlane = DataPlane;

package/out/cli/data-plane/registry.js

@@ -0,0 +1,80 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TurnRegistry = exports.DEFAULT_TURN_DEADLINE_MS = void 0;
+exports.hashNonce = hashNonce;
+/**
+ * TurnRegistry — the per-turn capability table of the data-plane gateway
+ * (secure-obo-design §3.1). Replaces the on-disk token file entirely.
+ *
+ * Per turn: mint a random 128-bit nonce, store the turn's verified identity under
+ * `sha256(nonce)` (the raw nonce is never stored or used as a lookup key, so lookups leak
+ * no timing signal about live nonces), hand the nonce to the engine via per-spawn env only,
+ * and delete the entry in the same `finally` that ends the turn. `deadline` is the backstop
+ * for a stranded entry — a leaked nonce dies on its own.
+ *
+ * The registry holds NO data credential: the gateway selects the credential server-side at
+ * call time from the broker's per-user cache (§5 step 7) — nothing a client sends can name
+ * a user or a credential.
+ */
+const crypto_1 = require("crypto");
+/** Backstop lifetime for a turn's nonce. Turns are seconds-to-minutes; 30 min is generous. */
+exports.DEFAULT_TURN_DEADLINE_MS = 30 * 60_000;
+function hashNonce(nonce) {
+    return (0, crypto_1.createHash)('sha256').update(nonce).digest('hex');
+}
+class TurnRegistry {
+    entries = new Map();
+    /**
+     * Mint a nonce and register the turn. Call `release()` in the turn's `finally`.
+     */
+    register(reg) {
+        this.prune();
+        // Never derived from anything — pure randomness (secure-obo-design §3.1).
+        const nonce = (0, crypto_1.randomBytes)(16).toString('hex');
+        const key = hashNonce(nonce);
+        this.entries.set(key, {
+            userId: reg.userId,
+            sessionKey: reg.sessionKey,
+            inboundToken: reg.inboundToken,
+            egressStoreKey: reg.egressStoreKey,
+            deadline: reg.deadline ?? Date.now() + exports.DEFAULT_TURN_DEADLINE_MS,
+        });
+        let released = false;
+        return {
+            nonce,
+            release: () => {
+                if (!released) {
+                    released = true;
+                    this.entries.delete(key);
+                }
+            },
+        };
+    }
+    /** Resolve a presented nonce to its turn, enforcing the deadline. Fail-closed: unknown/expired → undefined. */
+    resolve(nonce, now = Date.now()) {
+        const entry = this.entries.get(hashNonce(nonce));
+        if (!entry) {
+            return undefined;
+        }
+        if (now > entry.deadline) {
+            this.entries.delete(hashNonce(nonce));
+            return undefined;
+        }
+        return entry;
+    }
+    /** Drop expired entries (called on every register; cheap at realistic turn counts). */
+    prune(now = Date.now()) {
+        for (const [key, entry] of this.entries) {
+            if (now > entry.deadline) {
+                this.entries.delete(key);
+            }
+        }
+    }
+    get size() {
+        return this.entries.size;
+    }
+}
+exports.TurnRegistry = TurnRegistry;

package/out/cli/deploy/blueprints/registry.js

@@ -0,0 +1,84 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BLUEPRINTS = exports.BLUEPRINT_IDS = void 0;
+exports.isBlueprintId = isBlueprintId;
+exports.resolveBlueprint = resolveBlueprint;
+exports.BLUEPRINT_IDS = [
+    'sandbox',
+    'prospect-demo',
+    'team-pilot',
+    'regulated-air-gapped',
+    'enterprise-fleet',
+];
+function isBlueprintId(value) {
+    return exports.BLUEPRINT_IDS.includes(value);
+}
+exports.BLUEPRINTS = {
+    sandbox: {
+        id: 'sandbox',
+        description: 'Internal test, no external users — no edge, no SSO, no host port beyond localhost.',
+        targets: ['vm'],
+    },
+    'prospect-demo': {
+        id: 'prospect-demo',
+        description: 'Throwaway public demo for a prospect — Cloudflare Tunnel + a throwaway Google OAuth client.',
+        targets: ['vm', 'compose'],
+    },
+    'team-pilot': {
+        id: 'team-pilot',
+        description: 'Single-agent pilot. Rides the customer platform\'s own identity when one exists (GCP IAP, ' +
+            'Databricks workspace SSO, Snowflake network, Cloudflare Access); falls back to a self-issued edge ' +
+            '(own Caddy + oauth2-proxy + Google client) on vm/compose/aws-ecs/azure-container-apps, which have ' +
+            'no platform-native option yet.',
+        targets: ['cloudrun', 'databricks-app', 'spcs', 'cloudflare', 'vm', 'compose', 'aws-ecs', 'azure-container-apps'],
+    },
+    'regulated-air-gapped': {
+        id: 'regulated-air-gapped',
+        description: 'VPN/localhost only, no tunnel, no external telemetry — the highest-scrutiny buyer profile. ' +
+            'Currently generator-identical to sandbox (PLAN/deploy.md §2 gap); the distinction is buyer framing, ' +
+            'not yet enforced posture.',
+        targets: ['vm'],
+    },
+    'enterprise-fleet': {
+        id: 'enterprise-fleet',
+        description: 'Federated identity against a central IdP (enterprise-deploy/idp/) for a growing fleet of agents. ' +
+            'Same-host colocation (no edge of its own) is available for vm/compose via the raw ' +
+            '`--ingress edge-fed --colocate` flag — not yet encoded as a blueprint variant.',
+        targets: ['cloudrun', 'vm', 'compose', 'aws-ecs', 'azure-container-apps'],
+    },
+};
+/**
+ * Resolve a blueprint (+ optional platform override) to the `--target`/`--ingress` pair
+ * `deploy-init.ts` already knows how to render. Throws on a platform not in the blueprint's
+ * supported set so a typo doesn't silently produce the wrong deployment shape.
+ */
+function resolveBlueprint(id, platform) {
+    const def = exports.BLUEPRINTS[id];
+    const target = platform ?? def.targets[0];
+    if (!def.targets.includes(target)) {
+        throw new Error(`Blueprint "${id}" does not support --platform ${target}. ` +
+            `Supported: ${def.targets.join(', ')}.`);
+    }
+    switch (id) {
+        case 'sandbox':
+        case 'regulated-air-gapped':
+            return { target };
+        case 'prospect-demo':
+            return { target, ingress: 'edge' };
+        case 'enterprise-fleet':
+            return { target, ingress: 'edge-fed' };
+        case 'team-pilot':
+            // Platform-native identity where the platform actually has one; vm/compose have
+            // none, so they fall back to the self-issued edge (own Caddy + oauth2-proxy).
+            if (target === 'cloudrun') {
+                return { target, ingress: 'iap' };
+            }
+            if (target === 'databricks-app' || target === 'spcs' || target === 'cloudflare') {
+                return { target };
+            }
+            return { target, ingress: 'edge' };
+    }
+}

package/out/cli/deploy/layers/identity.js

@@ -0,0 +1,91 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EDGE_AGENT_PORT = void 0;
+exports.renderIdentityLayer = renderIdentityLayer;
+exports.renderSidecarEdgeCaddyfile = renderSidecarEdgeCaddyfile;
+exports.renderSidecarFedCaddyfile = renderSidecarFedCaddyfile;
+function renderIdentityLayer(opts) {
+    const { mode, authBrokerAddr, healthProxy, agentProxy } = opts;
+    const oauth2ProxyAddr = opts.oauth2ProxyAddr ?? '';
+    const catchallBody = opts.catchallBody ?? agentProxy;
+    const lines = [];
+    if (mode === 'self-issued') {
+        lines.push('  # IDE PKCE sign-in: broker requires X-Auth-Request-Email from oauth2-proxy. Must come', '  # before the generic /oauth/* handle so authorize is gated (not dumped straight to broker).', '  handle /oauth/authorize {', `    forward_auth ${oauth2ProxyAddr} {`, '      uri /oauth2/auth', '      copy_headers X-Auth-Request-Email', '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '      @unauth status 401', '      handle_response @unauth {', '        redir * "/oauth2/sign_in?rd={http.request.uri}"', '      }', '    }', `    reverse_proxy ${authBrokerAddr} {`, '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '    }', '  }', '  # Federated SSO (A′): browsers from other subdomains land here to stamp the shared cookie.', '  # Same oauth2-proxy gate as authorize; must precede the generic /oauth/* handle.', '  handle /oauth/browser-login {', `    forward_auth ${oauth2ProxyAddr} {`, '      uri /oauth2/auth', '      copy_headers X-Auth-Request-Email', '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '      @unauth status 401', '      handle_response @unauth {', '        redir * "/oauth2/sign_in?rd={http.request.uri}"', '      }', '    }', `    reverse_proxy ${authBrokerAddr} {`, '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '    }', '  }', '  # Auth-broker: token exchange + other /oauth/* routes that must stay ungated.', '  handle /oauth/* {', `    reverse_proxy ${authBrokerAddr} {`, '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '    }', '  }');
+    }
+    lines.push('  handle /api/ide/* {', `    reverse_proxy ${authBrokerAddr} {`, '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '    }', '  }');
+    if (mode === 'self-issued') {
+        lines.push('  # oauth2-proxy: Google SSO callback + sign-in.', '  handle /oauth2/* {', `    reverse_proxy ${oauth2ProxyAddr} {`, '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '    }', '  }');
+    }
+    lines.push('  @health path /health /ready', '  handle @health {', ...healthProxy, '  }', '  # API clients (IDE) with a Bearer token: validate via auth-broker, copy identity header.', '  @apiWithAuth {', '    path /v1/*', '    header Authorization *', '  }', '  handle @apiWithAuth {', `    forward_auth ${authBrokerAddr} {`, '      uri /api/ide/me', '      copy_headers X-Agent-User', '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '      @unauth status 401', '      handle_response @unauth {', '        respond "Unauthorized" 401', '      }', '    }', ...agentProxy, '  }');
+    if (mode === 'self-issued') {
+        lines.push('  # Browser clients: SSO via oauth2-proxy, identity injected as X-Agent-User.', '  handle {', `    forward_auth ${oauth2ProxyAddr} {`, '      uri /oauth2/auth', '      copy_headers X-Auth-Request-Email>X-Agent-User', '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '      @unauth status 401', '      handle_response @unauth {', '        redir * "/oauth2/sign_in?rd={http.request.uri}"', '      }', '    }', ...catchallBody, '  }');
+    }
+    else {
+        const idp = opts.idpUrl?.trim() || '';
+        const loginRedirect = idp
+            ? `        redir * "${idp}/oauth/browser-login?return_to=https://{http.request.host}{http.request.uri}" 302`
+            : '        respond "Unauthorized" 401';
+        lines.push('  # Browser clients: the shared .agenthippo.ai cookie is verified by auth-broker. No cookie', '  # → redirect to the central IdP to log in (it stamps the cookie), then return.', '  handle {', `    forward_auth ${authBrokerAddr} {`, '      uri /api/ide/me', '      copy_headers X-Agent-User', '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '      @unauth status 401', '      handle_response @unauth {', loginRedirect, '      }', '    }', ...catchallBody, '  }');
+    }
+    return lines;
+}
+/**
+ * "Sidecar" platforms — Cloud Run, ECS Fargate (`awsvpc` mode), Azure Container Apps (one
+ * replica) — all share one task's network namespace across containers and terminate TLS in
+ * front, so Caddy always listens on plain HTTP `:{$PORT}` and reaches every sidecar via
+ * `localhost:<port>` (never docker-DNS names). The agent isn't the ingress on these platforms,
+ * so it listens on a distinct internal port to avoid clashing with Caddy on `$PORT`.
+ */
+exports.EDGE_AGENT_PORT = 8090;
+/** Caddyfile for a sidecar platform's self-issued edge (own oauth2-proxy + Google client). */
+function renderSidecarEdgeCaddyfile() {
+    return [
+        '# Sidecar-platform edge ingress. TLS terminates in front; Caddy listens on HTTP :{$PORT}.',
+        '# Containers share one task/pod\'s localhost → upstreams are 127.0.0.1:<port> (not docker-DNS names).',
+        '{',
+        '  auto_https off',
+        '}',
+        '',
+        ':{$PORT} {',
+        ...renderIdentityLayer({
+            mode: 'self-issued',
+            oauth2ProxyAddr: 'localhost:4180',
+            authBrokerAddr: 'localhost:9780',
+            healthProxy: [`    reverse_proxy localhost:${exports.EDGE_AGENT_PORT}`],
+            agentProxy: [`    reverse_proxy localhost:${exports.EDGE_AGENT_PORT}`],
+        }),
+        '}',
+        '',
+    ].join('\n');
+}
+/**
+ * A′ — federated sidecar-platform edge. No oauth2-proxy: Google login happens once at the
+ * central IdP (`idpUrl`); this agent only verifies the shared AgentHippo JWT (Bearer for IDE,
+ * cookie for browser). On a browser 401, redirect to the IdP's `/oauth/browser-login` to stamp
+ * the shared cookie, then return.
+ */
+function renderSidecarFedCaddyfile(idpUrl) {
+    const idp = (idpUrl || '').trim().replace(/\/+$/, '');
+    return [
+        '# Sidecar-platform federated edge (A′). TLS terminates in front; Caddy listens on HTTP :{$PORT}.',
+        `# No oauth2-proxy — Google login happens once at the central IdP (${idp || '<IDP_URL>'});`,
+        '# this agent only verifies the shared AgentHippo JWT (Bearer for IDE, cookie for browser).',
+        '{',
+        '  auto_https off',
+        '}',
+        '',
+        ':{$PORT} {',
+        ...renderIdentityLayer({
+            mode: 'federated',
+            authBrokerAddr: 'localhost:9780',
+            idpUrl: idp,
+            healthProxy: [`    reverse_proxy localhost:${exports.EDGE_AGENT_PORT}`],
+            agentProxy: [`    reverse_proxy localhost:${exports.EDGE_AGENT_PORT}`],
+        }),
+        '}',
+        '',
+    ].join('\n');
+}