@axiom-lattice/gateway 8.3.0 → 8.4.0

package/dist/{A2AAuthService-7UGQ7GMW.mjs → A2AAuthService-UKN53ZGP.mjs}

@@ -2,11 +2,11 @@ import {
   A2AAuthError,
   A2AAuthService,
   parseEnvKeys
-} from "./chunk-GPHOYR3X.mjs";
+} from "./chunk-LCM4OQTI.mjs";
 import "./chunk-NFEGQTCC.mjs";
 export {
   A2AAuthError,
   A2AAuthService,
   parseEnvKeys
 };
-//# sourceMappingURL=A2AAuthService-7UGQ7GMW.mjs.map
+//# sourceMappingURL=A2AAuthService-UKN53ZGP.mjs.map

package/dist/{a2a-BHBLACJV.mjs → a2a-TDZ3TT6H.mjs}

@@ -4,8 +4,8 @@ import {
   registerA2ARoutes,
   setA2AAuthService,
   setA2AKeyStore
-} from "./chunk-HYYLYIMH.mjs";
-import "./chunk-GPHOYR3X.mjs";
+} from "./chunk-OBODBHIS.mjs";
+import "./chunk-LCM4OQTI.mjs";
 import "./chunk-NFEGQTCC.mjs";
 export {
   broadcastA2AKeyChanged,
@@ -14,4 +14,4 @@ export {
   setA2AAuthService,
   setA2AKeyStore
 };
-//# sourceMappingURL=a2a-BHBLACJV.mjs.map
+//# sourceMappingURL=a2a-TDZ3TT6H.mjs.map

package/dist/{a2a-standard-VL5I7B4W.mjs → a2a-standard-INVCUSAW.mjs}

@@ -9,9 +9,12 @@ import {
   saveProjectFile,
   wakeRunTaskQueue
 } from "./chunk-2SR4F3ZD.mjs";
+import {
+  getRateLimitService
+} from "./chunk-A7YNAU5L.mjs";
 import {
   A2AAuthError
-} from "./chunk-GPHOYR3X.mjs";
+} from "./chunk-LCM4OQTI.mjs";
 import "./chunk-NFEGQTCC.mjs";
 
 // src/routes/a2a-standard.ts
@@ -3317,6 +3320,12 @@ var SSE_HEADERS = {
 };
 function registerA2AStandardRoutes(app, deps) {
   const authService = deps.authService;
+  const rateLimits = deps.rateLimits ?? getRateLimitService();
+  const enforceRateLimit = async (request, reply, dimensions, requestId) => {
+    const decision = await rateLimits.consume("a2a.jsonrpc", dimensions);
+    if (decision.allowed) return null;
+    return reply.header("Retry-After", String(decision.retryAfterSeconds)).status(429).send(jsonRpcError(requestId, -32005, "Rate limited"));
+  };
   const resolveTasks = deps.getTaskStoreLattice ?? (() => getStoreLattice("default", "task").store);
   const resolveTaskWorkItems = deps.getTaskWorkItemStore ?? (() => getStoreLattice("default", "taskWorkItem").store);
   const getAssistantStore = deps.getAssistantStore ?? (() => getStoreLattice("default", "assistant").store);
@@ -3608,6 +3617,13 @@ function registerA2AStandardRoutes(app, deps) {
   );
   const handleJsonRpc = async (request, reply) => {
     const requestId = extractRequestId(request.body);
+    const preAuthBlocked = await enforceRateLimit(
+      request,
+      reply,
+      { ip: request.ip },
+      requestId
+    );
+    if (preAuthBlocked) return;
     const auth = await authService.authenticate(
       getHeader(request.headers.authorization) ?? getHeader(request.headers["x-api-key"])
     );
@@ -3636,6 +3652,13 @@ function registerA2AStandardRoutes(app, deps) {
       reply.status(500).send(jsonRpcError(requestId, -32603, "Internal error"));
       return;
     }
+    const blocked = await enforceRateLimit(
+      request,
+      reply,
+      { key: auth.apiKey },
+      requestId
+    );
+    if (blocked) return;
     const tenantId = auth.tenantId ?? "default";
     const scope = {
       tenantId,
@@ -3968,12 +3991,26 @@ data: ${JSON.stringify(data)}
         reply.header("A2A-Version", "1.0").send(versionNotSupportedError(requestId, requestedVersion));
         return;
       }
+      const preAuthBlocked = await enforceRateLimit(
+        request,
+        reply,
+        { ip: request.ip },
+        requestId
+      );
+      if (preAuthBlocked) return;
       const auth = await authenticateV1(request);
       if (!auth.ok) {
         reply.status(auth.status).send(jsonRpcError(requestId, authErrorToRpcCode(auth.status), auth.message));
         return;
       }
       const rawMethod = asString4(requestBody.method);
+      const blocked = await enforceRateLimit(
+        request,
+        reply,
+        { key: auth.auth.apiKey },
+        requestId
+      );
+      if (blocked) return;
       const tenantId = auth.auth.tenantId ?? "default";
       const scope = {
         tenantId,
@@ -4185,4 +4222,4 @@ data: ${JSON.stringify(errorResponse)}
 export {
   registerA2AStandardRoutes
 };
-//# sourceMappingURL=a2a-standard-VL5I7B4W.mjs.map
+//# sourceMappingURL=a2a-standard-INVCUSAW.mjs.map