@axiom-lattice/gateway 8.4.0 → 9.0.0

package/dist/{open-exposure-BPLYUIX6.mjs → open-exposure-HGYT5VFC.mjs}

@@ -1,6 +1,7 @@
 import {
-  buildAgentCardForAssistant
-} from "./chunk-W3YH4S6G.mjs";
+  buildAgentCardForAssistant,
+  resolveRequestBaseUrl
+} from "./chunk-SIMEG2JT.mjs";
 import {
   buildTenantOpenPlugins,
   mergeOpenCatalog
@@ -28,9 +29,7 @@ function registerOpenExposureRoutes(app, deps = {}) {
         return reply.status(404).send({ success: false, error: "Key not found" });
       }
       const grants = effectiveGrants(record);
-      const forwardedHost = request.headers["x-forwarded-host"];
-      const host = (Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost) ?? (Array.isArray(request.headers.host) ? request.headers.host[0] : request.headers.host) ?? request.hostname;
-      const baseUrl = `${request.protocol}://${host}`;
+      const baseUrl = resolveRequestBaseUrl(request);
       const globalCatalog = await openLattice.catalogFor(grants, { tenantId });
       let tenantTools = [];
       let tenantCatalogDegraded = false;
@@ -106,4 +105,4 @@ function registerOpenExposureRoutes(app, deps = {}) {
 export {
   registerOpenExposureRoutes
 };
-//# sourceMappingURL=open-exposure-BPLYUIX6.mjs.map
+//# sourceMappingURL=open-exposure-HGYT5VFC.mjs.map

package/dist/open-exposure-HGYT5VFC.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/routes/open-exposure.ts"],"sourcesContent":["/**\n * Key exposure endpoint: what a given API key exposes to external callers —\n * the MCP tools (per grants) and the A2A agent cards (for granted agents).\n * Console-session guarded and tenant-scoped.\n */\n\nimport type { FastifyInstance, FastifyReply, FastifyRequest } from \"fastify\";\nimport { getStoreLattice } from \"@axiom-lattice/core\";\nimport type {\n  A2AApiKeyStore,\n  AssistantStore,\n  OpenGrant,\n} from \"@axiom-lattice/protocols\";\nimport { effectiveGrants } from \"@axiom-lattice/protocols\";\nimport {\n  openLattice,\n  type OpenToolDescriptor,\n} from \"../services/open/openLattice\";\nimport {\n  buildTenantOpenPlugins,\n  mergeOpenCatalog,\n  type TenantOpenPluginDeps,\n} from \"../services/open/tenantOpenPlugins\";\nimport { buildAgentCardForAssistant } from \"../services/a2a/A2AAgentCardBuilder\";\nimport { resolveRequestBaseUrl } from \"../utils/request-base-url\";\n\ninterface RequestWithUser extends FastifyRequest {\n  user?: { id: string; tenantId?: string };\n}\n\n/** Overridable seams for the exposure route (tests / embedding). */\nexport interface OpenExposureDeps {\n  /** Tenant sandbox plugin catalog seams; defaults to the live sandbox catalog. */\n  tenantPluginDeps?: TenantOpenPluginDeps;\n}\n\nexport function registerOpenExposureRoutes(\n  app: FastifyInstance,\n  deps: OpenExposureDeps = {},\n): void {\n  app.get<{ Params: { id: string } }>(\n    \"/api/keys/:id/exposure\",\n    async (\n      request: FastifyRequest<{ Params: { id: string } }>,\n      reply: FastifyReply,\n    ) => {\n      const tenantId = (request as RequestWithUser).user?.tenantId;\n      if (!tenantId) {\n        return reply.status(401).send({ success: false, error: \"Unauthorized\" });\n      }\n\n      const keyStore = getStoreLattice(\"default\", \"a2aApiKey\")\n        .store as A2AApiKeyStore;\n      const record = await keyStore.findById(request.params.id);\n      if (!record || record.tenantId !== tenantId) {\n        return reply.status(404).send({ success: false, error: \"Key not found\" });\n      }\n\n      const grants: OpenGrant[] = effectiveGrants(record);\n      const baseUrl = resolveRequestBaseUrl(request);\n\n      // MCP surface: the credential-filtered tool catalog.\n      const globalCatalog = await openLattice.catalogFor(grants, { tenantId });\n\n      // Tenant sandbox plugins live in per-tenant volumes, outside the\n      // OpenLattice registry, so the globals are merged with the credential's\n      // grant-filtered tenant tools (global wins) to mirror the actual Open MCP\n      // session. A missing/unavailable sandbox catalog degrades to globals.\n      let tenantTools: OpenToolDescriptor[] = [];\n      let tenantCatalogDegraded = false;\n      try {\n        const tenant = await buildTenantOpenPlugins(tenantId, grants, {\n          ...deps.tenantPluginDeps,\n          reservedToolNames: new Set(globalCatalog.map((t) => t.toolName)),\n        });\n        tenantTools = tenant.tools;\n        tenantCatalogDegraded = tenant.degraded;\n      } catch (error) {\n        tenantCatalogDegraded = true;\n        request.log.warn(\n          { tenantId, err: error },\n          \"key exposure: tenant plugin catalog unavailable\",\n        );\n      }\n\n      const tools = mergeOpenCatalog(globalCatalog, tenantTools).map((t) => ({\n        domain: t.domain,\n        toolName: t.toolName,\n        description: t.description,\n        annotations: t.annotations,\n        hasUi: Boolean(t.ui),\n      }));\n\n      // A2A surface: one card per granted agent.\n      const agentGrant = grants.find((g) => g.domain === \"agent\");\n      const assistantStore = getStoreLattice(\"default\", \"assistant\")\n        .store as AssistantStore;\n      let pushNotifications = false;\n      try {\n        pushNotifications = Boolean(getStoreLattice(\"default\", \"store\").store);\n      } catch {\n        pushNotifications = false;\n      }\n      const agents: Array<{\n        assistantId: string;\n        cardUrl: string;\n        jsonrpcUrl: string;\n        v1CardUrl: string;\n        v1JsonrpcUrl: string;\n        card: unknown;\n      }> = [];\n      for (const assistantId of agentGrant?.items ?? []) {\n        const assistant = await assistantStore.getAssistantById(\n          tenantId,\n          assistantId,\n        );\n        if (!assistant) continue;\n        agents.push({\n          assistantId,\n          cardUrl: `${baseUrl}/api/a2a/agents/${assistantId}/.well-known/agent-card.json`,\n          jsonrpcUrl: `${baseUrl}/api/a2a/agents/${assistantId}/jsonrpc`,\n          v1CardUrl: `${baseUrl}/a2a/v1/${assistantId}/.well-known/agent-card.json`,\n          v1JsonrpcUrl: `${baseUrl}/a2a/v1/${assistantId}`,\n          card: buildAgentCardForAssistant({\n            assistant,\n            baseUrl,\n            pushNotifications,\n          }),\n        });\n      }\n\n      return reply.status(200).send({\n        success: true,\n        data: {\n          tenantId,\n          projectId: record.projectId,\n          grants,\n          mcp: {\n            endpoint: `${baseUrl}/open/mcp`,\n            tools,\n            // Surfaced so the console can distinguish \"no tenant tools granted\"\n            // from \"tenant catalog unreadable\"; the live Open session degrades\n            // to globals-only either way.\n            tenantCatalogDegraded,\n          },\n          a2a: { agents },\n        },\n      });\n    },\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;AAOA,SAAS,uBAAuB;AAMhC,SAAS,uBAAuB;AAuBzB,SAAS,2BACd,KACA,OAAyB,CAAC,GACpB;AACN,MAAI;AAAA,IACF;AAAA,IACA,OACE,SACA,UACG;AACH,YAAM,WAAY,QAA4B,MAAM;AACpD,UAAI,CAAC,UAAU;AACb,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,eAAe,CAAC;AAAA,MACzE;AAEA,YAAM,WAAW,gBAAgB,WAAW,WAAW,EACpD;AACH,YAAM,SAAS,MAAM,SAAS,SAAS,QAAQ,OAAO,EAAE;AACxD,UAAI,CAAC,UAAU,OAAO,aAAa,UAAU;AAC3C,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,gBAAgB,CAAC;AAAA,MAC1E;AAEA,YAAM,SAAsB,gBAAgB,MAAM;AAClD,YAAM,UAAU,sBAAsB,OAAO;AAG7C,YAAM,gBAAgB,MAAM,YAAY,WAAW,QAAQ,EAAE,SAAS,CAAC;AAMvE,UAAI,cAAoC,CAAC;AACzC,UAAI,wBAAwB;AAC5B,UAAI;AACF,cAAM,SAAS,MAAM,uBAAuB,UAAU,QAAQ;AAAA,UAC5D,GAAG,KAAK;AAAA,UACR,mBAAmB,IAAI,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;AAAA,QACjE,CAAC;AACD,sBAAc,OAAO;AACrB,gCAAwB,OAAO;AAAA,MACjC,SAAS,OAAO;AACd,gCAAwB;AACxB,gBAAQ,IAAI;AAAA,UACV,EAAE,UAAU,KAAK,MAAM;AAAA,UACvB;AAAA,QACF;AAAA,MACF;AAEA,YAAM,QAAQ,iBAAiB,eAAe,WAAW,EAAE,IAAI,CAAC,OAAO;AAAA,QACrE,QAAQ,EAAE;AAAA,QACV,UAAU,EAAE;AAAA,QACZ,aAAa,EAAE;AAAA,QACf,aAAa,EAAE;AAAA,QACf,OAAO,QAAQ,EAAE,EAAE;AAAA,MACrB,EAAE;AAGF,YAAM,aAAa,OAAO,KAAK,CAAC,MAAM,EAAE,WAAW,OAAO;AAC1D,YAAM,iBAAiB,gBAAgB,WAAW,WAAW,EAC1D;AACH,UAAI,oBAAoB;AACxB,UAAI;AACF,4BAAoB,QAAQ,gBAAgB,WAAW,OAAO,EAAE,KAAK;AAAA,MACvE,QAAQ;AACN,4BAAoB;AAAA,MACtB;AACA,YAAM,SAOD,CAAC;AACN,iBAAW,eAAe,YAAY,SAAS,CAAC,GAAG;AACjD,cAAM,YAAY,MAAM,eAAe;AAAA,UACrC;AAAA,UACA;AAAA,QACF;AACA,YAAI,CAAC,UAAW;AAChB,eAAO,KAAK;AAAA,UACV;AAAA,UACA,SAAS,GAAG,OAAO,mBAAmB,WAAW;AAAA,UACjD,YAAY,GAAG,OAAO,mBAAmB,WAAW;AAAA,UACpD,WAAW,GAAG,OAAO,WAAW,WAAW;AAAA,UAC3C,cAAc,GAAG,OAAO,WAAW,WAAW;AAAA,UAC9C,MAAM,2BAA2B;AAAA,YAC/B;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAEA,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK;AAAA,QAC5B,SAAS;AAAA,QACT,MAAM;AAAA,UACJ;AAAA,UACA,WAAW,OAAO;AAAA,UAClB;AAAA,UACA,KAAK;AAAA,YACH,UAAU,GAAG,OAAO;AAAA,YACpB;AAAA;AAAA;AAAA;AAAA,YAIA;AAAA,UACF;AAAA,UACA,KAAK,EAAE,OAAO;AAAA,QAChB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiom-lattice/gateway",
-  "version": "8.4.0",
+  "version": "9.0.0",
   "main": "dist/index.js",
   "files": [
     "dist"
@@ -55,11 +55,11 @@
     "uuid": "^9.0.1",
     "web-push": "^3.6.7",
     "zod": "3.25.76",
-    "@axiom-lattice/cli-a2a": "0.2.28",
-    "@axiom-lattice/core": "10.1.0",
-    "@axiom-lattice/pg-stores": "4.1.0",
-    "@axiom-lattice/protocols": "6.3.0",
-    "@axiom-lattice/queue-redis": "1.1.28"
+    "@axiom-lattice/cli-a2a": "0.2.29",
+    "@axiom-lattice/core": "11.0.0",
+    "@axiom-lattice/pg-stores": "4.1.1",
+    "@axiom-lattice/protocols": "6.4.0",
+    "@axiom-lattice/queue-redis": "1.1.29"
   },
   "devDependencies": {
     "@types/bcrypt": "^6.0.0",
@@ -84,7 +84,7 @@
     "typescript": "^5.8.2",
     "ws": "^8.19.0",
     "@axiom-lattice/open-mcp-client": "0.2.0",
-    "@axiom-lattice/react-sdk": "8.4.0"
+    "@axiom-lattice/react-sdk": "9.0.0"
   },
   "scripts": {
     "build": "tsup src/index.ts --format cjs,esm --dts --clean --sourcemap && pnpm copy:embed-assets",