@burdenoff/be-sdk 2026.510.79

package/dist/chunk-MLW2HPS5.js

@@ -0,0 +1,1267 @@
+import { logger } from './chunk-CBZNP6RF.js';
+import { __export, __name } from './chunk-XE4OXN2W.js';
+import { GraphQLError, validate, Kind } from 'graphql';
+
+// src/gateway/security/index.ts
+var security_exports = {};
+__export(security_exports, {
+  DEFAULT_ARMOR_CONFIG: () => DEFAULT_ARMOR_CONFIG,
+  DEFAULT_COST_MAP: () => DEFAULT_COST_MAP,
+  DEFAULT_TIERS: () => DEFAULT_TIERS,
+  MemoryValkey: () => MemoryValkey,
+  __resetMetricsForTest: () => __resetMetricsForTest,
+  __setSecurityValkeyForTest: () => __setSecurityValkeyForTest,
+  buildSecurityPlugins: () => buildSecurityPlugins,
+  checkRateLimit: () => checkRateLimit,
+  createArmorPlugins: () => createArmorPlugins,
+  createOperationTimeoutPlugin: () => createOperationTimeoutPlugin,
+  createOtelPlugin: () => createOtelPlugin,
+  createQueryComplexityPlugin: () => createQueryComplexityPlugin,
+  createRateLimitPlugin: () => createRateLimitPlugin,
+  getMetrics: () => getMetrics,
+  getSecurityValkey: () => getSecurityValkey,
+  initializeMetrics: () => initializeMetrics,
+  initializeOtel: () => initializeOtel,
+  initializeSecurityValkey: () => initializeSecurityValkey,
+  mergeCostMap: () => mergeCostMap,
+  resolveActor: () => resolveActor,
+  resolveSecurityOptionsFromEnv: () => resolveSecurityOptionsFromEnv,
+  resolveTiersFromEnv: () => resolveTiersFromEnv,
+  scrapeMetrics: () => scrapeMetrics,
+  shutdownOtel: () => shutdownOtel
+});
+
+// src/gateway/security/actor.ts
+var firstIp = /* @__PURE__ */ __name((header) => {
+  if (!header) return void 0;
+  return header.split(",")[0]?.trim() || void 0;
+}, "firstIp");
+var classify = /* @__PURE__ */ __name((actorType, actorRole) => {
+  if (actorRole === "super_admin") return "super_admin";
+  switch (actorType) {
+    case "user":
+      return "user";
+    case "app":
+      return "app";
+    case "service":
+    case "service_account":
+      return "service";
+    case "super_admin":
+      return "super_admin";
+    default:
+      return "public";
+  }
+}, "classify");
+var resolveActor = /* @__PURE__ */ __name((getHeader) => {
+  const actorId = getHeader("x-actor-id") ?? void 0;
+  const actorType = getHeader("x-actor-type") ?? void 0;
+  const actorRole = getHeader("x-actor-role") ?? void 0;
+  const workspaceId = getHeader("x-workspace-id") ?? void 0;
+  const tenantId = getHeader("x-tenant-id") ?? void 0;
+  const orgId = getHeader("x-org-id") ?? void 0;
+  const appId = getHeader("x-app-id") ?? void 0;
+  const ip = firstIp(getHeader("x-forwarded-for")) || getHeader("x-real-ip") || getHeader("cf-connecting-ip") || void 0;
+  const tier = classify(actorType, actorRole);
+  let identity;
+  switch (tier) {
+    case "super_admin":
+      identity = "bypass";
+      break;
+    case "service":
+      identity = `svc:${actorId ?? "unknown"}`;
+      break;
+    case "app":
+      identity = `${tenantId ?? "notenant"}:${appId ?? actorId ?? "unknown"}`;
+      break;
+    case "user":
+      identity = `${workspaceId ?? "nows"}:${actorId ?? "unknown"}`;
+      break;
+    case "public":
+    default:
+      identity = `ip:${ip ?? "unknown"}`;
+  }
+  return {
+    tier,
+    identity,
+    headers: {
+      actorId,
+      actorType,
+      actorRole,
+      workspaceId,
+      tenantId,
+      orgId,
+      appId,
+      ip
+    }
+  };
+}, "resolveActor");
+
+// src/gateway/security/cost-map.ts
+var DEFAULT_COST_MAP = {
+  // Cross-subgraph search — fanout
+  "Query.searchBigConsole": 200,
+  "Query.searchWorkspaces": 100,
+  "Query.searchTags": 80,
+  // Aggregations
+  "Query.analyticsReport": 300,
+  "Query.usageReport": 250,
+  "Query.billingReport": 250,
+  "Query.auditLog": 150,
+  // Enumeration risk (paginated lists)
+  "Query.listUsers": 50,
+  "Query.listWorkspaces": 50,
+  "Query.listFiles": 40,
+  "Query.listTags": 20,
+  "Query.listApps": 40,
+  // Nested lists
+  "Workspace.members": 5,
+  "User.workspaces": 10,
+  "User.apps": 5,
+  "Tag.appliedTo": 5,
+  // Introspection — expensive and abuse-prone in prod
+  "Query.__schema": 1e3,
+  "Query.__type": 500,
+  // Heavy writers
+  "Mutation.bulkImport": 500,
+  "Mutation.webhookTrigger": 100
+};
+var mergeCostMap = /* @__PURE__ */ __name((base, override) => ({
+  ...base,
+  ...override
+}), "mergeCostMap");
+
+// src/gateway/security/tiers.ts
+var DEFAULT_TIERS = {
+  // Public (anonymous) traffic is keyed per-IP. The previous 60+20=80/60s
+  // ceiling (1.33 req/s sustained) was tight enough that a single heavy
+  // frontend page load (≈15–30 GraphQL queries) plus a NAT-shared second
+  // user could blow the bucket on benign traffic. Bumping to 120+60=180/60s
+  // (3 req/s sustained) gives 2× headroom while staying ~40× below the
+  // ~130 req/s single-pod compute floor measured under realistic load.
+  public: {
+    points: 120,
+    duration: 60,
+    burst: 60
+  },
+  user: {
+    points: 600,
+    duration: 60,
+    burst: 120
+  },
+  app: {
+    points: 3e3,
+    duration: 60,
+    burst: 500
+  },
+  service: {
+    points: 6e3,
+    duration: 60,
+    burst: 1e3
+  },
+  super_admin: {
+    points: Number.MAX_SAFE_INTEGER,
+    duration: 60,
+    burst: Number.MAX_SAFE_INTEGER
+  }
+};
+var positiveInt = /* @__PURE__ */ __name((value, fallback) => {
+  if (!value) return fallback;
+  const parsed = parseInt(value, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}, "positiveInt");
+var resolveTiersFromEnv = /* @__PURE__ */ __name((base = DEFAULT_TIERS) => {
+  const out = {
+    ...base
+  };
+  Object.keys(base).forEach((tier) => {
+    const upper = tier.toUpperCase();
+    out[tier] = {
+      points: positiveInt(process.env[`GATEWAY_RL_${upper}_POINTS`], base[tier].points),
+      duration: positiveInt(process.env[`GATEWAY_RL_${upper}_DURATION`], base[tier].duration),
+      burst: positiveInt(process.env[`GATEWAY_RL_${upper}_BURST`], base[tier].burst)
+    };
+  });
+  return out;
+}, "resolveTiersFromEnv");
+
+// src/gateway/security/defaults.ts
+var boolEnv = /* @__PURE__ */ __name((key, fallback) => {
+  const v = process.env[key];
+  if (v === void 0) return fallback;
+  return v === "true" || v === "1";
+}, "boolEnv");
+var intEnv = /* @__PURE__ */ __name((key, fallback) => {
+  const v = process.env[key];
+  if (!v) return fallback;
+  const parsed = parseInt(v, 10);
+  return Number.isFinite(parsed) ? parsed : fallback;
+}, "intEnv");
+var strEnv = /* @__PURE__ */ __name((key, fallback) => process.env[key] ?? fallback, "strEnv");
+var DEFAULT_ARMOR_CONFIG = {
+  maxAliases: 15,
+  maxTokens: 1e3,
+  maxDirectives: 50,
+  characterLimit: 15e3,
+  costLimit: 5e3,
+  observe: true
+};
+var resolveSecurityOptionsFromEnv = /* @__PURE__ */ __name((gatewayName, costMapOverride) => {
+  return {
+    gatewayName,
+    enabled: boolEnv("SECURITY_PLUGINS_ENABLED", true),
+    armor: {
+      maxAliases: intEnv("ARMOR_MAX_ALIASES", DEFAULT_ARMOR_CONFIG.maxAliases),
+      maxTokens: intEnv("ARMOR_MAX_TOKENS", DEFAULT_ARMOR_CONFIG.maxTokens),
+      maxDirectives: intEnv("ARMOR_MAX_DIRECTIVES", DEFAULT_ARMOR_CONFIG.maxDirectives),
+      characterLimit: intEnv("ARMOR_CHARACTER_LIMIT", DEFAULT_ARMOR_CONFIG.characterLimit),
+      costLimit: intEnv("ARMOR_COST_LIMIT", DEFAULT_ARMOR_CONFIG.costLimit),
+      observe: boolEnv("ARMOR_OBSERVE", true)
+    },
+    queryComplexity: {
+      enabled: boolEnv("QUERY_COMPLEXITY_ENABLED", true),
+      maxCost: intEnv("QUERY_COMPLEXITY_MAX", 2e3),
+      costMap: costMapOverride ? mergeCostMap(DEFAULT_COST_MAP, costMapOverride) : DEFAULT_COST_MAP,
+      observe: boolEnv("QUERY_COMPLEXITY_OBSERVE", true)
+    },
+    rateLimit: {
+      tiers: resolveTiersFromEnv(),
+      keyPrefix: strEnv("VALKEY_KEY_PREFIX", gatewayName),
+      observeOnly: boolEnv("RATE_LIMIT_OBSERVE_ONLY", true),
+      failClosed: boolEnv("RATE_LIMIT_FAIL_CLOSED", false)
+    },
+    operationTimeout: {
+      // Default 15s — shorter than the 30s request-limiter queueTimeout, and
+      // aligned with typical client-side timeouts so load-shedding fires at
+      // the same edge a saturated client would already give up. Mutations
+      // that legitimately take longer can override per-deployment via the
+      // OPERATION_TIMEOUT_MS env var.
+      timeoutMs: intEnv("OPERATION_TIMEOUT_MS", 15e3)
+    },
+    otel: {
+      enabled: boolEnv("OTEL_ENABLED", true),
+      serviceName: strEnv("OTEL_SERVICE_NAME", gatewayName),
+      endpoint: strEnv("OTEL_EXPORTER_OTLP_ENDPOINT", "https://tempo.tooling.internal.burdenoff.com:4318/v1/traces"),
+      environment: strEnv("NODE_ENV", "development"),
+      version: process.env["APP_VERSION"]
+    }
+  };
+}, "resolveSecurityOptionsFromEnv");
+
+// src/gateway/security/valkey.ts
+var IoRedisAdapter = class IoRedisAdapter2 {
+  static {
+    __name(this, "IoRedisAdapter");
+  }
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  get(key) {
+    return this.client.get(key);
+  }
+  set(key, value, options) {
+    if (options?.EX) {
+      return this.client.set(key, value, "EX", options.EX);
+    }
+    return this.client.set(key, value);
+  }
+  incrBy(key, amount) {
+    return this.client.incrby(key, amount);
+  }
+  async expire(key, seconds) {
+    const result = await this.client.expire(key, seconds);
+    return result === 1;
+  }
+  ttl(key) {
+    return this.client.ttl(key);
+  }
+  ping() {
+    return this.client.ping();
+  }
+};
+var buildIoRedisClient = /* @__PURE__ */ __name(async (url) => {
+  const spec = "ioredis";
+  const mod = await import(
+    /* @vite-ignore */
+    spec
+  );
+  const Ctor = mod.default ?? mod.Redis;
+  if (!Ctor) {
+    throw new Error("ioredis module has no Redis constructor");
+  }
+  const client = new Ctor(url);
+  client.on("error", (err) => {
+    const e = err instanceof Error ? err : new Error(String(err));
+    logger.warn("[gateway-security] ioredis error event", {
+      error: e.message
+    });
+  });
+  return new IoRedisAdapter(client);
+}, "buildIoRedisClient");
+var MemoryValkey = class MemoryValkey2 {
+  static {
+    __name(this, "MemoryValkey");
+  }
+  store = /* @__PURE__ */ new Map();
+  prune(key) {
+    const e = this.store.get(key);
+    if (!e) return void 0;
+    if (e.expiresAt > 0 && e.expiresAt <= Date.now()) {
+      this.store.delete(key);
+      return void 0;
+    }
+    return e;
+  }
+  get(key) {
+    const e = this.prune(key);
+    return Promise.resolve(e?.value ?? null);
+  }
+  set(key, value, options) {
+    this.store.set(key, {
+      value,
+      expiresAt: options?.EX ? Date.now() + options.EX * 1e3 : 0
+    });
+    return Promise.resolve("OK");
+  }
+  incrBy(key, amount) {
+    const e = this.prune(key);
+    const next = (e ? parseInt(e.value, 10) || 0 : 0) + amount;
+    this.store.set(key, {
+      value: String(next),
+      expiresAt: e?.expiresAt ?? 0
+    });
+    return Promise.resolve(next);
+  }
+  expire(key, seconds) {
+    const e = this.store.get(key);
+    if (!e) return Promise.resolve(false);
+    e.expiresAt = Date.now() + seconds * 1e3;
+    return Promise.resolve(true);
+  }
+  ttl(key) {
+    const e = this.prune(key);
+    if (!e) return Promise.resolve(-2);
+    if (e.expiresAt === 0) return Promise.resolve(-1);
+    return Promise.resolve(Math.max(0, Math.ceil((e.expiresAt - Date.now()) / 1e3)));
+  }
+  ping() {
+    return Promise.resolve("PONG");
+  }
+};
+var singleton = null;
+var bootPromise = null;
+var initializeSecurityValkey = /* @__PURE__ */ __name(async (gatewayName) => {
+  if (singleton) return singleton;
+  if (bootPromise) return bootPromise;
+  bootPromise = (async () => {
+    const url = process.env["VALKEY_URL"] || process.env["REDIS_URL"];
+    const required = process.env["VALKEY_REQUIRED"] === "true";
+    const clientKind = process.env["VALKEY_CLIENT"] ?? "ioredis";
+    if (!url) {
+      const msg = "[gateway-security] VALKEY_URL not set";
+      if (required) throw new Error(`${msg} and VALKEY_REQUIRED=true`);
+      logger.warn(`${msg} \u2014 using in-memory fallback (not cross-pod safe)`, {
+        gatewayName
+      });
+      singleton = new MemoryValkey();
+      return singleton;
+    }
+    const attempts = [];
+    if (clientKind === "ioredis") {
+      attempts.push({
+        kind: "ioredis",
+        factory: /* @__PURE__ */ __name(() => buildIoRedisClient(url), "factory")
+      });
+      attempts.push({
+        kind: "glide (fallback)",
+        factory: /* @__PURE__ */ __name(async () => {
+          const { getValkeyClient } = await import('./cache/index.js');
+          return await getValkeyClient();
+        }, "factory")
+      });
+    } else {
+      attempts.push({
+        kind: "glide",
+        factory: /* @__PURE__ */ __name(async () => {
+          const { getValkeyClient } = await import('./cache/index.js');
+          return await getValkeyClient();
+        }, "factory")
+      });
+      attempts.push({
+        kind: "ioredis (fallback)",
+        factory: /* @__PURE__ */ __name(() => buildIoRedisClient(url), "factory")
+      });
+    }
+    let lastError = null;
+    for (const attempt of attempts) {
+      try {
+        const client = await attempt.factory();
+        const pong = await client.ping();
+        if (pong !== "PONG") {
+          throw new Error(`ping returned ${pong}`);
+        }
+        logger.info("[gateway-security] Valkey connected", {
+          gatewayName,
+          url,
+          client: attempt.kind
+        });
+        singleton = client;
+        return client;
+      } catch (err) {
+        lastError = err instanceof Error ? err : new Error(String(err));
+        logger.warn("[gateway-security] Valkey client init failed, will try next", {
+          gatewayName,
+          client: attempt.kind,
+          error: lastError.message
+        });
+      }
+    }
+    if (required) {
+      logger.error("[gateway-security] Valkey connection failed and required=true", {
+        gatewayName,
+        error: lastError?.message ?? "all attempts failed"
+      });
+      throw lastError ?? new Error("Valkey connection failed");
+    }
+    logger.warn("[gateway-security] All Valkey clients failed \u2014 using in-memory fallback", {
+      gatewayName,
+      error: lastError?.message ?? "unknown"
+    });
+    singleton = new MemoryValkey();
+    return singleton;
+  })();
+  return bootPromise;
+}, "initializeSecurityValkey");
+var getSecurityValkey = /* @__PURE__ */ __name(() => {
+  if (!singleton) {
+    throw new Error("[gateway-security] Valkey not initialized \u2014 call initializeSecurityValkey() first");
+  }
+  return singleton;
+}, "getSecurityValkey");
+var __setSecurityValkeyForTest = /* @__PURE__ */ __name((client) => {
+  singleton = client;
+  bootPromise = client ? Promise.resolve(client) : null;
+}, "__setSecurityValkeyForTest");
+
+// src/gateway/security/metrics.ts
+var metrics = null;
+var initializing = false;
+var promMod = null;
+var noopCounter = {
+  inc: /* @__PURE__ */ __name(() => void 0, "inc")
+};
+var noopMetrics = {
+  rateLimit: noopCounter,
+  complexityRejected: noopCounter,
+  armorRejected: noopCounter,
+  valkeyFailover: noopCounter,
+  operationTimeout: noopCounter
+};
+var initializeMetrics = /* @__PURE__ */ __name(async () => {
+  if (metrics) return metrics;
+  if (initializing) {
+    return noopMetrics;
+  }
+  if (process.env["PROMETHEUS_METRICS_ENABLED"] !== "true") {
+    logger.info("[gateway-security] Prometheus metrics disabled (PROMETHEUS_METRICS_ENABLED!=true)");
+    metrics = noopMetrics;
+    return metrics;
+  }
+  initializing = true;
+  try {
+    const spec = "prom-client";
+    promMod = await import(
+      /* @vite-ignore */
+      spec
+    );
+    if (typeof promMod.Counter !== "function") {
+      logger.warn("[gateway-security] prom-client has unexpected shape \u2014 metrics disabled");
+      metrics = noopMetrics;
+      return metrics;
+    }
+    const { Counter } = promMod;
+    metrics = {
+      rateLimit: new Counter({
+        name: "gateway_security_rate_limit_total",
+        help: "Rate-limit plugin decisions by tier + gateway",
+        labelNames: [
+          "gateway",
+          "tier",
+          "decision"
+        ]
+      }),
+      complexityRejected: new Counter({
+        name: "gateway_security_complexity_rejected_total",
+        help: "Query complexity plugin rejections",
+        labelNames: [
+          "gateway",
+          "observe"
+        ]
+      }),
+      armorRejected: new Counter({
+        name: "gateway_security_armor_rejected_total",
+        help: "graphql-armor rule rejections",
+        labelNames: [
+          "gateway",
+          "rule",
+          "mode"
+        ]
+      }),
+      valkeyFailover: new Counter({
+        name: "gateway_security_valkey_failover_total",
+        help: "Rate-limit plugin fail-open events due to Valkey unreachable",
+        labelNames: [
+          "gateway"
+        ]
+      }),
+      operationTimeout: new Counter({
+        name: "gateway_security_operation_timeout_total",
+        help: "Operation timeout plugin aborts",
+        labelNames: [
+          "gateway"
+        ]
+      })
+    };
+    logger.info("[gateway-security] Prometheus metrics initialized");
+    return metrics;
+  } catch (err) {
+    const e = err instanceof Error ? err : new Error(String(err));
+    logger.warn("[gateway-security] prom-client not installed \u2014 metrics disabled", {
+      error: e.message
+    });
+    metrics = noopMetrics;
+    return metrics;
+  } finally {
+    initializing = false;
+  }
+}, "initializeMetrics");
+var getMetrics = /* @__PURE__ */ __name(() => metrics ?? noopMetrics, "getMetrics");
+var scrapeMetrics = /* @__PURE__ */ __name(async () => {
+  if (!promMod?.register) return null;
+  const body = await promMod.register.metrics();
+  return {
+    body,
+    contentType: promMod.register.contentType
+  };
+}, "scrapeMetrics");
+var __resetMetricsForTest = /* @__PURE__ */ __name(() => {
+  metrics = null;
+  initializing = false;
+  promMod = null;
+}, "__resetMetricsForTest");
+var tryImport = /* @__PURE__ */ __name(async (specifier) => {
+  try {
+    return await import(specifier);
+  } catch (err) {
+    const e = err instanceof Error ? err : new Error(String(err));
+    logger.warn("[gateway-security] armor package not installed \u2014 rule skipped", {
+      specifier,
+      error: e.message
+    });
+    return null;
+  }
+}, "tryImport");
+var pickFactory = /* @__PURE__ */ __name((mod, candidates) => {
+  if (!mod) return null;
+  for (const name of candidates) {
+    const fn = mod[name];
+    if (typeof fn === "function") return fn;
+  }
+  return null;
+}, "pickFactory");
+var createMaxAliasesRule = /* @__PURE__ */ __name((maxAliases) => {
+  return (context) => {
+    let aliases = 0;
+    return {
+      Field(node) {
+        if (!node.alias) return;
+        aliases += 1;
+        if (aliases > maxAliases) {
+          context.reportError(new GraphQLError("Too many field aliases.", {
+            nodes: node,
+            extensions: {
+              code: "ARMOR_MAX_ALIASES"
+            }
+          }));
+        }
+      }
+    };
+  };
+}, "createMaxAliasesRule");
+var createMaxDirectivesRule = /* @__PURE__ */ __name((maxDirectives) => {
+  return (context) => {
+    let directives = 0;
+    return {
+      Directive(node) {
+        directives += 1;
+        if (directives > maxDirectives) {
+          context.reportError(new GraphQLError("Too many directives.", {
+            nodes: node,
+            extensions: {
+              code: "ARMOR_MAX_DIRECTIVES"
+            }
+          }));
+        }
+      }
+    };
+  };
+}, "createMaxDirectivesRule");
+var isLean = /* @__PURE__ */ __name(() => {
+  const v = process.env["ARMOR_LEAN"];
+  return v === "true" || v === "1";
+}, "isLean");
+var loadRules = /* @__PURE__ */ __name(async (cfg) => {
+  const lean = isLean();
+  const [aliasesMod, directivesMod, costMod, blockSuggestionsMod] = await Promise.all([
+    lean ? Promise.resolve(null) : tryImport("@escape.tech/graphql-armor-max-aliases"),
+    lean ? Promise.resolve(null) : tryImport("@escape.tech/graphql-armor-max-directives"),
+    tryImport("@escape.tech/graphql-armor-cost-limit"),
+    lean ? Promise.resolve(null) : tryImport("@escape.tech/graphql-armor-block-field-suggestions")
+  ]);
+  const loaded = {};
+  const maxAliasesFactory = pickFactory(aliasesMod, [
+    "maxAliasesRule"
+  ]);
+  loaded.maxAliasesRule = maxAliasesFactory ? maxAliasesFactory({
+    n: cfg.maxAliases,
+    exposeLimits: cfg.observe
+  }) : createMaxAliasesRule(cfg.maxAliases);
+  const maxDirectivesFactory = pickFactory(directivesMod, [
+    "maxDirectivesRule"
+  ]);
+  loaded.maxDirectivesRule = maxDirectivesFactory ? maxDirectivesFactory({
+    n: cfg.maxDirectives,
+    exposeLimits: cfg.observe
+  }) : createMaxDirectivesRule(cfg.maxDirectives);
+  const costLimitFactory = pickFactory(costMod, [
+    "costLimitRule"
+  ]);
+  if (costLimitFactory) {
+    loaded.costLimitRule = costLimitFactory({
+      maxCost: cfg.costLimit,
+      objectCost: 2,
+      scalarCost: 1,
+      depthCostFactor: 1.5,
+      ignoreIntrospection: true,
+      exposeLimits: cfg.observe
+    });
+  }
+  const blockSuggestionsFactory = pickFactory(blockSuggestionsMod, [
+    "blockFieldSuggestionsPlugin",
+    "default"
+  ]);
+  if (blockSuggestionsFactory) {
+    loaded.blockSuggestionsPlugin = blockSuggestionsFactory({});
+  }
+  if (lean) {
+    logger.info("[gateway-security] ARMOR_LEAN enabled \u2014 running only cost-limit + character-limit", {});
+  }
+  return loaded;
+}, "loadRules");
+var createArmorPlugins = /* @__PURE__ */ __name(async (cfg) => {
+  const rules = await loadRules(cfg);
+  const metrics2 = getMetrics();
+  const enabledRules = [];
+  if (rules.maxAliasesRule) {
+    enabledRules.push({
+      name: "max-aliases",
+      rule: rules.maxAliasesRule
+    });
+  }
+  if (rules.maxDirectivesRule) {
+    enabledRules.push({
+      name: "max-directives",
+      rule: rules.maxDirectivesRule
+    });
+  }
+  if (rules.costLimitRule) {
+    enabledRules.push({
+      name: "cost-limit",
+      rule: rules.costLimitRule
+    });
+  }
+  const armorValidationPlugin = {
+    onParse({ params }) {
+      const source = typeof params.source === "string" ? params.source : params.source?.body;
+      if (typeof source === "string" && source.length > cfg.characterLimit) {
+        if (cfg.observe) {
+          logger.warn("[gateway-security] armor character-limit exceeded (observe)", {
+            length: source.length,
+            limit: cfg.characterLimit
+          });
+          metrics2.armorRejected.inc({
+            rule: "character-limit",
+            mode: "observe"
+          }, 1);
+          return;
+        }
+        metrics2.armorRejected.inc({
+          rule: "character-limit",
+          mode: "enforce"
+        }, 1);
+        throw new GraphQLError("Syntax Error: Query exceeds maximum character limit.", {
+          extensions: {
+            code: "CHARACTER_LIMIT_EXCEEDED",
+            http: {
+              status: 400
+            }
+          }
+        });
+      }
+    },
+    onValidate({ params, setResult }) {
+      if (enabledRules.length === 0) return;
+      const armorErrors = [];
+      for (const { name, rule } of enabledRules) {
+        try {
+          const errs = validate(params.schema, params.documentAST, [
+            rule
+          ]);
+          armorErrors.push(...errs);
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          const wrapped = new GraphQLError(message, {
+            originalError: err instanceof Error ? err : void 0,
+            extensions: {
+              code: "ARMOR_VIOLATION",
+              rule: name
+            }
+          });
+          armorErrors.push(wrapped);
+        }
+      }
+      if (armorErrors.length === 0) return;
+      for (const err of armorErrors) {
+        logger.warn("[gateway-security] armor rule triggered", {
+          message: err.message,
+          observe: cfg.observe
+        });
+      }
+      metrics2.armorRejected.inc({
+        rule: "armor",
+        mode: cfg.observe ? "observe" : "enforce"
+      }, armorErrors.length);
+      if (cfg.observe) return;
+      setResult(armorErrors);
+    }
+  };
+  const plugins = [
+    armorValidationPlugin
+  ];
+  if (rules.blockSuggestionsPlugin) {
+    plugins.push(rules.blockSuggestionsPlugin);
+  }
+  return plugins;
+}, "createArmorPlugins");
+var createTimeoutHandle = /* @__PURE__ */ __name((timeoutMs, error) => {
+  let timerRef;
+  const promise = new Promise((_, reject) => {
+    timerRef = setTimeout(() => reject(error), timeoutMs);
+  });
+  return {
+    timer: timerRef,
+    promise
+  };
+}, "createTimeoutHandle");
+var createOperationTimeoutPlugin = /* @__PURE__ */ __name((deps) => {
+  const timeoutError = new GraphQLError("Operation timeout", {
+    extensions: {
+      code: "OPERATION_TIMEOUT",
+      timeoutMs: deps.config.timeoutMs
+    }
+  });
+  return {
+    onExecute: /* @__PURE__ */ __name(({ executeFn, setExecuteFn }) => {
+      setExecuteFn(async (args) => {
+        const handle = createTimeoutHandle(deps.config.timeoutMs, timeoutError);
+        try {
+          return await Promise.race([
+            executeFn(args),
+            handle.promise
+          ]);
+        } finally {
+          clearTimeout(handle.timer);
+        }
+      });
+    }, "onExecute")
+  };
+}, "createOperationTimeoutPlugin");
+
+// src/gateway/security/plugins/otel.ts
+var shutdownHook = null;
+var buildResource = /* @__PURE__ */ __name((resMod, attrs) => {
+  if (typeof resMod.resourceFromAttributes === "function") {
+    return resMod.resourceFromAttributes(attrs);
+  }
+  if (typeof resMod.Resource === "function") {
+    return new resMod.Resource(attrs);
+  }
+  throw new Error("@opentelemetry/resources module exposes neither Resource nor resourceFromAttributes");
+}, "buildResource");
+var resolveSemanticKeys = /* @__PURE__ */ __name((semcon) => {
+  if (semcon.SemanticResourceAttributes) {
+    return {
+      serviceName: semcon.SemanticResourceAttributes.SERVICE_NAME,
+      deploymentEnv: semcon.SemanticResourceAttributes.DEPLOYMENT_ENVIRONMENT,
+      serviceVersion: semcon.SemanticResourceAttributes.SERVICE_VERSION
+    };
+  }
+  return {
+    serviceName: semcon.ATTR_SERVICE_NAME ?? "service.name",
+    deploymentEnv: semcon.ATTR_DEPLOYMENT_ENVIRONMENT_NAME ?? semcon.ATTR_DEPLOYMENT_ENVIRONMENT ?? "deployment.environment",
+    serviceVersion: semcon.ATTR_SERVICE_VERSION ?? "service.version"
+  };
+}, "resolveSemanticKeys");
+var loadOtelPeerDeps = /* @__PURE__ */ __name(async () => {
+  const sdkSpec = "@opentelemetry/sdk-node";
+  const otlpSpec = "@opentelemetry/exporter-trace-otlp-http";
+  const resSpec = "@opentelemetry/resources";
+  const semSpec = "@opentelemetry/semantic-conventions";
+  const modules = await Promise.all([
+    import(
+      /* @vite-ignore */
+      sdkSpec
+    ),
+    import(
+      /* @vite-ignore */
+      otlpSpec
+    ),
+    import(
+      /* @vite-ignore */
+      resSpec
+    ),
+    import(
+      /* @vite-ignore */
+      semSpec
+    )
+  ]);
+  const [sdkMod, otlpMod, resMod, semcon] = modules;
+  return {
+    NodeSDK: sdkMod.NodeSDK,
+    OTLPTraceExporter: otlpMod.OTLPTraceExporter,
+    resMod,
+    semcon
+  };
+}, "loadOtelPeerDeps");
+var initializeOtel = /* @__PURE__ */ __name(async (cfg) => {
+  if (!cfg.enabled) {
+    logger.info("[gateway-security] OTel disabled by config");
+    return;
+  }
+  if (shutdownHook) {
+    return;
+  }
+  try {
+    const { NodeSDK, OTLPTraceExporter, resMod, semcon } = await loadOtelPeerDeps();
+    const keys = resolveSemanticKeys(semcon);
+    const resourceAttributes = {
+      [keys.serviceName]: cfg.serviceName,
+      [keys.deploymentEnv]: cfg.environment
+    };
+    if (cfg.version) {
+      resourceAttributes[keys.serviceVersion] = cfg.version;
+    }
+    const sdk = new NodeSDK({
+      resource: buildResource(resMod, resourceAttributes),
+      traceExporter: new OTLPTraceExporter({
+        url: cfg.endpoint
+      })
+    });
+    sdk.start();
+    shutdownHook = /* @__PURE__ */ __name(() => sdk.shutdown(), "shutdownHook");
+    logger.info("[gateway-security] OTel initialized", {
+      serviceName: cfg.serviceName,
+      endpoint: cfg.endpoint
+    });
+  } catch (err) {
+    const e = err instanceof Error ? err : new Error(String(err));
+    logger.warn("[gateway-security] OTel init failed \u2014 continuing without tracing", {
+      error: e.message
+    });
+  }
+}, "initializeOtel");
+var shutdownOtel = /* @__PURE__ */ __name(async () => {
+  if (shutdownHook) {
+    try {
+      await shutdownHook();
+    } catch (err) {
+      const e = err instanceof Error ? err : new Error(String(err));
+      logger.warn("[gateway-security] OTel shutdown error", {
+        error: e.message
+      });
+    }
+    shutdownHook = null;
+  }
+}, "shutdownOtel");
+var createOtelPlugin = /* @__PURE__ */ __name(async (cfg) => {
+  if (!cfg.enabled) return {};
+  try {
+    const spec = "@envelop/opentelemetry";
+    const mod = await import(
+      /* @vite-ignore */
+      spec
+    );
+    if (typeof mod.useOpenTelemetry !== "function") {
+      logger.warn("[gateway-security] @envelop/opentelemetry has unexpected shape \u2014 plugin skipped");
+      return {};
+    }
+    return mod.useOpenTelemetry({
+      spans: {
+        execute: true,
+        parse: true,
+        validate: true,
+        subscribe: true
+      },
+      resolvers: false
+    });
+  } catch (err) {
+    const e = err instanceof Error ? err : new Error(String(err));
+    logger.warn("[gateway-security] @envelop/opentelemetry not installed \u2014 plugin skipped", {
+      error: e.message
+    });
+    return {};
+  }
+}, "createOtelPlugin");
+var PAGINATION_ARGUMENTS = /* @__PURE__ */ new Set([
+  "first",
+  "limit",
+  "pageSize"
+]);
+var MAX_LIST_MULTIPLIER = 100;
+var MAX_FAILURE_LOG_VARIANTS = 5;
+var complexityFailureMessages = /* @__PURE__ */ new Set();
+var isRecord = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null, "isRecord");
+var unwrapNamedType = /* @__PURE__ */ __name((type) => {
+  let current = type;
+  while (isRecord(current) && current["ofType"] !== void 0) {
+    current = current["ofType"];
+  }
+  return isRecord(current) ? current : null;
+}, "unwrapNamedType");
+var getSchemaLike = /* @__PURE__ */ __name((schema) => schema, "getSchemaLike");
+var getOperationRootType = /* @__PURE__ */ __name((schema, operation) => {
+  const schemaLike = getSchemaLike(schema);
+  if (operation.operation === "mutation") return schemaLike.getMutationType?.() ?? null;
+  if (operation.operation === "subscription") return schemaLike.getSubscriptionType?.() ?? null;
+  return schemaLike.getQueryType?.() ?? null;
+}, "getOperationRootType");
+var getTypeByName = /* @__PURE__ */ __name((schema, name) => {
+  return getSchemaLike(schema).getType?.(name) ?? null;
+}, "getTypeByName");
+var getField = /* @__PURE__ */ __name((parentType, fieldName) => {
+  return parentType.getFields?.()[fieldName];
+}, "getField");
+var getCostMapValue = /* @__PURE__ */ __name((costMap, parentType, fieldName) => {
+  if (!parentType.name) return 1;
+  return costMap[`${parentType.name}.${fieldName}`] ?? 1;
+}, "getCostMapValue");
+var numericValueFromAst = /* @__PURE__ */ __name((value) => {
+  if (value.kind === Kind.INT || value.kind === Kind.FLOAT) {
+    const parsed = Number(value.value);
+    return Number.isFinite(parsed) ? parsed : void 0;
+  }
+  if (value.kind === Kind.STRING) {
+    const parsed = Number(value.value);
+    return Number.isFinite(parsed) ? parsed : void 0;
+  }
+  return void 0;
+}, "numericValueFromAst");
+var listMultiplierFromArgs = /* @__PURE__ */ __name((args) => {
+  if (!args) return 1;
+  for (const arg of args) {
+    if (!PAGINATION_ARGUMENTS.has(arg.name.value)) continue;
+    const raw = numericValueFromAst(arg.value);
+    if (typeof raw !== "number") return 1;
+    return Math.min(Math.max(1, Math.trunc(raw)), MAX_LIST_MULTIPLIER);
+  }
+  return 1;
+}, "listMultiplierFromArgs");
+var calculateFieldComplexity = /* @__PURE__ */ __name((schema, fieldNode, parentType, fragments, costMap, activeFragments) => {
+  const fieldName = fieldNode.name.value;
+  const field = getField(parentType, fieldName);
+  const baseCost = getCostMapValue(costMap, parentType, fieldName);
+  const namedFieldType = unwrapNamedType(field?.type);
+  const childCost = fieldNode.selectionSet && namedFieldType ? calculateSelectionSetComplexity(schema, fieldNode.selectionSet, namedFieldType, fragments, costMap, activeFragments) : 0;
+  return (baseCost + childCost) * listMultiplierFromArgs(fieldNode.arguments);
+}, "calculateFieldComplexity");
+var calculateSelectionSetComplexity = /* @__PURE__ */ __name((schema, selectionSet, parentType, fragments, costMap, activeFragments) => {
+  let total = 0;
+  for (const selection of selectionSet.selections) {
+    total += calculateSelectionComplexity(schema, selection, parentType, fragments, costMap, activeFragments);
+  }
+  return total;
+}, "calculateSelectionSetComplexity");
+var calculateSelectionComplexity = /* @__PURE__ */ __name((schema, selection, parentType, fragments, costMap, activeFragments) => {
+  if (selection.kind === Kind.FIELD) {
+    return calculateFieldComplexity(schema, selection, parentType, fragments, costMap, activeFragments);
+  }
+  if (selection.kind === Kind.INLINE_FRAGMENT) {
+    const fragmentParent2 = selection.typeCondition ? getTypeByName(schema, selection.typeCondition.name.value) ?? parentType : parentType;
+    return calculateSelectionSetComplexity(schema, selection.selectionSet, fragmentParent2, fragments, costMap, activeFragments);
+  }
+  const fragmentName = selection.name.value;
+  if (activeFragments.has(fragmentName)) return 0;
+  const fragment = fragments.get(fragmentName);
+  if (!fragment) return 0;
+  activeFragments.add(fragmentName);
+  const fragmentParent = getTypeByName(schema, fragment.typeCondition.name.value) ?? parentType;
+  const complexity = calculateSelectionSetComplexity(schema, fragment.selectionSet, fragmentParent, fragments, costMap, activeFragments);
+  activeFragments.delete(fragmentName);
+  return complexity;
+}, "calculateSelectionComplexity");
+var calculateDocumentComplexity = /* @__PURE__ */ __name((schema, documentAST, costMap) => {
+  const fragments = /* @__PURE__ */ new Map();
+  const operations = [];
+  for (const definition of documentAST.definitions) {
+    if (!isRecord(definition) || typeof definition["kind"] !== "string") continue;
+    if (definition["kind"] === Kind.FRAGMENT_DEFINITION) {
+      const fragment = definition;
+      fragments.set(fragment.name.value, fragment);
+    } else if (definition["kind"] === Kind.OPERATION_DEFINITION) {
+      operations.push(definition);
+    }
+  }
+  let maxComplexity = 0;
+  for (const operation of operations) {
+    const rootType = getOperationRootType(schema, operation);
+    if (!rootType) continue;
+    const complexity = calculateSelectionSetComplexity(schema, operation.selectionSet, rootType, fragments, costMap, /* @__PURE__ */ new Set());
+    maxComplexity = Math.max(maxComplexity, complexity);
+  }
+  return maxComplexity;
+}, "calculateDocumentComplexity");
+var logComplexityFailure = /* @__PURE__ */ __name((error) => {
+  const seen = complexityFailureMessages.has(error.message);
+  if (!seen && complexityFailureMessages.size < MAX_FAILURE_LOG_VARIANTS) {
+    complexityFailureMessages.add(error.message);
+    logger.warn("[gateway-security] complexity scoring failed \u2014 fail-open", {
+      error: error.message,
+      suppressedRepeats: true
+    });
+    return;
+  }
+  logger.debug("[gateway-security] repeated complexity scoring failure suppressed", {
+    error: error.message
+  });
+}, "logComplexityFailure");
+var createQueryComplexityPlugin = /* @__PURE__ */ __name((deps) => {
+  return {
+    onValidate: /* @__PURE__ */ __name(({ params, setResult }) => {
+      try {
+        const complexity = calculateDocumentComplexity(params.schema, params.documentAST, deps.config.costMap);
+        if (complexity > deps.config.maxCost) {
+          getMetrics().complexityRejected.inc({
+            gateway: "unknown",
+            observe: deps.config.observe ? "true" : "false"
+          });
+          if (deps.config.observe) {
+            logger.info("[gateway-security] complexity would_reject (observe)", {
+              complexity,
+              maxCost: deps.config.maxCost
+            });
+            return;
+          }
+          setResult([
+            new GraphQLError(`Query too expensive (cost ${complexity} > limit ${deps.config.maxCost})`, {
+              extensions: {
+                code: "COMPLEXITY_TOO_HIGH",
+                cost: complexity,
+                maxCost: deps.config.maxCost
+              }
+            })
+          ]);
+        }
+      } catch (err) {
+        const e = err instanceof Error ? err : new Error(String(err));
+        logComplexityFailure(e);
+      }
+    }, "onValidate")
+  };
+}, "createQueryComplexityPlugin");
+
+// src/gateway/security/plugins/rate-limit.ts
+var keyFor = /* @__PURE__ */ __name((prefix, tier, identity) => `rl:${prefix}:${tier}:${identity}`, "keyFor");
+var stamp = /* @__PURE__ */ __name(() => Date.now(), "stamp");
+var checkRateLimit = /* @__PURE__ */ __name(async (deps, actor) => {
+  const tier = deps.config.tiers[actor.tier];
+  const metrics2 = getMetrics();
+  const gateway = deps.config.keyPrefix;
+  if (tier.points === Number.MAX_SAFE_INTEGER) {
+    metrics2.rateLimit.inc({
+      gateway,
+      tier: actor.tier,
+      decision: "allowed"
+    });
+    return {
+      allowed: true,
+      remaining: Number.MAX_SAFE_INTEGER,
+      resetAtMs: 0,
+      limit: tier.points
+    };
+  }
+  const key = keyFor(deps.config.keyPrefix, actor.tier, actor.identity);
+  const limit = tier.points + tier.burst;
+  try {
+    const count = await deps.valkey.incrBy(key, 1);
+    if (count === 1) {
+      await deps.valkey.expire(key, tier.duration);
+    }
+    const ttl = await deps.valkey.ttl(key);
+    const resetAtMs = stamp() + Math.max(0, ttl) * 1e3;
+    if (count > limit) {
+      metrics2.rateLimit.inc({
+        gateway,
+        tier: actor.tier,
+        decision: deps.config.observeOnly ? "observed_reject" : "rejected"
+      });
+      return {
+        allowed: false,
+        remaining: 0,
+        resetAtMs,
+        limit
+      };
+    }
+    metrics2.rateLimit.inc({
+      gateway,
+      tier: actor.tier,
+      decision: "allowed"
+    });
+    return {
+      allowed: true,
+      remaining: Math.max(0, limit - count),
+      resetAtMs,
+      limit
+    };
+  } catch (err) {
+    const e = err instanceof Error ? err : new Error(String(err));
+    logger.warn("[gateway-security] rate-limit valkey error \u2014 fail-open", {
+      key,
+      error: e.message
+    });
+    metrics2.valkeyFailover.inc({
+      gateway
+    });
+    if (deps.config.failClosed) {
+      metrics2.rateLimit.inc({
+        gateway,
+        tier: actor.tier,
+        decision: "rejected"
+      });
+      return {
+        allowed: false,
+        remaining: 0,
+        resetAtMs: stamp() + tier.duration * 1e3,
+        limit
+      };
+    }
+    metrics2.rateLimit.inc({
+      gateway,
+      tier: actor.tier,
+      decision: "allowed"
+    });
+    return {
+      allowed: true,
+      remaining: -1,
+      resetAtMs: 0,
+      limit
+    };
+  }
+}, "checkRateLimit");
+var createRateLimitPlugin = /* @__PURE__ */ __name((deps) => {
+  return {
+    onRequest: /* @__PURE__ */ __name(async ({ request, fetchAPI, endResponse }) => {
+      const actor = resolveActor((name) => request.headers.get(name));
+      const result = await checkRateLimit(deps, actor);
+      request.__rateLimitResult = result;
+      request.__rateLimitActor = actor;
+      if (!result.allowed) {
+        if (deps.config.observeOnly) {
+          logger.info("[gateway-security] rate-limit would_reject (observe)", {
+            tier: actor.tier,
+            identity: actor.identity,
+            limit: result.limit
+          });
+          return;
+        }
+        const retryAfterS = Math.max(1, Math.ceil((result.resetAtMs - stamp()) / 1e3));
+        const body = JSON.stringify({
+          errors: [
+            {
+              message: "Rate limit exceeded",
+              extensions: {
+                code: "RATE_LIMITED",
+                resetAt: new Date(result.resetAtMs).toISOString()
+              }
+            }
+          ]
+        });
+        const response = new fetchAPI.Response(body, {
+          status: 429,
+          headers: {
+            "content-type": "application/json",
+            "retry-after": String(retryAfterS),
+            "x-ratelimit-limit": String(result.limit),
+            "x-ratelimit-remaining": "0",
+            "x-ratelimit-reset": String(Math.floor(result.resetAtMs / 1e3))
+          }
+        });
+        endResponse(response);
+      }
+    }, "onRequest"),
+    onResponse: /* @__PURE__ */ __name(({ request, response }) => {
+      const stash = request.__rateLimitResult;
+      if (!stash) return;
+      response.headers.set("x-ratelimit-limit", String(stash.limit));
+      response.headers.set("x-ratelimit-remaining", String(Math.max(0, stash.remaining)));
+      if (stash.resetAtMs > 0) {
+        response.headers.set("x-ratelimit-reset", String(Math.floor(stash.resetAtMs / 1e3)));
+      }
+    }, "onResponse")
+  };
+}, "createRateLimitPlugin");
+
+// src/gateway/security/plugins/index.ts
+var buildSecurityPlugins = /* @__PURE__ */ __name(async (options) => {
+  if (!options.enabled) {
+    logger.warn("[gateway-security] SECURITY_PLUGINS_ENABLED=false \u2014 plugins disabled", {
+      gatewayName: options.gatewayName
+    });
+    return [];
+  }
+  await initializeMetrics();
+  const valkey = await initializeSecurityValkey(options.gatewayName);
+  const plugins = [];
+  const otelPlugin = await createOtelPlugin(options.otel);
+  plugins.push(otelPlugin);
+  const armorPlugins = await createArmorPlugins(options.armor);
+  plugins.push(...armorPlugins);
+  if (options.queryComplexity.enabled) {
+    plugins.push(createQueryComplexityPlugin({
+      config: options.queryComplexity
+    }));
+  }
+  plugins.push(createRateLimitPlugin({
+    valkey,
+    config: options.rateLimit
+  }));
+  plugins.push(createOperationTimeoutPlugin({
+    config: options.operationTimeout
+  }));
+  logger.info("[gateway-security] plugins wired", {
+    gatewayName: options.gatewayName,
+    count: plugins.length,
+    observe: {
+      armor: options.armor.observe,
+      complexity: options.queryComplexity.observe,
+      rateLimit: options.rateLimit.observeOnly
+    },
+    enabled: {
+      complexity: options.queryComplexity.enabled
+    }
+  });
+  return plugins;
+}, "buildSecurityPlugins");
+
+export { DEFAULT_ARMOR_CONFIG, DEFAULT_COST_MAP, DEFAULT_TIERS, MemoryValkey, __resetMetricsForTest, __setSecurityValkeyForTest, buildSecurityPlugins, checkRateLimit, createArmorPlugins, createOperationTimeoutPlugin, createOtelPlugin, createQueryComplexityPlugin, createRateLimitPlugin, getMetrics, getSecurityValkey, initializeMetrics, initializeOtel, initializeSecurityValkey, mergeCostMap, resolveActor, resolveSecurityOptionsFromEnv, resolveTiersFromEnv, scrapeMetrics, security_exports, shutdownOtel };
+//# sourceMappingURL=chunk-MLW2HPS5.js.map
+//# sourceMappingURL=chunk-MLW2HPS5.js.map