@devtune/ai-traffic 0.9.0 → 0.11.0

package/dist/vercel-oidc.js

@@ -0,0 +1,152 @@
+/**
+ * ABOUTME: Vercel OIDC credentials for ingest, used instead of an ingest key on Vercel.
+ * Filters the per-request token header and exchanges it for DevTune's audience with a cache.
+ */
+/** Vercel sets this on every request to a deployment that has OIDC enabled. */
+export const VERCEL_OIDC_TOKEN_HEADER = "x-vercel-oidc-token";
+/** Tells the ingest route which DevTune project's Vercel link to check the token against. */
+export const DEVTUNE_PROJECT_HEADER = "x-devtune-project";
+export const DEVTUNE_INGEST_AUDIENCE = "https://devtune.ai/ai-traffic-ingest";
+export const VERCEL_TOKEN_EXCHANGE_URL = "https://oidc.vercel.com/~token";
+const VERCEL_OIDC_ISSUER = "https://oidc.vercel.com";
+const MAX_TOKEN_LENGTH = 8_192;
+const TOKEN_EXCHANGE_TIMEOUT_MS = 5_000;
+const BASE64URL_SEGMENT = /^[A-Za-z0-9_-]+$/u;
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
+/** Tokens this close to expiry are neither captured, exchanged nor served from the cache. */
+export const TOKEN_EXPIRY_MARGIN_MS = 60_000;
+export function isDevTuneProjectId(value) {
+    return UUID_PATTERN.test(value);
+}
+/**
+ * Returns the token's expiry in milliseconds when the value looks like a live
+ * Vercel OIDC token, or null for anything else.
+ *
+ * The signature is not checked: the SDK has no way to, and the ingest route
+ * verifies it. This filter only keeps a client-supplied junk header, a token
+ * from another issuer or an expired token from replacing a good one.
+ */
+export function readVercelOidcTokenExpiry(value, nowMs) {
+    if (value.length > MAX_TOKEN_LENGTH) {
+        return null;
+    }
+    const segments = value.split(".");
+    if (segments.length !== 3 || !segments.every((segment) => BASE64URL_SEGMENT.test(segment))) {
+        return null;
+    }
+    const claims = decodeJsonSegment(segments[1] ?? "");
+    if (!claims ||
+        typeof claims.iss !== "string" ||
+        (claims.iss !== VERCEL_OIDC_ISSUER && !claims.iss.startsWith(`${VERCEL_OIDC_ISSUER}/`)) ||
+        typeof claims.owner_id !== "string" ||
+        typeof claims.project_id !== "string" ||
+        typeof claims.exp !== "number" ||
+        !Number.isFinite(claims.exp)) {
+        return null;
+    }
+    const expiresAtMs = claims.exp * 1000;
+    return expiresAtMs - nowMs > TOKEN_EXPIRY_MARGIN_MS ? expiresAtMs : null;
+}
+/**
+ * Thrown when Vercel answers an exchange but not with a usable token. Carries
+ * a fixed `kind` and the status, so callers can report the failure without
+ * reading any message text.
+ */
+export class VercelOidcExchangeError extends Error {
+    kind;
+    status;
+    constructor(kind, status) {
+        super(kind === "exchange_status"
+            ? `Vercel OIDC token exchange failed with status ${status}`
+            : "Vercel OIDC token exchange returned an unusable response");
+        this.kind = kind;
+        this.status = status;
+        this.name = "VercelOidcExchangeError";
+    }
+}
+/**
+ * Exchanges a deployment's Vercel OIDC token for one scoped to DevTune's
+ * ingest audience.
+ *
+ * Results are cached in memory by source token until their expiry, less the
+ * margin, and expired entries are dropped on every call, so the steady state
+ * is one entry per live source token. Callers that need the same token at once
+ * share one request. Vercel's answers are reported as a
+ * `VercelOidcExchangeError`; anything the fetch itself throws is passed on.
+ */
+export class VercelOidcTokenExchanger {
+    fetchImpl;
+    nowMs;
+    cache = new Map();
+    inFlight = new Map();
+    constructor(fetchImpl, nowMs) {
+        this.fetchImpl = fetchImpl;
+        this.nowMs = nowMs;
+    }
+    async exchange(sourceToken) {
+        const nowMs = this.nowMs();
+        for (const [key, entry] of this.cache) {
+            if (entry.usableUntilMs <= nowMs) {
+                this.cache.delete(key);
+            }
+        }
+        const cached = this.cache.get(sourceToken);
+        if (cached) {
+            return cached.token;
+        }
+        const pending = this.inFlight.get(sourceToken);
+        if (pending) {
+            return pending;
+        }
+        const request = this.requestExchange(sourceToken).finally(() => {
+            this.inFlight.delete(sourceToken);
+        });
+        this.inFlight.set(sourceToken, request);
+        return request;
+    }
+    async requestExchange(sourceToken) {
+        const response = await this.fetchImpl(VERCEL_TOKEN_EXCHANGE_URL, {
+            body: JSON.stringify({ token: sourceToken, aud: DEVTUNE_INGEST_AUDIENCE }),
+            headers: {
+                accept: "application/json",
+                "content-type": "application/json",
+            },
+            method: "POST",
+            signal: AbortSignal.timeout(TOKEN_EXCHANGE_TIMEOUT_MS),
+        });
+        if (!response.ok) {
+            throw new VercelOidcExchangeError("exchange_status", response.status);
+        }
+        const payload = await response.json().catch(() => null);
+        if (!isRecord(payload) ||
+            typeof payload.token !== "string" ||
+            payload.token.length === 0 ||
+            typeof payload.expiry !== "number" ||
+            !Number.isFinite(payload.expiry)) {
+            throw new VercelOidcExchangeError("exchange_response");
+        }
+        const usableUntilMs = payload.expiry * 1000 - TOKEN_EXPIRY_MARGIN_MS;
+        // A token that is already inside the margin would only be rejected at ingest.
+        if (usableUntilMs <= this.nowMs()) {
+            throw new VercelOidcExchangeError("exchange_response");
+        }
+        this.cache.set(sourceToken, { token: payload.token, usableUntilMs });
+        return payload.token;
+    }
+}
+function decodeJsonSegment(segment) {
+    try {
+        const base64 = segment.replace(/-/gu, "+").replace(/_/gu, "/");
+        const binary = atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, "="));
+        const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+        const value = JSON.parse(new TextDecoder().decode(bytes));
+        return isRecord(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+//# sourceMappingURL=vercel-oidc.js.map

package/dist/vercel-oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel-oidc.js","sourceRoot":"","sources":["../src/vercel-oidc.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D,6FAA6F;AAC7F,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAE1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,sCAAsC,CAAC;AAC9E,MAAM,CAAC,MAAM,yBAAyB,GAAG,gCAAgC,CAAC;AAE1E,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AACrD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,yBAAyB,GAAG,KAAK,CAAC;AACxC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAC9C,MAAM,YAAY,GAAG,kEAAkE,CAAC;AAExF,6FAA6F;AAC7F,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE7C,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,KAAa;IACpE,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEpD,IACE,CAAC,MAAM;QACP,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,CAAC,MAAM,CAAC,GAAG,KAAK,kBAAkB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,kBAAkB,GAAG,CAAC,CAAC;QACvF,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;IAEtC,OAAO,WAAW,GAAG,KAAK,GAAG,sBAAsB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3E,CAAC;AAID;;;;GAIG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAErC;IACA;IAFX,YACW,IAAmC,EACnC,MAAe;QAExB,KAAK,CACH,IAAI,KAAK,iBAAiB;YACxB,CAAC,CAAC,iDAAiD,MAAM,EAAE;YAC3D,CAAC,CAAC,0DAA0D,CAC/D,CAAC;QAPO,SAAI,GAAJ,IAAI,CAA+B;QACnC,WAAM,GAAN,MAAM,CAAS;QAOxB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAOD;;;;;;;;;GASG;AACH,MAAM,OAAO,wBAAwB;IAKhB;IACA;IALF,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC1C,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE/D,YACmB,SAAuB,EACvB,KAAmB;QADnB,cAAS,GAAT,SAAS,CAAc;QACvB,UAAK,GAAL,KAAK,CAAc;IACnC,CAAC;IAEJ,KAAK,CAAC,QAAQ,CAAC,WAAmB;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAE3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,EAAE,CAAC;gBACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAE3C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAE/C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAExC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,WAAmB;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,yBAAyB,EAAE;YAC/D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC;YAC1E,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACD,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,yBAAyB,CAAC;SACvD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAEjE,IACE,CAAC,QAAQ,CAAC,OAAO,CAAC;YAClB,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YACjC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAC1B,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;YAClC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAChC,CAAC;YACD,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,sBAAsB,CAAC;QAErE,8EAA8E;QAC9E,IAAI,aAAa,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QAErE,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAEnE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC"}

package/dist/version.d.ts

@@ -3,7 +3,7 @@
  * Lets DevTune tell a customer when their sensor has an upgrade available.
  */
 /** Must equal `version` in package.json; a unit test and the release check enforce it. */
-export declare const SDK_VERSION = "0.9.0";
+export declare const SDK_VERSION = "0.11.0";
 /** Sent on every ingest and registry request. Carries the version only, no visitor data. */
 export declare const SDK_VERSION_HEADER = "x-devtune-sdk-version";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,0FAA0F;AAC1F,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC,4FAA4F;AAC5F,eAAO,MAAM,kBAAkB,0BAA0B,CAAC"}
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,0FAA0F;AAC1F,eAAO,MAAM,WAAW,WAAW,CAAC;AAEpC,4FAA4F;AAC5F,eAAO,MAAM,kBAAkB,0BAA0B,CAAC"}

package/dist/version.js

@@ -3,7 +3,7 @@
  * Lets DevTune tell a customer when their sensor has an upgrade available.
  */
 /** Must equal `version` in package.json; a unit test and the release check enforce it. */
-export const SDK_VERSION = "0.9.0";
+export const SDK_VERSION = "0.11.0";
 /** Sent on every ingest and registry request. Carries the version only, no visitor data. */
 export const SDK_VERSION_HEADER = "x-devtune-sdk-version";
 //# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AAEnC,4FAA4F;AAC5F,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC"}
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC;AAEpC,4FAA4F;AAC5F,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devtune/ai-traffic",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "private": false,
   "description": "Filtered edge-push sensor for DevTune AI Traffic.",
   "license": "MIT",