@evalops/maestro 0.10.17 → 0.10.20

package/dist/server/scripted-scenario-runner.js

@@ -0,0 +1,190 @@
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { resolve } from "node:path";
+import { escapeXml } from "./junit-xml.js";
+export const SCRIPTED_SCENARIO_RESULT_SCHEMA = "evalops.maestro.scripted-scenario-result.v1";
+function toolCallStatements(scenario) {
+    const calls = [];
+    for (const frame of scenario.frames) {
+        for (const [statementIndex, statement] of frame.statements.entries()) {
+            if (statement.kind !== "tool_call")
+                continue;
+            calls.push({
+                ...statement,
+                frameIndex: frame.index,
+                statementIndex,
+            });
+        }
+    }
+    return calls;
+}
+function evidence(kind, id, source, label = `${kind}:${id}`) {
+    return [{ kind, id, source, label }];
+}
+function pass(assertion, message, assertionEvidence = []) {
+    return {
+        id: assertion.id,
+        kind: assertion.kind,
+        status: "pass",
+        severity: assertion.severity ?? "error",
+        message,
+        evidence: assertionEvidence,
+    };
+}
+function fail(assertion, message, assertionEvidence = []) {
+    return {
+        id: assertion.id,
+        kind: assertion.kind,
+        status: assertion.severity === "warning" ? "warn" : "fail",
+        severity: assertion.severity ?? "error",
+        message,
+        evidence: assertionEvidence,
+    };
+}
+function requireAssertionString(assertion, field, options = {}) {
+    const value = assertion[field];
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    return value.length > 0 || options.allowEmpty ? value : undefined;
+}
+function evaluateAssertion(assertion, scenario, baseDir) {
+    const toolCalls = toolCallStatements(scenario);
+    switch (assertion.kind) {
+        case "tool_called": {
+            const tool = requireAssertionString(assertion, "tool");
+            const toolCallId = requireAssertionString(assertion, "toolCallId");
+            if (!tool && !toolCallId) {
+                return fail(assertion, "tool_called requires tool or toolCallId.");
+            }
+            const matches = toolCalls.filter((call) => (tool === undefined || call.tool === tool) &&
+                (toolCallId === undefined || call.id === toolCallId));
+            return matches.length > 0
+                ? pass(assertion, `Matched ${matches.length} scripted tool call(s).`, matches.map((call) => ({
+                    kind: "tool_call",
+                    id: call.id ??
+                        `${scenario.id}:${call.frameIndex}:${call.statementIndex}`,
+                    source: "scenario",
+                    label: `${call.tool}:${call.frameIndex}.${call.statementIndex}`,
+                })))
+                : fail(assertion, "No scripted tool call matched.");
+        }
+        case "tool_not_called": {
+            const tool = requireAssertionString(assertion, "tool");
+            if (!tool) {
+                return fail(assertion, "tool_not_called requires tool.");
+            }
+            const matches = toolCalls.filter((call) => call.tool === tool);
+            return matches.length === 0
+                ? pass(assertion, `Tool ${tool} was not called.`)
+                : fail(assertion, `Tool ${tool} was called ${matches.length} time(s).`, matches.map((call) => ({
+                    kind: "tool_call",
+                    id: call.id ??
+                        `${scenario.id}:${call.frameIndex}:${call.statementIndex}`,
+                    source: "scenario",
+                    label: `${call.tool}:${call.frameIndex}.${call.statementIndex}`,
+                })));
+        }
+        case "file_exists": {
+            const path = requireAssertionString(assertion, "path");
+            if (!path) {
+                return fail(assertion, "file_exists requires path.");
+            }
+            const fullPath = resolve(baseDir, path);
+            const exists = existsSync(fullPath) && statSync(fullPath).isFile();
+            return exists
+                ? pass(assertion, `File exists: ${path}.`, evidence("file", path, "workspace"))
+                : fail(assertion, `File does not exist: ${path}.`);
+        }
+        case "file_contents": {
+            const path = requireAssertionString(assertion, "path");
+            if (!path) {
+                return fail(assertion, "file_contents requires path.");
+            }
+            const contains = requireAssertionString(assertion, "contains");
+            const equals = requireAssertionString(assertion, "equals", {
+                allowEmpty: true,
+            });
+            if (!contains && equals === undefined) {
+                return fail(assertion, "file_contents requires contains or equals.");
+            }
+            const fullPath = resolve(baseDir, path);
+            if (!existsSync(fullPath) || !statSync(fullPath).isFile()) {
+                return fail(assertion, `File does not exist: ${path}.`);
+            }
+            const content = readFileSync(fullPath, "utf8");
+            const matched = (contains !== undefined && content.includes(contains)) ||
+                (equals !== undefined && content === equals);
+            return matched
+                ? pass(assertion, `File contents matched: ${path}.`, evidence("file", path, "workspace"))
+                : fail(assertion, `File contents did not match: ${path}.`);
+        }
+        case "audit_event_emitted": {
+            const eventType = requireAssertionString(assertion, "eventType");
+            if (!eventType) {
+                return fail(assertion, "audit_event_emitted requires eventType.");
+            }
+            const events = scenario.metadata.auditEvents ?? [];
+            return events.includes(eventType)
+                ? pass(assertion, `Audit event present: ${eventType}.`, evidence("audit_event", eventType, "audit"))
+                : fail(assertion, `Audit event missing: ${eventType}.`);
+        }
+    }
+    const _exhaustive = assertion.kind;
+    return fail(assertion, `Unsupported scripted assertion kind: ${_exhaustive}`);
+}
+export function evaluateScriptedScenario(scenario, options = {}) {
+    const assertions = (scenario.assertions ?? []).map((assertion) => evaluateAssertion(assertion, scenario, options.baseDir ?? process.cwd()));
+    const failed = assertions.filter((assertion) => assertion.status === "fail");
+    const warnings = assertions.filter((assertion) => assertion.status === "warn");
+    const observedOutcome = failed.length > 0 ? "fail" : "pass";
+    return {
+        schemaVersion: SCRIPTED_SCENARIO_RESULT_SCHEMA,
+        scenarioSchemaVersion: scenario.schemaVersion,
+        scenario: {
+            id: scenario.id,
+            description: scenario.description,
+            expectedOutcome: scenario.expectedOutcome ?? "pass",
+            observedOutcome,
+        },
+        run: {
+            scenarioId: scenario.id,
+            replay: true,
+            frames: scenario.frames.length,
+            toolCalls: toolCallStatements(scenario).length,
+            auditEvents: scenario.metadata.auditEvents ?? [],
+        },
+        counts: {
+            assertions: assertions.length,
+            passed: assertions.filter((assertion) => assertion.status === "pass")
+                .length,
+            failed: failed.length,
+            warnings: warnings.length,
+        },
+        assertions,
+    };
+}
+export function scriptedScenarioResultToJunit(result) {
+    const outcomeMatches = result.scenario.observedOutcome === result.scenario.expectedOutcome;
+    const failures = result.assertions.filter((assertion) => assertion.status === "fail");
+    const testcases = result.assertions
+        .map((assertion) => {
+        const failure = !outcomeMatches && assertion.status === "fail"
+            ? `\n\t\t<failure message="${escapeXml(assertion.message)}">${escapeXml(JSON.stringify(assertion.evidence))}</failure>\n\t`
+            : "";
+        const expectedFailureOutput = outcomeMatches && assertion.status === "fail"
+            ? `\n\t\t<system-out>${escapeXml([
+                `Expected failing assertion observed: ${assertion.message}`,
+                JSON.stringify(assertion.evidence),
+            ].join("\n"))}</system-out>\n\t`
+            : "";
+        return `\t<testcase classname="${escapeXml(result.scenario.id)}" name="${escapeXml(assertion.id)}">${failure}${expectedFailureOutput}</testcase>`;
+    })
+        .join("\n");
+    const outcomeFailure = !outcomeMatches && failures.length === 0
+        ? `\t<testcase classname="${escapeXml(result.scenario.id)}" name="scenario-outcome">\n\t\t<failure message="${escapeXml(`Observed outcome ${result.scenario.observedOutcome}; expected ${result.scenario.expectedOutcome}.`)}"></failure>\n\t</testcase>\n`
+        : "";
+    const failureCount = outcomeMatches ? 0 : Math.max(1, failures.length);
+    const testCount = result.counts.assertions + (outcomeFailure ? 1 : 0);
+    return `<?xml version="1.0" encoding="UTF-8"?>\n<testsuite name="${escapeXml(result.scenario.id)}" tests="${testCount}" failures="${failureCount}" warnings="${result.counts.warnings}">\n${outcomeFailure}${testcases}\n</testsuite>\n`;
+}
+//# sourceMappingURL=scripted-scenario-runner.js.map

package/dist/server/scripted-scenario-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scripted-scenario-runner.js","sourceRoot":"","sources":["../../src/server/scripted-scenario-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,MAAM,CAAC,MAAM,+BAA+B,GAC3C,6CAA6C,CAAC;AA6C/C,SAAS,kBAAkB,CAAC,QAAiC;IAM5D,MAAM,KAAK,GAKP,EAAE,CAAC;IACP,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YACtE,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW;gBAAE,SAAS;YAC7C,KAAK,CAAC,IAAI,CAAC;gBACV,GAAG,SAAS;gBACZ,UAAU,EAAE,KAAK,CAAC,KAAK;gBACvB,cAAc;aACd,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAChB,IAAY,EACZ,EAAU,EACV,MAAmD,EACnD,KAAK,GAAG,GAAG,IAAI,IAAI,EAAE,EAAE;IAEvB,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,IAAI,CACZ,SAA2C,EAC3C,OAAe,EACf,oBAAyD,EAAE;IAE3D,OAAO;QACN,EAAE,EAAE,SAAS,CAAC,EAAE;QAChB,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,OAAO;QACvC,OAAO;QACP,QAAQ,EAAE,iBAAiB;KAC3B,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CACZ,SAA2C,EAC3C,OAAe,EACf,oBAAyD,EAAE;IAE3D,OAAO;QACN,EAAE,EAAE,SAAS,CAAC,EAAE;QAChB,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,MAAM,EAAE,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC1D,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,OAAO;QACvC,OAAO;QACP,QAAQ,EAAE,iBAAiB;KAC3B,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC9B,SAA2C,EAC3C,KAA2E,EAC3E,UAAoC,EAAE;IAEtC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AAED,SAAS,iBAAiB,CACzB,SAA2C,EAC3C,QAAiC,EACjC,OAAe;IAEf,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC/C,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,aAAa,CAAC,CAAC,CAAC;YACpB,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACvD,MAAM,UAAU,GAAG,sBAAsB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YACnE,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,SAAS,EAAE,0CAA0C,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAC/B,CAAC,IAAI,EAAE,EAAE,CACR,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;gBAC1C,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,EAAE,KAAK,UAAU,CAAC,CACrD,CAAC;YACF,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC,IAAI,CACJ,SAAS,EACT,WAAW,OAAO,CAAC,MAAM,yBAAyB,EAClD,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACtB,IAAI,EAAE,WAAW;oBACjB,EAAE,EACD,IAAI,CAAC,EAAE;wBACP,GAAG,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,cAAc,EAAE;oBAC3D,MAAM,EAAE,UAAU;oBAClB,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,cAAc,EAAE;iBAC/D,CAAC,CAAC,CACH;gBACF,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACxB,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAC/D,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;gBAC1B,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,IAAI,kBAAkB,CAAC;gBACjD,CAAC,CAAC,IAAI,CACJ,SAAS,EACT,QAAQ,IAAI,eAAe,OAAO,CAAC,MAAM,WAAW,EACpD,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACtB,IAAI,EAAE,WAAW;oBACjB,EAAE,EACD,IAAI,CAAC,EAAE;wBACP,GAAG,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,cAAc,EAAE;oBAC3D,MAAM,EAAE,UAAU;oBAClB,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,cAAc,EAAE;iBAC/D,CAAC,CAAC,CACH,CAAC;QACL,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACpB,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;YACnE,OAAO,MAAM;gBACZ,CAAC,CAAC,IAAI,CACJ,SAAS,EACT,gBAAgB,IAAI,GAAG,EACvB,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CACnC;gBACF,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,IAAI,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,EAAE,QAAQ,EAAE;gBAC1D,UAAU,EAAE,IAAI;aAChB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO,IAAI,CAAC,SAAS,EAAE,4CAA4C,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,IAAI,GAAG,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,OAAO,GACZ,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACtD,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC;YAC9C,OAAO,OAAO;gBACb,CAAC,CAAC,IAAI,CACJ,SAAS,EACT,0BAA0B,IAAI,GAAG,EACjC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CACnC;gBACF,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,gCAAgC,IAAI,GAAG,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;YAC5B,MAAM,SAAS,GAAG,sBAAsB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACjE,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,OAAO,IAAI,CAAC,SAAS,EAAE,yCAAyC,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;YACnD,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAChC,CAAC,CAAC,IAAI,CACJ,SAAS,EACT,wBAAwB,SAAS,GAAG,EACpC,QAAQ,CAAC,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAC3C;gBACF,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,SAAS,GAAG,CAAC,CAAC;QAC1D,CAAC;IACF,CAAC;IACD,MAAM,WAAW,GAAU,SAAS,CAAC,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wCAAwC,WAAW,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,wBAAwB,CACvC,QAAiC,EACjC,UAAgC,EAAE;IAElC,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAChE,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CACxE,CAAC;IACF,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CACjC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAC1C,CAAC;IACF,MAAM,eAAe,GACpB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO;QACN,aAAa,EAAE,+BAA+B;QAC9C,qBAAqB,EAAE,QAAQ,CAAC,aAAa;QAC7C,QAAQ,EAAE;YACT,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,eAAe,EAAE,QAAQ,CAAC,eAAe,IAAI,MAAM;YACnD,eAAe;SACf;QACD,GAAG,EAAE;YACJ,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM;YAC9B,SAAS,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,MAAM;YAC9C,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE;SAChD;QACD,MAAM,EAAE;YACP,UAAU,EAAE,UAAU,CAAC,MAAM;YAC7B,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC;iBACnE,MAAM;YACR,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,QAAQ,CAAC,MAAM;SACzB;QACD,UAAU;KACV,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC5C,MAAiC;IAEjC,MAAM,cAAc,GACnB,MAAM,CAAC,QAAQ,CAAC,eAAe,KAAK,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;IACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CACxC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAC1C,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU;SACjC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,OAAO,GACZ,CAAC,cAAc,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM;YAC7C,CAAC,CAAC,2BAA2B,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,SAAS,CACrE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAClC,gBAAgB;YAClB,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,qBAAqB,GAC1B,cAAc,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM;YAC5C,CAAC,CAAC,qBAAqB,SAAS,CAC9B;gBACC,wCAAwC,SAAS,CAAC,OAAO,EAAE;gBAC3D,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC;aAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,mBAAmB;YACrB,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,0BAA0B,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,OAAO,GAAG,qBAAqB,aAAa,CAAC;IACnJ,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,cAAc,GACnB,CAAC,cAAc,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QACvC,CAAC,CAAC,0BAA0B,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,qDAAqD,SAAS,CACrH,oBAAoB,MAAM,CAAC,QAAQ,CAAC,eAAe,cAAc,MAAM,CAAC,QAAQ,CAAC,eAAe,GAAG,CACnG,+BAA+B;QACjC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,4DAA4D,SAAS,CAC3E,MAAM,CAAC,QAAQ,CAAC,EAAE,CAClB,YAAY,SAAS,eAAe,YAAY,eAAe,MAAM,CAAC,MAAM,CAAC,QAAQ,OAAO,cAAc,GAAG,SAAS,kBAAkB,CAAC;AAC3I,CAAC","sourcesContent":["import { existsSync, readFileSync, statSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport type {\n\tMaestroScenarioOutcome,\n\tMaestroScenarioSeverity,\n\tMaestroScriptedScenario,\n\tMaestroScriptedScenarioAssertion,\n\tMaestroScriptedScenarioAssertionKind,\n\tMaestroScriptedStatement,\n} from \"@evalops/contracts\";\nimport { escapeXml } from \"./junit-xml.js\";\n\nexport const SCRIPTED_SCENARIO_RESULT_SCHEMA =\n\t\"evalops.maestro.scripted-scenario-result.v1\";\n\nexport type ScriptedScenarioAssertionStatus = \"pass\" | \"fail\" | \"warn\";\n\nexport interface ScriptedScenarioAssertionEvidence {\n\tkind: string;\n\tid: string;\n\tsource: \"scenario\" | \"workspace\" | \"audit\";\n\tlabel: string;\n}\n\nexport interface ScriptedScenarioAssertionResult {\n\tid: string;\n\tkind: MaestroScriptedScenarioAssertionKind;\n\tstatus: ScriptedScenarioAssertionStatus;\n\tseverity: MaestroScenarioSeverity;\n\tmessage: string;\n\tevidence: ScriptedScenarioAssertionEvidence[];\n}\n\nexport interface ScriptedScenarioRunResult {\n\tschemaVersion: typeof SCRIPTED_SCENARIO_RESULT_SCHEMA;\n\tscenarioSchemaVersion: MaestroScriptedScenario[\"schemaVersion\"];\n\tscenario: {\n\t\tid: string;\n\t\tdescription: string;\n\t\texpectedOutcome: MaestroScenarioOutcome;\n\t\tobservedOutcome: MaestroScenarioOutcome;\n\t};\n\trun: {\n\t\tscenarioId: string;\n\t\treplay: true;\n\t\tframes: number;\n\t\ttoolCalls: number;\n\t\tauditEvents: string[];\n\t};\n\tcounts: {\n\t\tassertions: number;\n\t\tpassed: number;\n\t\tfailed: number;\n\t\twarnings: number;\n\t};\n\tassertions: ScriptedScenarioAssertionResult[];\n}\n\nfunction toolCallStatements(scenario: MaestroScriptedScenario): Array<\n\tExtract<MaestroScriptedStatement, { kind: \"tool_call\" }> & {\n\t\tframeIndex: number;\n\t\tstatementIndex: number;\n\t}\n> {\n\tconst calls: Array<\n\t\tExtract<MaestroScriptedStatement, { kind: \"tool_call\" }> & {\n\t\t\tframeIndex: number;\n\t\t\tstatementIndex: number;\n\t\t}\n\t> = [];\n\tfor (const frame of scenario.frames) {\n\t\tfor (const [statementIndex, statement] of frame.statements.entries()) {\n\t\t\tif (statement.kind !== \"tool_call\") continue;\n\t\t\tcalls.push({\n\t\t\t\t...statement,\n\t\t\t\tframeIndex: frame.index,\n\t\t\t\tstatementIndex,\n\t\t\t});\n\t\t}\n\t}\n\treturn calls;\n}\n\nfunction evidence(\n\tkind: string,\n\tid: string,\n\tsource: ScriptedScenarioAssertionEvidence[\"source\"],\n\tlabel = `${kind}:${id}`,\n): ScriptedScenarioAssertionEvidence[] {\n\treturn [{ kind, id, source, label }];\n}\n\nfunction pass(\n\tassertion: MaestroScriptedScenarioAssertion,\n\tmessage: string,\n\tassertionEvidence: ScriptedScenarioAssertionEvidence[] = [],\n): ScriptedScenarioAssertionResult {\n\treturn {\n\t\tid: assertion.id,\n\t\tkind: assertion.kind,\n\t\tstatus: \"pass\",\n\t\tseverity: assertion.severity ?? \"error\",\n\t\tmessage,\n\t\tevidence: assertionEvidence,\n\t};\n}\n\nfunction fail(\n\tassertion: MaestroScriptedScenarioAssertion,\n\tmessage: string,\n\tassertionEvidence: ScriptedScenarioAssertionEvidence[] = [],\n): ScriptedScenarioAssertionResult {\n\treturn {\n\t\tid: assertion.id,\n\t\tkind: assertion.kind,\n\t\tstatus: assertion.severity === \"warning\" ? \"warn\" : \"fail\",\n\t\tseverity: assertion.severity ?? \"error\",\n\t\tmessage,\n\t\tevidence: assertionEvidence,\n\t};\n}\n\nfunction requireAssertionString(\n\tassertion: MaestroScriptedScenarioAssertion,\n\tfield: \"tool\" | \"toolCallId\" | \"path\" | \"contains\" | \"equals\" | \"eventType\",\n\toptions: { allowEmpty?: boolean } = {},\n): string | undefined {\n\tconst value = assertion[field];\n\tif (typeof value !== \"string\") {\n\t\treturn undefined;\n\t}\n\treturn value.length > 0 || options.allowEmpty ? value : undefined;\n}\n\nfunction evaluateAssertion(\n\tassertion: MaestroScriptedScenarioAssertion,\n\tscenario: MaestroScriptedScenario,\n\tbaseDir: string,\n): ScriptedScenarioAssertionResult {\n\tconst toolCalls = toolCallStatements(scenario);\n\tswitch (assertion.kind) {\n\t\tcase \"tool_called\": {\n\t\t\tconst tool = requireAssertionString(assertion, \"tool\");\n\t\t\tconst toolCallId = requireAssertionString(assertion, \"toolCallId\");\n\t\t\tif (!tool && !toolCallId) {\n\t\t\t\treturn fail(assertion, \"tool_called requires tool or toolCallId.\");\n\t\t\t}\n\t\t\tconst matches = toolCalls.filter(\n\t\t\t\t(call) =>\n\t\t\t\t\t(tool === undefined || call.tool === tool) &&\n\t\t\t\t\t(toolCallId === undefined || call.id === toolCallId),\n\t\t\t);\n\t\t\treturn matches.length > 0\n\t\t\t\t? pass(\n\t\t\t\t\t\tassertion,\n\t\t\t\t\t\t`Matched ${matches.length} scripted tool call(s).`,\n\t\t\t\t\t\tmatches.map((call) => ({\n\t\t\t\t\t\t\tkind: \"tool_call\",\n\t\t\t\t\t\t\tid:\n\t\t\t\t\t\t\t\tcall.id ??\n\t\t\t\t\t\t\t\t`${scenario.id}:${call.frameIndex}:${call.statementIndex}`,\n\t\t\t\t\t\t\tsource: \"scenario\",\n\t\t\t\t\t\t\tlabel: `${call.tool}:${call.frameIndex}.${call.statementIndex}`,\n\t\t\t\t\t\t})),\n\t\t\t\t\t)\n\t\t\t\t: fail(assertion, \"No scripted tool call matched.\");\n\t\t}\n\t\tcase \"tool_not_called\": {\n\t\t\tconst tool = requireAssertionString(assertion, \"tool\");\n\t\t\tif (!tool) {\n\t\t\t\treturn fail(assertion, \"tool_not_called requires tool.\");\n\t\t\t}\n\t\t\tconst matches = toolCalls.filter((call) => call.tool === tool);\n\t\t\treturn matches.length === 0\n\t\t\t\t? pass(assertion, `Tool ${tool} was not called.`)\n\t\t\t\t: fail(\n\t\t\t\t\t\tassertion,\n\t\t\t\t\t\t`Tool ${tool} was called ${matches.length} time(s).`,\n\t\t\t\t\t\tmatches.map((call) => ({\n\t\t\t\t\t\t\tkind: \"tool_call\",\n\t\t\t\t\t\t\tid:\n\t\t\t\t\t\t\t\tcall.id ??\n\t\t\t\t\t\t\t\t`${scenario.id}:${call.frameIndex}:${call.statementIndex}`,\n\t\t\t\t\t\t\tsource: \"scenario\",\n\t\t\t\t\t\t\tlabel: `${call.tool}:${call.frameIndex}.${call.statementIndex}`,\n\t\t\t\t\t\t})),\n\t\t\t\t\t);\n\t\t}\n\t\tcase \"file_exists\": {\n\t\t\tconst path = requireAssertionString(assertion, \"path\");\n\t\t\tif (!path) {\n\t\t\t\treturn fail(assertion, \"file_exists requires path.\");\n\t\t\t}\n\t\t\tconst fullPath = resolve(baseDir, path);\n\t\t\tconst exists = existsSync(fullPath) && statSync(fullPath).isFile();\n\t\t\treturn exists\n\t\t\t\t? pass(\n\t\t\t\t\t\tassertion,\n\t\t\t\t\t\t`File exists: ${path}.`,\n\t\t\t\t\t\tevidence(\"file\", path, \"workspace\"),\n\t\t\t\t\t)\n\t\t\t\t: fail(assertion, `File does not exist: ${path}.`);\n\t\t}\n\t\tcase \"file_contents\": {\n\t\t\tconst path = requireAssertionString(assertion, \"path\");\n\t\t\tif (!path) {\n\t\t\t\treturn fail(assertion, \"file_contents requires path.\");\n\t\t\t}\n\t\t\tconst contains = requireAssertionString(assertion, \"contains\");\n\t\t\tconst equals = requireAssertionString(assertion, \"equals\", {\n\t\t\t\tallowEmpty: true,\n\t\t\t});\n\t\t\tif (!contains && equals === undefined) {\n\t\t\t\treturn fail(assertion, \"file_contents requires contains or equals.\");\n\t\t\t}\n\t\t\tconst fullPath = resolve(baseDir, path);\n\t\t\tif (!existsSync(fullPath) || !statSync(fullPath).isFile()) {\n\t\t\t\treturn fail(assertion, `File does not exist: ${path}.`);\n\t\t\t}\n\t\t\tconst content = readFileSync(fullPath, \"utf8\");\n\t\t\tconst matched =\n\t\t\t\t(contains !== undefined && content.includes(contains)) ||\n\t\t\t\t(equals !== undefined && content === equals);\n\t\t\treturn matched\n\t\t\t\t? pass(\n\t\t\t\t\t\tassertion,\n\t\t\t\t\t\t`File contents matched: ${path}.`,\n\t\t\t\t\t\tevidence(\"file\", path, \"workspace\"),\n\t\t\t\t\t)\n\t\t\t\t: fail(assertion, `File contents did not match: ${path}.`);\n\t\t}\n\t\tcase \"audit_event_emitted\": {\n\t\t\tconst eventType = requireAssertionString(assertion, \"eventType\");\n\t\t\tif (!eventType) {\n\t\t\t\treturn fail(assertion, \"audit_event_emitted requires eventType.\");\n\t\t\t}\n\t\t\tconst events = scenario.metadata.auditEvents ?? [];\n\t\t\treturn events.includes(eventType)\n\t\t\t\t? pass(\n\t\t\t\t\t\tassertion,\n\t\t\t\t\t\t`Audit event present: ${eventType}.`,\n\t\t\t\t\t\tevidence(\"audit_event\", eventType, \"audit\"),\n\t\t\t\t\t)\n\t\t\t\t: fail(assertion, `Audit event missing: ${eventType}.`);\n\t\t}\n\t}\n\tconst _exhaustive: never = assertion.kind;\n\treturn fail(assertion, `Unsupported scripted assertion kind: ${_exhaustive}`);\n}\n\nexport function evaluateScriptedScenario(\n\tscenario: MaestroScriptedScenario,\n\toptions: { baseDir?: string } = {},\n): ScriptedScenarioRunResult {\n\tconst assertions = (scenario.assertions ?? []).map((assertion) =>\n\t\tevaluateAssertion(assertion, scenario, options.baseDir ?? process.cwd()),\n\t);\n\tconst failed = assertions.filter((assertion) => assertion.status === \"fail\");\n\tconst warnings = assertions.filter(\n\t\t(assertion) => assertion.status === \"warn\",\n\t);\n\tconst observedOutcome: MaestroScenarioOutcome =\n\t\tfailed.length > 0 ? \"fail\" : \"pass\";\n\treturn {\n\t\tschemaVersion: SCRIPTED_SCENARIO_RESULT_SCHEMA,\n\t\tscenarioSchemaVersion: scenario.schemaVersion,\n\t\tscenario: {\n\t\t\tid: scenario.id,\n\t\t\tdescription: scenario.description,\n\t\t\texpectedOutcome: scenario.expectedOutcome ?? \"pass\",\n\t\t\tobservedOutcome,\n\t\t},\n\t\trun: {\n\t\t\tscenarioId: scenario.id,\n\t\t\treplay: true,\n\t\t\tframes: scenario.frames.length,\n\t\t\ttoolCalls: toolCallStatements(scenario).length,\n\t\t\tauditEvents: scenario.metadata.auditEvents ?? [],\n\t\t},\n\t\tcounts: {\n\t\t\tassertions: assertions.length,\n\t\t\tpassed: assertions.filter((assertion) => assertion.status === \"pass\")\n\t\t\t\t.length,\n\t\t\tfailed: failed.length,\n\t\t\twarnings: warnings.length,\n\t\t},\n\t\tassertions,\n\t};\n}\n\nexport function scriptedScenarioResultToJunit(\n\tresult: ScriptedScenarioRunResult,\n): string {\n\tconst outcomeMatches =\n\t\tresult.scenario.observedOutcome === result.scenario.expectedOutcome;\n\tconst failures = result.assertions.filter(\n\t\t(assertion) => assertion.status === \"fail\",\n\t);\n\tconst testcases = result.assertions\n\t\t.map((assertion) => {\n\t\t\tconst failure =\n\t\t\t\t!outcomeMatches && assertion.status === \"fail\"\n\t\t\t\t\t? `\\n\\t\\t<failure message=\"${escapeXml(assertion.message)}\">${escapeXml(\n\t\t\t\t\t\t\tJSON.stringify(assertion.evidence),\n\t\t\t\t\t\t)}</failure>\\n\\t`\n\t\t\t\t\t: \"\";\n\t\t\tconst expectedFailureOutput =\n\t\t\t\toutcomeMatches && assertion.status === \"fail\"\n\t\t\t\t\t? `\\n\\t\\t<system-out>${escapeXml(\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t`Expected failing assertion observed: ${assertion.message}`,\n\t\t\t\t\t\t\t\tJSON.stringify(assertion.evidence),\n\t\t\t\t\t\t\t].join(\"\\n\"),\n\t\t\t\t\t\t)}</system-out>\\n\\t`\n\t\t\t\t\t: \"\";\n\t\t\treturn `\\t<testcase classname=\"${escapeXml(result.scenario.id)}\" name=\"${escapeXml(assertion.id)}\">${failure}${expectedFailureOutput}</testcase>`;\n\t\t})\n\t\t.join(\"\\n\");\n\tconst outcomeFailure =\n\t\t!outcomeMatches && failures.length === 0\n\t\t\t? `\\t<testcase classname=\"${escapeXml(result.scenario.id)}\" name=\"scenario-outcome\">\\n\\t\\t<failure message=\"${escapeXml(\n\t\t\t\t\t`Observed outcome ${result.scenario.observedOutcome}; expected ${result.scenario.expectedOutcome}.`,\n\t\t\t\t)}\"></failure>\\n\\t</testcase>\\n`\n\t\t\t: \"\";\n\tconst failureCount = outcomeMatches ? 0 : Math.max(1, failures.length);\n\tconst testCount = result.counts.assertions + (outcomeFailure ? 1 : 0);\n\treturn `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\\n<testsuite name=\"${escapeXml(\n\t\tresult.scenario.id,\n\t)}\" tests=\"${testCount}\" failures=\"${failureCount}\" warnings=\"${result.counts.warnings}\">\\n${outcomeFailure}${testcases}\\n</testsuite>\\n`;\n}\n"]}

package/dist/server/server-middlewares.d.ts

@@ -1,6 +1,9 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { Middleware } from "./middleware.js";
 import type { RateLimiter, TieredRateLimiter } from "./rate-limiter.js";
+interface AuthBoundaryOptions {
+    exemptPaths?: readonly string[];
+}
 export declare function createLoadSheddingMiddleware(corsHeaders: Record<string, string>): Middleware;
 export declare function createRateLimitMiddleware(rateLimiter: RateLimiter, corsHeaders: Record<string, string>, trustProxy?: boolean, trustProxyHops?: number): Middleware;
 /**
@@ -9,8 +12,8 @@ export declare function createRateLimitMiddleware(rateLimiter: RateLimiter, cors
  */
 export declare function createTieredRateLimitMiddleware(rateLimiter: TieredRateLimiter, corsHeaders: Record<string, string>, trustProxy?: boolean, trustProxyHops?: number): Middleware;
 export declare function createCorsMiddleware(corsHeaders: Record<string, string>): Middleware;
-export declare function createAuthMiddleware(apiKey: string | null, corsHeaders: Record<string, string>, requireApiKey?: boolean): Middleware;
-export declare function createCsrfMiddleware(token: string | null, corsHeaders: Record<string, string>, enabled?: boolean): Middleware;
+export declare function createAuthMiddleware(apiKey: string | null, corsHeaders: Record<string, string>, requireApiKey?: boolean, options?: AuthBoundaryOptions): Middleware;
+export declare function createCsrfMiddleware(token: string | null, corsHeaders: Record<string, string>, enabled?: boolean, options?: AuthBoundaryOptions): Middleware;
 export declare function createRouterMiddleware(routerHandler: (req: IncomingMessage, res: ServerResponse, pathname: string) => Promise<void> | void): Middleware;
 export interface IpAccessRule {
     /** CIDR notation (e.g., "192.168.1.0/24") or single IP */
@@ -38,4 +41,5 @@ export declare function checkIpAccess(ip: string, config: IpAccessConfig): {
  * getConfig is called per-request to allow dynamic config updates.
  */
 export declare function createIpAccessMiddleware(getConfig: () => IpAccessConfig | null, corsHeaders: Record<string, string>, trustProxy?: boolean, trustProxyHops?: number): Middleware;
+export {};
 //# sourceMappingURL=server-middlewares.d.ts.map

package/dist/server/server-middlewares.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-middlewares.d.ts","sourceRoot":"","sources":["../../src/server/server-middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAgBxE,wBAAgB,4BAA4B,CAC3C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,UAAU,CAyBZ;AA6CD,wBAAgB,yBAAyB,CACxC,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,UAAU,UAAQ,EAClB,cAAc,SAAI,GAChB,UAAU,CAoCZ;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAC9C,WAAW,EAAE,iBAAiB,EAC9B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,UAAU,UAAQ,EAClB,cAAc,SAAI,GAChB,UAAU,CAsCZ;AAED,wBAAgB,oBAAoB,CACnC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,UAAU,CASZ;AAED,wBAAgB,oBAAoB,CACnC,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,aAAa,UAAQ,GACnB,UAAU,CAyDZ;AAED,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,OAAO,UAAQ,GACb,UAAU,CAgCZ;AAED,wBAAgB,sBAAsB,CACrC,aAAa,EAAE,CACd,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,MAAM,KACZ,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GACvB,UAAU,CASZ;AAMD,MAAM,WAAW,YAAY;IAC5B,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC9B,yCAAyC;IACzC,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC;IAChC,iDAAiD;IACjD,KAAK,EAAE,YAAY,EAAE,CAAC;CACtB;AA8ED;;GAEG;AACH,wBAAgB,aAAa,CAC5B,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,cAAc,GACpB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,YAAY,CAAA;CAAE,CAWlD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACvC,SAAS,EAAE,MAAM,cAAc,GAAG,IAAI,EACtC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,UAAU,UAAQ,EAClB,cAAc,SAAI,GAChB,UAAU,CA6CZ"}
+{"version":3,"file":"server-middlewares.d.ts","sourceRoot":"","sources":["../../src/server/server-middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAKxE,UAAU,mBAAmB;IAC5B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAaD,wBAAgB,4BAA4B,CAC3C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,UAAU,CAyBZ;AA6CD,wBAAgB,yBAAyB,CACxC,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,UAAU,UAAQ,EAClB,cAAc,SAAI,GAChB,UAAU,CAoCZ;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAC9C,WAAW,EAAE,iBAAiB,EAC9B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,UAAU,UAAQ,EAClB,cAAc,SAAI,GAChB,UAAU,CAsCZ;AAED,wBAAgB,oBAAoB,CACnC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,UAAU,CASZ;AAED,wBAAgB,oBAAoB,CACnC,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,aAAa,UAAQ,EACrB,OAAO,GAAE,mBAAwB,GAC/B,UAAU,CA4DZ;AAED,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,OAAO,UAAQ,EACf,OAAO,GAAE,mBAAwB,GAC/B,UAAU,CAmCZ;AAED,wBAAgB,sBAAsB,CACrC,aAAa,EAAE,CACd,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,MAAM,KACZ,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GACvB,UAAU,CASZ;AAMD,MAAM,WAAW,YAAY;IAC5B,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC9B,yCAAyC;IACzC,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC;IAChC,iDAAiD;IACjD,KAAK,EAAE,YAAY,EAAE,CAAC;CACtB;AA8ED;;GAEG;AACH,wBAAgB,aAAa,CAC5B,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,cAAc,GACpB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,YAAY,CAAA;CAAE,CAWlD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACvC,SAAS,EAAE,MAAM,cAAc,GAAG,IAAI,EACtC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,UAAU,UAAQ,EAClB,cAAc,SAAI,GAChB,UAAU,CA6CZ"}

package/dist/server/server-middlewares.js

@@ -148,13 +148,16 @@ export function createCorsMiddleware(corsHeaders) {
         return next();
     };
 }
-export function createAuthMiddleware(apiKey, corsHeaders, requireApiKey = false) {
+export function createAuthMiddleware(apiKey, corsHeaders, requireApiKey = false, options = {}) {
     return async (req, res, next) => {
         const pathname = getPathname(req);
         const isApiRoute = pathname.startsWith("/api");
         const isDebugRoute = pathname.startsWith("/debug");
         const requiresAuthBoundary = isApiRoute || isDebugRoute;
         if (requiresAuthBoundary) {
+            if (options.exemptPaths?.includes(pathname)) {
+                return next();
+            }
             const missingKey = !apiKey || apiKey.length === 0;
             // No key provided
             if (missingKey) {
@@ -185,7 +188,7 @@ export function createAuthMiddleware(apiKey, corsHeaders, requireApiKey = false)
         return next();
     };
 }
-export function createCsrfMiddleware(token, corsHeaders, enabled = false) {
+export function createCsrfMiddleware(token, corsHeaders, enabled = false, options = {}) {
     if (!enabled || !token) {
         return (_req, _res, next) => next();
     }
@@ -198,6 +201,9 @@ export function createCsrfMiddleware(token, corsHeaders, enabled = false) {
         if (!pathname.startsWith("/api")) {
             return next();
         }
+        if (options.exemptPaths?.includes(pathname)) {
+            return next();
+        }
         const value = getRequestHeader(req, "x-composer-csrf", "x-maestro-csrf", "x-csrf-token", "x-xsrf-token");
         if (!value || !secureCompare(String(value), token)) {
             sendJson(res, 403, { error: "Forbidden: missing or invalid CSRF token" }, corsHeaders, req);

package/dist/server/server-middlewares.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-middlewares.js","sourceRoot":"","sources":["../../src/server/server-middlewares.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iCAAiC,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAGvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE9E,MAAM,MAAM,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAEpD,yCAAyC;AACzC,SAAS,WAAW,CAAC,GAAoB;IACxC,IAAI,CAAC;QACJ,sEAAsE;QACtE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC,QAAQ,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,GAAG,CAAC;IACZ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC3C,WAAmC;IAEnC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,qDAAqD;QACrD,qEAAqE;QACrE,+CAA+C;QAC/C,IACC,YAAY,EAAE;YACd,QAAQ,KAAK,UAAU;YACvB,QAAQ,KAAK,SAAS;YACtB,QAAQ,KAAK,cAAc,EAC1B,CAAC;YACF,4BAA4B;YAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBAClB,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,GAAG;gBAClB,GAAG,WAAW;aACd,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CACN,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,CACtE,CAAC;YACF,OAAO;QACR,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,EAAU;IAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,CAAC;AACX,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CACnB,GAAoB,EACpB,UAAmB,EACnB,cAAsB;IAEtB,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IAE/C,IAAI,UAAU,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YACnC,4DAA4D;YAC5D,wDAAwD;YACxD,kDAAkD;YAClD,yEAAyE;YACzE,6CAA6C;YAC7C,sEAAsE;YACtE,MAAM,GAAG,GAAG,SAAS;iBACnB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,OAAO,CAAC,CAAC;YAClB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,mEAAmE;gBACnE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC;gBACjE,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC;QACF,CAAC;IACF,CAAC;IAED,oEAAoE;IACpE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACxC,WAAwB,EACxB,WAAmC,EACnC,UAAU,GAAG,KAAK,EAClB,cAAc,GAAG,CAAC;IAElB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,+DAA+D;QAC/D,MAAM,aAAa,GAClB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAC3B,QAAQ,KAAK,cAAc;YAC3B,QAAQ,KAAK,UAAU,CAAC;QAEzB,IAAI,aAAa,EAAE,CAAC;YACnB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;YACxD,iEAAiE;YACjE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GACzC,MAAM,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAElC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBAClB,cAAc,EAAE,kBAAkB;oBAClC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE;oBACrC,uBAAuB,EAAE,GAAG;oBAC5B,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;oBACvD,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;oBAChE,GAAG,WAAW;iBACd,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CACN,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CACnE,CAAC;gBACF,OAAO;YACR,CAAC;YACD,qDAAqD;YACrD,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAC9C,WAA8B,EAC9B,WAAmC,EACnC,UAAU,GAAG,KAAK,EAClB,cAAc,GAAG,CAAC;IAElB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,+DAA+D;QAC/D,MAAM,aAAa,GAClB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAC3B,QAAQ,KAAK,cAAc;YAC3B,QAAQ,KAAK,UAAU,CAAC;QAEzB,IAAI,aAAa,EAAE,CAAC;YACnB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;YACxD,iEAAiE;YACjE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC,UAAU,CACxE,EAAE,EACF,QAAQ,CACR,CAAC;YAEF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBAClB,cAAc,EAAE,kBAAkB;oBAClC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE;oBACrC,uBAAuB,EAAE,GAAG;oBAC5B,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;oBACvD,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;oBAChE,GAAG,WAAW;iBACd,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CACN,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CACnE,CAAC;gBACF,OAAO;YACR,CAAC;YACD,qDAAqD;YACrD,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,WAAmC;IAEnC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAChC,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACR,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,MAAqB,EACrB,WAAmC,EACnC,aAAa,GAAG,KAAK;IAErB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,oBAAoB,GAAG,UAAU,IAAI,YAAY,CAAC;QACxD,IAAI,oBAAoB,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;YAElD,kBAAkB;YAClB,IAAI,UAAU,EAAE,CAAC;gBAChB,IAAI,aAAa,EAAE,CAAC;oBACnB,QAAQ,CACP,GAAG,EACH,GAAG,EACH;wBACC,KAAK,EACJ,6KAA6K;qBAC9K,EACD,WAAW,EACX,GAAG,CACH,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,6CAA6C;gBAC7C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACd,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,cAAc,EAAE,EACvC,WAAW,EACX,GAAG,CACH,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,OAAO,IAAI,EAAE,CAAC;YACf,CAAC;YAED,6BAA6B;YAC7B,IAAI,UAAU,IAAI,iCAAiC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,OAAO,IAAI,EAAE,CAAC;YACf,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACd,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,cAAc,EAAE,EACvC,WAAW,EACX,GAAG,CACH,CAAC;gBACF,OAAO;YACR,CAAC;QACF,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,KAAoB,EACpB,WAAmC,EACnC,OAAO,GAAG,KAAK;IAEf,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnE,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,gBAAgB,CAC7B,GAAG,EACH,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,cAAc,CACd,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YACpD,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,0CAA0C,EAAE,EACrD,WAAW,EACX,GAAG,CACH,CAAC;YACF,OAAO;QACR,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACrC,aAIyB;IAEzB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACxC,gFAAgF;QAChF,mCAAmC;QACnC,mFAAmF;QACnF,2CAA2C;IAC5C,CAAC,CAAC;AACH,CAAC;AAsBD;;GAEG;AACH,SAAS,SAAS,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,EAAE,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEtE,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IACC,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EACvD,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IAED,4CAA4C;IAC5C,MAAM,KAAK,GAAG,MAAM,CACnB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC;QACnB,CAAC,OAAO,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC;QACnB,CAAC,OAAO,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC;QAClB,OAAO,CAAC,CAAC,CAAE,CAAC;QACZ,CAAC,CACF,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,EAAU;IAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAEhC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,IACC,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EACrD,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IAED,4CAA4C;IAC5C,OAAO,MAAM,CACZ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrE,CAAC,CACF,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,EAAU,EAAE,OAAe;IACpD,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAEjC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,kBAAkB;QAClB,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,UAAU,KAAK,IAAI,IAAI,KAAK,KAAK,UAAU,CAAC;IACpD,CAAC;IAED,OAAO,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC5B,EAAU,EACV,MAAsB;IAEtB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,OAAO;gBACN,OAAO,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO;gBAC9B,WAAW,EAAE,IAAI;aACjB,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACvC,SAAsC,EACtC,WAAmC,EACnC,UAAU,GAAG,KAAK,EAClB,cAAc,GAAG,CAAC;IAElB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,4BAA4B;YAC5B,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QAED,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QAE/C,yCAAyC;QACzC,IAAI,UAAU,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACjD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,SAAS;qBACnB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC;oBACjE,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;gBAC7B,CAAC;YACF,CAAC;QACF,CAAC;QAED,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;gBAC/B,EAAE;gBACF,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO;gBACxC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW;aAC5C,CAAC,CAAC;YAEH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBAClB,cAAc,EAAE,kBAAkB;gBAClC,GAAG,WAAW;aACd,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC,CAAC;YACxE,OAAO;QACR,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { parse } from \"node:url\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { getArtifactAccessGrantFromRequest } from \"./artifact-access.js\";\nimport { checkApiAuth } from \"./authz.js\";\nimport { isOverloaded, logRequest } from \"./logger.js\";\nimport type { Middleware } from \"./middleware.js\";\nimport type { RateLimiter, TieredRateLimiter } from \"./rate-limiter.js\";\nimport { getRequestHeader, secureCompare, sendJson } from \"./server-utils.js\";\n\nconst logger = createLogger(\"middleware:ip-access\");\n\n// Helper for consistent safe URL parsing\nfunction getPathname(req: IncomingMessage): string {\n\ttry {\n\t\t// Use a dummy base for relative URLs (req.url) to ensure safe parsing\n\t\tconst parsed = new URL(req.url || \"/\", \"http://localhost\");\n\t\treturn parsed.pathname;\n\t} catch {\n\t\treturn \"/\";\n\t}\n}\n\nexport function createLoadSheddingMiddleware(\n\tcorsHeaders: Record<string, string>,\n): Middleware {\n\treturn (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\t// 1. Criticality-Aware Load Shedding (Global health)\n\t\t// We prioritize /healthz, /api/metrics, and existing SSE connections\n\t\t// We drop new /api/chat requests if overloaded\n\t\tif (\n\t\t\tisOverloaded() &&\n\t\t\tpathname !== \"/healthz\" &&\n\t\t\tpathname !== \"/readyz\" &&\n\t\t\tpathname !== \"/api/metrics\"\n\t\t) {\n\t\t\t// Drop non-critical traffic\n\t\t\tres.writeHead(503, {\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\"Retry-After\": \"5\",\n\t\t\t\t...corsHeaders,\n\t\t\t});\n\t\t\tres.end(\n\t\t\t\tJSON.stringify({ error: \"Service Unavailable: Server is overloaded\" }),\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t\treturn next();\n\t};\n}\n\n// Normalize IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1 -> 127.0.0.1)\nfunction normalizeIP(ip: string): string {\n\tif (ip.startsWith(\"::ffff:\")) {\n\t\treturn ip.substring(7);\n\t}\n\treturn ip;\n}\n\n/**\n * Extract client IP from request, handling proxy headers.\n */\nfunction getClientIp(\n\treq: IncomingMessage,\n\ttrustProxy: boolean,\n\ttrustProxyHops: number,\n): string {\n\tlet ip = req.socket.remoteAddress || \"unknown\";\n\n\tif (trustProxy) {\n\t\tconst forwarded = req.headers[\"x-forwarded-for\"];\n\t\tif (typeof forwarded === \"string\") {\n\t\t\t// Parse IPs and read from right-to-left to prevent spoofing\n\t\t\t// X-Forwarded-For format: \"client, proxy1, proxy2, ...\"\n\t\t\t// Each proxy appends its upstream IP to the right\n\t\t\t// trustProxyHops = number of trusted proxies between us and the internet\n\t\t\t// Example with CDN -> nginx -> app (2 hops):\n\t\t\t//   Header: \"client, cdn, nginx\" -> skip 2 from right -> use \"client\"\n\t\t\tconst ips = forwarded\n\t\t\t\t.split(\",\")\n\t\t\t\t.map((s) => s.trim())\n\t\t\t\t.filter(Boolean);\n\t\t\tif (ips.length > 0) {\n\t\t\t\t// Skip trustProxyHops from the right to get the first untrusted IP\n\t\t\t\tconst targetIndex = Math.max(0, ips.length - trustProxyHops - 1);\n\t\t\t\tip = ips[targetIndex] || ip;\n\t\t\t}\n\t\t}\n\t}\n\n\t// Normalize IPv4-mapped IPv6 addresses for consistent rate limiting\n\treturn normalizeIP(ip);\n}\n\nexport function createRateLimitMiddleware(\n\trateLimiter: RateLimiter,\n\tcorsHeaders: Record<string, string>,\n\ttrustProxy = false,\n\ttrustProxyHops = 1,\n): Middleware {\n\treturn async (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\t// Skip for static assets and critical health/metrics endpoints\n\t\tconst isRateLimited =\n\t\t\tpathname.startsWith(\"/api\") &&\n\t\t\tpathname !== \"/api/metrics\" &&\n\t\t\tpathname !== \"/healthz\";\n\n\t\tif (isRateLimited) {\n\t\t\tconst ip = getClientIp(req, trustProxy, trustProxyHops);\n\t\t\t// Use async check to support Redis for distributed rate limiting\n\t\t\tconst { allowed, remaining, reset, limit } =\n\t\t\t\tawait rateLimiter.checkAsync(ip);\n\n\t\t\tif (!allowed) {\n\t\t\t\tres.writeHead(429, {\n\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\"X-RateLimit-Limit\": limit.toString(),\n\t\t\t\t\t\"X-RateLimit-Remaining\": \"0\",\n\t\t\t\t\t\"X-RateLimit-Reset\": Math.ceil(reset / 1000).toString(),\n\t\t\t\t\t\"Retry-After\": Math.ceil((reset - Date.now()) / 1000).toString(),\n\t\t\t\t\t...corsHeaders,\n\t\t\t\t});\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({ error: \"Too Many Requests: Rate limit exceeded\" }),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\t// Add rate limit headers to successful responses too\n\t\t\tres.setHeader(\"X-RateLimit-Limit\", limit.toString());\n\t\t\tres.setHeader(\"X-RateLimit-Remaining\", remaining.toString());\n\t\t\tres.setHeader(\"X-RateLimit-Reset\", Math.ceil(reset / 1000).toString());\n\t\t}\n\t\treturn next();\n\t};\n}\n\n/**\n * Create tiered rate limit middleware with per-endpoint limits.\n * Uses TieredRateLimiter for endpoint-specific rate limits.\n */\nexport function createTieredRateLimitMiddleware(\n\trateLimiter: TieredRateLimiter,\n\tcorsHeaders: Record<string, string>,\n\ttrustProxy = false,\n\ttrustProxyHops = 1,\n): Middleware {\n\treturn async (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\t// Skip for static assets and critical health/metrics endpoints\n\t\tconst isRateLimited =\n\t\t\tpathname.startsWith(\"/api\") &&\n\t\t\tpathname !== \"/api/metrics\" &&\n\t\t\tpathname !== \"/healthz\";\n\n\t\tif (isRateLimited) {\n\t\t\tconst ip = getClientIp(req, trustProxy, trustProxyHops);\n\t\t\t// Use async check to support Redis for distributed rate limiting\n\t\t\tconst { allowed, remaining, reset, limit } = await rateLimiter.checkAsync(\n\t\t\t\tip,\n\t\t\t\tpathname,\n\t\t\t);\n\n\t\t\tif (!allowed) {\n\t\t\t\tres.writeHead(429, {\n\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\"X-RateLimit-Limit\": limit.toString(),\n\t\t\t\t\t\"X-RateLimit-Remaining\": \"0\",\n\t\t\t\t\t\"X-RateLimit-Reset\": Math.ceil(reset / 1000).toString(),\n\t\t\t\t\t\"Retry-After\": Math.ceil((reset - Date.now()) / 1000).toString(),\n\t\t\t\t\t...corsHeaders,\n\t\t\t\t});\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({ error: \"Too Many Requests: Rate limit exceeded\" }),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\t// Add rate limit headers to successful responses too\n\t\t\tres.setHeader(\"X-RateLimit-Limit\", limit.toString());\n\t\t\tres.setHeader(\"X-RateLimit-Remaining\", remaining.toString());\n\t\t\tres.setHeader(\"X-RateLimit-Reset\", Math.ceil(reset / 1000).toString());\n\t\t}\n\t\treturn next();\n\t};\n}\n\nexport function createCorsMiddleware(\n\tcorsHeaders: Record<string, string>,\n): Middleware {\n\treturn (req, res, next) => {\n\t\tif (req.method === \"OPTIONS\") {\n\t\t\tres.writeHead(204, corsHeaders);\n\t\t\tres.end();\n\t\t\treturn;\n\t\t}\n\t\treturn next();\n\t};\n}\n\nexport function createAuthMiddleware(\n\tapiKey: string | null,\n\tcorsHeaders: Record<string, string>,\n\trequireApiKey = false,\n): Middleware {\n\treturn async (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\tconst isApiRoute = pathname.startsWith(\"/api\");\n\t\tconst isDebugRoute = pathname.startsWith(\"/debug\");\n\t\tconst requiresAuthBoundary = isApiRoute || isDebugRoute;\n\t\tif (requiresAuthBoundary) {\n\t\t\tconst missingKey = !apiKey || apiKey.length === 0;\n\n\t\t\t// No key provided\n\t\t\tif (missingKey) {\n\t\t\t\tif (requireApiKey) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t401,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\terror:\n\t\t\t\t\t\t\t\t\"MAESTRO_WEB_API_KEY is required for all API requests. Set the environment variable or disable requirement explicitly with MAESTRO_WEB_REQUIRE_KEY=0 for local testing only.\",\n\t\t\t\t\t\t},\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t\treq,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\t// Requirement off and no key: allow through.\n\t\t\t\tconst auth = await checkApiAuth(req, { apiKey });\n\t\t\t\tif (!auth.ok) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t401,\n\t\t\t\t\t\t{ error: auth.error || \"Unauthorized\" },\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t\treq,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\treturn next();\n\t\t\t}\n\n\t\t\t// Key provided: validate it.\n\t\t\tif (isApiRoute && getArtifactAccessGrantFromRequest(req)) {\n\t\t\t\treturn next();\n\t\t\t}\n\t\t\tconst auth = await checkApiAuth(req, { apiKey });\n\t\t\tif (!auth.ok) {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\t401,\n\t\t\t\t\t{ error: auth.error || \"Unauthorized\" },\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t\treq,\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t}\n\t\treturn next();\n\t};\n}\n\nexport function createCsrfMiddleware(\n\ttoken: string | null,\n\tcorsHeaders: Record<string, string>,\n\tenabled = false,\n): Middleware {\n\tif (!enabled || !token) {\n\t\treturn (_req, _res, next) => next();\n\t}\n\treturn (req, res, next) => {\n\t\tconst method = (req.method || \"GET\").toUpperCase();\n\t\tif (method === \"GET\" || method === \"HEAD\" || method === \"OPTIONS\") {\n\t\t\treturn next();\n\t\t}\n\t\tconst pathname = getPathname(req);\n\t\tif (!pathname.startsWith(\"/api\")) {\n\t\t\treturn next();\n\t\t}\n\t\tconst value = getRequestHeader(\n\t\t\treq,\n\t\t\t\"x-composer-csrf\",\n\t\t\t\"x-maestro-csrf\",\n\t\t\t\"x-csrf-token\",\n\t\t\t\"x-xsrf-token\",\n\t\t);\n\t\tif (!value || !secureCompare(String(value), token)) {\n\t\t\tsendJson(\n\t\t\t\tres,\n\t\t\t\t403,\n\t\t\t\t{ error: \"Forbidden: missing or invalid CSRF token\" },\n\t\t\t\tcorsHeaders,\n\t\t\t\treq,\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t\treturn next();\n\t};\n}\n\nexport function createRouterMiddleware(\n\trouterHandler: (\n\t\treq: IncomingMessage,\n\t\tres: ServerResponse,\n\t\tpathname: string,\n\t) => Promise<void> | void,\n): Middleware {\n\treturn async (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\tawait routerHandler(req, res, pathname);\n\t\t// Router handles the response, so we don't call next() unless it falls through,\n\t\t// but typically router is the end.\n\t\t// If router doesn't handle it (e.g. 404), it might send response itself or return.\n\t\t// Our current router sends 404/500 itself.\n\t};\n}\n\n// ============================================================================\n// IP ACCESS CONTROL\n// ============================================================================\n\nexport interface IpAccessRule {\n\t/** CIDR notation (e.g., \"192.168.1.0/24\") or single IP */\n\tpattern: string;\n\t/** Whether this is an allow or deny rule */\n\ttype: \"allow\" | \"deny\";\n\t/** Optional description */\n\tdescription?: string;\n}\n\nexport interface IpAccessConfig {\n\t/** Default action when no rules match */\n\tdefaultAction: \"allow\" | \"deny\";\n\t/** Rules evaluated in order, first match wins */\n\trules: IpAccessRule[];\n}\n\n/**\n * Parse CIDR notation to IP range (IPv4 only for now)\n */\nfunction parseCidr(cidr: string): { start: bigint; end: bigint } | null {\n\tconst parts = cidr.split(\"/\");\n\tconst ip = parts[0];\n\tif (!ip) {\n\t\treturn null;\n\t}\n\tconst prefix = parts.length > 1 ? Number.parseInt(parts[1]!, 10) : 32;\n\n\tif (Number.isNaN(prefix) || prefix < 0 || prefix > 32) {\n\t\treturn null;\n\t}\n\n\tconst ipParts = ip.split(\".\").map(Number);\n\tif (\n\t\tipParts.length !== 4 ||\n\t\tipParts.some((p) => Number.isNaN(p) || p < 0 || p > 255)\n\t) {\n\t\treturn null;\n\t}\n\n\t// Length check above guarantees these exist\n\tconst ipNum = BigInt(\n\t\t((ipParts[0]! << 24) |\n\t\t\t(ipParts[1]! << 16) |\n\t\t\t(ipParts[2]! << 8) |\n\t\t\tipParts[3]!) >>>\n\t\t\t0,\n\t);\n\tconst mask = BigInt(0xffffffff) << BigInt(32 - prefix);\n\tconst start = ipNum & mask;\n\tconst end = start | (~mask & BigInt(0xffffffff));\n\n\treturn { start, end };\n}\n\n/**\n * Convert IP string to numeric (IPv4)\n */\nfunction ipToNumber(ip: string): bigint | null {\n\tconst cleanIp = normalizeIP(ip);\n\n\tconst parts = cleanIp.split(\".\").map(Number);\n\tif (\n\t\tparts.length !== 4 ||\n\t\tparts.some((p) => Number.isNaN(p) || p < 0 || p > 255)\n\t) {\n\t\treturn null;\n\t}\n\n\t// Length check above guarantees these exist\n\treturn BigInt(\n\t\t((parts[0]! << 24) | (parts[1]! << 16) | (parts[2]! << 8) | parts[3]!) >>>\n\t\t\t0,\n\t);\n}\n\n/**\n * Check if IP matches a pattern (CIDR or exact)\n */\nfunction ipMatchesPattern(ip: string, pattern: string): boolean {\n\tconst ipNum = ipToNumber(ip);\n\tif (ipNum === null) return false;\n\n\tconst range = parseCidr(pattern);\n\tif (!range) {\n\t\t// Try exact match\n\t\tconst patternNum = ipToNumber(pattern);\n\t\treturn patternNum !== null && ipNum === patternNum;\n\t}\n\n\treturn ipNum >= range.start && ipNum <= range.end;\n}\n\n/**\n * Check if an IP is allowed based on access rules\n */\nexport function checkIpAccess(\n\tip: string,\n\tconfig: IpAccessConfig,\n): { allowed: boolean; matchedRule?: IpAccessRule } {\n\tfor (const rule of config.rules) {\n\t\tif (ipMatchesPattern(ip, rule.pattern)) {\n\t\t\treturn {\n\t\t\t\tallowed: rule.type === \"allow\",\n\t\t\t\tmatchedRule: rule,\n\t\t\t};\n\t\t}\n\t}\n\n\treturn { allowed: config.defaultAction === \"allow\" };\n}\n\n/**\n * Create IP access control middleware.\n * getConfig is called per-request to allow dynamic config updates.\n */\nexport function createIpAccessMiddleware(\n\tgetConfig: () => IpAccessConfig | null,\n\tcorsHeaders: Record<string, string>,\n\ttrustProxy = false,\n\ttrustProxyHops = 1,\n): Middleware {\n\treturn (req, res, next) => {\n\t\tconst config = getConfig();\n\t\tif (!config) {\n\t\t\t// No config means allow all\n\t\t\treturn next();\n\t\t}\n\n\t\tlet ip = req.socket.remoteAddress || \"unknown\";\n\n\t\t// Extract real client IP if behind proxy\n\t\tif (trustProxy) {\n\t\t\tconst forwarded = req.headers[\"x-forwarded-for\"];\n\t\t\tif (typeof forwarded === \"string\") {\n\t\t\t\tconst ips = forwarded\n\t\t\t\t\t.split(\",\")\n\t\t\t\t\t.map((s) => s.trim())\n\t\t\t\t\t.filter(Boolean);\n\t\t\t\tif (ips.length > 0) {\n\t\t\t\t\tconst targetIndex = Math.max(0, ips.length - trustProxyHops - 1);\n\t\t\t\t\tip = ips[targetIndex] || ip;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tip = normalizeIP(ip);\n\t\tconst result = checkIpAccess(ip, config);\n\n\t\tif (!result.allowed) {\n\t\t\tlogger.warn(\"IP access denied\", {\n\t\t\t\tip,\n\t\t\t\tmatchedRule: result.matchedRule?.pattern,\n\t\t\t\tdescription: result.matchedRule?.description,\n\t\t\t});\n\n\t\t\tres.writeHead(403, {\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t...corsHeaders,\n\t\t\t});\n\t\t\tres.end(JSON.stringify({ error: \"Forbidden: IP address not allowed\" }));\n\t\t\treturn;\n\t\t}\n\n\t\treturn next();\n\t};\n}\n"]}
+{"version":3,"file":"server-middlewares.js","sourceRoot":"","sources":["../../src/server/server-middlewares.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iCAAiC,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAGvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE9E,MAAM,MAAM,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAMpD,yCAAyC;AACzC,SAAS,WAAW,CAAC,GAAoB;IACxC,IAAI,CAAC;QACJ,sEAAsE;QACtE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC,QAAQ,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,GAAG,CAAC;IACZ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC3C,WAAmC;IAEnC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,qDAAqD;QACrD,qEAAqE;QACrE,+CAA+C;QAC/C,IACC,YAAY,EAAE;YACd,QAAQ,KAAK,UAAU;YACvB,QAAQ,KAAK,SAAS;YACtB,QAAQ,KAAK,cAAc,EAC1B,CAAC;YACF,4BAA4B;YAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBAClB,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,GAAG;gBAClB,GAAG,WAAW;aACd,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CACN,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,CACtE,CAAC;YACF,OAAO;QACR,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,EAAU;IAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,CAAC;AACX,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CACnB,GAAoB,EACpB,UAAmB,EACnB,cAAsB;IAEtB,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IAE/C,IAAI,UAAU,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YACnC,4DAA4D;YAC5D,wDAAwD;YACxD,kDAAkD;YAClD,yEAAyE;YACzE,6CAA6C;YAC7C,sEAAsE;YACtE,MAAM,GAAG,GAAG,SAAS;iBACnB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,OAAO,CAAC,CAAC;YAClB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,mEAAmE;gBACnE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC;gBACjE,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC;QACF,CAAC;IACF,CAAC;IAED,oEAAoE;IACpE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACxC,WAAwB,EACxB,WAAmC,EACnC,UAAU,GAAG,KAAK,EAClB,cAAc,GAAG,CAAC;IAElB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,+DAA+D;QAC/D,MAAM,aAAa,GAClB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAC3B,QAAQ,KAAK,cAAc;YAC3B,QAAQ,KAAK,UAAU,CAAC;QAEzB,IAAI,aAAa,EAAE,CAAC;YACnB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;YACxD,iEAAiE;YACjE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GACzC,MAAM,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAElC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBAClB,cAAc,EAAE,kBAAkB;oBAClC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE;oBACrC,uBAAuB,EAAE,GAAG;oBAC5B,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;oBACvD,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;oBAChE,GAAG,WAAW;iBACd,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CACN,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CACnE,CAAC;gBACF,OAAO;YACR,CAAC;YACD,qDAAqD;YACrD,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAC9C,WAA8B,EAC9B,WAAmC,EACnC,UAAU,GAAG,KAAK,EAClB,cAAc,GAAG,CAAC;IAElB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,+DAA+D;QAC/D,MAAM,aAAa,GAClB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAC3B,QAAQ,KAAK,cAAc;YAC3B,QAAQ,KAAK,UAAU,CAAC;QAEzB,IAAI,aAAa,EAAE,CAAC;YACnB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;YACxD,iEAAiE;YACjE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC,UAAU,CACxE,EAAE,EACF,QAAQ,CACR,CAAC;YAEF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBAClB,cAAc,EAAE,kBAAkB;oBAClC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE;oBACrC,uBAAuB,EAAE,GAAG;oBAC5B,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;oBACvD,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;oBAChE,GAAG,WAAW;iBACd,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CACN,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CACnE,CAAC;gBACF,OAAO;YACR,CAAC;YACD,qDAAqD;YACrD,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,WAAmC;IAEnC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAChC,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACR,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,MAAqB,EACrB,WAAmC,EACnC,aAAa,GAAG,KAAK,EACrB,UAA+B,EAAE;IAEjC,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,oBAAoB,GAAG,UAAU,IAAI,YAAY,CAAC;QACxD,IAAI,oBAAoB,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7C,OAAO,IAAI,EAAE,CAAC;YACf,CAAC;YACD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;YAElD,kBAAkB;YAClB,IAAI,UAAU,EAAE,CAAC;gBAChB,IAAI,aAAa,EAAE,CAAC;oBACnB,QAAQ,CACP,GAAG,EACH,GAAG,EACH;wBACC,KAAK,EACJ,6KAA6K;qBAC9K,EACD,WAAW,EACX,GAAG,CACH,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,6CAA6C;gBAC7C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACd,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,cAAc,EAAE,EACvC,WAAW,EACX,GAAG,CACH,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,OAAO,IAAI,EAAE,CAAC;YACf,CAAC;YAED,6BAA6B;YAC7B,IAAI,UAAU,IAAI,iCAAiC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,OAAO,IAAI,EAAE,CAAC;YACf,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACd,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,cAAc,EAAE,EACvC,WAAW,EACX,GAAG,CACH,CAAC;gBACF,OAAO;YACR,CAAC;QACF,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,KAAoB,EACpB,WAAmC,EACnC,OAAO,GAAG,KAAK,EACf,UAA+B,EAAE;IAEjC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnE,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,gBAAgB,CAC7B,GAAG,EACH,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,cAAc,CACd,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YACpD,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,0CAA0C,EAAE,EACrD,WAAW,EACX,GAAG,CACH,CAAC;YACF,OAAO;QACR,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACrC,aAIyB;IAEzB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACxC,gFAAgF;QAChF,mCAAmC;QACnC,mFAAmF;QACnF,2CAA2C;IAC5C,CAAC,CAAC;AACH,CAAC;AAsBD;;GAEG;AACH,SAAS,SAAS,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,EAAE,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEtE,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IACC,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EACvD,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IAED,4CAA4C;IAC5C,MAAM,KAAK,GAAG,MAAM,CACnB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC;QACnB,CAAC,OAAO,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC;QACnB,CAAC,OAAO,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC;QAClB,OAAO,CAAC,CAAC,CAAE,CAAC;QACZ,CAAC,CACF,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,EAAU;IAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAEhC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,IACC,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EACrD,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IAED,4CAA4C;IAC5C,OAAO,MAAM,CACZ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrE,CAAC,CACF,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,EAAU,EAAE,OAAe;IACpD,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAEjC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,kBAAkB;QAClB,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,UAAU,KAAK,IAAI,IAAI,KAAK,KAAK,UAAU,CAAC;IACpD,CAAC;IAED,OAAO,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC5B,EAAU,EACV,MAAsB;IAEtB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,OAAO;gBACN,OAAO,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO;gBAC9B,WAAW,EAAE,IAAI;aACjB,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACvC,SAAsC,EACtC,WAAmC,EACnC,UAAU,GAAG,KAAK,EAClB,cAAc,GAAG,CAAC;IAElB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,4BAA4B;YAC5B,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QAED,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QAE/C,yCAAyC;QACzC,IAAI,UAAU,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACjD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,SAAS;qBACnB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC;oBACjE,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;gBAC7B,CAAC;YACF,CAAC;QACF,CAAC;QAED,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;gBAC/B,EAAE;gBACF,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO;gBACxC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW;aAC5C,CAAC,CAAC;YAEH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBAClB,cAAc,EAAE,kBAAkB;gBAClC,GAAG,WAAW;aACd,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC,CAAC;YACxE,OAAO;QACR,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { parse } from \"node:url\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { getArtifactAccessGrantFromRequest } from \"./artifact-access.js\";\nimport { checkApiAuth } from \"./authz.js\";\nimport { isOverloaded, logRequest } from \"./logger.js\";\nimport type { Middleware } from \"./middleware.js\";\nimport type { RateLimiter, TieredRateLimiter } from \"./rate-limiter.js\";\nimport { getRequestHeader, secureCompare, sendJson } from \"./server-utils.js\";\n\nconst logger = createLogger(\"middleware:ip-access\");\n\ninterface AuthBoundaryOptions {\n\texemptPaths?: readonly string[];\n}\n\n// Helper for consistent safe URL parsing\nfunction getPathname(req: IncomingMessage): string {\n\ttry {\n\t\t// Use a dummy base for relative URLs (req.url) to ensure safe parsing\n\t\tconst parsed = new URL(req.url || \"/\", \"http://localhost\");\n\t\treturn parsed.pathname;\n\t} catch {\n\t\treturn \"/\";\n\t}\n}\n\nexport function createLoadSheddingMiddleware(\n\tcorsHeaders: Record<string, string>,\n): Middleware {\n\treturn (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\t// 1. Criticality-Aware Load Shedding (Global health)\n\t\t// We prioritize /healthz, /api/metrics, and existing SSE connections\n\t\t// We drop new /api/chat requests if overloaded\n\t\tif (\n\t\t\tisOverloaded() &&\n\t\t\tpathname !== \"/healthz\" &&\n\t\t\tpathname !== \"/readyz\" &&\n\t\t\tpathname !== \"/api/metrics\"\n\t\t) {\n\t\t\t// Drop non-critical traffic\n\t\t\tres.writeHead(503, {\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\"Retry-After\": \"5\",\n\t\t\t\t...corsHeaders,\n\t\t\t});\n\t\t\tres.end(\n\t\t\t\tJSON.stringify({ error: \"Service Unavailable: Server is overloaded\" }),\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t\treturn next();\n\t};\n}\n\n// Normalize IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1 -> 127.0.0.1)\nfunction normalizeIP(ip: string): string {\n\tif (ip.startsWith(\"::ffff:\")) {\n\t\treturn ip.substring(7);\n\t}\n\treturn ip;\n}\n\n/**\n * Extract client IP from request, handling proxy headers.\n */\nfunction getClientIp(\n\treq: IncomingMessage,\n\ttrustProxy: boolean,\n\ttrustProxyHops: number,\n): string {\n\tlet ip = req.socket.remoteAddress || \"unknown\";\n\n\tif (trustProxy) {\n\t\tconst forwarded = req.headers[\"x-forwarded-for\"];\n\t\tif (typeof forwarded === \"string\") {\n\t\t\t// Parse IPs and read from right-to-left to prevent spoofing\n\t\t\t// X-Forwarded-For format: \"client, proxy1, proxy2, ...\"\n\t\t\t// Each proxy appends its upstream IP to the right\n\t\t\t// trustProxyHops = number of trusted proxies between us and the internet\n\t\t\t// Example with CDN -> nginx -> app (2 hops):\n\t\t\t//   Header: \"client, cdn, nginx\" -> skip 2 from right -> use \"client\"\n\t\t\tconst ips = forwarded\n\t\t\t\t.split(\",\")\n\t\t\t\t.map((s) => s.trim())\n\t\t\t\t.filter(Boolean);\n\t\t\tif (ips.length > 0) {\n\t\t\t\t// Skip trustProxyHops from the right to get the first untrusted IP\n\t\t\t\tconst targetIndex = Math.max(0, ips.length - trustProxyHops - 1);\n\t\t\t\tip = ips[targetIndex] || ip;\n\t\t\t}\n\t\t}\n\t}\n\n\t// Normalize IPv4-mapped IPv6 addresses for consistent rate limiting\n\treturn normalizeIP(ip);\n}\n\nexport function createRateLimitMiddleware(\n\trateLimiter: RateLimiter,\n\tcorsHeaders: Record<string, string>,\n\ttrustProxy = false,\n\ttrustProxyHops = 1,\n): Middleware {\n\treturn async (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\t// Skip for static assets and critical health/metrics endpoints\n\t\tconst isRateLimited =\n\t\t\tpathname.startsWith(\"/api\") &&\n\t\t\tpathname !== \"/api/metrics\" &&\n\t\t\tpathname !== \"/healthz\";\n\n\t\tif (isRateLimited) {\n\t\t\tconst ip = getClientIp(req, trustProxy, trustProxyHops);\n\t\t\t// Use async check to support Redis for distributed rate limiting\n\t\t\tconst { allowed, remaining, reset, limit } =\n\t\t\t\tawait rateLimiter.checkAsync(ip);\n\n\t\t\tif (!allowed) {\n\t\t\t\tres.writeHead(429, {\n\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\"X-RateLimit-Limit\": limit.toString(),\n\t\t\t\t\t\"X-RateLimit-Remaining\": \"0\",\n\t\t\t\t\t\"X-RateLimit-Reset\": Math.ceil(reset / 1000).toString(),\n\t\t\t\t\t\"Retry-After\": Math.ceil((reset - Date.now()) / 1000).toString(),\n\t\t\t\t\t...corsHeaders,\n\t\t\t\t});\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({ error: \"Too Many Requests: Rate limit exceeded\" }),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\t// Add rate limit headers to successful responses too\n\t\t\tres.setHeader(\"X-RateLimit-Limit\", limit.toString());\n\t\t\tres.setHeader(\"X-RateLimit-Remaining\", remaining.toString());\n\t\t\tres.setHeader(\"X-RateLimit-Reset\", Math.ceil(reset / 1000).toString());\n\t\t}\n\t\treturn next();\n\t};\n}\n\n/**\n * Create tiered rate limit middleware with per-endpoint limits.\n * Uses TieredRateLimiter for endpoint-specific rate limits.\n */\nexport function createTieredRateLimitMiddleware(\n\trateLimiter: TieredRateLimiter,\n\tcorsHeaders: Record<string, string>,\n\ttrustProxy = false,\n\ttrustProxyHops = 1,\n): Middleware {\n\treturn async (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\t// Skip for static assets and critical health/metrics endpoints\n\t\tconst isRateLimited =\n\t\t\tpathname.startsWith(\"/api\") &&\n\t\t\tpathname !== \"/api/metrics\" &&\n\t\t\tpathname !== \"/healthz\";\n\n\t\tif (isRateLimited) {\n\t\t\tconst ip = getClientIp(req, trustProxy, trustProxyHops);\n\t\t\t// Use async check to support Redis for distributed rate limiting\n\t\t\tconst { allowed, remaining, reset, limit } = await rateLimiter.checkAsync(\n\t\t\t\tip,\n\t\t\t\tpathname,\n\t\t\t);\n\n\t\t\tif (!allowed) {\n\t\t\t\tres.writeHead(429, {\n\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\"X-RateLimit-Limit\": limit.toString(),\n\t\t\t\t\t\"X-RateLimit-Remaining\": \"0\",\n\t\t\t\t\t\"X-RateLimit-Reset\": Math.ceil(reset / 1000).toString(),\n\t\t\t\t\t\"Retry-After\": Math.ceil((reset - Date.now()) / 1000).toString(),\n\t\t\t\t\t...corsHeaders,\n\t\t\t\t});\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({ error: \"Too Many Requests: Rate limit exceeded\" }),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\t// Add rate limit headers to successful responses too\n\t\t\tres.setHeader(\"X-RateLimit-Limit\", limit.toString());\n\t\t\tres.setHeader(\"X-RateLimit-Remaining\", remaining.toString());\n\t\t\tres.setHeader(\"X-RateLimit-Reset\", Math.ceil(reset / 1000).toString());\n\t\t}\n\t\treturn next();\n\t};\n}\n\nexport function createCorsMiddleware(\n\tcorsHeaders: Record<string, string>,\n): Middleware {\n\treturn (req, res, next) => {\n\t\tif (req.method === \"OPTIONS\") {\n\t\t\tres.writeHead(204, corsHeaders);\n\t\t\tres.end();\n\t\t\treturn;\n\t\t}\n\t\treturn next();\n\t};\n}\n\nexport function createAuthMiddleware(\n\tapiKey: string | null,\n\tcorsHeaders: Record<string, string>,\n\trequireApiKey = false,\n\toptions: AuthBoundaryOptions = {},\n): Middleware {\n\treturn async (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\tconst isApiRoute = pathname.startsWith(\"/api\");\n\t\tconst isDebugRoute = pathname.startsWith(\"/debug\");\n\t\tconst requiresAuthBoundary = isApiRoute || isDebugRoute;\n\t\tif (requiresAuthBoundary) {\n\t\t\tif (options.exemptPaths?.includes(pathname)) {\n\t\t\t\treturn next();\n\t\t\t}\n\t\t\tconst missingKey = !apiKey || apiKey.length === 0;\n\n\t\t\t// No key provided\n\t\t\tif (missingKey) {\n\t\t\t\tif (requireApiKey) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t401,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\terror:\n\t\t\t\t\t\t\t\t\"MAESTRO_WEB_API_KEY is required for all API requests. Set the environment variable or disable requirement explicitly with MAESTRO_WEB_REQUIRE_KEY=0 for local testing only.\",\n\t\t\t\t\t\t},\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t\treq,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\t// Requirement off and no key: allow through.\n\t\t\t\tconst auth = await checkApiAuth(req, { apiKey });\n\t\t\t\tif (!auth.ok) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t401,\n\t\t\t\t\t\t{ error: auth.error || \"Unauthorized\" },\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t\treq,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\treturn next();\n\t\t\t}\n\n\t\t\t// Key provided: validate it.\n\t\t\tif (isApiRoute && getArtifactAccessGrantFromRequest(req)) {\n\t\t\t\treturn next();\n\t\t\t}\n\t\t\tconst auth = await checkApiAuth(req, { apiKey });\n\t\t\tif (!auth.ok) {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\t401,\n\t\t\t\t\t{ error: auth.error || \"Unauthorized\" },\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t\treq,\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t}\n\t\treturn next();\n\t};\n}\n\nexport function createCsrfMiddleware(\n\ttoken: string | null,\n\tcorsHeaders: Record<string, string>,\n\tenabled = false,\n\toptions: AuthBoundaryOptions = {},\n): Middleware {\n\tif (!enabled || !token) {\n\t\treturn (_req, _res, next) => next();\n\t}\n\treturn (req, res, next) => {\n\t\tconst method = (req.method || \"GET\").toUpperCase();\n\t\tif (method === \"GET\" || method === \"HEAD\" || method === \"OPTIONS\") {\n\t\t\treturn next();\n\t\t}\n\t\tconst pathname = getPathname(req);\n\t\tif (!pathname.startsWith(\"/api\")) {\n\t\t\treturn next();\n\t\t}\n\t\tif (options.exemptPaths?.includes(pathname)) {\n\t\t\treturn next();\n\t\t}\n\t\tconst value = getRequestHeader(\n\t\t\treq,\n\t\t\t\"x-composer-csrf\",\n\t\t\t\"x-maestro-csrf\",\n\t\t\t\"x-csrf-token\",\n\t\t\t\"x-xsrf-token\",\n\t\t);\n\t\tif (!value || !secureCompare(String(value), token)) {\n\t\t\tsendJson(\n\t\t\t\tres,\n\t\t\t\t403,\n\t\t\t\t{ error: \"Forbidden: missing or invalid CSRF token\" },\n\t\t\t\tcorsHeaders,\n\t\t\t\treq,\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t\treturn next();\n\t};\n}\n\nexport function createRouterMiddleware(\n\trouterHandler: (\n\t\treq: IncomingMessage,\n\t\tres: ServerResponse,\n\t\tpathname: string,\n\t) => Promise<void> | void,\n): Middleware {\n\treturn async (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\tawait routerHandler(req, res, pathname);\n\t\t// Router handles the response, so we don't call next() unless it falls through,\n\t\t// but typically router is the end.\n\t\t// If router doesn't handle it (e.g. 404), it might send response itself or return.\n\t\t// Our current router sends 404/500 itself.\n\t};\n}\n\n// ============================================================================\n// IP ACCESS CONTROL\n// ============================================================================\n\nexport interface IpAccessRule {\n\t/** CIDR notation (e.g., \"192.168.1.0/24\") or single IP */\n\tpattern: string;\n\t/** Whether this is an allow or deny rule */\n\ttype: \"allow\" | \"deny\";\n\t/** Optional description */\n\tdescription?: string;\n}\n\nexport interface IpAccessConfig {\n\t/** Default action when no rules match */\n\tdefaultAction: \"allow\" | \"deny\";\n\t/** Rules evaluated in order, first match wins */\n\trules: IpAccessRule[];\n}\n\n/**\n * Parse CIDR notation to IP range (IPv4 only for now)\n */\nfunction parseCidr(cidr: string): { start: bigint; end: bigint } | null {\n\tconst parts = cidr.split(\"/\");\n\tconst ip = parts[0];\n\tif (!ip) {\n\t\treturn null;\n\t}\n\tconst prefix = parts.length > 1 ? Number.parseInt(parts[1]!, 10) : 32;\n\n\tif (Number.isNaN(prefix) || prefix < 0 || prefix > 32) {\n\t\treturn null;\n\t}\n\n\tconst ipParts = ip.split(\".\").map(Number);\n\tif (\n\t\tipParts.length !== 4 ||\n\t\tipParts.some((p) => Number.isNaN(p) || p < 0 || p > 255)\n\t) {\n\t\treturn null;\n\t}\n\n\t// Length check above guarantees these exist\n\tconst ipNum = BigInt(\n\t\t((ipParts[0]! << 24) |\n\t\t\t(ipParts[1]! << 16) |\n\t\t\t(ipParts[2]! << 8) |\n\t\t\tipParts[3]!) >>>\n\t\t\t0,\n\t);\n\tconst mask = BigInt(0xffffffff) << BigInt(32 - prefix);\n\tconst start = ipNum & mask;\n\tconst end = start | (~mask & BigInt(0xffffffff));\n\n\treturn { start, end };\n}\n\n/**\n * Convert IP string to numeric (IPv4)\n */\nfunction ipToNumber(ip: string): bigint | null {\n\tconst cleanIp = normalizeIP(ip);\n\n\tconst parts = cleanIp.split(\".\").map(Number);\n\tif (\n\t\tparts.length !== 4 ||\n\t\tparts.some((p) => Number.isNaN(p) || p < 0 || p > 255)\n\t) {\n\t\treturn null;\n\t}\n\n\t// Length check above guarantees these exist\n\treturn BigInt(\n\t\t((parts[0]! << 24) | (parts[1]! << 16) | (parts[2]! << 8) | parts[3]!) >>>\n\t\t\t0,\n\t);\n}\n\n/**\n * Check if IP matches a pattern (CIDR or exact)\n */\nfunction ipMatchesPattern(ip: string, pattern: string): boolean {\n\tconst ipNum = ipToNumber(ip);\n\tif (ipNum === null) return false;\n\n\tconst range = parseCidr(pattern);\n\tif (!range) {\n\t\t// Try exact match\n\t\tconst patternNum = ipToNumber(pattern);\n\t\treturn patternNum !== null && ipNum === patternNum;\n\t}\n\n\treturn ipNum >= range.start && ipNum <= range.end;\n}\n\n/**\n * Check if an IP is allowed based on access rules\n */\nexport function checkIpAccess(\n\tip: string,\n\tconfig: IpAccessConfig,\n): { allowed: boolean; matchedRule?: IpAccessRule } {\n\tfor (const rule of config.rules) {\n\t\tif (ipMatchesPattern(ip, rule.pattern)) {\n\t\t\treturn {\n\t\t\t\tallowed: rule.type === \"allow\",\n\t\t\t\tmatchedRule: rule,\n\t\t\t};\n\t\t}\n\t}\n\n\treturn { allowed: config.defaultAction === \"allow\" };\n}\n\n/**\n * Create IP access control middleware.\n * getConfig is called per-request to allow dynamic config updates.\n */\nexport function createIpAccessMiddleware(\n\tgetConfig: () => IpAccessConfig | null,\n\tcorsHeaders: Record<string, string>,\n\ttrustProxy = false,\n\ttrustProxyHops = 1,\n): Middleware {\n\treturn (req, res, next) => {\n\t\tconst config = getConfig();\n\t\tif (!config) {\n\t\t\t// No config means allow all\n\t\t\treturn next();\n\t\t}\n\n\t\tlet ip = req.socket.remoteAddress || \"unknown\";\n\n\t\t// Extract real client IP if behind proxy\n\t\tif (trustProxy) {\n\t\t\tconst forwarded = req.headers[\"x-forwarded-for\"];\n\t\t\tif (typeof forwarded === \"string\") {\n\t\t\t\tconst ips = forwarded\n\t\t\t\t\t.split(\",\")\n\t\t\t\t\t.map((s) => s.trim())\n\t\t\t\t\t.filter(Boolean);\n\t\t\t\tif (ips.length > 0) {\n\t\t\t\t\tconst targetIndex = Math.max(0, ips.length - trustProxyHops - 1);\n\t\t\t\t\tip = ips[targetIndex] || ip;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tip = normalizeIP(ip);\n\t\tconst result = checkIpAccess(ip, config);\n\n\t\tif (!result.allowed) {\n\t\t\tlogger.warn(\"IP access denied\", {\n\t\t\t\tip,\n\t\t\t\tmatchedRule: result.matchedRule?.pattern,\n\t\t\t\tdescription: result.matchedRule?.description,\n\t\t\t});\n\n\t\t\tres.writeHead(403, {\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t...corsHeaders,\n\t\t\t});\n\t\t\tres.end(JSON.stringify({ error: \"Forbidden: IP address not allowed\" }));\n\t\t\treturn;\n\t\t}\n\n\t\treturn next();\n\t};\n}\n"]}

package/dist/server/server-request-manager.d.ts

@@ -11,6 +11,12 @@ export type ServerRequestRegisteredEvent = RuntimeServerRequestRegisteredEvent;
 export type ServerRequestResolvedEvent = RuntimeServerRequestResolvedEvent;
 export type ServerRequestLifecycleEvent = RuntimeServerRequestLifecycleEvent;
 type ServerRequestListener = (event: ServerRequestLifecycleEvent) => void;
+type ClaimedClientToolRequest = {
+    request: PendingServerRequestSnapshot & {
+        kind: "client_tool" | "mcp_elicitation" | "user_input";
+    };
+    resolve: (content: ToolResultContent[], isError: boolean) => boolean;
+};
 type RegisterApprovalOptions = {
     sessionId?: string;
     request: ActionApprovalRequest;
@@ -47,9 +53,11 @@ export declare class ServerRequestManager {
         sessionId?: string;
         kind?: ServerRequestKind;
     }): PendingServerRequestSnapshot[];
-    resolveApproval(id: string, decision: Pick<ActionApprovalDecision, "approved" | "reason" | "resolvedBy">): boolean;
+    resolveApproval(id: string, decision: Pick<ActionApprovalDecision, "approved" | "reason" | "resolvedBy" | "resolvedAtMs">): boolean;
     resolveToolRetry(id: string, decision: Pick<ToolRetryDecision, "action" | "reason" | "resolvedBy">): boolean;
     resolveClientTool(id: string, content: ToolResultContent[], isError: boolean): boolean;
+    claimClientTool(id: string): ClaimedClientToolRequest | undefined;
+    private resolveClientToolEntry;
     cancel(id: string, reason: string, resolvedBy?: "policy" | "runtime"): boolean;
     cancelBySession(sessionId: string, reason: string, resolvedBy?: "policy" | "runtime"): number;
     cleanup(now?: number): void;

package/dist/server/server-request-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-request-manager.d.ts","sourceRoot":"","sources":["../../src/server/server-request-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,wBAAwB,EACxB,kCAAkC,EAClC,mCAAmC,EACnC,8BAA8B,EAC9B,8BAA8B,EAC9B,iCAAiC,EACjC,4BAA4B,EAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EACX,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEnE,KAAK,iBAAiB,GAAG,WAAW,GAAG,YAAY,CAAC;AAEpD,MAAM,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AACzD,MAAM,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AACrE,MAAM,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AACrE,MAAM,MAAM,4BAA4B,GAAG,4BAA4B,CAAC;AACxE,MAAM,MAAM,4BAA4B,GAAG,mCAAmC,CAAC;AAC/E,MAAM,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AAC3E,MAAM,MAAM,2BAA2B,GAAG,kCAAkC,CAAC;AAE7E,KAAK,qBAAqB,GAAG,CAAC,KAAK,EAAE,2BAA2B,KAAK,IAAI,CAAC;AA0B1E,KAAK,uBAAuB,GAAG;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,aAAa,GAAG,iBAAiB,GAAG,YAAY,CAAC;IACxD,OAAO,EAAE,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;IACrE,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;CACpC,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAqBF,qBAAa,oBAAoB;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgD;IACxE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAE9D,SAAS,CAAC,QAAQ,EAAE,qBAAqB,GAAG,MAAM,IAAI;IAOtD,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAyBxD,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI;IA4B5D,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI;IAmD1D,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAI5B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,4BAA4B,GAAG,SAAS;IAmBzD,WAAW,CAAC,OAAO,CAAC,EAAE;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,iBAAiB,CAAC;KACzB,GAAG,4BAA4B,EAAE;IAuBlC,eAAe,CACd,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,IAAI,CACb,sBAAsB,EACtB,UAAU,GAAG,QAAQ,GAAG,YAAY,CACpC,GACC,OAAO;IAwBV,gBAAgB,CACf,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAC,GACnE,OAAO;IA6BV,iBAAiB,CAChB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,iBAAiB,EAAE,EAC5B,OAAO,EAAE,OAAO,GACd,OAAO;IA8BV,MAAM,CACL,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,UAAU,GAAE,QAAQ,GAAG,SAAoB,GACzC,OAAO;IAsDV,eAAe,CACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,UAAU,GAAE,QAAQ,GAAG,SAAoB,GACzC,MAAM;IAaT,OAAO,CAAC,GAAG,SAAa,GAAG,IAAI;IAS/B,OAAO,CAAC,IAAI;IAMZ,OAAO,CAAC,UAAU;CAmBlB;AAED,eAAO,MAAM,oBAAoB,sBAA6B,CAAC"}
+{"version":3,"file":"server-request-manager.d.ts","sourceRoot":"","sources":["../../src/server/server-request-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,wBAAwB,EACxB,kCAAkC,EAClC,mCAAmC,EACnC,8BAA8B,EAC9B,8BAA8B,EAC9B,iCAAiC,EACjC,4BAA4B,EAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EACX,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEnE,KAAK,iBAAiB,GAAG,WAAW,GAAG,YAAY,CAAC;AAEpD,MAAM,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AACzD,MAAM,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AACrE,MAAM,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AACrE,MAAM,MAAM,4BAA4B,GAAG,4BAA4B,CAAC;AACxE,MAAM,MAAM,4BAA4B,GAAG,mCAAmC,CAAC;AAC/E,MAAM,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AAC3E,MAAM,MAAM,2BAA2B,GAAG,kCAAkC,CAAC;AAE7E,KAAK,qBAAqB,GAAG,CAAC,KAAK,EAAE,2BAA2B,KAAK,IAAI,CAAC;AAE1E,KAAK,wBAAwB,GAAG;IAC/B,OAAO,EAAE,4BAA4B,GAAG;QACvC,IAAI,EAAE,aAAa,GAAG,iBAAiB,GAAG,YAAY,CAAC;KACvD,CAAC;IACF,OAAO,EAAE,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;CACrE,CAAC;AA0BF,KAAK,uBAAuB,GAAG;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,aAAa,GAAG,iBAAiB,GAAG,YAAY,CAAC;IACxD,OAAO,EAAE,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;IACrE,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;CACpC,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAqBF,qBAAa,oBAAoB;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgD;IACxE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAE9D,SAAS,CAAC,QAAQ,EAAE,qBAAqB,GAAG,MAAM,IAAI;IAOtD,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IA2BxD,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI;IA8B5D,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI;IAqD1D,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAI5B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,4BAA4B,GAAG,SAAS;IAoBzD,WAAW,CAAC,OAAO,CAAC,EAAE;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,iBAAiB,CAAC;KACzB,GAAG,4BAA4B,EAAE;IAwBlC,eAAe,CACd,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,IAAI,CACb,sBAAsB,EACtB,UAAU,GAAG,QAAQ,GAAG,YAAY,GAAG,cAAc,CACrD,GACC,OAAO;IA2BV,gBAAgB,CACf,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAC,GACnE,OAAO;IA+BV,iBAAiB,CAChB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,iBAAiB,EAAE,EAC5B,OAAO,EAAE,OAAO,GACd,OAAO;IAaV,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS;IA4BjE,OAAO,CAAC,sBAAsB;IAiC9B,MAAM,CACL,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,UAAU,GAAE,QAAQ,GAAG,SAAoB,GACzC,OAAO;IA2DV,eAAe,CACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,UAAU,GAAE,QAAQ,GAAG,SAAoB,GACzC,MAAM;IAaT,OAAO,CAAC,GAAG,SAAa,GAAG,IAAI;IAS/B,OAAO,CAAC,IAAI;IAMZ,OAAO,CAAC,UAAU;CAoBlB;AAED,eAAO,MAAM,oBAAoB,sBAA6B,CAAC"}