npm - @evalops/maestro - Versions diffs - 0.10.18 → 0.10.21 - Mend

@evalops/maestro 0.10.18 → 0.10.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2490) hide show

package/dist/server/scripted-scenario-runner.js ADDED Viewed

@@ -0,0 +1,190 @@
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { resolve } from "node:path";
+import { escapeXml } from "./junit-xml.js";
+export const SCRIPTED_SCENARIO_RESULT_SCHEMA = "evalops.maestro.scripted-scenario-result.v1";
+function toolCallStatements(scenario) {
+    const calls = [];
+    for (const frame of scenario.frames) {
+        for (const [statementIndex, statement] of frame.statements.entries()) {
+            if (statement.kind !== "tool_call")
+                continue;
+            calls.push({
+                ...statement,
+                frameIndex: frame.index,
+                statementIndex,
+            });
+        }
+    }
+    return calls;
+}
+function evidence(kind, id, source, label = `${kind}:${id}`) {
+    return [{ kind, id, source, label }];
+}
+function pass(assertion, message, assertionEvidence = []) {
+    return {
+        id: assertion.id,
+        kind: assertion.kind,
+        status: "pass",
+        severity: assertion.severity ?? "error",
+        message,
+        evidence: assertionEvidence,
+    };
+}
+function fail(assertion, message, assertionEvidence = []) {
+    return {
+        id: assertion.id,
+        kind: assertion.kind,
+        status: assertion.severity === "warning" ? "warn" : "fail",
+        severity: assertion.severity ?? "error",
+        message,
+        evidence: assertionEvidence,
+    };
+}
+function requireAssertionString(assertion, field, options = {}) {
+    const value = assertion[field];
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    return value.length > 0 || options.allowEmpty ? value : undefined;
+}
+function evaluateAssertion(assertion, scenario, baseDir) {
+    const toolCalls = toolCallStatements(scenario);
+    switch (assertion.kind) {
+        case "tool_called": {
+            const tool = requireAssertionString(assertion, "tool");
+            const toolCallId = requireAssertionString(assertion, "toolCallId");
+            if (!tool && !toolCallId) {
+                return fail(assertion, "tool_called requires tool or toolCallId.");
+            }
+            const matches = toolCalls.filter((call) => (tool === undefined || call.tool === tool) &&
+                (toolCallId === undefined || call.id === toolCallId));
+            return matches.length > 0
+                ? pass(assertion, `Matched ${matches.length} scripted tool call(s).`, matches.map((call) => ({
+                    kind: "tool_call",
+                    id: call.id ??
+                        `${scenario.id}:${call.frameIndex}:${call.statementIndex}`,
+                    source: "scenario",
+                    label: `${call.tool}:${call.frameIndex}.${call.statementIndex}`,
+                })))
+                : fail(assertion, "No scripted tool call matched.");
+        }
+        case "tool_not_called": {
+            const tool = requireAssertionString(assertion, "tool");
+            if (!tool) {
+                return fail(assertion, "tool_not_called requires tool.");
+            }
+            const matches = toolCalls.filter((call) => call.tool === tool);
+            return matches.length === 0
+                ? pass(assertion, `Tool ${tool} was not called.`)
+                : fail(assertion, `Tool ${tool} was called ${matches.length} time(s).`, matches.map((call) => ({
+                    kind: "tool_call",
+                    id: call.id ??
+                        `${scenario.id}:${call.frameIndex}:${call.statementIndex}`,
+                    source: "scenario",
+                    label: `${call.tool}:${call.frameIndex}.${call.statementIndex}`,
+                })));
+        }
+        case "file_exists": {
+            const path = requireAssertionString(assertion, "path");
+            if (!path) {
+                return fail(assertion, "file_exists requires path.");
+            }
+            const fullPath = resolve(baseDir, path);
+            const exists = existsSync(fullPath) && statSync(fullPath).isFile();
+            return exists
+                ? pass(assertion, `File exists: ${path}.`, evidence("file", path, "workspace"))
+                : fail(assertion, `File does not exist: ${path}.`);
+        }
+        case "file_contents": {
+            const path = requireAssertionString(assertion, "path");
+            if (!path) {
+                return fail(assertion, "file_contents requires path.");
+            }
+            const contains = requireAssertionString(assertion, "contains");
+            const equals = requireAssertionString(assertion, "equals", {
+                allowEmpty: true,
+            });
+            if (!contains && equals === undefined) {
+                return fail(assertion, "file_contents requires contains or equals.");
+            }
+            const fullPath = resolve(baseDir, path);
+            if (!existsSync(fullPath) || !statSync(fullPath).isFile()) {
+                return fail(assertion, `File does not exist: ${path}.`);
+            }
+            const content = readFileSync(fullPath, "utf8");
+            const matched = (contains !== undefined && content.includes(contains)) ||
+                (equals !== undefined && content === equals);
+            return matched
+                ? pass(assertion, `File contents matched: ${path}.`, evidence("file", path, "workspace"))
+                : fail(assertion, `File contents did not match: ${path}.`);
+        }
+        case "audit_event_emitted": {
+            const eventType = requireAssertionString(assertion, "eventType");
+            if (!eventType) {
+                return fail(assertion, "audit_event_emitted requires eventType.");
+            }
+            const events = scenario.metadata.auditEvents ?? [];
+            return events.includes(eventType)
+                ? pass(assertion, `Audit event present: ${eventType}.`, evidence("audit_event", eventType, "audit"))
+                : fail(assertion, `Audit event missing: ${eventType}.`);
+        }
+    }
+    const _exhaustive = assertion.kind;
+    return fail(assertion, `Unsupported scripted assertion kind: ${_exhaustive}`);
+}
+export function evaluateScriptedScenario(scenario, options = {}) {
+    const assertions = (scenario.assertions ?? []).map((assertion) => evaluateAssertion(assertion, scenario, options.baseDir ?? process.cwd()));
+    const failed = assertions.filter((assertion) => assertion.status === "fail");
+    const warnings = assertions.filter((assertion) => assertion.status === "warn");
+    const observedOutcome = failed.length > 0 ? "fail" : "pass";
+    return {
+        schemaVersion: SCRIPTED_SCENARIO_RESULT_SCHEMA,
+        scenarioSchemaVersion: scenario.schemaVersion,
+        scenario: {
+            id: scenario.id,
+            description: scenario.description,
+            expectedOutcome: scenario.expectedOutcome ?? "pass",
+            observedOutcome,
+        },
+        run: {
+            scenarioId: scenario.id,
+            replay: true,
+            frames: scenario.frames.length,
+            toolCalls: toolCallStatements(scenario).length,
+            auditEvents: scenario.metadata.auditEvents ?? [],
+        },
+        counts: {
+            assertions: assertions.length,
+            passed: assertions.filter((assertion) => assertion.status === "pass")
+                .length,
+            failed: failed.length,
+            warnings: warnings.length,
+        },
+        assertions,
+    };
+}
+export function scriptedScenarioResultToJunit(result) {
+    const outcomeMatches = result.scenario.observedOutcome === result.scenario.expectedOutcome;
+    const failures = result.assertions.filter((assertion) => assertion.status === "fail");
+    const testcases = result.assertions
+        .map((assertion) => {
+        const failure = !outcomeMatches && assertion.status === "fail"
+            ? `\n\t\t<failure message="${escapeXml(assertion.message)}">${escapeXml(JSON.stringify(assertion.evidence))}</failure>\n\t`
+            : "";
+        const expectedFailureOutput = outcomeMatches && assertion.status === "fail"
+            ? `\n\t\t<system-out>${escapeXml([
+                `Expected failing assertion observed: ${assertion.message}`,
+                JSON.stringify(assertion.evidence),
+            ].join("\n"))}</system-out>\n\t`
+            : "";
+        return `\t<testcase classname="${escapeXml(result.scenario.id)}" name="${escapeXml(assertion.id)}">${failure}${expectedFailureOutput}</testcase>`;
+    })
+        .join("\n");
+    const outcomeFailure = !outcomeMatches && failures.length === 0
+        ? `\t<testcase classname="${escapeXml(result.scenario.id)}" name="scenario-outcome">\n\t\t<failure message="${escapeXml(`Observed outcome ${result.scenario.observedOutcome}; expected ${result.scenario.expectedOutcome}.`)}"></failure>\n\t</testcase>\n`
+        : "";
+    const failureCount = outcomeMatches ? 0 : Math.max(1, failures.length);
+    const testCount = result.counts.assertions + (outcomeFailure ? 1 : 0);
+    return `<?xml version="1.0" encoding="UTF-8"?>\n<testsuite name="${escapeXml(result.scenario.id)}" tests="${testCount}" failures="${failureCount}" warnings="${result.counts.warnings}">\n${outcomeFailure}${testcases}\n</testsuite>\n`;
+}
+//# sourceMappingURL=scripted-scenario-runner.js.map

package/dist/server/scripted-scenario-runner.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"scripted-scenario-runner.js","sourceRoot":"","sources":["../../src/server/scripted-scenario-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,MAAM,CAAC,MAAM,+BAA+B,GAC3C,6CAA6C,CAAC;AA6C/C,SAAS,kBAAkB,CAAC,QAAiC;IAM5D,MAAM,KAAK,GAKP,EAAE,CAAC;IACP,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YACtE,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW;gBAAE,SAAS;YAC7C,KAAK,CAAC,IAAI,CAAC;gBACV,GAAG,SAAS;gBACZ,UAAU,EAAE,KAAK,CAAC,KAAK;gBACvB,cAAc;aACd,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAChB,IAAY,EACZ,EAAU,EACV,MAAmD,EACnD,KAAK,GAAG,GAAG,IAAI,IAAI,EAAE,EAAE;IAEvB,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,IAAI,CACZ,SAA2C,EAC3C,OAAe,EACf,oBAAyD,EAAE;IAE3D,OAAO;QACN,EAAE,EAAE,SAAS,CAAC,EAAE;QAChB,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,OAAO;QACvC,OAAO;QACP,QAAQ,EAAE,iBAAiB;KAC3B,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CACZ,SAA2C,EAC3C,OAAe,EACf,oBAAyD,EAAE;IAE3D,OAAO;QACN,EAAE,EAAE,SAAS,CAAC,EAAE;QAChB,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,MAAM,EAAE,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC1D,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,OAAO;QACvC,OAAO;QACP,QAAQ,EAAE,iBAAiB;KAC3B,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC9B,SAA2C,EAC3C,KAA2E,EAC3E,UAAoC,EAAE;IAEtC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AAED,SAAS,iBAAiB,CACzB,SAA2C,EAC3C,QAAiC,EACjC,OAAe;IAEf,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC/C,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,aAAa,CAAC,CAAC,CAAC;YACpB,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACvD,MAAM,UAAU,GAAG,sBAAsB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YACnE,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,SAAS,EAAE,0CAA0C,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAC/B,CAAC,IAAI,EAAE,EAAE,CACR,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;gBAC1C,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,EAAE,KAAK,UAAU,CAAC,CACrD,CAAC;YACF,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC,IAAI,CACJ,SAAS,EACT,WAAW,OAAO,CAAC,MAAM,yBAAyB,EAClD,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACtB,IAAI,EAAE,WAAW;oBACjB,EAAE,EACD,IAAI,CAAC,EAAE;wBACP,GAAG,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,cAAc,EAAE;oBAC3D,MAAM,EAAE,UAAU;oBAClB,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,cAAc,EAAE;iBAC/D,CAAC,CAAC,CACH;gBACF,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACxB,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAC/D,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;gBAC1B,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,IAAI,kBAAkB,CAAC;gBACjD,CAAC,CAAC,IAAI,CACJ,SAAS,EACT,QAAQ,IAAI,eAAe,OAAO,CAAC,MAAM,WAAW,EACpD,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACtB,IAAI,EAAE,WAAW;oBACjB,EAAE,EACD,IAAI,CAAC,EAAE;wBACP,GAAG,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,cAAc,EAAE;oBAC3D,MAAM,EAAE,UAAU;oBAClB,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,cAAc,EAAE;iBAC/D,CAAC,CAAC,CACH,CAAC;QACL,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACpB,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;YACnE,OAAO,MAAM;gBACZ,CAAC,CAAC,IAAI,CACJ,SAAS,EACT,gBAAgB,IAAI,GAAG,EACvB,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CACnC;gBACF,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,IAAI,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,EAAE,QAAQ,EAAE;gBAC1D,UAAU,EAAE,IAAI;aAChB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO,IAAI,CAAC,SAAS,EAAE,4CAA4C,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,IAAI,GAAG,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,OAAO,GACZ,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACtD,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC;YAC9C,OAAO,OAAO;gBACb,CAAC,CAAC,IAAI,CACJ,SAAS,EACT,0BAA0B,IAAI,GAAG,EACjC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CACnC;gBACF,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,gCAAgC,IAAI,GAAG,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;YAC5B,MAAM,SAAS,GAAG,sBAAsB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACjE,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,OAAO,IAAI,CAAC,SAAS,EAAE,yCAAyC,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;YACnD,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAChC,CAAC,CAAC,IAAI,CACJ,SAAS,EACT,wBAAwB,SAAS,GAAG,EACpC,QAAQ,CAAC,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAC3C;gBACF,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,SAAS,GAAG,CAAC,CAAC;QAC1D,CAAC;IACF,CAAC;IACD,MAAM,WAAW,GAAU,SAAS,CAAC,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wCAAwC,WAAW,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,wBAAwB,CACvC,QAAiC,EACjC,UAAgC,EAAE;IAElC,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAChE,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CACxE,CAAC;IACF,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CACjC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAC1C,CAAC;IACF,MAAM,eAAe,GACpB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO;QACN,aAAa,EAAE,+BAA+B;QAC9C,qBAAqB,EAAE,QAAQ,CAAC,aAAa;QAC7C,QAAQ,EAAE;YACT,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,eAAe,EAAE,QAAQ,CAAC,eAAe,IAAI,MAAM;YACnD,eAAe;SACf;QACD,GAAG,EAAE;YACJ,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM;YAC9B,SAAS,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,MAAM;YAC9C,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE;SAChD;QACD,MAAM,EAAE;YACP,UAAU,EAAE,UAAU,CAAC,MAAM;YAC7B,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC;iBACnE,MAAM;YACR,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,QAAQ,CAAC,MAAM;SACzB;QACD,UAAU;KACV,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC5C,MAAiC;IAEjC,MAAM,cAAc,GACnB,MAAM,CAAC,QAAQ,CAAC,eAAe,KAAK,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;IACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CACxC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAC1C,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU;SACjC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,OAAO,GACZ,CAAC,cAAc,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM;YAC7C,CAAC,CAAC,2BAA2B,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,SAAS,CACrE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAClC,gBAAgB;YAClB,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,qBAAqB,GAC1B,cAAc,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM;YAC5C,CAAC,CAAC,qBAAqB,SAAS,CAC9B;gBACC,wCAAwC,SAAS,CAAC,OAAO,EAAE;gBAC3D,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC;aAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,mBAAmB;YACrB,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,0BAA0B,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,OAAO,GAAG,qBAAqB,aAAa,CAAC;IACnJ,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,cAAc,GACnB,CAAC,cAAc,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QACvC,CAAC,CAAC,0BAA0B,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,qDAAqD,SAAS,CACrH,oBAAoB,MAAM,CAAC,QAAQ,CAAC,eAAe,cAAc,MAAM,CAAC,QAAQ,CAAC,eAAe,GAAG,CACnG,+BAA+B;QACjC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,4DAA4D,SAAS,CAC3E,MAAM,CAAC,QAAQ,CAAC,EAAE,CAClB,YAAY,SAAS,eAAe,YAAY,eAAe,MAAM,CAAC,MAAM,CAAC,QAAQ,OAAO,cAAc,GAAG,SAAS,kBAAkB,CAAC;AAC3I,CAAC","sourcesContent":["import { existsSync, readFileSync, statSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport type {\n\tMaestroScenarioOutcome,\n\tMaestroScenarioSeverity,\n\tMaestroScriptedScenario,\n\tMaestroScriptedScenarioAssertion,\n\tMaestroScriptedScenarioAssertionKind,\n\tMaestroScriptedStatement,\n} from \"@evalops/contracts\";\nimport { escapeXml } from \"./junit-xml.js\";\n\nexport const SCRIPTED_SCENARIO_RESULT_SCHEMA =\n\t\"evalops.maestro.scripted-scenario-result.v1\";\n\nexport type ScriptedScenarioAssertionStatus = \"pass\" | \"fail\" | \"warn\";\n\nexport interface ScriptedScenarioAssertionEvidence {\n\tkind: string;\n\tid: string;\n\tsource: \"scenario\" | \"workspace\" | \"audit\";\n\tlabel: string;\n}\n\nexport interface ScriptedScenarioAssertionResult {\n\tid: string;\n\tkind: MaestroScriptedScenarioAssertionKind;\n\tstatus: ScriptedScenarioAssertionStatus;\n\tseverity: MaestroScenarioSeverity;\n\tmessage: string;\n\tevidence: ScriptedScenarioAssertionEvidence[];\n}\n\nexport interface ScriptedScenarioRunResult {\n\tschemaVersion: typeof SCRIPTED_SCENARIO_RESULT_SCHEMA;\n\tscenarioSchemaVersion: MaestroScriptedScenario[\"schemaVersion\"];\n\tscenario: {\n\t\tid: string;\n\t\tdescription: string;\n\t\texpectedOutcome: MaestroScenarioOutcome;\n\t\tobservedOutcome: MaestroScenarioOutcome;\n\t};\n\trun: {\n\t\tscenarioId: string;\n\t\treplay: true;\n\t\tframes: number;\n\t\ttoolCalls: number;\n\t\tauditEvents: string[];\n\t};\n\tcounts: {\n\t\tassertions: number;\n\t\tpassed: number;\n\t\tfailed: number;\n\t\twarnings: number;\n\t};\n\tassertions: ScriptedScenarioAssertionResult[];\n}\n\nfunction toolCallStatements(scenario: MaestroScriptedScenario): Array<\n\tExtract<MaestroScriptedStatement, { kind: \"tool_call\" }> & {\n\t\tframeIndex: number;\n\t\tstatementIndex: number;\n\t}\n> {\n\tconst calls: Array<\n\t\tExtract<MaestroScriptedStatement, { kind: \"tool_call\" }> & {\n\t\t\tframeIndex: number;\n\t\t\tstatementIndex: number;\n\t\t}\n\t> = [];\n\tfor (const frame of scenario.frames) {\n\t\tfor (const [statementIndex, statement] of frame.statements.entries()) {\n\t\t\tif (statement.kind !== \"tool_call\") continue;\n\t\t\tcalls.push({\n\t\t\t\t...statement,\n\t\t\t\tframeIndex: frame.index,\n\t\t\t\tstatementIndex,\n\t\t\t});\n\t\t}\n\t}\n\treturn calls;\n}\n\nfunction evidence(\n\tkind: string,\n\tid: string,\n\tsource: ScriptedScenarioAssertionEvidence[\"source\"],\n\tlabel = `${kind}:${id}`,\n): ScriptedScenarioAssertionEvidence[] {\n\treturn [{ kind, id, source, label }];\n}\n\nfunction pass(\n\tassertion: MaestroScriptedScenarioAssertion,\n\tmessage: string,\n\tassertionEvidence: ScriptedScenarioAssertionEvidence[] = [],\n): ScriptedScenarioAssertionResult {\n\treturn {\n\t\tid: assertion.id,\n\t\tkind: assertion.kind,\n\t\tstatus: \"pass\",\n\t\tseverity: assertion.severity ?? \"error\",\n\t\tmessage,\n\t\tevidence: assertionEvidence,\n\t};\n}\n\nfunction fail(\n\tassertion: MaestroScriptedScenarioAssertion,\n\tmessage: string,\n\tassertionEvidence: ScriptedScenarioAssertionEvidence[] = [],\n): ScriptedScenarioAssertionResult {\n\treturn {\n\t\tid: assertion.id,\n\t\tkind: assertion.kind,\n\t\tstatus: assertion.severity === \"warning\" ? \"warn\" : \"fail\",\n\t\tseverity: assertion.severity ?? \"error\",\n\t\tmessage,\n\t\tevidence: assertionEvidence,\n\t};\n}\n\nfunction requireAssertionString(\n\tassertion: MaestroScriptedScenarioAssertion,\n\tfield: \"tool\" | \"toolCallId\" | \"path\" | \"contains\" | \"equals\" | \"eventType\",\n\toptions: { allowEmpty?: boolean } = {},\n): string | undefined {\n\tconst value = assertion[field];\n\tif (typeof value !== \"string\") {\n\t\treturn undefined;\n\t}\n\treturn value.length > 0 || options.allowEmpty ? value : undefined;\n}\n\nfunction evaluateAssertion(\n\tassertion: MaestroScriptedScenarioAssertion,\n\tscenario: MaestroScriptedScenario,\n\tbaseDir: string,\n): ScriptedScenarioAssertionResult {\n\tconst toolCalls = toolCallStatements(scenario);\n\tswitch (assertion.kind) {\n\t\tcase \"tool_called\": {\n\t\t\tconst tool = requireAssertionString(assertion, \"tool\");\n\t\t\tconst toolCallId = requireAssertionString(assertion, \"toolCallId\");\n\t\t\tif (!tool && !toolCallId) {\n\t\t\t\treturn fail(assertion, \"tool_called requires tool or toolCallId.\");\n\t\t\t}\n\t\t\tconst matches = toolCalls.filter(\n\t\t\t\t(call) =>\n\t\t\t\t\t(tool === undefined || call.tool === tool) &&\n\t\t\t\t\t(toolCallId === undefined || call.id === toolCallId),\n\t\t\t);\n\t\t\treturn matches.length > 0\n\t\t\t\t? pass(\n\t\t\t\t\t\tassertion,\n\t\t\t\t\t\t`Matched ${matches.length} scripted tool call(s).`,\n\t\t\t\t\t\tmatches.map((call) => ({\n\t\t\t\t\t\t\tkind: \"tool_call\",\n\t\t\t\t\t\t\tid:\n\t\t\t\t\t\t\t\tcall.id ??\n\t\t\t\t\t\t\t\t`${scenario.id}:${call.frameIndex}:${call.statementIndex}`,\n\t\t\t\t\t\t\tsource: \"scenario\",\n\t\t\t\t\t\t\tlabel: `${call.tool}:${call.frameIndex}.${call.statementIndex}`,\n\t\t\t\t\t\t})),\n\t\t\t\t\t)\n\t\t\t\t: fail(assertion, \"No scripted tool call matched.\");\n\t\t}\n\t\tcase \"tool_not_called\": {\n\t\t\tconst tool = requireAssertionString(assertion, \"tool\");\n\t\t\tif (!tool) {\n\t\t\t\treturn fail(assertion, \"tool_not_called requires tool.\");\n\t\t\t}\n\t\t\tconst matches = toolCalls.filter((call) => call.tool === tool);\n\t\t\treturn matches.length === 0\n\t\t\t\t? pass(assertion, `Tool ${tool} was not called.`)\n\t\t\t\t: fail(\n\t\t\t\t\t\tassertion,\n\t\t\t\t\t\t`Tool ${tool} was called ${matches.length} time(s).`,\n\t\t\t\t\t\tmatches.map((call) => ({\n\t\t\t\t\t\t\tkind: \"tool_call\",\n\t\t\t\t\t\t\tid:\n\t\t\t\t\t\t\t\tcall.id ??\n\t\t\t\t\t\t\t\t`${scenario.id}:${call.frameIndex}:${call.statementIndex}`,\n\t\t\t\t\t\t\tsource: \"scenario\",\n\t\t\t\t\t\t\tlabel: `${call.tool}:${call.frameIndex}.${call.statementIndex}`,\n\t\t\t\t\t\t})),\n\t\t\t\t\t);\n\t\t}\n\t\tcase \"file_exists\": {\n\t\t\tconst path = requireAssertionString(assertion, \"path\");\n\t\t\tif (!path) {\n\t\t\t\treturn fail(assertion, \"file_exists requires path.\");\n\t\t\t}\n\t\t\tconst fullPath = resolve(baseDir, path);\n\t\t\tconst exists = existsSync(fullPath) && statSync(fullPath).isFile();\n\t\t\treturn exists\n\t\t\t\t? pass(\n\t\t\t\t\t\tassertion,\n\t\t\t\t\t\t`File exists: ${path}.`,\n\t\t\t\t\t\tevidence(\"file\", path, \"workspace\"),\n\t\t\t\t\t)\n\t\t\t\t: fail(assertion, `File does not exist: ${path}.`);\n\t\t}\n\t\tcase \"file_contents\": {\n\t\t\tconst path = requireAssertionString(assertion, \"path\");\n\t\t\tif (!path) {\n\t\t\t\treturn fail(assertion, \"file_contents requires path.\");\n\t\t\t}\n\t\t\tconst contains = requireAssertionString(assertion, \"contains\");\n\t\t\tconst equals = requireAssertionString(assertion, \"equals\", {\n\t\t\t\tallowEmpty: true,\n\t\t\t});\n\t\t\tif (!contains && equals === undefined) {\n\t\t\t\treturn fail(assertion, \"file_contents requires contains or equals.\");\n\t\t\t}\n\t\t\tconst fullPath = resolve(baseDir, path);\n\t\t\tif (!existsSync(fullPath) || !statSync(fullPath).isFile()) {\n\t\t\t\treturn fail(assertion, `File does not exist: ${path}.`);\n\t\t\t}\n\t\t\tconst content = readFileSync(fullPath, \"utf8\");\n\t\t\tconst matched =\n\t\t\t\t(contains !== undefined && content.includes(contains)) ||\n\t\t\t\t(equals !== undefined && content === equals);\n\t\t\treturn matched\n\t\t\t\t? pass(\n\t\t\t\t\t\tassertion,\n\t\t\t\t\t\t`File contents matched: ${path}.`,\n\t\t\t\t\t\tevidence(\"file\", path, \"workspace\"),\n\t\t\t\t\t)\n\t\t\t\t: fail(assertion, `File contents did not match: ${path}.`);\n\t\t}\n\t\tcase \"audit_event_emitted\": {\n\t\t\tconst eventType = requireAssertionString(assertion, \"eventType\");\n\t\t\tif (!eventType) {\n\t\t\t\treturn fail(assertion, \"audit_event_emitted requires eventType.\");\n\t\t\t}\n\t\t\tconst events = scenario.metadata.auditEvents ?? [];\n\t\t\treturn events.includes(eventType)\n\t\t\t\t? pass(\n\t\t\t\t\t\tassertion,\n\t\t\t\t\t\t`Audit event present: ${eventType}.`,\n\t\t\t\t\t\tevidence(\"audit_event\", eventType, \"audit\"),\n\t\t\t\t\t)\n\t\t\t\t: fail(assertion, `Audit event missing: ${eventType}.`);\n\t\t}\n\t}\n\tconst _exhaustive: never = assertion.kind;\n\treturn fail(assertion, `Unsupported scripted assertion kind: ${_exhaustive}`);\n}\n\nexport function evaluateScriptedScenario(\n\tscenario: MaestroScriptedScenario,\n\toptions: { baseDir?: string } = {},\n): ScriptedScenarioRunResult {\n\tconst assertions = (scenario.assertions ?? []).map((assertion) =>\n\t\tevaluateAssertion(assertion, scenario, options.baseDir ?? process.cwd()),\n\t);\n\tconst failed = assertions.filter((assertion) => assertion.status === \"fail\");\n\tconst warnings = assertions.filter(\n\t\t(assertion) => assertion.status === \"warn\",\n\t);\n\tconst observedOutcome: MaestroScenarioOutcome =\n\t\tfailed.length > 0 ? \"fail\" : \"pass\";\n\treturn {\n\t\tschemaVersion: SCRIPTED_SCENARIO_RESULT_SCHEMA,\n\t\tscenarioSchemaVersion: scenario.schemaVersion,\n\t\tscenario: {\n\t\t\tid: scenario.id,\n\t\t\tdescription: scenario.description,\n\t\t\texpectedOutcome: scenario.expectedOutcome ?? \"pass\",\n\t\t\tobservedOutcome,\n\t\t},\n\t\trun: {\n\t\t\tscenarioId: scenario.id,\n\t\t\treplay: true,\n\t\t\tframes: scenario.frames.length,\n\t\t\ttoolCalls: toolCallStatements(scenario).length,\n\t\t\tauditEvents: scenario.metadata.auditEvents ?? [],\n\t\t},\n\t\tcounts: {\n\t\t\tassertions: assertions.length,\n\t\t\tpassed: assertions.filter((assertion) => assertion.status === \"pass\")\n\t\t\t\t.length,\n\t\t\tfailed: failed.length,\n\t\t\twarnings: warnings.length,\n\t\t},\n\t\tassertions,\n\t};\n}\n\nexport function scriptedScenarioResultToJunit(\n\tresult: ScriptedScenarioRunResult,\n): string {\n\tconst outcomeMatches =\n\t\tresult.scenario.observedOutcome === result.scenario.expectedOutcome;\n\tconst failures = result.assertions.filter(\n\t\t(assertion) => assertion.status === \"fail\",\n\t);\n\tconst testcases = result.assertions\n\t\t.map((assertion) => {\n\t\t\tconst failure =\n\t\t\t\t!outcomeMatches && assertion.status === \"fail\"\n\t\t\t\t\t? `\\n\\t\\t<failure message=\"${escapeXml(assertion.message)}\">${escapeXml(\n\t\t\t\t\t\t\tJSON.stringify(assertion.evidence),\n\t\t\t\t\t\t)}</failure>\\n\\t`\n\t\t\t\t\t: \"\";\n\t\t\tconst expectedFailureOutput =\n\t\t\t\toutcomeMatches && assertion.status === \"fail\"\n\t\t\t\t\t? `\\n\\t\\t<system-out>${escapeXml(\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t`Expected failing assertion observed: ${assertion.message}`,\n\t\t\t\t\t\t\t\tJSON.stringify(assertion.evidence),\n\t\t\t\t\t\t\t].join(\"\\n\"),\n\t\t\t\t\t\t)}</system-out>\\n\\t`\n\t\t\t\t\t: \"\";\n\t\t\treturn `\\t<testcase classname=\"${escapeXml(result.scenario.id)}\" name=\"${escapeXml(assertion.id)}\">${failure}${expectedFailureOutput}</testcase>`;\n\t\t})\n\t\t.join(\"\\n\");\n\tconst outcomeFailure =\n\t\t!outcomeMatches && failures.length === 0\n\t\t\t? `\\t<testcase classname=\"${escapeXml(result.scenario.id)}\" name=\"scenario-outcome\">\\n\\t\\t<failure message=\"${escapeXml(\n\t\t\t\t\t`Observed outcome ${result.scenario.observedOutcome}; expected ${result.scenario.expectedOutcome}.`,\n\t\t\t\t)}\"></failure>\\n\\t</testcase>\\n`\n\t\t\t: \"\";\n\tconst failureCount = outcomeMatches ? 0 : Math.max(1, failures.length);\n\tconst testCount = result.counts.assertions + (outcomeFailure ? 1 : 0);\n\treturn `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\\n<testsuite name=\"${escapeXml(\n\t\tresult.scenario.id,\n\t)}\" tests=\"${testCount}\" failures=\"${failureCount}\" warnings=\"${result.counts.warnings}\">\\n${outcomeFailure}${testcases}\\n</testsuite>\\n`;\n}\n"]}

package/dist/server/server-middlewares.d.ts CHANGED Viewed

@@ -1,6 +1,9 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { Middleware } from "./middleware.js";
 import type { RateLimiter, TieredRateLimiter } from "./rate-limiter.js";
+interface AuthBoundaryOptions {
+    exemptPaths?: readonly string[];
+}
 export declare function createLoadSheddingMiddleware(corsHeaders: Record<string, string>): Middleware;
 export declare function createRateLimitMiddleware(rateLimiter: RateLimiter, corsHeaders: Record<string, string>, trustProxy?: boolean, trustProxyHops?: number): Middleware;
 /**
@@ -9,8 +12,8 @@ export declare function createRateLimitMiddleware(rateLimiter: RateLimiter, cors
  */
 export declare function createTieredRateLimitMiddleware(rateLimiter: TieredRateLimiter, corsHeaders: Record<string, string>, trustProxy?: boolean, trustProxyHops?: number): Middleware;
 export declare function createCorsMiddleware(corsHeaders: Record<string, string>): Middleware;
-export declare function createAuthMiddleware(apiKey: string | null, corsHeaders: Record<string, string>, requireApiKey?: boolean): Middleware;
-export declare function createCsrfMiddleware(token: string | null, corsHeaders: Record<string, string>, enabled?: boolean): Middleware;
+export declare function createAuthMiddleware(apiKey: string | null, corsHeaders: Record<string, string>, requireApiKey?: boolean, options?: AuthBoundaryOptions): Middleware;
+export declare function createCsrfMiddleware(token: string | null, corsHeaders: Record<string, string>, enabled?: boolean, options?: AuthBoundaryOptions): Middleware;
 export declare function createRouterMiddleware(routerHandler: (req: IncomingMessage, res: ServerResponse, pathname: string) => Promise<void> | void): Middleware;
 export interface IpAccessRule {
     /** CIDR notation (e.g., "192.168.1.0/24") or single IP */
@@ -38,4 +41,5 @@ export declare function checkIpAccess(ip: string, config: IpAccessConfig): {
  * getConfig is called per-request to allow dynamic config updates.
  */
 export declare function createIpAccessMiddleware(getConfig: () => IpAccessConfig | null, corsHeaders: Record<string, string>, trustProxy?: boolean, trustProxyHops?: number): Middleware;
+export {};
 //# sourceMappingURL=server-middlewares.d.ts.map

package/dist/server/server-middlewares.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"server-middlewares.d.ts","sourceRoot":"","sources":["../../src/server/server-middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;~~AAgBxE~~,wBAAgB,4BAA4B,CAC3C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,UAAU,CAyBZ;AA6CD,wBAAgB,yBAAyB,CACxC,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,UAAU,UAAQ,EAClB,cAAc,SAAI,GAChB,UAAU,CAoCZ;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAC9C,WAAW,EAAE,iBAAiB,EAC9B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,UAAU,UAAQ,EAClB,cAAc,SAAI,GAChB,UAAU,CAsCZ;AAED,wBAAgB,oBAAoB,CACnC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,UAAU,CASZ;AAED,wBAAgB,oBAAoB,CACnC,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,aAAa,UAAQ,~~GACnB~~,UAAU,~~CAyDZ~~;AAED,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,OAAO,UAAQ,~~GACb~~,UAAU,~~CAgCZ~~;AAED,wBAAgB,sBAAsB,CACrC,aAAa,EAAE,CACd,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,MAAM,KACZ,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GACvB,UAAU,CASZ;AAMD,MAAM,WAAW,YAAY;IAC5B,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC9B,yCAAyC;IACzC,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC;IAChC,iDAAiD;IACjD,KAAK,EAAE,YAAY,EAAE,CAAC;CACtB;AA8ED;;GAEG;AACH,wBAAgB,aAAa,CAC5B,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,cAAc,GACpB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,YAAY,CAAA;CAAE,CAWlD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACvC,SAAS,EAAE,MAAM,cAAc,GAAG,IAAI,EACtC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,UAAU,UAAQ,EAClB,cAAc,SAAI,GAChB,UAAU,CA6CZ"}
1	+ {"version":3,"file":"server-middlewares.d.ts","sourceRoot":"","sources":["../../src/server/server-middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAKxE,UAAU,mBAAmB;IAC5B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAaD,wBAAgB,4BAA4B,CAC3C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,UAAU,CAyBZ;AA6CD,wBAAgB,yBAAyB,CACxC,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,UAAU,UAAQ,EAClB,cAAc,SAAI,GAChB,UAAU,CAoCZ;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAC9C,WAAW,EAAE,iBAAiB,EAC9B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,UAAU,UAAQ,EAClB,cAAc,SAAI,GAChB,UAAU,CAsCZ;AAED,wBAAgB,oBAAoB,CACnC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,UAAU,CASZ;AAED,wBAAgB,oBAAoB,CACnC,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,aAAa,UAAQ,EACrB,OAAO,GAAE,mBAAwB,GAC/B,UAAU,CA4DZ;AAED,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,OAAO,UAAQ,EACf,OAAO,GAAE,mBAAwB,GAC/B,UAAU,CAmCZ;AAED,wBAAgB,sBAAsB,CACrC,aAAa,EAAE,CACd,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,MAAM,KACZ,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GACvB,UAAU,CASZ;AAMD,MAAM,WAAW,YAAY;IAC5B,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC9B,yCAAyC;IACzC,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC;IAChC,iDAAiD;IACjD,KAAK,EAAE,YAAY,EAAE,CAAC;CACtB;AA8ED;;GAEG;AACH,wBAAgB,aAAa,CAC5B,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,cAAc,GACpB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,YAAY,CAAA;CAAE,CAWlD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACvC,SAAS,EAAE,MAAM,cAAc,GAAG,IAAI,EACtC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,UAAU,UAAQ,EAClB,cAAc,SAAI,GAChB,UAAU,CA6CZ"}

package/dist/server/server-middlewares.js CHANGED Viewed

@@ -148,13 +148,16 @@ export function createCorsMiddleware(corsHeaders) {
         return next();
     };
 }
-export function createAuthMiddleware(apiKey, corsHeaders, requireApiKey = false) {
+export function createAuthMiddleware(apiKey, corsHeaders, requireApiKey = false, options = {}) {
     return async (req, res, next) => {
         const pathname = getPathname(req);
         const isApiRoute = pathname.startsWith("/api");
         const isDebugRoute = pathname.startsWith("/debug");
         const requiresAuthBoundary = isApiRoute || isDebugRoute;
         if (requiresAuthBoundary) {
+            if (options.exemptPaths?.includes(pathname)) {
+                return next();
+            }
             const missingKey = !apiKey || apiKey.length === 0;
             // No key provided
             if (missingKey) {
@@ -185,7 +188,7 @@ export function createAuthMiddleware(apiKey, corsHeaders, requireApiKey = false)
         return next();
     };
 }
-export function createCsrfMiddleware(token, corsHeaders, enabled = false) {
+export function createCsrfMiddleware(token, corsHeaders, enabled = false, options = {}) {
     if (!enabled || !token) {
         return (_req, _res, next) => next();
     }
@@ -198,6 +201,9 @@ export function createCsrfMiddleware(token, corsHeaders, enabled = false) {
         if (!pathname.startsWith("/api")) {
             return next();
         }
+        if (options.exemptPaths?.includes(pathname)) {
+            return next();
+        }
         const value = getRequestHeader(req, "x-composer-csrf", "x-maestro-csrf", "x-csrf-token", "x-xsrf-token");
         if (!value || !secureCompare(String(value), token)) {
             sendJson(res, 403, { error: "Forbidden: missing or invalid CSRF token" }, corsHeaders, req);

package/dist/server/server-middlewares.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"server-middlewares.js","sourceRoot":"","sources":["../../src/server/server-middlewares.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iCAAiC,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAGvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE9E,MAAM,MAAM,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAEpD,yCAAyC;AACzC,SAAS,WAAW,CAAC,GAAoB;IACxC,IAAI,CAAC;QACJ,sEAAsE;QACtE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC,QAAQ,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,GAAG,CAAC;IACZ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC3C,WAAmC;IAEnC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,qDAAqD;QACrD,qEAAqE;QACrE,+CAA+C;QAC/C,IACC,YAAY,EAAE;YACd,QAAQ,KAAK,UAAU;YACvB,QAAQ,KAAK,SAAS;YACtB,QAAQ,KAAK,cAAc,EAC1B,CAAC;YACF,4BAA4B;YAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBAClB,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,GAAG;gBAClB,GAAG,WAAW;aACd,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CACN,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,CACtE,CAAC;YACF,OAAO;QACR,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,EAAU;IAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,CAAC;AACX,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CACnB,GAAoB,EACpB,UAAmB,EACnB,cAAsB;IAEtB,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IAE/C,IAAI,UAAU,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YACnC,4DAA4D;YAC5D,wDAAwD;YACxD,kDAAkD;YAClD,yEAAyE;YACzE,6CAA6C;YAC7C,sEAAsE;YACtE,MAAM,GAAG,GAAG,SAAS;iBACnB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,OAAO,CAAC,CAAC;YAClB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,mEAAmE;gBACnE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC;gBACjE,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC;QACF,CAAC;IACF,CAAC;IAED,oEAAoE;IACpE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACxC,WAAwB,EACxB,WAAmC,EACnC,UAAU,GAAG,KAAK,EAClB,cAAc,GAAG,CAAC;IAElB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,+DAA+D;QAC/D,MAAM,aAAa,GAClB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAC3B,QAAQ,KAAK,cAAc;YAC3B,QAAQ,KAAK,UAAU,CAAC;QAEzB,IAAI,aAAa,EAAE,CAAC;YACnB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;YACxD,iEAAiE;YACjE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GACzC,MAAM,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAElC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBAClB,cAAc,EAAE,kBAAkB;oBAClC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE;oBACrC,uBAAuB,EAAE,GAAG;oBAC5B,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;oBACvD,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;oBAChE,GAAG,WAAW;iBACd,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CACN,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CACnE,CAAC;gBACF,OAAO;YACR,CAAC;YACD,qDAAqD;YACrD,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAC9C,WAA8B,EAC9B,WAAmC,EACnC,UAAU,GAAG,KAAK,EAClB,cAAc,GAAG,CAAC;IAElB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,+DAA+D;QAC/D,MAAM,aAAa,GAClB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAC3B,QAAQ,KAAK,cAAc;YAC3B,QAAQ,KAAK,UAAU,CAAC;QAEzB,IAAI,aAAa,EAAE,CAAC;YACnB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;YACxD,iEAAiE;YACjE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC,UAAU,CACxE,EAAE,EACF,QAAQ,CACR,CAAC;YAEF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBAClB,cAAc,EAAE,kBAAkB;oBAClC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE;oBACrC,uBAAuB,EAAE,GAAG;oBAC5B,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;oBACvD,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;oBAChE,GAAG,WAAW;iBACd,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CACN,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CACnE,CAAC;gBACF,OAAO;YACR,CAAC;YACD,qDAAqD;YACrD,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,WAAmC;IAEnC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAChC,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACR,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,MAAqB,EACrB,WAAmC,EACnC,aAAa,GAAG,KAAK;IAErB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,oBAAoB,GAAG,UAAU,IAAI,YAAY,CAAC;QACxD,IAAI,oBAAoB,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;YAElD,kBAAkB;YAClB,IAAI,UAAU,EAAE,CAAC;gBAChB,IAAI,aAAa,EAAE,CAAC;oBACnB,QAAQ,CACP,GAAG,EACH,GAAG,EACH;wBACC,KAAK,EACJ,6KAA6K;qBAC9K,EACD,WAAW,EACX,GAAG,CACH,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,6CAA6C;gBAC7C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACd,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,cAAc,EAAE,EACvC,WAAW,EACX,GAAG,CACH,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,OAAO,IAAI,EAAE,CAAC;YACf,CAAC;YAED,6BAA6B;YAC7B,IAAI,UAAU,IAAI,iCAAiC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,OAAO,IAAI,EAAE,CAAC;YACf,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACd,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,cAAc,EAAE,EACvC,WAAW,EACX,GAAG,CACH,CAAC;gBACF,OAAO;YACR,CAAC;QACF,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,KAAoB,EACpB,WAAmC,EACnC,OAAO,GAAG,KAAK;IAEf,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnE,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,gBAAgB,CAC7B,GAAG,EACH,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,cAAc,CACd,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YACpD,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,0CAA0C,EAAE,EACrD,WAAW,EACX,GAAG,CACH,CAAC;YACF,OAAO;QACR,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACrC,aAIyB;IAEzB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACxC,gFAAgF;QAChF,mCAAmC;QACnC,mFAAmF;QACnF,2CAA2C;IAC5C,CAAC,CAAC;AACH,CAAC;AAsBD;;GAEG;AACH,SAAS,SAAS,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,EAAE,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEtE,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IACC,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EACvD,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IAED,4CAA4C;IAC5C,MAAM,KAAK,GAAG,MAAM,CACnB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC;QACnB,CAAC,OAAO,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC;QACnB,CAAC,OAAO,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC;QAClB,OAAO,CAAC,CAAC,CAAE,CAAC;QACZ,CAAC,CACF,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,EAAU;IAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAEhC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,IACC,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EACrD,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IAED,4CAA4C;IAC5C,OAAO,MAAM,CACZ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrE,CAAC,CACF,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,EAAU,EAAE,OAAe;IACpD,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAEjC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,kBAAkB;QAClB,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,UAAU,KAAK,IAAI,IAAI,KAAK,KAAK,UAAU,CAAC;IACpD,CAAC;IAED,OAAO,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC5B,EAAU,EACV,MAAsB;IAEtB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,OAAO;gBACN,OAAO,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO;gBAC9B,WAAW,EAAE,IAAI;aACjB,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACvC,SAAsC,EACtC,WAAmC,EACnC,UAAU,GAAG,KAAK,EAClB,cAAc,GAAG,CAAC;IAElB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,4BAA4B;YAC5B,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QAED,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QAE/C,yCAAyC;QACzC,IAAI,UAAU,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACjD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,SAAS;qBACnB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC;oBACjE,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;gBAC7B,CAAC;YACF,CAAC;QACF,CAAC;QAED,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;gBAC/B,EAAE;gBACF,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO;gBACxC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW;aAC5C,CAAC,CAAC;YAEH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBAClB,cAAc,EAAE,kBAAkB;gBAClC,GAAG,WAAW;aACd,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC,CAAC;YACxE,OAAO;QACR,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { parse } from \"node:url\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { getArtifactAccessGrantFromRequest } from \"./artifact-access.js\";\nimport { checkApiAuth } from \"./authz.js\";\nimport { isOverloaded, logRequest } from \"./logger.js\";\nimport type { Middleware } from \"./middleware.js\";\nimport type { RateLimiter, TieredRateLimiter } from \"./rate-limiter.js\";\nimport { getRequestHeader, secureCompare, sendJson } from \"./server-utils.js\";\n\nconst logger = createLogger(\"middleware:ip-access\");\n\n// Helper for consistent safe URL parsing\nfunction getPathname(req: IncomingMessage): string {\n\ttry {\n\t\t// Use a dummy base for relative URLs (req.url) to ensure safe parsing\n\t\tconst parsed = new URL(req.url \|\| \"/\", \"http://localhost\");\n\t\treturn parsed.pathname;\n\t} catch {\n\t\treturn \"/\";\n\t}\n}\n\nexport function createLoadSheddingMiddleware(\n\tcorsHeaders: Record<string, string>,\n): Middleware {\n\treturn (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\t// 1. Criticality-Aware Load Shedding (Global health)\n\t\t// We prioritize /healthz, /api/metrics, and existing SSE connections\n\t\t// We drop new /api/chat requests if overloaded\n\t\tif (\n\t\t\tisOverloaded() &&\n\t\t\tpathname !== \"/healthz\" &&\n\t\t\tpathname !== \"/readyz\" &&\n\t\t\tpathname !== \"/api/metrics\"\n\t\t) {\n\t\t\t// Drop non-critical traffic\n\t\t\tres.writeHead(503, {\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\"Retry-After\": \"5\",\n\t\t\t\t...corsHeaders,\n\t\t\t});\n\t\t\tres.end(\n\t\t\t\tJSON.stringify({ error: \"Service Unavailable: Server is overloaded\" }),\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t\treturn next();\n\t};\n}\n\n// Normalize IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1 -> 127.0.0.1)\nfunction normalizeIP(ip: string): string {\n\tif (ip.startsWith(\"::ffff:\")) {\n\t\treturn ip.substring(7);\n\t}\n\treturn ip;\n}\n\n/*\n Extract client IP from request, handling proxy headers.\n /\nfunction getClientIp(\n\treq: IncomingMessage,\n\ttrustProxy: boolean,\n\ttrustProxyHops: number,\n): string {\n\tlet ip = req.socket.remoteAddress \|\| \"unknown\";\n\n\tif (trustProxy) {\n\t\tconst forwarded = req.headers[\"x-forwarded-for\"];\n\t\tif (typeof forwarded === \"string\") {\n\t\t\t// Parse IPs and read from right-to-left to prevent spoofing\n\t\t\t// X-Forwarded-For format: \"client, proxy1, proxy2, ...\"\n\t\t\t// Each proxy appends its upstream IP to the right\n\t\t\t// trustProxyHops = number of trusted proxies between us and the internet\n\t\t\t// Example with CDN -> nginx -> app (2 hops):\n\t\t\t// Header: \"client, cdn, nginx\" -> skip 2 from right -> use \"client\"\n\t\t\tconst ips = forwarded\n\t\t\t\t.split(\",\")\n\t\t\t\t.map((s) => s.trim())\n\t\t\t\t.filter(Boolean);\n\t\t\tif (ips.length > 0) {\n\t\t\t\t// Skip trustProxyHops from the right to get the first untrusted IP\n\t\t\t\tconst targetIndex = Math.max(0, ips.length - trustProxyHops - 1);\n\t\t\t\tip = ips[targetIndex] \|\| ip;\n\t\t\t}\n\t\t}\n\t}\n\n\t// Normalize IPv4-mapped IPv6 addresses for consistent rate limiting\n\treturn normalizeIP(ip);\n}\n\nexport function createRateLimitMiddleware(\n\trateLimiter: RateLimiter,\n\tcorsHeaders: Record<string, string>,\n\ttrustProxy = false,\n\ttrustProxyHops = 1,\n): Middleware {\n\treturn async (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\t// Skip for static assets and critical health/metrics endpoints\n\t\tconst isRateLimited =\n\t\t\tpathname.startsWith(\"/api\") &&\n\t\t\tpathname !== \"/api/metrics\" &&\n\t\t\tpathname !== \"/healthz\";\n\n\t\tif (isRateLimited) {\n\t\t\tconst ip = getClientIp(req, trustProxy, trustProxyHops);\n\t\t\t// Use async check to support Redis for distributed rate limiting\n\t\t\tconst { allowed, remaining, reset, limit } =\n\t\t\t\tawait rateLimiter.checkAsync(ip);\n\n\t\t\tif (!allowed) {\n\t\t\t\tres.writeHead(429, {\n\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\"X-RateLimit-Limit\": limit.toString(),\n\t\t\t\t\t\"X-RateLimit-Remaining\": \"0\",\n\t\t\t\t\t\"X-RateLimit-Reset\": Math.ceil(reset / 1000).toString(),\n\t\t\t\t\t\"Retry-After\": Math.ceil((reset - Date.now()) / 1000).toString(),\n\t\t\t\t\t...corsHeaders,\n\t\t\t\t});\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({ error: \"Too Many Requests: Rate limit exceeded\" }),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\t// Add rate limit headers to successful responses too\n\t\t\tres.setHeader(\"X-RateLimit-Limit\", limit.toString());\n\t\t\tres.setHeader(\"X-RateLimit-Remaining\", remaining.toString());\n\t\t\tres.setHeader(\"X-RateLimit-Reset\", Math.ceil(reset / 1000).toString());\n\t\t}\n\t\treturn next();\n\t};\n}\n\n/\n Create tiered rate limit middleware with per-endpoint limits.\n * Uses TieredRateLimiter for endpoint-specific rate limits.\n /\nexport function createTieredRateLimitMiddleware(\n\trateLimiter: TieredRateLimiter,\n\tcorsHeaders: Record<string, string>,\n\ttrustProxy = false,\n\ttrustProxyHops = 1,\n): Middleware {\n\treturn async (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\t// Skip for static assets and critical health/metrics endpoints\n\t\tconst isRateLimited =\n\t\t\tpathname.startsWith(\"/api\") &&\n\t\t\tpathname !== \"/api/metrics\" &&\n\t\t\tpathname !== \"/healthz\";\n\n\t\tif (isRateLimited) {\n\t\t\tconst ip = getClientIp(req, trustProxy, trustProxyHops);\n\t\t\t// Use async check to support Redis for distributed rate limiting\n\t\t\tconst { allowed, remaining, reset, limit } = await rateLimiter.checkAsync(\n\t\t\t\tip,\n\t\t\t\tpathname,\n\t\t\t);\n\n\t\t\tif (!allowed) {\n\t\t\t\tres.writeHead(429, {\n\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\"X-RateLimit-Limit\": limit.toString(),\n\t\t\t\t\t\"X-RateLimit-Remaining\": \"0\",\n\t\t\t\t\t\"X-RateLimit-Reset\": Math.ceil(reset / 1000).toString(),\n\t\t\t\t\t\"Retry-After\": Math.ceil((reset - Date.now()) / 1000).toString(),\n\t\t\t\t\t...corsHeaders,\n\t\t\t\t});\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({ error: \"Too Many Requests: Rate limit exceeded\" }),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\t// Add rate limit headers to successful responses too\n\t\t\tres.setHeader(\"X-RateLimit-Limit\", limit.toString());\n\t\t\tres.setHeader(\"X-RateLimit-Remaining\", remaining.toString());\n\t\t\tres.setHeader(\"X-RateLimit-Reset\", Math.ceil(reset / 1000).toString());\n\t\t}\n\t\treturn next();\n\t};\n}\n\nexport function createCorsMiddleware(\n\tcorsHeaders: Record<string, string>,\n): Middleware {\n\treturn (req, res, next) => {\n\t\tif (req.method === \"OPTIONS\") {\n\t\t\tres.writeHead(204, corsHeaders);\n\t\t\tres.end();\n\t\t\treturn;\n\t\t}\n\t\treturn next();\n\t};\n}\n\nexport function createAuthMiddleware(\n\tapiKey: string \| null,\n\tcorsHeaders: Record<string, string>,\n\trequireApiKey = false,\n): Middleware {\n\treturn async (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\tconst isApiRoute = pathname.startsWith(\"/api\");\n\t\tconst isDebugRoute = pathname.startsWith(\"/debug\");\n\t\tconst requiresAuthBoundary = isApiRoute \|\| isDebugRoute;\n\t\tif (requiresAuthBoundary) {\n\t\t\tconst missingKey = !apiKey \|\| apiKey.length === 0;\n\n\t\t\t// No key provided\n\t\t\tif (missingKey) {\n\t\t\t\tif (requireApiKey) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t401,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\terror:\n\t\t\t\t\t\t\t\t\"MAESTRO_WEB_API_KEY is required for all API requests. Set the environment variable or disable requirement explicitly with MAESTRO_WEB_REQUIRE_KEY=0 for local testing only.\",\n\t\t\t\t\t\t},\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t\treq,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\t// Requirement off and no key: allow through.\n\t\t\t\tconst auth = await checkApiAuth(req, { apiKey });\n\t\t\t\tif (!auth.ok) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t401,\n\t\t\t\t\t\t{ error: auth.error \|\| \"Unauthorized\" },\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t\treq,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\treturn next();\n\t\t\t}\n\n\t\t\t// Key provided: validate it.\n\t\t\tif (isApiRoute && getArtifactAccessGrantFromRequest(req)) {\n\t\t\t\treturn next();\n\t\t\t}\n\t\t\tconst auth = await checkApiAuth(req, { apiKey });\n\t\t\tif (!auth.ok) {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\t401,\n\t\t\t\t\t{ error: auth.error \|\| \"Unauthorized\" },\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t\treq,\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t}\n\t\treturn next();\n\t};\n}\n\nexport function createCsrfMiddleware(\n\ttoken: string \| null,\n\tcorsHeaders: Record<string, string>,\n\tenabled = false,\n): Middleware {\n\tif (!enabled \|\| !token) {\n\t\treturn (_req, _res, next) => next();\n\t}\n\treturn (req, res, next) => {\n\t\tconst method = (req.method \|\| \"GET\").toUpperCase();\n\t\tif (method === \"GET\" \|\| method === \"HEAD\" \|\| method === \"OPTIONS\") {\n\t\t\treturn next();\n\t\t}\n\t\tconst pathname = getPathname(req);\n\t\tif (!pathname.startsWith(\"/api\")) {\n\t\t\treturn next();\n\t\t}\n\t\tconst value = getRequestHeader(\n\t\t\treq,\n\t\t\t\"x-composer-csrf\",\n\t\t\t\"x-maestro-csrf\",\n\t\t\t\"x-csrf-token\",\n\t\t\t\"x-xsrf-token\",\n\t\t);\n\t\tif (!value \|\| !secureCompare(String(value), token)) {\n\t\t\tsendJson(\n\t\t\t\tres,\n\t\t\t\t403,\n\t\t\t\t{ error: \"Forbidden: missing or invalid CSRF token\" },\n\t\t\t\tcorsHeaders,\n\t\t\t\treq,\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t\treturn next();\n\t};\n}\n\nexport function createRouterMiddleware(\n\trouterHandler: (\n\t\treq: IncomingMessage,\n\t\tres: ServerResponse,\n\t\tpathname: string,\n\t) => Promise<void> \| void,\n): Middleware {\n\treturn async (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\tawait routerHandler(req, res, pathname);\n\t\t// Router handles the response, so we don't call next() unless it falls through,\n\t\t// but typically router is the end.\n\t\t// If router doesn't handle it (e.g. 404), it might send response itself or return.\n\t\t// Our current router sends 404/500 itself.\n\t};\n}\n\n// ============================================================================\n// IP ACCESS CONTROL\n// ============================================================================\n\nexport interface IpAccessRule {\n\t/* CIDR notation (e.g., \"192.168.1.0/24\") or single IP /\n\tpattern: string;\n\t/* Whether this is an allow or deny rule /\n\ttype: \"allow\" \| \"deny\";\n\t/* Optional description /\n\tdescription?: string;\n}\n\nexport interface IpAccessConfig {\n\t/* Default action when no rules match /\n\tdefaultAction: \"allow\" \| \"deny\";\n\t/* Rules evaluated in order, first match wins /\n\trules: IpAccessRule[];\n}\n\n/\n Parse CIDR notation to IP range (IPv4 only for now)\n /\nfunction parseCidr(cidr: string): { start: bigint; end: bigint } \| null {\n\tconst parts = cidr.split(\"/\");\n\tconst ip = parts[0];\n\tif (!ip) {\n\t\treturn null;\n\t}\n\tconst prefix = parts.length > 1 ? Number.parseInt(parts[1]!, 10) : 32;\n\n\tif (Number.isNaN(prefix) \|\| prefix < 0 \|\| prefix > 32) {\n\t\treturn null;\n\t}\n\n\tconst ipParts = ip.split(\".\").map(Number);\n\tif (\n\t\tipParts.length !== 4 \|\|\n\t\tipParts.some((p) => Number.isNaN(p) \|\| p < 0 \|\| p > 255)\n\t) {\n\t\treturn null;\n\t}\n\n\t// Length check above guarantees these exist\n\tconst ipNum = BigInt(\n\t\t((ipParts[0]! << 24) \|\n\t\t\t(ipParts[1]! << 16) \|\n\t\t\t(ipParts[2]! << 8) \|\n\t\t\tipParts[3]!) >>>\n\t\t\t0,\n\t);\n\tconst mask = BigInt(0xffffffff) << BigInt(32 - prefix);\n\tconst start = ipNum & mask;\n\tconst end = start \| (~mask & BigInt(0xffffffff));\n\n\treturn { start, end };\n}\n\n/\n Convert IP string to numeric (IPv4)\n /\nfunction ipToNumber(ip: string): bigint \| null {\n\tconst cleanIp = normalizeIP(ip);\n\n\tconst parts = cleanIp.split(\".\").map(Number);\n\tif (\n\t\tparts.length !== 4 \|\|\n\t\tparts.some((p) => Number.isNaN(p) \|\| p < 0 \|\| p > 255)\n\t) {\n\t\treturn null;\n\t}\n\n\t// Length check above guarantees these exist\n\treturn BigInt(\n\t\t((parts[0]! << 24) \| (parts[1]! << 16) \| (parts[2]! << 8) \| parts[3]!) >>>\n\t\t\t0,\n\t);\n}\n\n/\n Check if IP matches a pattern (CIDR or exact)\n /\nfunction ipMatchesPattern(ip: string, pattern: string): boolean {\n\tconst ipNum = ipToNumber(ip);\n\tif (ipNum === null) return false;\n\n\tconst range = parseCidr(pattern);\n\tif (!range) {\n\t\t// Try exact match\n\t\tconst patternNum = ipToNumber(pattern);\n\t\treturn patternNum !== null && ipNum === patternNum;\n\t}\n\n\treturn ipNum >= range.start && ipNum <= range.end;\n}\n\n/\n Check if an IP is allowed based on access rules\n /\nexport function checkIpAccess(\n\tip: string,\n\tconfig: IpAccessConfig,\n): { allowed: boolean; matchedRule?: IpAccessRule } {\n\tfor (const rule of config.rules) {\n\t\tif (ipMatchesPattern(ip, rule.pattern)) {\n\t\t\treturn {\n\t\t\t\tallowed: rule.type === \"allow\",\n\t\t\t\tmatchedRule: rule,\n\t\t\t};\n\t\t}\n\t}\n\n\treturn { allowed: config.defaultAction === \"allow\" };\n}\n\n/\n Create IP access control middleware.\n * getConfig is called per-request to allow dynamic config updates.\n */\nexport function createIpAccessMiddleware(\n\tgetConfig: () => IpAccessConfig \| null,\n\tcorsHeaders: Record<string, string>,\n\ttrustProxy = false,\n\ttrustProxyHops = 1,\n): Middleware {\n\treturn (req, res, next) => {\n\t\tconst config = getConfig();\n\t\tif (!config) {\n\t\t\t// No config means allow all\n\t\t\treturn next();\n\t\t}\n\n\t\tlet ip = req.socket.remoteAddress \|\| \"unknown\";\n\n\t\t// Extract real client IP if behind proxy\n\t\tif (trustProxy) {\n\t\t\tconst forwarded = req.headers[\"x-forwarded-for\"];\n\t\t\tif (typeof forwarded === \"string\") {\n\t\t\t\tconst ips = forwarded\n\t\t\t\t\t.split(\",\")\n\t\t\t\t\t.map((s) => s.trim())\n\t\t\t\t\t.filter(Boolean);\n\t\t\t\tif (ips.length > 0) {\n\t\t\t\t\tconst targetIndex = Math.max(0, ips.length - trustProxyHops - 1);\n\t\t\t\t\tip = ips[targetIndex] \|\| ip;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tip = normalizeIP(ip);\n\t\tconst result = checkIpAccess(ip, config);\n\n\t\tif (!result.allowed) {\n\t\t\tlogger.warn(\"IP access denied\", {\n\t\t\t\tip,\n\t\t\t\tmatchedRule: result.matchedRule?.pattern,\n\t\t\t\tdescription: result.matchedRule?.description,\n\t\t\t});\n\n\t\t\tres.writeHead(403, {\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t...corsHeaders,\n\t\t\t});\n\t\t\tres.end(JSON.stringify({ error: \"Forbidden: IP address not allowed\" }));\n\t\t\treturn;\n\t\t}\n\n\t\treturn next();\n\t};\n}\n"]}
1	+ {"version":3,"file":"server-middlewares.js","sourceRoot":"","sources":["../../src/server/server-middlewares.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iCAAiC,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAGvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE9E,MAAM,MAAM,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAMpD,yCAAyC;AACzC,SAAS,WAAW,CAAC,GAAoB;IACxC,IAAI,CAAC;QACJ,sEAAsE;QACtE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC,QAAQ,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,GAAG,CAAC;IACZ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC3C,WAAmC;IAEnC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,qDAAqD;QACrD,qEAAqE;QACrE,+CAA+C;QAC/C,IACC,YAAY,EAAE;YACd,QAAQ,KAAK,UAAU;YACvB,QAAQ,KAAK,SAAS;YACtB,QAAQ,KAAK,cAAc,EAC1B,CAAC;YACF,4BAA4B;YAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBAClB,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,GAAG;gBAClB,GAAG,WAAW;aACd,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CACN,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,CACtE,CAAC;YACF,OAAO;QACR,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,EAAU;IAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,CAAC;AACX,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CACnB,GAAoB,EACpB,UAAmB,EACnB,cAAsB;IAEtB,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IAE/C,IAAI,UAAU,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YACnC,4DAA4D;YAC5D,wDAAwD;YACxD,kDAAkD;YAClD,yEAAyE;YACzE,6CAA6C;YAC7C,sEAAsE;YACtE,MAAM,GAAG,GAAG,SAAS;iBACnB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,OAAO,CAAC,CAAC;YAClB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,mEAAmE;gBACnE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC;gBACjE,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC;QACF,CAAC;IACF,CAAC;IAED,oEAAoE;IACpE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACxC,WAAwB,EACxB,WAAmC,EACnC,UAAU,GAAG,KAAK,EAClB,cAAc,GAAG,CAAC;IAElB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,+DAA+D;QAC/D,MAAM,aAAa,GAClB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAC3B,QAAQ,KAAK,cAAc;YAC3B,QAAQ,KAAK,UAAU,CAAC;QAEzB,IAAI,aAAa,EAAE,CAAC;YACnB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;YACxD,iEAAiE;YACjE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GACzC,MAAM,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAElC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBAClB,cAAc,EAAE,kBAAkB;oBAClC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE;oBACrC,uBAAuB,EAAE,GAAG;oBAC5B,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;oBACvD,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;oBAChE,GAAG,WAAW;iBACd,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CACN,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CACnE,CAAC;gBACF,OAAO;YACR,CAAC;YACD,qDAAqD;YACrD,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAC9C,WAA8B,EAC9B,WAAmC,EACnC,UAAU,GAAG,KAAK,EAClB,cAAc,GAAG,CAAC;IAElB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,+DAA+D;QAC/D,MAAM,aAAa,GAClB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAC3B,QAAQ,KAAK,cAAc;YAC3B,QAAQ,KAAK,UAAU,CAAC;QAEzB,IAAI,aAAa,EAAE,CAAC;YACnB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;YACxD,iEAAiE;YACjE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC,UAAU,CACxE,EAAE,EACF,QAAQ,CACR,CAAC;YAEF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBAClB,cAAc,EAAE,kBAAkB;oBAClC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE;oBACrC,uBAAuB,EAAE,GAAG;oBAC5B,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;oBACvD,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;oBAChE,GAAG,WAAW;iBACd,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CACN,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CACnE,CAAC;gBACF,OAAO;YACR,CAAC;YACD,qDAAqD;YACrD,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,WAAmC;IAEnC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAChC,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACR,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,MAAqB,EACrB,WAAmC,EACnC,aAAa,GAAG,KAAK,EACrB,UAA+B,EAAE;IAEjC,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,oBAAoB,GAAG,UAAU,IAAI,YAAY,CAAC;QACxD,IAAI,oBAAoB,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7C,OAAO,IAAI,EAAE,CAAC;YACf,CAAC;YACD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;YAElD,kBAAkB;YAClB,IAAI,UAAU,EAAE,CAAC;gBAChB,IAAI,aAAa,EAAE,CAAC;oBACnB,QAAQ,CACP,GAAG,EACH,GAAG,EACH;wBACC,KAAK,EACJ,6KAA6K;qBAC9K,EACD,WAAW,EACX,GAAG,CACH,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,6CAA6C;gBAC7C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACd,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,cAAc,EAAE,EACvC,WAAW,EACX,GAAG,CACH,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,OAAO,IAAI,EAAE,CAAC;YACf,CAAC;YAED,6BAA6B;YAC7B,IAAI,UAAU,IAAI,iCAAiC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,OAAO,IAAI,EAAE,CAAC;YACf,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACd,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,cAAc,EAAE,EACvC,WAAW,EACX,GAAG,CACH,CAAC;gBACF,OAAO;YACR,CAAC;QACF,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,KAAoB,EACpB,WAAmC,EACnC,OAAO,GAAG,KAAK,EACf,UAA+B,EAAE;IAEjC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnE,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,gBAAgB,CAC7B,GAAG,EACH,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,cAAc,CACd,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YACpD,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,0CAA0C,EAAE,EACrD,WAAW,EACX,GAAG,CACH,CAAC;YACF,OAAO;QACR,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACrC,aAIyB;IAEzB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACxC,gFAAgF;QAChF,mCAAmC;QACnC,mFAAmF;QACnF,2CAA2C;IAC5C,CAAC,CAAC;AACH,CAAC;AAsBD;;GAEG;AACH,SAAS,SAAS,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,EAAE,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEtE,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IACC,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EACvD,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IAED,4CAA4C;IAC5C,MAAM,KAAK,GAAG,MAAM,CACnB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC;QACnB,CAAC,OAAO,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC;QACnB,CAAC,OAAO,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC;QAClB,OAAO,CAAC,CAAC,CAAE,CAAC;QACZ,CAAC,CACF,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,EAAU;IAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAEhC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,IACC,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EACrD,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IAED,4CAA4C;IAC5C,OAAO,MAAM,CACZ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrE,CAAC,CACF,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,EAAU,EAAE,OAAe;IACpD,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAEjC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,kBAAkB;QAClB,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,UAAU,KAAK,IAAI,IAAI,KAAK,KAAK,UAAU,CAAC;IACpD,CAAC;IAED,OAAO,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC5B,EAAU,EACV,MAAsB;IAEtB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,OAAO;gBACN,OAAO,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO;gBAC9B,WAAW,EAAE,IAAI;aACjB,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACvC,SAAsC,EACtC,WAAmC,EACnC,UAAU,GAAG,KAAK,EAClB,cAAc,GAAG,CAAC;IAElB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,4BAA4B;YAC5B,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QAED,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QAE/C,yCAAyC;QACzC,IAAI,UAAU,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACjD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,SAAS;qBACnB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC;oBACjE,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;gBAC7B,CAAC;YACF,CAAC;QACF,CAAC;QAED,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;gBAC/B,EAAE;gBACF,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO;gBACxC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW;aAC5C,CAAC,CAAC;YAEH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBAClB,cAAc,EAAE,kBAAkB;gBAClC,GAAG,WAAW;aACd,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC,CAAC;YACxE,OAAO;QACR,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { parse } from \"node:url\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { getArtifactAccessGrantFromRequest } from \"./artifact-access.js\";\nimport { checkApiAuth } from \"./authz.js\";\nimport { isOverloaded, logRequest } from \"./logger.js\";\nimport type { Middleware } from \"./middleware.js\";\nimport type { RateLimiter, TieredRateLimiter } from \"./rate-limiter.js\";\nimport { getRequestHeader, secureCompare, sendJson } from \"./server-utils.js\";\n\nconst logger = createLogger(\"middleware:ip-access\");\n\ninterface AuthBoundaryOptions {\n\texemptPaths?: readonly string[];\n}\n\n// Helper for consistent safe URL parsing\nfunction getPathname(req: IncomingMessage): string {\n\ttry {\n\t\t// Use a dummy base for relative URLs (req.url) to ensure safe parsing\n\t\tconst parsed = new URL(req.url \|\| \"/\", \"http://localhost\");\n\t\treturn parsed.pathname;\n\t} catch {\n\t\treturn \"/\";\n\t}\n}\n\nexport function createLoadSheddingMiddleware(\n\tcorsHeaders: Record<string, string>,\n): Middleware {\n\treturn (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\t// 1. Criticality-Aware Load Shedding (Global health)\n\t\t// We prioritize /healthz, /api/metrics, and existing SSE connections\n\t\t// We drop new /api/chat requests if overloaded\n\t\tif (\n\t\t\tisOverloaded() &&\n\t\t\tpathname !== \"/healthz\" &&\n\t\t\tpathname !== \"/readyz\" &&\n\t\t\tpathname !== \"/api/metrics\"\n\t\t) {\n\t\t\t// Drop non-critical traffic\n\t\t\tres.writeHead(503, {\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\"Retry-After\": \"5\",\n\t\t\t\t...corsHeaders,\n\t\t\t});\n\t\t\tres.end(\n\t\t\t\tJSON.stringify({ error: \"Service Unavailable: Server is overloaded\" }),\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t\treturn next();\n\t};\n}\n\n// Normalize IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1 -> 127.0.0.1)\nfunction normalizeIP(ip: string): string {\n\tif (ip.startsWith(\"::ffff:\")) {\n\t\treturn ip.substring(7);\n\t}\n\treturn ip;\n}\n\n/*\n Extract client IP from request, handling proxy headers.\n /\nfunction getClientIp(\n\treq: IncomingMessage,\n\ttrustProxy: boolean,\n\ttrustProxyHops: number,\n): string {\n\tlet ip = req.socket.remoteAddress \|\| \"unknown\";\n\n\tif (trustProxy) {\n\t\tconst forwarded = req.headers[\"x-forwarded-for\"];\n\t\tif (typeof forwarded === \"string\") {\n\t\t\t// Parse IPs and read from right-to-left to prevent spoofing\n\t\t\t// X-Forwarded-For format: \"client, proxy1, proxy2, ...\"\n\t\t\t// Each proxy appends its upstream IP to the right\n\t\t\t// trustProxyHops = number of trusted proxies between us and the internet\n\t\t\t// Example with CDN -> nginx -> app (2 hops):\n\t\t\t// Header: \"client, cdn, nginx\" -> skip 2 from right -> use \"client\"\n\t\t\tconst ips = forwarded\n\t\t\t\t.split(\",\")\n\t\t\t\t.map((s) => s.trim())\n\t\t\t\t.filter(Boolean);\n\t\t\tif (ips.length > 0) {\n\t\t\t\t// Skip trustProxyHops from the right to get the first untrusted IP\n\t\t\t\tconst targetIndex = Math.max(0, ips.length - trustProxyHops - 1);\n\t\t\t\tip = ips[targetIndex] \|\| ip;\n\t\t\t}\n\t\t}\n\t}\n\n\t// Normalize IPv4-mapped IPv6 addresses for consistent rate limiting\n\treturn normalizeIP(ip);\n}\n\nexport function createRateLimitMiddleware(\n\trateLimiter: RateLimiter,\n\tcorsHeaders: Record<string, string>,\n\ttrustProxy = false,\n\ttrustProxyHops = 1,\n): Middleware {\n\treturn async (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\t// Skip for static assets and critical health/metrics endpoints\n\t\tconst isRateLimited =\n\t\t\tpathname.startsWith(\"/api\") &&\n\t\t\tpathname !== \"/api/metrics\" &&\n\t\t\tpathname !== \"/healthz\";\n\n\t\tif (isRateLimited) {\n\t\t\tconst ip = getClientIp(req, trustProxy, trustProxyHops);\n\t\t\t// Use async check to support Redis for distributed rate limiting\n\t\t\tconst { allowed, remaining, reset, limit } =\n\t\t\t\tawait rateLimiter.checkAsync(ip);\n\n\t\t\tif (!allowed) {\n\t\t\t\tres.writeHead(429, {\n\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\"X-RateLimit-Limit\": limit.toString(),\n\t\t\t\t\t\"X-RateLimit-Remaining\": \"0\",\n\t\t\t\t\t\"X-RateLimit-Reset\": Math.ceil(reset / 1000).toString(),\n\t\t\t\t\t\"Retry-After\": Math.ceil((reset - Date.now()) / 1000).toString(),\n\t\t\t\t\t...corsHeaders,\n\t\t\t\t});\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({ error: \"Too Many Requests: Rate limit exceeded\" }),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\t// Add rate limit headers to successful responses too\n\t\t\tres.setHeader(\"X-RateLimit-Limit\", limit.toString());\n\t\t\tres.setHeader(\"X-RateLimit-Remaining\", remaining.toString());\n\t\t\tres.setHeader(\"X-RateLimit-Reset\", Math.ceil(reset / 1000).toString());\n\t\t}\n\t\treturn next();\n\t};\n}\n\n/\n Create tiered rate limit middleware with per-endpoint limits.\n * Uses TieredRateLimiter for endpoint-specific rate limits.\n /\nexport function createTieredRateLimitMiddleware(\n\trateLimiter: TieredRateLimiter,\n\tcorsHeaders: Record<string, string>,\n\ttrustProxy = false,\n\ttrustProxyHops = 1,\n): Middleware {\n\treturn async (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\t// Skip for static assets and critical health/metrics endpoints\n\t\tconst isRateLimited =\n\t\t\tpathname.startsWith(\"/api\") &&\n\t\t\tpathname !== \"/api/metrics\" &&\n\t\t\tpathname !== \"/healthz\";\n\n\t\tif (isRateLimited) {\n\t\t\tconst ip = getClientIp(req, trustProxy, trustProxyHops);\n\t\t\t// Use async check to support Redis for distributed rate limiting\n\t\t\tconst { allowed, remaining, reset, limit } = await rateLimiter.checkAsync(\n\t\t\t\tip,\n\t\t\t\tpathname,\n\t\t\t);\n\n\t\t\tif (!allowed) {\n\t\t\t\tres.writeHead(429, {\n\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\"X-RateLimit-Limit\": limit.toString(),\n\t\t\t\t\t\"X-RateLimit-Remaining\": \"0\",\n\t\t\t\t\t\"X-RateLimit-Reset\": Math.ceil(reset / 1000).toString(),\n\t\t\t\t\t\"Retry-After\": Math.ceil((reset - Date.now()) / 1000).toString(),\n\t\t\t\t\t...corsHeaders,\n\t\t\t\t});\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({ error: \"Too Many Requests: Rate limit exceeded\" }),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\t// Add rate limit headers to successful responses too\n\t\t\tres.setHeader(\"X-RateLimit-Limit\", limit.toString());\n\t\t\tres.setHeader(\"X-RateLimit-Remaining\", remaining.toString());\n\t\t\tres.setHeader(\"X-RateLimit-Reset\", Math.ceil(reset / 1000).toString());\n\t\t}\n\t\treturn next();\n\t};\n}\n\nexport function createCorsMiddleware(\n\tcorsHeaders: Record<string, string>,\n): Middleware {\n\treturn (req, res, next) => {\n\t\tif (req.method === \"OPTIONS\") {\n\t\t\tres.writeHead(204, corsHeaders);\n\t\t\tres.end();\n\t\t\treturn;\n\t\t}\n\t\treturn next();\n\t};\n}\n\nexport function createAuthMiddleware(\n\tapiKey: string \| null,\n\tcorsHeaders: Record<string, string>,\n\trequireApiKey = false,\n\toptions: AuthBoundaryOptions = {},\n): Middleware {\n\treturn async (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\tconst isApiRoute = pathname.startsWith(\"/api\");\n\t\tconst isDebugRoute = pathname.startsWith(\"/debug\");\n\t\tconst requiresAuthBoundary = isApiRoute \|\| isDebugRoute;\n\t\tif (requiresAuthBoundary) {\n\t\t\tif (options.exemptPaths?.includes(pathname)) {\n\t\t\t\treturn next();\n\t\t\t}\n\t\t\tconst missingKey = !apiKey \|\| apiKey.length === 0;\n\n\t\t\t// No key provided\n\t\t\tif (missingKey) {\n\t\t\t\tif (requireApiKey) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t401,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\terror:\n\t\t\t\t\t\t\t\t\"MAESTRO_WEB_API_KEY is required for all API requests. Set the environment variable or disable requirement explicitly with MAESTRO_WEB_REQUIRE_KEY=0 for local testing only.\",\n\t\t\t\t\t\t},\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t\treq,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\t// Requirement off and no key: allow through.\n\t\t\t\tconst auth = await checkApiAuth(req, { apiKey });\n\t\t\t\tif (!auth.ok) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t401,\n\t\t\t\t\t\t{ error: auth.error \|\| \"Unauthorized\" },\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t\treq,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\treturn next();\n\t\t\t}\n\n\t\t\t// Key provided: validate it.\n\t\t\tif (isApiRoute && getArtifactAccessGrantFromRequest(req)) {\n\t\t\t\treturn next();\n\t\t\t}\n\t\t\tconst auth = await checkApiAuth(req, { apiKey });\n\t\t\tif (!auth.ok) {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\t401,\n\t\t\t\t\t{ error: auth.error \|\| \"Unauthorized\" },\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t\treq,\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t}\n\t\treturn next();\n\t};\n}\n\nexport function createCsrfMiddleware(\n\ttoken: string \| null,\n\tcorsHeaders: Record<string, string>,\n\tenabled = false,\n\toptions: AuthBoundaryOptions = {},\n): Middleware {\n\tif (!enabled \|\| !token) {\n\t\treturn (_req, _res, next) => next();\n\t}\n\treturn (req, res, next) => {\n\t\tconst method = (req.method \|\| \"GET\").toUpperCase();\n\t\tif (method === \"GET\" \|\| method === \"HEAD\" \|\| method === \"OPTIONS\") {\n\t\t\treturn next();\n\t\t}\n\t\tconst pathname = getPathname(req);\n\t\tif (!pathname.startsWith(\"/api\")) {\n\t\t\treturn next();\n\t\t}\n\t\tif (options.exemptPaths?.includes(pathname)) {\n\t\t\treturn next();\n\t\t}\n\t\tconst value = getRequestHeader(\n\t\t\treq,\n\t\t\t\"x-composer-csrf\",\n\t\t\t\"x-maestro-csrf\",\n\t\t\t\"x-csrf-token\",\n\t\t\t\"x-xsrf-token\",\n\t\t);\n\t\tif (!value \|\| !secureCompare(String(value), token)) {\n\t\t\tsendJson(\n\t\t\t\tres,\n\t\t\t\t403,\n\t\t\t\t{ error: \"Forbidden: missing or invalid CSRF token\" },\n\t\t\t\tcorsHeaders,\n\t\t\t\treq,\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t\treturn next();\n\t};\n}\n\nexport function createRouterMiddleware(\n\trouterHandler: (\n\t\treq: IncomingMessage,\n\t\tres: ServerResponse,\n\t\tpathname: string,\n\t) => Promise<void> \| void,\n): Middleware {\n\treturn async (req, res, next) => {\n\t\tconst pathname = getPathname(req);\n\t\tawait routerHandler(req, res, pathname);\n\t\t// Router handles the response, so we don't call next() unless it falls through,\n\t\t// but typically router is the end.\n\t\t// If router doesn't handle it (e.g. 404), it might send response itself or return.\n\t\t// Our current router sends 404/500 itself.\n\t};\n}\n\n// ============================================================================\n// IP ACCESS CONTROL\n// ============================================================================\n\nexport interface IpAccessRule {\n\t/* CIDR notation (e.g., \"192.168.1.0/24\") or single IP /\n\tpattern: string;\n\t/* Whether this is an allow or deny rule /\n\ttype: \"allow\" \| \"deny\";\n\t/* Optional description /\n\tdescription?: string;\n}\n\nexport interface IpAccessConfig {\n\t/* Default action when no rules match /\n\tdefaultAction: \"allow\" \| \"deny\";\n\t/* Rules evaluated in order, first match wins /\n\trules: IpAccessRule[];\n}\n\n/\n Parse CIDR notation to IP range (IPv4 only for now)\n /\nfunction parseCidr(cidr: string): { start: bigint; end: bigint } \| null {\n\tconst parts = cidr.split(\"/\");\n\tconst ip = parts[0];\n\tif (!ip) {\n\t\treturn null;\n\t}\n\tconst prefix = parts.length > 1 ? Number.parseInt(parts[1]!, 10) : 32;\n\n\tif (Number.isNaN(prefix) \|\| prefix < 0 \|\| prefix > 32) {\n\t\treturn null;\n\t}\n\n\tconst ipParts = ip.split(\".\").map(Number);\n\tif (\n\t\tipParts.length !== 4 \|\|\n\t\tipParts.some((p) => Number.isNaN(p) \|\| p < 0 \|\| p > 255)\n\t) {\n\t\treturn null;\n\t}\n\n\t// Length check above guarantees these exist\n\tconst ipNum = BigInt(\n\t\t((ipParts[0]! << 24) \|\n\t\t\t(ipParts[1]! << 16) \|\n\t\t\t(ipParts[2]! << 8) \|\n\t\t\tipParts[3]!) >>>\n\t\t\t0,\n\t);\n\tconst mask = BigInt(0xffffffff) << BigInt(32 - prefix);\n\tconst start = ipNum & mask;\n\tconst end = start \| (~mask & BigInt(0xffffffff));\n\n\treturn { start, end };\n}\n\n/\n Convert IP string to numeric (IPv4)\n /\nfunction ipToNumber(ip: string): bigint \| null {\n\tconst cleanIp = normalizeIP(ip);\n\n\tconst parts = cleanIp.split(\".\").map(Number);\n\tif (\n\t\tparts.length !== 4 \|\|\n\t\tparts.some((p) => Number.isNaN(p) \|\| p < 0 \|\| p > 255)\n\t) {\n\t\treturn null;\n\t}\n\n\t// Length check above guarantees these exist\n\treturn BigInt(\n\t\t((parts[0]! << 24) \| (parts[1]! << 16) \| (parts[2]! << 8) \| parts[3]!) >>>\n\t\t\t0,\n\t);\n}\n\n/\n Check if IP matches a pattern (CIDR or exact)\n /\nfunction ipMatchesPattern(ip: string, pattern: string): boolean {\n\tconst ipNum = ipToNumber(ip);\n\tif (ipNum === null) return false;\n\n\tconst range = parseCidr(pattern);\n\tif (!range) {\n\t\t// Try exact match\n\t\tconst patternNum = ipToNumber(pattern);\n\t\treturn patternNum !== null && ipNum === patternNum;\n\t}\n\n\treturn ipNum >= range.start && ipNum <= range.end;\n}\n\n/\n Check if an IP is allowed based on access rules\n /\nexport function checkIpAccess(\n\tip: string,\n\tconfig: IpAccessConfig,\n): { allowed: boolean; matchedRule?: IpAccessRule } {\n\tfor (const rule of config.rules) {\n\t\tif (ipMatchesPattern(ip, rule.pattern)) {\n\t\t\treturn {\n\t\t\t\tallowed: rule.type === \"allow\",\n\t\t\t\tmatchedRule: rule,\n\t\t\t};\n\t\t}\n\t}\n\n\treturn { allowed: config.defaultAction === \"allow\" };\n}\n\n/\n Create IP access control middleware.\n * getConfig is called per-request to allow dynamic config updates.\n */\nexport function createIpAccessMiddleware(\n\tgetConfig: () => IpAccessConfig \| null,\n\tcorsHeaders: Record<string, string>,\n\ttrustProxy = false,\n\ttrustProxyHops = 1,\n): Middleware {\n\treturn (req, res, next) => {\n\t\tconst config = getConfig();\n\t\tif (!config) {\n\t\t\t// No config means allow all\n\t\t\treturn next();\n\t\t}\n\n\t\tlet ip = req.socket.remoteAddress \|\| \"unknown\";\n\n\t\t// Extract real client IP if behind proxy\n\t\tif (trustProxy) {\n\t\t\tconst forwarded = req.headers[\"x-forwarded-for\"];\n\t\t\tif (typeof forwarded === \"string\") {\n\t\t\t\tconst ips = forwarded\n\t\t\t\t\t.split(\",\")\n\t\t\t\t\t.map((s) => s.trim())\n\t\t\t\t\t.filter(Boolean);\n\t\t\t\tif (ips.length > 0) {\n\t\t\t\t\tconst targetIndex = Math.max(0, ips.length - trustProxyHops - 1);\n\t\t\t\t\tip = ips[targetIndex] \|\| ip;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tip = normalizeIP(ip);\n\t\tconst result = checkIpAccess(ip, config);\n\n\t\tif (!result.allowed) {\n\t\t\tlogger.warn(\"IP access denied\", {\n\t\t\t\tip,\n\t\t\t\tmatchedRule: result.matchedRule?.pattern,\n\t\t\t\tdescription: result.matchedRule?.description,\n\t\t\t});\n\n\t\t\tres.writeHead(403, {\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t...corsHeaders,\n\t\t\t});\n\t\t\tres.end(JSON.stringify({ error: \"Forbidden: IP address not allowed\" }));\n\t\t\treturn;\n\t\t}\n\n\t\treturn next();\n\t};\n}\n"]}

package/dist/server/server-request-manager.d.ts CHANGED Viewed

@@ -11,6 +11,12 @@ export type ServerRequestRegisteredEvent = RuntimeServerRequestRegisteredEvent;
 export type ServerRequestResolvedEvent = RuntimeServerRequestResolvedEvent;
 export type ServerRequestLifecycleEvent = RuntimeServerRequestLifecycleEvent;
 type ServerRequestListener = (event: ServerRequestLifecycleEvent) => void;
+type ClaimedClientToolRequest = {
+    request: PendingServerRequestSnapshot & {
+        kind: "client_tool" | "mcp_elicitation" | "user_input";
+    };
+    resolve: (content: ToolResultContent[], isError: boolean) => boolean;
+};
 type RegisterApprovalOptions = {
     sessionId?: string;
     request: ActionApprovalRequest;
@@ -47,9 +53,11 @@ export declare class ServerRequestManager {
         sessionId?: string;
         kind?: ServerRequestKind;
     }): PendingServerRequestSnapshot[];
-    resolveApproval(id: string, decision: Pick<ActionApprovalDecision, "approved" | "reason" | "resolvedBy">): boolean;
+    resolveApproval(id: string, decision: Pick<ActionApprovalDecision, "approved" | "reason" | "resolvedBy" | "resolvedAtMs">): boolean;
     resolveToolRetry(id: string, decision: Pick<ToolRetryDecision, "action" | "reason" | "resolvedBy">): boolean;
     resolveClientTool(id: string, content: ToolResultContent[], isError: boolean): boolean;
+    claimClientTool(id: string): ClaimedClientToolRequest | undefined;
+    private resolveClientToolEntry;
     cancel(id: string, reason: string, resolvedBy?: "policy" | "runtime"): boolean;
     cancelBySession(sessionId: string, reason: string, resolvedBy?: "policy" | "runtime"): number;
     cleanup(now?: number): void;

package/dist/server/server-request-manager.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"server-request-manager.d.ts","sourceRoot":"","sources":["../../src/server/server-request-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,wBAAwB,EACxB,kCAAkC,EAClC,mCAAmC,EACnC,8BAA8B,EAC9B,8BAA8B,EAC9B,iCAAiC,EACjC,4BAA4B,EAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EACX,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEnE,KAAK,iBAAiB,GAAG,WAAW,GAAG,YAAY,CAAC;AAEpD,MAAM,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AACzD,MAAM,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AACrE,MAAM,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AACrE,MAAM,MAAM,4BAA4B,GAAG,4BAA4B,CAAC;AACxE,MAAM,MAAM,4BAA4B,GAAG,mCAAmC,CAAC;AAC/E,MAAM,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AAC3E,MAAM,MAAM,2BAA2B,GAAG,kCAAkC,CAAC;AAE7E,KAAK,qBAAqB,GAAG,CAAC,KAAK,EAAE,2BAA2B,KAAK,IAAI,CAAC;~~AA0B1E~~,KAAK,uBAAuB,GAAG;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,aAAa,GAAG,iBAAiB,GAAG,YAAY,CAAC;IACxD,OAAO,EAAE,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;IACrE,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;CACpC,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAqBF,qBAAa,oBAAoB;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgD;IACxE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAE9D,SAAS,CAAC,QAAQ,EAAE,qBAAqB,GAAG,MAAM,IAAI;IAOtD,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;~~IAyBxD~~,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI;~~IA4B5D~~,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI;~~IAmD1D~~,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAI5B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,4BAA4B,GAAG,SAAS;~~IAmBzD~~,WAAW,CAAC,OAAO,CAAC,EAAE;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,iBAAiB,CAAC;KACzB,GAAG,4BAA4B,EAAE;~~IAuBlC~~,eAAe,CACd,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,IAAI,CACb,sBAAsB,EACtB,UAAU,GAAG,QAAQ,GAAG,YAAY,~~CACpC~~,GACC,OAAO;~~IAwBV~~,gBAAgB,CACf,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAC,GACnE,OAAO;~~IA6BV~~,iBAAiB,CAChB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,iBAAiB,EAAE,EAC5B,OAAO,EAAE,OAAO,GACd,OAAO;~~IA8BV~~,MAAM,CACL,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,UAAU,GAAE,QAAQ,GAAG,SAAoB,GACzC,OAAO;~~IAsDV~~,eAAe,CACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,UAAU,GAAE,QAAQ,GAAG,SAAoB,GACzC,MAAM;IAaT,OAAO,CAAC,GAAG,SAAa,GAAG,IAAI;IAS/B,OAAO,CAAC,IAAI;IAMZ,OAAO,CAAC,UAAU;~~CAmBlB~~;AAED,eAAO,MAAM,oBAAoB,sBAA6B,CAAC"}
1	+ {"version":3,"file":"server-request-manager.d.ts","sourceRoot":"","sources":["../../src/server/server-request-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,wBAAwB,EACxB,kCAAkC,EAClC,mCAAmC,EACnC,8BAA8B,EAC9B,8BAA8B,EAC9B,iCAAiC,EACjC,4BAA4B,EAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EACX,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEnE,KAAK,iBAAiB,GAAG,WAAW,GAAG,YAAY,CAAC;AAEpD,MAAM,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AACzD,MAAM,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AACrE,MAAM,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AACrE,MAAM,MAAM,4BAA4B,GAAG,4BAA4B,CAAC;AACxE,MAAM,MAAM,4BAA4B,GAAG,mCAAmC,CAAC;AAC/E,MAAM,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AAC3E,MAAM,MAAM,2BAA2B,GAAG,kCAAkC,CAAC;AAE7E,KAAK,qBAAqB,GAAG,CAAC,KAAK,EAAE,2BAA2B,KAAK,IAAI,CAAC;AAE1E,KAAK,wBAAwB,GAAG;IAC/B,OAAO,EAAE,4BAA4B,GAAG;QACvC,IAAI,EAAE,aAAa,GAAG,iBAAiB,GAAG,YAAY,CAAC;KACvD,CAAC;IACF,OAAO,EAAE,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;CACrE,CAAC;AA0BF,KAAK,uBAAuB,GAAG;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,aAAa,GAAG,iBAAiB,GAAG,YAAY,CAAC;IACxD,OAAO,EAAE,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;IACrE,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;CACpC,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAqBF,qBAAa,oBAAoB;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgD;IACxE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAE9D,SAAS,CAAC,QAAQ,EAAE,qBAAqB,GAAG,MAAM,IAAI;IAOtD,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IA2BxD,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI;IA8B5D,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI;IAqD1D,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAI5B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,4BAA4B,GAAG,SAAS;IAoBzD,WAAW,CAAC,OAAO,CAAC,EAAE;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,iBAAiB,CAAC;KACzB,GAAG,4BAA4B,EAAE;IAwBlC,eAAe,CACd,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,IAAI,CACb,sBAAsB,EACtB,UAAU,GAAG,QAAQ,GAAG,YAAY,GAAG,cAAc,CACrD,GACC,OAAO;IA2BV,gBAAgB,CACf,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAC,GACnE,OAAO;IA+BV,iBAAiB,CAChB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,iBAAiB,EAAE,EAC5B,OAAO,EAAE,OAAO,GACd,OAAO;IAaV,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS;IA4BjE,OAAO,CAAC,sBAAsB;IAiC9B,MAAM,CACL,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,UAAU,GAAE,QAAQ,GAAG,SAAoB,GACzC,OAAO;IA2DV,eAAe,CACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,UAAU,GAAE,QAAQ,GAAG,SAAoB,GACzC,MAAM;IAaT,OAAO,CAAC,GAAG,SAAa,GAAG,IAAI;IAS/B,OAAO,CAAC,IAAI;IAMZ,OAAO,CAAC,UAAU;CAoBlB;AAED,eAAO,MAAM,oBAAoB,sBAA6B,CAAC"}