@faable/faable 4.15.0 → 4.17.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Faable Cloud SLU
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/api/FaableApi.js

@@ -95,7 +95,9 @@ class FaableApi {
                             ? 'This Faable API key is invalid or was revoked. Create a new one in the dashboard (project settings → API Keys).'
                             : 'Your Faable session has expired or is invalid. Run `faable login` to sign in again.', { cause: error });
                         expired.status = 401;
-                        expired.code = by_key ? 'apikey_invalid' : 'session_expired';
+                        expired.code = by_key
+                            ? 'apikey_invalid'
+                            : 'session_expired';
                         throw expired;
                     }
                     const serverMessage = res.data?.message || res.statusText || 'Unknown Error';
@@ -157,7 +159,11 @@ class FaableApi {
     async listProjects(params) {
         const { q, user_id, ...page } = params;
         return data(this.client.get(`/project`, {
-            params: { ...page_params(page), ...(q ? { q } : {}), ...(user_id ? { user_id } : {}) }
+            params: {
+                ...page_params(page),
+                ...(q ? { q } : {}),
+                ...(user_id ? { user_id } : {})
+            }
         }));
     }
     async getProject(project_id) {

package/dist/commands/deploy/waf/add_rule.js

@@ -62,6 +62,21 @@ const add_rule = async (opts) => {
     }
     if (json)
         return waf;
+    if (action === 'allow') {
+        // The one rule that opens instead of closing: say exactly what it opens.
+        log.info(`🔓 ${describe_selector(want)} → reaches your app`);
+        log.info(`   for ${app_name} (${app_id}), even where Faable blocks it for every app`);
+        log.info(`   (archives like .zip or .tar.gz, dotfiles, config files).`);
+        log.info(``);
+        log.info(`Your own block and sink rules still win over it, and certificate checks,`);
+        log.info(`/.faable/* and /_next/* are never affected.`);
+        log.info(``);
+        log.info(`It takes about 20s to reach the edge. Then check it with:`);
+        log.info(`  curl -s -o /dev/null -w '%{http_code}\\n' https://${app_url}<path>`);
+        log.info(``);
+        log.info(`Undo: faable deploy waf rm ${undo_args(want)} --action allow -a ${app_id}`);
+        return waf;
+    }
     const answer = action === 'deny' ? '403' : '404';
     log.info(`🛡️  ${describe_selector(want)} → ${answer} at the edge`);
     log.info(`   for ${app_name} (${app_id}).`);

package/dist/commands/deploy/waf/allow.js

@@ -0,0 +1,58 @@
+import { requireApi } from '../../../api/context.js';
+import { print_json, json_option } from '../../../lib/listing.js';
+import { resolve_app_id } from '../resolve_app_id.js';
+import { add_rule } from './add_rule.js';
+
+/**
+ * The one WAF rule that opens instead of closing: paths of THIS app that Faable
+ * blocks for every app (archives, dotfiles, config files) and that this app
+ * really serves — a `.zip` download, say. Path only: a user-agent or query
+ * exception could be claimed by anyone sending that header.
+ */
+const waf_allow = {
+    command: 'allow <pattern>',
+    describe: 'Let a path Faable blocks for every app (e.g. *.zip) reach your app',
+    builder: yargs => json_option(yargs)
+        .positional('pattern', {
+        type: 'string',
+        demandOption: true,
+        description: 'Anchored path regex, e.g. ^/downloads/.*\\.zip$ (quote it in your shell)'
+    })
+        .option('app', {
+        alias: 'a',
+        type: 'string',
+        description: 'App id, name or slug (defaults to the linked app)'
+    })
+        .option('description', {
+        alias: 'd',
+        type: 'string',
+        description: 'Why this rule exists (shown in `waf list`)'
+    })
+        .example("$0 deploy waf allow '^/downloads/.*\\.zip$'", 'Serve the .zip files under /downloads that Faable would otherwise refuse')
+        .epilogue('Faable refuses some paths for every app before they reach it — ' +
+        'archives like .zip or .tar.gz, dotfiles, config files — because ' +
+        'scanners request them by the thousand. If your app really serves ' +
+        'one, allow exactly that path. Keep the pattern narrow: your own ' +
+        'block and sink rules still win over it, and it can never cover ' +
+        '/.well-known/acme-challenge, /.faable or /_next.')
+        .showHelpOnFail(false),
+    handler: async (args) => {
+        const ctx = await requireApi();
+        const app_id = await resolve_app_id(args.app, ctx.appId, ctx.api);
+        const app = await ctx.api.getApp(app_id);
+        const waf = await add_rule({
+            api: ctx.api,
+            app_id,
+            app_name: app.name,
+            app_url: app.url,
+            pattern: args.pattern,
+            action: 'allow',
+            description: args.description,
+            json: args.json
+        });
+        if (args.json)
+            print_json(waf);
+    }
+};
+
+export { waf_allow };

package/dist/commands/deploy/waf/format.js

@@ -5,7 +5,9 @@ const action_label = (action) => action === 'sink'
         ? '403 (blocked at the edge)'
         : action === 'probe'
             ? 'answered by Faable, app not woken (uptime monitors)'
-            : action;
+            : action === 'allow'
+                ? 'allowed (reaches your app where Faable blocks it for every app)'
+                : action;
 /**
  * Render the effective WAF of an app.
  *

package/dist/commands/deploy/waf/index.js

@@ -1,3 +1,4 @@
+import { waf_allow } from './allow.js';
 import { waf_block } from './block.js';
 import { waf_list } from './list.js';
 import { waf_rm } from './rm.js';
@@ -10,8 +11,9 @@ const waf = {
         .command(waf_list)
         .command(waf_block)
         .command(waf_sink)
+        .command(waf_allow)
         .command(waf_rm)
-        .demandCommand(1, 'Specify a waf command: list, block, sink or rm'),
+        .demandCommand(1, 'Specify a waf command: list, block, sink, allow or rm'),
     handler: () => {
         // Unreachable: demandCommand(1) either routes to a subcommand or fails
         // through the global .fail() in src/index.ts.

package/dist/commands/deploy/waf/rm.js

@@ -27,7 +27,7 @@ const waf_rm = {
     })
         .option('action', {
         type: 'string',
-        choices: ['deny', 'sink'],
+        choices: ['deny', 'sink', 'allow'],
         description: 'Only needed when the same rule exists as both'
     })
         .option('app', {

package/dist/mcp/http.js

@@ -233,6 +233,15 @@ const create_http_server = (opts) => {
             if (req.method === 'GET' && url.pathname === '/llms.txt') {
                 return send(res, 200, llms_txt(base), 'text/plain; charset=utf-8');
             }
+            // ChatGPT app submission proves domain ownership by fetching this file;
+            // the token comes from the OpenAI platform, set as a secret of the app.
+            if (req.method === 'GET' &&
+                url.pathname === '/.well-known/openai-apps-challenge') {
+                const token = process.env.OPENAI_APPS_CHALLENGE?.trim();
+                return token
+                    ? send(res, 200, token, 'text/plain; charset=utf-8')
+                    : send(res, 404, { error: 'not_found' });
+            }
             // RFC 9728: at the root and with the resource path inserted (what MCP
             // clients derive from https://mcp.faable.com/mcp). Only with OAuth on.
             if (req.method === 'GET' &&

package/dist/mcp/tools.js

@@ -16,7 +16,11 @@ const target = (a) => ['--app', a.app, ...scope(a)];
 const opt = (flag, value) => value === undefined || value === null || value === ''
     ? []
     : [flag, String(value)];
-const READ = { readOnlyHint: true, openWorldHint: true };
+const READ = {
+    readOnlyHint: true,
+    destructiveHint: false,
+    openWorldHint: true
+};
 // A value as a double-quoted .env value, escaping exactly what parse_env
 // (src/commands/deploy/secrets/parse_env.ts) unescapes — no more: JSON's
 // \b, \f or \uXXXX would arrive as literal text.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "4.15.0",
+  "version": "4.17.0",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",