@forklaunch/core 3.0.1 → 3.2.0

package/lib/http/index.js

@@ -63,12 +63,16 @@ __export(http_exports, {
   VoiceClient: () => VoiceClient,
   VoiceRequestError: () => VoiceRequestError,
   WhatsAppRequestError: () => WhatsAppRequestError,
+  auditComplianceAccess: () => auditComplianceAccess,
+  auditEnabled: () => auditEnabled,
+  auditEventType: () => auditEventType,
   createContext: () => createContext,
   createEmailClient: () => createEmailClient,
   createHmacToken: () => createHmacToken,
   createInstanceGatewayTransport: () => createInstanceGatewayTransport,
   createModelGatewayClient: () => createModelGatewayClient,
   createPaymentsClient: () => createPaymentsClient,
+  createPreviewModelGatewayClient: () => createPreviewModelGatewayClient,
   createSmsClient: () => createSmsClient,
   createStripeClient: () => createStripeClient,
   createVoiceClient: () => createVoiceClient,
@@ -114,6 +118,7 @@ __export(http_exports, {
   post: () => post,
   put: () => put,
   recordMetric: () => recordMetric,
+  recordRequestAudit: () => recordRequestAudit,
   resetProcessHandlersForTesting: () => resetProcessHandlersForTesting,
   signPlatformEvent: () => signPlatformEvent,
   smsSegments: () => smsSegments,
@@ -122,6 +127,7 @@ __export(http_exports, {
   typedAuthHandler: () => typedAuthHandler,
   typedHandler: () => typedHandler,
   validateEmailSendRequest: () => validateEmailSendRequest,
+  validateListUnsubscribe: () => validateListUnsubscribe,
   validateSmsSend: () => validateSmsSend,
   verifyPlatformEvent: () => verifyPlatformEvent,
   voiceRequestProblem: () => voiceRequestProblem
@@ -150,7 +156,7 @@ function cors(corsOptions) {
 }
 
 // src/http/router/expressLikeRouter.ts
-var import_common11 = require("@forklaunch/common");
+var import_common12 = require("@forklaunch/common");
 
 // src/http/guards/hasPermissionChecks.ts
 function hasPermissionChecks(maybePermissionedAuth) {
@@ -720,7 +726,7 @@ function discriminateResponseBodies(schemaValidator, responses) {
 }
 
 // src/http/router/routerSharedLogic.ts
-var import_common10 = require("@forklaunch/common");
+var import_common11 = require("@forklaunch/common");
 
 // src/http/guards/hasVersionedSchema.ts
 function hasVersionedSchema(contractDetails) {
@@ -799,8 +805,8 @@ async function getCachedJwks(jwksPublicKeyUrl) {
     return cachedJwks.value;
   } else {
     const jwksResponse = await fetch(jwksPublicKeyUrl);
-    const text = await jwksResponse.text();
-    if (!text) {
+    const text2 = await jwksResponse.text();
+    if (!text2) {
       if (cachedJwks.value) {
         return cachedJwks.value;
       }
@@ -808,7 +814,7 @@ async function getCachedJwks(jwksPublicKeyUrl) {
         `JWKS endpoint returned empty response (status ${jwksResponse.status})`
       );
     }
-    const jwks = JSON.parse(text).keys;
+    const jwks = JSON.parse(text2).keys;
     cachedJwks.value = jwks;
     cachedJwks.lastUpdated = /* @__PURE__ */ new Date();
     cachedJwks.ttl = parseInt(
@@ -1270,7 +1276,164 @@ async function parseRequestAuth(req, res, next) {
 }
 
 // src/http/middleware/request/enrichDetails.middleware.ts
+var import_common9 = require("@forklaunch/common");
+
+// src/http/telemetry/requestAudit.ts
 var import_common8 = require("@forklaunch/common");
+
+// src/persistence/encryptedType.ts
+var import_core = require("@mikro-orm/core");
+var import_node_async_hooks = require("async_hooks");
+var _tenantContext = new import_node_async_hooks.AsyncLocalStorage();
+
+// src/persistence/complianceChanges.ts
+var LISTENERS = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.changeListeners")] ??= /* @__PURE__ */ new Set();
+function onComplianceChange(listener) {
+  LISTENERS.add(listener);
+  return () => LISTENERS.delete(listener);
+}
+
+// src/persistence/compliantField.ts
+var import_core2 = require("@mikro-orm/core");
+
+// src/persistence/fieldEncryptor.ts
+var HKDF_SALT = Buffer.alloc(0);
+
+// src/persistence/compliantField.ts
+var LISTENERS2 = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.listeners")] ??= /* @__PURE__ */ new Set();
+function onComplianceAccess(listener) {
+  LISTENERS2.add(listener);
+  return () => LISTENERS2.delete(listener);
+}
+var STATE = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.state")] ??= /* @__PURE__ */ new WeakMap();
+var SLOTS = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.slots")] ??= /* @__PURE__ */ new WeakMap();
+var LOADED_TENANTS = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.loadedTenants")] ??= /* @__PURE__ */ new WeakMap();
+
+// src/http/telemetry/auditLogger.ts
+var import_crypto3 = require("crypto");
+var AuditLogger = class {
+  _otel;
+  constructor(otel) {
+    this._otel = otel;
+  }
+  append(entry) {
+    try {
+      this._otel.info(
+        {
+          "log.type": "audit",
+          "audit.timestamp": entry.timestamp,
+          "audit.userId": entry.userId ?? "",
+          "audit.tenantId": entry.tenantId ?? "",
+          "audit.route": entry.route,
+          "audit.method": entry.method,
+          "audit.bodyHash": entry.bodyHash,
+          "audit.status": entry.status,
+          "audit.duration": entry.duration,
+          "audit.redactedFields": entry.redactedFields.join(","),
+          "audit.eventType": entry.eventType,
+          _meta: true
+        },
+        `audit:${entry.eventType} ${entry.method} ${entry.route} ${entry.status}`
+      );
+    } catch (error) {
+      console.error("Failed to emit audit log via OTEL:", error);
+    }
+  }
+  static hashBody(body) {
+    if (body === void 0 || body === null || body === "") {
+      return "";
+    }
+    return (0, import_crypto3.createHash)("sha256").update(body).digest("hex");
+  }
+};
+
+// src/http/telemetry/requestAudit.ts
+function auditEnabled() {
+  return (0, import_common8.getEnvVar)("FORKLAUNCH_AUDIT") !== "off";
+}
+var loggers = /* @__PURE__ */ new WeakMap();
+function loggerFor(otel) {
+  let logger2 = loggers.get(otel);
+  if (!logger2) {
+    logger2 = new AuditLogger(otel);
+    loggers.set(otel, logger2);
+  }
+  return logger2;
+}
+function auditEventType(status) {
+  if (status === 401) return "auth_failure";
+  if (status === 403) return "rbac_deny";
+  if (status === 429) return "rate_limit";
+  return "http";
+}
+var text = (value) => typeof value === "string" && value ? value : null;
+function bodyText(body) {
+  if (body == null || body === "") return void 0;
+  if (typeof body === "string" || Buffer.isBuffer(body)) return String(body);
+  try {
+    return JSON.stringify(body);
+  } catch {
+    return void 0;
+  }
+}
+function recordRequestAudit(otel, req, status, durationMs) {
+  if (!otel || !auditEnabled()) return;
+  const session = req.session && typeof req.session === "object" ? req.session : void 0;
+  loggerFor(otel).append({
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    userId: text(session?.sub) ?? text(session?.userId),
+    tenantId: text(session?.activeOrganizationId) ?? text(session?.organizationId),
+    route: req.originalPath ?? req.path ?? "unknown",
+    method: req.method,
+    bodyHash: AuditLogger.hashBody(bodyText(req.body)),
+    status,
+    duration: Math.max(0, Math.round(durationMs)),
+    redactedFields: [],
+    eventType: auditEventType(status)
+  });
+}
+var accessAudit;
+function auditComplianceAccess(otel) {
+  if (!accessAudit && auditEnabled()) {
+    const logger2 = loggerFor(otel);
+    const remove = onComplianceAccess(
+      (event) => logger2.append({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        userId: null,
+        tenantId: event.tenantId || null,
+        route: event.field,
+        method: "READ",
+        bodyHash: "",
+        status: 0,
+        duration: 0,
+        redactedFields: [event.field],
+        eventType: "data_access"
+      })
+    );
+    const removeChanges = onComplianceChange(
+      (event) => logger2.append({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        userId: null,
+        tenantId: event.tenantId,
+        route: `${event.entity}#${event.id}`,
+        method: event.action.toUpperCase(),
+        bodyHash: "",
+        status: 0,
+        duration: 0,
+        redactedFields: event.sensitiveFields,
+        eventType: "data_change"
+      })
+    );
+    accessAudit = () => {
+      remove();
+      removeChanges();
+      accessAudit = void 0;
+    };
+  }
+  return accessAudit ?? (() => void 0);
+}
+
+// src/http/middleware/request/enrichDetails.middleware.ts
 function enrichDetails(path, contractDetails, requestSchema, responseSchemas, openTelemetryCollector, globalOptions) {
   return (req, res, next) => {
     req.originalPath = path;
@@ -1281,12 +1444,20 @@ function enrichDetails(path, contractDetails, requestSchema, responseSchemas, op
     req._globalOptions = globalOptions ?? (() => void 0);
     req.context?.span?.setAttribute(ATTR_API_NAME, req.contractDetails?.name);
     const startTime = process.hrtime();
+    if (openTelemetryCollector) auditComplianceAccess(openTelemetryCollector);
     res.on("finish", () => {
+      const [auditSeconds, auditNanoseconds] = process.hrtime(startTime);
+      recordRequestAudit(
+        openTelemetryCollector,
+        req,
+        Number(res.statusCode),
+        auditSeconds * 1e3 + auditNanoseconds / 1e6
+      );
       const [seconds, nanoseconds] = process.hrtime(startTime);
       const durationMs = seconds + nanoseconds / 1e9;
       httpServerDurationHistogram.record(durationMs, {
-        [import_semantic_conventions.ATTR_SERVICE_NAME]: (0, import_common8.getEnvVar)("OTEL_SERVICE_NAME") || "unknown",
-        [ATTR_APPLICATION_ID]: (0, import_common8.getEnvVar)("OTEL_APPLICATION_ID"),
+        [import_semantic_conventions.ATTR_SERVICE_NAME]: (0, import_common9.getEnvVar)("OTEL_SERVICE_NAME") || "unknown",
+        [ATTR_APPLICATION_ID]: (0, import_common9.getEnvVar)("OTEL_APPLICATION_ID"),
         [ATTR_API_NAME]: req.contractDetails?.name || "unknown",
         [import_semantic_conventions.ATTR_HTTP_REQUEST_METHOD]: req.method,
         [import_semantic_conventions.ATTR_HTTP_ROUTE]: req.originalPath || "unknown",
@@ -1298,7 +1469,7 @@ function enrichDetails(path, contractDetails, requestSchema, responseSchemas, op
 }
 
 // src/http/middleware/request/parse.middleware.ts
-var import_common9 = require("@forklaunch/common");
+var import_common10 = require("@forklaunch/common");
 var import_validator2 = require("@forklaunch/validator");
 
 // src/http/guards/hasSend.ts
@@ -1327,7 +1498,7 @@ function parse(req, res, next) {
   let parsedRequest;
   let collectedParseErrors;
   if (req.contractDetails.versions) {
-    if ((0, import_common9.isRecord)(req.requestSchema)) {
+    if ((0, import_common10.isRecord)(req.requestSchema)) {
       let runningParseErrors = "";
       matchedVersions = [];
       Object.entries(req.requestSchema).forEach(([version, schema]) => {
@@ -1558,13 +1729,13 @@ function compileRouteSchemas(contractDetails, schemaValidator) {
           versionedContractDetails,
           contractDetails.params
         );
-        if ((0, import_common10.isRecord)(requestSchema)) {
+        if ((0, import_common11.isRecord)(requestSchema)) {
           requestSchema = {
             ...requestSchema,
             [version]: versionedRequestSchema
           };
         }
-        if ((0, import_common10.isRecord)(responseSchemas)) {
+        if ((0, import_common11.isRecord)(responseSchemas)) {
           responseSchemas = {
             ...responseSchemas,
             [version]: versionedResponseSchemas
@@ -1918,8 +2089,8 @@ var ForklaunchExpressLikeRouter = class _ForklaunchExpressLikeRouter {
       ...middlewares,
       this.#parseAndRunControllerHandler(controllerHandler)
     );
-    (0, import_common11.toRecord)(this._fetchMap)[(0, import_common11.sanitizePathSlashes)(`${this.basePath}${path}`)] = {
-      ...this._fetchMap[(0, import_common11.sanitizePathSlashes)(`${this.basePath}${path}`)] ?? {},
+    (0, import_common12.toRecord)(this._fetchMap)[(0, import_common12.sanitizePathSlashes)(`${this.basePath}${path}`)] = {
+      ...this._fetchMap[(0, import_common12.sanitizePathSlashes)(`${this.basePath}${path}`)] ?? {},
       [method.toUpperCase()]: contractDetails.versions ? Object.fromEntries(
         Object.keys(contractDetails.versions).map((version) => [
           version,
@@ -1942,7 +2113,7 @@ var ForklaunchExpressLikeRouter = class _ForklaunchExpressLikeRouter {
     };
     const contractDetailsName = contractDetails.name;
     if (contractDetailsName) {
-      (0, import_common11.toRecord)(this.sdk)[(0, import_common11.toPrettyCamelCase)(contractDetailsName)] = contractDetails.versions ? Object.fromEntries(
+      (0, import_common12.toRecord)(this.sdk)[(0, import_common12.toPrettyCamelCase)(contractDetailsName)] = contractDetails.versions ? Object.fromEntries(
         Object.keys(contractDetails.versions).map((version) => [
           version,
           (req) => this.#localParamRequest(
@@ -2046,10 +2217,10 @@ var ForklaunchExpressLikeRouter = class _ForklaunchExpressLikeRouter {
   }
   addRouterToSdk(router) {
     Object.entries(router._fetchMap).map(
-      ([key, value]) => (0, import_common11.toRecord)(this._fetchMap)[(0, import_common11.sanitizePathSlashes)(`${this.basePath}${key}`)] = value
+      ([key, value]) => (0, import_common12.toRecord)(this._fetchMap)[(0, import_common12.sanitizePathSlashes)(`${this.basePath}${key}`)] = value
     );
-    const existingSdk = this.sdk[router.sdkName ?? (0, import_common11.toPrettyCamelCase)(router.basePath)];
-    (0, import_common11.toRecord)(this.sdk)[router.sdkName ?? (0, import_common11.toPrettyCamelCase)(router.basePath)] = {
+    const existingSdk = this.sdk[router.sdkName ?? (0, import_common12.toPrettyCamelCase)(router.basePath)];
+    (0, import_common12.toRecord)(this.sdk)[router.sdkName ?? (0, import_common12.toPrettyCamelCase)(router.basePath)] = {
       ...typeof existingSdk === "object" ? existingSdk : {},
       ...router.sdk
     };
@@ -2381,7 +2552,7 @@ var ForklaunchExpressLikeRouter = class _ForklaunchExpressLikeRouter {
   unpackSdks(sdks, path, routerUniquenessCache) {
     Object.entries(sdks).forEach(([key, maybeHandler]) => {
       if (isSdkHandler(maybeHandler)) {
-        const cacheKey = (0, import_common11.hashString)((0, import_common11.safeStringify)(maybeHandler));
+        const cacheKey = (0, import_common12.hashString)((0, import_common12.safeStringify)(maybeHandler));
         if (routerUniquenessCache.has(cacheKey)) {
           throw new Error(`SDK handler ${key} is already registered`);
         }
@@ -2488,7 +2659,7 @@ function isPortBound(port, host = "localhost") {
 }
 
 // src/http/generateHmacAuthHeaders.ts
-var import_crypto3 = require("crypto");
+var import_crypto4 = require("crypto");
 function generateHmacAuthHeaders({
   secretKey,
   method,
@@ -2497,7 +2668,7 @@ function generateHmacAuthHeaders({
   keyId = "default"
 }) {
   const timestamp = /* @__PURE__ */ new Date();
-  const nonce = (0, import_crypto3.randomUUID)();
+  const nonce = (0, import_crypto4.randomUUID)();
   const signature = createHmacToken({
     secretKey,
     method,
@@ -2512,7 +2683,7 @@ function generateHmacAuthHeaders({
 }
 
 // src/http/instanceGateway.ts
-var import_crypto4 = require("crypto");
+var import_crypto5 = require("crypto");
 var INSTANCE_GATEWAY_MOUNT = "/instance-gateway";
 var PLATFORM_EVENT_KEY_ID = "platform";
 var PLATFORM_EVENTS_PATH = "/platform-events";
@@ -2633,7 +2804,7 @@ function verifyPlatformEvent(request, options2 = {}) {
     })
   );
   const received = Buffer.from(signature);
-  if (expected.length !== received.length || !(0, import_crypto4.timingSafeEqual)(expected, received)) {
+  if (expected.length !== received.length || !(0, import_crypto5.timingSafeEqual)(expected, received)) {
     throw new PlatformEventVerificationError("Invalid signature");
   }
   for (const [seen, at] of seenEventNonces) {
@@ -2738,6 +2909,92 @@ async function* sseData(stream) {
   }
 }
 
+// src/http/previewModelGatewayClient.ts
+function record(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function invalidCatalog() {
+  throw new ModelGatewayRequestError(
+    502,
+    "The local preview model catalog is invalid or expired."
+  );
+}
+function previewCatalog(raw) {
+  if (!record(raw) || !record(raw.preview)) return invalidCatalog();
+  const preview = raw.preview;
+  if (Object.keys(raw).some((key) => !["models", "preview"].includes(key)) || Object.keys(preview).some(
+    (key) => !["expiresAt", "maxCalls", "maxUnits"].includes(key)
+  ) || !Array.isArray(raw.models) || raw.models.length !== 1 || !record(raw.models[0]) || Object.keys(raw.models[0]).some((key) => key !== "id") || typeof raw.models[0].id !== "string" || !/^[\w.:-]{1,160}$/.test(raw.models[0].id) || typeof preview.expiresAt !== "number" || !Number.isSafeInteger(preview.expiresAt) || preview.expiresAt <= Date.now() || preview.expiresAt > Date.now() + 15 * 6e4 || typeof preview.maxCalls !== "number" || !Number.isSafeInteger(preview.maxCalls) || preview.maxCalls < 1 || preview.maxCalls > 20 || typeof preview.maxUnits !== "number" || !Number.isSafeInteger(preview.maxUnits) || preview.maxUnits < 1 || preview.maxUnits > 1e5)
+    return invalidCatalog();
+  return {
+    models: [{ id: raw.models[0].id }],
+    preview: {
+      expiresAt: preview.expiresAt,
+      maxCalls: preview.maxCalls,
+      maxUnits: preview.maxUnits
+    }
+  };
+}
+async function readPreviewCatalog(response) {
+  if (!response.body) return invalidCatalog();
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let text2 = "", bytes = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      bytes += value.byteLength;
+      if (bytes > 8192) return invalidCatalog();
+      text2 += decoder.decode(value, { stream: true });
+    }
+    text2 += decoder.decode();
+    return previewCatalog(JSON.parse(text2));
+  } catch {
+    return invalidCatalog();
+  } finally {
+    await reader.cancel().catch(() => {
+    });
+    reader.releaseLock();
+  }
+}
+function createPreviewModelGatewayClient(options2 = {}) {
+  const transport = createInstanceGatewayTransport(
+    options2,
+    "The local preview model gateway"
+  );
+  async function send(method, route, body) {
+    try {
+      return await transport.request(method, route, body);
+    } catch (error) {
+      if (error instanceof InstanceGatewayRequestError)
+        throw new ModelGatewayRequestError(
+          error.status,
+          "The local preview model request was refused or is unavailable.",
+          error.retryAfterSeconds
+        );
+      throw error;
+    }
+  }
+  return {
+    async models() {
+      const response = await send("GET", "/models");
+      return readPreviewCatalog(response);
+    },
+    chat: {
+      completions: {
+        async create(request) {
+          return await (await send(
+            "POST",
+            "/models/chat/completions",
+            request
+          )).json();
+        }
+      }
+    }
+  };
+}
+
 // src/http/emailClient.ts
 var EmailRequestError = class extends InstanceGatewayRequestError {
   name = "EmailRequestError";
@@ -2748,10 +3005,16 @@ var EMAIL_LIMITS = {
   maxSubjectLength: 998,
   /** text + html, UTF-8 bytes. */
   maxBodyBytes: 512 * 1024,
-  maxTags: 10
+  maxTags: 10,
+  /** `listUnsubscribe.url`; keeps the header within SES's limit. */
+  maxUnsubscribeUrlLength: 512
 };
 var ADDRESS = /^[^\s@<>()[\]\\,;:"]+@[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)+$/;
 var TAG_PART = /^[A-Za-z0-9_-]{1,256}$/;
+var HEADER_SAFE = /^[\x21-\x7e]+$/;
+var URL_DELIMITERS = /[<>,"\\]/;
+var MAILBOX = /^[A-Za-z0-9._+-]+@[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)+$/;
+var UNSUBSCRIBE_FIELDS = /* @__PURE__ */ new Set(["url", "mailto", "oneClick"]);
 function isEmailAddress(address) {
   return typeof address === "string" && address.length <= EMAIL_LIMITS.maxAddressLength && ADDRESS.test(address);
 }
@@ -2776,6 +3039,72 @@ function addresses(value, field) {
   }
   return list;
 }
+function fail(problem) {
+  refuse(`listUnsubscribe: ${problem}`);
+}
+function unsubscribeUrlProblem(url) {
+  if (typeof url !== "string" || url === "") return "url must be a string";
+  if (url.length > EMAIL_LIMITS.maxUnsubscribeUrlLength) {
+    return `url is longer than ${EMAIL_LIMITS.maxUnsubscribeUrlLength} characters`;
+  }
+  if (!HEADER_SAFE.test(url)) {
+    return "url must be printable ASCII with no spaces or line breaks; percent-encode anything else";
+  }
+  if (URL_DELIMITERS.test(url)) {
+    return 'url must not contain < > , " or \\; percent-encode them';
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return "url is not a URL";
+  }
+  if (parsed.protocol !== "https:") return "url must be https";
+  if (parsed.username || parsed.password) {
+    return "url must not carry a user name or password";
+  }
+  return null;
+}
+function validateListUnsubscribe(value) {
+  if (value === void 0 || value === null) return void 0;
+  if (typeof value !== "object" || Array.isArray(value)) {
+    fail("must be an object");
+  }
+  const unknownFields = Object.keys(value).filter(
+    (key) => !UNSUBSCRIBE_FIELDS.has(key)
+  );
+  if (unknownFields.length) {
+    fail(`unknown field ${unknownFields.map((k) => `'${k}'`).join(", ")}`);
+  }
+  const url = "url" in value ? value.url : void 0;
+  const mailto = "mailto" in value ? value.mailto : void 0;
+  const oneClick = "oneClick" in value ? value.oneClick : void 0;
+  if (url === void 0 && mailto === void 0) {
+    fail("needs a url or a mailto");
+  }
+  if (url !== void 0) {
+    const problem = unsubscribeUrlProblem(url);
+    if (problem) fail(problem);
+  }
+  if (mailto !== void 0 && (typeof mailto !== "string" || mailto.length > EMAIL_LIMITS.maxAddressLength || !MAILBOX.test(mailto))) {
+    fail(
+      `mailto: '${String(mailto).slice(0, 80)}' is not a plain mailbox (letters, digits, . _ + - before the @)`
+    );
+  }
+  if (oneClick !== void 0 && typeof oneClick !== "boolean") {
+    fail("oneClick must be true or false");
+  }
+  if (typeof url === "string") {
+    return {
+      url,
+      ...typeof mailto === "string" ? { mailto } : {},
+      ...oneClick === true ? { oneClick: true } : {}
+    };
+  }
+  if (oneClick === true) fail("oneClick needs a url (RFC 8058 posts to it)");
+  if (typeof mailto === "string") return { mailto };
+  return fail("needs a url or a mailto");
+}
 function validateEmailSendRequest(request) {
   const to = addresses(request.to, "to") ?? refuse("to is required");
   const replyTo = addresses(request.replyTo, "replyTo");
@@ -2807,13 +3136,15 @@ function validateEmailSendRequest(request) {
       refuse(`tag '${name}' is reserved`);
     }
   }
+  const listUnsubscribe = validateListUnsubscribe(request.listUnsubscribe);
   return {
     to,
     subject,
     ...request.text !== void 0 ? { text: request.text } : {},
     ...request.html !== void 0 ? { html: request.html } : {},
     ...replyTo ? { replyTo } : {},
-    ...names.length ? { tags } : {}
+    ...names.length ? { tags } : {},
+    ...listUnsubscribe ? { listUnsubscribe } : {}
   };
 }
 function createEmailClient(options2 = {}) {
@@ -2823,7 +3154,7 @@ function createEmailClient(options2 = {}) {
     INSTANCE_HMAC_KEY: options2.hmacKey ?? process.env.INSTANCE_HMAC_KEY
   })) {
     throw new Error(
-      "Email is sent by the ForkLaunch platform and is only available to managed instances: PLATFORM_GATEWAY_URL, INSTANCE_ID and INSTANCE_HMAC_KEY must be set. Locally, `forklaunch infra add <service> email` sets them to the gateway mock in docker-compose."
+      "Email is sent by the ForkLaunch platform: PLATFORM_GATEWAY_URL, INSTANCE_ID and INSTANCE_HMAC_KEY must be set. A managed instance and an app deployed with `forklaunch deploy create` get them from the platform at deploy. Locally, `forklaunch infra add <service> email` sets them to the gateway mock in docker-compose."
     );
   }
   const transport = createInstanceGatewayTransport(options2, "Email");
@@ -3122,8 +3453,8 @@ var VoiceClient = class {
   async send(method, route, body) {
     try {
       const response = await this.transport.request(method, route, body);
-      const text = await response.text();
-      return text ? JSON.parse(text) : void 0;
+      const text2 = await response.text();
+      return text2 ? JSON.parse(text2) : void 0;
     } catch (error) {
       if (error instanceof InstanceGatewayRequestError) {
         throw new VoiceRequestError(
@@ -3251,6 +3582,9 @@ function createStripeClient(options2 = {}) {
   const explicitGateway = Boolean(
     options2.gatewayUrl || options2.instanceId || options2.hmacKey
   );
+  if (!explicitGateway && options2.apiKey) {
+    return new StripeClass(options2.apiKey, options2.config);
+  }
   if (!explicitGateway && !isManagedInstance()) {
     if (!options2.apiKey) {
       throw new Error(
@@ -4353,7 +4687,7 @@ var getCodeForStatus = (status) => {
 var httpStatusCodes_default = HTTPStatuses;
 
 // src/http/mcpGenerator/mcpGenerator.ts
-var import_common12 = require("@forklaunch/common");
+var import_common13 = require("@forklaunch/common");
 var import_zod = require("@forklaunch/validator/zod");
 var import_fastmcp = require("fastmcp");
 
@@ -4488,7 +4822,7 @@ function generateMcpServer(schemaValidator, protocol, host, port, version, appli
             if (discriminatedBody) {
               switch (discriminatedBody.parserType) {
                 case "json": {
-                  parsedBody = (0, import_common12.safeStringify)(body);
+                  parsedBody = (0, import_common13.safeStringify)(body);
                   break;
                 }
                 case "text": {
@@ -4496,12 +4830,12 @@ function generateMcpServer(schemaValidator, protocol, host, port, version, appli
                   break;
                 }
                 case "file": {
-                  parsedBody = Buffer.from((0, import_common12.safeStringify)(body));
+                  parsedBody = Buffer.from((0, import_common13.safeStringify)(body));
                   break;
                 }
                 case "multipart": {
                   const formData = new FormData();
-                  if ((0, import_common12.isRecord)(body)) {
+                  if ((0, import_common13.isRecord)(body)) {
                     for (const key in body) {
                       if (typeof body[key] === "string") {
                         if (schemaValidator.isInstanceOf(
@@ -4526,11 +4860,11 @@ function generateMcpServer(schemaValidator, protocol, host, port, version, appli
                   break;
                 }
                 case "urlEncoded": {
-                  if ((0, import_common12.isRecord)(body)) {
+                  if ((0, import_common13.isRecord)(body)) {
                     parsedBody = new URLSearchParams(
                       Object.entries(body).map(([key, value]) => [
                         key,
-                        (0, import_common12.safeStringify)(value)
+                        (0, import_common13.safeStringify)(value)
                       ])
                     );
                   } else {
@@ -4539,8 +4873,8 @@ function generateMcpServer(schemaValidator, protocol, host, port, version, appli
                   break;
                 }
                 default: {
-                  (0, import_common12.isNever)(discriminatedBody.parserType);
-                  parsedBody = (0, import_common12.safeStringify)(body);
+                  (0, import_common13.isNever)(discriminatedBody.parserType);
+                  parsedBody = (0, import_common13.safeStringify)(body);
                   break;
                 }
               }
@@ -4549,7 +4883,7 @@ function generateMcpServer(schemaValidator, protocol, host, port, version, appli
               const queryString = new URLSearchParams(
                 Object.entries(query).map(([key, value]) => [
                   key,
-                  (0, import_common12.safeStringify)(value)
+                  (0, import_common13.safeStringify)(value)
                 ])
               ).toString();
               url += queryString ? `?${queryString}` : "";
@@ -4582,7 +4916,7 @@ function generateMcpServer(schemaValidator, protocol, host, port, version, appli
                   content: [
                     {
                       type: "text",
-                      text: (0, import_common12.safeStringify)(await response.json())
+                      text: (0, import_common13.safeStringify)(await response.json())
                     }
                   ]
                 };
@@ -4737,20 +5071,20 @@ ${parseErrors.join("\n\n")}`
 }
 
 // src/http/middleware/response/enrichExpressLikeSend.middleware.ts
-var import_common14 = require("@forklaunch/common");
+var import_common15 = require("@forklaunch/common");
 var import_stream = require("stream");
 
 // src/http/telemetry/recordMetric.ts
-var import_common13 = require("@forklaunch/common");
+var import_common14 = require("@forklaunch/common");
 var import_semantic_conventions4 = require("@opentelemetry/semantic-conventions");
 function recordMetric(req, res) {
   if (res.metricRecorded) {
     return;
   }
-  const serviceName = (0, import_common13.getEnvVar)("OTEL_SERVICE_NAME") || "unknown";
+  const serviceName = (0, import_common14.getEnvVar)("OTEL_SERVICE_NAME") || "unknown";
   const attrs = {
     [import_semantic_conventions4.ATTR_SERVICE_NAME]: serviceName,
-    [ATTR_APPLICATION_ID]: (0, import_common13.getEnvVar)("OTEL_APPLICATION_ID"),
+    [ATTR_APPLICATION_ID]: (0, import_common14.getEnvVar)("OTEL_APPLICATION_ID"),
     [ATTR_API_NAME]: req.contractDetails?.name,
     [import_semantic_conventions4.ATTR_HTTP_REQUEST_METHOD]: req.method,
     [import_semantic_conventions4.ATTR_HTTP_ROUTE]: req.originalPath,
@@ -4798,15 +5132,15 @@ function enrichExpressLikeSend(instance, req, res, originalOperation, originalSe
         `attachment; filename="${data.name}"`
       );
     }
-    if ((0, import_common14.isNodeJsWriteableStream)(res)) {
-      import_stream.Readable.from((0, import_common14.readableStreamToAsyncIterable)(data.stream())).pipe(res);
+    if ((0, import_common15.isNodeJsWriteableStream)(res)) {
+      import_stream.Readable.from((0, import_common15.readableStreamToAsyncIterable)(data.stream())).pipe(res);
     } else {
       res.type("text/plain");
       res.status(500);
       originalSend.call(instance, "Not a NodeJS WritableStream");
       errorSent = true;
     }
-  } else if ((0, import_common14.isAsyncGenerator)(data)) {
+  } else if ((0, import_common15.isAsyncGenerator)(data)) {
     let firstPass = true;
     const transformer = new import_stream.Transform({
       objectMode: true,
@@ -4830,7 +5164,7 @@ ${res.locals.errorMessage}`;
             } else {
               let data2 = "";
               for (const [key, value] of Object.entries(chunk)) {
-                data2 += `${key}: ${typeof value === "string" ? value : (0, import_common14.safeStringify)(value)}
+                data2 += `${key}: ${typeof value === "string" ? value : (0, import_common15.safeStringify)(value)}
 `;
               }
               data2 += "\n";
@@ -4841,7 +5175,7 @@ ${res.locals.errorMessage}`;
         } else if (!errorSent) {
           let data2 = "";
           for (const [key, value] of Object.entries(chunk)) {
-            data2 += `${key}: ${typeof value === "string" ? value : (0, import_common14.safeStringify)(value)}
+            data2 += `${key}: ${typeof value === "string" ? value : (0, import_common15.safeStringify)(value)}
 `;
           }
           data2 += "\n";
@@ -4849,7 +5183,7 @@ ${res.locals.errorMessage}`;
         }
       }
     });
-    if ((0, import_common14.isNodeJsWriteableStream)(res)) {
+    if ((0, import_common15.isNodeJsWriteableStream)(res)) {
       import_stream.Readable.from(data).pipe(transformer).pipe(res);
     } else {
       res.type("text/plain");
@@ -4860,7 +5194,7 @@ ${res.locals.errorMessage}`;
   } else {
     const parserType = responseBodies?.[Number(res.statusCode)]?.parserType;
     res.bodyData = data;
-    if ((0, import_common14.isRecord)(data)) {
+    if ((0, import_common15.isRecord)(data)) {
       switch (parserType) {
         case "json":
           res.bodyData = "json" in data ? data.json : data;
@@ -4881,7 +5215,7 @@ ${res.locals.errorMessage}`;
           res.bodyData = data;
           break;
         default:
-          (0, import_common14.isNever)(parserType);
+          (0, import_common15.isNever)(parserType);
           res.bodyData = data;
           break;
       }
@@ -4916,7 +5250,7 @@ ${res.locals.errorMessage}`;
 }
 
 // src/http/openApiV3Generator/openApiV3Generator.ts
-var import_common15 = require("@forklaunch/common");
+var import_common16 = require("@forklaunch/common");
 var OPENAPI_DEFAULT_VERSION = /* @__PURE__ */ Symbol("default");
 function toUpperCase(str) {
   return str.charAt(0).toUpperCase() + str.slice(1);
@@ -5139,7 +5473,7 @@ function generateOpenApiSpecs(schemaValidator, serverUrls, serverDescriptions, a
   ].forEach(({ fullPath, router }) => {
     const controllerName = transformBasePath(fullPath);
     router.routes.forEach((route) => {
-      const openApiPath = (0, import_common15.openApiCompliantPath)(
+      const openApiPath = (0, import_common16.openApiCompliantPath)(
         `${fullPath}${route.path === "/" ? "" : route.path}`
       );
       const { name, summary, params, versions, auth, options: options2 } = route.contractDetails;
@@ -5243,44 +5577,6 @@ function generateOpenApiSpecs(schemaValidator, serverUrls, serverDescriptions, a
   );
 }
 
-// src/http/telemetry/auditLogger.ts
-var import_crypto5 = require("crypto");
-var AuditLogger = class {
-  _otel;
-  constructor(otel) {
-    this._otel = otel;
-  }
-  append(entry) {
-    try {
-      this._otel.info(
-        {
-          "log.type": "audit",
-          "audit.timestamp": entry.timestamp,
-          "audit.userId": entry.userId ?? "",
-          "audit.tenantId": entry.tenantId ?? "",
-          "audit.route": entry.route,
-          "audit.method": entry.method,
-          "audit.bodyHash": entry.bodyHash,
-          "audit.status": entry.status,
-          "audit.duration": entry.duration,
-          "audit.redactedFields": entry.redactedFields.join(","),
-          "audit.eventType": entry.eventType,
-          _meta: true
-        },
-        `audit:${entry.eventType} ${entry.method} ${entry.route} ${entry.status}`
-      );
-    } catch (error) {
-      console.error("Failed to emit audit log via OTEL:", error);
-    }
-  }
-  static hashBody(body) {
-    if (body === void 0 || body === null || body === "") {
-      return "";
-    }
-    return (0, import_crypto5.createHash)("sha256").update(body).digest("hex");
-  }
-};
-
 // src/http/telemetry/evaluateTelemetryOptions.ts
 function evaluateTelemetryOptions(telemetryOptions) {
   return {
@@ -5325,8 +5621,8 @@ var RateLimiter = class {
       const now = Date.now();
       let counter;
       try {
-        const record = await this.cache.readRecord(key);
-        counter = record.value;
+        const record2 = await this.cache.readRecord(key);
+        counter = record2.value;
         if (now >= counter.resetAt) {
           counter = { count: 0, resetAt: now + windowMs };
         }
@@ -5404,12 +5700,16 @@ var RateLimiter = class {
   VoiceClient,
   VoiceRequestError,
   WhatsAppRequestError,
+  auditComplianceAccess,
+  auditEnabled,
+  auditEventType,
   createContext,
   createEmailClient,
   createHmacToken,
   createInstanceGatewayTransport,
   createModelGatewayClient,
   createPaymentsClient,
+  createPreviewModelGatewayClient,
   createSmsClient,
   createStripeClient,
   createVoiceClient,
@@ -5455,6 +5755,7 @@ var RateLimiter = class {
   post,
   put,
   recordMetric,
+  recordRequestAudit,
   resetProcessHandlersForTesting,
   signPlatformEvent,
   smsSegments,
@@ -5463,6 +5764,7 @@ var RateLimiter = class {
   typedAuthHandler,
   typedHandler,
   validateEmailSendRequest,
+  validateListUnsubscribe,
   validateSmsSend,
   verifyPlatformEvent,
   voiceRequestProblem