@forklaunch/core 3.0.1 → 3.2.0

package/lib/http/index.mjs

@@ -686,8 +686,8 @@ async function getCachedJwks(jwksPublicKeyUrl) {
     return cachedJwks.value;
   } else {
     const jwksResponse = await fetch(jwksPublicKeyUrl);
-    const text = await jwksResponse.text();
-    if (!text) {
+    const text2 = await jwksResponse.text();
+    if (!text2) {
       if (cachedJwks.value) {
         return cachedJwks.value;
       }
@@ -695,7 +695,7 @@ async function getCachedJwks(jwksPublicKeyUrl) {
         `JWKS endpoint returned empty response (status ${jwksResponse.status})`
       );
     }
-    const jwks = JSON.parse(text).keys;
+    const jwks = JSON.parse(text2).keys;
     cachedJwks.value = jwks;
     cachedJwks.lastUpdated = /* @__PURE__ */ new Date();
     cachedJwks.ttl = parseInt(
@@ -1157,7 +1157,166 @@ async function parseRequestAuth(req, res, next) {
 }
 
 // src/http/middleware/request/enrichDetails.middleware.ts
+import { getEnvVar as getEnvVar4 } from "@forklaunch/common";
+
+// src/http/telemetry/requestAudit.ts
 import { getEnvVar as getEnvVar3 } from "@forklaunch/common";
+
+// src/persistence/encryptedType.ts
+import { Type } from "@mikro-orm/core";
+import { AsyncLocalStorage } from "async_hooks";
+var _tenantContext = new AsyncLocalStorage();
+
+// src/persistence/complianceChanges.ts
+var LISTENERS = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.changeListeners")] ??= /* @__PURE__ */ new Set();
+function onComplianceChange(listener) {
+  LISTENERS.add(listener);
+  return () => LISTENERS.delete(listener);
+}
+
+// src/persistence/compliantField.ts
+import {
+  Type as Type2
+} from "@mikro-orm/core";
+
+// src/persistence/fieldEncryptor.ts
+var HKDF_SALT = Buffer.alloc(0);
+
+// src/persistence/compliantField.ts
+var LISTENERS2 = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.listeners")] ??= /* @__PURE__ */ new Set();
+function onComplianceAccess(listener) {
+  LISTENERS2.add(listener);
+  return () => LISTENERS2.delete(listener);
+}
+var STATE = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.state")] ??= /* @__PURE__ */ new WeakMap();
+var SLOTS = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.slots")] ??= /* @__PURE__ */ new WeakMap();
+var LOADED_TENANTS = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.loadedTenants")] ??= /* @__PURE__ */ new WeakMap();
+
+// src/http/telemetry/auditLogger.ts
+import { createHash as createHash2 } from "crypto";
+var AuditLogger = class {
+  _otel;
+  constructor(otel) {
+    this._otel = otel;
+  }
+  append(entry) {
+    try {
+      this._otel.info(
+        {
+          "log.type": "audit",
+          "audit.timestamp": entry.timestamp,
+          "audit.userId": entry.userId ?? "",
+          "audit.tenantId": entry.tenantId ?? "",
+          "audit.route": entry.route,
+          "audit.method": entry.method,
+          "audit.bodyHash": entry.bodyHash,
+          "audit.status": entry.status,
+          "audit.duration": entry.duration,
+          "audit.redactedFields": entry.redactedFields.join(","),
+          "audit.eventType": entry.eventType,
+          _meta: true
+        },
+        `audit:${entry.eventType} ${entry.method} ${entry.route} ${entry.status}`
+      );
+    } catch (error) {
+      console.error("Failed to emit audit log via OTEL:", error);
+    }
+  }
+  static hashBody(body) {
+    if (body === void 0 || body === null || body === "") {
+      return "";
+    }
+    return createHash2("sha256").update(body).digest("hex");
+  }
+};
+
+// src/http/telemetry/requestAudit.ts
+function auditEnabled() {
+  return getEnvVar3("FORKLAUNCH_AUDIT") !== "off";
+}
+var loggers = /* @__PURE__ */ new WeakMap();
+function loggerFor(otel) {
+  let logger2 = loggers.get(otel);
+  if (!logger2) {
+    logger2 = new AuditLogger(otel);
+    loggers.set(otel, logger2);
+  }
+  return logger2;
+}
+function auditEventType(status) {
+  if (status === 401) return "auth_failure";
+  if (status === 403) return "rbac_deny";
+  if (status === 429) return "rate_limit";
+  return "http";
+}
+var text = (value) => typeof value === "string" && value ? value : null;
+function bodyText(body) {
+  if (body == null || body === "") return void 0;
+  if (typeof body === "string" || Buffer.isBuffer(body)) return String(body);
+  try {
+    return JSON.stringify(body);
+  } catch {
+    return void 0;
+  }
+}
+function recordRequestAudit(otel, req, status, durationMs) {
+  if (!otel || !auditEnabled()) return;
+  const session = req.session && typeof req.session === "object" ? req.session : void 0;
+  loggerFor(otel).append({
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    userId: text(session?.sub) ?? text(session?.userId),
+    tenantId: text(session?.activeOrganizationId) ?? text(session?.organizationId),
+    route: req.originalPath ?? req.path ?? "unknown",
+    method: req.method,
+    bodyHash: AuditLogger.hashBody(bodyText(req.body)),
+    status,
+    duration: Math.max(0, Math.round(durationMs)),
+    redactedFields: [],
+    eventType: auditEventType(status)
+  });
+}
+var accessAudit;
+function auditComplianceAccess(otel) {
+  if (!accessAudit && auditEnabled()) {
+    const logger2 = loggerFor(otel);
+    const remove = onComplianceAccess(
+      (event) => logger2.append({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        userId: null,
+        tenantId: event.tenantId || null,
+        route: event.field,
+        method: "READ",
+        bodyHash: "",
+        status: 0,
+        duration: 0,
+        redactedFields: [event.field],
+        eventType: "data_access"
+      })
+    );
+    const removeChanges = onComplianceChange(
+      (event) => logger2.append({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        userId: null,
+        tenantId: event.tenantId,
+        route: `${event.entity}#${event.id}`,
+        method: event.action.toUpperCase(),
+        bodyHash: "",
+        status: 0,
+        duration: 0,
+        redactedFields: event.sensitiveFields,
+        eventType: "data_change"
+      })
+    );
+    accessAudit = () => {
+      remove();
+      removeChanges();
+      accessAudit = void 0;
+    };
+  }
+  return accessAudit ?? (() => void 0);
+}
+
+// src/http/middleware/request/enrichDetails.middleware.ts
 function enrichDetails(path, contractDetails, requestSchema, responseSchemas, openTelemetryCollector, globalOptions) {
   return (req, res, next) => {
     req.originalPath = path;
@@ -1168,12 +1327,20 @@ function enrichDetails(path, contractDetails, requestSchema, responseSchemas, op
     req._globalOptions = globalOptions ?? (() => void 0);
     req.context?.span?.setAttribute(ATTR_API_NAME, req.contractDetails?.name);
     const startTime = process.hrtime();
+    if (openTelemetryCollector) auditComplianceAccess(openTelemetryCollector);
     res.on("finish", () => {
+      const [auditSeconds, auditNanoseconds] = process.hrtime(startTime);
+      recordRequestAudit(
+        openTelemetryCollector,
+        req,
+        Number(res.statusCode),
+        auditSeconds * 1e3 + auditNanoseconds / 1e6
+      );
       const [seconds, nanoseconds] = process.hrtime(startTime);
       const durationMs = seconds + nanoseconds / 1e9;
       httpServerDurationHistogram.record(durationMs, {
-        [ATTR_SERVICE_NAME]: getEnvVar3("OTEL_SERVICE_NAME") || "unknown",
-        [ATTR_APPLICATION_ID]: getEnvVar3("OTEL_APPLICATION_ID"),
+        [ATTR_SERVICE_NAME]: getEnvVar4("OTEL_SERVICE_NAME") || "unknown",
+        [ATTR_APPLICATION_ID]: getEnvVar4("OTEL_APPLICATION_ID"),
         [ATTR_API_NAME]: req.contractDetails?.name || "unknown",
         [ATTR_HTTP_REQUEST_METHOD]: req.method,
         [ATTR_HTTP_ROUTE]: req.originalPath || "unknown",
@@ -2627,6 +2794,92 @@ async function* sseData(stream) {
   }
 }
 
+// src/http/previewModelGatewayClient.ts
+function record(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function invalidCatalog() {
+  throw new ModelGatewayRequestError(
+    502,
+    "The local preview model catalog is invalid or expired."
+  );
+}
+function previewCatalog(raw) {
+  if (!record(raw) || !record(raw.preview)) return invalidCatalog();
+  const preview = raw.preview;
+  if (Object.keys(raw).some((key) => !["models", "preview"].includes(key)) || Object.keys(preview).some(
+    (key) => !["expiresAt", "maxCalls", "maxUnits"].includes(key)
+  ) || !Array.isArray(raw.models) || raw.models.length !== 1 || !record(raw.models[0]) || Object.keys(raw.models[0]).some((key) => key !== "id") || typeof raw.models[0].id !== "string" || !/^[\w.:-]{1,160}$/.test(raw.models[0].id) || typeof preview.expiresAt !== "number" || !Number.isSafeInteger(preview.expiresAt) || preview.expiresAt <= Date.now() || preview.expiresAt > Date.now() + 15 * 6e4 || typeof preview.maxCalls !== "number" || !Number.isSafeInteger(preview.maxCalls) || preview.maxCalls < 1 || preview.maxCalls > 20 || typeof preview.maxUnits !== "number" || !Number.isSafeInteger(preview.maxUnits) || preview.maxUnits < 1 || preview.maxUnits > 1e5)
+    return invalidCatalog();
+  return {
+    models: [{ id: raw.models[0].id }],
+    preview: {
+      expiresAt: preview.expiresAt,
+      maxCalls: preview.maxCalls,
+      maxUnits: preview.maxUnits
+    }
+  };
+}
+async function readPreviewCatalog(response) {
+  if (!response.body) return invalidCatalog();
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let text2 = "", bytes = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      bytes += value.byteLength;
+      if (bytes > 8192) return invalidCatalog();
+      text2 += decoder.decode(value, { stream: true });
+    }
+    text2 += decoder.decode();
+    return previewCatalog(JSON.parse(text2));
+  } catch {
+    return invalidCatalog();
+  } finally {
+    await reader.cancel().catch(() => {
+    });
+    reader.releaseLock();
+  }
+}
+function createPreviewModelGatewayClient(options2 = {}) {
+  const transport = createInstanceGatewayTransport(
+    options2,
+    "The local preview model gateway"
+  );
+  async function send(method, route, body) {
+    try {
+      return await transport.request(method, route, body);
+    } catch (error) {
+      if (error instanceof InstanceGatewayRequestError)
+        throw new ModelGatewayRequestError(
+          error.status,
+          "The local preview model request was refused or is unavailable.",
+          error.retryAfterSeconds
+        );
+      throw error;
+    }
+  }
+  return {
+    async models() {
+      const response = await send("GET", "/models");
+      return readPreviewCatalog(response);
+    },
+    chat: {
+      completions: {
+        async create(request) {
+          return await (await send(
+            "POST",
+            "/models/chat/completions",
+            request
+          )).json();
+        }
+      }
+    }
+  };
+}
+
 // src/http/emailClient.ts
 var EmailRequestError = class extends InstanceGatewayRequestError {
   name = "EmailRequestError";
@@ -2637,10 +2890,16 @@ var EMAIL_LIMITS = {
   maxSubjectLength: 998,
   /** text + html, UTF-8 bytes. */
   maxBodyBytes: 512 * 1024,
-  maxTags: 10
+  maxTags: 10,
+  /** `listUnsubscribe.url`; keeps the header within SES's limit. */
+  maxUnsubscribeUrlLength: 512
 };
 var ADDRESS = /^[^\s@<>()[\]\\,;:"]+@[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)+$/;
 var TAG_PART = /^[A-Za-z0-9_-]{1,256}$/;
+var HEADER_SAFE = /^[\x21-\x7e]+$/;
+var URL_DELIMITERS = /[<>,"\\]/;
+var MAILBOX = /^[A-Za-z0-9._+-]+@[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)+$/;
+var UNSUBSCRIBE_FIELDS = /* @__PURE__ */ new Set(["url", "mailto", "oneClick"]);
 function isEmailAddress(address) {
   return typeof address === "string" && address.length <= EMAIL_LIMITS.maxAddressLength && ADDRESS.test(address);
 }
@@ -2665,6 +2924,72 @@ function addresses(value, field) {
   }
   return list;
 }
+function fail(problem) {
+  refuse(`listUnsubscribe: ${problem}`);
+}
+function unsubscribeUrlProblem(url) {
+  if (typeof url !== "string" || url === "") return "url must be a string";
+  if (url.length > EMAIL_LIMITS.maxUnsubscribeUrlLength) {
+    return `url is longer than ${EMAIL_LIMITS.maxUnsubscribeUrlLength} characters`;
+  }
+  if (!HEADER_SAFE.test(url)) {
+    return "url must be printable ASCII with no spaces or line breaks; percent-encode anything else";
+  }
+  if (URL_DELIMITERS.test(url)) {
+    return 'url must not contain < > , " or \\; percent-encode them';
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return "url is not a URL";
+  }
+  if (parsed.protocol !== "https:") return "url must be https";
+  if (parsed.username || parsed.password) {
+    return "url must not carry a user name or password";
+  }
+  return null;
+}
+function validateListUnsubscribe(value) {
+  if (value === void 0 || value === null) return void 0;
+  if (typeof value !== "object" || Array.isArray(value)) {
+    fail("must be an object");
+  }
+  const unknownFields = Object.keys(value).filter(
+    (key) => !UNSUBSCRIBE_FIELDS.has(key)
+  );
+  if (unknownFields.length) {
+    fail(`unknown field ${unknownFields.map((k) => `'${k}'`).join(", ")}`);
+  }
+  const url = "url" in value ? value.url : void 0;
+  const mailto = "mailto" in value ? value.mailto : void 0;
+  const oneClick = "oneClick" in value ? value.oneClick : void 0;
+  if (url === void 0 && mailto === void 0) {
+    fail("needs a url or a mailto");
+  }
+  if (url !== void 0) {
+    const problem = unsubscribeUrlProblem(url);
+    if (problem) fail(problem);
+  }
+  if (mailto !== void 0 && (typeof mailto !== "string" || mailto.length > EMAIL_LIMITS.maxAddressLength || !MAILBOX.test(mailto))) {
+    fail(
+      `mailto: '${String(mailto).slice(0, 80)}' is not a plain mailbox (letters, digits, . _ + - before the @)`
+    );
+  }
+  if (oneClick !== void 0 && typeof oneClick !== "boolean") {
+    fail("oneClick must be true or false");
+  }
+  if (typeof url === "string") {
+    return {
+      url,
+      ...typeof mailto === "string" ? { mailto } : {},
+      ...oneClick === true ? { oneClick: true } : {}
+    };
+  }
+  if (oneClick === true) fail("oneClick needs a url (RFC 8058 posts to it)");
+  if (typeof mailto === "string") return { mailto };
+  return fail("needs a url or a mailto");
+}
 function validateEmailSendRequest(request) {
   const to = addresses(request.to, "to") ?? refuse("to is required");
   const replyTo = addresses(request.replyTo, "replyTo");
@@ -2696,13 +3021,15 @@ function validateEmailSendRequest(request) {
       refuse(`tag '${name}' is reserved`);
     }
   }
+  const listUnsubscribe = validateListUnsubscribe(request.listUnsubscribe);
   return {
     to,
     subject,
     ...request.text !== void 0 ? { text: request.text } : {},
     ...request.html !== void 0 ? { html: request.html } : {},
     ...replyTo ? { replyTo } : {},
-    ...names.length ? { tags } : {}
+    ...names.length ? { tags } : {},
+    ...listUnsubscribe ? { listUnsubscribe } : {}
   };
 }
 function createEmailClient(options2 = {}) {
@@ -2712,7 +3039,7 @@ function createEmailClient(options2 = {}) {
     INSTANCE_HMAC_KEY: options2.hmacKey ?? process.env.INSTANCE_HMAC_KEY
   })) {
     throw new Error(
-      "Email is sent by the ForkLaunch platform and is only available to managed instances: PLATFORM_GATEWAY_URL, INSTANCE_ID and INSTANCE_HMAC_KEY must be set. Locally, `forklaunch infra add <service> email` sets them to the gateway mock in docker-compose."
+      "Email is sent by the ForkLaunch platform: PLATFORM_GATEWAY_URL, INSTANCE_ID and INSTANCE_HMAC_KEY must be set. A managed instance and an app deployed with `forklaunch deploy create` get them from the platform at deploy. Locally, `forklaunch infra add <service> email` sets them to the gateway mock in docker-compose."
     );
   }
   const transport = createInstanceGatewayTransport(options2, "Email");
@@ -3011,8 +3338,8 @@ var VoiceClient = class {
   async send(method, route, body) {
     try {
       const response = await this.transport.request(method, route, body);
-      const text = await response.text();
-      return text ? JSON.parse(text) : void 0;
+      const text2 = await response.text();
+      return text2 ? JSON.parse(text2) : void 0;
     } catch (error) {
       if (error instanceof InstanceGatewayRequestError) {
         throw new VoiceRequestError(
@@ -3139,6 +3466,9 @@ function createStripeClient(options2 = {}) {
   const explicitGateway = Boolean(
     options2.gatewayUrl || options2.instanceId || options2.hmacKey
   );
+  if (!explicitGateway && options2.apiKey) {
+    return new StripeClass(options2.apiKey, options2.config);
+  }
   if (!explicitGateway && !isManagedInstance()) {
     if (!options2.apiKey) {
       throw new Error(
@@ -4638,7 +4968,7 @@ import {
 import { Readable, Transform } from "stream";
 
 // src/http/telemetry/recordMetric.ts
-import { getEnvVar as getEnvVar4 } from "@forklaunch/common";
+import { getEnvVar as getEnvVar5 } from "@forklaunch/common";
 import {
   ATTR_HTTP_REQUEST_METHOD as ATTR_HTTP_REQUEST_METHOD3,
   ATTR_HTTP_RESPONSE_STATUS_CODE as ATTR_HTTP_RESPONSE_STATUS_CODE3,
@@ -4649,10 +4979,10 @@ function recordMetric(req, res) {
   if (res.metricRecorded) {
     return;
   }
-  const serviceName = getEnvVar4("OTEL_SERVICE_NAME") || "unknown";
+  const serviceName = getEnvVar5("OTEL_SERVICE_NAME") || "unknown";
   const attrs = {
     [ATTR_SERVICE_NAME3]: serviceName,
-    [ATTR_APPLICATION_ID]: getEnvVar4("OTEL_APPLICATION_ID"),
+    [ATTR_APPLICATION_ID]: getEnvVar5("OTEL_APPLICATION_ID"),
     [ATTR_API_NAME]: req.contractDetails?.name,
     [ATTR_HTTP_REQUEST_METHOD3]: req.method,
     [ATTR_HTTP_ROUTE3]: req.originalPath,
@@ -5145,44 +5475,6 @@ function generateOpenApiSpecs(schemaValidator, serverUrls, serverDescriptions, a
   );
 }
 
-// src/http/telemetry/auditLogger.ts
-import { createHash as createHash2 } from "crypto";
-var AuditLogger = class {
-  _otel;
-  constructor(otel) {
-    this._otel = otel;
-  }
-  append(entry) {
-    try {
-      this._otel.info(
-        {
-          "log.type": "audit",
-          "audit.timestamp": entry.timestamp,
-          "audit.userId": entry.userId ?? "",
-          "audit.tenantId": entry.tenantId ?? "",
-          "audit.route": entry.route,
-          "audit.method": entry.method,
-          "audit.bodyHash": entry.bodyHash,
-          "audit.status": entry.status,
-          "audit.duration": entry.duration,
-          "audit.redactedFields": entry.redactedFields.join(","),
-          "audit.eventType": entry.eventType,
-          _meta: true
-        },
-        `audit:${entry.eventType} ${entry.method} ${entry.route} ${entry.status}`
-      );
-    } catch (error) {
-      console.error("Failed to emit audit log via OTEL:", error);
-    }
-  }
-  static hashBody(body) {
-    if (body === void 0 || body === null || body === "") {
-      return "";
-    }
-    return createHash2("sha256").update(body).digest("hex");
-  }
-};
-
 // src/http/telemetry/evaluateTelemetryOptions.ts
 function evaluateTelemetryOptions(telemetryOptions) {
   return {
@@ -5227,8 +5519,8 @@ var RateLimiter = class {
       const now = Date.now();
       let counter;
       try {
-        const record = await this.cache.readRecord(key);
-        counter = record.value;
+        const record2 = await this.cache.readRecord(key);
+        counter = record2.value;
         if (now >= counter.resetAt) {
           counter = { count: 0, resetAt: now + windowMs };
         }
@@ -5305,12 +5597,16 @@ export {
   VoiceClient,
   VoiceRequestError,
   WhatsAppRequestError,
+  auditComplianceAccess,
+  auditEnabled,
+  auditEventType,
   createContext,
   createEmailClient,
   createHmacToken,
   createInstanceGatewayTransport,
   createModelGatewayClient,
   createPaymentsClient,
+  createPreviewModelGatewayClient,
   createSmsClient,
   createStripeClient,
   createVoiceClient,
@@ -5356,6 +5652,7 @@ export {
   post,
   put,
   recordMetric,
+  recordRequestAudit,
   resetProcessHandlersForTesting,
   signPlatformEvent,
   smsSegments,
@@ -5364,6 +5661,7 @@ export {
   typedAuthHandler,
   typedHandler,
   validateEmailSendRequest,
+  validateListUnsubscribe,
   validateSmsSend,
   verifyPlatformEvent,
   voiceRequestProblem