@geekmidas/manifest 10.0.0-alpha.147 → 10.0.0-alpha.149

package/dist/index.cjs

@@ -1115,10 +1115,27 @@ var NoUrlForStage = class extends Error {
 * and the address is still needed — Better Auth rate-limits per client.
 *
 * Reserved: the stack's edge (Caddy, Traefik, the `gkm dev` edge) removes it
-* from incoming requests, and the auth server ignores it on any request that
-* is not an internal caller's, so it cannot be spoofed from outside.
+* from every request that does not carry the stack's token
+* ({@link EDGE_TOKEN_HEADER}), and the auth server ignores it on any request
+* that neither carries the token nor is an internal caller's, so it cannot be
+* spoofed from outside.
 */
 const CLIENT_IP_HEADER = "x-gkm-client-ip";
+/**
+* The token a service of a stack sends beside {@link CLIENT_IP_HEADER} when
+* it calls a sibling through the stack's edge, at its public address.
+*
+* A request carries a forwarding header once it has passed an edge, so the
+* peer alone no longer says it came from inside the stack. The token does:
+* it is derived from the stage's seed, handed to every process of the stack
+* as {@link EDGE_TOKEN_KEY}, and known to the edge. The edge keeps
+* `x-gkm-client-ip` only on a request carrying it, and strips the header from
+* every other; the auth server honours the header only from an internal
+* caller or a request carrying its own token. A browser never has it.
+*/
+const EDGE_TOKEN_HEADER = "x-gkm-edge-token";
+/** Where a stack's processes read the token {@link EDGE_TOKEN_HEADER} carries. */
+const EDGE_TOKEN_KEY = "GKM_EDGE_TOKEN";
 //#endregion
 //#region src/inbox.ts
 /** The event type a received message is announced as on its inbox's topic. */
@@ -1379,6 +1396,8 @@ exports.DEFAULT_POSTGRES_VERSION = DEFAULT_POSTGRES_VERSION;
 exports.DEFAULT_STAGE_URL = DEFAULT_STAGE_URL;
 exports.DERIVED_PREFIX = DERIVED_PREFIX;
 exports.DERIVES_FROM = DERIVES_FROM;
+exports.EDGE_TOKEN_HEADER = EDGE_TOKEN_HEADER;
+exports.EDGE_TOKEN_KEY = EDGE_TOKEN_KEY;
 exports.INBOX_EVENT = INBOX_EVENT;
 exports.INBOX_MESSAGES_PREFIX = INBOX_MESSAGES_PREFIX;
 exports.IllegalDerivation = IllegalDerivation;