@geekmidas/telescope 10.0.0-alpha.84 → 10.0.0-alpha.86

package/dist/instrumentation/trust.cjs

@@ -28,7 +28,13 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 * Whether a trusted context is *sampled* is still this API's decision: see
 * `traceSampler`, which caps an incoming sampled flag at the stage's rate.
 */
-/** Headers a reverse proxy or CDN adds on the way in. */
+/**
+* Headers a reverse proxy or CDN adds on the way in.
+*
+* Not `x-gkm-client-ip`: that is gkm's own, sent by a service calling another
+* on a client's behalf (an API's session check), and stripped by the stack's
+* edge from everything that arrives from outside.
+*/
 const FORWARDING_HEADERS = [
 	"forwarded",
 	"x-forwarded-for",

package/dist/instrumentation/trust.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"trust.cjs","names":[],"sources":["../../src/instrumentation/trust.ts"],"sourcesContent":["/**\n * Whose `traceparent` an API continues.\n *\n * An incoming trace context is a claim made by the caller. Continued, it puts\n * this request's span inside whatever trace the caller named, and its sampled\n * flag asks this API to record it. From the API's own sites and from its own\n * services that is the point; from anyone else it lets a stranger graft spans\n * onto another user's trace, or force traces the stage's rate would not keep.\n *\n * So a request's context is continued only when it comes from a trusted source:\n *\n * - **its own sites** — an `Origin` header naming one of the API's allowed CORS\n *   origins (the sites with an edge to it). A browser sets `Origin` itself on\n *   every cross-origin request and a page cannot forge it;\n * - **an internal caller** — no `Origin` at all, no header any reverse proxy\n *   adds (`X-Forwarded-For`, `Forwarded`, `X-Real-IP`, …), and a TCP peer on a\n *   loopback or private address. That is another service calling this one\n *   over the private network by its internal URL: a request from the internet\n *   reaches the API through the stack's proxy, which always adds a forwarding\n *   header, or from a public address.\n *\n * Anything else — an unknown origin, a request through the public proxy with\n * no origin (curl, a server elsewhere) — starts a new trace, linked to the\n * context it claimed so the hop can still be followed.\n *\n * Whether a trusted context is *sampled* is still this API's decision: see\n * `traceSampler`, which caps an incoming sampled flag at the stage's rate.\n */\n\n/** Headers a reverse proxy or CDN adds on the way in. */\nconst FORWARDING_HEADERS = [\n\t'forwarded',\n\t'x-forwarded-for',\n\t'x-forwarded-host',\n\t'x-real-ip',\n\t'cf-connecting-ip',\n\t'true-client-ip',\n\t'fastly-client-ip',\n\t'x-client-ip',\n];\n\n/** `origin` normalized the way a browser sends it, or undefined. */\nfunction normalizeOrigin(origin: string): string | undefined {\n\ttry {\n\t\tconst url = new URL(origin);\n\t\treturn url.origin === 'null' ? undefined : url.origin;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\n/**\n * Whether `origin` is one of `trustedOrigins` — exactly, scheme, host and\n * port. A wildcard trusts nothing: an API that answers any origin's CORS has\n * not said which sites are its own.\n */\nexport function isTrustedOrigin(\n\torigin: string | undefined,\n\ttrustedOrigins: readonly string[] | undefined,\n): boolean {\n\tif (!origin || !trustedOrigins?.length) return false;\n\tconst normalized = normalizeOrigin(origin);\n\tif (!normalized) return false;\n\treturn trustedOrigins.some(\n\t\t(trusted) => trusted !== '*' && normalizeOrigin(trusted) === normalized,\n\t);\n}\n\n/**\n * Whether `address` is loopback or private: 127/8, 10/8, 172.16/12,\n * 192.168/16, 169.254/16, `::1`, `fc00::/7`, `fe80::/10`, and an IPv4 one\n * mapped into IPv6.\n */\nexport function isPrivateAddress(address: string | undefined): boolean {\n\tif (!address) return false;\n\tconst ip = address.toLowerCase().replace(/^::ffff:/, '');\n\n\tconst v4 = ip.match(/^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/);\n\tif (v4) {\n\t\tconst [a, b] = [Number(v4[1]), Number(v4[2])];\n\t\treturn (\n\t\t\ta === 127 ||\n\t\t\ta === 10 ||\n\t\t\t(a === 172 && b >= 16 && b <= 31) ||\n\t\t\t(a === 192 && b === 168) ||\n\t\t\t(a === 169 && b === 254)\n\t\t);\n\t}\n\n\tif (ip === '::1') return true;\n\treturn /^f[cd][0-9a-f]{2}:/.test(ip) || /^fe[89ab][0-9a-f]:/.test(ip);\n}\n\n/** What the internal-caller rule looks at. */\nexport interface IncomingRequestFacts {\n\t/** Every request header. */\n\theaders: Headers | Record<string, string | string[] | undefined>;\n\t/** The TCP peer's address, when the server knows it. */\n\tremoteAddress?: string;\n}\n\nfunction header(\n\theaders: IncomingRequestFacts['headers'],\n\tname: string,\n): string | undefined {\n\tif (headers instanceof Headers) return headers.get(name) ?? undefined;\n\tfor (const [key, value] of Object.entries(headers)) {\n\t\tif (key.toLowerCase() !== name) continue;\n\t\treturn Array.isArray(value) ? value[0] : value;\n\t}\n\treturn undefined;\n}\n\n/**\n * Whether a request is an internal caller's: no `Origin`, no forwarding\n * header, and a loopback or private peer. Without a peer address — a request\n * handed to the app in-process, a runtime that does not expose the socket —\n * it is not.\n */\nexport function isInternalCaller(request: IncomingRequestFacts): boolean {\n\tif (header(request.headers, 'origin')) return false;\n\tif (FORWARDING_HEADERS.some((name) => header(request.headers, name))) {\n\t\treturn false;\n\t}\n\treturn isPrivateAddress(request.remoteAddress);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,MAAM,qBAAqB;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD;;AAGA,SAAS,gBAAgB,QAAoC;CAC5D,IAAI;EACH,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,OAAO,IAAI,WAAW,SAAS,KAAA,IAAY,IAAI;CAChD,QAAQ;EACP;CACD;AACD;;;;;;AAOA,SAAgB,gBACf,QACA,gBACU;CACV,IAAI,CAAC,UAAU,CAAC,gBAAgB,QAAQ,OAAO;CAC/C,MAAM,aAAa,gBAAgB,MAAM;CACzC,IAAI,CAAC,YAAY,OAAO;CACxB,OAAO,eAAe,MACpB,YAAY,YAAY,OAAO,gBAAgB,OAAO,MAAM,UAC9D;AACD;;;;;;AAOA,SAAgB,iBAAiB,SAAsC;CACtE,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,KAAK,QAAQ,YAAY,CAAC,CAAC,QAAQ,YAAY,EAAE;CAEvD,MAAM,KAAK,GAAG,MAAM,8CAA8C;CAClE,IAAI,IAAI;EACP,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,GAAG,EAAE,CAAC;EAC5C,OACC,MAAM,OACN,MAAM,MACL,MAAM,OAAO,KAAK,MAAM,KAAK,MAC7B,MAAM,OAAO,MAAM,OACnB,MAAM,OAAO,MAAM;CAEtB;CAEA,IAAI,OAAO,OAAO,OAAO;CACzB,OAAO,qBAAqB,KAAK,EAAE,KAAK,qBAAqB,KAAK,EAAE;AACrE;AAUA,SAAS,OACR,SACA,MACqB;CACrB,IAAI,mBAAmB,SAAS,OAAO,QAAQ,IAAI,IAAI,KAAK,KAAA;CAC5D,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG;EACnD,IAAI,IAAI,YAAY,MAAM,MAAM;EAChC,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK;CAC1C;AAED;;;;;;;AAQA,SAAgB,iBAAiB,SAAwC;CACxE,IAAI,OAAO,QAAQ,SAAS,QAAQ,GAAG,OAAO;CAC9C,IAAI,mBAAmB,MAAM,SAAS,OAAO,QAAQ,SAAS,IAAI,CAAC,GAClE,OAAO;CAER,OAAO,iBAAiB,QAAQ,aAAa;AAC9C"}
+{"version":3,"file":"trust.cjs","names":[],"sources":["../../src/instrumentation/trust.ts"],"sourcesContent":["/**\n * Whose `traceparent` an API continues.\n *\n * An incoming trace context is a claim made by the caller. Continued, it puts\n * this request's span inside whatever trace the caller named, and its sampled\n * flag asks this API to record it. From the API's own sites and from its own\n * services that is the point; from anyone else it lets a stranger graft spans\n * onto another user's trace, or force traces the stage's rate would not keep.\n *\n * So a request's context is continued only when it comes from a trusted source:\n *\n * - **its own sites** — an `Origin` header naming one of the API's allowed CORS\n *   origins (the sites with an edge to it). A browser sets `Origin` itself on\n *   every cross-origin request and a page cannot forge it;\n * - **an internal caller** — no `Origin` at all, no header any reverse proxy\n *   adds (`X-Forwarded-For`, `Forwarded`, `X-Real-IP`, …), and a TCP peer on a\n *   loopback or private address. That is another service calling this one\n *   over the private network by its internal URL: a request from the internet\n *   reaches the API through the stack's proxy, which always adds a forwarding\n *   header, or from a public address.\n *\n * Anything else — an unknown origin, a request through the public proxy with\n * no origin (curl, a server elsewhere) — starts a new trace, linked to the\n * context it claimed so the hop can still be followed.\n *\n * Whether a trusted context is *sampled* is still this API's decision: see\n * `traceSampler`, which caps an incoming sampled flag at the stage's rate.\n */\n\n/**\n * Headers a reverse proxy or CDN adds on the way in.\n *\n * Not `x-gkm-client-ip`: that is gkm's own, sent by a service calling another\n * on a client's behalf (an API's session check), and stripped by the stack's\n * edge from everything that arrives from outside.\n */\nconst FORWARDING_HEADERS = [\n\t'forwarded',\n\t'x-forwarded-for',\n\t'x-forwarded-host',\n\t'x-real-ip',\n\t'cf-connecting-ip',\n\t'true-client-ip',\n\t'fastly-client-ip',\n\t'x-client-ip',\n];\n\n/** `origin` normalized the way a browser sends it, or undefined. */\nfunction normalizeOrigin(origin: string): string | undefined {\n\ttry {\n\t\tconst url = new URL(origin);\n\t\treturn url.origin === 'null' ? undefined : url.origin;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\n/**\n * Whether `origin` is one of `trustedOrigins` — exactly, scheme, host and\n * port. A wildcard trusts nothing: an API that answers any origin's CORS has\n * not said which sites are its own.\n */\nexport function isTrustedOrigin(\n\torigin: string | undefined,\n\ttrustedOrigins: readonly string[] | undefined,\n): boolean {\n\tif (!origin || !trustedOrigins?.length) return false;\n\tconst normalized = normalizeOrigin(origin);\n\tif (!normalized) return false;\n\treturn trustedOrigins.some(\n\t\t(trusted) => trusted !== '*' && normalizeOrigin(trusted) === normalized,\n\t);\n}\n\n/**\n * Whether `address` is loopback or private: 127/8, 10/8, 172.16/12,\n * 192.168/16, 169.254/16, `::1`, `fc00::/7`, `fe80::/10`, and an IPv4 one\n * mapped into IPv6.\n */\nexport function isPrivateAddress(address: string | undefined): boolean {\n\tif (!address) return false;\n\tconst ip = address.toLowerCase().replace(/^::ffff:/, '');\n\n\tconst v4 = ip.match(/^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/);\n\tif (v4) {\n\t\tconst [a, b] = [Number(v4[1]), Number(v4[2])];\n\t\treturn (\n\t\t\ta === 127 ||\n\t\t\ta === 10 ||\n\t\t\t(a === 172 && b >= 16 && b <= 31) ||\n\t\t\t(a === 192 && b === 168) ||\n\t\t\t(a === 169 && b === 254)\n\t\t);\n\t}\n\n\tif (ip === '::1') return true;\n\treturn /^f[cd][0-9a-f]{2}:/.test(ip) || /^fe[89ab][0-9a-f]:/.test(ip);\n}\n\n/** What the internal-caller rule looks at. */\nexport interface IncomingRequestFacts {\n\t/** Every request header. */\n\theaders: Headers | Record<string, string | string[] | undefined>;\n\t/** The TCP peer's address, when the server knows it. */\n\tremoteAddress?: string;\n}\n\nfunction header(\n\theaders: IncomingRequestFacts['headers'],\n\tname: string,\n): string | undefined {\n\tif (headers instanceof Headers) return headers.get(name) ?? undefined;\n\tfor (const [key, value] of Object.entries(headers)) {\n\t\tif (key.toLowerCase() !== name) continue;\n\t\treturn Array.isArray(value) ? value[0] : value;\n\t}\n\treturn undefined;\n}\n\n/**\n * Whether a request is an internal caller's: no `Origin`, no forwarding\n * header, and a loopback or private peer. Without a peer address — a request\n * handed to the app in-process, a runtime that does not expose the socket —\n * it is not.\n */\nexport function isInternalCaller(request: IncomingRequestFacts): boolean {\n\tif (header(request.headers, 'origin')) return false;\n\tif (FORWARDING_HEADERS.some((name) => header(request.headers, name))) {\n\t\treturn false;\n\t}\n\treturn isPrivateAddress(request.remoteAddress);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,MAAM,qBAAqB;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD;;AAGA,SAAS,gBAAgB,QAAoC;CAC5D,IAAI;EACH,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,OAAO,IAAI,WAAW,SAAS,KAAA,IAAY,IAAI;CAChD,QAAQ;EACP;CACD;AACD;;;;;;AAOA,SAAgB,gBACf,QACA,gBACU;CACV,IAAI,CAAC,UAAU,CAAC,gBAAgB,QAAQ,OAAO;CAC/C,MAAM,aAAa,gBAAgB,MAAM;CACzC,IAAI,CAAC,YAAY,OAAO;CACxB,OAAO,eAAe,MACpB,YAAY,YAAY,OAAO,gBAAgB,OAAO,MAAM,UAC9D;AACD;;;;;;AAOA,SAAgB,iBAAiB,SAAsC;CACtE,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,KAAK,QAAQ,YAAY,CAAC,CAAC,QAAQ,YAAY,EAAE;CAEvD,MAAM,KAAK,GAAG,MAAM,8CAA8C;CAClE,IAAI,IAAI;EACP,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,GAAG,EAAE,CAAC;EAC5C,OACC,MAAM,OACN,MAAM,MACL,MAAM,OAAO,KAAK,MAAM,KAAK,MAC7B,MAAM,OAAO,MAAM,OACnB,MAAM,OAAO,MAAM;CAEtB;CAEA,IAAI,OAAO,OAAO,OAAO;CACzB,OAAO,qBAAqB,KAAK,EAAE,KAAK,qBAAqB,KAAK,EAAE;AACrE;AAUA,SAAS,OACR,SACA,MACqB;CACrB,IAAI,mBAAmB,SAAS,OAAO,QAAQ,IAAI,IAAI,KAAK,KAAA;CAC5D,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG;EACnD,IAAI,IAAI,YAAY,MAAM,MAAM;EAChC,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK;CAC1C;AAED;;;;;;;AAQA,SAAgB,iBAAiB,SAAwC;CACxE,IAAI,OAAO,QAAQ,SAAS,QAAQ,GAAG,OAAO;CAC9C,IAAI,mBAAmB,MAAM,SAAS,OAAO,QAAQ,SAAS,IAAI,CAAC,GAClE,OAAO;CAER,OAAO,iBAAiB,QAAQ,aAAa;AAC9C"}

package/dist/instrumentation/trust.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"trust.d.cts","names":[],"sources":["../../src/instrumentation/trust.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAwDgB,gBACf,4BACA;;;;;;wBAee,iBAAiB;;iBAqBhB;;EAEhB,SAAS,UAAU;;EAEnB;;;;;;;;wBAqBe,iBAAiB,SAAS"}
+{"version":3,"file":"trust.d.cts","names":[],"sources":["../../src/instrumentation/trust.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA8DgB,gBACf,4BACA;;;;;;wBAee,iBAAiB;;iBAqBhB;;EAEhB,SAAS,UAAU;;EAEnB;;;;;;;;wBAqBe,iBAAiB,SAAS"}

package/dist/instrumentation/trust.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"trust.d.mts","names":[],"sources":["../../src/instrumentation/trust.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAwDgB,gBACf,4BACA;;;;;;wBAee,iBAAiB;;iBAqBhB;;EAEhB,SAAS,UAAU;;EAEnB;;;;;;;;wBAqBe,iBAAiB,SAAS"}
+{"version":3,"file":"trust.d.mts","names":[],"sources":["../../src/instrumentation/trust.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA8DgB,gBACf,4BACA;;;;;;wBAee,iBAAiB;;iBAqBhB;;EAEhB,SAAS,UAAU;;EAEnB;;;;;;;;wBAqBe,iBAAiB,SAAS"}

package/dist/instrumentation/trust.mjs

@@ -27,7 +27,13 @@
 * Whether a trusted context is *sampled* is still this API's decision: see
 * `traceSampler`, which caps an incoming sampled flag at the stage's rate.
 */
-/** Headers a reverse proxy or CDN adds on the way in. */
+/**
+* Headers a reverse proxy or CDN adds on the way in.
+*
+* Not `x-gkm-client-ip`: that is gkm's own, sent by a service calling another
+* on a client's behalf (an API's session check), and stripped by the stack's
+* edge from everything that arrives from outside.
+*/
 const FORWARDING_HEADERS = [
 	"forwarded",
 	"x-forwarded-for",

package/dist/instrumentation/trust.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"trust.mjs","names":[],"sources":["../../src/instrumentation/trust.ts"],"sourcesContent":["/**\n * Whose `traceparent` an API continues.\n *\n * An incoming trace context is a claim made by the caller. Continued, it puts\n * this request's span inside whatever trace the caller named, and its sampled\n * flag asks this API to record it. From the API's own sites and from its own\n * services that is the point; from anyone else it lets a stranger graft spans\n * onto another user's trace, or force traces the stage's rate would not keep.\n *\n * So a request's context is continued only when it comes from a trusted source:\n *\n * - **its own sites** — an `Origin` header naming one of the API's allowed CORS\n *   origins (the sites with an edge to it). A browser sets `Origin` itself on\n *   every cross-origin request and a page cannot forge it;\n * - **an internal caller** — no `Origin` at all, no header any reverse proxy\n *   adds (`X-Forwarded-For`, `Forwarded`, `X-Real-IP`, …), and a TCP peer on a\n *   loopback or private address. That is another service calling this one\n *   over the private network by its internal URL: a request from the internet\n *   reaches the API through the stack's proxy, which always adds a forwarding\n *   header, or from a public address.\n *\n * Anything else — an unknown origin, a request through the public proxy with\n * no origin (curl, a server elsewhere) — starts a new trace, linked to the\n * context it claimed so the hop can still be followed.\n *\n * Whether a trusted context is *sampled* is still this API's decision: see\n * `traceSampler`, which caps an incoming sampled flag at the stage's rate.\n */\n\n/** Headers a reverse proxy or CDN adds on the way in. */\nconst FORWARDING_HEADERS = [\n\t'forwarded',\n\t'x-forwarded-for',\n\t'x-forwarded-host',\n\t'x-real-ip',\n\t'cf-connecting-ip',\n\t'true-client-ip',\n\t'fastly-client-ip',\n\t'x-client-ip',\n];\n\n/** `origin` normalized the way a browser sends it, or undefined. */\nfunction normalizeOrigin(origin: string): string | undefined {\n\ttry {\n\t\tconst url = new URL(origin);\n\t\treturn url.origin === 'null' ? undefined : url.origin;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\n/**\n * Whether `origin` is one of `trustedOrigins` — exactly, scheme, host and\n * port. A wildcard trusts nothing: an API that answers any origin's CORS has\n * not said which sites are its own.\n */\nexport function isTrustedOrigin(\n\torigin: string | undefined,\n\ttrustedOrigins: readonly string[] | undefined,\n): boolean {\n\tif (!origin || !trustedOrigins?.length) return false;\n\tconst normalized = normalizeOrigin(origin);\n\tif (!normalized) return false;\n\treturn trustedOrigins.some(\n\t\t(trusted) => trusted !== '*' && normalizeOrigin(trusted) === normalized,\n\t);\n}\n\n/**\n * Whether `address` is loopback or private: 127/8, 10/8, 172.16/12,\n * 192.168/16, 169.254/16, `::1`, `fc00::/7`, `fe80::/10`, and an IPv4 one\n * mapped into IPv6.\n */\nexport function isPrivateAddress(address: string | undefined): boolean {\n\tif (!address) return false;\n\tconst ip = address.toLowerCase().replace(/^::ffff:/, '');\n\n\tconst v4 = ip.match(/^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/);\n\tif (v4) {\n\t\tconst [a, b] = [Number(v4[1]), Number(v4[2])];\n\t\treturn (\n\t\t\ta === 127 ||\n\t\t\ta === 10 ||\n\t\t\t(a === 172 && b >= 16 && b <= 31) ||\n\t\t\t(a === 192 && b === 168) ||\n\t\t\t(a === 169 && b === 254)\n\t\t);\n\t}\n\n\tif (ip === '::1') return true;\n\treturn /^f[cd][0-9a-f]{2}:/.test(ip) || /^fe[89ab][0-9a-f]:/.test(ip);\n}\n\n/** What the internal-caller rule looks at. */\nexport interface IncomingRequestFacts {\n\t/** Every request header. */\n\theaders: Headers | Record<string, string | string[] | undefined>;\n\t/** The TCP peer's address, when the server knows it. */\n\tremoteAddress?: string;\n}\n\nfunction header(\n\theaders: IncomingRequestFacts['headers'],\n\tname: string,\n): string | undefined {\n\tif (headers instanceof Headers) return headers.get(name) ?? undefined;\n\tfor (const [key, value] of Object.entries(headers)) {\n\t\tif (key.toLowerCase() !== name) continue;\n\t\treturn Array.isArray(value) ? value[0] : value;\n\t}\n\treturn undefined;\n}\n\n/**\n * Whether a request is an internal caller's: no `Origin`, no forwarding\n * header, and a loopback or private peer. Without a peer address — a request\n * handed to the app in-process, a runtime that does not expose the socket —\n * it is not.\n */\nexport function isInternalCaller(request: IncomingRequestFacts): boolean {\n\tif (header(request.headers, 'origin')) return false;\n\tif (FORWARDING_HEADERS.some((name) => header(request.headers, name))) {\n\t\treturn false;\n\t}\n\treturn isPrivateAddress(request.remoteAddress);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,MAAM,qBAAqB;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD;;AAGA,SAAS,gBAAgB,QAAoC;CAC5D,IAAI;EACH,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,OAAO,IAAI,WAAW,SAAS,KAAA,IAAY,IAAI;CAChD,QAAQ;EACP;CACD;AACD;;;;;;AAOA,SAAgB,gBACf,QACA,gBACU;CACV,IAAI,CAAC,UAAU,CAAC,gBAAgB,QAAQ,OAAO;CAC/C,MAAM,aAAa,gBAAgB,MAAM;CACzC,IAAI,CAAC,YAAY,OAAO;CACxB,OAAO,eAAe,MACpB,YAAY,YAAY,OAAO,gBAAgB,OAAO,MAAM,UAC9D;AACD;;;;;;AAOA,SAAgB,iBAAiB,SAAsC;CACtE,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,KAAK,QAAQ,YAAY,CAAC,CAAC,QAAQ,YAAY,EAAE;CAEvD,MAAM,KAAK,GAAG,MAAM,8CAA8C;CAClE,IAAI,IAAI;EACP,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,GAAG,EAAE,CAAC;EAC5C,OACC,MAAM,OACN,MAAM,MACL,MAAM,OAAO,KAAK,MAAM,KAAK,MAC7B,MAAM,OAAO,MAAM,OACnB,MAAM,OAAO,MAAM;CAEtB;CAEA,IAAI,OAAO,OAAO,OAAO;CACzB,OAAO,qBAAqB,KAAK,EAAE,KAAK,qBAAqB,KAAK,EAAE;AACrE;AAUA,SAAS,OACR,SACA,MACqB;CACrB,IAAI,mBAAmB,SAAS,OAAO,QAAQ,IAAI,IAAI,KAAK,KAAA;CAC5D,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG;EACnD,IAAI,IAAI,YAAY,MAAM,MAAM;EAChC,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK;CAC1C;AAED;;;;;;;AAQA,SAAgB,iBAAiB,SAAwC;CACxE,IAAI,OAAO,QAAQ,SAAS,QAAQ,GAAG,OAAO;CAC9C,IAAI,mBAAmB,MAAM,SAAS,OAAO,QAAQ,SAAS,IAAI,CAAC,GAClE,OAAO;CAER,OAAO,iBAAiB,QAAQ,aAAa;AAC9C"}
+{"version":3,"file":"trust.mjs","names":[],"sources":["../../src/instrumentation/trust.ts"],"sourcesContent":["/**\n * Whose `traceparent` an API continues.\n *\n * An incoming trace context is a claim made by the caller. Continued, it puts\n * this request's span inside whatever trace the caller named, and its sampled\n * flag asks this API to record it. From the API's own sites and from its own\n * services that is the point; from anyone else it lets a stranger graft spans\n * onto another user's trace, or force traces the stage's rate would not keep.\n *\n * So a request's context is continued only when it comes from a trusted source:\n *\n * - **its own sites** — an `Origin` header naming one of the API's allowed CORS\n *   origins (the sites with an edge to it). A browser sets `Origin` itself on\n *   every cross-origin request and a page cannot forge it;\n * - **an internal caller** — no `Origin` at all, no header any reverse proxy\n *   adds (`X-Forwarded-For`, `Forwarded`, `X-Real-IP`, …), and a TCP peer on a\n *   loopback or private address. That is another service calling this one\n *   over the private network by its internal URL: a request from the internet\n *   reaches the API through the stack's proxy, which always adds a forwarding\n *   header, or from a public address.\n *\n * Anything else — an unknown origin, a request through the public proxy with\n * no origin (curl, a server elsewhere) — starts a new trace, linked to the\n * context it claimed so the hop can still be followed.\n *\n * Whether a trusted context is *sampled* is still this API's decision: see\n * `traceSampler`, which caps an incoming sampled flag at the stage's rate.\n */\n\n/**\n * Headers a reverse proxy or CDN adds on the way in.\n *\n * Not `x-gkm-client-ip`: that is gkm's own, sent by a service calling another\n * on a client's behalf (an API's session check), and stripped by the stack's\n * edge from everything that arrives from outside.\n */\nconst FORWARDING_HEADERS = [\n\t'forwarded',\n\t'x-forwarded-for',\n\t'x-forwarded-host',\n\t'x-real-ip',\n\t'cf-connecting-ip',\n\t'true-client-ip',\n\t'fastly-client-ip',\n\t'x-client-ip',\n];\n\n/** `origin` normalized the way a browser sends it, or undefined. */\nfunction normalizeOrigin(origin: string): string | undefined {\n\ttry {\n\t\tconst url = new URL(origin);\n\t\treturn url.origin === 'null' ? undefined : url.origin;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\n/**\n * Whether `origin` is one of `trustedOrigins` — exactly, scheme, host and\n * port. A wildcard trusts nothing: an API that answers any origin's CORS has\n * not said which sites are its own.\n */\nexport function isTrustedOrigin(\n\torigin: string | undefined,\n\ttrustedOrigins: readonly string[] | undefined,\n): boolean {\n\tif (!origin || !trustedOrigins?.length) return false;\n\tconst normalized = normalizeOrigin(origin);\n\tif (!normalized) return false;\n\treturn trustedOrigins.some(\n\t\t(trusted) => trusted !== '*' && normalizeOrigin(trusted) === normalized,\n\t);\n}\n\n/**\n * Whether `address` is loopback or private: 127/8, 10/8, 172.16/12,\n * 192.168/16, 169.254/16, `::1`, `fc00::/7`, `fe80::/10`, and an IPv4 one\n * mapped into IPv6.\n */\nexport function isPrivateAddress(address: string | undefined): boolean {\n\tif (!address) return false;\n\tconst ip = address.toLowerCase().replace(/^::ffff:/, '');\n\n\tconst v4 = ip.match(/^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/);\n\tif (v4) {\n\t\tconst [a, b] = [Number(v4[1]), Number(v4[2])];\n\t\treturn (\n\t\t\ta === 127 ||\n\t\t\ta === 10 ||\n\t\t\t(a === 172 && b >= 16 && b <= 31) ||\n\t\t\t(a === 192 && b === 168) ||\n\t\t\t(a === 169 && b === 254)\n\t\t);\n\t}\n\n\tif (ip === '::1') return true;\n\treturn /^f[cd][0-9a-f]{2}:/.test(ip) || /^fe[89ab][0-9a-f]:/.test(ip);\n}\n\n/** What the internal-caller rule looks at. */\nexport interface IncomingRequestFacts {\n\t/** Every request header. */\n\theaders: Headers | Record<string, string | string[] | undefined>;\n\t/** The TCP peer's address, when the server knows it. */\n\tremoteAddress?: string;\n}\n\nfunction header(\n\theaders: IncomingRequestFacts['headers'],\n\tname: string,\n): string | undefined {\n\tif (headers instanceof Headers) return headers.get(name) ?? undefined;\n\tfor (const [key, value] of Object.entries(headers)) {\n\t\tif (key.toLowerCase() !== name) continue;\n\t\treturn Array.isArray(value) ? value[0] : value;\n\t}\n\treturn undefined;\n}\n\n/**\n * Whether a request is an internal caller's: no `Origin`, no forwarding\n * header, and a loopback or private peer. Without a peer address — a request\n * handed to the app in-process, a runtime that does not expose the socket —\n * it is not.\n */\nexport function isInternalCaller(request: IncomingRequestFacts): boolean {\n\tif (header(request.headers, 'origin')) return false;\n\tif (FORWARDING_HEADERS.some((name) => header(request.headers, name))) {\n\t\treturn false;\n\t}\n\treturn isPrivateAddress(request.remoteAddress);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,MAAM,qBAAqB;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD;;AAGA,SAAS,gBAAgB,QAAoC;CAC5D,IAAI;EACH,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,OAAO,IAAI,WAAW,SAAS,KAAA,IAAY,IAAI;CAChD,QAAQ;EACP;CACD;AACD;;;;;;AAOA,SAAgB,gBACf,QACA,gBACU;CACV,IAAI,CAAC,UAAU,CAAC,gBAAgB,QAAQ,OAAO;CAC/C,MAAM,aAAa,gBAAgB,MAAM;CACzC,IAAI,CAAC,YAAY,OAAO;CACxB,OAAO,eAAe,MACpB,YAAY,YAAY,OAAO,gBAAgB,OAAO,MAAM,UAC9D;AACD;;;;;;AAOA,SAAgB,iBAAiB,SAAsC;CACtE,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,KAAK,QAAQ,YAAY,CAAC,CAAC,QAAQ,YAAY,EAAE;CAEvD,MAAM,KAAK,GAAG,MAAM,8CAA8C;CAClE,IAAI,IAAI;EACP,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,GAAG,EAAE,CAAC;EAC5C,OACC,MAAM,OACN,MAAM,MACL,MAAM,OAAO,KAAK,MAAM,KAAK,MAC7B,MAAM,OAAO,MAAM,OACnB,MAAM,OAAO,MAAM;CAEtB;CAEA,IAAI,OAAO,OAAO,OAAO;CACzB,OAAO,qBAAqB,KAAK,EAAE,KAAK,qBAAqB,KAAK,EAAE;AACrE;AAUA,SAAS,OACR,SACA,MACqB;CACrB,IAAI,mBAAmB,SAAS,OAAO,QAAQ,IAAI,IAAI,KAAK,KAAA;CAC5D,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG;EACnD,IAAI,IAAI,YAAY,MAAM,MAAM;EAChC,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK;CAC1C;AAED;;;;;;;AAQA,SAAgB,iBAAiB,SAAwC;CACxE,IAAI,OAAO,QAAQ,SAAS,QAAQ,GAAG,OAAO;CAC9C,IAAI,mBAAmB,MAAM,SAAS,OAAO,QAAQ,SAAS,IAAI,CAAC,GAClE,OAAO;CAER,OAAO,iBAAiB,QAAQ,aAAa;AAC9C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geekmidas/telescope",
-  "version": "10.0.0-alpha.84",
+  "version": "10.0.0-alpha.86",
   "description": "Laravel Telescope-style request, exception and log recording for web applications, exposed as a JSON API",
   "type": "module",
   "exports": {
@@ -159,7 +159,7 @@
   "dependencies": {
     "@pinojs/redact": "~0.4.0",
     "nanoid": "~6.0.1",
-    "@geekmidas/logger": "^10.0.0-alpha.84"
+    "@geekmidas/logger": "^10.0.0-alpha.86"
   },
   "peerDependencies": {
     "@middy/core": ">=7.9.2",
@@ -251,7 +251,7 @@
     "pg": "~8.23.0",
     "pino": "~10.3.1",
     "pino-abstract-transport": "~3.0.0",
-    "@geekmidas/logger": "^10.0.0-alpha.84"
+    "@geekmidas/logger": "^10.0.0-alpha.86"
   },
   "scripts": {
     "build": "tsdown --config ../../tsdown.config.ts --filter ."