@jango-blockchained/hoox-shared 1.0.9 → 1.1.0

package/dist/schemas/validators.js

@@ -0,0 +1,290 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/schemas/validators.ts
+import { parse } from "jsonc-parser";
+function validateWranglerJsonc(workerName, manifest, jsoncContent) {
+  const errors = [];
+  let parsed;
+  try {
+    parsed = parse(jsoncContent);
+  } catch {
+    errors.push({
+      worker: workerName,
+      severity: "error",
+      message: "Failed to parse wrangler.jsonc",
+      file: "wrangler.jsonc"
+    });
+    return errors;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    errors.push({
+      worker: workerName,
+      severity: "error",
+      message: "Failed to parse wrangler.jsonc \u2014 result is not a valid object",
+      file: "wrangler.jsonc"
+    });
+    return errors;
+  }
+  const wrangler = parsed;
+  const declaredVars = wrangler.vars ?? {};
+  for (const [name, def] of Object.entries(manifest.vars)) {
+    if (!(name in declaredVars)) {
+      errors.push({
+        worker: workerName,
+        severity: "error",
+        message: `Missing var: ${name} (${def.description})`,
+        file: "wrangler.jsonc"
+      });
+    }
+  }
+  for (const [name, def] of Object.entries(manifest.vars)) {
+    if (def.type === "secret" && !name.endsWith("_BINDING") && !name.endsWith("_SECRET") && !name.startsWith("CLOUDFLARE_") && name !== "TELEGRAM_SECRET_TOKEN" && name !== "MAILGUN_API_KEY" && name !== "EMAIL_SCAN_SUBJECT" && name !== "DASHBOARD_USER" && name !== "DASHBOARD_PASS" && name !== "SESSION_SECRET" && name !== "AGENT_INTERNAL_KEY") {
+      errors.push({
+        worker: workerName,
+        severity: "warning",
+        message: `Secret var "${name}" does not end with _BINDING or _SECRET suffix`,
+        file: "wrangler.jsonc"
+      });
+    }
+  }
+  const declaredServices = wrangler.services ?? [];
+  for (const expected of manifest.services) {
+    const match = declaredServices.find((s) => s.binding === expected.binding && s.service === expected.service);
+    if (!match) {
+      const declared = declaredServices.find((s) => s.binding === expected.binding);
+      if (declared) {
+        errors.push({
+          worker: workerName,
+          severity: "error",
+          message: `Service "${expected.binding}" points to "${declared.service}" but manifest expects "${expected.service}"`,
+          file: "wrangler.jsonc"
+        });
+      } else {
+        errors.push({
+          worker: workerName,
+          severity: "error",
+          message: `Missing service binding: ${expected.binding} -> ${expected.service}`,
+          file: "wrangler.jsonc"
+        });
+      }
+    }
+  }
+  for (const declared of declaredServices) {
+    const expected = manifest.services.find((s) => s.binding === declared.binding);
+    if (!expected) {
+      errors.push({
+        worker: workerName,
+        severity: "warning",
+        message: `Unexpected service binding: ${declared.binding}`,
+        file: "wrangler.jsonc"
+      });
+    }
+  }
+  return errors;
+}
+function validateRootSecrets(workerName, manifest, rootJsoncContent) {
+  const errors = [];
+  let parsed;
+  try {
+    parsed = parse(rootJsoncContent);
+  } catch {
+    errors.push({
+      worker: workerName,
+      severity: "error",
+      message: "Failed to parse root wrangler.jsonc"
+    });
+    return errors;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    errors.push({
+      worker: workerName,
+      severity: "error",
+      message: "Failed to parse root wrangler.jsonc \u2014 result is not a valid object"
+    });
+    return errors;
+  }
+  const rootWrangler = parsed;
+  const rootSecrets = rootWrangler.workers?.[workerName]?.secrets ?? [];
+  const expectedSecrets = Object.entries(manifest.vars).filter(([_, def]) => def.type === "secret").map(([name]) => name);
+  for (const expected of expectedSecrets) {
+    if (!rootSecrets.includes(expected)) {
+      errors.push({
+        worker: workerName,
+        severity: "error",
+        message: `Secret "${expected}" missing from root wrangler.jsonc workers.${workerName}.secrets`,
+        file: "wrangler.jsonc (root)"
+      });
+    }
+  }
+  return errors;
+}
+function validateDevVars(workerName, manifest, devVarsContent) {
+  const errors = [];
+  const vars = new Map;
+  for (const line of devVarsContent.split(`
+`)) {
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#"))
+      continue;
+    const eqIdx = trimmed.indexOf("=");
+    if (eqIdx < 1)
+      continue;
+    vars.set(trimmed.substring(0, eqIdx).trim(), trimmed.substring(eqIdx + 1).trim());
+  }
+  for (const [name, def] of Object.entries(manifest.vars)) {
+    if (def.type !== "secret")
+      continue;
+    if (!vars.has(name)) {
+      errors.push({
+        worker: workerName,
+        severity: "error",
+        message: `Missing "${name}" in .dev.vars`,
+        file: ".dev.vars"
+      });
+    }
+  }
+  return errors;
+}
+function generateWranglerJsonc(manifest) {
+  const parts = [];
+  parts.push(`{`);
+  parts.push(`  "name": "${manifest.name}",`);
+  parts.push(`  "main": "src/index.ts",`);
+  const varKeys = Object.keys(manifest.vars);
+  if (varKeys.length > 0) {
+    parts.push(`  "vars": {`);
+    for (const [i, name] of varKeys.entries()) {
+      const def = manifest.vars[name];
+      const comma = i < varKeys.length - 1 ? "," : "";
+      const val = def.type === "secret" ? "__SECRET__" : JSON.stringify(def.default ?? "");
+      parts.push(`    "${name}": ${val}${comma}`);
+    }
+    parts.push(`  },`);
+  }
+  if (manifest.services.length > 0) {
+    parts.push(`  "services": [`);
+    for (const [i, svc] of manifest.services.entries()) {
+      const comma = i < manifest.services.length - 1 ? "," : "";
+      parts.push(`    { "binding": "${svc.binding}", "service": "${svc.service}" }${comma}`);
+    }
+    parts.push(`  ],`);
+  }
+  const infra = manifest.infrastructure;
+  if (infra.kv && infra.kv.length > 0) {
+    parts.push(`  "kv_namespaces": [`);
+    for (const [i, binding] of infra.kv.entries()) {
+      const comma = i < infra.kv.length - 1 ? "," : "";
+      parts.push(`    { "binding": "${binding.binding}", "id": "" }${comma}`);
+    }
+    parts.push(`  ],`);
+  }
+  if (infra.d1 && infra.d1.length > 0) {
+    parts.push(`  "d1_databases": [`);
+    for (const [i, binding] of infra.d1.entries()) {
+      const comma = i < infra.d1.length - 1 ? "," : "";
+      parts.push(`    { "binding": "${binding.binding}", "database_name": "${binding.database}", "database_id": "" }${comma}`);
+    }
+    parts.push(`  ],`);
+  }
+  if (infra.r2 && infra.r2.length > 0) {
+    parts.push(`  "r2_buckets": [`);
+    for (const [i, binding] of infra.r2.entries()) {
+      const comma = i < infra.r2.length - 1 ? "," : "";
+      parts.push(`    { "binding": "${binding.binding}", "bucket_name": "${binding.bucket}" }${comma}`);
+    }
+    parts.push(`  ],`);
+  }
+  if (infra.ai) {
+    parts.push(`  "ai": { "binding": "AI" },`);
+  }
+  if (infra.analyticsEngine) {
+    parts.push(`  "analytics_engine_datasets": [{ "binding": "ANALYTICS_ENGINE", "dataset": "hoox-analytics" }],`);
+  }
+  if (infra.vectorize && infra.vectorize.length > 0) {
+    parts.push(`  "vectorize": [`);
+    for (const [i, binding] of infra.vectorize.entries()) {
+      const comma = i < infra.vectorize.length - 1 ? "," : "";
+      parts.push(`    { "binding": "${binding.binding}", "index_name": "${binding.index}" }${comma}`);
+    }
+    parts.push(`  ],`);
+  }
+  if (infra.queues) {
+    if (infra.queues.producer && infra.queues.producer.length > 0) {
+      parts.push(`  "queues": { "producers": [`);
+      for (const [i, q] of infra.queues.producer.entries()) {
+        const comma = i < infra.queues.producer.length - 1 ? "," : "";
+        parts.push(`    { "queue": "${q}", "binding": "" }${comma}`);
+      }
+      parts.push(`  ] },`);
+    }
+    if (infra.queues.consumer && infra.queues.consumer.length > 0) {
+      parts.push(`  "queues": { "consumers": [`);
+      for (const [i, q] of infra.queues.consumer.entries()) {
+        const comma = i < infra.queues.consumer.length - 1 ? "," : "";
+        parts.push(`    { "queue": "${q}" }${comma}`);
+      }
+      parts.push(`  ] },`);
+    }
+  }
+  if (infra.durableObjects && infra.durableObjects.length > 0) {
+    parts.push(`  "durable_objects": { "bindings": [`);
+    for (const [i, doBinding] of infra.durableObjects.entries()) {
+      const comma = i < infra.durableObjects.length - 1 ? "," : "";
+      parts.push(`    { "name": "${doBinding.name}", "class_name": "${doBinding.className}" }${comma}`);
+    }
+    parts.push(`  ] },`);
+  }
+  parts.push(`}`);
+  return parts.join(`
+`) + `
+`;
+}
+function generateDevVars(manifest) {
+  const lines = [];
+  lines.push(`# ${manifest.name} \u2014 Environment Variables`);
+  lines.push(`# Auto-generated from worker manifest schema`);
+  lines.push(``);
+  for (const [name, def] of Object.entries(manifest.vars)) {
+    if (def.type === "secret") {
+      lines.push(`${name}=placeholder_${name.toLowerCase()}`);
+    }
+  }
+  lines.push(``);
+  return lines.join(`
+`);
+}
+function validateAll(workerName, manifest, files) {
+  const errors = [
+    ...validateWranglerJsonc(workerName, manifest, files.wranglerJsonc),
+    ...validateRootSecrets(workerName, manifest, files.rootWranglerJsonc),
+    ...validateDevVars(workerName, manifest, files.devVars)
+  ];
+  return {
+    worker: workerName,
+    passed: errors.filter((e) => e.severity === "error").length === 0,
+    errors
+  };
+}
+export {
+  validateWranglerJsonc,
+  validateRootSecrets,
+  validateDevVars,
+  validateAll,
+  generateWranglerJsonc,
+  generateDevVars
+};

package/dist/service-bindings.d.ts

@@ -1,6 +1,71 @@
+import type { InternalAuthKeyName } from "./middleware/auth";
 export interface ServiceBinding {
     fetch(request: Request | string, init?: RequestInit): Promise<Response>;
 }
+/** Env binding names for scoped internal auth keys. */
+export declare const InternalAuthKeyFields: {
+    readonly DEFAULT: "INTERNAL_KEY_BINDING";
+    readonly D1_READ: "D1_READ_KEY_BINDING";
+    readonly D1_WRITE: "D1_WRITE_KEY_BINDING";
+    readonly TRADE_EXECUTE: "TRADE_EXECUTE_KEY_BINDING";
+    readonly TRADE_READ: "TRADE_READ_KEY_BINDING";
+    readonly TELEGRAM_ALERT: "TELEGRAM_INTERNAL_KEY_BINDING";
+    readonly WALLET_EXECUTE: "WALLET_EXECUTE_KEY_BINDING";
+    readonly AGENT: "AGENT_INTERNAL_KEY";
+    /** Dashboard Pages secret aliases (legacy naming). */
+    readonly D1_INTERNAL_ALIAS: "D1_INTERNAL_KEY";
+    readonly TRADE_INTERNAL_ALIAS: "TRADE_INTERNAL_KEY";
+    readonly TELEGRAM_INTERNAL_ALIAS: "TELEGRAM_INTERNAL_KEY";
+};
+/** d1-worker read routes: prefer read-only key, fall back to legacy full key. */
+export declare const D1_READ_AUTH_KEY_FIELDS: readonly ["D1_READ_KEY_BINDING", "INTERNAL_KEY_BINDING"];
+/** d1-worker write/RPC routes: prefer write key, fall back to legacy full key. */
+export declare const D1_WRITE_AUTH_KEY_FIELDS: readonly ["D1_WRITE_KEY_BINDING", "INTERNAL_KEY_BINDING"];
+/** trade-worker execute routes (/webhook, /process, POST /api/signals). */
+export declare const TRADE_EXECUTE_AUTH_KEY_FIELDS: readonly ["TRADE_EXECUTE_KEY_BINDING", "INTERNAL_KEY_BINDING", "AGENT_INTERNAL_KEY"];
+/** trade-worker read routes (GET /api/signals, GET /report). */
+export declare const TRADE_READ_AUTH_KEY_FIELDS: readonly ["TRADE_READ_KEY_BINDING", "INTERNAL_KEY_BINDING"];
+/** telegram-worker /alert notification endpoint. */
+export declare const TELEGRAM_ALERT_AUTH_KEY_FIELDS: readonly ["TELEGRAM_INTERNAL_KEY_BINDING", "INTERNAL_KEY_BINDING"];
+/** web3-wallet-worker privileged routes. */
+export declare const WALLET_EXECUTE_AUTH_KEY_FIELDS: readonly ["WALLET_EXECUTE_KEY_BINDING", "INTERNAL_KEY_BINDING"];
+/** Dashboard → d1-worker read calls (includes Pages secret aliases). */
+export declare const DASHBOARD_D1_READ_AUTH_KEY_FIELDS: readonly ["D1_READ_KEY_BINDING", "D1_INTERNAL_KEY", "INTERNAL_KEY_BINDING"];
+/** Dashboard → trade-worker execute calls. */
+export declare const DASHBOARD_TRADE_EXECUTE_AUTH_KEY_FIELDS: readonly ["TRADE_EXECUTE_KEY_BINDING", "TRADE_INTERNAL_KEY", "INTERNAL_KEY_BINDING"];
+/** Dashboard → telegram-worker /alert calls. */
+export declare const DASHBOARD_TELEGRAM_ALERT_AUTH_KEY_FIELDS: readonly ["TELEGRAM_INTERNAL_KEY_BINDING", "TELEGRAM_INTERNAL_KEY", "INTERNAL_KEY_BINDING"];
+/** First configured key from an ordered fallback list. */
+export declare function resolveInternalAuthKey(env: object, keyFields: InternalAuthKeyName): string | undefined;
+export interface AuthenticatedServiceEnv {
+    INTERNAL_KEY_BINDING?: string;
+    D1_READ_KEY_BINDING?: string;
+    D1_WRITE_KEY_BINDING?: string;
+    TRADE_EXECUTE_KEY_BINDING?: string;
+    TRADE_READ_KEY_BINDING?: string;
+    TELEGRAM_INTERNAL_KEY_BINDING?: string;
+    WALLET_EXECUTE_KEY_BINDING?: string;
+    AGENT_INTERNAL_KEY?: string;
+    D1_INTERNAL_KEY?: string;
+    TRADE_INTERNAL_KEY?: string;
+    TELEGRAM_INTERNAL_KEY?: string;
+}
+export declare class ServiceAuthError extends Error {
+    constructor(message: string);
+}
+/**
+ * serviceFetch with fail-closed internal auth.
+ * Injects X-Internal-Auth-Key from env.INTERNAL_KEY_BINDING.
+ */
+export declare function authenticatedServiceFetch<E extends AuthenticatedServiceEnv>(binding: ServiceBinding, env: E, path: string, body?: unknown, options?: {
+    method?: string;
+    headers?: Record<string, string>;
+    timeout?: number;
+    /** Override env key (e.g. TELEGRAM_INTERNAL_KEY_BINDING, AGENT_INTERNAL_KEY) */
+    internalKey?: string;
+    /** Ordered env fields to try when internalKey is not set */
+    internalKeyFields?: InternalAuthKeyName;
+}): Promise<Response>;
 export declare function serviceFetch(binding: ServiceBinding, path: string, body?: unknown, options?: {
     method?: string;
     headers?: Record<string, string>;

package/dist/service-bindings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-bindings.d.ts","sourceRoot":"","sources":["../src/service-bindings.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACzE;AAED,wBAAgB,YAAY,CAC1B,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;IACR,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC,QAAQ,CAAC,CAWnB"}
+{"version":3,"file":"service-bindings.d.ts","sourceRoot":"","sources":["../src/service-bindings.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmB,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE9E,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACzE;AAED,uDAAuD;AACvD,eAAO,MAAM,qBAAqB;;;;;;;;;IAShC,sDAAsD;;;;CAI9C,CAAC;AAEX,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,0DAG1B,CAAC;AAEX,kFAAkF;AAClF,eAAO,MAAM,wBAAwB,2DAG3B,CAAC;AAEX,2EAA2E;AAC3E,eAAO,MAAM,6BAA6B,sFAIhC,CAAC;AAEX,gEAAgE;AAChE,eAAO,MAAM,0BAA0B,6DAG7B,CAAC;AAEX,oDAAoD;AACpD,eAAO,MAAM,8BAA8B,oEAGjC,CAAC;AAEX,4CAA4C;AAC5C,eAAO,MAAM,8BAA8B,iEAGjC,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,iCAAiC,6EAIpC,CAAC;AAEX,8CAA8C;AAC9C,eAAO,MAAM,uCAAuC,sFAI1C,CAAC;AAEX,gDAAgD;AAChD,eAAO,MAAM,wCAAwC,6FAI3C,CAAC;AAEX,0DAA0D;AAC1D,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,mBAAmB,GAC7B,MAAM,GAAG,SAAS,CAEpB;AAED,MAAM,WAAW,uBAAuB;IACtC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,uBAAuB,EACzE,OAAO,EAAE,cAAc,EACvB,GAAG,EAAE,CAAC,EACN,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;IACR,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;CACzC,GACA,OAAO,CAAC,QAAQ,CAAC,CAsBnB;AAED,wBAAgB,YAAY,CAC1B,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;IACR,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC,QAAQ,CAAC,CAWnB"}

package/dist/service-bindings.js

@@ -15,7 +15,209 @@ var __export = (target, all) => {
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
+// src/middleware/auth.ts
+function timingSafeEqual(a, b) {
+  const encoder = new TextEncoder;
+  const aBuf = encoder.encode(a);
+  const bBuf = encoder.encode(b);
+  const len = Math.max(aBuf.length, bBuf.length);
+  let result = aBuf.length === bBuf.length ? 0 : 1;
+  for (let i = 0;i < len; i++) {
+    const av = i < aBuf.length ? aBuf[i] : 0;
+    const bv = i < bBuf.length ? bBuf[i] : 0;
+    result |= av ^ bv;
+  }
+  return result === 0;
+}
+function resolveOperatorApiKey(env) {
+  const preferred = env.OPERATOR_API_KEY;
+  if (typeof preferred === "string" && preferred.length > 0) {
+    return preferred;
+  }
+  const legacy = env.INTERNAL_API_KEY;
+  if (typeof legacy === "string" && legacy.length > 0) {
+    return legacy;
+  }
+  return;
+}
+async function requireAuth(request, env) {
+  return requireOperatorAuth(request, env);
+}
+async function requireOperatorAuth(request, env) {
+  const apiKey = resolveOperatorApiKey(env);
+  if (!apiKey) {
+    return new Response(JSON.stringify({
+      error: "Operator API key not configured",
+      hint: "Set OPERATOR_API_KEY (preferred) or INTERNAL_API_KEY on the Worker"
+    }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  const authHeader = request.headers.get("Authorization");
+  const expectedHeader = `Bearer ${apiKey}`;
+  if (!authHeader || !timingSafeEqual(authHeader, expectedHeader)) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  return null;
+}
+function createOperatorAuthMiddleware() {
+  return async (request, env, _ctx) => {
+    const denied = await requireOperatorAuth(request, env);
+    if (denied)
+      return denied;
+    return;
+  };
+}
+function normalizeKeyNames(keyName) {
+  if (typeof keyName === "string") {
+    return [keyName];
+  }
+  return [...keyName];
+}
+function collectInternalAuthKeys(env, keyNames) {
+  const keys = [];
+  for (const name of normalizeKeyNames(keyNames)) {
+    const value = env[name];
+    if (typeof value === "string" && value.length > 0) {
+      keys.push(value);
+    }
+  }
+  return keys;
+}
+function matchesAnyInternalAuthKey(providedKey, expectedKeys) {
+  for (const expected of expectedKeys) {
+    if (timingSafeEqual(providedKey, expected)) {
+      return true;
+    }
+  }
+  return false;
+}
+function internalAuthNotConfiguredResponse(keyNames) {
+  const label = normalizeKeyNames(keyNames).join(" | ");
+  return new Response(JSON.stringify({
+    success: false,
+    error: `Internal auth key(s) not configured: ${label}`
+  }), { status: 401, headers: { "Content-Type": "application/json" } });
+}
+function requireInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return internalAuthNotConfiguredResponse(keyName);
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  return null;
+}
+function createInternalAuthMiddleware(keyName = "INTERNAL_KEY_BINDING") {
+  return async (request, env, _ctx) => {
+    const expectedKeys = collectInternalAuthKeys(env, keyName);
+    if (expectedKeys.length === 0) {
+      return internalAuthNotConfiguredResponse(keyName);
+    }
+    const providedKey = request.headers.get("X-Internal-Auth-Key");
+    if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+      return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+    }
+    return;
+  };
+}
+function checkInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return {
+      authorized: false,
+      error: `${normalizeKeyNames(keyName).join(" | ")} not configured`
+    };
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return { authorized: false, error: "Unauthorized" };
+  }
+  return { authorized: true };
+}
+
 // src/service-bindings.ts
+var InternalAuthKeyFields = {
+  DEFAULT: "INTERNAL_KEY_BINDING",
+  D1_READ: "D1_READ_KEY_BINDING",
+  D1_WRITE: "D1_WRITE_KEY_BINDING",
+  TRADE_EXECUTE: "TRADE_EXECUTE_KEY_BINDING",
+  TRADE_READ: "TRADE_READ_KEY_BINDING",
+  TELEGRAM_ALERT: "TELEGRAM_INTERNAL_KEY_BINDING",
+  WALLET_EXECUTE: "WALLET_EXECUTE_KEY_BINDING",
+  AGENT: "AGENT_INTERNAL_KEY",
+  D1_INTERNAL_ALIAS: "D1_INTERNAL_KEY",
+  TRADE_INTERNAL_ALIAS: "TRADE_INTERNAL_KEY",
+  TELEGRAM_INTERNAL_ALIAS: "TELEGRAM_INTERNAL_KEY"
+};
+var D1_READ_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.D1_READ,
+  InternalAuthKeyFields.DEFAULT
+];
+var D1_WRITE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.D1_WRITE,
+  InternalAuthKeyFields.DEFAULT
+];
+var TRADE_EXECUTE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TRADE_EXECUTE,
+  InternalAuthKeyFields.DEFAULT,
+  InternalAuthKeyFields.AGENT
+];
+var TRADE_READ_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TRADE_READ,
+  InternalAuthKeyFields.DEFAULT
+];
+var TELEGRAM_ALERT_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TELEGRAM_ALERT,
+  InternalAuthKeyFields.DEFAULT
+];
+var WALLET_EXECUTE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.WALLET_EXECUTE,
+  InternalAuthKeyFields.DEFAULT
+];
+var DASHBOARD_D1_READ_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.D1_READ,
+  InternalAuthKeyFields.D1_INTERNAL_ALIAS,
+  InternalAuthKeyFields.DEFAULT
+];
+var DASHBOARD_TRADE_EXECUTE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TRADE_EXECUTE,
+  InternalAuthKeyFields.TRADE_INTERNAL_ALIAS,
+  InternalAuthKeyFields.DEFAULT
+];
+var DASHBOARD_TELEGRAM_ALERT_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TELEGRAM_ALERT,
+  InternalAuthKeyFields.TELEGRAM_INTERNAL_ALIAS,
+  InternalAuthKeyFields.DEFAULT
+];
+function resolveInternalAuthKey(env, keyFields) {
+  return collectInternalAuthKeys(env, keyFields)[0];
+}
+
+class ServiceAuthError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ServiceAuthError";
+  }
+}
+function authenticatedServiceFetch(binding, env, path, body, options) {
+  const key = options?.internalKey ?? (options?.internalKeyFields ? resolveInternalAuthKey(env, options.internalKeyFields) : env.INTERNAL_KEY_BINDING);
+  if (!key) {
+    const label = options?.internalKeyFields ? Array.isArray(options.internalKeyFields) ? options.internalKeyFields.join(" | ") : options.internalKeyFields : "INTERNAL_KEY_BINDING";
+    return Promise.reject(new ServiceAuthError(`${label} not configured`));
+  }
+  return serviceFetch(binding, path, body, {
+    method: options?.method,
+    timeout: options?.timeout,
+    headers: {
+      ...options?.headers,
+      "X-Internal-Auth-Key": key
+    }
+  });
+}
 function serviceFetch(binding, path, body, options) {
   const timeout = options?.timeout ?? 30000;
   return binding.fetch(`http://internal${path}`, {
@@ -29,5 +231,18 @@ function serviceFetch(binding, path, body, options) {
   });
 }
 export {
-  serviceFetch
+  serviceFetch,
+  resolveInternalAuthKey,
+  authenticatedServiceFetch,
+  WALLET_EXECUTE_AUTH_KEY_FIELDS,
+  TRADE_READ_AUTH_KEY_FIELDS,
+  TRADE_EXECUTE_AUTH_KEY_FIELDS,
+  TELEGRAM_ALERT_AUTH_KEY_FIELDS,
+  ServiceAuthError,
+  InternalAuthKeyFields,
+  DASHBOARD_TRADE_EXECUTE_AUTH_KEY_FIELDS,
+  DASHBOARD_TELEGRAM_ALERT_AUTH_KEY_FIELDS,
+  DASHBOARD_D1_READ_AUTH_KEY_FIELDS,
+  D1_WRITE_AUTH_KEY_FIELDS,
+  D1_READ_AUTH_KEY_FIELDS
 };

package/dist/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAItC,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,eAAe,EAAE,OAAO,CAAC;IACzB,+CAA+C;IAC/C,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;CACjB;AA2BD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,OAAO,EACxB,UAAU,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAC1C,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAkBf;AAID;;;;;GAKG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC,CA6B5D"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAKtC,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,eAAe,EAAE,OAAO,CAAC;IACzB,+CAA+C;IAC/C,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;CACjB;AA+CD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,OAAO,EACxB,UAAU,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAC1C,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAkBf;AAID;;;;;GAKG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC,CA8B5D"}