@lanes-sh/link 0.6.9 → 0.6.10

package/.gcloudignore

@@ -0,0 +1,50 @@
+# What `gcloud builds submit` uploads, and what it must not.
+#
+# **This file exists because `.dockerignore` is not consulted for the upload.**
+# The build context is packed and sent to a Cloud Build staging bucket before any
+# Dockerfile is read, so the first block of `.dockerignore` — which its own
+# comment calls "a security control, not an image-size optimisation" — governs
+# what reaches the *image* and says nothing about what reaches Google.
+#
+# Absent this file, gcloud derives its exclusions from `.gitignore` when the
+# context happens to be a git checkout, and from nothing at all when it is not.
+# `lanes link deploy` sends `installRoot`, which for the documented install
+# method is a directory under `~/.bun` with no `.git` in it — so the safe
+# behaviour was being inherited from a coincidence.
+#
+# Keep the first block in step with `.dockerignore`. `data/` holds the encrypted
+# credential store *and* the key that opens it.
+data/
+*.key
+*.pem
+*.enc
+*.p12
+.env
+.env.*
+
+# Not needed to build, and `.git` in particular carries every branch.
+.git/
+.gitignore
+.worktrees/
+node_modules/
+**/node_modules/
+coverage/
+dist/
+build/
+*.tsbuildinfo
+
+# Tests, docs and tooling: the image runs the endpoint and nothing else.
+**/*.test.ts
+**/*.test.json
+docs/
+instructions/
+**/README.md
+.lanes/
+.claude/
+.vscode/
+.idea/
+.DS_Store
+.playwright-mcp/
+
+# The compiled binary from `bun build --compile`, if one was made locally.
+/lanes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.6.9",
+  "version": "0.6.10",
   "description": "A self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets",
   "license": "Apache-2.0",
   "homepage": "https://lanes.sh/link",
@@ -44,13 +44,14 @@
     "README.md",
     "LICENSE",
     "bunfig.toml",
-    ".dockerignore"
+    ".dockerignore",
+    ".gcloudignore"
   ],
   "scripts": {
     "test": "bun test",
     "typecheck": "tsc --noEmit",
     "lanes": "bun run ./src/cli/lanes.ts",
-    "audit": "bun pm scan",
+    "audit": "bun audit",
     "vendor:bunq": "bun run ./src/providers/bunq/specs/vendor.ts",
     "vendor:discord": "bun run ./src/providers/discord/specs/vendor.ts",
     "vendor:google": "bun run ./src/providers/google/specs/vendor.ts"

package/src/auth/oidc.ts

@@ -108,8 +108,27 @@ export class OidcVerifier {
     return verified;
   }
 
-  async #endpoint(): Promise<string | null> {
-    if (this.#options.introspectionEndpoint) return this.#options.introspectionEndpoint;
+  /**
+   * Where to ask about a token, and whether the operator chose it.
+   *
+   * The second half decides one thing: whether the non-standard GET shape below
+   * is attempted at all. A discovered endpoint is one the issuer publishes as
+   * RFC 7662, and RFC 7662 is a form POST — so an issuer that answers discovery
+   * and then needs its token in a query string is not a case that exists. The
+   * shape is for issuers that ship an equivalent without advertising one, and
+   * those have to be named in config regardless.
+   */
+  async #endpoint(): Promise<{ url: string; explicit: boolean } | null> {
+    const named = this.#options.introspectionEndpoint;
+    if (named) {
+      if (!isHttps(named)) {
+        throw new Error(
+          `auth.authorization.introspection_endpoint is ${named}, which is not https. ` +
+            'A token is sent to it on every call.',
+        );
+      }
+      return { url: named, explicit: true };
+    }
 
     this.#discovered ??= this.#fetch(
       `${this.#options.issuer.replace(/\/$/, '')}/.well-known/openid-configuration`,
@@ -120,16 +139,33 @@ export class OidcVerifier {
 
     const metadata = await this.#discovered;
     const endpoint = metadata['introspection_endpoint'];
-    return typeof endpoint === 'string' ? endpoint : null;
+    if (typeof endpoint !== 'string') return null;
+
+    // **A discovery document decides where a credential is sent, so what it
+    // names is checked rather than followed.** The issuer is config and the
+    // operator chose it; the endpoint inside its metadata is a value fetched
+    // over the network, and until now anything there — any host, any scheme —
+    // received this endpoint's tokens. Same origin as the issuer is what a
+    // conforming document says anyway.
+    if (!isHttps(endpoint) || !sameOrigin(endpoint, this.#options.issuer)) return null;
+
+    return { url: endpoint, explicit: false };
   }
 
   /**
    * Two request shapes, because two are in the wild.
    *
    * RFC 7662 is a form POST of `token`. The other common spelling is a GET with
-   * the token in the query string, which several issuers ship instead. Trying
-   * the standard one first and the other on failure covers both without either
-   * being named in a conditional.
+   * the token in the query string, which several issuers ship instead — Google's
+   * `tokeninfo` among them, which is why the second shape exists at all.
+   *
+   * **The GET is attempted only for an endpoint the operator named.** A token in
+   * a query string is a credential in the issuer's access logs and in every
+   * proxy between here and it, which is a cost worth paying for the issuer whose
+   * documented setup requires it and worth paying for no other. A discovered
+   * endpoint publishes itself as RFC 7662 and RFC 7662 is the POST, so trying
+   * the query-string shape against one could only ever put a credential in a URL
+   * for an issuer that did not ask for it.
    */
   async #introspect(token: string): Promise<Introspection | null> {
     const endpoint = await this.#endpoint();
@@ -138,20 +174,21 @@ export class OidcVerifier {
       // audience would leave the confused-deputy hole open while looking like
       // it verified something.
       throw new Error(
-        `The issuer ${this.#options.issuer} publishes no introspection_endpoint. ` +
-          'Set auth.authorization.introspection_endpoint to the URL that answers ' +
-          'questions about a token, or this endpoint cannot check who a token was issued to.',
+        `The issuer ${this.#options.issuer} publishes no introspection_endpoint this endpoint ` +
+          'will use — it is absent, not https, or not on the issuer\'s own origin. Set ' +
+          'auth.authorization.introspection_endpoint to the URL that answers questions about a ' +
+          'token, or this endpoint cannot check who a token was issued to.',
       );
     }
 
-    const posted = await this.#ask(endpoint, {
+    const posted = await this.#ask(endpoint.url, {
       method: 'POST',
       headers: { 'content-type': 'application/x-www-form-urlencoded' },
       body: new URLSearchParams({ token }).toString(),
     });
-    if (posted) return posted;
+    if (posted || !endpoint.explicit) return posted;
 
-    const url = new URL(endpoint);
+    const url = new URL(endpoint.url);
     url.searchParams.set('access_token', token);
     return this.#ask(url.toString(), { method: 'GET' });
   }
@@ -167,6 +204,22 @@ export class OidcVerifier {
   }
 }
 
+function isHttps(candidate: string): boolean {
+  try {
+    return new URL(candidate).protocol === 'https:';
+  } catch {
+    return false;
+  }
+}
+
+function sameOrigin(candidate: string, issuer: string): boolean {
+  try {
+    return new URL(candidate).origin === new URL(issuer).origin;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * One shape out of several spellings of the same three facts.
  *

package/src/cli/brand.ts

@@ -160,6 +160,12 @@ a { color: inherit; }
  */
 export const PAGE_CSP =
   "frame-ancestors 'none'; default-src 'none'; " +
+  // `form-action` does **not** fall back to `default-src`, so `'none'` above
+  // says nothing about where a form may post. One page here posts the owner's
+  // endpoint token, and its `action` is built from the request's own `Host` —
+  // this is the second lock on that, so a form target that ever came from
+  // somewhere else is refused by the browser rather than followed.
+  "form-action 'self'; " +
   "style-src 'unsafe-inline' https://fonts.googleapis.com; " +
   'font-src https://fonts.gstatic.com';
 

package/src/deployments/gcp/Dockerfile

@@ -11,7 +11,21 @@
 # There is no build step: Bun runs TypeScript directly, so the image holds
 # source, and `bun install` only fetches the third-party dependencies.
 
-FROM oven/bun:1.3.11-slim
+# Pinned by digest, with the tag kept beside it so the next bump is legible.
+#
+# A tag is a pointer its publisher can move. `1.3.11-slim` is not a promise about
+# bytes — it resolves to whatever was last pushed under that name — so a rebuild
+# months from now can ship a base image nobody here reviewed, in a container that
+# holds live OAuth refresh tokens. The digest is the bytes.
+#
+# `bunfig.toml` already makes this argument about npm packages, with a seven-day
+# release-age floor; the base image is the larger half of the same supply chain
+# and had nothing.
+#
+# To bump: change the tag, then resolve it —
+#   docker buildx imagetools inspect oven/bun:<tag> --format '{{.Manifest.Digest}}'
+# The digest below is the multi-arch index, so it still resolves per architecture.
+FROM oven/bun:1.3.11-slim@sha256:478281fdd196871c7e51ba6a820b7803a8ae97042ec86cdbc2e1c6b6626442d9
 
 WORKDIR /app
 
@@ -42,7 +56,18 @@ COPY package.json bunfig.toml bun.lock* ./
 # in `package.json` is an exact version, so the direct set is identical either
 # way; the lockfile pins what those depend on in turn, and a published package
 # has never been able to carry one.
-RUN if [ -f bun.lock ]; then bun install --frozen-lockfile; else bun install; fi
+#
+# The fallback says so out loud. An unfrozen resolve is a real difference in what
+# ships and it used to be silent — the build log looked identical either way, so
+# "which transitive versions did this image get" was answerable only by opening
+# the image. One line makes it answerable from the build.
+RUN if [ -f bun.lock ]; then \
+      bun install --frozen-lockfile; \
+    else \
+      echo "no bun.lock in the build context: resolving transitive dependencies fresh." >&2; \
+      echo "Direct dependencies are exact in package.json, so the direct set is unchanged." >&2; \
+      bun install; \
+    fi
 
 COPY src/ src/
 

package/src/deployments/gcp/bucket.ts

@@ -1,4 +1,5 @@
-import { layout } from '#profile';
+import { join } from 'node:path';
+import { installRoot, layout } from '#profile';
 import type { DeployStep } from '../driver.ts';
 import {
   removalStep,
@@ -103,6 +104,68 @@ export function bucketGrants(bucket: string, profiles: readonly string[]): Condi
   ];
 }
 
+/**
+ * How long a deleted or overwritten object can still be recovered.
+ *
+ * The revision holds `objectAdmin` on everything under `data/`, and
+ * `objectAdmin` contains `storage.objects.delete`. That grant is correct — the
+ * endpoint writes state, memory, tasks, assets and the audit log, and rewriting
+ * an object is deleting the old one — but it means the process most exposed to
+ * the internet is also the one that can erase the record of what it did.
+ * `audit.tamper-evident` already says deleting a run whole is not *detectable*;
+ * without this it was not *recoverable* either.
+ *
+ * Thirty days rather than the platform's default seven, because the gap this
+ * closes is noticing late. A compromise found the same afternoon needs no
+ * retention policy at all.
+ */
+const SOFT_DELETE_DURATION = '30d';
+
+/**
+ * The three protections a deploy applies to the bucket every time it runs.
+ *
+ * `update` rather than flags on `create`, so they reach a bucket that already
+ * exists — see the call site. Idempotent: setting a policy to what it already is
+ * is a no-op that costs one API call.
+ *
+ * - **Public access prevention**, enforced. Nothing in this bucket is served to
+ *   a browser and nothing in it should ever be anonymous-readable, so the useful
+ *   setting is the one that makes granting that impossible rather than merely
+ *   absent. Uniform bucket-level access already removes per-object ACLs; this
+ *   removes the bucket-level way to do the same thing.
+ * - **Soft delete**, so a deletion is recoverable — see above.
+ * - **Object versioning**, with the lifecycle rule that bounds it. Versioning
+ *   covers what soft delete does not: an object *overwritten* in place, where
+ *   the previous content is the thing worth keeping. The rule is a file shipped
+ *   beside this one rather than written at plan time, because `--dry-run` writes
+ *   nothing and prints what it would run — a temporary file would break both.
+ */
+function durabilitySteps(bucket: string): DeployStep[] {
+  const lifecycle = join(installRoot(import.meta.dir), 'src/deployments/gcp/lifecycle.json');
+
+  return [
+    {
+      title: 'make the bucket unable to be shared publicly, and its deletions recoverable',
+      argv: [
+        'storage',
+        'buckets',
+        'update',
+        `gs://${bucket}`,
+        '--public-access-prevention',
+        '--soft-delete-duration',
+        SOFT_DELETE_DURATION,
+        '--versioning',
+        // Without this, versioning keeps every prior copy of every state key
+        // forever, and state is the one thing here that is rewritten rather than
+        // appended. The rule bounds it by age and by count.
+        '--lifecycle-file',
+        lifecycle,
+      ],
+      tolerateFailure: true,
+    },
+  ];
+}
+
 const TITLES: Record<string, string> = {
   'owns-its-data': 'let the revision write its own data, but not the manifests in it',
   'reads-its-config': 'let the revision read its config, and only read it',
@@ -133,20 +196,30 @@ export async function bucketSteps(input: {
         // served publicly; uniform access removes per-object ACLs as a way to
         // get that wrong.
         '--uniform-bucket-level-access',
-        // Autoclass rather than a lifecycle rule, because no one fixed class is
-        // right for this bucket: it holds the config the endpoint reads on every
-        // boot next to assets and audit rows nobody opens again. Inside an
-        // Autoclass bucket there are no retrieval and no early-deletion fees,
-        // which is what makes ARCHIVE safe as the floor rather than a bet on
-        // never reading the thing again — a read pulls the object back to
-        // Standard at no charge. Objects under 128 KiB never leave Standard, so
-        // this costs the config and the log nothing and saves on attachments.
+        // Autoclass rather than a storage-class lifecycle rule, because no one
+        // fixed class is right for this bucket: it holds the config the endpoint
+        // reads on every boot next to assets and audit rows nobody opens again.
+        // Inside an Autoclass bucket there are no retrieval and no
+        // early-deletion fees, which is what makes ARCHIVE safe as the floor
+        // rather than a bet on never reading the thing again — a read pulls the
+        // object back to Standard at no charge. Objects under 128 KiB never
+        // leave Standard, so this costs the config and the log nothing and saves
+        // on attachments.
         '--enable-autoclass',
         '--autoclass-terminal-storage-class',
         'ARCHIVE',
       ],
       tolerateFailure: true,
     },
+    // Everything about durability, applied separately from the create.
+    //
+    // **Not folded into the flags above, and that is the whole point.** Every
+    // step here tolerates failure, so the create is refused as `ALREADY_EXISTS`
+    // on the second deploy onwards — which means a protection added to that
+    // argv reaches a bucket made after this commit and no other. Every
+    // deployment that already exists is exactly the one that has an audit log
+    // worth keeping.
+    ...durabilitySteps(input.bucket),
   ];
 
   if (!input.serviceAccount) return steps;

package/src/deployments/gcp/driver.ts

@@ -126,12 +126,43 @@ export function deployPlan(input: PlanInput): DeployStep[] {
         // harness can mint one — so a target reached by a remote MCP client
         // declares `public` and gates the request in the application instead.
         cloudrun.access === 'iam' ? '--no-allow-unauthenticated' : '--allow-unauthenticated',
-        // Always passed, including the zero. Config is the source of truth here
-        // (ADR-004), and a flag sent only when non-zero would let a value be
-        // raised and never lowered — the revision would keep whatever the last
-        // deploy that bothered to mention it had set.
+        // What the platform will accept a connection from at all, which is a
+        // different question from who it lets through. An `iam` target is by
+        // definition not reached by an MCP client — no agent harness can mint the
+        // identity token Cloud Run wants — so it is reached by other cloud
+        // workloads or by nothing, and neither needs an internet-facing listener.
+        // `public` is the case where the listener *is* the point.
+        '--ingress',
+        cloudrun.access === 'iam' ? 'internal-and-cloud-load-balancing' : 'all',
+        // Always passed, including the zero and including every default below
+        // it. Config is the source of truth here (ADR-004), and a flag sent only
+        // when non-zero would let a value be raised and never lowered — the
+        // revision would keep whatever the last deploy that bothered to mention
+        // it had set.
         '--min-instances',
         String(cloudrun.min_instances),
+        // The five that used to be absent, and absent meant the platform's own
+        // defaults: a hundred instances, eighty concurrent requests each, and
+        // 512 MiB to serve a 64 MiB upload in. Each one is argued at its field in
+        // `deployTargetSchema`; what they have in common is that a public URL
+        // with no ceiling on any of them is an endpoint whose cost and whose
+        // credential-store traffic are decided by whoever is calling it.
+        '--max-instances',
+        String(cloudrun.max_instances),
+        '--concurrency',
+        String(cloudrun.concurrency),
+        '--timeout',
+        String(cloudrun.timeout_seconds),
+        '--memory',
+        cloudrun.memory,
+        '--cpu',
+        cloudrun.cpu,
+        // Named rather than inherited, like the five above. gen2 is the current
+        // default and the one this image is tested on; pinning it means a
+        // platform migration is a commit here rather than a change under a
+        // running endpoint.
+        '--execution-environment',
+        'gen2',
       ],
     },
   ];
@@ -151,7 +182,14 @@ export function deployPlan(input: PlanInput): DeployStep[] {
  */
 function secretMounts(secretEnv: PlanInput['secretEnv']): string[] {
   const entries = Object.entries(secretEnv ?? {});
-  if (entries.length === 0) return [];
+
+  // `--clear-secrets`, not nothing. `gcloud run deploy` leaves a setting it is
+  // not told about exactly as the last revision had it, so an empty map used to
+  // mean "keep whatever is mounted" rather than "mount nothing" — and removing a
+  // vault from config left its secret still resolved into the new revision's
+  // environment, indefinitely, with nothing in the config saying so. The same
+  // argument `--min-instances` makes about always passing the zero.
+  if (entries.length === 0) return ['--clear-secrets'];
 
   return [
     '--set-secrets',

package/src/deployments/gcp/lifecycle.json

@@ -0,0 +1,12 @@
+{
+  "rule": [
+    {
+      "action": { "type": "Delete" },
+      "condition": { "daysSinceNoncurrentTime": 30 }
+    },
+    {
+      "action": { "type": "Delete" },
+      "condition": { "numNewerVersions": 10 }
+    }
+  ]
+}

package/src/deployments/gcp/survey.ts

@@ -1,4 +1,4 @@
-import { ConfigError, type DeployConfig, type TargetConfig } from '#profile';
+import { ConfigError, DEPLOY_DEFAULTS, type DeployConfig, type TargetConfig } from '#profile';
 import { heading, print, style, waiting } from '#cli/output.ts';
 import { ask, confirm } from '#cli/prompt.ts';
 import type { SurveyInput, SurveyResult } from '../driver.ts';
@@ -130,6 +130,17 @@ export async function surveyCloudRun(input: SurveyInput): Promise<SurveyResult>
     // Not asked about. Zero is right for almost every target and the question
     // would cost every operator a decision to buy one of them a knob.
     min_instances: current.min_instances ?? 0,
+    // Not asked about either, and for a stronger version of the same reason: a
+    // ceiling is only interesting to somebody who has already hit it, and the
+    // defaults are the ones a single-user endpoint wants. Carried through from
+    // what the target already says so that an operator who *has* edited them
+    // keeps their edit — pressing return through the survey changes nothing,
+    // which is the property every other field here has too.
+    max_instances: current.max_instances ?? DEPLOY_DEFAULTS.max_instances,
+    concurrency: current.concurrency ?? DEPLOY_DEFAULTS.concurrency,
+    timeout_seconds: current.timeout_seconds ?? DEPLOY_DEFAULTS.timeout_seconds,
+    memory: current.memory ?? DEPLOY_DEFAULTS.memory,
+    cpu: current.cpu ?? DEPLOY_DEFAULTS.cpu,
     project,
     region,
     service,

package/src/policy/limits.ts

@@ -27,6 +27,29 @@ interface Bucket {
   lastRefill: number;
 }
 
+/**
+ * How many keys one limiter will hold.
+ *
+ * The bound exists because a key is not always something the endpoint chose. At
+ * the HTTP edge a caller is identified by the first `X-Forwarded-For` hop, which
+ * on a public deployment is a header a stranger writes — so an unbounded map is
+ * an unbounded allocation driven from outside, in a container that now has an
+ * explicit memory limit to exceed.
+ *
+ * Ten thousand is far above any real caller count for a single-user endpoint and
+ * far below a problem: a bucket is two numbers and a string key.
+ */
+const DEFAULT_MAX_KEYS = 10_000;
+
+/**
+ * How many go at once when the cap is reached.
+ *
+ * A batch rather than one, so the sort that finds them is amortised. Evicting a
+ * single key per overflow would run an O(n log n) pass on every request once the
+ * map is full, which turns the bound into its own denial of service.
+ */
+const EVICTION_FRACTION = 10;
+
 /**
  * Token bucket, refilled continuously rather than on a fixed window boundary.
  *
@@ -37,9 +60,16 @@ interface Bucket {
 export class RateLimiter {
   readonly #buckets = new Map<string, Bucket>();
   readonly #now: () => number;
+  readonly #maxKeys: number;
 
-  constructor(now: () => number = Date.now) {
+  constructor(now: () => number = Date.now, maxKeys: number = DEFAULT_MAX_KEYS) {
     this.#now = now;
+    this.#maxKeys = maxKeys;
+  }
+
+  /** How many callers are currently held. For tests, and for nothing else. */
+  get size(): number {
+    return this.#buckets.size;
   }
 
   /**
@@ -52,7 +82,13 @@ export class RateLimiter {
 
     const now = this.#now();
     const refillPerMs = perMinute / 60_000;
-    const bucket = this.#buckets.get(key) ?? { tokens: perMinute, lastRefill: now };
+    const existing = this.#buckets.get(key);
+
+    // Before the insert, not after: the cap is on what this map holds, and
+    // checking afterwards means it is briefly one over on every overflow.
+    if (!existing) this.#makeRoom();
+
+    const bucket = existing ?? { tokens: perMinute, lastRefill: now };
 
     bucket.tokens = Math.min(perMinute, bucket.tokens + (now - bucket.lastRefill) * refillPerMs);
     bucket.lastRefill = now;
@@ -67,11 +103,48 @@ export class RateLimiter {
     return { allowed: true, retryAfterMs: 0 };
   }
 
-  /** Drop idle buckets so a long-lived process does not accumulate keys forever. */
+  /**
+   * Drop idle buckets so a long-lived process does not accumulate keys forever.
+   *
+   * Public because it reads as the obvious lever, and because the tests drive it
+   * directly. It is **not** what bounds the map, and nothing's correctness may
+   * depend on a caller remembering it: for most of this file's life nothing did
+   * call it, `edge.ts` claimed idle callers were dropped, and the map grew for
+   * as long as the process lived. `#makeRoom` is the bound now, and it runs on
+   * the insert path where it cannot be forgotten.
+   */
   prune(idleMs = 300_000): void {
     const cutoff = this.#now() - idleMs;
     for (const [key, bucket] of this.#buckets) {
       if (bucket.lastRefill < cutoff) this.#buckets.delete(key);
     }
   }
+
+  /**
+   * Make space for one more key, if the map is full.
+   *
+   * Idle callers first, because dropping one costs nothing — a bucket that has
+   * not been touched in five minutes has refilled to full, so re-creating it
+   * gives back exactly what was discarded.
+   *
+   * Only when that is not enough does this evict a live caller, oldest first by
+   * last use. That *does* forgive whatever the evicted caller had spent, which
+   * is the honest cost of a bounded map: an attacker who can mint ten thousand
+   * distinct keys can push their own bucket out and start again. What they
+   * cannot do is grow the map, and on the paths this limiter guards there is a
+   * second bucket keyed on nothing at all — see `edge.ts` — which is the one
+   * that holds when the per-caller key is worthless.
+   */
+  #makeRoom(): void {
+    if (this.#buckets.size < this.#maxKeys) return;
+
+    this.prune();
+    if (this.#buckets.size < this.#maxKeys) return;
+
+    const oldest = [...this.#buckets.entries()]
+      .sort((a, b) => a[1].lastRefill - b[1].lastRefill)
+      .slice(0, Math.max(1, Math.ceil(this.#maxKeys / EVICTION_FRACTION)));
+
+    for (const [key] of oldest) this.#buckets.delete(key);
+  }
 }

package/src/profile/index.ts

@@ -12,6 +12,7 @@
  */
 
 export {
+  DEPLOY_DEFAULTS,
   SUPPORTED_CONTRACT,
   configSchema,
   declaredTarget,

package/src/profile/legacy.ts

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import {
   auditTargetSchema,
   credentialsTargetSchema,
+  DEPLOY_DEFAULTS,
   deployTargetSchema,
   storageTargetSchema,
   vaultTargetSchema,
@@ -54,14 +55,18 @@ export const legacyTargetSchema = z
       ? target
       : {
           ...target,
-          // The pre-`deploy` spelling predates both of these, so it gets the
-          // same defaults the current one would: the closed door, and no
-          // instance kept warm.
+          // The pre-`deploy` spelling predates all of these, so it gets the
+          // same defaults the current one would: the closed door, no instance
+          // kept warm, and the ceilings a public URL is deployed under. Built by
+          // hand here rather than parsed, so `DEPLOY_DEFAULTS` is spread rather
+          // than left to zod — a block that reaches `deployPlan` without them
+          // sends `undefined` to `gcloud` as the string "undefined".
           deploy: {
             ...cloudrun,
             platform: 'cloudrun' as const,
             access: 'iam' as const,
             min_instances: 0,
+            ...DEPLOY_DEFAULTS,
           },
         },
   );

package/src/profile/schema.ts

@@ -158,6 +158,25 @@ export const vaultTargetSchema = z.object({
  * discriminated union per platform — buys precision this file cannot use and
  * costs a schema edit on every field any host ever adds.
  */
+/**
+ * The ceilings a deployed revision runs under, in one place.
+ *
+ * A named constant rather than five literals inside `z.default()` because two
+ * callers need the same numbers and neither can read a zod default out of a
+ * schema: the survey writes a target's block field by field, and the deploy plan
+ * sends every one of them on every rollout. Two spellings of a ceiling is a
+ * ceiling that is one value in a fresh profile and another in a surveyed one.
+ *
+ * Each is argued at its own field below.
+ */
+export const DEPLOY_DEFAULTS = {
+  max_instances: 4,
+  concurrency: 40,
+  timeout_seconds: 300,
+  memory: '1Gi',
+  cpu: '1',
+} as const;
+
 export const deployTargetSchema = z.object({
   platform: z.enum(['cloudrun']),
   // Non-empty here rather than in a referential check further down. Under
@@ -210,6 +229,52 @@ export const deployTargetSchema = z.object({
    * Raise it if a re-authorization ever lines up with a cold `/token`.
    */
   min_instances: z.number().int().min(0).max(10).default(0),
+  /**
+   * The ceiling on instances, and the only thing bounding what a public URL can
+   * spend.
+   *
+   * Four, not the platform's hundred. `access: public` is a routable address on
+   * the internet, and every instance that starts reads the credential store and
+   * lists the bucket — so scaling out multiplies cost *and* traffic against the
+   * two things this endpoint most wants kept quiet. A single-user endpoint that
+   * genuinely needs a fifth concurrent instance has an agent in a loop, which is
+   * the case the ceiling is for.
+   *
+   * It is also what makes `limits.requests_per_minute` mean something in
+   * aggregate. Those limits are per instance and always were; with no ceiling
+   * the aggregate had no value at all, and `docs/detailed/deployment-cloudrun.md`
+   * told the reader to cap this themselves because nothing here did.
+   */
+  max_instances: z.number().int().min(1).max(100).default(DEPLOY_DEFAULTS.max_instances),
+  /**
+   * Requests one instance serves at once.
+   *
+   * Forty rather than the platform's eighty, paired with `memory` below: an
+   * attachment upload is capped at 64 MiB and is buffered before it is written,
+   * so what bounds this is memory per instance rather than CPU.
+   */
+  concurrency: z.number().int().min(1).max(1000).default(DEPLOY_DEFAULTS.concurrency),
+  /**
+   * How long one request may run before the platform cuts it.
+   *
+   * The platform's own default, stated rather than inherited — the point is that
+   * it is written down and always sent, so a platform changing its default is
+   * not a silent change to what this serves.
+   */
+  timeout_seconds: z.number().int().min(1).max(3600).default(DEPLOY_DEFAULTS.timeout_seconds),
+  /**
+   * Memory per instance.
+   *
+   * A gigabyte because 512 MiB is not enough for what the endpoint already
+   * accepts: `MAX_UPLOAD_BYTES` is 64 MiB, and staging one costs roughly twice
+   * that at peak — the chunks as they arrive, and the single buffer they are
+   * copied into. At the platform default that is one upload away from an
+   * out-of-memory kill, and an OOM is a 503 for every request the instance was
+   * also serving.
+   */
+  memory: z.string().min(1).default(DEPLOY_DEFAULTS.memory),
+  /** CPU per instance. Explicit for the same reason `timeout_seconds` is. */
+  cpu: z.string().min(1).default(DEPLOY_DEFAULTS.cpu),
 });
 
 /**

package/src/server/edge.ts

@@ -1,3 +1,4 @@
+import { challenge, type AuthOutcome, type ChallengeError } from '#auth';
 import { RateLimiter } from '#policy';
 
 /**
@@ -15,6 +16,56 @@ import { RateLimiter } from '#policy';
  */
 export const FAILED_AUTH_PER_MINUTE = 30;
 
+/**
+ * A ceiling on the surface that answers *before* authentication.
+ *
+ * The limit above sits behind the bearer gate, and for a long time that was the
+ * whole of it — which left the four things that answer in front of the gate with
+ * no ceiling at all. On a `public` deployment every one of them costs the owner
+ * something, and none of them needs a credential to reach:
+ *
+ *   - `/health` presented with a credential re-reads the credential store, which
+ *     on a deployed target is a Secret Manager call — two, when the value the
+ *     process cached does not match, because a mismatch against a cached value
+ *     forces the re-read that makes a rotation take effect.
+ *   - `/register` writes an object to the workspace bucket, then lists two
+ *     namespaces to decide whether anything needs evicting.
+ *   - `/authorize` compares against the endpoint token, which is another read of
+ *     the credential store.
+ *   - `/token` reads and writes bucket objects.
+ *
+ * `/health` presented with *no* credential is deliberately free: it reads
+ * nothing, and it is what a platform probe and `lanes link outputs` send.
+ * Metering it would put a ceiling on the one request that costs nothing to
+ * answer.
+ */
+export const UNAUTHENTICATED_PER_MINUTE = 30;
+
+/**
+ * The same ceiling for the endpoint as a whole, keyed on nothing.
+ *
+ * **This is the one that actually holds.** The per-caller key below is the first
+ * `X-Forwarded-For` hop, which anyone talking to the endpoint directly can write
+ * as they please — so a per-caller limit alone bounds only a caller who is not
+ * trying, and rotating the header walks straight through it.
+ *
+ * A shared bucket has the opposite problem: whoever is spending it locks
+ * everyone else out, which is why `index.ts` refuses to key the *failed-auth*
+ * limit that way. Here the trade is different, because what is behind these
+ * paths is not the owner's ability to use their endpoint — a client that has
+ * already authorised holds a token and never comes back through them — it is a
+ * discovery document, a registration, and a consent screen. Losing those for a
+ * minute is an authorization that has to be retried. Not losing them costs a
+ * stranger's arbitrary spend against the credential store.
+ *
+ * Two hundred a minute is far above what an authorization flow uses: a connector
+ * being added is a handful of requests, once.
+ */
+export const UNAUTHENTICATED_TOTAL_PER_MINUTE = 200;
+
+/** The key the endpoint-wide bucket is held under. Constant on purpose. */
+const EVERYONE = 'endpoint';
+
 /**
  * Who an attempt is counted against.
  *
@@ -47,7 +98,143 @@ export function tooManyAttempts(retryAfterMs: number): Response {
   );
 }
 
-/** One bucket set per endpoint. Idle callers are dropped so keys do not accumulate. */
+/**
+ * One bucket set per endpoint.
+ *
+ * The map is bounded by `RateLimiter` itself rather than by a caller
+ * remembering to prune it. This comment used to say idle callers were dropped
+ * "so keys do not accumulate", and nothing anywhere called `prune` — so on a
+ * public URL the map grew one entry per distinct `X-Forwarded-For` for as long
+ * as the process lived, which is a header a stranger writes.
+ */
 export function failedAuthLimiter(): RateLimiter {
   return new RateLimiter();
 }
+
+/** The same, for the pre-authentication surface. Separate so one cannot spend the other. */
+export function unauthenticatedLimiter(): RateLimiter {
+  return new RateLimiter();
+}
+
+/**
+ * The refusal for a pre-authentication request over budget, or `undefined` to
+ * let it through.
+ *
+ * One function rather than a branch in the router, for the reason `./cors.ts`
+ * and `./oauth.ts` are their own files: `index.ts` gains a delegation instead of
+ * the whole of this behaviour, and it stays inside the size budget that would
+ * otherwise be the rule relaxed to fit this in.
+ *
+ * `isAuthorizationPath` is passed rather than imported so this file does not
+ * reach back into the router's path constants — `corsAware` takes the same shape
+ * for the same reason.
+ *
+ * Two buckets are taken rather than one short-circuiting the other, so a caller
+ * that has exhausted its own budget still counts against the endpoint's: the
+ * alternative lets a flood of distinct forwarded-for values leave the shared
+ * bucket untouched, which is precisely the case the shared bucket exists for.
+ */
+export function unauthenticatedRefusal(input: {
+  readonly request: Request;
+  readonly pathname: string;
+  readonly limiter: RateLimiter;
+  readonly healthPath: string;
+  readonly isAuthorizationPath: (pathname: string) => boolean;
+  readonly authorizationEnabled: boolean;
+}): Response | undefined {
+  // A `/health` carrying no credential reads nothing and is deliberately free —
+  // it is what a platform probe and `lanes link outputs` send, and a ceiling on
+  // the one request that costs nothing to answer is an outage waiting for an
+  // attack that did not have to cause one.
+  const costly =
+    input.pathname === input.healthPath
+      ? input.request.headers.get('authorization') !== null
+      : input.authorizationEnabled && input.isAuthorizationPath(input.pathname);
+
+  if (!costly) return undefined;
+
+  const caller = callerKey(input.request);
+  const mine = input.limiter.take(`caller:${caller}`, UNAUTHENTICATED_PER_MINUTE);
+  const everyone = input.limiter.take(EVERYONE, UNAUTHENTICATED_TOTAL_PER_MINUTE);
+  if (mine.allowed && everyone.allowed) return undefined;
+
+  return tooManyAttempts(Math.max(mine.retryAfterMs, everyone.retryAfterMs));
+}
+
+type RefusalReason = Extract<AuthOutcome, { ok: false }>['reason'];
+
+/**
+ * What a caller should do about each refusal.
+ *
+ * `invalid` is the only one a client can act on by itself: it presented a
+ * credential and this endpoint did not accept it, which is what a refresh is
+ * for. RFC 6750 §3.1 has a name for that and clients branch on it; the others
+ * mean there is nothing to refresh, and §3 says to stay quiet rather than send
+ * a client after a token it does not hold. `malformed` says nothing either —
+ * `invalid_request` carries a SHOULD of a 400 status, and changing that path's
+ * status is a larger question than this answers.
+ */
+const CHALLENGE: Partial<Record<RefusalReason, ChallengeError>> = {
+  invalid: {
+    code: 'invalid_token',
+    description: 'The credential is expired, revoked, or not one this endpoint issued.',
+  },
+};
+
+/** The same four, for whoever is reading the body rather than the header. */
+const HINTS: Record<RefusalReason, string> = {
+  missing: 'Present the profile token as: Authorization: Bearer <token>',
+  malformed: 'Present the profile token as: Authorization: Bearer <token>',
+  invalid: 'Refresh the credential. Authorize again only if the refresh is refused too.',
+  not_configured: 'This profile has no token yet. Run: lanes link token rotate',
+};
+
+/**
+ * The `401`, with whatever the caller can act on.
+ *
+ * Here rather than in the router because it is the same subject as the two
+ * ceilings above — what this endpoint does about a caller who has not
+ * authenticated — and because the router was over its size budget carrying both.
+ * The vocabulary is RFC 6750's on the header and plain English in the body, so
+ * whoever is reading a terminal and whoever is writing a client each get the
+ * version they can use.
+ */
+function unauthorized(reason: RefusalReason, metadataUrl: string | null): Response {
+  return new Response(
+    JSON.stringify({ error: 'unauthorized', reason, hint: HINTS[reason] }),
+    {
+      status: 401,
+      headers: {
+        'content-type': 'application/json',
+        'www-authenticate': challenge(metadataUrl, CHALLENGE[reason]),
+      },
+    },
+  );
+}
+
+/**
+ * What a caller who failed authentication gets: the `401`, or the `429` once
+ * they have failed too often.
+ *
+ * The ceiling is spent **after** the attempt rather than before it. Keyed on the
+ * caller alone, anyone able to reach the endpoint could spend the owner's budget
+ * and lock them out, which trades a cost problem for a worse availability one.
+ * Only a failure consumes a token, so a valid credential is never refused by
+ * this.
+ *
+ * `metadataUrl` is the whole handshake for a remote client: it reads the named
+ * document, finds the authorization server, and starts a flow. Without it the
+ * client has to guess the document's location, and a client that guesses wrong
+ * reports the endpoint as unreachable.
+ */
+export function authRefusal(input: {
+  readonly request: Request;
+  readonly reason: RefusalReason;
+  readonly limiter: RateLimiter;
+  readonly metadataUrl: string | null;
+}): Response {
+  const budget = input.limiter.take(callerKey(input.request), FAILED_AUTH_PER_MINUTE);
+  return budget.allowed
+    ? unauthorized(input.reason, input.metadataUrl)
+    : tooManyAttempts(budget.retryAfterMs);
+}

package/src/server/harness.ts

@@ -116,6 +116,15 @@ export interface HarnessOptions {
    * serving the old generation" case is reached; absent means nothing new.
    */
   reopen?: () => Promise<ReadonlyMap<string, ProfileRuntime>>;
+  /**
+   * Meter the pre-authentication surface, as a routable deployment does.
+   *
+   * A harness binds loopback, where `serve()` leaves this off — the ceiling
+   * protects a credential-store call over the network and an object written to a
+   * bucket, and on loopback both are a local file. Set it to drive the deployed
+   * behaviour without a deployment.
+   */
+  meterUnauthenticated?: boolean;
 }
 
 /**
@@ -254,6 +263,7 @@ export function startHarness(options: HarnessOptions): Harness {
     primary: options.profile,
     authenticator: gate ? new AuthenticatorChain([bearer, gate.authenticator]) : bearer,
     ...(gate ? { authorization: gate.surface } : {}),
+    ...(options.meterUnauthenticated ? { meterUnauthenticated: true } : {}),
     log,
   });
 

package/src/server/index.ts

@@ -1,4 +1,4 @@
-import { challenge, type Authenticator, type AuthOutcome, type ChallengeError } from '#auth';
+import type { Authenticator } from '#auth';
 import type { Logger } from '#connectivity';
 import { capabilityIdForToolName } from '#server/mcp';
 import { ATTACHMENTS_PATH, stageAttachment } from './attachments.ts';
@@ -6,7 +6,12 @@ import { allowedHostnamesFor, rebindingRefusal } from './rebinding.ts';
 import { ANY_ORIGIN, corsAware, type CorsPolicy } from './cors.ts';
 import type { Generation } from './generation.ts';
 import type { Generations } from './generations.ts';
-import { callerKey, failedAuthLimiter, FAILED_AUTH_PER_MINUTE, tooManyAttempts } from './edge.ts';
+import {
+  authRefusal,
+  failedAuthLimiter,
+  unauthenticatedLimiter,
+  unauthenticatedRefusal,
+} from './edge.ts';
 import {
   handleAuthorization,
   isAuthorizationPath,
@@ -50,38 +55,29 @@ export interface ServerOptions {
   readonly authorization?: AuthorizationSurface | undefined;
   /** Hostnames this endpoint answers to. See `./rebinding.ts`. */
   readonly allowedHostnames?: readonly string[] | undefined;
+  /**
+   * Meter the surface that answers before authentication.
+   *
+   * A property of what this is bound to, exactly as `cors` and
+   * `allowedHostnames` are, and decided in the same lines of `serve()`. Off on
+   * loopback, and that is not a gap: what the ceiling protects is a
+   * credential-store call over the network and an object written to a bucket,
+   * and on loopback both are a local file belonging to whoever is already
+   * standing at the machine. `./rebinding.ts` refuses the one caller that is not
+   * — a page the owner happens to be visiting — before this would be reached.
+   */
+  readonly meterUnauthenticated?: boolean | undefined;
 }
 
-type RefusalReason = Extract<AuthOutcome, { ok: false }>['reason'];
-
-/**
- * What a caller should do about each refusal.
- *
- * `invalid` is the only one a client can act on by itself: it presented a
- * credential and this endpoint did not accept it, which is what a refresh is
- * for. RFC 6750 §3.1 has a name for that and clients branch on it; the others
- * mean there is nothing to refresh, and §3 says to stay quiet rather than send
- * a client after a token it does not hold. `malformed` says nothing either —
- * `invalid_request` carries a SHOULD of a 400 status, and changing that path's
- * status is a larger question than this answers.
- */
-const CHALLENGE: Partial<Record<RefusalReason, ChallengeError>> = {
-  invalid: {
-    code: 'invalid_token',
-    description: 'The credential is expired, revoked, or not one this endpoint issued.',
-  },
-};
-
-/** The same four, for whoever is reading the body rather than the header. */
-const HINTS: Record<RefusalReason, string> = {
-  missing: 'Present the profile token as: Authorization: Bearer <token>',
-  malformed: 'Present the profile token as: Authorization: Bearer <token>',
-  invalid: 'Refresh the credential. Authorize again only if the refresh is refused too.',
-  not_configured: 'This profile has no token yet. Run: lanes link token rotate',
-};
-
 export const MCP_PATH = '/mcp';
 export const RELOAD_PATH = '/reload';
+/**
+ * Named rather than inline, because two places now decide about it: the branch
+ * that answers it, and the ceiling in front of that branch which has to know
+ * that a `/health` carrying a credential is not the free request the other one
+ * is.
+ */
+export const HEALTH_PATH = '/health';
 
 /**
  * Loopback addresses. What binding to one changes is the browser threat model,
@@ -111,6 +107,7 @@ export interface RequestHandler {
 export function createRequestHandler(options: ServerOptions): RequestHandler {
   let probedAt = 0;
   const failedAuth = failedAuthLimiter();
+  const unauthenticated = options.meterUnauthenticated ? unauthenticatedLimiter() : null;
 
   /**
    * Re-read the config because a call named a tool we do not serve.
@@ -144,6 +141,27 @@ export function createRequestHandler(options: ServerOptions): RequestHandler {
 
       const url = new URL(request.url);
 
+      // Ahead of every path that answers without a credential, because the
+      // ceiling further down is inside the `401` branch and so has never covered
+      // any of them. Each costs a read of the credential store or a write to the
+      // workspace bucket, and none of them asks who is calling first. See
+      // `./edge.ts` for which ones, and for why `/health` is only sometimes
+      // among them.
+      if (unauthenticated) {
+        const refusal = unauthenticatedRefusal({
+          request,
+          pathname: url.pathname,
+          limiter: unauthenticated,
+          healthPath: HEALTH_PATH,
+          isAuthorizationPath,
+          authorizationEnabled: options.authorization !== undefined,
+        });
+        if (refusal) {
+          options.log.warn('rejected request', { reason: 'unauthenticated_rate' });
+          return refusal;
+        }
+      }
+
       // Before authentication, deliberately: a client's first request is the
       // one that discovers how to authenticate, so requiring a token to read
       // the document that says where tokens come from would close the loop it
@@ -152,7 +170,7 @@ export function createRequestHandler(options: ServerOptions): RequestHandler {
         return await handleAuthorization(request, options.authorization);
       }
 
-      if (url.pathname === '/health') {
+      if (url.pathname === HEALTH_PATH) {
         // `status` is unauthenticated because the platform's own probe reads it
         // and a deploy waits on it. The profile *names* are not: on a public URL
         // that is a list of what this endpoint holds, handed to anyone who asks,
@@ -182,37 +200,17 @@ export function createRequestHandler(options: ServerOptions): RequestHandler {
         request.headers.get('authorization'),
       );
 
+      // The refusal, and the ceiling on how often one may be provoked. Both in
+      // `./edge.ts`, which is the subject: what this endpoint does about a
+      // caller who has not authenticated.
       if (!outcome.ok) {
         options.log.warn('rejected request', { reason: outcome.reason });
-
-        // After the attempt rather than before it: keyed on the caller alone,
-        // anyone able to reach the endpoint could spend the owner's budget and
-        // lock them out, which trades a cost problem for a worse availability
-        // one. Only a failure consumes a token, so a valid credential is never
-        // refused by this.
-        const budget = failedAuth.take(callerKey(request), FAILED_AUTH_PER_MINUTE);
-        if (!budget.allowed) return tooManyAttempts(budget.retryAfterMs);
-
-        // The pointer is the whole handshake for a remote client: it reads the
-        // named document, finds the authorization server, and starts a flow.
-        // Without it the client has to guess the document's location, and a
-        // client that guesses wrong reports the endpoint as unreachable.
-        const metadata = options.authorization ? resourceMetadataUrl(request) : null;
-
-        return new Response(
-          JSON.stringify({
-            error: 'unauthorized',
-            reason: outcome.reason,
-            hint: HINTS[outcome.reason],
-          }),
-          {
-            status: 401,
-            headers: {
-              'content-type': 'application/json',
-              'www-authenticate': challenge(metadata, CHALLENGE[outcome.reason]),
-            },
-          },
-        );
+        return authRefusal({
+          request,
+          reason: outcome.reason,
+          limiter: failedAuth,
+          metadataUrl: options.authorization ? resourceMetadataUrl(request) : null,
+        });
       }
 
       // Behind the same bearer check as everything else, and deliberately not a
@@ -348,6 +346,10 @@ export function serve(options: ServeOptions): RunningServer {
     : { allowedOrigins: primary.config.auth.allowed_origins ?? [ANY_ORIGIN] };
   const handler = createRequestHandler({
     ...options,
+    // Off on loopback for the same reason `cors` is undefined there, and decided
+    // here so every property of the bind address is decided together. An
+    // explicit `true` wins, which is how a test drives the deployed behaviour.
+    meterUnauthenticated: options.meterUnauthenticated ?? !loopback,
     ...(allowedHostnames ? { allowedHostnames } : {}),
   });
 

package/src/server/oauth.ts

@@ -62,11 +62,30 @@ export function isAuthorizationPath(pathname: string): boolean {
  * `http` and every metadata document would name a resource no client asked for
  * — which fails the exact-match the specification requires. Config cannot help
  * either: the hostname carries a project hash assigned at deploy time.
+ *
+ * **The host is `Host`, and `X-Forwarded-Host` is not consulted.** It used to
+ * be, ahead of `Host`, and the justification above is entirely about the
+ * *scheme* — nothing ever needed the other header. What it cost is that four
+ * documents were steerable per request by whoever sent it: both discovery
+ * documents, the `resource_metadata` pointer on every `401`, and the `action` of
+ * the consent form that asks the owner to paste their endpoint token. Cloud Run
+ * sets `Host` and routes on it, so it is the one value a caller cannot invent
+ * without the request going somewhere else; a proxy that genuinely rewrites it
+ * rewrites `Host` too, which is what a domain mapping does.
+ *
+ * The scheme is checked rather than trusted for the same reason, and it is a
+ * smaller hole — naming `http` in a document downgrades nothing, it just makes
+ * the exact-match fail — but a header that decides part of a URL should not
+ * accept an arbitrary string.
  */
 export function publicOrigin(request: Request): string {
   const url = new URL(request.url);
-  const host = request.headers.get('x-forwarded-host') ?? request.headers.get('host') ?? url.host;
-  const proto = request.headers.get('x-forwarded-proto') ?? url.protocol.replace(':', '');
+  const host = request.headers.get('host') ?? url.host;
+
+  const forwarded = request.headers.get('x-forwarded-proto');
+  const proto =
+    forwarded === 'https' || forwarded === 'http' ? forwarded : url.protocol.replace(':', '');
+
   return `${proto}://${host}`;
 }