@lobu/gateway 2.8.0

package/dist/config/index.js

@@ -0,0 +1,357 @@
+#!/usr/bin/env bun
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadEnvFile = loadEnvFile;
+exports.getInternalGatewayUrl = getInternalGatewayUrl;
+exports.buildMemoryPlugins = buildMemoryPlugins;
+exports.buildGatewayConfig = buildGatewayConfig;
+exports.displayGatewayConfig = displayGatewayConfig;
+const node_fs_1 = require("node:fs");
+const node_module_1 = require("node:module");
+const node_path_1 = __importDefault(require("node:path"));
+const core_1 = require("@lobu/core");
+const dotenv_1 = require("dotenv");
+const logger = (0, core_1.createLogger)("cli-config");
+const OWLETTO_PLUGIN_SOURCE = "@lobu/owletto-openclaw";
+const NATIVE_MEMORY_PLUGIN_SOURCE = "@openclaw/native-memory";
+const WORKER_PACKAGE_JSON_CANDIDATES = [
+    node_path_1.default.resolve(process.cwd(), "packages/worker/package.json"),
+    "/app/packages/worker/package.json",
+];
+// ============================================================================
+// CONSTANTS
+// ============================================================================
+/**
+ * Gateway-specific constants
+ * Core constants (TIME, REDIS_KEYS, core DEFAULTS) are imported from @lobu/core
+ * This file contains gateway-specific configuration values
+ */
+// Gateway-specific default configuration values
+const GATEWAY_DEFAULTS = {
+    /** Default HTTP server port */
+    HTTP_PORT: 3000,
+    /** Default public gateway URL */
+    PUBLIC_GATEWAY_URL: "",
+    /** Default queue names */
+    QUEUE_DIRECT_MESSAGE: "direct_message",
+    QUEUE_MESSAGE_QUEUE: "message_queue",
+    /** Default worker settings */
+    WORKER_IMAGE_REPOSITORY: "lobu-worker",
+    WORKER_IMAGE_TAG: "latest",
+    WORKER_IMAGE_DIGEST: "",
+    WORKER_IMAGE_PULL_POLICY: "Always",
+    WORKER_IMAGE_PULL_SECRETS: "",
+    WORKER_SERVICE_ACCOUNT_NAME: "lobu-worker",
+    WORKER_RUNTIME_CLASS_NAME: "kata",
+    WORKER_STARTUP_TIMEOUT_SECONDS: 90,
+    WORKER_CPU_REQUEST: "100m",
+    WORKER_MEMORY_REQUEST: "256Mi",
+    WORKER_CPU_LIMIT: "1000m",
+    WORKER_MEMORY_LIMIT: "2Gi",
+    WORKER_IDLE_CLEANUP_MINUTES: 60,
+    MAX_WORKER_DEPLOYMENTS: 100,
+    WORKER_STALE_TIMEOUT_MINUTES: 10,
+    /** Default Kubernetes namespace */
+    KUBERNETES_NAMESPACE: "lobu",
+    /** Default cleanup settings */
+    CLEANUP_INITIAL_DELAY_MS: core_1.TIME.FIVE_SECONDS_MS,
+    CLEANUP_INTERVAL_MS: 60000, // 1 minute
+    CLEANUP_VERY_OLD_DAYS: 7,
+    /** Default socket health settings */
+    SOCKET_HEALTH_CHECK_INTERVAL_MS: 5 * core_1.TIME.MINUTE_MS, // 5 minutes
+    SOCKET_STALE_THRESHOLD_MS: 15 * core_1.TIME.MINUTE_MS, // 15 minutes
+    SOCKET_PROTECT_ACTIVE_WORKERS: true,
+    /** Default deployment settings */
+    LOBU_DEV_PROJECT_PATH: "/app",
+    COMPOSE_PROJECT_NAME: "lobu",
+    DISPATCHER_SERVICE_NAME: "lobu-dispatcher",
+    /** Default log level */
+    LOG_LEVEL: "INFO",
+    /** Default kubeconfig path */
+    KUBECONFIG: "~/.kube/config",
+    /** Embedded mode defaults */
+    EMBEDDED_MAX_CONCURRENT_SESSIONS: 100,
+    EMBEDDED_MAX_MEMORY_PER_SESSION_MB: 256,
+    EMBEDDED_BASH_MAX_COMMAND_COUNT: 50000,
+    EMBEDDED_BASH_MAX_LOOP_ITERATIONS: 50000,
+    EMBEDDED_BASH_MAX_CALL_DEPTH: 50,
+};
+// Merged DEFAULTS with core and gateway-specific values (internal use only)
+const DEFAULTS = Object.assign(Object.assign({}, core_1.DEFAULTS), GATEWAY_DEFAULTS);
+// Display formatting (internal use only)
+const DISPLAY = {
+    /** Horizontal separator length */
+    SEPARATOR_LENGTH: 50,
+    /** Token preview length for logging */
+    TOKEN_PREVIEW_LENGTH: 10,
+};
+// ============================================================================
+// CONFIGURATION BUILDERS
+// ============================================================================
+/**
+ * Load environment variables from .env file if in non-production
+ */
+function loadEnvFile(envPath) {
+    if (process.env.NODE_ENV === "production") {
+        logger.debug("Production mode - skipping .env file");
+        return;
+    }
+    const envProvided = Boolean(envPath);
+    const resolvedPath = envProvided
+        ? node_path_1.default.resolve(process.cwd(), envPath)
+        : node_path_1.default.resolve(process.cwd(), ".env");
+    if ((0, node_fs_1.existsSync)(resolvedPath)) {
+        (0, dotenv_1.config)({ path: resolvedPath });
+        logger.debug(`Loaded environment variables from ${resolvedPath}`);
+    }
+    else if (envProvided) {
+        logger.warn(`Specified env file ${resolvedPath} was not found; continuing without it.`);
+    }
+    else {
+        logger.debug("No .env file found; relying on process environment.");
+    }
+}
+/**
+ * Derive the internal gateway URL for worker→gateway communication.
+ * In K8s, uses DISPATCHER_SERVICE_NAME + namespace. In Docker, defaults to "gateway".
+ */
+function getInternalGatewayUrl() {
+    const dispatcherService = process.env.DISPATCHER_SERVICE_NAME;
+    if (dispatcherService) {
+        const namespace = process.env.KUBERNETES_NAMESPACE || "lobu";
+        return `http://${dispatcherService}.${namespace}.svc.cluster.local:8080`;
+    }
+    const port = process.env.GATEWAY_PORT || "8080";
+    return `http://gateway:${port}`;
+}
+/**
+ * Build the default memory plugin list based on MEMORY_URL env var.
+ * MEMORY_URL set → Owletto MCP plugin (connect to that URL) when installed
+ * MEMORY_URL empty → @openclaw/native-memory (filesystem-based)
+ */
+function isPluginInstalled(source) {
+    const resolverPaths = new Set([__filename]);
+    const packagePathParts = source.split("/");
+    for (const candidate of WORKER_PACKAGE_JSON_CANDIDATES) {
+        if ((0, node_fs_1.existsSync)(candidate)) {
+            resolverPaths.add(candidate);
+        }
+    }
+    for (const resolverPath of resolverPaths) {
+        try {
+            (0, node_module_1.createRequire)(resolverPath).resolve(source);
+            return true;
+        }
+        catch (_a) {
+            const packageDir = node_path_1.default.join(node_path_1.default.dirname(resolverPath), "node_modules", ...packagePathParts);
+            if ((0, node_fs_1.existsSync)(packageDir)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+function buildMemoryPlugins(options) {
+    var _a, _b;
+    const nativeMemoryPlugin = {
+        source: NATIVE_MEMORY_PLUGIN_SOURCE,
+        slot: "memory",
+        enabled: true,
+    };
+    const hasNativeMemoryPlugin = (_a = options === null || options === void 0 ? void 0 : options.hasNativeMemoryPlugin) !== null && _a !== void 0 ? _a : isPluginInstalled(NATIVE_MEMORY_PLUGIN_SOURCE);
+    if (!process.env.MEMORY_URL) {
+        if (hasNativeMemoryPlugin) {
+            return [nativeMemoryPlugin];
+        }
+        logger.warn(`${NATIVE_MEMORY_PLUGIN_SOURCE} is not installed; continuing without a memory plugin`);
+        return [];
+    }
+    const hasOwlettoPlugin = (_b = options === null || options === void 0 ? void 0 : options.hasOwlettoPlugin) !== null && _b !== void 0 ? _b : isPluginInstalled(OWLETTO_PLUGIN_SOURCE);
+    if (!hasOwlettoPlugin) {
+        if (hasNativeMemoryPlugin) {
+            logger.warn(`${OWLETTO_PLUGIN_SOURCE} is not installed; falling back to ${NATIVE_MEMORY_PLUGIN_SOURCE}`);
+            return [nativeMemoryPlugin];
+        }
+        logger.warn(`${OWLETTO_PLUGIN_SOURCE} is not installed and ${NATIVE_MEMORY_PLUGIN_SOURCE} is unavailable; continuing without a memory plugin`);
+        return [];
+    }
+    const gatewayUrl = getInternalGatewayUrl();
+    return [
+        {
+            source: OWLETTO_PLUGIN_SOURCE,
+            slot: "memory",
+            enabled: true,
+            config: {
+                mcpUrl: `${gatewayUrl}/mcp/owletto`,
+                gatewayAuthUrl: gatewayUrl,
+            },
+        },
+    ];
+}
+/** Deep-merge utility: merges source into target, recursing into plain objects */
+function deepMerge(target, source) {
+    const result = Object.assign({}, target);
+    for (const key of Object.keys(source)) {
+        const srcVal = source[key];
+        if (srcVal === undefined)
+            continue;
+        const tgtVal = result[key];
+        if (tgtVal &&
+            srcVal &&
+            typeof tgtVal === "object" &&
+            typeof srcVal === "object" &&
+            !Array.isArray(tgtVal) &&
+            !Array.isArray(srcVal)) {
+            result[key] = deepMerge(tgtVal, srcVal);
+        }
+        else {
+            result[key] = srcVal;
+        }
+    }
+    return result;
+}
+/**
+ * Build complete gateway configuration from environment variables,
+ * optionally deep-merged with explicit overrides.
+ *
+ * @param overrides - Partial config that takes precedence over env vars.
+ *   Useful for embedded mode where the host provides config programmatically.
+ */
+function buildGatewayConfig(overrides) {
+    var _a, _b, _c;
+    logger.debug("Building gateway configuration from environment variables");
+    // Required variables (allow override to satisfy the requirement)
+    const connectionString = ((_a = overrides === null || overrides === void 0 ? void 0 : overrides.queues) === null || _a === void 0 ? void 0 : _a.connectionString) || (0, core_1.getRequiredEnv)("QUEUE_URL");
+    const defaultMemoryFlushEnabled = (0, core_1.getOptionalBoolean)("AGENT_DEFAULT_MEMORY_FLUSH_ENABLED", true);
+    const defaultMemoryFlushSoftThresholdTokens = (0, core_1.getOptionalNumber)("AGENT_DEFAULT_MEMORY_FLUSH_SOFT_THRESHOLD_TOKENS", 4000);
+    const defaultMemoryFlushSystemPrompt = (0, core_1.getOptionalEnv)("AGENT_DEFAULT_MEMORY_FLUSH_SYSTEM_PROMPT", "Session nearing compaction. Store durable memories now.");
+    const defaultMemoryFlushPrompt = (0, core_1.getOptionalEnv)("AGENT_DEFAULT_MEMORY_FLUSH_PROMPT", "Write any lasting notes to memory using available memory tools. Reply with NO_REPLY if nothing to store.");
+    const publicGatewayUrl = (0, core_1.getOptionalEnv)("PUBLIC_GATEWAY_URL", DEFAULTS.PUBLIC_GATEWAY_URL);
+    // Build configuration
+    const config = {
+        agentDefaults: {
+            allowedTools: (_b = process.env.ALLOWED_TOOLS) === null || _b === void 0 ? void 0 : _b.split(","),
+            disallowedTools: (_c = process.env.DISALLOWED_TOOLS) === null || _c === void 0 ? void 0 : _c.split(","),
+            runtime: process.env.AGENT_RUNTIME || process.env.AGENT_DEFAULT_RUNTIME,
+            model: process.env.AGENT_DEFAULT_MODEL,
+            timeoutMinutes: process.env.TIMEOUT_MINUTES
+                ? Number(process.env.TIMEOUT_MINUTES)
+                : undefined,
+            compaction: {
+                memoryFlush: {
+                    enabled: defaultMemoryFlushEnabled,
+                    softThresholdTokens: defaultMemoryFlushSoftThresholdTokens,
+                    systemPrompt: defaultMemoryFlushSystemPrompt,
+                    prompt: defaultMemoryFlushPrompt,
+                },
+            },
+            pluginsConfig: {
+                plugins: buildMemoryPlugins(),
+            },
+        },
+        sessionTimeoutMinutes: (0, core_1.getOptionalNumber)("SESSION_TIMEOUT_MINUTES", DEFAULTS.SESSION_TIMEOUT_MINUTES),
+        logLevel: process.env.LOG_LEVEL || DEFAULTS.LOG_LEVEL,
+        queues: {
+            connectionString,
+            directMessage: (0, core_1.getOptionalEnv)("QUEUE_DIRECT_MESSAGE", DEFAULTS.QUEUE_DIRECT_MESSAGE),
+            messageQueue: (0, core_1.getOptionalEnv)("QUEUE_MESSAGE_QUEUE", DEFAULTS.QUEUE_MESSAGE_QUEUE),
+            retryLimit: (0, core_1.getOptionalNumber)("QUEUE_RETRY_LIMIT", DEFAULTS.QUEUE_RETRY_LIMIT),
+            retryDelay: (0, core_1.getOptionalNumber)("QUEUE_RETRY_DELAY", DEFAULTS.QUEUE_RETRY_DELAY_SECONDS),
+            expireInHours: (0, core_1.getOptionalNumber)("QUEUE_EXPIRE_HOURS", DEFAULTS.QUEUE_EXPIRE_HOURS),
+        },
+        anthropicProxy: {
+            enabled: true,
+            anthropicBaseUrl: process.env.SECRET_PROXY_UPSTREAM_URL || process.env.ANTHROPIC_BASE_URL,
+        },
+        orchestration: {
+            deploymentMode: process.env.DEPLOYMENT_MODE,
+            queues: {
+                connectionString,
+                retryLimit: (0, core_1.getOptionalNumber)("QUEUE_RETRY_LIMIT", DEFAULTS.QUEUE_RETRY_LIMIT),
+                retryDelay: (0, core_1.getOptionalNumber)("QUEUE_RETRY_DELAY", DEFAULTS.QUEUE_RETRY_DELAY_SECONDS),
+                expireInSeconds: (0, core_1.getOptionalNumber)("QUEUE_EXPIRE_HOURS", DEFAULTS.QUEUE_EXPIRE_HOURS) *
+                    core_1.TIME.HOUR_SECONDS,
+            },
+            worker: {
+                image: {
+                    repository: (0, core_1.getOptionalEnv)("WORKER_IMAGE_REPOSITORY", DEFAULTS.WORKER_IMAGE_REPOSITORY),
+                    tag: (0, core_1.getOptionalEnv)("WORKER_IMAGE_TAG", DEFAULTS.WORKER_IMAGE_TAG),
+                    digest: (0, core_1.getOptionalEnv)("WORKER_IMAGE_DIGEST", DEFAULTS.WORKER_IMAGE_DIGEST),
+                    pullPolicy: (0, core_1.getOptionalEnv)("WORKER_IMAGE_PULL_POLICY", DEFAULTS.WORKER_IMAGE_PULL_POLICY),
+                },
+                imagePullSecrets: (0, core_1.getOptionalEnv)("WORKER_IMAGE_PULL_SECRETS", DEFAULTS.WORKER_IMAGE_PULL_SECRETS)
+                    .split(",")
+                    .map((secret) => secret.trim())
+                    .filter(Boolean),
+                serviceAccountName: (0, core_1.getOptionalEnv)("WORKER_SERVICE_ACCOUNT_NAME", DEFAULTS.WORKER_SERVICE_ACCOUNT_NAME),
+                runtimeClassName: (0, core_1.getOptionalEnv)("WORKER_RUNTIME_CLASS_NAME", DEFAULTS.WORKER_RUNTIME_CLASS_NAME),
+                startupTimeoutSeconds: (0, core_1.getOptionalNumber)("WORKER_STARTUP_TIMEOUT_SECONDS", DEFAULTS.WORKER_STARTUP_TIMEOUT_SECONDS),
+                resources: {
+                    requests: {
+                        cpu: (0, core_1.getOptionalEnv)("WORKER_CPU_REQUEST", DEFAULTS.WORKER_CPU_REQUEST),
+                        memory: (0, core_1.getOptionalEnv)("WORKER_MEMORY_REQUEST", DEFAULTS.WORKER_MEMORY_REQUEST),
+                    },
+                    limits: {
+                        cpu: (0, core_1.getOptionalEnv)("WORKER_CPU_LIMIT", DEFAULTS.WORKER_CPU_LIMIT),
+                        memory: (0, core_1.getOptionalEnv)("WORKER_MEMORY_LIMIT", DEFAULTS.WORKER_MEMORY_LIMIT),
+                    },
+                },
+                idleCleanupMinutes: (0, core_1.getOptionalNumber)("WORKER_IDLE_CLEANUP_MINUTES", DEFAULTS.WORKER_IDLE_CLEANUP_MINUTES),
+                maxDeployments: (0, core_1.getOptionalNumber)("MAX_WORKER_DEPLOYMENTS", DEFAULTS.MAX_WORKER_DEPLOYMENTS),
+            },
+            kubernetes: {
+                namespace: (0, core_1.getOptionalEnv)("KUBERNETES_NAMESPACE", DEFAULTS.KUBERNETES_NAMESPACE),
+            },
+            cleanup: {
+                initialDelayMs: (0, core_1.getOptionalNumber)("CLEANUP_INITIAL_DELAY_MS", DEFAULTS.CLEANUP_INITIAL_DELAY_MS),
+                intervalMs: (0, core_1.getOptionalNumber)("CLEANUP_INTERVAL_MS", DEFAULTS.CLEANUP_INTERVAL_MS),
+                veryOldDays: (0, core_1.getOptionalNumber)("CLEANUP_VERY_OLD_DAYS", DEFAULTS.CLEANUP_VERY_OLD_DAYS),
+            },
+        },
+        mcp: {
+            publicGatewayUrl,
+            internalGatewayUrl: getInternalGatewayUrl(),
+        },
+        health: {
+            checkIntervalMs: (0, core_1.getOptionalNumber)("SOCKET_HEALTH_CHECK_INTERVAL_MS", DEFAULTS.SOCKET_HEALTH_CHECK_INTERVAL_MS),
+            staleThresholdMs: (0, core_1.getOptionalNumber)("SOCKET_STALE_THRESHOLD_MS", DEFAULTS.SOCKET_STALE_THRESHOLD_MS),
+            protectActiveWorkers: (0, core_1.getOptionalBoolean)("SOCKET_PROTECT_ACTIVE_WORKERS", DEFAULTS.SOCKET_PROTECT_ACTIVE_WORKERS),
+        },
+    };
+    logger.debug("Gateway configuration built successfully");
+    if (overrides) {
+        return deepMerge(config, overrides);
+    }
+    return config;
+}
+/**
+ * Display gateway configuration (platform-agnostic parts only)
+ * Platform-specific display should be handled by platform modules
+ */
+function displayGatewayConfig(config) {
+    const separator = "=".repeat(DISPLAY.SEPARATOR_LENGTH);
+    console.log("Gateway Configuration:");
+    console.log(separator);
+    console.log("\nQueues:");
+    console.log(`  Connection: ${config.queues.connectionString.substring(0, 30)}...`);
+    console.log(`  Retry Limit: ${config.queues.retryLimit}`);
+    console.log(`  Retry Delay: ${config.queues.retryDelay}s`);
+    console.log("\nMCP:");
+    console.log(`  Public Gateway: ${config.mcp.publicGatewayUrl || "(not set)"}`);
+    console.log("\nOrchestration:");
+    console.log(`  Worker Image: ${config.orchestration.worker.image.repository}`);
+    console.log(`  Worker Tag: ${config.orchestration.worker.image.tag}`);
+    if (config.orchestration.worker.image.digest) {
+        console.log(`  Worker Digest: ${config.orchestration.worker.image.digest}`);
+    }
+    console.log(`  Max Deployments: ${config.orchestration.worker.maxDeployments}`);
+    console.log("\nHealth:");
+    console.log(`  Socket Check Interval: ${config.health.checkIntervalMs}ms`);
+    console.log(`  Socket Stale Threshold: ${config.health.staleThresholdMs}ms`);
+    console.log(`  Protect Active Workers: ${config.health.protectActiveWorkers}`);
+    console.log(`\n${separator}`);
+}
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":";;;;;;AA4KA,kCAqBC;AAMD,sDAQC;AAoCD,gDAkDC;AAmCD,gDAuNC;AAMD,oDAsCC;AAzkBD,qCAAqC;AACrC,6CAA4C;AAC5C,0DAA6B;AAE7B,qCAQoB;AACpB,mCAAgD;AAGhD,MAAM,MAAM,GAAG,IAAA,mBAAY,EAAC,YAAY,CAAC,CAAC;AAC1C,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AACvD,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAC9D,MAAM,8BAA8B,GAAG;IACrC,mBAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,8BAA8B,CAAC;IAC3D,mCAAmC;CAC3B,CAAC;AAEX,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E;;;;GAIG;AAEH,gDAAgD;AAChD,MAAM,gBAAgB,GAAG;IACvB,+BAA+B;IAC/B,SAAS,EAAE,IAAI;IACf,iCAAiC;IACjC,kBAAkB,EAAE,EAAE;IACtB,0BAA0B;IAC1B,oBAAoB,EAAE,gBAAgB;IACtC,mBAAmB,EAAE,eAAe;IACpC,8BAA8B;IAC9B,uBAAuB,EAAE,aAAa;IACtC,gBAAgB,EAAE,QAAQ;IAC1B,mBAAmB,EAAE,EAAE;IACvB,wBAAwB,EAAE,QAAQ;IAClC,yBAAyB,EAAE,EAAE;IAC7B,2BAA2B,EAAE,aAAa;IAC1C,yBAAyB,EAAE,MAAM;IACjC,8BAA8B,EAAE,EAAE;IAClC,kBAAkB,EAAE,MAAM;IAC1B,qBAAqB,EAAE,OAAO;IAC9B,gBAAgB,EAAE,OAAO;IACzB,mBAAmB,EAAE,KAAK;IAC1B,2BAA2B,EAAE,EAAE;IAC/B,sBAAsB,EAAE,GAAG;IAC3B,4BAA4B,EAAE,EAAE;IAChC,mCAAmC;IACnC,oBAAoB,EAAE,MAAM;IAC5B,+BAA+B;IAC/B,wBAAwB,EAAE,WAAI,CAAC,eAAe;IAC9C,mBAAmB,EAAE,KAAK,EAAE,WAAW;IACvC,qBAAqB,EAAE,CAAC;IACxB,qCAAqC;IACrC,+BAA+B,EAAE,CAAC,GAAG,WAAI,CAAC,SAAS,EAAE,YAAY;IACjE,yBAAyB,EAAE,EAAE,GAAG,WAAI,CAAC,SAAS,EAAE,aAAa;IAC7D,6BAA6B,EAAE,IAAI;IACnC,kCAAkC;IAClC,qBAAqB,EAAE,MAAM;IAC7B,oBAAoB,EAAE,MAAM;IAC5B,uBAAuB,EAAE,iBAAiB;IAC1C,wBAAwB;IACxB,SAAS,EAAE,MAAe;IAC1B,8BAA8B;IAC9B,UAAU,EAAE,gBAAgB;IAC5B,6BAA6B;IAC7B,gCAAgC,EAAE,GAAG;IACrC,kCAAkC,EAAE,GAAG;IACvC,+BAA+B,EAAE,KAAM;IACvC,iCAAiC,EAAE,KAAM;IACzC,4BAA4B,EAAE,EAAE;CACxB,CAAC;AAEX,4EAA4E;AAC5E,MAAM,QAAQ,GAAG,gCACZ,eAAa,GACb,gBAAgB,CACX,CAAC;AAEX,yCAAyC;AACzC,MAAM,OAAO,GAAG;IACd,kCAAkC;IAClC,gBAAgB,EAAE,EAAE;IACpB,uCAAuC;IACvC,oBAAoB,EAAE,EAAE;CAChB,CAAC;AAkEX,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,WAAW,CAAC,OAAgB;IAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,WAAW;QAC9B,CAAC,CAAC,mBAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAQ,CAAC;QACvC,CAAC,CAAC,mBAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAExC,IAAI,IAAA,oBAAU,EAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,IAAA,eAAY,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,qCAAqC,YAAY,EAAE,CAAC,CAAC;IACpE,CAAC;SAAM,IAAI,WAAW,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CACT,sBAAsB,YAAY,wCAAwC,CAC3E,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB;IACnC,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAC9D,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,MAAM,CAAC;QAC7D,OAAO,UAAU,iBAAiB,IAAI,SAAS,yBAAyB,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC;IAChD,OAAO,kBAAkB,IAAI,EAAE,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IACpD,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE3C,KAAK,MAAM,SAAS,IAAI,8BAA8B,EAAE,CAAC;QACvD,IAAI,IAAA,oBAAU,EAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,IAAA,2BAAa,EAAC,YAAY,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,UAAU,GAAG,mBAAI,CAAC,IAAI,CAC1B,mBAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAC1B,cAAc,EACd,GAAG,gBAAgB,CACpB,CAAC;YACF,IAAI,IAAA,oBAAU,EAAC,UAAU,CAAC,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAGlC;;IACC,MAAM,kBAAkB,GAAiB;QACvC,MAAM,EAAE,2BAA2B;QACnC,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI;KACd,CAAC;IACF,MAAM,qBAAqB,GACzB,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,qBAAqB,mCAC9B,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;IAEjD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QAC5B,IAAI,qBAAqB,EAAE,CAAC;YAC1B,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,CAAC,IAAI,CACT,GAAG,2BAA2B,uDAAuD,CACtF,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,gBAAgB,GACpB,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,gBAAgB,mCAAI,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IACxE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,IAAI,qBAAqB,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CACT,GAAG,qBAAqB,sCAAsC,2BAA2B,EAAE,CAC5F,CAAC;YACF,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,CAAC,IAAI,CACT,GAAG,qBAAqB,yBAAyB,2BAA2B,qDAAqD,CAClI,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAG,qBAAqB,EAAE,CAAC;IAC3C,OAAO;QACL;YACE,MAAM,EAAE,qBAAqB;YAC7B,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE;gBACN,MAAM,EAAE,GAAG,UAAU,cAAc;gBACnC,cAAc,EAAE,UAAU;aAC3B;SACF;KACF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,SAAS,CAChB,MAAS,EACT,MAAkB;IAElB,MAAM,MAAM,qBAAQ,MAAM,CAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAgB,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,IACE,MAAM;YACN,MAAM;YACN,OAAO,MAAM,KAAK,QAAQ;YAC1B,OAAO,MAAM,KAAK,QAAQ;YAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACtB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACtB,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,MAAa,EAAE,MAAa,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,MAAoB,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAChC,SAAsC;;IAEtC,MAAM,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAE1E,iEAAiE;IACjE,MAAM,gBAAgB,GACpB,CAAA,MAAA,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,MAAM,0CAAE,gBAAgB,KAAI,IAAA,qBAAc,EAAC,WAAW,CAAC,CAAC;IAErE,MAAM,yBAAyB,GAAG,IAAA,yBAAkB,EAClD,oCAAoC,EACpC,IAAI,CACL,CAAC;IACF,MAAM,qCAAqC,GAAG,IAAA,wBAAiB,EAC7D,kDAAkD,EAClD,IAAI,CACL,CAAC;IACF,MAAM,8BAA8B,GAAG,IAAA,qBAAc,EACnD,0CAA0C,EAC1C,yDAAyD,CAC1D,CAAC;IACF,MAAM,wBAAwB,GAAG,IAAA,qBAAc,EAC7C,mCAAmC,EACnC,0GAA0G,CAC3G,CAAC;IACF,MAAM,gBAAgB,GAAG,IAAA,qBAAc,EACrC,oBAAoB,EACpB,QAAQ,CAAC,kBAAkB,CAC5B,CAAC;IACF,sBAAsB;IACtB,MAAM,MAAM,GAAkB;QAC5B,aAAa,EAAE;YACb,YAAY,EAAE,MAAA,OAAO,CAAC,GAAG,CAAC,aAAa,0CAAE,KAAK,CAAC,GAAG,CAAC;YACnD,eAAe,EAAE,MAAA,OAAO,CAAC,GAAG,CAAC,gBAAgB,0CAAE,KAAK,CAAC,GAAG,CAAC;YACzD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB;YACvE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;YACtC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;gBACzC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;gBACrC,CAAC,CAAC,SAAS;YACb,UAAU,EAAE;gBACV,WAAW,EAAE;oBACX,OAAO,EAAE,yBAAyB;oBAClC,mBAAmB,EAAE,qCAAqC;oBAC1D,YAAY,EAAE,8BAA8B;oBAC5C,MAAM,EAAE,wBAAwB;iBACjC;aACF;YACD,aAAa,EAAE;gBACb,OAAO,EAAE,kBAAkB,EAAE;aAC9B;SACF;QACD,qBAAqB,EAAE,IAAA,wBAAiB,EACtC,yBAAyB,EACzB,QAAQ,CAAC,uBAAuB,CACjC;QACD,QAAQ,EAAG,OAAO,CAAC,GAAG,CAAC,SAAsB,IAAI,QAAQ,CAAC,SAAS;QACnE,MAAM,EAAE;YACN,gBAAgB;YAChB,aAAa,EAAE,IAAA,qBAAc,EAC3B,sBAAsB,EACtB,QAAQ,CAAC,oBAAoB,CAC9B;YACD,YAAY,EAAE,IAAA,qBAAc,EAC1B,qBAAqB,EACrB,QAAQ,CAAC,mBAAmB,CAC7B;YACD,UAAU,EAAE,IAAA,wBAAiB,EAC3B,mBAAmB,EACnB,QAAQ,CAAC,iBAAiB,CAC3B;YACD,UAAU,EAAE,IAAA,wBAAiB,EAC3B,mBAAmB,EACnB,QAAQ,CAAC,yBAAyB,CACnC;YACD,aAAa,EAAE,IAAA,wBAAiB,EAC9B,oBAAoB,EACpB,QAAQ,CAAC,kBAAkB,CAC5B;SACF;QACD,cAAc,EAAE;YACd,OAAO,EAAE,IAAI;YACb,gBAAgB,EACd,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB;SAC1E;QACD,aAAa,EAAE;YACb,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,eAIf;YACb,MAAM,EAAE;gBACN,gBAAgB;gBAChB,UAAU,EAAE,IAAA,wBAAiB,EAC3B,mBAAmB,EACnB,QAAQ,CAAC,iBAAiB,CAC3B;gBACD,UAAU,EAAE,IAAA,wBAAiB,EAC3B,mBAAmB,EACnB,QAAQ,CAAC,yBAAyB,CACnC;gBACD,eAAe,EACb,IAAA,wBAAiB,EAAC,oBAAoB,EAAE,QAAQ,CAAC,kBAAkB,CAAC;oBACpE,WAAI,CAAC,YAAY;aACpB;YACD,MAAM,EAAE;gBACN,KAAK,EAAE;oBACL,UAAU,EAAE,IAAA,qBAAc,EACxB,yBAAyB,EACzB,QAAQ,CAAC,uBAAuB,CACjC;oBACD,GAAG,EAAE,IAAA,qBAAc,EAAC,kBAAkB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;oBAClE,MAAM,EAAE,IAAA,qBAAc,EACpB,qBAAqB,EACrB,QAAQ,CAAC,mBAAmB,CAC7B;oBACD,UAAU,EAAE,IAAA,qBAAc,EACxB,0BAA0B,EAC1B,QAAQ,CAAC,wBAAwB,CAClC;iBACF;gBACD,gBAAgB,EAAE,IAAA,qBAAc,EAC9B,2BAA2B,EAC3B,QAAQ,CAAC,yBAAyB,CACnC;qBACE,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;qBAC9B,MAAM,CAAC,OAAO,CAAC;gBAClB,kBAAkB,EAAE,IAAA,qBAAc,EAChC,6BAA6B,EAC7B,QAAQ,CAAC,2BAA2B,CACrC;gBACD,gBAAgB,EAAE,IAAA,qBAAc,EAC9B,2BAA2B,EAC3B,QAAQ,CAAC,yBAAyB,CACnC;gBACD,qBAAqB,EAAE,IAAA,wBAAiB,EACtC,gCAAgC,EAChC,QAAQ,CAAC,8BAA8B,CACxC;gBACD,SAAS,EAAE;oBACT,QAAQ,EAAE;wBACR,GAAG,EAAE,IAAA,qBAAc,EACjB,oBAAoB,EACpB,QAAQ,CAAC,kBAAkB,CAC5B;wBACD,MAAM,EAAE,IAAA,qBAAc,EACpB,uBAAuB,EACvB,QAAQ,CAAC,qBAAqB,CAC/B;qBACF;oBACD,MAAM,EAAE;wBACN,GAAG,EAAE,IAAA,qBAAc,EAAC,kBAAkB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;wBAClE,MAAM,EAAE,IAAA,qBAAc,EACpB,qBAAqB,EACrB,QAAQ,CAAC,mBAAmB,CAC7B;qBACF;iBACF;gBACD,kBAAkB,EAAE,IAAA,wBAAiB,EACnC,6BAA6B,EAC7B,QAAQ,CAAC,2BAA2B,CACrC;gBACD,cAAc,EAAE,IAAA,wBAAiB,EAC/B,wBAAwB,EACxB,QAAQ,CAAC,sBAAsB,CAChC;aACF;YACD,UAAU,EAAE;gBACV,SAAS,EAAE,IAAA,qBAAc,EACvB,sBAAsB,EACtB,QAAQ,CAAC,oBAAoB,CAC9B;aACF;YACD,OAAO,EAAE;gBACP,cAAc,EAAE,IAAA,wBAAiB,EAC/B,0BAA0B,EAC1B,QAAQ,CAAC,wBAAwB,CAClC;gBACD,UAAU,EAAE,IAAA,wBAAiB,EAC3B,qBAAqB,EACrB,QAAQ,CAAC,mBAAmB,CAC7B;gBACD,WAAW,EAAE,IAAA,wBAAiB,EAC5B,uBAAuB,EACvB,QAAQ,CAAC,qBAAqB,CAC/B;aACF;SACF;QACD,GAAG,EAAE;YACH,gBAAgB;YAChB,kBAAkB,EAAE,qBAAqB,EAAE;SAC5C;QACD,MAAM,EAAE;YACN,eAAe,EAAE,IAAA,wBAAiB,EAChC,iCAAiC,EACjC,QAAQ,CAAC,+BAA+B,CACzC;YACD,gBAAgB,EAAE,IAAA,wBAAiB,EACjC,2BAA2B,EAC3B,QAAQ,CAAC,yBAAyB,CACnC;YACD,oBAAoB,EAAE,IAAA,yBAAkB,EACtC,+BAA+B,EAC/B,QAAQ,CAAC,6BAA6B,CACvC;SACF;KACF,CAAC;IAEF,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAEzD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,MAAM,EAAE,SAAmC,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,MAAqB;IACxD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEvD,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAEvB,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzB,OAAO,CAAC,GAAG,CACT,iBAAiB,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CACtE,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC;IAE3D,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtB,OAAO,CAAC,GAAG,CACT,qBAAqB,MAAM,CAAC,GAAG,CAAC,gBAAgB,IAAI,WAAW,EAAE,CAClE,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CACT,mBAAmB,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAClE,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,oBAAoB,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,CAAC,GAAG,CACT,sBAAsB,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,cAAc,EAAE,CACnE,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzB,OAAO,CAAC,GAAG,CAAC,4BAA4B,MAAM,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CAAC,6BAA6B,MAAM,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CACT,6BAA6B,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAClE,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;AAChC,CAAC"}

package/dist/config/network-allowlist.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Load allowed domains from environment
+ *
+ * Behavior:
+ * - Not set: Complete isolation (deny all)
+ * - "*": Unrestricted access (allow all)
+ * - "domain1,domain2": Allowlist mode (deny by default, allow only these)
+ */
+export declare function loadAllowedDomains(): string[];
+/**
+ * Check if unrestricted mode is enabled
+ */
+export declare function isUnrestrictedMode(allowedDomains: string[]): boolean;
+/**
+ * Load disallowed domains from environment
+ */
+export declare function loadDisallowedDomains(): string[];
+//# sourceMappingURL=network-allowlist.d.ts.map

package/dist/config/network-allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-allowlist.d.ts","sourceRoot":"","sources":["../../src/config/network-allowlist.ts"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CA6B7C;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAEpE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAiBhD"}

package/dist/config/network-allowlist.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadAllowedDomains = loadAllowedDomains;
+exports.isUnrestrictedMode = isUnrestrictedMode;
+exports.loadDisallowedDomains = loadDisallowedDomains;
+const core_1 = require("@lobu/core");
+const logger = (0, core_1.createLogger)("network-allowlist");
+/**
+ * Load allowed domains from environment
+ *
+ * Behavior:
+ * - Not set: Complete isolation (deny all)
+ * - "*": Unrestricted access (allow all)
+ * - "domain1,domain2": Allowlist mode (deny by default, allow only these)
+ */
+function loadAllowedDomains() {
+    const domains = [];
+    const allowedDomains = process.env.WORKER_ALLOWED_DOMAINS;
+    if (allowedDomains) {
+        const trimmed = allowedDomains.trim();
+        // Special case: * means unrestricted access
+        if (trimmed === "*") {
+            logger.debug("WORKER_ALLOWED_DOMAINS=* - unrestricted internet access");
+            return ["*"];
+        }
+        const parsed = trimmed
+            .split(",")
+            .map((d) => d.trim())
+            .filter((d) => d.length > 0);
+        domains.push(...parsed);
+        logger.debug(`Loaded ${parsed.length} allowed domains from WORKER_ALLOWED_DOMAINS`);
+    }
+    else {
+        logger.warn("⚠️  WORKER_ALLOWED_DOMAINS not set - workers will have NO internet access (complete isolation)");
+    }
+    return domains;
+}
+/**
+ * Check if unrestricted mode is enabled
+ */
+function isUnrestrictedMode(allowedDomains) {
+    return allowedDomains.length === 1 && allowedDomains[0] === "*";
+}
+/**
+ * Load disallowed domains from environment
+ */
+function loadDisallowedDomains() {
+    const domains = [];
+    const disallowedDomains = process.env.WORKER_DISALLOWED_DOMAINS;
+    if (disallowedDomains) {
+        const parsed = disallowedDomains
+            .split(",")
+            .map((d) => d.trim())
+            .filter((d) => d.length > 0);
+        domains.push(...parsed);
+        logger.debug(`Loaded ${parsed.length} disallowed domains from WORKER_DISALLOWED_DOMAINS`);
+    }
+    return domains;
+}
+//# sourceMappingURL=network-allowlist.js.map

package/dist/config/network-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-allowlist.js","sourceRoot":"","sources":["../../src/config/network-allowlist.ts"],"names":[],"mappings":";;AAYA,gDA6BC;AAKD,gDAEC;AAKD,sDAiBC;AAtED,qCAA0C;AAE1C,MAAM,MAAM,GAAG,IAAA,mBAAY,EAAC,mBAAmB,CAAC,CAAC;AAEjD;;;;;;;GAOG;AACH,SAAgB,kBAAkB;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC1D,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC;QAEtC,4CAA4C;QAC5C,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;YACxE,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,OAAO;aACnB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAE/B,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CACV,UAAU,MAAM,CAAC,MAAM,8CAA8C,CACtE,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CACT,gGAAgG,CACjG,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,cAAwB;IACzD,OAAO,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAChE,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,iBAAiB;aAC7B,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAE/B,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CACV,UAAU,MAAM,CAAC,MAAM,oDAAoD,CAC5E,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/connections/chat-instance-manager.d.ts

@@ -0,0 +1,107 @@
+/**
+ * ChatInstanceManager — manages Chat SDK instances for API-driven platform connections.
+ * Owns Redis persistence, Chat lifecycle, and webhook dispatch.
+ */
+import type { CoreServices, PlatformAdapter } from "../platform";
+import { type ConnectionSettings, type PlatformAdapterConfig, type PlatformConnection } from "./types";
+export declare const ADAPTER_FACTORIES: Record<string, (config: any) => Promise<any>>;
+interface ManagedInstance {
+    connection: PlatformConnection;
+    chat: any;
+    cleanup?: () => Promise<void>;
+    interactionCleanup?: () => void;
+}
+export declare class ChatInstanceManager {
+    private instances;
+    private redis;
+    private services;
+    private publicGatewayUrl;
+    initialize(services: CoreServices): Promise<void>;
+    shutdown(): Promise<void>;
+    addConnection(platform: string, templateAgentId: string | undefined, config: PlatformAdapterConfig, settings?: ConnectionSettings, metadata?: Record<string, any>): Promise<PlatformConnection>;
+    removeConnection(id: string): Promise<void>;
+    restartConnection(id: string): Promise<void>;
+    stopConnection(id: string): Promise<void>;
+    updateConnection(id: string, updates: {
+        templateAgentId?: string | null;
+        config?: PlatformAdapterConfig;
+        settings?: ConnectionSettings;
+        metadata?: Record<string, any>;
+    }): Promise<PlatformConnection>;
+    listConnections(filter?: {
+        platform?: string;
+        templateAgentId?: string;
+    }): Promise<PlatformConnection[]>;
+    getConnection(id: string): Promise<PlatformConnection | null>;
+    has(id: string): boolean;
+    getInstance(id: string): ManagedInstance | undefined;
+    /** Get a decrypted secret from a running connection's config. */
+    getConnectionConfigSecret(connectionId: string, field: string): string | undefined;
+    handleWebhook(connectionId: string, request: Request): Promise<Response>;
+    getServices(): CoreServices;
+    findSlackConnectionByTeamId(teamId: string): Promise<PlatformConnection | null>;
+    getDefaultSlackConnection(): Promise<PlatformConnection | null>;
+    ensureSlackWorkspaceConnection(teamId: string, installation: {
+        botToken: string;
+        botUserId?: string;
+        teamName?: string;
+    }): Promise<PlatformConnection>;
+    completeSlackOAuthInstall(request: Request, redirectUri?: string): Promise<{
+        teamId: string;
+        teamName?: string;
+        connectionId: string;
+    }>;
+    handleSlackAppWebhook(request: Request): Promise<Response>;
+    private startInstance;
+    private createAdapter;
+    private createStateAdapter;
+    /**
+     * Register slash commands with the platform's native command menu.
+     * Currently supports Telegram (setMyCommands) and Slack (via manifest).
+     */
+    private registerPlatformCommands;
+    private resolveSlackAdapterConfig;
+    private createSlackOAuthChat;
+    private cloneRequestWithBody;
+    private extractSlackTeamId;
+    private ensureConnectionRunning;
+    private persistConnection;
+    private encryptConfig;
+    private decryptConfig;
+    /** Return connection with secrets redacted for API responses. */
+    private sanitizeConnection;
+    /**
+     * Create PlatformAdapter objects for each chat platform.
+     * These are lightweight adapters that delegate to this manager.
+     */
+    createPlatformAdapters(): PlatformAdapter[];
+    private createPlatformAdapter;
+    private extractPlatformRoutingInfo;
+    sendPlatformMessage(name: string, message: string, options: {
+        agentId: string;
+        channelId: string;
+        conversationId?: string;
+        teamId: string;
+        files?: Array<{
+            buffer: Buffer;
+            filename: string;
+        }>;
+    }): Promise<{
+        messageId: string;
+        eventsUrl?: string;
+        queued?: boolean;
+    }>;
+    getPlatformConversationHistory(name: string, channelId: string, _conversationId: string | undefined, limit: number, before: string | undefined): Promise<{
+        messages: Array<{
+            timestamp: string;
+            user: string;
+            text: string;
+            isBot?: boolean;
+        }>;
+        nextCursor: string | null;
+        hasMore: boolean;
+    }>;
+    private selectConnectionForPlatform;
+}
+export {};
+//# sourceMappingURL=chat-instance-manager.d.ts.map

package/dist/connections/chat-instance-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-instance-manager.d.ts","sourceRoot":"","sources":["../../src/connections/chat-instance-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,KAAK,kBAAkB,EAEvB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACxB,MAAM,SAAS,CAAC;AAYjB,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAczE,CAAC;AAEJ,UAAU,eAAe;IACvB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,IAAI,EAAE,GAAG,CAAC;IACV,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAC;CACjC;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,SAAS,CAAsC;IACvD,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,gBAAgB,CAAM;IAExB,UAAU,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAmFjD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAsBzB,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,CAAC,EAAE,kBAAkB,EAC7B,QAAQ,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,GACjC,OAAO,CAAC,kBAAkB,CAAC;IAmCxB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsB3C,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA6B5C,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBzC,gBAAgB,CACpB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QACP,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,MAAM,CAAC,EAAE,qBAAqB,CAAC;QAC/B,QAAQ,CAAC,EAAE,kBAAkB,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAChC,GACA,OAAO,CAAC,kBAAkB,CAAC;IAoExB,eAAe,CAAC,MAAM,CAAC,EAAE;QAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAqB3B,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAMnE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIxB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAIpD,iEAAiE;IACjE,yBAAyB,CACvB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS;IAQf,aAAa,CACjB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,QAAQ,CAAC;IA2BpB,WAAW,IAAI,YAAY;IAIrB,2BAA2B,CAC/B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAS/B,yBAAyB,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAW/D,8BAA8B,CAClC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GACA,OAAO,CAAC,kBAAkB,CAAC;IAsCxB,yBAAyB,CAC7B,OAAO,EAAE,OAAO,EAChB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IAiDI,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;YAgDlD,aAAa;YA6Gb,aAAa;YAQb,kBAAkB;IAShC;;;OAGG;YACW,wBAAwB;IAqCtC,OAAO,CAAC,yBAAyB;YAmEnB,oBAAoB;IAoBlC,OAAO,CAAC,oBAAoB;IAW5B,OAAO,CAAC,kBAAkB;YA0CZ,uBAAuB;YA2BvB,iBAAiB;IAwB/B,OAAO,CAAC,aAAa;IAcrB,OAAO,CAAC,aAAa;IAqBrB,iEAAiE;IACjE,OAAO,CAAC,kBAAkB;IAoB1B;;;OAGG;IACH,sBAAsB,IAAI,eAAe,EAAE;IAM3C,OAAO,CAAC,qBAAqB;IAsD7B,OAAO,CAAC,0BAA0B;IAmC5B,mBAAmB,CACvB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACrD,GACA,OAAO,CAAC;QACT,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IAyDI,8BAA8B,CAClC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,OAAO,CAAC;QACT,QAAQ,EAAE,KAAK,CAAC;YACd,SAAS,EAAE,MAAM,CAAC;YAClB,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,CAAC,EAAE,OAAO,CAAC;SACjB,CAAC,CAAC;QACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;YAoDY,2BAA2B;CA6B1C"}