@maravilla-labs/adapter-core 3.4.0 → 4.1.0

package/dist/build-failure.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Shared failure reporting for the workflows / events adapter steps.
+ *
+ * Both steps used to catch build errors, call `log?.error(...)`, and return —
+ * so the adapter build finished green and the deployment shipped without the
+ * bundle. Worse, `log` is optional and three of the four adapters pass nothing,
+ * so on those frameworks the failure produced no output at all (issue #94).
+ *
+ * A build error here is always fatal: the caller only gets this far after
+ * confirming the project actually has sources to build.
+ */
+export type AdapterLog = {
+    minor: (msg: string) => void;
+    error: (msg: string) => void;
+    warn: (msg: string) => void;
+};
+/**
+ * Report a fatal build failure and throw.
+ *
+ * Writes to `console.error` unconditionally — not just through the optional
+ * `log` — so the message survives on adapters that pass no logger.
+ */
+export declare function failBuild(what: 'workflows' | 'events', error: unknown, log?: AdapterLog): never;
+/**
+ * Error thrown when the build API itself can't be resolved. That means a
+ * broken or partial install of `@maravilla-labs/functions`, which is very
+ * different from "this project has no workflows" — the old code returned
+ * silent no-op stubs and the two were indistinguishable.
+ */
+export declare function missingBuildApi(what: 'workflows' | 'events', attempted: string[]): Error;
+//# sourceMappingURL=build-failure.d.ts.map

package/dist/build-failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-failure.d.ts","sourceRoot":"","sources":["../src/build-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,UAAU,GAAG,KAAK,CAQ/F;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAOxF"}

package/dist/build-failure.js

@@ -0,0 +1,37 @@
+/**
+ * Shared failure reporting for the workflows / events adapter steps.
+ *
+ * Both steps used to catch build errors, call `log?.error(...)`, and return —
+ * so the adapter build finished green and the deployment shipped without the
+ * bundle. Worse, `log` is optional and three of the four adapters pass nothing,
+ * so on those frameworks the failure produced no output at all (issue #94).
+ *
+ * A build error here is always fatal: the caller only gets this far after
+ * confirming the project actually has sources to build.
+ */
+/**
+ * Report a fatal build failure and throw.
+ *
+ * Writes to `console.error` unconditionally — not just through the optional
+ * `log` — so the message survives on adapters that pass no logger.
+ */
+export function failBuild(what, error, log) {
+    const message = error?.message || String(error);
+    const banner = `Failed to build ${what} — aborting build so this is not silently deployed.`;
+    log?.error(banner);
+    console.error(`\n${banner}\n${message}\n`);
+    throw error instanceof Error ? error : new Error(message);
+}
+/**
+ * Error thrown when the build API itself can't be resolved. That means a
+ * broken or partial install of `@maravilla-labs/functions`, which is very
+ * different from "this project has no workflows" — the old code returned
+ * silent no-op stubs and the two were indistinguishable.
+ */
+export function missingBuildApi(what, attempted) {
+    return new Error(`Cannot load the ${what} build API — @maravilla-labs/functions did not resolve.\n` +
+        `Tried: ${attempted.join(', ')}\n\n` +
+        `This project has ${what} sources, so they cannot be skipped.\n` +
+        'Install the package (npm i -D @maravilla-labs/functions) and rebuild.');
+}
+//# sourceMappingURL=build-failure.js.map

package/dist/build-failure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-failure.js","sourceRoot":"","sources":["../src/build-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,IAA4B,EAAE,KAAc,EAAE,GAAgB;IACtF,MAAM,OAAO,GAAI,KAAe,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,mBAAmB,IAAI,qDAAqD,CAAC;IAE5F,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC;IAE3C,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAA4B,EAAE,SAAmB;IAC/E,OAAO,IAAI,KAAK,CACd,mBAAmB,IAAI,2DAA2D;QAChF,UAAU,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;QACpC,oBAAoB,IAAI,wCAAwC;QAChE,uEAAuE,CAC1E,CAAC;AACJ,CAAC"}

package/dist/config-loader.d.ts

@@ -1,4 +1,4 @@
-import type { AuthConfigBlock, DatabaseConfigBlock, DocumentIndexDeclaration, StudioConfigBlock } from './types.js';
+import type { AuthConfigBlock, DatabaseConfigBlock, DocumentIndexDeclaration, StudioConfigBlock, RealtimeConfigBlock, SecurityConfigBlock, ProxyConfigBlock } from './types.js';
 import type { TransformsConfig } from './transforms/index.js';
 export interface MaravillaConfig {
     auth?: AuthConfigBlock;
@@ -17,6 +17,23 @@ export interface MaravillaConfig {
      * `crates/dev-server/src/config_loader.rs`'s `StudioConfig`.
      */
     studio?: StudioConfigBlock;
+    /**
+     * Realtime settings — today which channels keep a replayable message history.
+     * Mirrors `RealtimeConfigBlock` in `packages/platform/src/config.ts`.
+     */
+    realtime?: RealtimeConfigBlock;
+    /**
+     * Security settings — today the extra origins allowed to frame this site.
+     * Mirrors `SecurityConfigBlock` in `packages/adapter-core/src/types.ts`.
+     */
+    security?: SecurityConfigBlock;
+    /**
+     * Reverse-proxy mounts — paths served by forwarding to an external origin.
+     * Mirrors `ProxyConfigBlock` in `packages/adapter-core/src/types.ts` and the
+     * Rust `ProxyManifest` in
+     * `crates/server-integration/src/manifest/proxy.rs`.
+     */
+    proxy?: ProxyConfigBlock;
 }
 export interface OAuthProviderDefinition {
     enabled: boolean;
@@ -47,4 +64,5 @@ export declare class ConfigError extends Error {
 export declare function loadMaravillaConfig(projectRoot: string): Promise<LoadResult>;
 export declare function normalizeDocumentIndex(raw: unknown, file: string, path: string): DocumentIndexDeclaration;
 export type { AuthConfigBlock, DatabaseConfigBlock, DocumentIndexDeclaration, VectorIndexDeclaration, } from './types.js';
+export declare function normalizeProxy(raw: unknown, file: string, field: string): ProxyConfigBlock;
 //# sourceMappingURL=config-loader.d.ts.map

package/dist/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../src/config-loader.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,EAElB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAe9D,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AACD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,SAAS,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AACD,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAWjD,MAAM,WAAW,UAAU;IACzB,0EAA0E;IAC1E,MAAM,EAAE,eAAe,CAAC;IACxB,8EAA8E;IAC9E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,qBAAa,WAAY,SAAQ,KAAK;aAGlB,IAAI,EAAE,MAAM,GAAG,IAAI;aACnB,KAAK,CAAC,EAAE,MAAM;gBAF9B,OAAO,EAAE,MAAM,EACC,IAAI,GAAE,MAAM,GAAG,IAAW,EAC1B,KAAK,CAAC,EAAE,MAAM,YAAA;CASjC;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAkBlF;AAkKD,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,wBAAwB,CAkC1B;AA8ND,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../src/config-loader.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAKjB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAe9D,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AACD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,SAAS,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AACD,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAWjD,MAAM,WAAW,UAAU;IACzB,0EAA0E;IAC1E,MAAM,EAAE,eAAe,CAAC;IACxB,8EAA8E;IAC9E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,qBAAa,WAAY,SAAQ,KAAK;aAGlB,IAAI,EAAE,MAAM,GAAG,IAAI;aACnB,KAAK,CAAC,EAAE,MAAM;gBAF9B,OAAO,EAAE,MAAM,EACC,IAAI,GAAE,MAAM,GAAG,IAAW,EAC1B,KAAK,CAAC,EAAE,MAAM,YAAA;CASjC;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAkBlF;AAoQD,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,wBAAwB,CAkC1B;AA8ND,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AA8WpB,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,gBAAgB,CAqB1F"}

package/dist/config-loader.js

@@ -162,6 +162,94 @@ function normalize(raw, file) {
     if (src.studio !== undefined) {
         out.studio = normalizeStudio(src.studio, file, 'studio');
     }
+    if (src.realtime !== undefined) {
+        out.realtime = normalizeRealtime(src.realtime, file, 'realtime');
+    }
+    if (src.security !== undefined) {
+        out.security = normalizeSecurity(src.security, file, 'security');
+    }
+    if (src.proxy !== undefined) {
+        out.proxy = normalizeProxy(src.proxy, file, 'proxy');
+    }
+    return out;
+}
+// ── Security normalization ──
+//
+// Validated here rather than passed through, because a malformed source is
+// silent at every later layer: the manifest carries it, delivery unions it into
+// the CSP, and the browser drops the whole `frame-ancestors` directive it
+// cannot parse — which reads as "the platform ignored my setting", not as a
+// typo. A path, a port-less scheme mismatch or a bare `*` are the common ones.
+/**
+ * A CSP `frame-ancestors` source we accept: `'self'`, `'none'`, or an
+ * http(s) origin with an optional single leading `*.` label and no path.
+ * A bare `*` is rejected on purpose — it is almost never what the author
+ * means, and it cannot be narrowed later without breaking whoever relied on it.
+ */
+function validateFrameAncestor(value, file, field) {
+    if (value === "'self'" || value === "'none'")
+        return value;
+    if (!/^https?:\/\//.test(value)) {
+        throw new ConfigError(`${field} must be 'self', 'none', or an https:// origin (got ${JSON.stringify(value)})`, file);
+    }
+    const rest = value.replace(/^https?:\/\//, '');
+    if (rest.includes('/')) {
+        throw new ConfigError(`${field} must be an origin with no path (got ${JSON.stringify(value)})`, file);
+    }
+    const host = rest.split(':')[0];
+    if (host === '*' || host.length === 0) {
+        throw new ConfigError(`${field} must name a host, not a bare wildcard`, file);
+    }
+    const labels = host.startsWith('*.') ? host.slice(2) : host;
+    if (labels.includes('*')) {
+        throw new ConfigError(`${field} allows at most one leading '*.' label (got ${JSON.stringify(value)})`, file);
+    }
+    return value;
+}
+function normalizeSecurity(raw, file, field) {
+    const obj = expectObject(raw, file, field);
+    const out = {};
+    if (obj.frameAncestors !== undefined) {
+        if (!Array.isArray(obj.frameAncestors)) {
+            throw new ConfigError(`${field}.frameAncestors must be an array of origins`, file);
+        }
+        out.frameAncestors = obj.frameAncestors.map((v, i) => {
+            if (typeof v !== 'string' || v.length === 0) {
+                throw new ConfigError(`${field}.frameAncestors[${i}] must be a non-empty string`, file);
+            }
+            return validateFrameAncestor(v, file, `${field}.frameAncestors[${i}]`);
+        });
+    }
+    return out;
+}
+// ── Realtime normalization ──
+//
+// Validated here rather than passed through, because a typo in `channels` is
+// silent at every later layer: the manifest carries it, registration accepts it,
+// and the only symptom is a replay that returns nothing.
+function normalizeRealtime(raw, file, field) {
+    const obj = expectObject(raw, file, field);
+    const out = {};
+    if (obj.history !== undefined) {
+        const h = expectObject(obj.history, file, `${field}.history`);
+        if (!Array.isArray(h.channels)) {
+            throw new ConfigError(`${field}.history.channels must be an array of channel patterns`, file);
+        }
+        const channels = h.channels.map((c, i) => {
+            if (typeof c !== 'string' || c.length === 0) {
+                throw new ConfigError(`${field}.history.channels[${i}] must be a non-empty string`, file);
+            }
+            return c;
+        });
+        const history = { channels };
+        if (h.maxMessages !== undefined) {
+            if (typeof h.maxMessages !== 'number' || !Number.isFinite(h.maxMessages) || h.maxMessages < 0) {
+                throw new ConfigError(`${field}.history.maxMessages must be a non-negative number`, file);
+            }
+            history.maxMessages = h.maxMessages;
+        }
+        out.history = history;
+    }
     return out;
 }
 // ── Studio normalization ──
@@ -416,4 +504,334 @@ function errMsg(e) {
         return e.message;
     return String(e);
 }
+// ── Proxy normalization ──
+//
+// A proxy mount is the one config block that can reach OUT of the platform, so
+// it is validated hardest and at build time: a bad target here is not a broken
+// page, it is a request the platform makes on the author's behalf. Two classes
+// of mistake are caught rather than deployed:
+//
+//  * a target naming a private or loopback address, which would turn a
+//    tenant-authored config into a request-forgery primitive against the
+//    platform's own internal APIs (delivery's `/_internal/*` listens on
+//    loopback). Delivery re-checks this at request time — including what the
+//    hostname actually resolves to — but a config that can never work should
+//    fail the build, not each request.
+//  * a mount that shadows a platform path (`/_auth/*`, `/_assets/*`, …), which
+//    would silently break login, assets or realtime for the whole site.
+/**
+ * Path prefixes delivery owns. A mount may not claim any of them: the site's
+ * own login pages, asset serving, realtime sockets and health endpoints all
+ * live here, and a mount that swallowed one would break the site in a way whose
+ * cause is invisible from the app's own code.
+ */
+const RESERVED_PROXY_PREFIXES = [
+    '/_assets', '/_auth', '/_rt', '/_push', '/_internal', '/_mcp', '/_queue',
+    '/health', '/stats', '/metrics', '/.well-known',
+];
+/** Methods we will forward. Anything else is a config error, not a 405 at runtime. */
+const PROXY_METHODS = new Set([
+    'GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS',
+]);
+/**
+ * Headers a mount may not set on the upstream request or on our response.
+ * These are either connection-scoped (the HTTP client owns them) or the
+ * proxy's own bookkeeping, and letting config forge them makes the hop
+ * unreadable — an upstream trusting `X-Forwarded-For` would trust whatever the
+ * config said instead of the real client.
+ */
+const PROXY_FORBIDDEN_HEADERS = new Set([
+    'host', 'connection', 'keep-alive', 'transfer-encoding', 'upgrade', 'te',
+    'trailer', 'proxy-authorization', 'proxy-authenticate', 'content-length',
+    'x-forwarded-for', 'x-forwarded-proto', 'x-forwarded-host',
+]);
+/**
+ * Reject a target that names the platform's own network. Literal-IP checks
+ * cover the direct attempt; the hostname list covers the obvious names. A
+ * hostname that *resolves* into private space is caught by delivery at request
+ * time — that check cannot be done honestly here, since the build machine's
+ * DNS is not the server's.
+ */
+function isPrivateHost(host) {
+    const h = host.toLowerCase();
+    if (h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local') || h.endsWith('.internal')) {
+        return true;
+    }
+    // IPv6 literal, as it appears in a URL: [::1]
+    if (h.startsWith('[')) {
+        const inner = h.slice(1, h.endsWith(']') ? -1 : undefined);
+        if (inner === '::1' || inner === '::')
+            return true;
+        // fc00::/7 (unique-local) and fe80::/10 (link-local)
+        if (/^f[cd][0-9a-f]{2}:/.test(inner) || /^fe[89ab][0-9a-f]:/.test(inner))
+            return true;
+        return false;
+    }
+    const v4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(h);
+    if (!v4)
+        return false;
+    const [a, b] = [Number(v4[1]), Number(v4[2])];
+    if (a === 127 || a === 0 || a === 10)
+        return true;
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    if (a === 192 && b === 168)
+        return true;
+    if (a === 169 && b === 254)
+        return true; // link-local, incl. cloud metadata
+    if (a === 100 && b >= 64 && b <= 127)
+        return true; // CGNAT
+    return false;
+}
+function normalizeProxyTarget(raw, file, field) {
+    if (typeof raw !== 'string' || raw.length === 0) {
+        throw new ConfigError(`${field} must be a non-empty http(s) URL`, file);
+    }
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new ConfigError(`${field} must be an absolute URL (got ${JSON.stringify(raw)})`, file);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new ConfigError(`${field} must use http:// or https:// (got ${url.protocol})`, file);
+    }
+    if (url.search || url.hash) {
+        throw new ConfigError(`${field} must not carry a query string or fragment — the visitor's own query is forwarded`, file);
+    }
+    if (url.username || url.password) {
+        throw new ConfigError(`${field} must not embed credentials — use requestHeaders for an upstream secret`, file);
+    }
+    if (isPrivateHost(url.hostname)) {
+        throw new ConfigError(`${field} names a private or loopback address (${url.hostname}); a proxy target must be a public origin`, file);
+    }
+    // Normalize: keep an explicit base path, drop the trailing slash so joining
+    // is unambiguous later (`/site` + `/cart`, never `/site//cart`).
+    const basePath = url.pathname.replace(/\/+$/, '');
+    return `${url.protocol}//${url.host}${basePath}`;
+}
+function normalizeProxyPath(raw, file, field) {
+    if (typeof raw !== 'string' || raw.length === 0) {
+        throw new ConfigError(`${field} must be a non-empty path`, file);
+    }
+    if (!raw.startsWith('/')) {
+        throw new ConfigError(`${field} must start with '/' (got ${JSON.stringify(raw)})`, file);
+    }
+    if (raw.includes('?') || raw.includes('#')) {
+        throw new ConfigError(`${field} must be a path with no query or fragment`, file);
+    }
+    const star = raw.indexOf('*');
+    if (star !== -1 && !raw.endsWith('/*')) {
+        throw new ConfigError(`${field} may only use a trailing '/*' wildcard (got ${JSON.stringify(raw)})`, file);
+    }
+    const mount = raw.endsWith('/*') ? raw.slice(0, -2) : raw.replace(/\/+$/, '');
+    if (mount === '') {
+        // '/*' — the whole site. Legal, but then nothing of ours is left to serve.
+        throw new ConfigError(`${field} may not mount the whole site ('/*') — proxy the sections that live elsewhere`, file);
+    }
+    const lower = mount.toLowerCase();
+    for (const reserved of RESERVED_PROXY_PREFIXES) {
+        if (lower === reserved || lower.startsWith(`${reserved}/`)) {
+            throw new ConfigError(`${field} may not claim ${reserved} — that path belongs to the platform`, file);
+        }
+    }
+    return raw;
+}
+function normalizeProxyHeaders(raw, file, field) {
+    const obj = expectObject(raw, file, field);
+    const out = {};
+    for (const [name, value] of Object.entries(obj)) {
+        const lower = name.toLowerCase();
+        if (!/^[!#$%&'*+\-.^_`|~0-9a-z]+$/.test(lower)) {
+            throw new ConfigError(`${field}: ${JSON.stringify(name)} is not a valid header name`, file);
+        }
+        if (PROXY_FORBIDDEN_HEADERS.has(lower)) {
+            throw new ConfigError(`${field}: ${name} is set by the proxy itself and cannot be overridden`, file);
+        }
+        if (typeof value !== 'string') {
+            throw new ConfigError(`${field}.${name} must be a string`, file);
+        }
+        if (/[\r\n]/.test(value)) {
+            throw new ConfigError(`${field}.${name} must not contain a newline`, file);
+        }
+        out[lower] = value;
+    }
+    return out;
+}
+function expectPositiveInt(raw, file, field, max) {
+    if (typeof raw !== 'number' || !Number.isFinite(raw) || raw < 0 || !Number.isInteger(raw)) {
+        throw new ConfigError(`${field} must be a non-negative whole number`, file);
+    }
+    if (max !== undefined && raw > max) {
+        throw new ConfigError(`${field} must be at most ${max}`, file);
+    }
+    return raw;
+}
+function normalizeStringArray(raw, file, field) {
+    const arr = expectArray(raw, file, field);
+    return arr.map((v, i) => {
+        if (typeof v !== 'string' || v.length === 0) {
+            throw new ConfigError(`${field}[${i}] must be a non-empty string`, file);
+        }
+        return v;
+    });
+}
+/**
+ * Validate a list of path patterns — the grammar shared by `blockPaths` and
+ * `cache.bypassPaths`. Kept as one function so the two can never drift apart:
+ * an author who learns the grammar in one field should not find it means
+ * something else in the other.
+ */
+function normalizePathPatterns(raw, file, field) {
+    return normalizeStringArray(raw, file, field).map((p, i) => {
+        if (!p.startsWith('/')) {
+            throw new ConfigError(`${field}[${i}] must start with '/' (got ${JSON.stringify(p)})`, file);
+        }
+        const star = p.indexOf('*');
+        if (star !== -1 && star !== p.length - 1) {
+            throw new ConfigError(`${field}[${i}] may only use a trailing '*' (got ${JSON.stringify(p)})`, file);
+        }
+        return p;
+    });
+}
+function normalizeProxyCache(raw, file, field) {
+    const obj = expectObject(raw, file, field);
+    const out = {};
+    if (obj.ttl !== undefined)
+        out.ttl = expectPositiveInt(obj.ttl, file, `${field}.ttl`, 31536000);
+    if (obj.staleWhileRevalidate !== undefined) {
+        out.staleWhileRevalidate = expectPositiveInt(obj.staleWhileRevalidate, file, `${field}.staleWhileRevalidate`, 31536000);
+    }
+    if (obj.methods !== undefined) {
+        out.methods = normalizeStringArray(obj.methods, file, `${field}.methods`).map((m) => {
+            const upper = m.toUpperCase();
+            if (upper !== 'GET' && upper !== 'HEAD') {
+                throw new ConfigError(`${field}.methods may only contain GET or HEAD — caching a ${upper} would serve one visitor's write to the next`, file);
+            }
+            return upper;
+        });
+    }
+    if (obj.ignoreUpstreamCacheControl !== undefined) {
+        if (typeof obj.ignoreUpstreamCacheControl !== 'boolean') {
+            throw new ConfigError(`${field}.ignoreUpstreamCacheControl must be a boolean`, file);
+        }
+        out.ignoreUpstreamCacheControl = obj.ignoreUpstreamCacheControl;
+    }
+    if (obj.varyHeaders !== undefined) {
+        out.varyHeaders = normalizeStringArray(obj.varyHeaders, file, `${field}.varyHeaders`)
+            .map((h) => h.toLowerCase());
+    }
+    if (obj.bypassPaths !== undefined) {
+        out.bypassPaths = normalizePathPatterns(obj.bypassPaths, file, `${field}.bypassPaths`);
+    }
+    if (obj.bypassCookies !== undefined) {
+        if (typeof obj.bypassCookies !== 'boolean') {
+            throw new ConfigError(`${field}.bypassCookies must be a boolean`, file);
+        }
+        out.bypassCookies = obj.bypassCookies;
+    }
+    if (obj.maxBodyBytes !== undefined) {
+        out.maxBodyBytes = expectPositiveInt(obj.maxBodyBytes, file, `${field}.maxBodyBytes`, 33554432);
+    }
+    return out;
+}
+function normalizeProxyRewrite(raw, file, field) {
+    const obj = expectObject(raw, file, field);
+    const out = {};
+    if (obj.links !== undefined) {
+        if (typeof obj.links !== 'boolean') {
+            throw new ConfigError(`${field}.links must be a boolean`, file);
+        }
+        out.links = obj.links;
+    }
+    if (obj.hosts !== undefined) {
+        out.hosts = normalizeStringArray(obj.hosts, file, `${field}.hosts`).map((h, i) => {
+            const host = h.toLowerCase();
+            if (host.includes('/') || host.includes(':')) {
+                throw new ConfigError(`${field}.hosts[${i}] must be a bare hostname, no scheme, port or path (got ${JSON.stringify(h)})`, file);
+            }
+            return host;
+        });
+    }
+    if (obj.contentTypes !== undefined) {
+        out.contentTypes = normalizeStringArray(obj.contentTypes, file, `${field}.contentTypes`)
+            .map((t) => t.toLowerCase());
+    }
+    if (obj.setCookieDomain !== undefined) {
+        if (typeof obj.setCookieDomain !== 'boolean') {
+            throw new ConfigError(`${field}.setCookieDomain must be a boolean`, file);
+        }
+        out.setCookieDomain = obj.setCookieDomain;
+    }
+    if (obj.maxBodyBytes !== undefined) {
+        out.maxBodyBytes = expectPositiveInt(obj.maxBodyBytes, file, `${field}.maxBodyBytes`, 67108864);
+    }
+    return out;
+}
+function normalizeProxyRoute(raw, file, field) {
+    const obj = expectObject(raw, file, field);
+    const out = {
+        path: normalizeProxyPath(obj.path, file, `${field}.path`),
+        target: normalizeProxyTarget(obj.target, file, `${field}.target`),
+    };
+    if (obj.stripPrefix !== undefined) {
+        if (typeof obj.stripPrefix !== 'boolean') {
+            throw new ConfigError(`${field}.stripPrefix must be a boolean`, file);
+        }
+        out.stripPrefix = obj.stripPrefix;
+    }
+    if (obj.preserveHostHeader !== undefined) {
+        if (typeof obj.preserveHostHeader !== 'boolean') {
+            throw new ConfigError(`${field}.preserveHostHeader must be a boolean`, file);
+        }
+        out.preserveHostHeader = obj.preserveHostHeader;
+    }
+    if (obj.methods !== undefined) {
+        out.methods = normalizeStringArray(obj.methods, file, `${field}.methods`).map((m) => {
+            const upper = m.toUpperCase();
+            if (!PROXY_METHODS.has(upper)) {
+                throw new ConfigError(`${field}.methods: ${JSON.stringify(m)} is not a forwardable method`, file);
+            }
+            return upper;
+        });
+    }
+    if (obj.blockPaths !== undefined) {
+        out.blockPaths = normalizePathPatterns(obj.blockPaths, file, `${field}.blockPaths`);
+    }
+    if (obj.timeoutMs !== undefined) {
+        out.timeoutMs = expectPositiveInt(obj.timeoutMs, file, `${field}.timeoutMs`, 120000);
+    }
+    if (obj.cache !== undefined)
+        out.cache = normalizeProxyCache(obj.cache, file, `${field}.cache`);
+    if (obj.rewrite !== undefined) {
+        out.rewrite = normalizeProxyRewrite(obj.rewrite, file, `${field}.rewrite`);
+    }
+    if (obj.requestHeaders !== undefined) {
+        out.requestHeaders = normalizeProxyHeaders(obj.requestHeaders, file, `${field}.requestHeaders`);
+    }
+    if (obj.responseHeaders !== undefined) {
+        out.responseHeaders = normalizeProxyHeaders(obj.responseHeaders, file, `${field}.responseHeaders`);
+    }
+    return out;
+}
+export function normalizeProxy(raw, file, field) {
+    const obj = expectObject(raw, file, field);
+    const out = {};
+    if (obj.routes !== undefined) {
+        const arr = expectArray(obj.routes, file, `${field}.routes`);
+        const routes = arr.map((r, i) => normalizeProxyRoute(r, file, `${field}.routes[${i}]`));
+        // Two mounts on the same path is not a precedence question, it is a typo:
+        // the second is unreachable and its author will never see why.
+        const seen = new Set();
+        for (const route of routes) {
+            if (seen.has(route.path)) {
+                throw new ConfigError(`${field}.routes: ${route.path} is mounted twice — the second one can never match`, file);
+            }
+            seen.add(route.path);
+        }
+        out.routes = routes;
+    }
+    return out;
+}
 //# sourceMappingURL=config-loader.js.map