@naylence/runtime 0.3.21 → 0.4.1

package/dist/esm/naylence/fame/sentinel/sentinel.js

@@ -20,7 +20,7 @@ import { AsyncEvent } from '../util/async-event.js';
 import { AsyncLock } from '../util/lock.js';
 import { createResource } from '../connector/connector-factory.js';
 import { UpstreamSessionManager } from '../node/upstream-session-manager.js';
-import { emitDeliveryNack, RouterState } from './router.js';
+import { Drop, emitDeliveryNack, RouterState, } from './router.js';
 const logger = getLogger('naylence.fame.sentinel.sentinel');
 const ALLOWED_BEFORE_ATTACH = new Set(['NodeAttach']);
 const SYSTEM_INBOX = '__sys__';
@@ -280,8 +280,11 @@ export class Sentinel extends FameNode {
             }
         }
         const state = this.buildRouterState();
-        const action = await this.routingPolicy.decide(processedEnvelope, state, context);
-        await action.execute(processedEnvelope, this, state, context);
+        let action = await this.routingPolicy.decide(processedEnvelope, state, context);
+        // Dispatch onRoutingActionSelected hook to allow authorization/replacement
+        // The hook must return the action to execute; null/undefined/throw => Drop
+        const actionToExecute = await this.dispatchRoutingActionSelected(processedEnvelope, action, state, context);
+        await actionToExecute.execute(processedEnvelope, this, state, context);
     }
     async forwardToRoute(nextSegment, envelope, context) {
         if (this.originMatches(context, nextSegment, DeliveryOriginType.DOWNSTREAM)) {
@@ -827,6 +830,47 @@ export class Sentinel extends FameNode {
             });
         }
     }
+    /**
+     * Dispatches the onRoutingActionSelected event to all event listeners.
+     *
+     * This allows listeners (like DefaultSecurityManager) to authorize
+     * routing actions and optionally replace them with Deny actions.
+     *
+     * The hook must return the RoutingAction to execute. If a listener returns
+     * null, undefined, or throws, the router will execute a Drop action.
+     *
+     * @param envelope - The envelope being routed
+     * @param selected - The RoutingAction selected by the routing policy
+     * @param state - The current router state
+     * @param context - Optional delivery context
+     * @returns The RoutingAction to execute (never null/undefined)
+     */
+    async dispatchRoutingActionSelected(envelope, selected, state, context) {
+        let currentAction = selected;
+        for (const listener of this.eventListeners) {
+            if (typeof listener.onRoutingActionSelected !== 'function') {
+                continue;
+            }
+            try {
+                const result = await listener.onRoutingActionSelected(this, envelope, currentAction, state, context);
+                // null/undefined => treat as denial, execute Drop
+                if (result == null) {
+                    return new Drop();
+                }
+                // Update current action for next listener in chain
+                currentAction = result;
+            }
+            catch (error) {
+                // Hook threw => treat as denial, execute Drop
+                logger.warning('routing_action_hook_error', {
+                    envp_id: envelope.id,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                return new Drop();
+            }
+        }
+        return currentAction;
+    }
     static async aserve(options = {}) {
         const { logLevel, rootConfig, config, node = null, fabric: providedFabric = null, signals = ['SIGINT', 'SIGTERM'], signal, ...fabricOptions } = options;
         const resolvedLevel = normalizeServeLogLevel(logLevel) ?? LogLevel.INFO;

package/dist/esm/naylence/fame/util/register-runtime-factories.js

@@ -7,6 +7,8 @@ const NODE_ONLY_FACTORY_MODULES = new Set([
     './connector/websocket-listener-factory.js',
     './telemetry/open-telemetry-trace-emitter-factory.js',
     './security/credential/prompt-credential-provider-factory.js',
+    './security/auth/default-policy-authorizer-factory.js',
+    './security/auth/policy/local-file-authorization-policy-source-factory.js',
 ]);
 const BROWSER_ONLY_FACTORY_MODULES = new Set([
     './security/auth/oauth2-pkce-token-provider-factory.js',

package/dist/esm/version.js

@@ -1,7 +1,7 @@
 // This file is auto-generated during build - do not edit manually
-// Generated from package.json version: 0.3.21
+// Generated from package.json version: 0.4.1
 /**
  * The package version, injected at build time.
  * @internal
  */
-export const VERSION = '0.3.21';
+export const VERSION = '0.4.1';