@orcareplay/core 0.2.5-main.gd97beed → 0.3.1-main.g2d7bd68

package/dist/fetch.d.ts

@@ -0,0 +1,38 @@
+/**
+ * fetch with the DESTINATION PINNED — a redirect is a hard failure, never a hand-off.
+ *
+ * THE ORIGIN CHECK VALIDATES THE URL WE PASS, NOT THE URL THE REQUEST REACHES (orcacode-review).
+ * `resolveGateway` decides whether the key may go to this host, and then `fetch` was free to follow
+ * a `Location` anywhere. undici strips `authorization` across origins but NOT `x-api-key`, and
+ * gatewayHeaders sets both to the same key — so one header from whoever answers for the gateway
+ * carried the replay-scoped credential to a host it was never issued for, defeating the promise the
+ * README makes in writing: "Never a key to a host it was not set up for."
+ *
+ * Push had a second failure on top: a 301/302/303 is re-issued as a GET with no body, so the
+ * target's 200 satisfied `res.ok` and the CLI printed `push.done` for a run that went nowhere. A
+ * 307/308 instead failed with an opaque "fetch failed", because undici cannot replay a detached
+ * body — so a legitimately redirecting gateway could not be talked to either.
+ *
+ * `manual` rather than `error`: Node resolves it with the real status and Location, so the refusal
+ * can NAME the destination. `error` rejects with a bare TypeError whose only distinguishing mark is
+ * an undici-internal cause string ("unexpected redirect"), which a genuine connection failure
+ * ("bad port") is indistinguishable from without matching on that string.
+ *
+ * Following a same-origin redirect would be safe and is deliberately not implemented: no gateway
+ * this CLI talks to issues one, and an unused branch that forwards credentials is the wrong thing
+ * to carry.
+ *
+ * IT LIVES IN core, NOT IN THE PACKAGE THAT FIRST NEEDED IT (orcacode-review, twice).
+ *
+ * The first version was local to the CLI's sync.ts, so push and pull were pinned and `probeModels`
+ * — the third request carrying the same header pair — was not. The second lived beside
+ * gatewayHeaders in the CLI's config.ts, which fixed that and left the RECORDING PROXY out: it is
+ * handed the very same credential as `upstreamHeaders` and attaches it to both of its live call
+ * sites, on the path every `orca record` / `replay --loose` / `compare` / fork takes.
+ *
+ * Both times the pin sat in the package that noticed the problem rather than in the one every
+ * carrier of the credential depends on. core is that package, so this is the last place it can
+ * move to.
+ */
+export declare function fetchPinned(target: string, init: RequestInit): Promise<Response>;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWtF"}

package/dist/fetch.js

@@ -0,0 +1,47 @@
+/**
+ * fetch with the DESTINATION PINNED — a redirect is a hard failure, never a hand-off.
+ *
+ * THE ORIGIN CHECK VALIDATES THE URL WE PASS, NOT THE URL THE REQUEST REACHES (orcacode-review).
+ * `resolveGateway` decides whether the key may go to this host, and then `fetch` was free to follow
+ * a `Location` anywhere. undici strips `authorization` across origins but NOT `x-api-key`, and
+ * gatewayHeaders sets both to the same key — so one header from whoever answers for the gateway
+ * carried the replay-scoped credential to a host it was never issued for, defeating the promise the
+ * README makes in writing: "Never a key to a host it was not set up for."
+ *
+ * Push had a second failure on top: a 301/302/303 is re-issued as a GET with no body, so the
+ * target's 200 satisfied `res.ok` and the CLI printed `push.done` for a run that went nowhere. A
+ * 307/308 instead failed with an opaque "fetch failed", because undici cannot replay a detached
+ * body — so a legitimately redirecting gateway could not be talked to either.
+ *
+ * `manual` rather than `error`: Node resolves it with the real status and Location, so the refusal
+ * can NAME the destination. `error` rejects with a bare TypeError whose only distinguishing mark is
+ * an undici-internal cause string ("unexpected redirect"), which a genuine connection failure
+ * ("bad port") is indistinguishable from without matching on that string.
+ *
+ * Following a same-origin redirect would be safe and is deliberately not implemented: no gateway
+ * this CLI talks to issues one, and an unused branch that forwards credentials is the wrong thing
+ * to carry.
+ *
+ * IT LIVES IN core, NOT IN THE PACKAGE THAT FIRST NEEDED IT (orcacode-review, twice).
+ *
+ * The first version was local to the CLI's sync.ts, so push and pull were pinned and `probeModels`
+ * — the third request carrying the same header pair — was not. The second lived beside
+ * gatewayHeaders in the CLI's config.ts, which fixed that and left the RECORDING PROXY out: it is
+ * handed the very same credential as `upstreamHeaders` and attaches it to both of its live call
+ * sites, on the path every `orca record` / `replay --loose` / `compare` / fork takes.
+ *
+ * Both times the pin sat in the package that noticed the problem rather than in the one every
+ * carrier of the credential depends on. core is that package, so this is the last place it can
+ * move to.
+ */
+export async function fetchPinned(target, init) {
+    const res = await fetch(target, { ...init, redirect: 'manual' });
+    if (res.status >= 300 && res.status < 400) {
+        const to = res.headers.get('location') ?? '(no Location header)';
+        throw new Error(`${target} answered ${res.status} redirecting to ${to}. orca does not follow it: your key is ` +
+            `attached to the host you named, and following would hand it to whatever answers there. ` +
+            `Point --gateway (or ORCA_GATEWAY_URL) at the final address instead.`);
+    }
+    return res;
+}
+//# sourceMappingURL=fetch.js.map

package/dist/fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,IAAiB;IACjE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjE,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,sBAAsB,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,aAAa,GAAG,CAAC,MAAM,mBAAmB,EAAE,yCAAyC;YAC5F,yFAAyF;YACzF,qEAAqE,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * from './blobs.js';
+export * from './fetch.js';
 export * from './graph.js';
 export * from './paths.js';
 export * from './reader.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -1,4 +1,5 @@
 export * from './blobs.js';
+export * from './fetch.js';
 export * from './graph.js';
 export * from './paths.js';
 export * from './reader.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orcareplay/core",
-  "version": "0.2.5-main.gd97beed",
+  "version": "0.3.1-main.g2d7bd68",
   "type": "module",
   "license": "Apache-2.0",
   "repository": {
@@ -17,7 +17,7 @@
     "dist"
   ],
   "dependencies": {
-    "@orcareplay/plugin-api": "0.2.5-main.gd97beed",
-    "@orcareplay/schema": "0.2.5-main.gd97beed"
+    "@orcareplay/plugin-api": "0.3.1-main.g2d7bd68",
+    "@orcareplay/schema": "0.3.1-main.g2d7bd68"
   }
 }