@praesidias/api-gateway 0.0.0-stage → 0.1.1

package/dist/index.cjs

@@ -0,0 +1,962 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  ConfigError: () => ConfigError,
+  EnvCredentialSource: () => EnvCredentialSource,
+  FileCredentialSource: () => FileCredentialSource,
+  VaultCredentialSource: () => VaultCredentialSource,
+  compileConfig: () => compileConfig,
+  createApiGateway: () => createApiGateway,
+  createApiGatewayHandler: () => createApiGatewayHandler,
+  createApiGatewayServer: () => createApiGatewayServer,
+  loadConfig: () => loadConfig
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/config.ts
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+var import_sdk = require("@praesidias/sdk");
+var ConfigError = class extends Error {
+};
+var fail = (message) => {
+  throw new ConfigError(`Gateway config: ${message}`);
+};
+var NAME = /^[a-z0-9][a-z0-9_-]{0,47}$/;
+var METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+var LOOPBACK = ["localhost", "127.0.0.1", "[::1]", "::1"];
+function compileRoute(upstream, index, route) {
+  const where = `upstreams.${upstream}.routes[${index}]`;
+  const method = String(route?.method ?? "").toUpperCase();
+  if (!METHODS.includes(method)) fail(`${where}.method must be one of ${METHODS.join(", ")}.`);
+  if (typeof route.path !== "string" || !route.path.startsWith("/") || route.path.includes("..") || /[?#*]/.test(route.path)) {
+    fail(`${where}.path must start with "/" and name a path (":name" for a segment that varies).`);
+  }
+  const params = [];
+  const pattern = route.path.split("/").map((segment) => {
+    if (segment.startsWith(":")) {
+      if (!/^:[A-Za-z_][A-Za-z0-9_]*$/.test(segment))
+        fail(`${where}.path has a bad parameter "${segment}".`);
+      params.push(segment.slice(1));
+      return "([^/]+)";
+    }
+    return segment.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  }).join("/");
+  if (!route.ungoverned && route.action === void 0 && !(route.when ?? []).length) {
+    fail(`${where} needs an "action" (or "ungoverned": true to let it through unrecorded).`);
+  }
+  return {
+    ...route,
+    method,
+    match: new RegExp(`^${pattern}/?$`),
+    params,
+    id: `${method} ${route.path}`
+  };
+}
+var VAULT_SEGMENT = /^[A-Za-z0-9_.-]+$/;
+function compileCredential(upstream, raw) {
+  if (raw === void 0 || raw === null) return null;
+  const where = `upstreams.${upstream}.credential`;
+  const rule = raw;
+  if (typeof rule !== "object") return fail(`${where} must be an object.`);
+  if (rule.header !== void 0 && !/^[A-Za-z0-9-]+$/.test(String(rule.header)))
+    fail(`${where}.header is not a header name.`);
+  const placement = {
+    ...rule.header !== void 0 ? { header: String(rule.header) } : {},
+    ...rule.scheme !== void 0 ? { scheme: String(rule.scheme) } : {}
+  };
+  switch (rule.from) {
+    case "env":
+      if (typeof rule.name !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(rule.name))
+        fail(`${where}.name must be the name of an environment variable.`);
+      return { from: "env", name: rule.name, ...placement };
+    case "file":
+      if (typeof rule.path !== "string" || !rule.path || !(0, import_node_path.isAbsolute)(rule.path))
+        fail(`${where}.path must be the absolute path of the file that holds the secret.`);
+      return { from: "file", name: rule.path, ...placement };
+    case "vault": {
+      const path = rule.path;
+      if (typeof path !== "string" || !path.split("/").every((s) => VAULT_SEGMENT.test(s) && s !== ".." && s !== "."))
+        fail(`${where}.path must be a Vault path like "secret/data/payments/bank".`);
+      if (typeof rule.field !== "string" || !VAULT_SEGMENT.test(rule.field))
+        fail(`${where}.field must name the field in the secret, like "api_key".`);
+      return { from: "vault", name: `${path}#${rule.field}`, ...placement };
+    }
+    default:
+      return fail(
+        `${where}.from must be "env", "file" or "vault". The secret itself never goes in this file.`
+      );
+  }
+}
+var LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+function compileHosts(upstream, raw) {
+  if (raw === void 0) return [];
+  const where = `upstreams.${upstream}.hosts`;
+  if (!Array.isArray(raw) || raw.length === 0) return fail(`${where} must be a list of hostnames.`);
+  const hosts = [];
+  for (const entry of raw) {
+    const h = String(entry ?? "").trim().toLowerCase().replace(/\.$/, "");
+    if (!h || h.length > 253 || !h.split(".").every((label) => LABEL.test(label)))
+      fail(`${where}: "${String(entry)}" is not a hostname (no scheme, port or path).`);
+    if (LOOPBACK.includes(h))
+      fail(`${where}: "${h}" is this machine. List the API's own hostnames.`);
+    if (!hosts.includes(h)) hosts.push(h);
+  }
+  return hosts;
+}
+function compileAgentKey(upstream, raw) {
+  if (raw === void 0) return null;
+  const where = `upstreams.${upstream}.agentKey`;
+  const rule = raw;
+  if (!rule || typeof rule !== "object") return fail(`${where} must be an object.`);
+  if (typeof rule.header !== "string" || !/^[A-Za-z0-9-]+$/.test(rule.header))
+    fail(`${where}.header is not a header name.`);
+  if (rule.scheme !== void 0 && (typeof rule.scheme !== "string" || !/^[A-Za-z]+$/.test(rule.scheme)))
+    fail(`${where}.scheme must be one word, like "Bearer".`);
+  return {
+    header: rule.header.toLowerCase(),
+    ...rule.scheme !== void 0 ? { scheme: rule.scheme } : {}
+  };
+}
+function compileTls(raw) {
+  if (raw === void 0) return null;
+  const rule = raw;
+  if (!rule || typeof rule !== "object" || typeof rule.certFile !== "string" || !rule.certFile || typeof rule.keyFile !== "string" || !rule.keyFile)
+    return fail(
+      '"listen.tls" needs "certFile" and "keyFile": the certificate and its key, as files.'
+    );
+  return { certFile: rule.certFile, keyFile: rule.keyFile };
+}
+function compileConfig(raw) {
+  const config = raw;
+  if (!config || typeof config !== "object") fail("must be a JSON object.");
+  if (typeof config.system !== "string" || !config.system) fail('"system" is required.');
+  const host = config.listen?.host ?? "127.0.0.1";
+  const port = config.listen?.port ?? 8787;
+  if (!Number.isInteger(port) || port < 0 || port > 65535)
+    fail('"listen.port" must be a port number.');
+  if (!LOOPBACK.includes(host) && config.listen?.allowRemote !== true) {
+    fail(
+      `"listen.host" is ${host}, which other machines can reach. The gateway holds API credentials, so it listens on this machine only unless "listen.allowRemote" is true.`
+    );
+  }
+  const entries = Object.entries(config.upstreams ?? {});
+  if (entries.length === 0 && config.ask !== true) {
+    fail(
+      '"upstreams" needs at least one upstream (or set "ask": true to serve only the Ask Praesidias step).'
+    );
+  }
+  if (Object.prototype.hasOwnProperty.call(config.upstreams ?? {}, "ask"))
+    fail('an upstream cannot be named "ask".');
+  const upstreams = /* @__PURE__ */ new Map();
+  const byHost = /* @__PURE__ */ new Map();
+  for (const [name, upstream] of entries) {
+    if (!NAME.test(name))
+      fail(`upstream name "${name}" must be lower-case letters, digits, - and _.`);
+    let base;
+    try {
+      base = new URL(upstream.baseUrl);
+    } catch {
+      return fail(`upstreams.${name}.baseUrl is not a URL.`);
+    }
+    if (base.username || base.password || base.search || base.hash)
+      fail(`upstreams.${name}.baseUrl must be a plain address: no credentials, query or fragment.`);
+    if (base.protocol !== "https:" && !(base.protocol === "http:" && LOOPBACK.includes(base.hostname))) {
+      fail(`upstreams.${name}.baseUrl must use https (http is accepted for this machine only).`);
+    }
+    const credential = compileCredential(name, upstream.credential);
+    if (!Array.isArray(upstream.routes) || upstream.routes.length === 0)
+      fail(
+        `upstreams.${name}.routes needs at least one route. A request that matches no route is refused.`
+      );
+    const routes = upstream.routes.map((route, index) => compileRoute(name, index, route));
+    const tools = {};
+    for (const route of routes) {
+      tools[route.id] = {
+        ...route.action !== void 0 ? { action: route.action } : {},
+        ...route.resource ? { resource: route.resource } : {},
+        ...route.when ? { when: route.when } : {},
+        ...route.context ? { context: route.context } : {},
+        ...route.system ? { system: route.system } : {},
+        ...route.ungoverned ? { ungoverned: true } : {}
+      };
+    }
+    let mapping;
+    try {
+      mapping = (0, import_sdk.checkMapping)({
+        system: config.system,
+        server: name,
+        defaults: { resource: { idFrom: [] } },
+        tools
+      });
+    } catch (err) {
+      return fail(`upstreams.${name}: ${err.message.replace(/^Mapping: /, "")}`);
+    }
+    const hosts = compileHosts(name, upstream.hosts);
+    const agentKey = compileAgentKey(name, upstream.agentKey);
+    const compiled = { name, base, credential, routes, mapping, hosts, agentKey };
+    upstreams.set(name, compiled);
+    for (const h of hosts) {
+      const other = byHost.get(h);
+      if (other) fail(`"${h}" is listed under both upstreams.${other.name} and upstreams.${name}.`);
+      byHost.set(h, compiled);
+    }
+  }
+  const tls = compileTls(config.listen?.tls);
+  return {
+    system: config.system,
+    host,
+    port,
+    ask: config.ask === true,
+    upstreams,
+    hosts: byHost,
+    tls
+  };
+}
+function loadConfig(path) {
+  let text;
+  try {
+    text = (0, import_node_fs.readFileSync)(path, "utf8");
+  } catch {
+    return fail(`cannot read ${path}.`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return fail(`${path} is not valid JSON.`);
+  }
+  return compileConfig(parsed);
+}
+
+// src/credentials.ts
+var import_promises = require("fs/promises");
+var EnvCredentialSource = class {
+  constructor(env = process.env) {
+    this.env = env;
+  }
+  env;
+  get(name) {
+    const value = this.env[name];
+    return value && value.trim() ? value.trim() : void 0;
+  }
+};
+var MAX_SECRET_BYTES = 64 * 1024;
+var FileCredentialSource = class {
+  constructor(note = () => {
+  }) {
+    this.note = note;
+  }
+  note;
+  async get(path) {
+    try {
+      const info = await (0, import_promises.stat)(path);
+      if (!info.isFile() || info.size > MAX_SECRET_BYTES) {
+        this.note(`credential file ${path} is not a secret file`);
+        return void 0;
+      }
+      const value = (await (0, import_promises.readFile)(path, "utf8")).trim();
+      if (!value) this.note(`credential file ${path} is empty`);
+      return value || void 0;
+    } catch {
+      this.note(`credential file ${path} cannot be read`);
+      return void 0;
+    }
+  }
+};
+var LOOPBACK2 = ["localhost", "127.0.0.1", "[::1]", "::1"];
+function vaultAddress(env = process.env) {
+  const raw = String(env.VAULT_ADDR ?? "").trim();
+  if (!raw) return "VAULT_ADDR is not set";
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return "VAULT_ADDR is not a URL";
+  }
+  if (url.username || url.password || url.search || url.hash)
+    return "VAULT_ADDR must be a plain address";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && LOOPBACK2.includes(url.hostname)))
+    return "VAULT_ADDR must use https (http is accepted for this machine only)";
+  return url;
+}
+var VaultCredentialSource = class {
+  env;
+  cacheMs;
+  timeoutMs;
+  note;
+  send;
+  cache = /* @__PURE__ */ new Map();
+  reading = /* @__PURE__ */ new Map();
+  constructor(options = {}) {
+    this.env = options.env ?? process.env;
+    this.cacheMs = Math.max(0, options.cacheMs ?? 6e4);
+    this.timeoutMs = options.timeoutMs ?? 5e3;
+    this.note = options.note ?? (() => {
+    });
+    this.send = options.fetch ?? fetch;
+  }
+  async get(name) {
+    const kept = this.cache.get(name);
+    if (kept && Date.now() - kept.at < this.cacheMs) return kept.value;
+    if (kept) this.cache.delete(name);
+    let pending = this.reading.get(name);
+    if (!pending) {
+      pending = this.read(name).finally(() => this.reading.delete(name));
+      this.reading.set(name, pending);
+    }
+    return pending;
+  }
+  async token() {
+    const file = String(this.env.VAULT_TOKEN_FILE ?? "").trim();
+    if (file) {
+      try {
+        const value2 = (await (0, import_promises.readFile)(file, "utf8")).trim();
+        if (value2) return value2;
+      } catch {
+      }
+      this.note("the Vault token file cannot be read");
+      return void 0;
+    }
+    const value = String(this.env.VAULT_TOKEN ?? "").trim();
+    if (!value) this.note("neither VAULT_TOKEN nor VAULT_TOKEN_FILE is set");
+    return value || void 0;
+  }
+  async read(name) {
+    const at = name.lastIndexOf("#");
+    const path = at > 0 ? name.slice(0, at) : "";
+    const field = at > 0 ? name.slice(at + 1) : "";
+    if (!path || !field) {
+      this.note(`"${name}" is not a Vault path and field`);
+      return void 0;
+    }
+    const where = vaultAddress(this.env);
+    if (typeof where === "string") {
+      this.note(where);
+      return void 0;
+    }
+    const token = await this.token();
+    if (!token) return void 0;
+    const headers = { "x-vault-token": token, accept: "application/json" };
+    const namespace = String(this.env.VAULT_NAMESPACE ?? "").trim();
+    if (namespace) headers["x-vault-namespace"] = namespace;
+    const target = new URL(`${where.pathname.replace(/\/$/, "")}/v1/${path}`, where);
+    if (target.origin !== where.origin) {
+      this.note(`"${path}" is not a Vault path`);
+      return void 0;
+    }
+    let reply2;
+    try {
+      reply2 = await this.send(target, {
+        headers,
+        redirect: "manual",
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+    } catch {
+      this.note(`Vault could not be reached for ${path}`);
+      return void 0;
+    }
+    if (reply2.status !== 200) {
+      this.note(`Vault answered ${reply2.status} for ${path}`);
+      return void 0;
+    }
+    let body;
+    try {
+      body = await reply2.json();
+    } catch {
+      this.note(`Vault's answer for ${path} is not JSON`);
+      return void 0;
+    }
+    const data = body?.data;
+    const secret = data && typeof data.data === "object" && data.data !== null && data.metadata !== void 0 ? data.data : data;
+    const value = secret && typeof secret === "object" ? secret[field] : void 0;
+    if (typeof value !== "string" || !value.trim()) {
+      this.note(`Vault has no text field "${field}" at ${path}`);
+      return void 0;
+    }
+    const trimmed = value.trim();
+    if (this.cacheMs > 0) this.cache.set(name, { value: trimmed, at: Date.now() });
+    return trimmed;
+  }
+};
+
+// src/gateway.ts
+var import_node_crypto2 = require("crypto");
+var import_node_fs2 = require("fs");
+var import_node_http = require("http");
+var import_node_https = require("https");
+var import_sdk4 = require("@praesidias/sdk");
+
+// src/ask.ts
+var import_node_crypto = require("crypto");
+var import_sdk3 = require("@praesidias/sdk");
+
+// src/workload.ts
+var import_node_async_hooks = require("async_hooks");
+var import_sdk2 = require("@praesidias/sdk");
+var current = new import_node_async_hooks.AsyncLocalStorage();
+function workloadTokenOf(req) {
+  const header = req.headers[import_sdk2.WORKLOAD_TOKEN_HEADER];
+  const value = (Array.isArray(header) ? header[0] : header)?.trim();
+  return value ? value : null;
+}
+function withWorkloadToken(req, handle) {
+  return current.run(workloadTokenOf(req), handle);
+}
+function withoutWorkloadToken(options) {
+  const { workloadToken: _token, workloadTokenFile: _file, ...rest } = options ?? {};
+  return rest;
+}
+var relayedWorkloadToken = () => current.getStore() ?? null;
+
+// src/ask.ts
+function stable(value) {
+  if (Array.isArray(value)) return `[${value.map(stable).join(",")}]`;
+  if (value && typeof value === "object") {
+    const o = value;
+    return `{${Object.keys(o).sort().map((k) => `${JSON.stringify(k)}:${stable(o[k])}`).join(",")}}`;
+  }
+  return JSON.stringify(value ?? null);
+}
+var ACTION = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/;
+var MAX_BODY = 64 * 1024;
+var reply = (res, status, body) => {
+  const text = JSON.stringify(body);
+  res.writeHead(status, {
+    "content-type": "application/json",
+    "content-length": Buffer.byteLength(text),
+    "cache-control": "no-store"
+  });
+  res.end(text);
+};
+function createAsk(options) {
+  const clients = /* @__PURE__ */ new Map();
+  const waiting = /* @__PURE__ */ new Map();
+  const clientFor = (apiKey) => {
+    const id = (0, import_node_crypto.createHash)("sha256").update(apiKey).digest("hex");
+    const now = Date.now();
+    for (const [k, entry2] of clients) if (now - entry2.at > 60 * 6e4) clients.delete(k);
+    for (const [k, entry2] of waiting) if (now - entry2.at > 24 * 60 * 6e4) waiting.delete(k);
+    let entry = clients.get(id);
+    if (!entry) {
+      entry = {
+        client: new import_sdk3.Praesidias({
+          ...withoutWorkloadToken(options.sdkOptions),
+          apiKey,
+          baseUrl: options.praesidiasUrl,
+          system: options.system,
+          onApproval: "return",
+          // Each request's own workload token (workload.ts), never one shared or the gateway's.
+          workloadToken: relayedWorkloadToken
+        }),
+        at: now
+      };
+      clients.set(id, entry);
+    }
+    entry.at = now;
+    return { client: entry.client, id };
+  };
+  async function body(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+      size += chunk.length;
+      if (size > MAX_BODY) return null;
+      chunks.push(chunk);
+    }
+    try {
+      const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    } catch {
+      return null;
+    }
+  }
+  return async function ask(req, res, path) {
+    if (path !== "/ask" && path !== "/ask/outcome") return false;
+    if (req.method !== "POST") {
+      reply(res, 405, { allowed: false, status: "refused", message: "Use POST." });
+      return true;
+    }
+    const header = req.headers[options.keyHeader];
+    const apiKey = (Array.isArray(header) ? header[0] : header)?.trim();
+    if (!apiKey) {
+      reply(res, 401, {
+        allowed: false,
+        status: "refused",
+        message: `Send your Praesidias key in the ${options.keyHeader} header.`
+      });
+      return true;
+    }
+    const input = await body(req);
+    if (!input) {
+      reply(res, 400, { allowed: false, status: "refused", message: "Send a JSON object." });
+      return true;
+    }
+    const { client, id } = clientFor(apiKey);
+    try {
+      if (path === "/ask/outcome") {
+        const { decisionId, proofId, status } = input;
+        if (typeof decisionId !== "string" || typeof proofId !== "string" || status !== "succeeded" && status !== "failed") {
+          reply(res, 400, {
+            recorded: false,
+            message: 'Send decisionId, proofId and status ("succeeded" or "failed").'
+          });
+          return true;
+        }
+        await client.reportOutcome(
+          { decisionId, id: proofId },
+          status === "succeeded" ? { status } : { status: "failed" }
+        );
+        reply(res, 200, { recorded: true });
+        return true;
+      }
+      const resource = input.resource ?? {};
+      const action = input.action;
+      if (typeof action !== "string" || !ACTION.test(action) || typeof resource.type !== "string" || !resource.type) {
+        reply(res, 400, {
+          allowed: false,
+          status: "refused",
+          message: 'Send "action" and "resource": { "type", "id" }.'
+        });
+        return true;
+      }
+      const target = {
+        type: resource.type.slice(0, 64),
+        id: resource.id === void 0 || resource.id === null ? null : String(resource.id).slice(0, 256)
+      };
+      const context = input.context && typeof input.context === "object" && !Array.isArray(input.context) ? input.context : {};
+      const system = typeof input.system === "string" && input.system ? input.system : void 0;
+      const call = { ...system ? { system } : {}, context };
+      const key = `${id}:${stable([system ?? options.system, action, target.type, target.id, context])}`;
+      let decision = null;
+      const held = waiting.get(key);
+      if (held) {
+        const approval = await client.approvalStatus(held.decisionId);
+        if (approval.state === "approved") {
+          decision = await client.decide(action, target, {
+            ...call,
+            approvalArtifactIds: approval.approvalArtifactIds
+          });
+        } else if (approval.state === "waiting") {
+          options.log(`ask ${action}: needs approval`);
+          reply(res, 200, {
+            allowed: false,
+            status: "needs_approval",
+            message: `Needs approval. A person has to approve this first (${approval.approvalsHave} of ${approval.approvalsNeeded ?? "?"} so far). Ask again once it is approved.`,
+            decisionId: held.decisionId,
+            approvalsHave: approval.approvalsHave,
+            approvalsNeeded: approval.approvalsNeeded
+          });
+          return true;
+        }
+        waiting.delete(key);
+      }
+      decision ??= await client.decide(action, target, call);
+      if (decision.allowed) {
+        const proof = await client.commit(decision);
+        waiting.delete(key);
+        options.log(`ask ${action}: allowed`);
+        reply(res, 200, {
+          allowed: true,
+          status: "allowed",
+          message: "Allowed.",
+          decisionId: decision.decisionId,
+          proofId: proof.id,
+          authorization: proof.raw
+        });
+        return true;
+      }
+      if (decision.needsApproval) {
+        waiting.set(key, { decisionId: decision.decisionId, at: Date.now() });
+        options.log(`ask ${action}: needs approval`);
+        reply(res, 200, {
+          allowed: false,
+          status: "needs_approval",
+          message: `Needs approval. ${decision.reason.message} Ask again once it is approved.`,
+          decisionId: decision.decisionId
+        });
+        return true;
+      }
+      options.log(`ask ${action}: blocked (${decision.reason.code})`);
+      reply(res, 200, {
+        allowed: false,
+        status: "blocked",
+        message: `Blocked by Praesidias. ${decision.reason.message}`,
+        decisionId: decision.decisionId,
+        code: decision.reason.code
+      });
+      return true;
+    } catch (err) {
+      const code = err instanceof import_sdk3.PraesidiasError ? err.code : "ERROR";
+      options.log(`ask: not answered (${code})`);
+      const refusedKey = code === "KEY_REFUSED";
+      reply(res, refusedKey ? 401 : 503, {
+        allowed: false,
+        status: refusedKey ? "refused" : "unavailable",
+        message: refusedKey ? "Praesidias did not accept this key." : "Praesidias could not confirm this action is allowed. Do not carry it out."
+      });
+      return true;
+    }
+  };
+}
+
+// src/gateway.ts
+var HOP_BY_HOP = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+  "host",
+  "content-length"
+]);
+var FROM_AGENT = /* @__PURE__ */ new Set([
+  "authorization",
+  "cookie",
+  "x-api-key",
+  "api-key",
+  "x-auth-token",
+  "proxy-authorization",
+  // The agent's workload identity token goes to Praesidias only, never to an upstream.
+  import_sdk2.WORKLOAD_TOKEN_HEADER
+]);
+var json = (res, status, body) => {
+  const text = JSON.stringify(body);
+  res.writeHead(status, {
+    "content-type": "application/json",
+    "content-length": Buffer.byteLength(text),
+    "cache-control": "no-store"
+  });
+  res.end(text);
+};
+var UpstreamAnswered = class extends Error {
+  constructor(reply2) {
+    super(`The API answered ${reply2.status}.`);
+    this.reply = reply2;
+  }
+  reply;
+  name = "UpstreamAnswered";
+};
+function createApiGateway(options) {
+  return (0, import_node_http.createServer)(createApiGatewayHandler(options));
+}
+function createApiGatewayServer(options) {
+  const { tls } = options.config;
+  if (!tls) return createApiGateway(options);
+  let cert;
+  let key;
+  try {
+    cert = (0, import_node_fs2.readFileSync)(tls.certFile);
+    key = (0, import_node_fs2.readFileSync)(tls.keyFile);
+  } catch {
+    throw new ConfigError(
+      'Gateway config: the "listen.tls" certificate or key file cannot be read.'
+    );
+  }
+  return (0, import_node_https.createServer)({ cert, key }, createApiGatewayHandler(options));
+}
+var PRAESIDIAS_KEY = /^pk_[A-Za-z0-9_]{16,128}$/;
+function hostnameOf(header) {
+  const raw = String(header ?? "").trim().toLowerCase();
+  if (!raw) return "";
+  if (raw.startsWith("[")) return raw.slice(0, raw.indexOf("]") + 1);
+  return raw.split(":")[0].replace(/\.$/, "");
+}
+function createApiGatewayHandler(options) {
+  const { config } = options;
+  let praesidiasAt;
+  try {
+    praesidiasAt = new URL(options.praesidiasUrl);
+  } catch {
+    throw new ConfigError("The Praesidias address is not a valid URL.");
+  }
+  const onThisMachine = ["localhost", "127.0.0.1", "[::1]"].includes(praesidiasAt.hostname);
+  if (praesidiasAt.protocol !== "https:" && !(praesidiasAt.protocol === "http:" && onThisMachine)) {
+    throw new ConfigError(
+      "The Praesidias address must use https (http is accepted for this machine only)."
+    );
+  }
+  const log = options.log ?? (() => {
+  });
+  const note = (line) => log(`credential: ${line}`);
+  const sources = {
+    env: options.credentials ?? new EnvCredentialSource(),
+    file: new FileCredentialSource(note),
+    vault: new VaultCredentialSource({ ...options.vault, note })
+  };
+  const keyHeader = (options.keyHeader ?? "x-praesidias-key").toLowerCase();
+  const maxBody = options.maxBodyBytes ?? 1024 * 1024;
+  const send = options.fetch ?? fetch;
+  const timeoutMs = options.upstreamTimeoutMs ?? 3e4;
+  const ask = config.ask ? createAsk({
+    praesidiasUrl: options.praesidiasUrl,
+    system: config.system,
+    keyHeader,
+    log,
+    ...options.sdkOptions ? { sdkOptions: options.sdkOptions } : {}
+  }) : null;
+  const gates = /* @__PURE__ */ new Map();
+  const gateFor = (apiKey, upstream) => {
+    const id = `${(0, import_node_crypto2.createHash)("sha256").update(apiKey).digest("hex")}:${upstream.name}`;
+    const now = Date.now();
+    for (const [k, entry2] of gates) if (now - entry2.at > 60 * 6e4) gates.delete(k);
+    let entry = gates.get(id);
+    if (!entry) {
+      const praesidias = new import_sdk4.Praesidias({
+        ...withoutWorkloadToken(options.sdkOptions),
+        apiKey,
+        baseUrl: options.praesidiasUrl,
+        system: config.system,
+        onApproval: "return",
+        // Each request's own workload token (workload.ts), never one shared or the gateway's.
+        workloadToken: relayedWorkloadToken
+      });
+      entry = {
+        gate: new import_sdk4.ToolGate(praesidias, upstream.mapping, { onApproval: "return" }),
+        at: now
+      };
+      gates.set(id, entry);
+    }
+    entry.at = now;
+    return entry.gate;
+  };
+  async function readBody(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+      size += chunk.length;
+      if (size > maxBody) return null;
+      chunks.push(chunk);
+    }
+    return Buffer.concat(chunks);
+  }
+  function parsed(body, contentType) {
+    if (body.length === 0) return {};
+    if (/^application\/(.+\+)?json\b/i.test(contentType)) {
+      try {
+        return JSON.parse(body.toString("utf8"));
+      } catch {
+        return {};
+      }
+    }
+    if (/^application\/x-www-form-urlencoded\b/i.test(contentType))
+      return Object.fromEntries(new URLSearchParams(body.toString("utf8")));
+    return {};
+  }
+  async function handle(req, res) {
+    const url = new URL(req.url ?? "/", "http://gateway.invalid");
+    const byHost = config.hosts.size ? config.hosts.get(hostnameOf(req.headers.host)) : void 0;
+    if (!byHost) {
+      if (req.method === "GET" && url.pathname === "/healthz") return json(res, 200, { ok: true });
+      if (ask && await ask(req, res, url.pathname)) return;
+    }
+    let name;
+    let path;
+    let upstream;
+    if (byHost) {
+      upstream = byHost;
+      name = byHost.name;
+      path = url.pathname;
+    } else {
+      const [, first = "", ...rest] = url.pathname.split("/");
+      name = first;
+      upstream = config.upstreams.get(name);
+      path = `/${rest.join("/")}`;
+    }
+    const method = (req.method ?? "GET").toUpperCase();
+    if (!upstream)
+      return json(res, 404, {
+        status: "refused",
+        message: "There is no upstream by that name. This gateway only reaches the APIs it is configured for."
+      });
+    let decoded;
+    try {
+      decoded = decodeURIComponent(path);
+    } catch {
+      return json(res, 400, { status: "refused", message: "The path is not valid." });
+    }
+    if (decoded.split("/").includes("..") || decoded.includes("\\"))
+      return json(res, 400, { status: "refused", message: "The path is not valid." });
+    let route;
+    let params = {};
+    for (const candidate of upstream.routes) {
+      if (candidate.method !== method) continue;
+      const found = candidate.match.exec(path);
+      if (found) {
+        route = candidate;
+        params = Object.fromEntries(
+          candidate.params.map((p, i) => [p, decodeURIComponent(found[i + 1] ?? "")])
+        );
+        break;
+      }
+    }
+    if (!route) {
+      log(
+        `${method} ${name}${path.replace(/[0-9a-f-]{8,}|\d{3,}/gi, ":id")}: refused (no such route)`
+      );
+      return json(res, 403, {
+        status: "refused",
+        message: "This request does not match any route this gateway is configured for, so it was not sent."
+      });
+    }
+    const header = req.headers[keyHeader];
+    let apiKey = (Array.isArray(header) ? header[0] : header)?.trim();
+    const agentKey = upstream.agentKey;
+    if (!apiKey && agentKey) {
+      const sent = req.headers[agentKey.header];
+      let value = (Array.isArray(sent) ? sent[0] : sent)?.trim() ?? "";
+      if (agentKey.scheme) {
+        const prefix = `${agentKey.scheme.toLowerCase()} `;
+        value = value.toLowerCase().startsWith(prefix) ? value.slice(prefix.length).trim() : "";
+      }
+      if (!PRAESIDIAS_KEY.test(value)) {
+        log(`${route.id} (${name}): refused (no Praesidias key in ${agentKey.header})`);
+        return json(res, 401, {
+          status: "refused",
+          message: `The ${agentKey.header} header does not hold a Praesidias key, so nothing was sent and Praesidias was not asked.`
+        });
+      }
+      apiKey = value;
+    }
+    if (!apiKey)
+      return json(res, 401, {
+        status: "refused",
+        message: `Send your Praesidias key in the ${keyHeader} header.`
+      });
+    const body = await readBody(req);
+    if (body === null)
+      return json(res, 413, { status: "refused", message: "The request body is too large." });
+    const args = {
+      params,
+      query: Object.fromEntries(url.searchParams),
+      body: parsed(body, String(req.headers["content-type"] ?? ""))
+    };
+    const forward = async () => {
+      const headers = new Headers();
+      for (const [key, value] of Object.entries(req.headers)) {
+        const lower = key.toLowerCase();
+        if (value === void 0 || HOP_BY_HOP.has(lower) || FROM_AGENT.has(lower) || lower === keyHeader || lower === upstream.agentKey?.header)
+          continue;
+        headers.set(key, Array.isArray(value) ? value.join(", ") : value);
+      }
+      if (upstream.credential) {
+        const secret = await sources[upstream.credential.from].get(upstream.credential.name);
+        if (!secret) throw new MissingCredential();
+        headers.set(
+          upstream.credential.header ?? "authorization",
+          upstream.credential.scheme ? `${upstream.credential.scheme} ${secret}` : secret
+        );
+      }
+      const target = new URL(
+        upstream.base.pathname.replace(/\/$/, "") + path + url.search,
+        upstream.base
+      );
+      if (target.origin !== upstream.base.origin) throw new Error("refusing to leave the upstream");
+      const reply2 = await send(target, {
+        method,
+        headers,
+        ...method === "GET" || method === "DELETE" ? {} : { body: new Uint8Array(body) },
+        redirect: "manual",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      const answered = {
+        status: reply2.status,
+        headers: reply2.headers,
+        body: Buffer.from(await reply2.arrayBuffer())
+      };
+      if (reply2.status >= 400) throw new UpstreamAnswered(answered);
+      return answered;
+    };
+    const relay = (reply2) => {
+      const headers = {};
+      reply2.headers.forEach((value, key) => {
+        if (!HOP_BY_HOP.has(key.toLowerCase()) && key.toLowerCase() !== "content-encoding")
+          headers[key] = value;
+      });
+      res.writeHead(reply2.status, { ...headers, "content-length": reply2.body.length });
+      res.end(reply2.body);
+    };
+    let outcome;
+    try {
+      outcome = await gateFor(apiKey, upstream).run(route.id, args, forward);
+    } catch (err) {
+      if (err instanceof UpstreamAnswered) {
+        log(`${route.id} (${name}): allowed, and the API answered ${err.reply.status}`);
+        return relay(err.reply);
+      }
+      if (err instanceof MissingCredential) {
+        log(`${route.id} (${name}): not sent (the API credential is not set)`);
+        return json(res, 503, {
+          status: "unavailable",
+          message: "The gateway has no credential for this API, so the request was not sent."
+        });
+      }
+      log(`${route.id} (${name}): allowed, and the API could not be reached`);
+      return json(res, 502, {
+        status: "upstream_failed",
+        message: "The API could not be reached."
+      });
+    }
+    if (outcome.ran) {
+      log(
+        `${route.id} (${name}): ${outcome.status === "passed_through" ? "passed through (ungoverned)" : "allowed"}`
+      );
+      res.setHeader("x-praesidias-decision", outcome.decisionId ?? "");
+      return relay(outcome.value);
+    }
+    log(`${route.id} (${name}): ${outcome.status}`);
+    const status = outcome.status === "blocked" ? 403 : outcome.status === "needs_approval" ? 409 : 503;
+    return json(res, status, {
+      status: outcome.status,
+      message: outcome.message,
+      ...outcome.decisionId ? { decisionId: outcome.decisionId } : {},
+      ...outcome.status === "needs_approval" ? { approvalsHave: outcome.approvalsHave, approvalsNeeded: outcome.approvalsNeeded } : {}
+    });
+  }
+  return (req, res) => {
+    withWorkloadToken(req, () => handle(req, res)).catch(() => {
+      if (!res.headersSent)
+        json(res, 500, {
+          status: "error",
+          message: "The gateway failed. The request was not completed."
+        });
+      else res.end();
+    });
+  };
+}
+var MissingCredential = class extends Error {
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ConfigError,
+  EnvCredentialSource,
+  FileCredentialSource,
+  VaultCredentialSource,
+  compileConfig,
+  createApiGateway,
+  createApiGatewayHandler,
+  createApiGatewayServer,
+  loadConfig
+});