@relaycast/engine 1.1.7

package/dist/lib/origin.js

@@ -0,0 +1,80 @@
+import { normalizeTelemetryOrigin } from '@relaycast/types';
+/**
+ * HTTP header used by harnesses (Claude Code, Cursor, etc.) to identify
+ * themselves to the relaycast server. See relay#881.
+ */
+export const HARNESS_HEADER = 'X-Relaycast-Harness';
+/** Fallback value when the header is missing or invalid. */
+export const UNKNOWN_HARNESS = 'unknown';
+/** Sanity-cap on the header value — long enough for any reasonable identifier. */
+const HARNESS_MAX_LENGTH = 40;
+/**
+ * Read and sanitize the `X-Relaycast-Harness` header from a request.
+ *
+ * Returns a lowercase identifier (kebab-case by convention, e.g. `claude-code`,
+ * `cursor`, `codex`). We intentionally do NOT enforce an enum here — accepting
+ * any well-formed value lets us discover new harnesses without shipping a
+ * relaycast release first. Segmentation/normalization happens downstream in
+ * the analytics layer.
+ *
+ * Drops empty, oversized, or non-ASCII values to `'unknown'`.
+ */
+export function extractHarness(headers) {
+    const raw = headers.get(HARNESS_HEADER);
+    if (!raw)
+        return UNKNOWN_HARNESS;
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return UNKNOWN_HARNESS;
+    if (trimmed.length > HARNESS_MAX_LENGTH)
+        return UNKNOWN_HARNESS;
+    // Restrict to printable ASCII to keep PostHog property values clean. Allow
+    // letters, digits, and the small set of separators harness names tend to
+    // use. Anything else falls back to `unknown`.
+    if (!/^[a-zA-Z0-9._-]+$/.test(trimmed))
+        return UNKNOWN_HARNESS;
+    return trimmed.toLowerCase();
+}
+function sanitizeOriginPart(value, maxLen) {
+    if (!value)
+        return undefined;
+    const normalized = value.trim();
+    if (!normalized)
+        return undefined;
+    return normalized.slice(0, maxLen);
+}
+export function deriveClientName(headers) {
+    const explicit = headers.get('x-client-name') ?? headers.get('x-relaycast-client');
+    if (explicit)
+        return explicit.trim().slice(0, 80);
+    const ua = headers.get('user-agent');
+    if (!ua)
+        return undefined;
+    const family = ua.split(/[\/\s;]/)[0];
+    return family ? family.trim().slice(0, 80) : undefined;
+}
+export function extractOriginInfo(request, fallbackClientName) {
+    const headers = request.headers;
+    const url = new URL(request.url);
+    const querySurface = url.searchParams.get('origin_surface');
+    const queryClient = url.searchParams.get('origin_client');
+    const queryVersion = url.searchParams.get('origin_version');
+    const originSurface = sanitizeOriginPart(headers.get('x-relaycast-origin-surface') ?? headers.get('x-origin-surface') ?? querySurface, 32);
+    const originClient = sanitizeOriginPart(headers.get('x-relaycast-origin-client')
+        ?? headers.get('x-origin-client')
+        ?? queryClient
+        ?? fallbackClientName, 80);
+    const originVersion = sanitizeOriginPart(headers.get('x-relaycast-origin-version')
+        ?? headers.get('x-origin-version')
+        ?? queryVersion
+        ?? headers.get('x-sdk-version'), 48);
+    return {
+        ...(originSurface ? { origin_surface: originSurface } : {}),
+        ...(originClient ? { origin_client: originClient } : {}),
+        ...(originVersion ? { origin_version: originVersion } : {}),
+    };
+}
+export function requiredOriginInfo(request, fallbackClientName) {
+    return normalizeTelemetryOrigin(extractOriginInfo(request, fallbackClientName));
+}
+//# sourceMappingURL=origin.js.map

package/dist/lib/origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.js","sourceRoot":"","sources":["../../src/lib/origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAwB,MAAM,kBAAkB,CAAC;AAIlF;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEpD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC;AAEzC,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,eAAe,CAAC;IAEjC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,eAAe,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,GAAG,kBAAkB;QAAE,OAAO,eAAe,CAAC;IAChE,2EAA2E;IAC3E,yEAAyE;IACzE,8CAA8C;IAC9C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,eAAe,CAAC;IAE/D,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAgC,EAAE,MAAc;IAC1E,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnF,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAElD,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAgB,EAAE,kBAA2B;IAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEjC,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAE5D,MAAM,aAAa,GAAG,kBAAkB,CACtC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,YAAY,EAC5F,EAAE,CACH,CAAC;IACF,MAAM,YAAY,GAAG,kBAAkB,CACrC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;WACnC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;WAC9B,WAAW;WACX,kBAAkB,EACvB,EAAE,CACH,CAAC;IACF,MAAM,aAAa,GAAG,kBAAkB,CACtC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;WACpC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;WAC/B,YAAY;WACZ,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EACjC,EAAE,CACH,CAAC;IAEF,OAAO;QACL,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAgB,EAAE,kBAA2B;IAC9E,OAAO,wBAAwB,CAAC,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAClF,CAAC"}

package/dist/lib/serverTelemetry.d.ts

@@ -0,0 +1,12 @@
+import type { Context } from 'hono';
+import type { AppEnv } from '../env.js';
+type ServerEvent = `relaycast_server_${string}`;
+export declare function normalizeRoutePathForTelemetry(value: string): string;
+/**
+ * Emit a server-side product-telemetry event through the injected
+ * {@link TelemetrySink}. Self-host's default sink is a no-op; cloud injects
+ * PostHog. The sink owns batching/background-flush, so this returns immediately.
+ */
+export declare function emitServerEvent(c: Context<AppEnv>, workspaceId: string, event: ServerEvent, properties: Record<string, unknown>): void;
+export {};
+//# sourceMappingURL=serverTelemetry.d.ts.map

package/dist/lib/serverTelemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverTelemetry.d.ts","sourceRoot":"","sources":["../../src/lib/serverTelemetry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGxC,KAAK,WAAW,GAAG,oBAAoB,MAAM,EAAE,CAAC;AAEhD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWpE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAClB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,WAAW,EAClB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,IAAI,CAyBN"}

package/dist/lib/serverTelemetry.js

@@ -0,0 +1,46 @@
+import { extractHarness, requiredOriginInfo, UNKNOWN_HARNESS } from './origin.js';
+export function normalizeRoutePathForTelemetry(value) {
+    const withoutQuery = value.split(/[?#]/)[0] ?? value;
+    const compact = withoutQuery.replace(/\/+/g, '/').trim();
+    const withLeadingSlash = compact.startsWith('/') ? compact : `/${compact}`;
+    const segments = withLeadingSlash.split('/').filter(Boolean).map((segment) => {
+        if (/^\d{6,}$/.test(segment))
+            return ':id';
+        if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(segment))
+            return ':id';
+        if (/^(dm|dmch|cmd|sub|wh)_[a-zA-Z0-9_-]{8,}$/.test(segment))
+            return ':id';
+        return segment;
+    });
+    return `/${segments.join('/')}`;
+}
+/**
+ * Emit a server-side product-telemetry event through the injected
+ * {@link TelemetrySink}. Self-host's default sink is a no-op; cloud injects
+ * PostHog. The sink owns batching/background-flush, so this returns immediately.
+ */
+export function emitServerEvent(c, workspaceId, event, properties) {
+    const normalizedProperties = { ...properties };
+    if (typeof normalizedProperties.route_path === 'string') {
+        normalizedProperties.route_path = normalizeRoutePathForTelemetry(normalizedProperties.route_path);
+    }
+    // Prefer the value stashed by the logger middleware. Fall back to reading the
+    // header directly so emitters that bypass middleware still get a sane value.
+    const harness = c.get('harness')
+        ?? extractHarness(c.req.raw.headers)
+        ?? UNKNOWN_HARNESS;
+    const origin = requiredOriginInfo(c.req.raw);
+    c.get('engine').telemetry.capture({
+        name: event,
+        distinctId: workspaceId,
+        properties: {
+            workspace_id: workspaceId,
+            harness,
+            origin_surface: origin.origin_surface,
+            origin_client: origin.origin_client,
+            origin_version: origin.origin_version,
+            ...normalizedProperties,
+        },
+    });
+}
+//# sourceMappingURL=serverTelemetry.js.map

package/dist/lib/serverTelemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverTelemetry.js","sourceRoot":"","sources":["../../src/lib/serverTelemetry.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAIlF,MAAM,UAAU,8BAA8B,CAAC,KAAa;IAC1D,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IACrD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,MAAM,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3E,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,IAAI,4EAA4E,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7G,IAAI,0CAA0C,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3E,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,CAAkB,EAClB,WAAmB,EACnB,KAAkB,EAClB,UAAmC;IAEnC,MAAM,oBAAoB,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC;IAC/C,IAAI,OAAO,oBAAoB,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACxD,oBAAoB,CAAC,UAAU,GAAG,8BAA8B,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACpG,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;WAC3B,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;WACjC,eAAe,CAAC;IAErB,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;QAChC,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,WAAW;QACvB,UAAU,EAAE;YACV,YAAY,EAAE,WAAW;YACzB,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,GAAG,oBAAoB;SACxB;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/ssrf.d.ts

@@ -0,0 +1,23 @@
+export interface SafeUrlOptions {
+    /**
+     * Reject loopback / link-local / private (RFC-1918, unique-local) hosts.
+     *
+     * Default `false` (permissive): the engine's primary consumer is single-tenant
+     * self-host, where the operator legitimately points A2A at LAN/localhost
+     * agents — so only the scheme is enforced. A multi-tenant hosted deployment
+     * should pass `strict: true` so an untrusted tenant can't aim the server at
+     * internal infrastructure (e.g. `169.254.169.254` cloud metadata).
+     */
+    strict?: boolean;
+}
+/**
+ * Guard for outbound fetches to operator/tenant-supplied URLs (A2A external
+ * agent URLs, agent-card URLs). Always rejects non-http(s) schemes; in `strict`
+ * mode additionally rejects loopback/link-local/private hosts.
+ *
+ * The strict host check is literal (no DNS resolution), so it does not defend
+ * against DNS-rebinding; a hardened deployment should also validate the resolved
+ * address at connect time.
+ */
+export declare function isSafeExternalUrl(rawUrl: string, options?: SafeUrlOptions): boolean;
+//# sourceMappingURL=ssrf.d.ts.map

package/dist/lib/ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.d.ts","sourceRoot":"","sources":["../../src/lib/ssrf.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CA6CvF"}

package/dist/lib/ssrf.js

@@ -0,0 +1,57 @@
+/**
+ * Guard for outbound fetches to operator/tenant-supplied URLs (A2A external
+ * agent URLs, agent-card URLs). Always rejects non-http(s) schemes; in `strict`
+ * mode additionally rejects loopback/link-local/private hosts.
+ *
+ * The strict host check is literal (no DNS resolution), so it does not defend
+ * against DNS-rebinding; a hardened deployment should also validate the resolved
+ * address at connect time.
+ */
+export function isSafeExternalUrl(rawUrl, options = {}) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+        return false;
+    if (!options.strict)
+        return true;
+    const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, ''); // strip IPv6 brackets
+    if (host === 'localhost' ||
+        host === '0.0.0.0' ||
+        host === '::' ||
+        host === '::1' ||
+        host.endsWith('.localhost') ||
+        host.endsWith('.local') ||
+        host.endsWith('.internal')) {
+        return false;
+    }
+    // IPv4 literal → check private/loopback/link-local ranges.
+    const v4 = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (v4) {
+        const [a, b] = [Number(v4[1]), Number(v4[2])];
+        if (a === 10)
+            return false; // 10.0.0.0/8
+        if (a === 127)
+            return false; // loopback
+        if (a === 0)
+            return false; // "this host"
+        if (a === 169 && b === 254)
+            return false; // link-local (incl. cloud metadata)
+        if (a === 172 && b >= 16 && b <= 31)
+            return false; // 172.16.0.0/12
+        if (a === 192 && b === 168)
+            return false; // 192.168.0.0/16
+        if (a >= 224)
+            return false; // multicast / reserved
+    }
+    // IPv6 unique-local (fc00::/7) and link-local (fe80::/10).
+    if (host.includes(':') && (host.startsWith('fc') || host.startsWith('fd') || host.startsWith('fe8') || host.startsWith('fe9') || host.startsWith('fea') || host.startsWith('feb'))) {
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=ssrf.js.map

package/dist/lib/ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../../src/lib/ssrf.ts"],"names":[],"mappings":"AAaA;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,UAA0B,EAAE;IAC5E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAExE,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB;IAEvF,IACE,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,SAAS;QAClB,IAAI,KAAK,IAAI;QACb,IAAI,KAAK,KAAK;QACd,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC1B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2DAA2D;IAC3D,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACtE,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC,CAAC,aAAa;QACzC,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC,CAAC,WAAW;QACxC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,cAAc;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC,CAAC,oCAAoC;QAC9E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;QACnE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC,CAAC,iBAAiB;QAC3D,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC,CAAC,uBAAuB;IACrD,CAAC;IAED,2DAA2D;IAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACnL,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/workspaceStream.d.ts

@@ -0,0 +1,9 @@
+import type { KeyValueStore } from '../ports/kv.js';
+export declare function getWorkspaceStreamConfig(kv: KeyValueStore, workspaceId: string, defaultEnabled?: boolean): Promise<{
+    enabled: boolean;
+    defaultEnabled: boolean;
+    override: boolean | null;
+}>;
+export declare function isWorkspaceStreamEnabled(kv: KeyValueStore, workspaceId: string, defaultEnabled?: boolean): Promise<boolean>;
+export declare function setWorkspaceStreamOverride(kv: KeyValueStore, workspaceId: string, override: boolean | null): Promise<void>;
+//# sourceMappingURL=workspaceStream.d.ts.map

package/dist/lib/workspaceStream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceStream.d.ts","sourceRoot":"","sources":["../../src/lib/workspaceStream.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AA2BpD,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,aAAa,EACjB,WAAW,EAAE,MAAM,EACnB,cAAc,GAAE,OAAyB,GACxC,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAA;CAAE,CAAC,CAuBlF;AAED,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,aAAa,EACjB,WAAW,EAAE,MAAM,EACnB,cAAc,GAAE,OAAyB,GACxC,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,aAAa,EACjB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,OAAO,GAAG,IAAI,GACvB,OAAO,CAAC,IAAI,CAAC,CAQf"}

package/dist/lib/workspaceStream.js

@@ -0,0 +1,53 @@
+const KEY_PREFIX = 'workspace-stream:';
+const CACHE_TTL_MS = 10_000;
+const DEFAULT_ENABLED = false;
+const cache = new Map();
+function parseBool(value) {
+    if (value == null)
+        return null;
+    const normalized = value.trim().toLowerCase();
+    if (['1', 'true', 'yes', 'on'].includes(normalized))
+        return true;
+    if (['0', 'false', 'no', 'off'].includes(normalized))
+        return false;
+    return null;
+}
+function getKey(workspaceId) {
+    return `${KEY_PREFIX}${workspaceId}`;
+}
+export async function getWorkspaceStreamConfig(kv, workspaceId, defaultEnabled = DEFAULT_ENABLED) {
+    const now = Date.now();
+    const cached = cache.get(workspaceId);
+    if (cached && cached.expiresAt > now) {
+        return {
+            enabled: cached.enabled,
+            defaultEnabled: cached.defaultEnabled,
+            override: cached.override,
+        };
+    }
+    const raw = await kv.get(getKey(workspaceId));
+    const override = parseBool(raw);
+    const enabled = override ?? defaultEnabled;
+    cache.set(workspaceId, {
+        enabled,
+        defaultEnabled,
+        override,
+        expiresAt: now + CACHE_TTL_MS,
+    });
+    return { enabled, defaultEnabled, override };
+}
+export async function isWorkspaceStreamEnabled(kv, workspaceId, defaultEnabled = DEFAULT_ENABLED) {
+    const cfg = await getWorkspaceStreamConfig(kv, workspaceId, defaultEnabled);
+    return cfg.enabled;
+}
+export async function setWorkspaceStreamOverride(kv, workspaceId, override) {
+    const key = getKey(workspaceId);
+    if (override === null) {
+        await kv.delete(key);
+    }
+    else {
+        await kv.put(key, override ? 'true' : 'false');
+    }
+    cache.delete(workspaceId);
+}
+//# sourceMappingURL=workspaceStream.js.map

package/dist/lib/workspaceStream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceStream.js","sourceRoot":"","sources":["../../src/lib/workspaceStream.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAAG,mBAAmB,CAAC;AACvC,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,eAAe,GAAG,KAAK,CAAC;AAS9B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAE5C,SAAS,SAAS,CAAC,KAAgC;IACjD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,WAAmB;IACjC,OAAO,GAAG,UAAU,GAAG,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAiB,EACjB,WAAmB,EACnB,iBAA0B,eAAe;IAEzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACrC,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,QAAQ,IAAI,cAAc,CAAC;IAE3C,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE;QACrB,OAAO;QACP,cAAc;QACd,QAAQ;QACR,SAAS,EAAE,GAAG,GAAG,YAAY;KAC9B,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAiB,EACjB,WAAmB,EACnB,iBAA0B,eAAe;IAEzC,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAiB,EACjB,WAAmB,EACnB,QAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC5B,CAAC"}

package/dist/middleware/auth.d.ts

@@ -0,0 +1,9 @@
+import type { AppEnv } from '../env.js';
+export { hashToken } from '../auth/index.js';
+/** Requires a workspace key (`rk_live_...`). */
+export declare const requireWorkspaceKey: import("hono").MiddlewareHandler<AppEnv, string, {}, Response>;
+/** Accepts either a workspace key or an agent token. */
+export declare const requireAuth: import("hono").MiddlewareHandler<AppEnv, string, {}, Response>;
+/** Requires an agent token (`at_live_...`). */
+export declare const requireAgentToken: import("hono").MiddlewareHandler<AppEnv, string, {}, Response>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAKxC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAyC7C,gDAAgD;AAChD,eAAO,MAAM,mBAAmB,gEAAkC,CAAC;AAEnE,wDAAwD;AACxD,eAAO,MAAM,WAAW,gEAA4B,CAAC;AAErD,+CAA+C;AAC/C,eAAO,MAAM,iBAAiB,gEAA8B,CAAC"}

package/dist/middleware/auth.js

@@ -0,0 +1,40 @@
+import { createMiddleware } from 'hono/factory';
+import { touchLastSeen } from '../engine/agent.js';
+// Re-exported for the WS upgrade + MCP key handling, which look tokens up
+// directly. The active provider's `hashToken` is preferred at those call sites.
+export { hashToken } from '../auth/index.js';
+const LAST_SEEN_DEBOUNCE_MS = 30_000; // 30 seconds
+function extractToken(authHeader) {
+    if (!authHeader?.startsWith('Bearer '))
+        return null;
+    return authHeader.slice(7);
+}
+function makeAuthMiddleware(require) {
+    return createMiddleware(async (c, next) => {
+        const token = extractToken(c.req.header('Authorization'));
+        if (!token) {
+            return c.json({ ok: false, error: { code: 'unauthorized', message: 'Missing or invalid Authorization header' } }, 401);
+        }
+        const db = c.get('db');
+        const result = await c.get('engine').auth.authenticate({ token, require, db });
+        if (!result.ok) {
+            return c.json({ ok: false, error: { code: result.code, message: result.message } }, result.status);
+        }
+        c.set('workspace', result.workspace);
+        if (result.agent) {
+            c.set('agent', result.agent);
+            // Touch lastSeen (debounced, fire-and-forget)
+            if (Date.now() - result.agent.lastSeen.getTime() > LAST_SEEN_DEBOUNCE_MS) {
+                touchLastSeen(db, result.agent.id).catch(() => { });
+            }
+        }
+        await next();
+    });
+}
+/** Requires a workspace key (`rk_live_...`). */
+export const requireWorkspaceKey = makeAuthMiddleware('workspace');
+/** Accepts either a workspace key or an agent token. */
+export const requireAuth = makeAuthMiddleware('any');
+/** Requires an agent token (`at_live_...`). */
+export const requireAgentToken = makeAuthMiddleware('agent');
+//# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAInD,0EAA0E;AAC1E,gFAAgF;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,qBAAqB,GAAG,MAAM,CAAC,CAAC,aAAa;AAEnD,SAAS,YAAY,CAAC,UAA8B;IAClD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAoB;IAC9C,OAAO,gBAAgB,CAAS,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,yCAAyC,EAAE,EAAE,EAClG,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,EACpE,MAAM,CAAC,MAA8B,CACtC,CAAC;QACJ,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7B,8CAA8C;YAC9C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,qBAAqB,EAAE,CAAC;gBACzE,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;AAEnE,wDAAwD;AACxD,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;AAErD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC"}

package/dist/middleware/engine-context.d.ts

@@ -0,0 +1,9 @@
+import type { AppEnv, EngineRuntime } from '../env.js';
+/**
+ * Injects the deployment's {@link EngineRuntime} (ports + providers + config)
+ * onto every request, plus the convenience `db` variable. Mounted first by
+ * `createEngine`, so all downstream engine code reads infrastructure off
+ * `c.get('engine')` / `c.get('db')` rather than Cloudflare `c.env` bindings.
+ */
+export declare function engineContext(runtime: EngineRuntime): import("hono").MiddlewareHandler<AppEnv, string, {}, Response>;
+//# sourceMappingURL=engine-context.d.ts.map

package/dist/middleware/engine-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-context.d.ts","sourceRoot":"","sources":["../../src/middleware/engine-context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,kEAMnD"}

package/dist/middleware/engine-context.js

@@ -0,0 +1,15 @@
+import { createMiddleware } from 'hono/factory';
+/**
+ * Injects the deployment's {@link EngineRuntime} (ports + providers + config)
+ * onto every request, plus the convenience `db` variable. Mounted first by
+ * `createEngine`, so all downstream engine code reads infrastructure off
+ * `c.get('engine')` / `c.get('db')` rather than Cloudflare `c.env` bindings.
+ */
+export function engineContext(runtime) {
+    return createMiddleware(async (c, next) => {
+        c.set('engine', runtime);
+        c.set('db', runtime.db);
+        await next();
+    });
+}
+//# sourceMappingURL=engine-context.js.map

package/dist/middleware/engine-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-context.js","sourceRoot":"","sources":["../../src/middleware/engine-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,OAAsB;IAClD,OAAO,gBAAgB,CAAS,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAChD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzB,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/middleware/idempotency.d.ts

@@ -0,0 +1,24 @@
+import type { KeyValueStore } from '../ports/kv.js';
+export interface IdempotentResult<T> {
+    status: number;
+    data: T;
+    replayed: boolean;
+}
+interface RunIdempotentOptions<T> {
+    workspaceId: string;
+    actorId: string;
+    scope: string;
+    key?: string;
+    status?: number;
+    fingerprint?: string;
+    ttlSeconds?: number;
+    kv?: KeyValueStore;
+    operation: () => Promise<T>;
+}
+export declare function parseIdempotencyKey(headerValue: string | undefined): {
+    key?: string;
+    error?: string;
+};
+export declare function runIdempotent<T>(options: RunIdempotentOptions<T>): Promise<IdempotentResult<T>>;
+export {};
+//# sourceMappingURL=idempotency.d.ts.map

package/dist/middleware/idempotency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../../src/middleware/idempotency.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAYpD,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,CAAC,CAAC;IACR,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,UAAU,oBAAoB,CAAC,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,EAAE,CAAC,EAAE,aAAa,CAAC;IACnB,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7B;AAQD,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAwBrG;AAED,wBAAsB,aAAa,CAAC,CAAC,EACnC,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAiI9B"}

package/dist/middleware/idempotency.js

@@ -0,0 +1,148 @@
+import { createHash } from 'node:crypto';
+const IDEMPOTENCY_TTL_SECONDS = 24 * 60 * 60;
+const IDEMPOTENCY_LOCK_TTL_SECONDS = 30;
+const IDEMPOTENCY_KEY_MAX_LENGTH = 255;
+function buildKey(workspaceId, actorId, scope, key) {
+    const digest = createHash('sha256').update(key).digest('hex');
+    const scopeDigest = createHash('sha256').update(scope).digest('hex').slice(0, 16);
+    return `idem:v1:${workspaceId}:${actorId}:${scopeDigest}:${digest}`;
+}
+export function parseIdempotencyKey(headerValue) {
+    if (headerValue === undefined) {
+        return {};
+    }
+    const key = headerValue.trim();
+    if (!key) {
+        return { error: 'Idempotency-Key cannot be empty' };
+    }
+    if (key.length > IDEMPOTENCY_KEY_MAX_LENGTH) {
+        return {
+            error: `Idempotency-Key must be ${IDEMPOTENCY_KEY_MAX_LENGTH} characters or fewer`,
+        };
+    }
+    // Restrict to visible ASCII (no whitespace/control chars)
+    if (/[^\x21-\x7E]/.test(key)) {
+        return {
+            error: 'Idempotency-Key must contain only visible ASCII characters',
+        };
+    }
+    return { key };
+}
+export async function runIdempotent(options) {
+    const { workspaceId, actorId, scope, key, fingerprint, operation, status = 201, ttlSeconds = IDEMPOTENCY_TTL_SECONDS, kv, } = options;
+    if (!key) {
+        const data = await operation();
+        return { status, data, replayed: false };
+    }
+    let kvStore = kv ?? null;
+    let kvKey = null;
+    let lockKey = null;
+    let lockAcquired = false;
+    if (kvStore) {
+        kvKey = buildKey(workspaceId, actorId, scope, key);
+        lockKey = `${kvKey}:lock`;
+        try {
+            const existingRaw = await kvStore.get(kvKey);
+            if (existingRaw) {
+                const parsed = JSON.parse(existingRaw);
+                if (fingerprint && parsed.fingerprint && parsed.fingerprint !== fingerprint) {
+                    const err = new Error('Idempotency-Key was reused with a different request payload');
+                    Object.assign(err, { code: 'idempotency_key_reused', status: 409 });
+                    throw err;
+                }
+                return {
+                    status: parsed.status || status,
+                    data: parsed.data,
+                    replayed: true,
+                };
+            }
+            // KV doesn't support atomic NX-style set, so we do a read-then-write for the lock.
+            // This is best-effort; in rare race conditions, duplicate operations may run.
+            const existingLock = await kvStore.get(lockKey);
+            if (existingLock) {
+                // Another request may be processing. Check if result is now available.
+                const concurrentRaw = await kvStore.get(kvKey);
+                if (concurrentRaw) {
+                    const parsed = JSON.parse(concurrentRaw);
+                    if (fingerprint && parsed.fingerprint && parsed.fingerprint !== fingerprint) {
+                        const err = new Error('Idempotency-Key was reused with a different request payload');
+                        Object.assign(err, { code: 'idempotency_key_reused', status: 409 });
+                        throw err;
+                    }
+                    return {
+                        status: parsed.status || status,
+                        data: parsed.data,
+                        replayed: true,
+                    };
+                }
+                const err = new Error('Another request with this Idempotency-Key is still processing');
+                Object.assign(err, { code: 'idempotency_in_progress', status: 409 });
+                throw err;
+            }
+            // Acquire lock
+            await kvStore.put(lockKey, '1', { expirationTtl: IDEMPOTENCY_LOCK_TTL_SECONDS });
+            lockAcquired = true;
+            // Re-check record after acquiring lock to handle race with completed request
+            const recheckRaw = await kvStore.get(kvKey);
+            if (recheckRaw) {
+                await kvStore.delete(lockKey);
+                const parsed = JSON.parse(recheckRaw);
+                if (fingerprint && parsed.fingerprint && parsed.fingerprint !== fingerprint) {
+                    const err = new Error('Idempotency-Key was reused with a different request payload');
+                    Object.assign(err, { code: 'idempotency_key_reused', status: 409 });
+                    throw err;
+                }
+                return {
+                    status: parsed.status || status,
+                    data: parsed.data,
+                    replayed: true,
+                };
+            }
+        }
+        catch (err) {
+            if (err instanceof Error && ['idempotency_key_reused', 'idempotency_in_progress'].includes(err.code ?? '')) {
+                throw err;
+            }
+            // KV unavailable or decode failure: proceed without idempotency.
+            kvStore = null;
+            kvKey = null;
+            lockKey = null;
+            lockAcquired = false;
+        }
+    }
+    try {
+        const data = await operation();
+        if (kvStore && kvKey && lockAcquired) {
+            const record = {
+                status,
+                data,
+                fingerprint,
+            };
+            try {
+                await kvStore.put(kvKey, JSON.stringify(record), { expirationTtl: ttlSeconds });
+            }
+            catch {
+                // KV failure during record storage — proceed without idempotency record.
+            }
+            finally {
+                if (lockKey) {
+                    try {
+                        await kvStore.delete(lockKey);
+                    }
+                    catch { /* ignore */ }
+                }
+            }
+        }
+        return { status, data, replayed: false };
+    }
+    catch (err) {
+        if (kvStore && lockKey && lockAcquired) {
+            try {
+                await kvStore.delete(lockKey);
+            }
+            catch { /* ignore */ }
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=idempotency.js.map

package/dist/middleware/idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../../src/middleware/idempotency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC7C,MAAM,4BAA4B,GAAG,EAAE,CAAC;AACxC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AA0BvC,SAAS,QAAQ,CAAC,WAAmB,EAAE,OAAe,EAAE,KAAa,EAAE,GAAW;IAChF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,WAAW,WAAW,IAAI,OAAO,IAAI,WAAW,IAAI,MAAM,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAA+B;IACjE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;QAC5C,OAAO;YACL,KAAK,EAAE,2BAA2B,0BAA0B,sBAAsB;SACnF,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,4DAA4D;SACpE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgC;IAEhC,MAAM,EACJ,WAAW,EACX,OAAO,EACP,KAAK,EACL,GAAG,EACH,WAAW,EACX,SAAS,EACT,MAAM,GAAG,GAAG,EACZ,UAAU,GAAG,uBAAuB,EACpC,EAAE,GACH,GAAG,OAAO,CAAC;IAEZ,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,OAAO,GAAyB,EAAE,IAAI,IAAI,CAAC;IAC/C,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACnD,OAAO,GAAG,GAAG,KAAK,OAAO,CAAC;QAE1B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAA+B,CAAC;gBACrE,IAAI,WAAW,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;oBAC5E,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;oBACrF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;oBACpE,MAAM,GAAG,CAAC;gBACZ,CAAC;gBAED,OAAO;oBACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM;oBAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,QAAQ,EAAE,IAAI;iBACf,CAAC;YACJ,CAAC;YAED,mFAAmF;YACnF,8EAA8E;YAC9E,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,YAAY,EAAE,CAAC;gBACjB,uEAAuE;gBACvE,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC/C,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAA+B,CAAC;oBACvE,IAAI,WAAW,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;wBAC5E,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;wBACrF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;wBACpE,MAAM,GAAG,CAAC;oBACZ,CAAC;oBAED,OAAO;wBACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM;wBAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,QAAQ,EAAE,IAAI;qBACf,CAAC;gBACJ,CAAC;gBAED,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;gBACvF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACrE,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,eAAe;YACf,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACjF,YAAY,GAAG,IAAI,CAAC;YAEpB,6EAA6E;YAC7E,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAA+B,CAAC;gBACpE,IAAI,WAAW,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;oBAC5E,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;oBACrF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;oBACpE,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,OAAO;oBACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM;oBAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,QAAQ,EAAE,IAAI;iBACf,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,KAAK,IAAI,CAAC,wBAAwB,EAAE,yBAAyB,CAAC,CAAC,QAAQ,CAAE,GAAiC,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC1I,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,iEAAiE;YACjE,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,GAAG,IAAI,CAAC;YACb,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;QAE/B,IAAI,OAAO,IAAI,KAAK,IAAI,YAAY,EAAE,CAAC;YACrC,MAAM,MAAM,GAA+B;gBACzC,MAAM;gBACN,IAAI;gBACJ,WAAW;aACZ,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;YAClF,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;YAC3E,CAAC;oBAAS,CAAC;gBACT,IAAI,OAAO,EAAE,CAAC;oBACZ,IAAI,CAAC;wBAAC,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;YACvC,IAAI,CAAC;gBAAC,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/middleware/logger.d.ts

@@ -0,0 +1,4 @@
+import type { MiddlewareHandler } from 'hono';
+import type { AppEnv } from '../env.js';
+export declare const loggerMiddleware: MiddlewareHandler<AppEnv>;
+//# sourceMappingURL=logger.d.ts.map

package/dist/middleware/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAwGxC,eAAO,MAAM,gBAAgB,EAAE,iBAAiB,CAAC,MAAM,CA+DtD,CAAC"}