@rudderhq/server 0.7.24-canary.2 → 0.7.24-canary.21

package/dist/services/rust-foundation-bridge.js

@@ -0,0 +1,802 @@
+import { resolveRudderNativeTarget } from "@rudderhq/shared";
+import { spawn } from "node:child_process";
+import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
+import { accessSync, existsSync, constants as fsConstants, statSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { createInterface } from "node:readline";
+import { setTimeout as delay } from "node:timers/promises";
+import { fileURLToPath } from "node:url";
+export class RustFoundationBridgeError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.code = code;
+        this.name = "RustFoundationBridgeError";
+    }
+}
+const ACTOR_ENVELOPE_AUDIENCE = "rudder-server-foundation";
+const ACTOR_ENVELOPE_ACTION = "organization.members.directory.read";
+const ORGANIZATION_BRANDING_ACTION = "organization.branding.update";
+const ORGANIZATION_RESOURCE_ACTION = "organization.resource.mutate";
+const PROJECT_GOAL_SET_ACTION = "project.goal_set.replace";
+const PROJECT_DELETE_ACTION = "project.delete";
+const PROJECT_CREATE_ACTION = "project.create";
+const PROJECT_READ_ACTION = "project.read";
+const ACTOR_ENVELOPE_PROTOCOL_VERSION = 2;
+const ACTOR_ENVELOPE_SCHEMA = "rudder.actor-envelope.v2";
+const ACTOR_ENVELOPE_LIFETIME_SECONDS = 60;
+const DEFAULT_REQUEST_TIMEOUT_MS = 3_000;
+const DEFAULT_READY_TIMEOUT_MS = 5_000;
+function debugBridge(message) {
+    if (process.env.RUDDER_RUST_BRIDGE_DEBUG === "true") {
+        process.stderr.write(`[rudder-rust-bridge] ${message}\n`);
+    }
+}
+function configuredMode(value, envName, defaultMode = "off") {
+    const mode = value?.trim() || defaultMode;
+    if (mode === "off" || mode === "shadow" || mode === "required")
+        return mode;
+    throw new RustFoundationBridgeError("invalid_mode", `${envName} must be off, shadow, or required; received ${mode}`);
+}
+function actorIdentity(actor) {
+    if (actor.type === "agent") {
+        if (!actor.agentId)
+            throw new RustFoundationBridgeError("request_failed", "Authenticated agent has no agent id");
+        return { kind: "agent", id: actor.agentId };
+    }
+    if (actor.type === "board") {
+        return { kind: "user", id: actor.userId ?? "local-board" };
+    }
+    throw new RustFoundationBridgeError("request_failed", "Rust bridge requires an authenticated actor");
+}
+function actorSession(actor) {
+    const explicit = actor.sessionId?.trim();
+    if (explicit)
+        return explicit;
+    return `${actor.source}:${actor.keyId ?? actor.userId ?? actor.agentId ?? "unknown"}`;
+}
+function appendLengthPrefixed(output, value) {
+    const bytes = Buffer.from(value, "utf8");
+    const length = Buffer.allocUnsafe(8);
+    length.writeBigUInt64BE(BigInt(bytes.byteLength));
+    output.push(length, bytes);
+}
+function canonicalSigningBytes(input) {
+    const output = [Buffer.from(ACTOR_ENVELOPE_SCHEMA, "utf8"), Buffer.from([0])];
+    const protocol = Buffer.allocUnsafe(2);
+    protocol.writeUInt16BE(ACTOR_ENVELOPE_PROTOCOL_VERSION);
+    output.push(protocol);
+    for (const field of [
+        input.actor.kind,
+        input.actor.id,
+        input.organizationId,
+        input.sessionId,
+        input.audience,
+        input.method,
+        input.path,
+        input.action,
+        input.bodySha256,
+        input.requestId,
+        input.nonce,
+    ]) {
+        appendLengthPrefixed(output, field);
+    }
+    if (input.idempotencyKey) {
+        appendLengthPrefixed(output, input.idempotencyKey);
+    }
+    for (const value of [input.authEpoch, input.issuedAt, input.expiresAt]) {
+        const encoded = Buffer.allocUnsafe(8);
+        encoded.writeBigUInt64BE(BigInt(value));
+        output.push(encoded);
+    }
+    return Buffer.concat(output);
+}
+export function createRustActorEnvelope(input) {
+    const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);
+    const requestId = input.requestId ?? randomUUID();
+    const nonce = input.nonce ?? randomUUID();
+    const actor = actorIdentity(input.actor);
+    const sessionId = actorSession(input.actor);
+    const authEpoch = Number.isSafeInteger(input.actor.authEpoch) && (input.actor.authEpoch ?? 0) > 0
+        ? input.actor.authEpoch
+        : 1;
+    const unsigned = {
+        protocolVersion: ACTOR_ENVELOPE_PROTOCOL_VERSION,
+        actor,
+        organizationId: input.organizationId,
+        sessionId,
+        authEpoch,
+        audience: ACTOR_ENVELOPE_AUDIENCE,
+        method: input.method,
+        path: input.path,
+        action: input.action,
+        bodySha256: createHash("sha256").update(input.body).digest("hex"),
+        requestId,
+        nonce,
+        idempotencyKey: input.idempotencyKey ?? null,
+        issuedAt: Math.max(1, now - 1),
+        expiresAt: now + ACTOR_ENVELOPE_LIFETIME_SECONDS,
+    };
+    const signature = createHmac("sha256", Buffer.from(input.secret, "utf8")).update(canonicalSigningBytes(unsigned)).digest("hex");
+    return { ...unsigned, signature };
+}
+function isLoopbackBoundAddress(value) {
+    const [host] = value.startsWith("[")
+        ? [value.slice(1, value.indexOf("]"))]
+        : value.split(":");
+    return host === "127.0.0.1" || host === "localhost" || host === "::1";
+}
+function candidateBinaryPaths(configured) {
+    const explicit = configured?.trim();
+    if (explicit)
+        return [explicit];
+    const moduleDirectory = dirname(fileURLToPath(import.meta.url));
+    const repositoryRoot = resolve(moduleDirectory, "../../..");
+    const serverPackageRoot = resolve(moduleDirectory, "../..");
+    const isSourceRuntime = basename(moduleDirectory) === "services"
+        && basename(dirname(moduleDirectory)) === "src";
+    const binaryName = process.platform === "win32"
+        ? "rudder-server-foundation.exe"
+        : "rudder-server-foundation";
+    const candidates = [];
+    const target = resolveRudderNativeTarget();
+    if (target) {
+        candidates.push(join(serverPackageRoot, "resources", "native", target, binaryName));
+    }
+    // Only source modules get repository build outputs; installed modules fail closed without their packaged asset.
+    if (isSourceRuntime) {
+        candidates.push(join(repositoryRoot, "native", "target", "debug", binaryName), join(repositoryRoot, "native", "target", "release", binaryName));
+    }
+    return candidates;
+}
+function createFoundationChildEnvironment(input) {
+    return {
+        RUDDER_NATIVE_LISTEN: "127.0.0.1:0",
+        RUDDER_NATIVE_DATABASE_URL: input.databaseUrl,
+        RUDDER_NATIVE_DATABASE_REQUIRED: "true",
+        RUDDER_NATIVE_ACTOR_ENVELOPE_KEY: input.actorEnvelopeKey,
+        ...(input.publicIngress ? {
+            RUDDER_NATIVE_PUBLIC_LISTEN: input.publicIngress.listenAddr,
+            RUDDER_NATIVE_NODE_UPSTREAM: input.publicIngress.nodeUpstream,
+            RUDDER_NATIVE_INGRESS_AUTH_KEY: input.publicIngress.authorizationKey,
+            ...(input.publicIngress.trustedProxies ? { RUDDER_NATIVE_INGRESS_TRUSTED_PROXIES: input.publicIngress.trustedProxies } : {}),
+        } : {}),
+    };
+}
+function resolveBinaryPath(configured) {
+    const candidate = candidateBinaryPaths(configured).find((value) => {
+        try {
+            if (!existsSync(value) || !statSync(value).isFile())
+                return false;
+            accessSync(value, process.platform === "win32" ? fsConstants.F_OK : fsConstants.X_OK);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
+    return candidate ?? null;
+}
+function childHasExited(child) {
+    return child.exitCode !== null || child.signalCode !== null;
+}
+function waitForChildExit(child, timeoutMs) {
+    if (childHasExited(child))
+        return Promise.resolve(true);
+    return new Promise((resolveExit) => {
+        let settled = false;
+        let timer;
+        const finish = (exited) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            child.off("exit", onExit);
+            child.off("error", onError);
+            resolveExit(exited);
+        };
+        const onExit = () => finish(true);
+        const onError = () => finish(true);
+        child.once("exit", onExit);
+        child.once("error", onError);
+        if (childHasExited(child)) {
+            finish(true);
+        }
+        else if (timeoutMs !== undefined) {
+            timer = setTimeout(() => finish(false), timeoutMs);
+        }
+    });
+}
+async function stopChild(child, spawnFailed = false) {
+    if (spawnFailed || childHasExited(child))
+        return;
+    try {
+        child.kill("SIGTERM");
+    }
+    catch {
+        // The process may have exited between the state check and the signal.
+    }
+    if (await waitForChildExit(child, 2_000))
+        return;
+    try {
+        child.kill("SIGKILL");
+    }
+    catch {
+        // The process may have exited while the graceful-stop timeout elapsed.
+    }
+    await waitForChildExit(child);
+}
+export function createRustFoundationBridge(options) {
+    const mode = configuredMode(options.mode ?? process.env.RUDDER_RUST_MEMBER_DIRECTORY_MODE, "RUDDER_RUST_MEMBER_DIRECTORY_MODE", "required");
+    const organizationBrandingMode = configuredMode(options.organizationBrandingMode ?? process.env.RUDDER_RUST_ORGANIZATION_BRANDING_MODE, "RUDDER_RUST_ORGANIZATION_BRANDING_MODE");
+    const projectGoalSetMode = configuredMode(options.projectGoalSetMode ?? process.env.RUDDER_RUST_PROJECT_GOAL_SET_MODE, "RUDDER_RUST_PROJECT_GOAL_SET_MODE", "required");
+    const actorEnvelopeKey = options.actorEnvelopeKey?.trim()
+        || process.env.RUDDER_NATIVE_ACTOR_ENVELOPE_KEY?.trim()
+        || randomBytes(32).toString("hex");
+    // Project and live-run reads are API-wide Rust capabilities, independent
+    // of entity mutation ownership and the remaining mutation pilot switches.
+    const requiresStartup = true;
+    let child = null;
+    let baseUrl = null;
+    let publicIngressBaseUrl = null;
+    let lifecycleState = "idle";
+    let lifecycleTail = Promise.resolve();
+    let lastStderr = "";
+    const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+    const start = async () => {
+        lifecycleState = "starting";
+        let spawned = null;
+        let spawnFailed = false;
+        try {
+            if (!options.databaseUrl.trim()) {
+                throw new RustFoundationBridgeError("database_unconfigured", "Rust foundation bridge requires the active database URL");
+            }
+            const binary = resolveBinaryPath(options.binaryPath ?? process.env.RUDDER_SERVER_FOUNDATION_PATH);
+            if (!binary) {
+                throw new RustFoundationBridgeError("binary_unavailable", "rudder-server-foundation binary is unavailable");
+            }
+            lastStderr = "";
+            const processHandle = spawn(binary, [], {
+                cwd: resolve(dirname(fileURLToPath(import.meta.url)), "../../.."),
+                env: createFoundationChildEnvironment({
+                    databaseUrl: options.databaseUrl,
+                    actorEnvelopeKey,
+                    publicIngress: options.publicIngress,
+                }),
+                stdio: ["ignore", "pipe", "pipe"],
+            });
+            spawned = processHandle;
+            child = spawned;
+            debugBridge(`started pid=${spawned.pid ?? "unknown"}`);
+            spawned.once("error", () => {
+                spawnFailed = true;
+            });
+            spawned.stderr.on("data", (chunk) => {
+                lastStderr = `${lastStderr}${chunk.toString("utf8")}`.slice(-2_000);
+            });
+            spawned.once("exit", () => {
+                if (child === spawned) {
+                    child = null;
+                    baseUrl = null;
+                    publicIngressBaseUrl = null;
+                    if (lifecycleState !== "closing")
+                        lifecycleState = "idle";
+                }
+            });
+            const stdout = createInterface({ input: spawned.stdout });
+            const startupLine = await new Promise((resolveLine, rejectLine) => {
+                const onLine = (line) => {
+                    cleanup();
+                    resolveLine(line);
+                };
+                const onError = (error) => {
+                    cleanup();
+                    rejectLine(error);
+                };
+                const onExit = (code, signal) => {
+                    cleanup();
+                    rejectLine(new Error(`Rust foundation exited before startup (${code ?? signal ?? "unknown"})`));
+                };
+                const cleanup = () => {
+                    stdout.off("line", onLine);
+                    spawned?.off("error", onError);
+                    spawned?.off("exit", onExit);
+                    stdout.close();
+                };
+                stdout.once("line", onLine);
+                processHandle.once("error", onError);
+                processHandle.once("exit", onExit);
+            }).catch((error) => {
+                throw new RustFoundationBridgeError("startup_failed", `Rust foundation startup failed${lastStderr ? `: ${lastStderr.trim()}` : ""}`, { cause: error });
+            });
+            let receipt;
+            try {
+                const parsed = JSON.parse(startupLine);
+                if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+                    throw new Error("startup receipt must be a JSON object");
+                }
+                receipt = parsed;
+            }
+            catch (error) {
+                throw new RustFoundationBridgeError("startup_failed", "Rust foundation emitted an invalid startup receipt", { cause: error });
+            }
+            const boundAddr = typeof receipt.boundAddr === "string" ? receipt.boundAddr : null;
+            if (!boundAddr || !isLoopbackBoundAddress(boundAddr) || receipt.publicListener === true || receipt.productWriteAuthority === true) {
+                throw new RustFoundationBridgeError("startup_failed", "Rust foundation startup receipt violated the private bridge contract");
+            }
+            baseUrl = `http://${boundAddr}`;
+            if (options.publicIngress) {
+                const publicAddr = receipt.publicIngress?.boundAddr;
+                const expected = options.publicIngress.listenAddr;
+                const expectedPort = expected.slice(expected.lastIndexOf(":") + 1);
+                const expectedHost = expected.slice(0, expected.lastIndexOf(":") + 1);
+                if (typeof publicAddr !== "string"
+                    || receipt.publicIngress?.publicListener !== true
+                    || !publicAddr.startsWith(expectedHost)
+                    || (expectedPort !== "0" && publicAddr !== expected)
+                    || !/^\d+$/.test(publicAddr.slice(publicAddr.lastIndexOf(":") + 1))
+                    || Number(publicAddr.slice(publicAddr.lastIndexOf(":") + 1)) < 1
+                    || Number(publicAddr.slice(publicAddr.lastIndexOf(":") + 1)) > 65535
+                    || publicAddr === boundAddr) {
+                    throw new RustFoundationBridgeError("startup_failed", "Rust public ingress binding did not match the requested listener");
+                }
+                publicIngressBaseUrl = `http://${publicAddr}`;
+            }
+            else if (receipt.publicIngress !== undefined) {
+                throw new RustFoundationBridgeError("startup_failed", "Unexpected Rust public ingress listener");
+            }
+            const deadline = Date.now() + DEFAULT_READY_TIMEOUT_MS;
+            while (Date.now() < deadline) {
+                try {
+                    const response = await fetch(`${baseUrl}/readyz`, {
+                        signal: AbortSignal.timeout(Math.min(requestTimeoutMs, 1_000)),
+                    });
+                    if (response.status === 200) {
+                        lifecycleState = "ready";
+                        return;
+                    }
+                }
+                catch {
+                    // The process may need a short interval between binding and readiness.
+                }
+                await delay(50);
+            }
+            throw new RustFoundationBridgeError("not_ready", "Rust foundation did not become ready", {
+                cause: new Error(lastStderr || "ready probe failed"),
+            });
+        }
+        catch (error) {
+            const startupError = error instanceof RustFoundationBridgeError
+                ? error
+                : new RustFoundationBridgeError("startup_failed", "Rust foundation startup failed", { cause: error });
+            baseUrl = null;
+            publicIngressBaseUrl = null;
+            if (spawned)
+                await stopChild(spawned, spawnFailed);
+            if (child === spawned)
+                child = null;
+            lifecycleState = "idle";
+            throw startupError;
+        }
+    };
+    const enqueueLifecycle = (operation) => {
+        const run = lifecycleTail.then(operation, operation);
+        lifecycleTail = run.then(() => undefined, () => undefined);
+        return run;
+    };
+    const ensureStarted = () => enqueueLifecycle(async () => {
+        if (lifecycleState === "ready" && child && baseUrl && !childHasExited(child))
+            return;
+        await start();
+    });
+    const close = () => enqueueLifecycle(async () => {
+        lifecycleState = "closing";
+        const current = child;
+        baseUrl = null;
+        publicIngressBaseUrl = null;
+        debugBridge(`close requested pid=${current?.pid ?? "none"}`);
+        try {
+            if (current)
+                await stopChild(current);
+        }
+        finally {
+            if (child === current)
+                child = null;
+            baseUrl = null;
+            lifecycleState = "idle";
+            debugBridge(`close completed pid=${current?.pid ?? "none"} exitCode=${current?.exitCode ?? "none"} signal=${current?.signalCode ?? "none"}`);
+        }
+    });
+    return {
+        mode,
+        organizationBrandingMode,
+        projectGoalSetMode,
+        requiresStartup,
+        get publicIngressBaseUrl() { return publicIngressBaseUrl; },
+        async waitForPublicIngressReady() {
+            if (!options.publicIngress || !publicIngressBaseUrl || !child || childHasExited(child)) {
+                throw new RustFoundationBridgeError("not_ready", "Rust public ingress is not running");
+            }
+            // Called after the private Node listener binds: public readiness includes
+            // that upstream, whereas start() checks only the private Rust listener.
+            const probeUrl = publicIngressBaseUrl.replace("http://0.0.0.0:", "http://127.0.0.1:")
+                .replace("http://[::]:", "http://[::1]:");
+            const deadline = Date.now() + DEFAULT_READY_TIMEOUT_MS;
+            while (Date.now() < deadline && child && !childHasExited(child)) {
+                try {
+                    const response = await fetch(`${probeUrl}/readyz`, {
+                        signal: AbortSignal.timeout(Math.min(requestTimeoutMs, 1_000)),
+                    });
+                    if (response.status === 200)
+                        return;
+                }
+                catch { /* Remain fail-closed while the upstream starts. */ }
+                await delay(50);
+            }
+            throw new RustFoundationBridgeError("not_ready", "Rust public ingress did not become ready");
+        },
+        start: ensureStarted,
+        async projectRead(actor, orgId, input) {
+            await ensureStarted();
+            if (!baseUrl)
+                throw new RustFoundationBridgeError("request_failed", "Rust foundation bridge is not running");
+            const requestPath = `/internal/orgs/${encodeURIComponent(orgId)}/project-reads`;
+            const body = Buffer.from(JSON.stringify(input), "utf8");
+            const requestId = randomUUID();
+            const envelope = createRustActorEnvelope({
+                actor,
+                organizationId: orgId,
+                method: "POST",
+                path: requestPath,
+                action: PROJECT_READ_ACTION,
+                body,
+                secret: actorEnvelopeKey,
+                requestId,
+            });
+            try {
+                const response = await fetch(`${baseUrl}${requestPath}`, {
+                    method: "POST",
+                    headers: {
+                        "content-type": "application/json",
+                        "x-rudder-actor-envelope": JSON.stringify(envelope),
+                        "x-rudder-request-id": requestId,
+                    },
+                    body: body,
+                    signal: AbortSignal.timeout(requestTimeoutMs),
+                });
+                return {
+                    status: response.status,
+                    contentType: response.headers.get("content-type") ?? "application/json",
+                    body: Buffer.from(await response.arrayBuffer()),
+                };
+            }
+            catch (error) {
+                throw new RustFoundationBridgeError("request_failed", "Rust Project read request failed", { cause: error });
+            }
+        },
+        async liveRunRead(actor, orgId, input) {
+            await ensureStarted();
+            if (!baseUrl)
+                throw new RustFoundationBridgeError("request_failed", "Rust foundation bridge is not running");
+            const requestPath = `/internal/orgs/${encodeURIComponent(orgId)}/live-run-reads`;
+            const body = Buffer.from(JSON.stringify(input));
+            const requestId = randomUUID();
+            const envelope = createRustActorEnvelope({
+                actor,
+                organizationId: orgId,
+                method: "POST",
+                path: requestPath,
+                action: "live_run.read",
+                body,
+                secret: actorEnvelopeKey,
+                requestId,
+            });
+            try {
+                const response = await fetch(`${baseUrl}${requestPath}`, {
+                    method: "POST",
+                    headers: {
+                        "content-type": "application/json",
+                        "x-rudder-actor-envelope": JSON.stringify(envelope),
+                        "x-rudder-request-id": requestId,
+                    },
+                    body: body,
+                    signal: AbortSignal.timeout(requestTimeoutMs),
+                });
+                return {
+                    status: response.status,
+                    contentType: response.headers.get("content-type") ?? "application/json",
+                    body: Buffer.from(await response.arrayBuffer()),
+                };
+            }
+            catch (error) {
+                throw new RustFoundationBridgeError("request_failed", "Rust foundation request failed", { cause: error });
+            }
+        },
+        async projectCreate(actor, orgId, data, idempotencyKey, activityDetails, roots) {
+            if (projectGoalSetMode !== "required") {
+                throw new RustFoundationBridgeError("request_failed", "Rust Project creation requires required mode");
+            }
+            const normalizedIdempotencyKey = idempotencyKey.trim();
+            if (!normalizedIdempotencyKey) {
+                throw new RustFoundationBridgeError("request_failed", "Rust Project creation requires an idempotency key");
+            }
+            await ensureStarted();
+            if (!baseUrl)
+                throw new RustFoundationBridgeError("request_failed", "Rust foundation bridge is not running");
+            const requestPath = `/api/orgs/${encodeURIComponent(orgId)}/projects`;
+            const body = Buffer.from(JSON.stringify({
+                runId: actor.runId ?? null,
+                data,
+                activityDetails,
+                organizationWorkspaceRoot: roots.organizationWorkspaceRoot,
+                projectCreateStateRoot: roots.projectCreateStateRoot,
+            }));
+            const requestId = randomUUID();
+            const envelope = createRustActorEnvelope({
+                actor,
+                organizationId: orgId,
+                method: "POST",
+                path: requestPath,
+                action: PROJECT_CREATE_ACTION,
+                body,
+                secret: actorEnvelopeKey,
+                requestId,
+                idempotencyKey: normalizedIdempotencyKey,
+            });
+            let response;
+            try {
+                response = await fetch(`${baseUrl}${requestPath}`, {
+                    method: "POST",
+                    headers: {
+                        "content-type": "application/json",
+                        "x-rudder-actor-envelope": JSON.stringify(envelope),
+                        "x-rudder-request-id": requestId,
+                        "x-rudder-idempotency-key": normalizedIdempotencyKey,
+                    },
+                    body: body,
+                    signal: AbortSignal.timeout(requestTimeoutMs),
+                });
+            }
+            catch (error) {
+                throw new RustFoundationBridgeError("request_failed", "Rust foundation request failed", { cause: error });
+            }
+            return {
+                status: response.status,
+                contentType: response.headers.get("content-type") ?? "application/json",
+                body: Buffer.from(await response.arrayBuffer()),
+            };
+        },
+        async memberDirectory(req, orgId) {
+            if (mode === "off") {
+                throw new RustFoundationBridgeError("request_failed", "Rust foundation member directory bridge is disabled");
+            }
+            await ensureStarted();
+            if (!baseUrl)
+                throw new RustFoundationBridgeError("request_failed", "Rust foundation bridge is not running");
+            const body = Buffer.alloc(0);
+            const requestId = randomUUID();
+            const envelope = createRustActorEnvelope({
+                actor: req.actor,
+                organizationId: orgId,
+                method: "GET",
+                path: req.originalUrl,
+                action: ACTOR_ENVELOPE_ACTION,
+                body,
+                secret: actorEnvelopeKey,
+                requestId,
+            });
+            let response;
+            try {
+                response = await fetch(`${baseUrl}${req.originalUrl}`, {
+                    method: "GET",
+                    headers: {
+                        "x-rudder-actor-envelope": JSON.stringify(envelope),
+                        "x-rudder-request-id": requestId,
+                    },
+                    signal: AbortSignal.timeout(requestTimeoutMs),
+                });
+            }
+            catch (error) {
+                throw new RustFoundationBridgeError("request_failed", "Rust foundation request failed", { cause: error });
+            }
+            return {
+                status: response.status,
+                contentType: response.headers.get("content-type") ?? "application/json",
+                body: Buffer.from(await response.arrayBuffer()),
+            };
+        },
+        async organizationBranding(req, orgId, body, requestPath = req.originalUrl) {
+            if (organizationBrandingMode === "off") {
+                throw new RustFoundationBridgeError("request_failed", "Rust foundation organization branding bridge is disabled");
+            }
+            await ensureStarted();
+            if (!baseUrl)
+                throw new RustFoundationBridgeError("request_failed", "Rust foundation bridge is not running");
+            const requestId = randomUUID();
+            const idempotencyKey = req.header("x-rudder-idempotency-key")?.trim();
+            if (!idempotencyKey) {
+                throw new RustFoundationBridgeError("request_failed", "Rust organization branding requires x-rudder-idempotency-key");
+            }
+            const envelope = createRustActorEnvelope({
+                actor: req.actor,
+                organizationId: orgId,
+                method: "PATCH",
+                path: requestPath,
+                action: ORGANIZATION_BRANDING_ACTION,
+                body,
+                secret: actorEnvelopeKey,
+                requestId,
+                idempotencyKey,
+            });
+            let response;
+            try {
+                response = await fetch(`${baseUrl}${requestPath}`, {
+                    method: "PATCH",
+                    headers: {
+                        "content-type": req.header("content-type") ?? "application/json",
+                        "x-rudder-actor-envelope": JSON.stringify(envelope),
+                        "x-rudder-request-id": requestId,
+                        "x-rudder-idempotency-key": idempotencyKey,
+                    },
+                    body: body,
+                    signal: AbortSignal.timeout(requestTimeoutMs),
+                });
+            }
+            catch (error) {
+                throw new RustFoundationBridgeError("request_failed", "Rust foundation request failed", { cause: error });
+            }
+            const responseBody = Buffer.from(await response.arrayBuffer());
+            debugBridge(`organization-branding response status=${response.status} body=${responseBody.toString("utf8").slice(0, 512)}`);
+            return {
+                status: response.status,
+                contentType: response.headers.get("content-type") ?? "application/json",
+                body: responseBody,
+            };
+        },
+        async projectGoalSet(req, orgId, projectId, body, requestPath = `/api/orgs/${encodeURIComponent(orgId)}/projects/${encodeURIComponent(projectId)}/goal-set`) {
+            if (projectGoalSetMode !== "required") {
+                throw new RustFoundationBridgeError("request_failed", "Rust foundation Project-Goal writes require required mode");
+            }
+            await ensureStarted();
+            if (!baseUrl)
+                throw new RustFoundationBridgeError("request_failed", "Rust foundation bridge is not running");
+            const requestId = randomUUID();
+            const idempotencyKey = req.header("x-rudder-idempotency-key")?.trim();
+            if (!idempotencyKey) {
+                throw new RustFoundationBridgeError("request_failed", "Rust Project-Goal replacement requires x-rudder-idempotency-key");
+            }
+            const envelope = createRustActorEnvelope({
+                actor: req.actor,
+                organizationId: orgId,
+                method: "PATCH",
+                path: requestPath,
+                action: PROJECT_GOAL_SET_ACTION,
+                body,
+                secret: actorEnvelopeKey,
+                requestId,
+                idempotencyKey,
+            });
+            let response;
+            try {
+                response = await fetch(`${baseUrl}${requestPath}`, {
+                    method: "PATCH",
+                    headers: {
+                        "content-type": req.header("content-type") ?? "application/json",
+                        "x-rudder-actor-envelope": JSON.stringify(envelope),
+                        "x-rudder-request-id": requestId,
+                        "x-rudder-idempotency-key": idempotencyKey,
+                    },
+                    body: body,
+                    signal: AbortSignal.timeout(requestTimeoutMs),
+                });
+            }
+            catch (error) {
+                throw new RustFoundationBridgeError("request_failed", "Rust foundation request failed", { cause: error });
+            }
+            const responseBody = Buffer.from(await response.arrayBuffer());
+            debugBridge(`project-goal response status=${response.status} body=${responseBody.toString("utf8").slice(0, 512)}`);
+            return {
+                status: response.status,
+                contentType: response.headers.get("content-type") ?? "application/json",
+                body: responseBody,
+            };
+        },
+        async organizationResourceMutation(req, orgId, resourceId, operation, body, idempotencyKey) {
+            if (projectGoalSetMode !== "required") {
+                throw new RustFoundationBridgeError("request_failed", "Rust organization resource writes require required mode");
+            }
+            await ensureStarted();
+            if (!baseUrl)
+                throw new RustFoundationBridgeError("request_failed", "Rust foundation bridge is not running");
+            const normalizedKey = idempotencyKey.trim();
+            if (!normalizedKey)
+                throw new RustFoundationBridgeError("request_failed", "Rust resource mutation requires an idempotency key");
+            const requestPath = `/api/orgs/${encodeURIComponent(orgId)}/resources/${encodeURIComponent(resourceId)}`;
+            const method = operation === "update" ? "PATCH" : "DELETE";
+            const requestId = randomUUID();
+            const envelope = createRustActorEnvelope({
+                actor: req.actor,
+                organizationId: orgId,
+                method,
+                path: requestPath,
+                action: ORGANIZATION_RESOURCE_ACTION,
+                body,
+                secret: actorEnvelopeKey,
+                requestId,
+                idempotencyKey: normalizedKey,
+            });
+            try {
+                const response = await fetch(`${baseUrl}${requestPath}`, {
+                    method,
+                    headers: {
+                        "content-type": "application/json",
+                        "x-rudder-actor-envelope": JSON.stringify(envelope),
+                        "x-rudder-request-id": requestId,
+                        "x-rudder-idempotency-key": normalizedKey,
+                    },
+                    body: body,
+                    signal: AbortSignal.timeout(requestTimeoutMs),
+                });
+                return {
+                    status: response.status,
+                    contentType: response.headers.get("content-type") ?? "application/json",
+                    body: Buffer.from(await response.arrayBuffer()),
+                };
+            }
+            catch (error) {
+                throw new RustFoundationBridgeError("request_failed", "Rust organization resource request failed", { cause: error });
+            }
+        },
+        async projectDelete(req, orgId, projectId, body, idempotencyKey, requestPath = `/api/orgs/${encodeURIComponent(orgId)}/projects/${encodeURIComponent(projectId)}`) {
+            if (projectGoalSetMode !== "required") {
+                throw new RustFoundationBridgeError("request_failed", "Rust Project deletion requires required mode");
+            }
+            await ensureStarted();
+            if (!baseUrl)
+                throw new RustFoundationBridgeError("request_failed", "Rust foundation bridge is not running");
+            const requestId = randomUUID();
+            const normalizedIdempotencyKey = idempotencyKey.trim();
+            if (!normalizedIdempotencyKey) {
+                throw new RustFoundationBridgeError("request_failed", "Rust Project deletion requires an idempotency key");
+            }
+            const envelope = createRustActorEnvelope({
+                actor: req.actor,
+                organizationId: orgId,
+                method: "DELETE",
+                path: requestPath,
+                action: PROJECT_DELETE_ACTION,
+                body,
+                secret: actorEnvelopeKey,
+                requestId,
+                idempotencyKey: normalizedIdempotencyKey,
+            });
+            let response;
+            try {
+                response = await fetch(`${baseUrl}${requestPath}`, {
+                    method: "DELETE",
+                    headers: {
+                        "content-type": req.header("content-type") ?? "application/json",
+                        "x-rudder-actor-envelope": JSON.stringify(envelope),
+                        "x-rudder-request-id": requestId,
+                        "x-rudder-idempotency-key": normalizedIdempotencyKey,
+                    },
+                    body: body,
+                    signal: AbortSignal.timeout(requestTimeoutMs),
+                });
+            }
+            catch (error) {
+                throw new RustFoundationBridgeError("request_failed", "Rust foundation request failed", { cause: error });
+            }
+            const responseBody = Buffer.from(await response.arrayBuffer());
+            debugBridge(`project-delete response status=${response.status} body=${responseBody.toString("utf8").slice(0, 512)}`);
+            return {
+                status: response.status,
+                contentType: response.headers.get("content-type") ?? "application/json",
+                body: responseBody,
+            };
+        },
+        close,
+    };
+}
+//# sourceMappingURL=rust-foundation-bridge.js.map