@supaku/agentfactory-nextjs 0.4.2 → 0.4.3

package/dist/src/middleware/factory.d.ts

@@ -1,11 +1,12 @@
 /**
- * Middleware Factory
+ * Middleware Factory — Edge Runtime Compatible
  *
  * Creates a Next.js middleware function that handles authentication,
  * rate limiting, and security for AgentFactory API routes.
  *
- * Uses the rate limiter and worker auth from @supaku/agentfactory-server
- * for proper LRU eviction and crypto.timingSafeEqual.
+ * IMPORTANT: This module runs in the Edge Runtime. It MUST NOT import
+ * from @supaku/agentfactory-server (which uses Node.js crypto/ioredis).
+ * All utilities are inlined for Edge compatibility.
  */
 import { NextRequest, NextResponse } from 'next/server';
 import type { MiddlewareConfig } from './types.js';

package/dist/src/middleware/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../../src/middleware/factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAOvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAQlD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,CAAC,EAAE,gBAAgB;0BAO3C,WAAW,KAAG,YAAY,GAAG,SAAS;;;;EA8GpE"}
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../../src/middleware/factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AA0GlD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,CAAC,EAAE,gBAAgB;0BAO3C,WAAW,KAAG,YAAY,GAAG,SAAS;;;;EA8GpE"}

package/dist/src/middleware/factory.js

@@ -1,14 +1,80 @@
 /**
- * Middleware Factory
+ * Middleware Factory — Edge Runtime Compatible
  *
  * Creates a Next.js middleware function that handles authentication,
  * rate limiting, and security for AgentFactory API routes.
  *
- * Uses the rate limiter and worker auth from @supaku/agentfactory-server
- * for proper LRU eviction and crypto.timingSafeEqual.
+ * IMPORTANT: This module runs in the Edge Runtime. It MUST NOT import
+ * from @supaku/agentfactory-server (which uses Node.js crypto/ioredis).
+ * All utilities are inlined for Edge compatibility.
  */
 import { NextResponse } from 'next/server';
-import { checkRateLimit, getClientIP, buildRateLimitHeaders, verifyApiKey, } from '@supaku/agentfactory-server';
+const RATE_LIMITS = {
+    public: { limit: 60, windowMs: 60_000 },
+    webhook: { limit: 10, windowMs: 1_000 },
+    dashboard: { limit: 30, windowMs: 60_000 },
+};
+const caches = new Map();
+function checkRateLimit(type, key) {
+    const config = RATE_LIMITS[type];
+    let cache = caches.get(type);
+    if (!cache) {
+        cache = new Map();
+        caches.set(type, cache);
+    }
+    const now = Date.now();
+    const windowStart = now - config.windowMs;
+    let entry = cache.get(key);
+    if (!entry) {
+        entry = { timestamps: [], lastAccess: now };
+    }
+    entry.timestamps = entry.timestamps.filter((ts) => ts > windowStart);
+    entry.lastAccess = now;
+    const allowed = entry.timestamps.length < config.limit;
+    if (allowed)
+        entry.timestamps.push(now);
+    cache.set(key, entry);
+    // LRU eviction at 10k entries
+    if (cache.size > 10_000) {
+        const entries = Array.from(cache.entries()).sort((a, b) => a[1].lastAccess - b[1].lastAccess);
+        const toRemove = Math.ceil(10_000 * 0.1);
+        for (let i = 0; i < toRemove && i < entries.length; i++) {
+            cache.delete(entries[i][0]);
+        }
+    }
+    const remaining = Math.max(0, config.limit - entry.timestamps.length);
+    const oldestTs = entry.timestamps[0];
+    const resetIn = oldestTs ? Math.max(0, oldestTs + config.windowMs - now) : 0;
+    return { allowed, remaining, resetIn, limit: config.limit };
+}
+// === Edge-compatible utilities ===
+function getClientIP(headers) {
+    return (headers.get('x-forwarded-for')?.split(',')[0].trim() ||
+        headers.get('cf-connecting-ip') ||
+        headers.get('x-real-ip') ||
+        'unknown');
+}
+function buildRateLimitHeaders(result) {
+    return {
+        'X-RateLimit-Limit': result.limit.toString(),
+        'X-RateLimit-Remaining': result.remaining.toString(),
+        'X-RateLimit-Reset': Math.ceil(result.resetIn / 1000).toString(),
+    };
+}
+/**
+ * Timing-safe string comparison using XOR (Edge-compatible).
+ * Does NOT use Node.js crypto.timingSafeEqual.
+ */
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let result = 0;
+    for (let i = 0; i < a.length; i++) {
+        result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return result === 0;
+}
+// === Route defaults ===
 const DEFAULT_PUBLIC_ROUTES = ['/api/public/', '/dashboard', '/'];
 const DEFAULT_PROTECTED_ROUTES = ['/api/sessions', '/api/workers'];
 const DEFAULT_SESSION_PAGES = ['/sessions/'];
@@ -90,7 +156,7 @@ export function createAgentFactoryMiddleware(userConfig) {
                 return new NextResponse(JSON.stringify({ error: 'Unauthorized', message: 'Invalid or missing API key' }), { status: 401, headers: { 'Content-Type': 'application/json' } });
             }
             const token = authHeader.slice(7);
-            if (!verifyApiKey(token, workerApiKey)) {
+            if (!timingSafeEqual(token, workerApiKey)) {
                 return new NextResponse(JSON.stringify({ error: 'Unauthorized', message: 'Invalid or missing API key' }), { status: 401, headers: { 'Content-Type': 'application/json' } });
             }
             return NextResponse.next();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supaku/agentfactory-nextjs",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "type": "module",
   "description": "Next.js API route handlers for AgentFactory — webhook processor, worker/session management, public stats",
   "author": "Supaku (https://supaku.com)",
@@ -43,9 +43,9 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@supaku/agentfactory-linear": "0.4.2",
-    "@supaku/agentfactory-server": "0.4.2",
-    "@supaku/agentfactory": "0.4.2"
+    "@supaku/agentfactory-linear": "0.4.3",
+    "@supaku/agentfactory-server": "0.4.3",
+    "@supaku/agentfactory": "0.4.3"
   },
   "peerDependencies": {
     "next": ">=14.0.0"