@xopcai/xopc 0.0.81 → 0.0.83

package/dist/src/gateway/rate-limit/buckets.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Named rate-limit buckets used across the gateway. Each is a thin wrapper
+ * over a primitive limiter ({@link RateLimiter} or {@link FailureLimiter})
+ * that hard-codes its config and exposes a small surface.
+ *
+ * All buckets are owned by a process-level singleton {@link BucketRegistry}
+ * so that:
+ *   - lifecycle (cleanup timers) is centralized — `destroyAll()` on shutdown,
+ *   - tests get one obvious reset entry point (`resetAllForTests`),
+ *   - new buckets are added in exactly one place.
+ *
+ * Tuning policy:
+ *   - `auth_failure` is read from runtime config because users tune it per
+ *     deployment. Other buckets keep static defaults until a real need
+ *     emerges to expose them. (YAGNI > premature configurability.)
+ */
+import { FailureLimiter, RateLimiter } from '../../infra/rate-limit/index.js';
+import type { GatewayAuthRateLimitConfig } from '../../config/schema.js';
+import type { AuthRateLimitPolicyConfig } from './auth-policy.js';
+/**
+ * Auth-failure config validated/normalized into the shape both the limiter
+ * primitive and the policy layer need.
+ */
+export type ResolvedAuthRateLimitConfig = {
+    enabled: boolean;
+    maxFailures: number;
+    windowMs: number;
+    blockDurationMs: number;
+    burstCoalesceMs: number;
+    exemptLoopback: boolean;
+};
+export declare function resolveAuthRateLimit(input: GatewayAuthRateLimitConfig | undefined): ResolvedAuthRateLimitConfig;
+export declare function authPolicyConfig(cfg: ResolvedAuthRateLimitConfig): AuthRateLimitPolicyConfig;
+declare class BucketRegistry {
+    private authFailureLimiter?;
+    private authFailureSignature?;
+    private strictApiLimiter?;
+    private tunnelMutateLimiter?;
+    private pairingExchangeLimiter?;
+    private sharePublicShortLimiter?;
+    private sharePublicLongLimiter?;
+    /**
+     * Reconfigured on the fly when `gateway.auth.rateLimit` is reloaded —
+     * compares a stable signature to avoid swapping out a hot bucket on every
+     * config read.
+     */
+    authFailure(cfg: ResolvedAuthRateLimitConfig): FailureLimiter;
+    /** Sensitive admin / mutation endpoints — 15 req / 60 s per client IP. */
+    strictApi(): RateLimiter;
+    /** Tunnel mutation calls — 12 req / 5 min per gateway-token fingerprint. */
+    tunnelMutate(): RateLimiter;
+    /** Failed pairing-exchange attempts — 30 failures / 5 min per client IP. */
+    pairingExchange(): FailureLimiter;
+    /** Public share download short window — 60 req / min per client IP. */
+    sharePublicShort(): RateLimiter;
+    /** Public share download long window — 300 req / 15 min per client IP. */
+    sharePublicLong(): RateLimiter;
+    destroyAll(): void;
+    /** @internal */
+    resetAllForTests(): void;
+}
+export declare const buckets: BucketRegistry;
+export {};

package/dist/src/gateway/rate-limit/buckets.js

@@ -0,0 +1,143 @@
+import { RateLimiter } from "../../infra/rate-limit/rate-limiter.js";
+import { FailureLimiter } from "../../infra/rate-limit/failure-limiter.js";
+//#region src/gateway/rate-limit/buckets.ts
+/**
+* Named rate-limit buckets used across the gateway. Each is a thin wrapper
+* over a primitive limiter ({@link RateLimiter} or {@link FailureLimiter})
+* that hard-codes its config and exposes a small surface.
+*
+* All buckets are owned by a process-level singleton {@link BucketRegistry}
+* so that:
+*   - lifecycle (cleanup timers) is centralized — `destroyAll()` on shutdown,
+*   - tests get one obvious reset entry point (`resetAllForTests`),
+*   - new buckets are added in exactly one place.
+*
+* Tuning policy:
+*   - `auth_failure` is read from runtime config because users tune it per
+*     deployment. Other buckets keep static defaults until a real need
+*     emerges to expose them. (YAGNI > premature configurability.)
+*/
+const DEFAULT_AUTH_RATE_LIMIT = {
+	enabled: true,
+	maxFailures: 5,
+	windowMs: 900 * 1e3,
+	blockDurationMs: 300 * 1e3,
+	burstCoalesceMs: 1e3,
+	exemptLoopback: true
+};
+function resolveAuthRateLimit(input) {
+	if (!input) return { ...DEFAULT_AUTH_RATE_LIMIT };
+	const blockDurationMs = input.blockDurationMs ?? input.lockoutMs ?? DEFAULT_AUTH_RATE_LIMIT.blockDurationMs;
+	return {
+		enabled: input.enabled ?? DEFAULT_AUTH_RATE_LIMIT.enabled,
+		maxFailures: Math.max(1, Math.floor(input.maxAttempts ?? DEFAULT_AUTH_RATE_LIMIT.maxFailures)),
+		windowMs: Math.max(1e3, Math.floor(input.windowMs ?? DEFAULT_AUTH_RATE_LIMIT.windowMs)),
+		blockDurationMs: Math.max(1e3, Math.floor(blockDurationMs)),
+		burstCoalesceMs: Math.max(0, Math.floor(input.burstCoalesceMs ?? DEFAULT_AUTH_RATE_LIMIT.burstCoalesceMs)),
+		exemptLoopback: input.exemptLoopback ?? DEFAULT_AUTH_RATE_LIMIT.exemptLoopback
+	};
+}
+function authPolicyConfig(cfg) {
+	return {
+		enabled: cfg.enabled,
+		exemptLoopback: cfg.exemptLoopback
+	};
+}
+var BucketRegistry = class {
+	authFailureLimiter;
+	authFailureSignature;
+	strictApiLimiter;
+	tunnelMutateLimiter;
+	pairingExchangeLimiter;
+	sharePublicShortLimiter;
+	sharePublicLongLimiter;
+	/**
+	* Reconfigured on the fly when `gateway.auth.rateLimit` is reloaded —
+	* compares a stable signature to avoid swapping out a hot bucket on every
+	* config read.
+	*/
+	authFailure(cfg) {
+		const sig = `${cfg.maxFailures}|${cfg.windowMs}|${cfg.blockDurationMs}|${cfg.burstCoalesceMs}`;
+		if (!this.authFailureLimiter || this.authFailureSignature !== sig) {
+			this.authFailureLimiter?.destroy();
+			this.authFailureLimiter = new FailureLimiter({
+				maxFailures: cfg.maxFailures,
+				windowMs: cfg.windowMs,
+				blockDurationMs: cfg.blockDurationMs,
+				burstCoalesceMs: cfg.burstCoalesceMs
+			});
+			this.authFailureSignature = sig;
+		}
+		return this.authFailureLimiter;
+	}
+	/** Sensitive admin / mutation endpoints — 15 req / 60 s per client IP. */
+	strictApi() {
+		if (!this.strictApiLimiter) this.strictApiLimiter = new RateLimiter({
+			maxRequests: 15,
+			windowMs: 6e4
+		});
+		return this.strictApiLimiter;
+	}
+	/** Tunnel mutation calls — 12 req / 5 min per gateway-token fingerprint. */
+	tunnelMutate() {
+		if (!this.tunnelMutateLimiter) this.tunnelMutateLimiter = new RateLimiter({
+			maxRequests: 12,
+			windowMs: 5 * 6e4
+		});
+		return this.tunnelMutateLimiter;
+	}
+	/** Failed pairing-exchange attempts — 30 failures / 5 min per client IP. */
+	pairingExchange() {
+		if (!this.pairingExchangeLimiter) this.pairingExchangeLimiter = new FailureLimiter({
+			maxFailures: 30,
+			windowMs: 5 * 6e4,
+			blockDurationMs: 5 * 6e4
+		});
+		return this.pairingExchangeLimiter;
+	}
+	/** Public share download short window — 60 req / min per client IP. */
+	sharePublicShort() {
+		if (!this.sharePublicShortLimiter) this.sharePublicShortLimiter = new RateLimiter({
+			maxRequests: 60,
+			windowMs: 6e4
+		});
+		return this.sharePublicShortLimiter;
+	}
+	/** Public share download long window — 300 req / 15 min per client IP. */
+	sharePublicLong() {
+		if (!this.sharePublicLongLimiter) this.sharePublicLongLimiter = new RateLimiter({
+			maxRequests: 300,
+			windowMs: 15 * 6e4
+		});
+		return this.sharePublicLongLimiter;
+	}
+	destroyAll() {
+		this.authFailureLimiter?.destroy();
+		this.strictApiLimiter?.destroy();
+		this.tunnelMutateLimiter?.destroy();
+		this.pairingExchangeLimiter?.destroy();
+		this.sharePublicShortLimiter?.destroy();
+		this.sharePublicLongLimiter?.destroy();
+		this.authFailureLimiter = void 0;
+		this.strictApiLimiter = void 0;
+		this.tunnelMutateLimiter = void 0;
+		this.pairingExchangeLimiter = void 0;
+		this.sharePublicShortLimiter = void 0;
+		this.sharePublicLongLimiter = void 0;
+		this.authFailureSignature = void 0;
+	}
+	/** @internal */
+	resetAllForTests() {
+		this.authFailureLimiter?.resetForTests();
+		this.strictApiLimiter?.resetForTests();
+		this.tunnelMutateLimiter?.resetForTests();
+		this.pairingExchangeLimiter?.resetForTests();
+		this.sharePublicShortLimiter?.resetForTests();
+		this.sharePublicLongLimiter?.resetForTests();
+	}
+};
+const buckets = new BucketRegistry();
+//#endregion
+export { authPolicyConfig, buckets, resolveAuthRateLimit };
+
+//# sourceMappingURL=buckets.js.map

package/dist/src/gateway/rate-limit/buckets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buckets.js","names":[],"sources":["../../../../src/gateway/rate-limit/buckets.ts"],"sourcesContent":["/**\n * Named rate-limit buckets used across the gateway. Each is a thin wrapper\n * over a primitive limiter ({@link RateLimiter} or {@link FailureLimiter})\n * that hard-codes its config and exposes a small surface.\n *\n * All buckets are owned by a process-level singleton {@link BucketRegistry}\n * so that:\n *   - lifecycle (cleanup timers) is centralized — `destroyAll()` on shutdown,\n *   - tests get one obvious reset entry point (`resetAllForTests`),\n *   - new buckets are added in exactly one place.\n *\n * Tuning policy:\n *   - `auth_failure` is read from runtime config because users tune it per\n *     deployment. Other buckets keep static defaults until a real need\n *     emerges to expose them. (YAGNI > premature configurability.)\n */\n\nimport { FailureLimiter, RateLimiter } from '../../infra/rate-limit/index.js';\n\nimport type { GatewayAuthRateLimitConfig } from '../../config/schema.js';\nimport type { AuthRateLimitPolicyConfig } from './auth-policy.js';\n\n/**\n * Auth-failure config validated/normalized into the shape both the limiter\n * primitive and the policy layer need.\n */\nexport type ResolvedAuthRateLimitConfig = {\n  enabled: boolean;\n  maxFailures: number;\n  windowMs: number;\n  blockDurationMs: number;\n  burstCoalesceMs: number;\n  exemptLoopback: boolean;\n};\n\nconst DEFAULT_AUTH_RATE_LIMIT: ResolvedAuthRateLimitConfig = {\n  enabled: true,\n  maxFailures: 5,\n  windowMs: 15 * 60 * 1000,\n  blockDurationMs: 5 * 60 * 1000,\n  burstCoalesceMs: 1000,\n  exemptLoopback: true,\n};\n\nexport function resolveAuthRateLimit(\n  input: GatewayAuthRateLimitConfig | undefined,\n): ResolvedAuthRateLimitConfig {\n  if (!input) return { ...DEFAULT_AUTH_RATE_LIMIT };\n  const blockDurationMs =\n    input.blockDurationMs ?? input.lockoutMs ?? DEFAULT_AUTH_RATE_LIMIT.blockDurationMs;\n  return {\n    enabled: input.enabled ?? DEFAULT_AUTH_RATE_LIMIT.enabled,\n    maxFailures: Math.max(1, Math.floor(input.maxAttempts ?? DEFAULT_AUTH_RATE_LIMIT.maxFailures)),\n    windowMs: Math.max(1000, Math.floor(input.windowMs ?? DEFAULT_AUTH_RATE_LIMIT.windowMs)),\n    blockDurationMs: Math.max(1000, Math.floor(blockDurationMs)),\n    burstCoalesceMs: Math.max(\n      0,\n      Math.floor(input.burstCoalesceMs ?? DEFAULT_AUTH_RATE_LIMIT.burstCoalesceMs),\n    ),\n    exemptLoopback: input.exemptLoopback ?? DEFAULT_AUTH_RATE_LIMIT.exemptLoopback,\n  };\n}\n\nexport function authPolicyConfig(\n  cfg: ResolvedAuthRateLimitConfig,\n): AuthRateLimitPolicyConfig {\n  return { enabled: cfg.enabled, exemptLoopback: cfg.exemptLoopback };\n}\n\nclass BucketRegistry {\n  private authFailureLimiter?: FailureLimiter;\n  private authFailureSignature?: string;\n\n  private strictApiLimiter?: RateLimiter;\n  private tunnelMutateLimiter?: RateLimiter;\n  private pairingExchangeLimiter?: FailureLimiter;\n  private sharePublicShortLimiter?: RateLimiter;\n  private sharePublicLongLimiter?: RateLimiter;\n\n  /**\n   * Reconfigured on the fly when `gateway.auth.rateLimit` is reloaded —\n   * compares a stable signature to avoid swapping out a hot bucket on every\n   * config read.\n   */\n  authFailure(cfg: ResolvedAuthRateLimitConfig): FailureLimiter {\n    const sig = `${cfg.maxFailures}|${cfg.windowMs}|${cfg.blockDurationMs}|${cfg.burstCoalesceMs}`;\n    if (!this.authFailureLimiter || this.authFailureSignature !== sig) {\n      this.authFailureLimiter?.destroy();\n      this.authFailureLimiter = new FailureLimiter({\n        maxFailures: cfg.maxFailures,\n        windowMs: cfg.windowMs,\n        blockDurationMs: cfg.blockDurationMs,\n        burstCoalesceMs: cfg.burstCoalesceMs,\n      });\n      this.authFailureSignature = sig;\n    }\n    return this.authFailureLimiter;\n  }\n\n  /** Sensitive admin / mutation endpoints — 15 req / 60 s per client IP. */\n  strictApi(): RateLimiter {\n    if (!this.strictApiLimiter) {\n      this.strictApiLimiter = new RateLimiter({ maxRequests: 15, windowMs: 60_000 });\n    }\n    return this.strictApiLimiter;\n  }\n\n  /** Tunnel mutation calls — 12 req / 5 min per gateway-token fingerprint. */\n  tunnelMutate(): RateLimiter {\n    if (!this.tunnelMutateLimiter) {\n      this.tunnelMutateLimiter = new RateLimiter({\n        maxRequests: 12,\n        windowMs: 5 * 60_000,\n      });\n    }\n    return this.tunnelMutateLimiter;\n  }\n\n  /** Failed pairing-exchange attempts — 30 failures / 5 min per client IP. */\n  pairingExchange(): FailureLimiter {\n    if (!this.pairingExchangeLimiter) {\n      this.pairingExchangeLimiter = new FailureLimiter({\n        maxFailures: 30,\n        windowMs: 5 * 60_000,\n        blockDurationMs: 5 * 60_000,\n      });\n    }\n    return this.pairingExchangeLimiter;\n  }\n\n  /** Public share download short window — 60 req / min per client IP. */\n  sharePublicShort(): RateLimiter {\n    if (!this.sharePublicShortLimiter) {\n      this.sharePublicShortLimiter = new RateLimiter({\n        maxRequests: 60,\n        windowMs: 60_000,\n      });\n    }\n    return this.sharePublicShortLimiter;\n  }\n\n  /** Public share download long window — 300 req / 15 min per client IP. */\n  sharePublicLong(): RateLimiter {\n    if (!this.sharePublicLongLimiter) {\n      this.sharePublicLongLimiter = new RateLimiter({\n        maxRequests: 300,\n        windowMs: 15 * 60_000,\n      });\n    }\n    return this.sharePublicLongLimiter;\n  }\n\n  destroyAll(): void {\n    this.authFailureLimiter?.destroy();\n    this.strictApiLimiter?.destroy();\n    this.tunnelMutateLimiter?.destroy();\n    this.pairingExchangeLimiter?.destroy();\n    this.sharePublicShortLimiter?.destroy();\n    this.sharePublicLongLimiter?.destroy();\n    this.authFailureLimiter = undefined;\n    this.strictApiLimiter = undefined;\n    this.tunnelMutateLimiter = undefined;\n    this.pairingExchangeLimiter = undefined;\n    this.sharePublicShortLimiter = undefined;\n    this.sharePublicLongLimiter = undefined;\n    this.authFailureSignature = undefined;\n  }\n\n  /** @internal */\n  resetAllForTests(): void {\n    this.authFailureLimiter?.resetForTests();\n    this.strictApiLimiter?.resetForTests();\n    this.tunnelMutateLimiter?.resetForTests();\n    this.pairingExchangeLimiter?.resetForTests();\n    this.sharePublicShortLimiter?.resetForTests();\n    this.sharePublicLongLimiter?.resetForTests();\n  }\n}\n\nexport const buckets = new BucketRegistry();\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAmCA,MAAM,0BAAuD;CAC3D,SAAS;CACT,aAAa;CACb,UAAU,MAAU;CACpB,iBAAiB,MAAS;CAC1B,iBAAiB;CACjB,gBAAgB;CACjB;AAED,SAAgB,qBACd,OAC6B;AAC7B,KAAI,CAAC,MAAO,QAAO,EAAE,GAAG,yBAAyB;CACjD,MAAM,kBACJ,MAAM,mBAAmB,MAAM,aAAa,wBAAwB;AACtE,QAAO;EACL,SAAS,MAAM,WAAW,wBAAwB;EAClD,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,MAAM,eAAe,wBAAwB,YAAY,CAAC;EAC9F,UAAU,KAAK,IAAI,KAAM,KAAK,MAAM,MAAM,YAAY,wBAAwB,SAAS,CAAC;EACxF,iBAAiB,KAAK,IAAI,KAAM,KAAK,MAAM,gBAAgB,CAAC;EAC5D,iBAAiB,KAAK,IACpB,GACA,KAAK,MAAM,MAAM,mBAAmB,wBAAwB,gBAAgB,CAC7E;EACD,gBAAgB,MAAM,kBAAkB,wBAAwB;EACjE;;AAGH,SAAgB,iBACd,KAC2B;AAC3B,QAAO;EAAE,SAAS,IAAI;EAAS,gBAAgB,IAAI;EAAgB;;AAGrE,IAAM,iBAAN,MAAqB;CACnB;CACA;CAEA;CACA;CACA;CACA;CACA;;;;;;CAOA,YAAY,KAAkD;EAC5D,MAAM,MAAM,GAAG,IAAI,YAAY,GAAG,IAAI,SAAS,GAAG,IAAI,gBAAgB,GAAG,IAAI;AAC7E,MAAI,CAAC,KAAK,sBAAsB,KAAK,yBAAyB,KAAK;AACjE,QAAK,oBAAoB,SAAS;AAClC,QAAK,qBAAqB,IAAI,eAAe;IAC3C,aAAa,IAAI;IACjB,UAAU,IAAI;IACd,iBAAiB,IAAI;IACrB,iBAAiB,IAAI;IACtB,CAAC;AACF,QAAK,uBAAuB;;AAE9B,SAAO,KAAK;;;CAId,YAAyB;AACvB,MAAI,CAAC,KAAK,iBACR,MAAK,mBAAmB,IAAI,YAAY;GAAE,aAAa;GAAI,UAAU;GAAQ,CAAC;AAEhF,SAAO,KAAK;;;CAId,eAA4B;AAC1B,MAAI,CAAC,KAAK,oBACR,MAAK,sBAAsB,IAAI,YAAY;GACzC,aAAa;GACb,UAAU,IAAI;GACf,CAAC;AAEJ,SAAO,KAAK;;;CAId,kBAAkC;AAChC,MAAI,CAAC,KAAK,uBACR,MAAK,yBAAyB,IAAI,eAAe;GAC/C,aAAa;GACb,UAAU,IAAI;GACd,iBAAiB,IAAI;GACtB,CAAC;AAEJ,SAAO,KAAK;;;CAId,mBAAgC;AAC9B,MAAI,CAAC,KAAK,wBACR,MAAK,0BAA0B,IAAI,YAAY;GAC7C,aAAa;GACb,UAAU;GACX,CAAC;AAEJ,SAAO,KAAK;;;CAId,kBAA+B;AAC7B,MAAI,CAAC,KAAK,uBACR,MAAK,yBAAyB,IAAI,YAAY;GAC5C,aAAa;GACb,UAAU,KAAK;GAChB,CAAC;AAEJ,SAAO,KAAK;;CAGd,aAAmB;AACjB,OAAK,oBAAoB,SAAS;AAClC,OAAK,kBAAkB,SAAS;AAChC,OAAK,qBAAqB,SAAS;AACnC,OAAK,wBAAwB,SAAS;AACtC,OAAK,yBAAyB,SAAS;AACvC,OAAK,wBAAwB,SAAS;AACtC,OAAK,qBAAqB,KAAA;AAC1B,OAAK,mBAAmB,KAAA;AACxB,OAAK,sBAAsB,KAAA;AAC3B,OAAK,yBAAyB,KAAA;AAC9B,OAAK,0BAA0B,KAAA;AAC/B,OAAK,yBAAyB,KAAA;AAC9B,OAAK,uBAAuB,KAAA;;;CAI9B,mBAAyB;AACvB,OAAK,oBAAoB,eAAe;AACxC,OAAK,kBAAkB,eAAe;AACtC,OAAK,qBAAqB,eAAe;AACzC,OAAK,wBAAwB,eAAe;AAC5C,OAAK,yBAAyB,eAAe;AAC7C,OAAK,wBAAwB,eAAe;;;AAIhD,MAAa,UAAU,IAAI,gBAAgB"}

package/dist/src/gateway/rate-limit/env-flags.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Process-level env-var feature flags that influence rate-limit and gateway
+ * security behavior. Kept as a tiny module so non-gateway packages can read
+ * them without pulling the rate-limit subsystem.
+ */
+export declare function isAuthRateLimitGloballyDisabled(): boolean;
+export declare function isGatewayStrictSecurityEnabled(cfg?: {
+    gateway?: {
+        security?: {
+            strict?: boolean;
+        };
+    };
+}): boolean;

package/dist/src/gateway/rate-limit/env-flags.js

@@ -0,0 +1,16 @@
+//#region src/gateway/rate-limit/env-flags.ts
+/**
+* Process-level env-var feature flags that influence rate-limit and gateway
+* security behavior. Kept as a tiny module so non-gateway packages can read
+* them without pulling the rate-limit subsystem.
+*/
+function isAuthRateLimitGloballyDisabled() {
+	return process.env.XOPC_AUTH_RATE_LIMIT === "false";
+}
+function isGatewayStrictSecurityEnabled(cfg) {
+	return cfg?.gateway?.security?.strict === true || process.env.XOPC_GATEWAY_STRICT_SECURITY === "1";
+}
+//#endregion
+export { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled };
+
+//# sourceMappingURL=env-flags.js.map

package/dist/src/gateway/rate-limit/env-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-flags.js","names":[],"sources":["../../../../src/gateway/rate-limit/env-flags.ts"],"sourcesContent":["/**\n * Process-level env-var feature flags that influence rate-limit and gateway\n * security behavior. Kept as a tiny module so non-gateway packages can read\n * them without pulling the rate-limit subsystem.\n */\n\nexport function isAuthRateLimitGloballyDisabled(): boolean {\n  return process.env.XOPC_AUTH_RATE_LIMIT === 'false';\n}\n\nexport function isGatewayStrictSecurityEnabled(cfg?: {\n  gateway?: { security?: { strict?: boolean } };\n}): boolean {\n  return (\n    cfg?.gateway?.security?.strict === true ||\n    process.env.XOPC_GATEWAY_STRICT_SECURITY === '1'\n  );\n}\n"],"mappings":";;;;;;AAMA,SAAgB,kCAA2C;AACzD,QAAO,QAAQ,IAAI,yBAAyB;;AAG9C,SAAgB,+BAA+B,KAEnC;AACV,QACE,KAAK,SAAS,UAAU,WAAW,QACnC,QAAQ,IAAI,iCAAiC"}

package/dist/src/gateway/rate-limit/index.d.ts

@@ -0,0 +1,3 @@
+export { buckets, resolveAuthRateLimit, authPolicyConfig, type ResolvedAuthRateLimitConfig, } from './buckets.js';
+export { resolveAuthTracking, buildBrowserOriginKey, type AuthRateLimitPolicyConfig, type AuthRateLimitTracking, } from './auth-policy.js';
+export { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled, } from './env-flags.js';

package/dist/src/gateway/rate-limit/index.js

@@ -0,0 +1,4 @@
+import { authPolicyConfig, buckets, resolveAuthRateLimit } from "./buckets.js";
+import { buildBrowserOriginKey, resolveAuthTracking } from "./auth-policy.js";
+import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "./env-flags.js";
+export { authPolicyConfig, buckets, buildBrowserOriginKey, isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled, resolveAuthRateLimit, resolveAuthTracking };

package/dist/src/gateway/run-loop.d.ts

@@ -1,7 +1,7 @@
 /**
  * Gateway Run Loop - Core run loop for gateway process management
  */
-import type { GatewayServer } from "./server.js";
+import type { GatewayServer } from './server.js';
 export type RunGatewayLoopOptions = {
     start: () => Promise<GatewayServer>;
     configPath: string;

package/dist/src/gateway/run-loop.js

@@ -1,7 +1,15 @@
+import { loadConfig } from "../config/loader.js";
+import "../config/index.js";
+import { isRestartEnabled } from "../config/commands.flags.js";
 import { restartGatewayProcessWithFreshPid } from "./respawn.js";
 import { acquireGatewayLock } from "./lock.js";
+import { consumeGatewayRestartIntentSync, consumeGatewaySigusr1RestartAuthorization, isGatewaySigusr1RestartExternallyAllowed, resetGatewayRestartStateForInProcessRestart, scheduleGatewaySigusr1Restart, setGatewaySigusr1RestartPolicy } from "../infra/restart.js";
 //#region src/gateway/run-loop.ts
+/**
+* Gateway Run Loop - Core run loop for gateway process management
+*/
 async function runGatewayLoop(opts) {
+	setGatewaySigusr1RestartPolicy({ allowExternal: isRestartEnabled(loadConfig(opts.configPath)) });
 	let lock = await acquireGatewayLock(opts.configPath, { port: opts.port });
 	let server = null;
 	let shuttingDown = false;
@@ -32,6 +40,7 @@ async function runGatewayLoop(opts) {
 		}
 		if (respawn.mode === "failed") console.warn(`[GatewayRunLoop] Full process restart failed: ${respawn.detail ?? "unknown error"}`);
 		else console.log("[GatewayRunLoop] Restart mode: in-process restart (XOPC_NO_RESPAWN)");
+		resetGatewayRestartStateForInProcessRestart();
 		try {
 			lock = await acquireGatewayLock(opts.configPath, { port: opts.port });
 		} catch (err) {
@@ -47,7 +56,6 @@ async function runGatewayLoop(opts) {
 		exitProcess(0);
 	};
 	const DRAIN_TIMEOUT_MS = 3e4;
-	/** Allow slow channel plugin `stop()` + HTTP close; primary path should finish sooner after bus shutdown. */
 	const SHUTDOWN_TIMEOUT_MS = 15e3;
 	const requestShutdown = (action, signal) => {
 		if (shuttingDown) return;
@@ -79,7 +87,7 @@ async function runGatewayLoop(opts) {
 	};
 	const onSigterm = () => {
 		console.log("[GatewayRunLoop] SIGTERM received");
-		requestShutdown("stop", "SIGTERM");
+		requestShutdown(consumeGatewayRestartIntentSync() ? "restart" : "stop", "SIGTERM");
 	};
 	const onSigint = () => {
 		console.log("[GatewayRunLoop] SIGINT received");
@@ -87,8 +95,20 @@ async function runGatewayLoop(opts) {
 	};
 	const onSigusr1 = () => {
 		console.log("[GatewayRunLoop] SIGUSR1 received");
-		if (process.env.XOPC_ALLOW_SIGUSR1_RESTART !== "1") {
-			console.warn("[GatewayRunLoop] SIGUSR1 restart ignored (set XOPC_ALLOW_SIGUSR1_RESTART=1 to enable)");
+		if (!consumeGatewaySigusr1RestartAuthorization()) {
+			if (!isGatewaySigusr1RestartExternallyAllowed()) {
+				console.warn("[GatewayRunLoop] SIGUSR1 restart ignored (commands.restart=false or unauthorized).");
+				return;
+			}
+			if (shuttingDown) {
+				console.log("[GatewayRunLoop] Received SIGUSR1 during shutdown; ignoring");
+				return;
+			}
+			scheduleGatewaySigusr1Restart({
+				delayMs: 0,
+				reason: "SIGUSR1",
+				onRestart: () => requestShutdown("restart", "SIGUSR1")
+			});
 			return;
 		}
 		requestShutdown("restart", "SIGUSR1");

package/dist/src/gateway/run-loop.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-loop.js","names":[],"sources":["../../../src/gateway/run-loop.ts"],"sourcesContent":["/**\n * Gateway Run Loop - Core run loop for gateway process management\n */\n\nimport type { GatewayServer } from \"./server.js\";\nimport { acquireGatewayLock } from \"./lock.js\";\nimport { restartGatewayProcessWithFreshPid } from \"./respawn.js\";\n\ntype GatewayRunSignalAction = \"stop\" | \"restart\";\n\nexport type RunGatewayLoopOptions = {\n  start: () => Promise<GatewayServer>;\n  configPath: string;\n  port: number;\n};\n\nexport async function runGatewayLoop(opts: RunGatewayLoopOptions): Promise<void> {\n  // 1. Acquire lock\n  let lock = await acquireGatewayLock(opts.configPath, { port: opts.port });\n  let server: GatewayServer | null = null;\n  let shuttingDown = false;\n  let restartResolver: (() => void) | null = null;\n\n  // Cleanup functions\n  const cleanupSignals = () => {\n    process.removeListener(\"SIGTERM\", onSigterm);\n    process.removeListener(\"SIGINT\", onSigint);\n    process.removeListener(\"SIGUSR1\", onSigusr1);\n  };\n\n  const exitProcess = (code: number) => {\n    cleanupSignals();\n    process.exit(code);\n  };\n\n  const releaseLock = async (): Promise<void> => {\n    if (lock) {\n      await lock.release();\n      lock = null;\n    }\n  };\n\n  // Handle restart after close\n  const handleRestartAfterClose = async () => {\n    await releaseLock();\n\n    const respawn = restartGatewayProcessWithFreshPid();\n\n    if (respawn.mode === \"spawned\" || respawn.mode === \"supervised\") {\n      const modeLabel = respawn.mode === \"spawned\"\n        ? `spawned pid ${respawn.pid ?? \"unknown\"}`\n        : \"supervisor restart\";\n      console.log(`[GatewayRunLoop] Restart mode: full process restart (${modeLabel})`);\n      exitProcess(0);\n      return;\n    }\n\n    if (respawn.mode === \"failed\") {\n      console.warn(`[GatewayRunLoop] Full process restart failed: ${respawn.detail ?? \"unknown error\"}`);\n    } else {\n      console.log(\"[GatewayRunLoop] Restart mode: in-process restart (XOPC_NO_RESPAWN)\");\n    }\n\n    // In-process restart: reacquire lock\n    try {\n      lock = await acquireGatewayLock(opts.configPath, { port: opts.port });\n    } catch (err) {\n      console.error(`[GatewayRunLoop] Failed to reacquire lock: ${String(err)}`);\n      exitProcess(1);\n      return;\n    }\n\n    shuttingDown = false;\n    restartResolver?.();\n  };\n\n  // Handle stop after close\n  const handleStopAfterClose = async () => {\n    await releaseLock();\n    exitProcess(0);\n  };\n\n  // Signal handling\n  const DRAIN_TIMEOUT_MS = 30_000;\n  /** Allow slow channel plugin `stop()` + HTTP close; primary path should finish sooner after bus shutdown. */\n  const SHUTDOWN_TIMEOUT_MS = 15_000;\n\n  const requestShutdown = (action: GatewayRunSignalAction, signal: string) => {\n    if (shuttingDown) {\n      // Already shutting down, ignore subsequent signals silently\n      return;\n    }\n\n    shuttingDown = true;\n    const isRestart = action === \"restart\";\n    console.log(`[GatewayRunLoop] Received ${signal}; ${isRestart ? \"restarting\" : \"shutting down\"}`);\n\n    // Remove signal listeners to prevent repeated logging\n    cleanupSignals();\n\n    // Force exit timer\n    const forceExitMs = isRestart ? DRAIN_TIMEOUT_MS + SHUTDOWN_TIMEOUT_MS : SHUTDOWN_TIMEOUT_MS;\n    const forceExitTimer = setTimeout(() => {\n      console.error(\"[GatewayRunLoop] Shutdown timed out; force exiting\");\n      exitProcess(0);\n    }, forceExitMs);\n\n    // Async shutdown\n    void (async () => {\n      try {\n        // TODO: Add task draining when task queue is implemented\n        if (isRestart) {\n          console.log(\"[GatewayRunLoop] Draining active tasks before restart...\");\n        }\n\n        await server?.close?.({\n          reason: isRestart ? \"gateway restarting\" : \"gateway stopping\",\n          restartExpectedMs: isRestart ? 1500 : null,\n        });\n      } catch (err) {\n        console.error(`[GatewayRunLoop] Shutdown error: ${String(err)}`);\n      } finally {\n        clearTimeout(forceExitTimer);\n        server = null;\n\n        if (isRestart) {\n          await handleRestartAfterClose();\n        } else {\n          await handleStopAfterClose();\n        }\n      }\n    })();\n  };\n\n  const onSigterm = () => {\n    console.log(\"[GatewayRunLoop] SIGTERM received\");\n    requestShutdown(\"stop\", \"SIGTERM\");\n  };\n\n  const onSigint = () => {\n    console.log(\"[GatewayRunLoop] SIGINT received\");\n    requestShutdown(\"stop\", \"SIGINT\");\n  };\n\n  const onSigusr1 = () => {\n    console.log(\"[GatewayRunLoop] SIGUSR1 received\");\n    // Check if external restart is allowed\n    if (process.env.XOPC_ALLOW_SIGUSR1_RESTART !== \"1\") {\n      console.warn(\"[GatewayRunLoop] SIGUSR1 restart ignored (set XOPC_ALLOW_SIGUSR1_RESTART=1 to enable)\");\n      return;\n    }\n    requestShutdown(\"restart\", \"SIGUSR1\");\n  };\n\n  process.on(\"SIGTERM\", onSigterm);\n  process.on(\"SIGINT\", onSigint);\n  process.on(\"SIGUSR1\", onSigusr1);\n\n  // Main loop\n  try {\n    while (true) {\n      console.log(\"[GatewayRunLoop] Starting gateway server...\");\n      try {\n        server = await opts.start();\n      } catch (err) {\n        console.error(\"[GatewayRunLoop] Failed to start gateway server:\", err);\n        // Release lock before exiting\n        await releaseLock();\n        exitProcess(1);\n        return;\n      }\n\n      // Wait for restart signal\n      await new Promise<void>((resolve) => {\n        restartResolver = resolve;\n      });\n\n      console.log(\"[GatewayRunLoop] Restart signal received, restarting gateway...\");\n    }\n  } finally {\n    await releaseLock();\n    cleanupSignals();\n  }\n}\n"],"mappings":";;;AAgBA,eAAsB,eAAe,MAA4C;CAE/E,IAAI,OAAO,MAAM,mBAAmB,KAAK,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;CACzE,IAAI,SAA+B;CACnC,IAAI,eAAe;CACnB,IAAI,kBAAuC;CAG3C,MAAM,uBAAuB;AAC3B,UAAQ,eAAe,WAAW,UAAU;AAC5C,UAAQ,eAAe,UAAU,SAAS;AAC1C,UAAQ,eAAe,WAAW,UAAU;;CAG9C,MAAM,eAAe,SAAiB;AACpC,kBAAgB;AAChB,UAAQ,KAAK,KAAK;;CAGpB,MAAM,cAAc,YAA2B;AAC7C,MAAI,MAAM;AACR,SAAM,KAAK,SAAS;AACpB,UAAO;;;CAKX,MAAM,0BAA0B,YAAY;AAC1C,QAAM,aAAa;EAEnB,MAAM,UAAU,mCAAmC;AAEnD,MAAI,QAAQ,SAAS,aAAa,QAAQ,SAAS,cAAc;GAC/D,MAAM,YAAY,QAAQ,SAAS,YAC/B,eAAe,QAAQ,OAAO,cAC9B;AACJ,WAAQ,IAAI,wDAAwD,UAAU,GAAG;AACjF,eAAY,EAAE;AACd;;AAGF,MAAI,QAAQ,SAAS,SACnB,SAAQ,KAAK,iDAAiD,QAAQ,UAAU,kBAAkB;MAElG,SAAQ,IAAI,sEAAsE;AAIpF,MAAI;AACF,UAAO,MAAM,mBAAmB,KAAK,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;WAC9D,KAAK;AACZ,WAAQ,MAAM,8CAA8C,OAAO,IAAI,GAAG;AAC1E,eAAY,EAAE;AACd;;AAGF,iBAAe;AACf,qBAAmB;;CAIrB,MAAM,uBAAuB,YAAY;AACvC,QAAM,aAAa;AACnB,cAAY,EAAE;;CAIhB,MAAM,mBAAmB;;CAEzB,MAAM,sBAAsB;CAE5B,MAAM,mBAAmB,QAAgC,WAAmB;AAC1E,MAAI,aAEF;AAGF,iBAAe;EACf,MAAM,YAAY,WAAW;AAC7B,UAAQ,IAAI,6BAA6B,OAAO,IAAI,YAAY,eAAe,kBAAkB;AAGjG,kBAAgB;EAGhB,MAAM,cAAc,YAAY,mBAAmB,sBAAsB;EACzE,MAAM,iBAAiB,iBAAiB;AACtC,WAAQ,MAAM,qDAAqD;AACnE,eAAY,EAAE;KACb,YAAY;AAGf,GAAM,YAAY;AAChB,OAAI;AAEF,QAAI,UACF,SAAQ,IAAI,2DAA2D;AAGzE,UAAM,QAAQ,QAAQ;KACpB,QAAQ,YAAY,uBAAuB;KAC3C,mBAAmB,YAAY,OAAO;KACvC,CAAC;YACK,KAAK;AACZ,YAAQ,MAAM,oCAAoC,OAAO,IAAI,GAAG;aACxD;AACR,iBAAa,eAAe;AAC5B,aAAS;AAET,QAAI,UACF,OAAM,yBAAyB;QAE/B,OAAM,sBAAsB;;MAG9B;;CAGN,MAAM,kBAAkB;AACtB,UAAQ,IAAI,oCAAoC;AAChD,kBAAgB,QAAQ,UAAU;;CAGpC,MAAM,iBAAiB;AACrB,UAAQ,IAAI,mCAAmC;AAC/C,kBAAgB,QAAQ,SAAS;;CAGnC,MAAM,kBAAkB;AACtB,UAAQ,IAAI,oCAAoC;AAEhD,MAAI,QAAQ,IAAI,+BAA+B,KAAK;AAClD,WAAQ,KAAK,wFAAwF;AACrG;;AAEF,kBAAgB,WAAW,UAAU;;AAGvC,SAAQ,GAAG,WAAW,UAAU;AAChC,SAAQ,GAAG,UAAU,SAAS;AAC9B,SAAQ,GAAG,WAAW,UAAU;AAGhC,KAAI;AACF,SAAO,MAAM;AACX,WAAQ,IAAI,8CAA8C;AAC1D,OAAI;AACF,aAAS,MAAM,KAAK,OAAO;YACpB,KAAK;AACZ,YAAQ,MAAM,oDAAoD,IAAI;AAEtE,UAAM,aAAa;AACnB,gBAAY,EAAE;AACd;;AAIF,SAAM,IAAI,SAAe,YAAY;AACnC,sBAAkB;KAClB;AAEF,WAAQ,IAAI,kEAAkE;;WAExE;AACR,QAAM,aAAa;AACnB,kBAAgB"}
+{"version":3,"file":"run-loop.js","names":[],"sources":["../../../src/gateway/run-loop.ts"],"sourcesContent":["/**\n * Gateway Run Loop - Core run loop for gateway process management\n */\n\nimport { isRestartEnabled } from '../config/commands.flags.js';\nimport { loadConfig } from '../config/index.js';\nimport type { GatewayServer } from './server.js';\nimport { acquireGatewayLock } from './lock.js';\nimport { restartGatewayProcessWithFreshPid } from './respawn.js';\nimport {\n  consumeGatewayRestartIntentSync,\n  consumeGatewaySigusr1RestartAuthorization,\n  isGatewaySigusr1RestartExternallyAllowed,\n  resetGatewayRestartStateForInProcessRestart,\n  scheduleGatewaySigusr1Restart,\n  setGatewaySigusr1RestartPolicy,\n} from '../infra/restart.js';\n\ntype GatewayRunSignalAction = 'stop' | 'restart';\n\nexport type RunGatewayLoopOptions = {\n  start: () => Promise<GatewayServer>;\n  configPath: string;\n  port: number;\n};\n\nexport async function runGatewayLoop(opts: RunGatewayLoopOptions): Promise<void> {\n  const config = loadConfig(opts.configPath);\n  setGatewaySigusr1RestartPolicy({ allowExternal: isRestartEnabled(config) });\n\n  let lock = await acquireGatewayLock(opts.configPath, { port: opts.port });\n  let server: GatewayServer | null = null;\n  let shuttingDown = false;\n  let restartResolver: (() => void) | null = null;\n\n  const cleanupSignals = () => {\n    process.removeListener('SIGTERM', onSigterm);\n    process.removeListener('SIGINT', onSigint);\n    process.removeListener('SIGUSR1', onSigusr1);\n  };\n\n  const exitProcess = (code: number) => {\n    cleanupSignals();\n    process.exit(code);\n  };\n\n  const releaseLock = async (): Promise<void> => {\n    if (lock) {\n      await lock.release();\n      lock = null;\n    }\n  };\n\n  const handleRestartAfterClose = async () => {\n    await releaseLock();\n\n    const respawn = restartGatewayProcessWithFreshPid();\n\n    if (respawn.mode === 'spawned' || respawn.mode === 'supervised') {\n      const modeLabel = respawn.mode === 'spawned'\n        ? `spawned pid ${respawn.pid ?? 'unknown'}`\n        : 'supervisor restart';\n      console.log(`[GatewayRunLoop] Restart mode: full process restart (${modeLabel})`);\n      exitProcess(0);\n      return;\n    }\n\n    if (respawn.mode === 'failed') {\n      console.warn(`[GatewayRunLoop] Full process restart failed: ${respawn.detail ?? 'unknown error'}`);\n    } else {\n      console.log('[GatewayRunLoop] Restart mode: in-process restart (XOPC_NO_RESPAWN)');\n    }\n\n    resetGatewayRestartStateForInProcessRestart();\n\n    try {\n      lock = await acquireGatewayLock(opts.configPath, { port: opts.port });\n    } catch (err) {\n      console.error(`[GatewayRunLoop] Failed to reacquire lock: ${String(err)}`);\n      exitProcess(1);\n      return;\n    }\n\n    shuttingDown = false;\n    restartResolver?.();\n  };\n\n  const handleStopAfterClose = async () => {\n    await releaseLock();\n    exitProcess(0);\n  };\n\n  const DRAIN_TIMEOUT_MS = 30_000;\n  const SHUTDOWN_TIMEOUT_MS = 15_000;\n\n  const requestShutdown = (action: GatewayRunSignalAction, signal: string) => {\n    if (shuttingDown) {\n      return;\n    }\n\n    shuttingDown = true;\n    const isRestart = action === 'restart';\n    console.log(`[GatewayRunLoop] Received ${signal}; ${isRestart ? 'restarting' : 'shutting down'}`);\n\n    cleanupSignals();\n\n    const forceExitMs = isRestart ? DRAIN_TIMEOUT_MS + SHUTDOWN_TIMEOUT_MS : SHUTDOWN_TIMEOUT_MS;\n    const forceExitTimer = setTimeout(() => {\n      console.error('[GatewayRunLoop] Shutdown timed out; force exiting');\n      exitProcess(0);\n    }, forceExitMs);\n\n    void (async () => {\n      try {\n        if (isRestart) {\n          console.log('[GatewayRunLoop] Draining active tasks before restart...');\n        }\n\n        await server?.close?.({\n          reason: isRestart ? 'gateway restarting' : 'gateway stopping',\n          restartExpectedMs: isRestart ? 1500 : null,\n        });\n      } catch (err) {\n        console.error(`[GatewayRunLoop] Shutdown error: ${String(err)}`);\n      } finally {\n        clearTimeout(forceExitTimer);\n        server = null;\n\n        if (isRestart) {\n          await handleRestartAfterClose();\n        } else {\n          await handleStopAfterClose();\n        }\n      }\n    })();\n  };\n\n  const onSigterm = () => {\n    console.log('[GatewayRunLoop] SIGTERM received');\n    const isRestart = consumeGatewayRestartIntentSync();\n    requestShutdown(isRestart ? 'restart' : 'stop', 'SIGTERM');\n  };\n\n  const onSigint = () => {\n    console.log('[GatewayRunLoop] SIGINT received');\n    requestShutdown('stop', 'SIGINT');\n  };\n\n  const onSigusr1 = () => {\n    console.log('[GatewayRunLoop] SIGUSR1 received');\n    const authorized = consumeGatewaySigusr1RestartAuthorization();\n    if (!authorized) {\n      if (!isGatewaySigusr1RestartExternallyAllowed()) {\n        console.warn(\n          '[GatewayRunLoop] SIGUSR1 restart ignored (commands.restart=false or unauthorized).',\n        );\n        return;\n      }\n      if (shuttingDown) {\n        console.log('[GatewayRunLoop] Received SIGUSR1 during shutdown; ignoring');\n        return;\n      }\n      scheduleGatewaySigusr1Restart({\n        delayMs: 0,\n        reason: 'SIGUSR1',\n        onRestart: () => requestShutdown('restart', 'SIGUSR1'),\n      });\n      return;\n    }\n    requestShutdown('restart', 'SIGUSR1');\n  };\n\n  process.on('SIGTERM', onSigterm);\n  process.on('SIGINT', onSigint);\n  process.on('SIGUSR1', onSigusr1);\n\n  try {\n    while (true) {\n      console.log('[GatewayRunLoop] Starting gateway server...');\n      try {\n        server = await opts.start();\n      } catch (err) {\n        console.error('[GatewayRunLoop] Failed to start gateway server:', err);\n        await releaseLock();\n        exitProcess(1);\n        return;\n      }\n\n      await new Promise<void>((resolve) => {\n        restartResolver = resolve;\n      });\n\n      console.log('[GatewayRunLoop] Restart signal received, restarting gateway...');\n    }\n  } finally {\n    await releaseLock();\n    cleanupSignals();\n  }\n}\n"],"mappings":";;;;;;;;;;AA0BA,eAAsB,eAAe,MAA4C;AAE/E,gCAA+B,EAAE,eAAe,iBADjC,WAAW,KAAK,WACwC,CAAC,EAAE,CAAC;CAE3E,IAAI,OAAO,MAAM,mBAAmB,KAAK,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;CACzE,IAAI,SAA+B;CACnC,IAAI,eAAe;CACnB,IAAI,kBAAuC;CAE3C,MAAM,uBAAuB;AAC3B,UAAQ,eAAe,WAAW,UAAU;AAC5C,UAAQ,eAAe,UAAU,SAAS;AAC1C,UAAQ,eAAe,WAAW,UAAU;;CAG9C,MAAM,eAAe,SAAiB;AACpC,kBAAgB;AAChB,UAAQ,KAAK,KAAK;;CAGpB,MAAM,cAAc,YAA2B;AAC7C,MAAI,MAAM;AACR,SAAM,KAAK,SAAS;AACpB,UAAO;;;CAIX,MAAM,0BAA0B,YAAY;AAC1C,QAAM,aAAa;EAEnB,MAAM,UAAU,mCAAmC;AAEnD,MAAI,QAAQ,SAAS,aAAa,QAAQ,SAAS,cAAc;GAC/D,MAAM,YAAY,QAAQ,SAAS,YAC/B,eAAe,QAAQ,OAAO,cAC9B;AACJ,WAAQ,IAAI,wDAAwD,UAAU,GAAG;AACjF,eAAY,EAAE;AACd;;AAGF,MAAI,QAAQ,SAAS,SACnB,SAAQ,KAAK,iDAAiD,QAAQ,UAAU,kBAAkB;MAElG,SAAQ,IAAI,sEAAsE;AAGpF,+CAA6C;AAE7C,MAAI;AACF,UAAO,MAAM,mBAAmB,KAAK,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;WAC9D,KAAK;AACZ,WAAQ,MAAM,8CAA8C,OAAO,IAAI,GAAG;AAC1E,eAAY,EAAE;AACd;;AAGF,iBAAe;AACf,qBAAmB;;CAGrB,MAAM,uBAAuB,YAAY;AACvC,QAAM,aAAa;AACnB,cAAY,EAAE;;CAGhB,MAAM,mBAAmB;CACzB,MAAM,sBAAsB;CAE5B,MAAM,mBAAmB,QAAgC,WAAmB;AAC1E,MAAI,aACF;AAGF,iBAAe;EACf,MAAM,YAAY,WAAW;AAC7B,UAAQ,IAAI,6BAA6B,OAAO,IAAI,YAAY,eAAe,kBAAkB;AAEjG,kBAAgB;EAEhB,MAAM,cAAc,YAAY,mBAAmB,sBAAsB;EACzE,MAAM,iBAAiB,iBAAiB;AACtC,WAAQ,MAAM,qDAAqD;AACnE,eAAY,EAAE;KACb,YAAY;AAEf,GAAM,YAAY;AAChB,OAAI;AACF,QAAI,UACF,SAAQ,IAAI,2DAA2D;AAGzE,UAAM,QAAQ,QAAQ;KACpB,QAAQ,YAAY,uBAAuB;KAC3C,mBAAmB,YAAY,OAAO;KACvC,CAAC;YACK,KAAK;AACZ,YAAQ,MAAM,oCAAoC,OAAO,IAAI,GAAG;aACxD;AACR,iBAAa,eAAe;AAC5B,aAAS;AAET,QAAI,UACF,OAAM,yBAAyB;QAE/B,OAAM,sBAAsB;;MAG9B;;CAGN,MAAM,kBAAkB;AACtB,UAAQ,IAAI,oCAAoC;AAEhD,kBADkB,iCACO,GAAG,YAAY,QAAQ,UAAU;;CAG5D,MAAM,iBAAiB;AACrB,UAAQ,IAAI,mCAAmC;AAC/C,kBAAgB,QAAQ,SAAS;;CAGnC,MAAM,kBAAkB;AACtB,UAAQ,IAAI,oCAAoC;AAEhD,MAAI,CADe,2CACJ,EAAE;AACf,OAAI,CAAC,0CAA0C,EAAE;AAC/C,YAAQ,KACN,qFACD;AACD;;AAEF,OAAI,cAAc;AAChB,YAAQ,IAAI,8DAA8D;AAC1E;;AAEF,iCAA8B;IAC5B,SAAS;IACT,QAAQ;IACR,iBAAiB,gBAAgB,WAAW,UAAU;IACvD,CAAC;AACF;;AAEF,kBAAgB,WAAW,UAAU;;AAGvC,SAAQ,GAAG,WAAW,UAAU;AAChC,SAAQ,GAAG,UAAU,SAAS;AAC9B,SAAQ,GAAG,WAAW,UAAU;AAEhC,KAAI;AACF,SAAO,MAAM;AACX,WAAQ,IAAI,8CAA8C;AAC1D,OAAI;AACF,aAAS,MAAM,KAAK,OAAO;YACpB,KAAK;AACZ,YAAQ,MAAM,oDAAoD,IAAI;AACtE,UAAM,aAAa;AACnB,gBAAY,EAAE;AACd;;AAGF,SAAM,IAAI,SAAe,YAAY;AACnC,sBAAkB;KAClB;AAEF,WAAQ,IAAI,kEAAkE;;WAExE;AACR,QAAM,aAAa;AACnB,kBAAgB"}

package/dist/src/gateway/runtime-config.js

@@ -1,7 +1,8 @@
 import { isAllInterfacesHost, isLoopbackHost } from "./host.js";
-import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "./auth-rate-limit.js";
 import { resolveGatewayListenPlan } from "./listen.js";
 import { assertTailscaleExposureCompatible } from "./tailscale-lifecycle.js";
+import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "./rate-limit/env-flags.js";
+import "./rate-limit/index.js";
 //#region src/gateway/runtime-config.ts
 function normalizeCorsOrigins(cfg) {
 	return (cfg.gateway?.corsOrigins ?? []).map((value) => value.trim()).filter(Boolean);

package/dist/src/gateway/runtime-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-config.js","names":[],"sources":["../../../src/gateway/runtime-config.ts"],"sourcesContent":["import type { Config } from '../config/schema.js';\nimport type { GatewayBindMode } from '../config/schema.js';\nimport type { ResolvedGatewayAuth } from './auth.js';\nimport { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from './auth-rate-limit.js';\nimport {\n  isAllInterfacesHost,\n  isLoopbackHost,\n} from './host.js';\nimport { resolveGatewayListenPlan } from './listen.js';\nimport { assertTailscaleExposureCompatible } from './tailscale-lifecycle.js';\n\nexport type GatewayRuntimeConfig = {\n  bindMode: GatewayBindMode;\n  bindHost: string;\n  customBindHost?: string;\n  loopback: boolean;\n  auth: ResolvedGatewayAuth;\n  corsOrigins: string[];\n  dangerouslyAllowHostHeaderOriginFallback: boolean;\n  rateLimitEnabled: boolean;\n  tlsEnabled: boolean;\n};\n\nfunction normalizeCorsOrigins(cfg: Config): string[] {\n  return (cfg.gateway?.corsOrigins ?? [])\n    .map((value) => value.trim())\n    .filter(Boolean);\n}\n\nfunction hasSharedSecret(auth: ResolvedGatewayAuth): boolean {\n  if (auth.mode === 'trusted-proxy') {\n    return true;\n  }\n  if (auth.mode === 'token') {\n    return typeof auth.token === 'string' && auth.token.trim().length > 0;\n  }\n  if (auth.mode === 'password') {\n    return typeof auth.password === 'string' && auth.password.trim().length > 0;\n  }\n  return false;\n}\n\n/**\n * Fail-closed gateway startup guards (OpenClaw-aligned).\n * Throws when bind/auth/origin combinations are unsafe for network exposure.\n */\nexport function assertGatewayRuntimeConfig(params: {\n  cfg: Config;\n  auth: ResolvedGatewayAuth;\n  bindOverride?: GatewayBindMode;\n  port: number;\n}): GatewayRuntimeConfig {\n  const plan = resolveGatewayListenPlan({\n    cfg: params.cfg,\n    bindOverride: params.bindOverride,\n  });\n  const { bindMode, bindHost, customBindHost } = plan;\n  const loopback = isLoopbackHost(bindHost);\n  const corsOrigins = normalizeCorsOrigins(params.cfg);\n  const dangerouslyAllowHostHeaderOriginFallback =\n    params.cfg.gateway?.dangerouslyAllowHostHeaderOriginFallback === true;\n\n  if (bindMode === 'loopback' && !loopback) {\n    throw new Error(\n      `gateway bind=loopback resolved to non-loopback host ${bindHost}; refusing fallback to a network bind`,\n    );\n  }\n\n  if (bindMode === 'custom') {\n    const configuredCustom = params.cfg.gateway?.customBindHost?.trim();\n    if (!configuredCustom) {\n      throw new Error('gateway.bind=custom requires gateway.customBindHost');\n    }\n    if (bindHost !== configuredCustom) {\n      throw new Error(\n        `gateway bind=custom requested ${configuredCustom} but resolved ${bindHost}`,\n      );\n    }\n  }\n\n  if (!loopback) {\n    if (params.auth.mode === 'none') {\n      throw new Error(\n        `refusing to bind gateway to ${bindHost}:${params.port} without auth ` +\n          '(set gateway.auth.mode to \"token\", \"password\", or \"trusted-proxy\" and configure credentials)',\n      );\n    }\n\n    if (!hasSharedSecret(params.auth)) {\n      throw new Error(\n        `refusing to bind gateway to ${bindHost}:${params.port} without auth ` +\n          '(set gateway.auth.token/password, XOPC_GATEWAY_TOKEN/XOPC_GATEWAY_PASSWORD, or trusted-proxy config)',\n      );\n    }\n\n    if (params.auth.mode === 'trusted-proxy') {\n      const trustedProxies = (params.cfg.gateway?.trustedProxies ?? [])\n        .map((entry) => entry.trim())\n        .filter(Boolean);\n      if (trustedProxies.length === 0) {\n        throw new Error(\n          'gateway auth mode=trusted-proxy requires gateway.trustedProxies to be configured with at least one proxy IP',\n        );\n      }\n    }\n\n    // Empty corsOrigins is allowed: resolveGatewayCorsOrigins applies loopback defaults\n    // (localhost + 127.0.0.1 on the gateway port). LAN browser access still needs explicit origins.\n\n    if (corsOrigins.some((origin) => origin === '*')) {\n      throw new Error(\n        'gateway.corsOrigins must not include \"*\" when binding to a network-accessible address',\n      );\n    }\n  }\n\n  if (isAllInterfacesHost(bindHost) && params.auth.mode === 'none') {\n    throw new Error(\n      'refusing to bind gateway to all interfaces (0.0.0.0) without authentication',\n    );\n  }\n\n  assertTailscaleExposureCompatible(params.cfg);\n\n  const rateLimitConfigured = params.cfg.gateway?.auth?.rateLimit !== undefined;\n  const rateLimitEnabled =\n    params.cfg.gateway?.auth?.rateLimit?.enabled !== false &&\n    !isAuthRateLimitGloballyDisabled();\n  const tailscaleMode = params.cfg.gateway?.tailscale?.mode ?? 'off';\n  const tlsEnabled =\n    params.cfg.tunnel?.enabled === true ||\n    tailscaleMode !== 'off' ||\n    params.cfg.gateway?.tls?.enabled === true;\n\n  if (\n    !loopback &&\n    isGatewayStrictSecurityEnabled(params.cfg) &&\n    !rateLimitConfigured\n  ) {\n    throw new Error(\n      'gateway.security.strict requires gateway.auth.rateLimit on network-accessible binds ' +\n        '(e.g. { maxAttempts: 10, windowMs: 60000, blockDurationMs: 300000 })',\n    );\n  }\n\n  return {\n    bindMode,\n    bindHost,\n    customBindHost,\n    loopback,\n    auth: params.auth,\n    corsOrigins,\n    dangerouslyAllowHostHeaderOriginFallback,\n    rateLimitEnabled,\n    tlsEnabled,\n  };\n}\n"],"mappings":";;;;;AAuBA,SAAS,qBAAqB,KAAuB;AACnD,SAAQ,IAAI,SAAS,eAAe,EAAE,EACnC,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,OAAO,QAAQ;;AAGpB,SAAS,gBAAgB,MAAoC;AAC3D,KAAI,KAAK,SAAS,gBAChB,QAAO;AAET,KAAI,KAAK,SAAS,QAChB,QAAO,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,MAAM,CAAC,SAAS;AAEtE,KAAI,KAAK,SAAS,WAChB,QAAO,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,MAAM,CAAC,SAAS;AAE5E,QAAO;;;;;;AAOT,SAAgB,2BAA2B,QAKlB;CAKvB,MAAM,EAAE,UAAU,UAAU,mBAJf,yBAAyB;EACpC,KAAK,OAAO;EACZ,cAAc,OAAO;EACtB,CACkD;CACnD,MAAM,WAAW,eAAe,SAAS;CACzC,MAAM,cAAc,qBAAqB,OAAO,IAAI;CACpD,MAAM,2CACJ,OAAO,IAAI,SAAS,6CAA6C;AAEnE,KAAI,aAAa,cAAc,CAAC,SAC9B,OAAM,IAAI,MACR,uDAAuD,SAAS,uCACjE;AAGH,KAAI,aAAa,UAAU;EACzB,MAAM,mBAAmB,OAAO,IAAI,SAAS,gBAAgB,MAAM;AACnE,MAAI,CAAC,iBACH,OAAM,IAAI,MAAM,sDAAsD;AAExE,MAAI,aAAa,iBACf,OAAM,IAAI,MACR,iCAAiC,iBAAiB,gBAAgB,WACnE;;AAIL,KAAI,CAAC,UAAU;AACb,MAAI,OAAO,KAAK,SAAS,OACvB,OAAM,IAAI,MACR,+BAA+B,SAAS,GAAG,OAAO,KAAK,4GAExD;AAGH,MAAI,CAAC,gBAAgB,OAAO,KAAK,CAC/B,OAAM,IAAI,MACR,+BAA+B,SAAS,GAAG,OAAO,KAAK,oHAExD;AAGH,MAAI,OAAO,KAAK,SAAS;QACC,OAAO,IAAI,SAAS,kBAAkB,EAAE,EAC7D,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,OAAO,QACQ,CAAC,WAAW,EAC5B,OAAM,IAAI,MACR,8GACD;;AAOL,MAAI,YAAY,MAAM,WAAW,WAAW,IAAI,CAC9C,OAAM,IAAI,MACR,0FACD;;AAIL,KAAI,oBAAoB,SAAS,IAAI,OAAO,KAAK,SAAS,OACxD,OAAM,IAAI,MACR,8EACD;AAGH,mCAAkC,OAAO,IAAI;CAE7C,MAAM,sBAAsB,OAAO,IAAI,SAAS,MAAM,cAAc,KAAA;CACpE,MAAM,mBACJ,OAAO,IAAI,SAAS,MAAM,WAAW,YAAY,SACjD,CAAC,iCAAiC;CACpC,MAAM,gBAAgB,OAAO,IAAI,SAAS,WAAW,QAAQ;CAC7D,MAAM,aACJ,OAAO,IAAI,QAAQ,YAAY,QAC/B,kBAAkB,SAClB,OAAO,IAAI,SAAS,KAAK,YAAY;AAEvC,KACE,CAAC,YACD,+BAA+B,OAAO,IAAI,IAC1C,CAAC,oBAED,OAAM,IAAI,MACR,2JAED;AAGH,QAAO;EACL;EACA;EACA;EACA;EACA,MAAM,OAAO;EACb;EACA;EACA;EACA;EACD"}
+{"version":3,"file":"runtime-config.js","names":[],"sources":["../../../src/gateway/runtime-config.ts"],"sourcesContent":["import type { Config } from '../config/schema.js';\nimport type { GatewayBindMode } from '../config/schema.js';\nimport type { ResolvedGatewayAuth } from './auth.js';\nimport { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from './rate-limit/index.js';\nimport {\n  isAllInterfacesHost,\n  isLoopbackHost,\n} from './host.js';\nimport { resolveGatewayListenPlan } from './listen.js';\nimport { assertTailscaleExposureCompatible } from './tailscale-lifecycle.js';\n\nexport type GatewayRuntimeConfig = {\n  bindMode: GatewayBindMode;\n  bindHost: string;\n  customBindHost?: string;\n  loopback: boolean;\n  auth: ResolvedGatewayAuth;\n  corsOrigins: string[];\n  dangerouslyAllowHostHeaderOriginFallback: boolean;\n  rateLimitEnabled: boolean;\n  tlsEnabled: boolean;\n};\n\nfunction normalizeCorsOrigins(cfg: Config): string[] {\n  return (cfg.gateway?.corsOrigins ?? [])\n    .map((value) => value.trim())\n    .filter(Boolean);\n}\n\nfunction hasSharedSecret(auth: ResolvedGatewayAuth): boolean {\n  if (auth.mode === 'trusted-proxy') {\n    return true;\n  }\n  if (auth.mode === 'token') {\n    return typeof auth.token === 'string' && auth.token.trim().length > 0;\n  }\n  if (auth.mode === 'password') {\n    return typeof auth.password === 'string' && auth.password.trim().length > 0;\n  }\n  return false;\n}\n\n/**\n * Fail-closed gateway startup guards (OpenClaw-aligned).\n * Throws when bind/auth/origin combinations are unsafe for network exposure.\n */\nexport function assertGatewayRuntimeConfig(params: {\n  cfg: Config;\n  auth: ResolvedGatewayAuth;\n  bindOverride?: GatewayBindMode;\n  port: number;\n}): GatewayRuntimeConfig {\n  const plan = resolveGatewayListenPlan({\n    cfg: params.cfg,\n    bindOverride: params.bindOverride,\n  });\n  const { bindMode, bindHost, customBindHost } = plan;\n  const loopback = isLoopbackHost(bindHost);\n  const corsOrigins = normalizeCorsOrigins(params.cfg);\n  const dangerouslyAllowHostHeaderOriginFallback =\n    params.cfg.gateway?.dangerouslyAllowHostHeaderOriginFallback === true;\n\n  if (bindMode === 'loopback' && !loopback) {\n    throw new Error(\n      `gateway bind=loopback resolved to non-loopback host ${bindHost}; refusing fallback to a network bind`,\n    );\n  }\n\n  if (bindMode === 'custom') {\n    const configuredCustom = params.cfg.gateway?.customBindHost?.trim();\n    if (!configuredCustom) {\n      throw new Error('gateway.bind=custom requires gateway.customBindHost');\n    }\n    if (bindHost !== configuredCustom) {\n      throw new Error(\n        `gateway bind=custom requested ${configuredCustom} but resolved ${bindHost}`,\n      );\n    }\n  }\n\n  if (!loopback) {\n    if (params.auth.mode === 'none') {\n      throw new Error(\n        `refusing to bind gateway to ${bindHost}:${params.port} without auth ` +\n          '(set gateway.auth.mode to \"token\", \"password\", or \"trusted-proxy\" and configure credentials)',\n      );\n    }\n\n    if (!hasSharedSecret(params.auth)) {\n      throw new Error(\n        `refusing to bind gateway to ${bindHost}:${params.port} without auth ` +\n          '(set gateway.auth.token/password, XOPC_GATEWAY_TOKEN/XOPC_GATEWAY_PASSWORD, or trusted-proxy config)',\n      );\n    }\n\n    if (params.auth.mode === 'trusted-proxy') {\n      const trustedProxies = (params.cfg.gateway?.trustedProxies ?? [])\n        .map((entry) => entry.trim())\n        .filter(Boolean);\n      if (trustedProxies.length === 0) {\n        throw new Error(\n          'gateway auth mode=trusted-proxy requires gateway.trustedProxies to be configured with at least one proxy IP',\n        );\n      }\n    }\n\n    // Empty corsOrigins is allowed: resolveGatewayCorsOrigins applies loopback defaults\n    // (localhost + 127.0.0.1 on the gateway port). LAN browser access still needs explicit origins.\n\n    if (corsOrigins.some((origin) => origin === '*')) {\n      throw new Error(\n        'gateway.corsOrigins must not include \"*\" when binding to a network-accessible address',\n      );\n    }\n  }\n\n  if (isAllInterfacesHost(bindHost) && params.auth.mode === 'none') {\n    throw new Error(\n      'refusing to bind gateway to all interfaces (0.0.0.0) without authentication',\n    );\n  }\n\n  assertTailscaleExposureCompatible(params.cfg);\n\n  const rateLimitConfigured = params.cfg.gateway?.auth?.rateLimit !== undefined;\n  const rateLimitEnabled =\n    params.cfg.gateway?.auth?.rateLimit?.enabled !== false &&\n    !isAuthRateLimitGloballyDisabled();\n  const tailscaleMode = params.cfg.gateway?.tailscale?.mode ?? 'off';\n  const tlsEnabled =\n    params.cfg.tunnel?.enabled === true ||\n    tailscaleMode !== 'off' ||\n    params.cfg.gateway?.tls?.enabled === true;\n\n  if (\n    !loopback &&\n    isGatewayStrictSecurityEnabled(params.cfg) &&\n    !rateLimitConfigured\n  ) {\n    throw new Error(\n      'gateway.security.strict requires gateway.auth.rateLimit on network-accessible binds ' +\n        '(e.g. { maxAttempts: 10, windowMs: 60000, blockDurationMs: 300000 })',\n    );\n  }\n\n  return {\n    bindMode,\n    bindHost,\n    customBindHost,\n    loopback,\n    auth: params.auth,\n    corsOrigins,\n    dangerouslyAllowHostHeaderOriginFallback,\n    rateLimitEnabled,\n    tlsEnabled,\n  };\n}\n"],"mappings":";;;;;;AAuBA,SAAS,qBAAqB,KAAuB;AACnD,SAAQ,IAAI,SAAS,eAAe,EAAE,EACnC,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,OAAO,QAAQ;;AAGpB,SAAS,gBAAgB,MAAoC;AAC3D,KAAI,KAAK,SAAS,gBAChB,QAAO;AAET,KAAI,KAAK,SAAS,QAChB,QAAO,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,MAAM,CAAC,SAAS;AAEtE,KAAI,KAAK,SAAS,WAChB,QAAO,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,MAAM,CAAC,SAAS;AAE5E,QAAO;;;;;;AAOT,SAAgB,2BAA2B,QAKlB;CAKvB,MAAM,EAAE,UAAU,UAAU,mBAJf,yBAAyB;EACpC,KAAK,OAAO;EACZ,cAAc,OAAO;EACtB,CACkD;CACnD,MAAM,WAAW,eAAe,SAAS;CACzC,MAAM,cAAc,qBAAqB,OAAO,IAAI;CACpD,MAAM,2CACJ,OAAO,IAAI,SAAS,6CAA6C;AAEnE,KAAI,aAAa,cAAc,CAAC,SAC9B,OAAM,IAAI,MACR,uDAAuD,SAAS,uCACjE;AAGH,KAAI,aAAa,UAAU;EACzB,MAAM,mBAAmB,OAAO,IAAI,SAAS,gBAAgB,MAAM;AACnE,MAAI,CAAC,iBACH,OAAM,IAAI,MAAM,sDAAsD;AAExE,MAAI,aAAa,iBACf,OAAM,IAAI,MACR,iCAAiC,iBAAiB,gBAAgB,WACnE;;AAIL,KAAI,CAAC,UAAU;AACb,MAAI,OAAO,KAAK,SAAS,OACvB,OAAM,IAAI,MACR,+BAA+B,SAAS,GAAG,OAAO,KAAK,4GAExD;AAGH,MAAI,CAAC,gBAAgB,OAAO,KAAK,CAC/B,OAAM,IAAI,MACR,+BAA+B,SAAS,GAAG,OAAO,KAAK,oHAExD;AAGH,MAAI,OAAO,KAAK,SAAS;QACC,OAAO,IAAI,SAAS,kBAAkB,EAAE,EAC7D,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,OAAO,QACQ,CAAC,WAAW,EAC5B,OAAM,IAAI,MACR,8GACD;;AAOL,MAAI,YAAY,MAAM,WAAW,WAAW,IAAI,CAC9C,OAAM,IAAI,MACR,0FACD;;AAIL,KAAI,oBAAoB,SAAS,IAAI,OAAO,KAAK,SAAS,OACxD,OAAM,IAAI,MACR,8EACD;AAGH,mCAAkC,OAAO,IAAI;CAE7C,MAAM,sBAAsB,OAAO,IAAI,SAAS,MAAM,cAAc,KAAA;CACpE,MAAM,mBACJ,OAAO,IAAI,SAAS,MAAM,WAAW,YAAY,SACjD,CAAC,iCAAiC;CACpC,MAAM,gBAAgB,OAAO,IAAI,SAAS,WAAW,QAAQ;CAC7D,MAAM,aACJ,OAAO,IAAI,QAAQ,YAAY,QAC/B,kBAAkB,SAClB,OAAO,IAAI,SAAS,KAAK,YAAY;AAEvC,KACE,CAAC,YACD,+BAA+B,OAAO,IAAI,IAC1C,CAAC,oBAED,OAAM,IAAI,MACR,2JAED;AAGH,QAAO;EACL;EACA;EACA;EACA;EACA,MAAM,OAAO;EACb;EACA;EACA;EACA;EACD"}

package/dist/src/gateway/security/audit.js

@@ -1,9 +1,10 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "../auth-rate-limit.js";
 import { assertGatewayAuthConfigured, resolveGatewayAuth } from "../auth.js";
 import { resolveGatewayListenPlan } from "../listen.js";
 import { collectExposureConflicts, isRemoteGatewayInsecure, isTailnetBindUnavailable } from "../../remote-access/exposure-guards.js";
+import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "../rate-limit/env-flags.js";
+import "../rate-limit/index.js";
 import { assertGatewayRuntimeConfig } from "../runtime-config.js";
 //#region src/gateway/security/audit.ts
 init_logger();

package/dist/src/gateway/security/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","names":[],"sources":["../../../../src/gateway/security/audit.ts"],"sourcesContent":["import type { Config } from '../../config/schema.js';\nimport type { ResolvedGatewayAuth } from '../auth.js';\nimport { resolveGatewayAuth, assertGatewayAuthConfigured } from '../auth.js';\nimport { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from '../auth-rate-limit.js';\nimport { assertGatewayRuntimeConfig } from '../runtime-config.js';\nimport { resolveGatewayListenPlan } from '../listen.js';\nimport {\n  collectExposureConflicts,\n  isRemoteGatewayInsecure,\n  isTailnetBindUnavailable,\n} from '../../remote-access/exposure-guards.js';\nimport { createLogger } from '../../utils/logger.js';\n\nconst log = createLogger('SecurityAudit');\n\nexport type SecurityAuditFinding = {\n  checkId: string;\n  severity: 'critical' | 'warn' | 'info';\n  title: string;\n  detail: string;\n  /** Actionable remediation suggestion (aligned with OpenClaw audit format). */\n  remediation?: string;\n};\n\n/** Minimum token length to resist brute-force even with rate limiting. */\nconst MIN_AUDIT_TOKEN_LENGTH = 22;\n\nfunction isLoopbackHost(host: string | undefined): boolean {\n  return !host ||\n    host === '127.0.0.1' ||\n    host === 'localhost' ||\n    host === '::1';\n}\n\nfunction normalizeCorsOrigins(cfg: Config): string[] {\n  return (cfg.gateway?.corsOrigins ?? [])\n    .map((value) => value.trim())\n    .filter(Boolean);\n}\n\nfunction resolveAuditInputs(cfg: Config, env: NodeJS.ProcessEnv = process.env): {\n  auth: ResolvedGatewayAuth;\n  bindHost: string;\n  corsOrigins: string[];\n  rateLimitEnabled: boolean;\n  tlsEnabled: boolean;\n  trustedProxies?: string[];\n  allowRealIpFallback: boolean;\n  dangerouslyAllowHostHeaderOriginFallback: boolean;\n  loopback: boolean;\n} {\n  const auth = resolveGatewayAuth({ authConfig: cfg.gateway?.auth, env });\n  const plan = resolveGatewayListenPlan({ cfg });\n  const corsOrigins = normalizeCorsOrigins(cfg);\n  const rateLimitEnabled =\n    cfg.gateway?.auth?.rateLimit?.enabled !== false &&\n    !isAuthRateLimitGloballyDisabled();\n  const tlsEnabled =\n    cfg.tunnel?.enabled === true ||\n    (cfg.gateway?.tailscale?.mode ?? 'off') !== 'off' ||\n    cfg.gateway?.tls?.enabled === true;\n  const loopback = isLoopbackHost(plan.bindHost);\n\n  return {\n    auth,\n    bindHost: plan.bindHost,\n    corsOrigins,\n    rateLimitEnabled,\n    tlsEnabled,\n    trustedProxies: cfg.gateway?.trustedProxies,\n    allowRealIpFallback: cfg.gateway?.allowRealIpFallback === true,\n    dangerouslyAllowHostHeaderOriginFallback:\n      cfg.gateway?.dangerouslyAllowHostHeaderOriginFallback === true,\n    loopback,\n  };\n}\n\n/**\n * Pure gateway config audit (no logging). Shared by startup audit and `xopc doctor`.\n */\nexport function collectGatewayConfigFindings(params: {\n  auth: ResolvedGatewayAuth;\n  bindHost?: string;\n  corsOrigins?: string[];\n  rateLimitEnabled?: boolean;\n  tlsEnabled?: boolean;\n  trustedProxies?: string[];\n  allowRealIpFallback?: boolean;\n  dangerouslyAllowHostHeaderOriginFallback?: boolean;\n  strictSecurityEnabled?: boolean;\n  rateLimitConfigured?: boolean;\n}): SecurityAuditFinding[] {\n  const findings: SecurityAuditFinding[] = [];\n  const loopback = isLoopbackHost(params.bindHost);\n\n  if (params.auth.mode === 'none') {\n    if (!loopback) {\n      findings.push({\n        checkId: 'gateway.auth.none_on_network',\n        severity: 'critical',\n        title: 'Gateway has no authentication on a network-accessible address',\n        detail: `Auth mode is \"none\" but gateway binds to ${params.bindHost}. ` +\n          'Any host on the network can access the gateway without credentials.',\n        remediation: 'Set gateway.auth.mode to \"token\" and configure a strong token ' +\n          '(e.g. `openssl rand -hex 32`).',\n      });\n    } else {\n      findings.push({\n        checkId: 'gateway.auth.none_loopback',\n        severity: 'warn',\n        title: 'Gateway authentication is disabled',\n        detail: 'Auth mode is \"none\". This is acceptable for local development ' +\n          'but should not be used in production.',\n        remediation: 'Set gateway.auth.mode to \"token\" for production use.',\n      });\n    }\n  }\n\n  if (\n    !loopback &&\n    params.auth.mode === 'token' &&\n    !params.auth.token?.trim()\n  ) {\n    findings.push({\n      checkId: 'gateway.auth.missing_token_on_network',\n      severity: 'critical',\n      title: 'Network-accessible gateway has no auth token configured',\n      detail: 'gateway.auth.mode is \"token\" but no token is configured for a non-loopback bind.',\n      remediation: 'Set gateway.auth.token or XOPC_GATEWAY_TOKEN before binding to the network.',\n    });\n  }\n\n  if (\n    !loopback &&\n    params.auth.mode === 'password' &&\n    !params.auth.password?.trim()\n  ) {\n    findings.push({\n      checkId: 'gateway.auth.missing_password_on_network',\n      severity: 'critical',\n      title: 'Network-accessible gateway has no auth password configured',\n      detail: 'gateway.auth.mode is \"password\" but no password is configured for a non-loopback bind.',\n      remediation: 'Set gateway.auth.password or XOPC_GATEWAY_PASSWORD before binding to the network.',\n    });\n  }\n\n  if (params.auth.mode === 'token' && params.auth.token) {\n    const token = params.auth.token;\n\n    if (token.length < MIN_AUDIT_TOKEN_LENGTH) {\n      findings.push({\n        checkId: 'gateway.auth.short_token',\n        severity: 'warn',\n        title: 'Gateway token is short',\n        detail: `Token length is ${token.length} characters. Short tokens are vulnerable ` +\n          'to brute-force even with rate limiting.',\n        remediation: `Use a token of at least ${MIN_AUDIT_TOKEN_LENGTH} characters ` +\n          '(e.g. `openssl rand -hex 32`).',\n      });\n    }\n\n    if (/^(.)\\1+$/.test(token)) {\n      findings.push({\n        checkId: 'gateway.auth.low_entropy_token',\n        severity: 'critical',\n        title: 'Gateway token has extremely low entropy',\n        detail: 'Token consists of a single repeated character, making it trivially guessable.',\n        remediation: 'Generate a cryptographically random token: `openssl rand -hex 32`.',\n      });\n    }\n\n    const envToken = process.env.XOPC_GATEWAY_TOKEN;\n    if (!envToken) {\n      findings.push({\n        checkId: 'gateway.auth.auto_generated_token',\n        severity: 'info',\n        title: 'Gateway token was auto-generated',\n        detail: 'No explicit XOPC_GATEWAY_TOKEN set. The token was auto-generated and will ' +\n          'change on each restart.',\n        remediation: 'Set XOPC_GATEWAY_TOKEN environment variable for a stable token.',\n      });\n    }\n  }\n\n  if (params.corsOrigins?.includes('*')) {\n    findings.push({\n      checkId: 'gateway.cors.wildcard',\n      severity: !loopback ? 'critical' : 'warn',\n      title: 'CORS allows all origins',\n      detail: 'corsOrigins includes \"*\". Any website can make authenticated API calls ' +\n        'to the gateway if it can obtain the token.',\n      remediation: 'Replace \"*\" with explicit allowed origins ' +\n        '(e.g. [\"http://localhost:18790\"]).',\n    });\n  }\n\n  if (params.corsOrigins && params.corsOrigins.length > 20) {\n    findings.push({\n      checkId: 'gateway.cors.excessive_origins',\n      severity: 'info',\n      title: 'Large number of CORS origins configured',\n      detail: `${params.corsOrigins.length} CORS origins configured. Review whether all are necessary.`,\n    });\n  }\n\n  if (\n    !loopback &&\n    (!params.corsOrigins || params.corsOrigins.length === 0) &&\n    params.dangerouslyAllowHostHeaderOriginFallback !== true\n  ) {\n    findings.push({\n      checkId: 'gateway.cors.no_explicit_origins',\n      severity: 'info',\n      title: 'No custom CORS origins — loopback browsers only',\n      detail:\n        'Gateway listens on a network address with empty gateway.corsOrigins. ' +\n        'localhost and 127.0.0.1 on the gateway port are allowed by default; ' +\n        'LAN or remote browser URLs must be added explicitly.',\n      remediation:\n        'Add gateway.corsOrigins entries (e.g. http://192.168.x.x:<port>) for non-loopback browser access, ' +\n        'or enable gateway.dangerouslyAllowHostHeaderOriginFallback only if you understand the CSRF risk.',\n    });\n  }\n\n  if (\n    !loopback &&\n    params.auth.mode !== 'none' &&\n    params.auth.mode !== 'trusted-proxy' &&\n    params.rateLimitEnabled === false\n  ) {\n    findings.push({\n      checkId: 'gateway.auth.no_rate_limit',\n      severity: 'warn',\n      title: 'No auth rate limiting on network-accessible gateway',\n      detail: 'Gateway is bound to a non-loopback address but auth rate limiting is disabled. ' +\n        'This allows unlimited brute-force authentication attempts.',\n      remediation: 'Set gateway.auth.rateLimit ' +\n        '(e.g. { maxAttempts: 10, windowMs: 60000, lockoutMs: 300000 }).',\n    });\n  }\n\n  if (\n    !loopback &&\n    params.strictSecurityEnabled === true &&\n    params.rateLimitConfigured !== true\n  ) {\n    findings.push({\n      checkId: 'gateway.security.strict_no_rate_limit',\n      severity: 'critical',\n      title: 'Strict security requires explicit auth rate limit configuration',\n      detail: 'gateway.security.strict is enabled on a network-accessible bind but gateway.auth.rateLimit is missing.',\n      remediation:\n        'Set gateway.auth.rateLimit (e.g. { maxAttempts: 10, windowMs: 60000, blockDurationMs: 300000 }).',\n    });\n  }\n\n  if (!loopback && !params.tlsEnabled) {\n    findings.push({\n      checkId: 'gateway.transport.no_tls',\n      severity: 'warn',\n      title: 'No TLS on network-accessible gateway',\n      detail: 'Gateway is bound to a non-loopback address without TLS termination. ' +\n        'Tokens and data are transmitted in plaintext unless a reverse proxy or tunnel handles HTTPS.',\n      remediation:\n        'Enable the tunnel feature (`tunnel.enabled`), terminate TLS at a reverse proxy (Caddy/nginx), ' +\n        'or bind to loopback and access via SSH/VPN.',\n    });\n  }\n\n  if (params.bindHost === '0.0.0.0' || params.bindHost === '::') {\n    findings.push({\n      checkId: 'gateway.bind.all_interfaces',\n      severity: 'warn',\n      title: 'Gateway binds to all network interfaces',\n      detail: 'Binding to all interfaces exposes the gateway on every network interface. ' +\n        'Prefer loopback unless remote access is required.',\n      remediation: 'Set gateway.bind to \"loopback\" unless remote access is required.',\n    });\n  }\n\n  if (params.auth.mode === 'trusted-proxy') {\n    const trustedProxies = params.trustedProxies ?? [];\n    const trustedProxyConfig = params.auth.trustedProxy;\n\n    findings.push({\n      checkId: 'gateway.trusted_proxy_auth',\n      severity: 'critical',\n      title: 'Trusted-proxy auth mode enabled',\n      detail:\n        'gateway.auth.mode=\"trusted-proxy\" delegates authentication to a reverse proxy. ' +\n        'Ensure your proxy terminates TLS and authenticates users; gateway.trustedProxies ' +\n        'must only list your proxy server IPs.',\n      remediation:\n        'Verify: (1) Proxy terminates TLS and authenticates users. ' +\n        '(2) gateway.trustedProxies is restricted to proxy IPs only. ' +\n        '(3) Direct access to the gateway port is blocked by firewall.',\n    });\n\n    if (trustedProxies.length === 0) {\n      findings.push({\n        checkId: 'gateway.trusted_proxy_no_proxies',\n        severity: 'critical',\n        title: 'Trusted-proxy auth enabled but no trusted proxies configured',\n        detail:\n          'gateway.auth.mode=\"trusted-proxy\" but gateway.trustedProxies is empty. ' +\n          'All requests will be rejected and startup guards will fail.',\n        remediation: 'Set gateway.trustedProxies to the IP(s) of your reverse proxy.',\n      });\n    }\n\n    if (!trustedProxyConfig?.userHeader) {\n      findings.push({\n        checkId: 'gateway.trusted_proxy_no_user_header',\n        severity: 'critical',\n        title: 'Trusted-proxy auth missing userHeader config',\n        detail:\n          'gateway.auth.mode=\"trusted-proxy\" but gateway.auth.trustedProxy.userHeader is not configured.',\n        remediation:\n          'Set gateway.auth.trustedProxy.userHeader to the header your proxy uses ' +\n          '(e.g. \"x-forwarded-user\", \"x-pomerium-claim-email\").',\n      });\n    }\n\n    if (trustedProxyConfig?.allowLoopback === true) {\n      findings.push({\n        checkId: 'gateway.trusted_proxy_allow_loopback',\n        severity: 'warn',\n        title: 'Trusted-proxy auth allows loopback proxy sources',\n        detail:\n          'gateway.auth.trustedProxy.allowLoopback=true allows loopback-source requests ' +\n          'from configured gateway.trustedProxies entries to satisfy trusted-proxy auth.',\n        remediation:\n          'Enable only when a same-host reverse proxy is the intended trust boundary.',\n      });\n    }\n\n    const allowUsers = trustedProxyConfig?.allowUsers ?? [];\n    if (allowUsers.length === 0) {\n      findings.push({\n        checkId: 'gateway.trusted_proxy_no_allowlist',\n        severity: 'warn',\n        title: 'Trusted-proxy auth allows all authenticated users',\n        detail:\n          'gateway.auth.trustedProxy.allowUsers is empty, so any user authenticated by your proxy can access the gateway.',\n        remediation:\n          'Consider setting gateway.auth.trustedProxy.allowUsers to restrict access to specific users.',\n      });\n    }\n\n    if (params.allowRealIpFallback === true) {\n      findings.push({\n        checkId: 'gateway.trusted_proxy_real_ip_fallback',\n        severity: 'warn',\n        title: 'X-Real-IP fallback is enabled for trusted-proxy client IP resolution',\n        detail:\n          'gateway.allowRealIpFallback=true uses X-Real-IP when X-Forwarded-For chain parsing fails.',\n        remediation:\n          'Keep gateway.allowRealIpFallback=false unless your trusted proxy only sets X-Real-IP.',\n      });\n    }\n  }\n\n  return findings;\n}\n\nexport function collectExposureAuditFindings(cfg: Config): SecurityAuditFinding[] {\n  const findings: SecurityAuditFinding[] = [];\n  const tailscaleMode = cfg.gateway?.tailscale?.mode ?? 'off';\n  const bindMode = cfg.gateway?.bind ?? 'loopback';\n\n  for (const conflict of collectExposureConflicts(cfg)) {\n    findings.push({\n      checkId: `gateway.exposure.${conflict.code}`,\n      severity: 'critical',\n      title: 'Remote exposure configuration conflict',\n      detail: conflict.message,\n      remediation: 'Adjust gateway.tailscale and tunnel settings so only one auto-exposure path is active.',\n    });\n  }\n\n  if (tailscaleMode === 'funnel' && cfg.gateway?.auth?.mode !== 'password') {\n    findings.push({\n      checkId: 'gateway.tailscale.funnel_without_password',\n      severity: 'critical',\n      title: 'Tailscale Funnel requires password auth',\n      detail: 'gateway.tailscale.mode=funnel exposes the gateway on the public internet and requires gateway.auth.mode=password.',\n      remediation: 'Set gateway.auth.mode to password and configure gateway.auth.password.',\n    });\n  }\n\n  if (tailscaleMode !== 'off' && bindMode !== 'loopback') {\n    findings.push({\n      checkId: 'gateway.tailscale.serve_with_non_loopback_bind',\n      severity: 'critical',\n      title: 'Tailscale exposure requires loopback bind',\n      detail: `Tailscale ${tailscaleMode} is enabled but gateway.bind=${bindMode}.`,\n      remediation: 'Set gateway.bind to loopback when using Tailscale Serve or Funnel.',\n    });\n  }\n\n  if (isTailnetBindUnavailable(cfg)) {\n    findings.push({\n      checkId: 'gateway.bind.tailnet_ip_unavailable',\n      severity: 'warn',\n      title: 'Tailnet bind requested but Tailscale IP unavailable',\n      detail: 'gateway.bind=tailnet but no Tailscale IPv4 (100.x) was detected; gateway falls back to loopback.',\n      remediation: 'Install and connect Tailscale, or use gateway.tailscale.mode=serve instead.',\n    });\n  }\n\n  if (isRemoteGatewayInsecure(cfg)) {\n    findings.push({\n      checkId: 'gateway.remote.insecure_url',\n      severity: 'warn',\n      title: 'Remote gateway URL uses plaintext HTTP',\n      detail: 'gateway.mode=remote points to a non-loopback http:// URL without TLS.',\n      remediation: 'Use https://, SSH tunnel to loopback, or Tailscale Serve.',\n    });\n  }\n\n  if (tailscaleMode === 'funnel') {\n    findings.push({\n      checkId: 'gateway.tailscale.funnel_public',\n      severity: 'critical',\n      title: 'Tailscale Funnel exposes gateway to the public internet',\n      detail: 'Funnel publishes HTTPS endpoints reachable from the public internet.',\n      remediation: 'Prefer Tailscale Serve for tailnet-only access, or use FRP with consent for controlled public exposure.',\n    });\n  }\n\n  return findings;\n}\n\n/** Findings from fail-closed startup guards (`assertGatewayRuntimeConfig`). */\nexport function collectGatewayStartupGuardFindings(\n  cfg: Config,\n  env: NodeJS.ProcessEnv = process.env,\n): SecurityAuditFinding[] {\n  try {\n    const auth = resolveGatewayAuth({ authConfig: cfg.gateway?.auth, env });\n    assertGatewayAuthConfigured(auth);\n    assertGatewayRuntimeConfig({\n      cfg,\n      auth,\n      port: cfg.gateway?.port ?? 18790,\n    });\n    return [];\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err);\n    return [{\n      checkId: 'gateway.runtime_config.blocked',\n      severity: 'critical',\n      title: 'Gateway startup guards would reject this configuration',\n      detail: message,\n      remediation: 'Fix the configuration issue above, then run `xopc gateway` again.',\n    }];\n  }\n}\n\nfunction mergeFindings(findings: SecurityAuditFinding[]): SecurityAuditFinding[] {\n  const byId = new Map<string, SecurityAuditFinding>();\n  const severityRank = { critical: 3, warn: 2, info: 1 } as const;\n\n  for (const finding of findings) {\n    const existing = byId.get(finding.checkId);\n    if (!existing || severityRank[finding.severity] > severityRank[existing.severity]) {\n      byId.set(finding.checkId, finding);\n    }\n  }\n  return [...byId.values()];\n}\n\n/**\n * Full gateway security findings for doctor / CLI audit (config + startup guards).\n */\nexport function collectGatewaySecurityFindings(\n  cfg: Config,\n  env: NodeJS.ProcessEnv = process.env,\n): SecurityAuditFinding[] {\n  const inputs = resolveAuditInputs(cfg, env);\n  const configFindings = collectGatewayConfigFindings({\n    auth: inputs.auth,\n    bindHost: inputs.bindHost,\n    corsOrigins: inputs.corsOrigins,\n    rateLimitEnabled: inputs.rateLimitEnabled,\n    tlsEnabled: inputs.tlsEnabled,\n    trustedProxies: inputs.trustedProxies,\n    allowRealIpFallback: inputs.allowRealIpFallback,\n    dangerouslyAllowHostHeaderOriginFallback: inputs.dangerouslyAllowHostHeaderOriginFallback,\n    strictSecurityEnabled: isGatewayStrictSecurityEnabled(cfg),\n    rateLimitConfigured: cfg.gateway?.auth?.rateLimit !== undefined,\n  });\n  const startupFindings = collectGatewayStartupGuardFindings(cfg, env);\n  const exposureFindings = collectExposureAuditFindings(cfg);\n  return mergeFindings([...configFindings, ...startupFindings, ...exposureFindings]);\n}\n\nfunction emitFindings(findings: SecurityAuditFinding[]): void {\n  for (const finding of findings) {\n    const logData = {\n      checkId: finding.checkId,\n      detail: finding.detail,\n      ...(finding.remediation ? { remediation: finding.remediation } : {}),\n    };\n    switch (finding.severity) {\n      case 'critical':\n        log.error(logData, `Security audit: ${finding.title}`);\n        break;\n      case 'warn':\n        log.warn(logData, `Security audit: ${finding.title}`);\n        break;\n      case 'info':\n        log.info(logData, `Security audit: ${finding.title}`);\n        break;\n    }\n  }\n}\n\n/**\n * Audit the gateway configuration at startup and log security findings.\n */\nexport function auditGatewayConfig(params: {\n  auth: ResolvedGatewayAuth;\n  bindHost?: string;\n  corsOrigins?: string[];\n  rateLimitEnabled?: boolean;\n  tlsEnabled?: boolean;\n  trustedProxies?: string[];\n  allowRealIpFallback?: boolean;\n  dangerouslyAllowHostHeaderOriginFallback?: boolean;\n  strictSecurityEnabled?: boolean;\n  rateLimitConfigured?: boolean;\n}): SecurityAuditFinding[] {\n  const findings = collectGatewayConfigFindings(params);\n  emitFindings(findings);\n  return findings;\n}\n"],"mappings":";;;;;;;;aAWqD;AAErD,MAAM,MAAM,aAAa,gBAAgB;;AAYzC,MAAM,yBAAyB;AAE/B,SAAS,eAAe,MAAmC;AACzD,QAAO,CAAC,QACN,SAAS,eACT,SAAS,eACT,SAAS;;AAGb,SAAS,qBAAqB,KAAuB;AACnD,SAAQ,IAAI,SAAS,eAAe,EAAE,EACnC,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,OAAO,QAAQ;;AAGpB,SAAS,mBAAmB,KAAa,MAAyB,QAAQ,KAUxE;CACA,MAAM,OAAO,mBAAmB;EAAE,YAAY,IAAI,SAAS;EAAM;EAAK,CAAC;CACvE,MAAM,OAAO,yBAAyB,EAAE,KAAK,CAAC;CAC9C,MAAM,cAAc,qBAAqB,IAAI;CAC7C,MAAM,mBACJ,IAAI,SAAS,MAAM,WAAW,YAAY,SAC1C,CAAC,iCAAiC;CACpC,MAAM,aACJ,IAAI,QAAQ,YAAY,SACvB,IAAI,SAAS,WAAW,QAAQ,WAAW,SAC5C,IAAI,SAAS,KAAK,YAAY;CAChC,MAAM,WAAW,eAAe,KAAK,SAAS;AAE9C,QAAO;EACL;EACA,UAAU,KAAK;EACf;EACA;EACA;EACA,gBAAgB,IAAI,SAAS;EAC7B,qBAAqB,IAAI,SAAS,wBAAwB;EAC1D,0CACE,IAAI,SAAS,6CAA6C;EAC5D;EACD;;;;;AAMH,SAAgB,6BAA6B,QAWlB;CACzB,MAAM,WAAmC,EAAE;CAC3C,MAAM,WAAW,eAAe,OAAO,SAAS;AAEhD,KAAI,OAAO,KAAK,SAAS,OACvB,KAAI,CAAC,SACH,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ,4CAA4C,OAAO,SAAS;EAEpE,aAAa;EAEd,CAAC;KAEF,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EAER,aAAa;EACd,CAAC;AAIN,KACE,CAAC,YACD,OAAO,KAAK,SAAS,WACrB,CAAC,OAAO,KAAK,OAAO,MAAM,CAE1B,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EACR,aAAa;EACd,CAAC;AAGJ,KACE,CAAC,YACD,OAAO,KAAK,SAAS,cACrB,CAAC,OAAO,KAAK,UAAU,MAAM,CAE7B,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EACR,aAAa;EACd,CAAC;AAGJ,KAAI,OAAO,KAAK,SAAS,WAAW,OAAO,KAAK,OAAO;EACrD,MAAM,QAAQ,OAAO,KAAK;AAE1B,MAAI,MAAM,SAAS,uBACjB,UAAS,KAAK;GACZ,SAAS;GACT,UAAU;GACV,OAAO;GACP,QAAQ,mBAAmB,MAAM,OAAO;GAExC,aAAa,2BAA2B,uBAAuB;GAEhE,CAAC;AAGJ,MAAI,WAAW,KAAK,MAAM,CACxB,UAAS,KAAK;GACZ,SAAS;GACT,UAAU;GACV,OAAO;GACP,QAAQ;GACR,aAAa;GACd,CAAC;AAIJ,MAAI,CADa,QAAQ,IAAI,mBAE3B,UAAS,KAAK;GACZ,SAAS;GACT,UAAU;GACV,OAAO;GACP,QAAQ;GAER,aAAa;GACd,CAAC;;AAIN,KAAI,OAAO,aAAa,SAAS,IAAI,CACnC,UAAS,KAAK;EACZ,SAAS;EACT,UAAU,CAAC,WAAW,aAAa;EACnC,OAAO;EACP,QAAQ;EAER,aAAa;EAEd,CAAC;AAGJ,KAAI,OAAO,eAAe,OAAO,YAAY,SAAS,GACpD,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ,GAAG,OAAO,YAAY,OAAO;EACtC,CAAC;AAGJ,KACE,CAAC,aACA,CAAC,OAAO,eAAe,OAAO,YAAY,WAAW,MACtD,OAAO,6CAA6C,KAEpD,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QACE;EAGF,aACE;EAEH,CAAC;AAGJ,KACE,CAAC,YACD,OAAO,KAAK,SAAS,UACrB,OAAO,KAAK,SAAS,mBACrB,OAAO,qBAAqB,MAE5B,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EAER,aAAa;EAEd,CAAC;AAGJ,KACE,CAAC,YACD,OAAO,0BAA0B,QACjC,OAAO,wBAAwB,KAE/B,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EACR,aACE;EACH,CAAC;AAGJ,KAAI,CAAC,YAAY,CAAC,OAAO,WACvB,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EAER,aACE;EAEH,CAAC;AAGJ,KAAI,OAAO,aAAa,aAAa,OAAO,aAAa,KACvD,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EAER,aAAa;EACd,CAAC;AAGJ,KAAI,OAAO,KAAK,SAAS,iBAAiB;EACxC,MAAM,iBAAiB,OAAO,kBAAkB,EAAE;EAClD,MAAM,qBAAqB,OAAO,KAAK;AAEvC,WAAS,KAAK;GACZ,SAAS;GACT,UAAU;GACV,OAAO;GACP,QACE;GAGF,aACE;GAGH,CAAC;AAEF,MAAI,eAAe,WAAW,EAC5B,UAAS,KAAK;GACZ,SAAS;GACT,UAAU;GACV,OAAO;GACP,QACE;GAEF,aAAa;GACd,CAAC;AAGJ,MAAI,CAAC,oBAAoB,WACvB,UAAS,KAAK;GACZ,SAAS;GACT,UAAU;GACV,OAAO;GACP,QACE;GACF,aACE;GAEH,CAAC;AAGJ,MAAI,oBAAoB,kBAAkB,KACxC,UAAS,KAAK;GACZ,SAAS;GACT,UAAU;GACV,OAAO;GACP,QACE;GAEF,aACE;GACH,CAAC;AAIJ,OADmB,oBAAoB,cAAc,EAAE,EACxC,WAAW,EACxB,UAAS,KAAK;GACZ,SAAS;GACT,UAAU;GACV,OAAO;GACP,QACE;GACF,aACE;GACH,CAAC;AAGJ,MAAI,OAAO,wBAAwB,KACjC,UAAS,KAAK;GACZ,SAAS;GACT,UAAU;GACV,OAAO;GACP,QACE;GACF,aACE;GACH,CAAC;;AAIN,QAAO;;AAGT,SAAgB,6BAA6B,KAAqC;CAChF,MAAM,WAAmC,EAAE;CAC3C,MAAM,gBAAgB,IAAI,SAAS,WAAW,QAAQ;CACtD,MAAM,WAAW,IAAI,SAAS,QAAQ;AAEtC,MAAK,MAAM,YAAY,yBAAyB,IAAI,CAClD,UAAS,KAAK;EACZ,SAAS,oBAAoB,SAAS;EACtC,UAAU;EACV,OAAO;EACP,QAAQ,SAAS;EACjB,aAAa;EACd,CAAC;AAGJ,KAAI,kBAAkB,YAAY,IAAI,SAAS,MAAM,SAAS,WAC5D,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EACR,aAAa;EACd,CAAC;AAGJ,KAAI,kBAAkB,SAAS,aAAa,WAC1C,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ,aAAa,cAAc,+BAA+B,SAAS;EAC3E,aAAa;EACd,CAAC;AAGJ,KAAI,yBAAyB,IAAI,CAC/B,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EACR,aAAa;EACd,CAAC;AAGJ,KAAI,wBAAwB,IAAI,CAC9B,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EACR,aAAa;EACd,CAAC;AAGJ,KAAI,kBAAkB,SACpB,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EACR,aAAa;EACd,CAAC;AAGJ,QAAO;;;AAIT,SAAgB,mCACd,KACA,MAAyB,QAAQ,KACT;AACxB,KAAI;EACF,MAAM,OAAO,mBAAmB;GAAE,YAAY,IAAI,SAAS;GAAM;GAAK,CAAC;AACvE,8BAA4B,KAAK;AACjC,6BAA2B;GACzB;GACA;GACA,MAAM,IAAI,SAAS,QAAQ;GAC5B,CAAC;AACF,SAAO,EAAE;UACF,KAAK;AAEZ,SAAO,CAAC;GACN,SAAS;GACT,UAAU;GACV,OAAO;GACP,QALc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;GAM9D,aAAa;GACd,CAAC;;;AAIN,SAAS,cAAc,UAA0D;CAC/E,MAAM,uBAAO,IAAI,KAAmC;CACpD,MAAM,eAAe;EAAE,UAAU;EAAG,MAAM;EAAG,MAAM;EAAG;AAEtD,MAAK,MAAM,WAAW,UAAU;EAC9B,MAAM,WAAW,KAAK,IAAI,QAAQ,QAAQ;AAC1C,MAAI,CAAC,YAAY,aAAa,QAAQ,YAAY,aAAa,SAAS,UACtE,MAAK,IAAI,QAAQ,SAAS,QAAQ;;AAGtC,QAAO,CAAC,GAAG,KAAK,QAAQ,CAAC;;;;;AAM3B,SAAgB,+BACd,KACA,MAAyB,QAAQ,KACT;CACxB,MAAM,SAAS,mBAAmB,KAAK,IAAI;CAC3C,MAAM,iBAAiB,6BAA6B;EAClD,MAAM,OAAO;EACb,UAAU,OAAO;EACjB,aAAa,OAAO;EACpB,kBAAkB,OAAO;EACzB,YAAY,OAAO;EACnB,gBAAgB,OAAO;EACvB,qBAAqB,OAAO;EAC5B,0CAA0C,OAAO;EACjD,uBAAuB,+BAA+B,IAAI;EAC1D,qBAAqB,IAAI,SAAS,MAAM,cAAc,KAAA;EACvD,CAAC;CACF,MAAM,kBAAkB,mCAAmC,KAAK,IAAI;CACpE,MAAM,mBAAmB,6BAA6B,IAAI;AAC1D,QAAO,cAAc;EAAC,GAAG;EAAgB,GAAG;EAAiB,GAAG;EAAiB,CAAC;;AAGpF,SAAS,aAAa,UAAwC;AAC5D,MAAK,MAAM,WAAW,UAAU;EAC9B,MAAM,UAAU;GACd,SAAS,QAAQ;GACjB,QAAQ,QAAQ;GAChB,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,aAAa,GAAG,EAAE;GACpE;AACD,UAAQ,QAAQ,UAAhB;GACE,KAAK;AACH,QAAI,MAAM,SAAS,mBAAmB,QAAQ,QAAQ;AACtD;GACF,KAAK;AACH,QAAI,KAAK,SAAS,mBAAmB,QAAQ,QAAQ;AACrD;GACF,KAAK;AACH,QAAI,KAAK,SAAS,mBAAmB,QAAQ,QAAQ;AACrD;;;;;;;AAQR,SAAgB,mBAAmB,QAWR;CACzB,MAAM,WAAW,6BAA6B,OAAO;AACrD,cAAa,SAAS;AACtB,QAAO"}
+{"version":3,"file":"audit.js","names":[],"sources":["../../../../src/gateway/security/audit.ts"],"sourcesContent":["import type { Config } from '../../config/schema.js';\nimport type { ResolvedGatewayAuth } from '../auth.js';\nimport { resolveGatewayAuth, assertGatewayAuthConfigured } from '../auth.js';\nimport { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from '../rate-limit/index.js';\nimport { assertGatewayRuntimeConfig } from '../runtime-config.js';\nimport { resolveGatewayListenPlan } from '../listen.js';\nimport {\n  collectExposureConflicts,\n  isRemoteGatewayInsecure,\n  isTailnetBindUnavailable,\n} from '../../remote-access/exposure-guards.js';\nimport { createLogger } from '../../utils/logger.js';\n\nconst log = createLogger('SecurityAudit');\n\nexport type SecurityAuditFinding = {\n  checkId: string;\n  severity: 'critical' | 'warn' | 'info';\n  title: string;\n  detail: string;\n  /** Actionable remediation suggestion (aligned with OpenClaw audit format). */\n  remediation?: string;\n};\n\n/** Minimum token length to resist brute-force even with rate limiting. */\nconst MIN_AUDIT_TOKEN_LENGTH = 22;\n\nfunction isLoopbackHost(host: string | undefined): boolean {\n  return !host ||\n    host === '127.0.0.1' ||\n    host === 'localhost' ||\n    host === '::1';\n}\n\nfunction normalizeCorsOrigins(cfg: Config): string[] {\n  return (cfg.gateway?.corsOrigins ?? [])\n    .map((value) => value.trim())\n    .filter(Boolean);\n}\n\nfunction resolveAuditInputs(cfg: Config, env: NodeJS.ProcessEnv = process.env): {\n  auth: ResolvedGatewayAuth;\n  bindHost: string;\n  corsOrigins: string[];\n  rateLimitEnabled: boolean;\n  tlsEnabled: boolean;\n  trustedProxies?: string[];\n  allowRealIpFallback: boolean;\n  dangerouslyAllowHostHeaderOriginFallback: boolean;\n  loopback: boolean;\n} {\n  const auth = resolveGatewayAuth({ authConfig: cfg.gateway?.auth, env });\n  const plan = resolveGatewayListenPlan({ cfg });\n  const corsOrigins = normalizeCorsOrigins(cfg);\n  const rateLimitEnabled =\n    cfg.gateway?.auth?.rateLimit?.enabled !== false &&\n    !isAuthRateLimitGloballyDisabled();\n  const tlsEnabled =\n    cfg.tunnel?.enabled === true ||\n    (cfg.gateway?.tailscale?.mode ?? 'off') !== 'off' ||\n    cfg.gateway?.tls?.enabled === true;\n  const loopback = isLoopbackHost(plan.bindHost);\n\n  return {\n    auth,\n    bindHost: plan.bindHost,\n    corsOrigins,\n    rateLimitEnabled,\n    tlsEnabled,\n    trustedProxies: cfg.gateway?.trustedProxies,\n    allowRealIpFallback: cfg.gateway?.allowRealIpFallback === true,\n    dangerouslyAllowHostHeaderOriginFallback:\n      cfg.gateway?.dangerouslyAllowHostHeaderOriginFallback === true,\n    loopback,\n  };\n}\n\n/**\n * Pure gateway config audit (no logging). Shared by startup audit and `xopc doctor`.\n */\nexport function collectGatewayConfigFindings(params: {\n  auth: ResolvedGatewayAuth;\n  bindHost?: string;\n  corsOrigins?: string[];\n  rateLimitEnabled?: boolean;\n  tlsEnabled?: boolean;\n  trustedProxies?: string[];\n  allowRealIpFallback?: boolean;\n  dangerouslyAllowHostHeaderOriginFallback?: boolean;\n  strictSecurityEnabled?: boolean;\n  rateLimitConfigured?: boolean;\n}): SecurityAuditFinding[] {\n  const findings: SecurityAuditFinding[] = [];\n  const loopback = isLoopbackHost(params.bindHost);\n\n  if (params.auth.mode === 'none') {\n    if (!loopback) {\n      findings.push({\n        checkId: 'gateway.auth.none_on_network',\n        severity: 'critical',\n        title: 'Gateway has no authentication on a network-accessible address',\n        detail: `Auth mode is \"none\" but gateway binds to ${params.bindHost}. ` +\n          'Any host on the network can access the gateway without credentials.',\n        remediation: 'Set gateway.auth.mode to \"token\" and configure a strong token ' +\n          '(e.g. `openssl rand -hex 32`).',\n      });\n    } else {\n      findings.push({\n        checkId: 'gateway.auth.none_loopback',\n        severity: 'warn',\n        title: 'Gateway authentication is disabled',\n        detail: 'Auth mode is \"none\". This is acceptable for local development ' +\n          'but should not be used in production.',\n        remediation: 'Set gateway.auth.mode to \"token\" for production use.',\n      });\n    }\n  }\n\n  if (\n    !loopback &&\n    params.auth.mode === 'token' &&\n    !params.auth.token?.trim()\n  ) {\n    findings.push({\n      checkId: 'gateway.auth.missing_token_on_network',\n      severity: 'critical',\n      title: 'Network-accessible gateway has no auth token configured',\n      detail: 'gateway.auth.mode is \"token\" but no token is configured for a non-loopback bind.',\n      remediation: 'Set gateway.auth.token or XOPC_GATEWAY_TOKEN before binding to the network.',\n    });\n  }\n\n  if (\n    !loopback &&\n    params.auth.mode === 'password' &&\n    !params.auth.password?.trim()\n  ) {\n    findings.push({\n      checkId: 'gateway.auth.missing_password_on_network',\n      severity: 'critical',\n      title: 'Network-accessible gateway has no auth password configured',\n      detail: 'gateway.auth.mode is \"password\" but no password is configured for a non-loopback bind.',\n      remediation: 'Set gateway.auth.password or XOPC_GATEWAY_PASSWORD before binding to the network.',\n    });\n  }\n\n  if (params.auth.mode === 'token' && params.auth.token) {\n    const token = params.auth.token;\n\n    if (token.length < MIN_AUDIT_TOKEN_LENGTH) {\n      findings.push({\n        checkId: 'gateway.auth.short_token',\n        severity: 'warn',\n        title: 'Gateway token is short',\n        detail: `Token length is ${token.length} characters. Short tokens are vulnerable ` +\n          'to brute-force even with rate limiting.',\n        remediation: `Use a token of at least ${MIN_AUDIT_TOKEN_LENGTH} characters ` +\n          '(e.g. `openssl rand -hex 32`).',\n      });\n    }\n\n    if (/^(.)\\1+$/.test(token)) {\n      findings.push({\n        checkId: 'gateway.auth.low_entropy_token',\n        severity: 'critical',\n        title: 'Gateway token has extremely low entropy',\n        detail: 'Token consists of a single repeated character, making it trivially guessable.',\n        remediation: 'Generate a cryptographically random token: `openssl rand -hex 32`.',\n      });\n    }\n\n    const envToken = process.env.XOPC_GATEWAY_TOKEN;\n    if (!envToken) {\n      findings.push({\n        checkId: 'gateway.auth.auto_generated_token',\n        severity: 'info',\n        title: 'Gateway token was auto-generated',\n        detail: 'No explicit XOPC_GATEWAY_TOKEN set. The token was auto-generated and will ' +\n          'change on each restart.',\n        remediation: 'Set XOPC_GATEWAY_TOKEN environment variable for a stable token.',\n      });\n    }\n  }\n\n  if (params.corsOrigins?.includes('*')) {\n    findings.push({\n      checkId: 'gateway.cors.wildcard',\n      severity: !loopback ? 'critical' : 'warn',\n      title: 'CORS allows all origins',\n      detail: 'corsOrigins includes \"*\". Any website can make authenticated API calls ' +\n        'to the gateway if it can obtain the token.',\n      remediation: 'Replace \"*\" with explicit allowed origins ' +\n        '(e.g. [\"http://localhost:18790\"]).',\n    });\n  }\n\n  if (params.corsOrigins && params.corsOrigins.length > 20) {\n    findings.push({\n      checkId: 'gateway.cors.excessive_origins',\n      severity: 'info',\n      title: 'Large number of CORS origins configured',\n      detail: `${params.corsOrigins.length} CORS origins configured. Review whether all are necessary.`,\n    });\n  }\n\n  if (\n    !loopback &&\n    (!params.corsOrigins || params.corsOrigins.length === 0) &&\n    params.dangerouslyAllowHostHeaderOriginFallback !== true\n  ) {\n    findings.push({\n      checkId: 'gateway.cors.no_explicit_origins',\n      severity: 'info',\n      title: 'No custom CORS origins — loopback browsers only',\n      detail:\n        'Gateway listens on a network address with empty gateway.corsOrigins. ' +\n        'localhost and 127.0.0.1 on the gateway port are allowed by default; ' +\n        'LAN or remote browser URLs must be added explicitly.',\n      remediation:\n        'Add gateway.corsOrigins entries (e.g. http://192.168.x.x:<port>) for non-loopback browser access, ' +\n        'or enable gateway.dangerouslyAllowHostHeaderOriginFallback only if you understand the CSRF risk.',\n    });\n  }\n\n  if (\n    !loopback &&\n    params.auth.mode !== 'none' &&\n    params.auth.mode !== 'trusted-proxy' &&\n    params.rateLimitEnabled === false\n  ) {\n    findings.push({\n      checkId: 'gateway.auth.no_rate_limit',\n      severity: 'warn',\n      title: 'No auth rate limiting on network-accessible gateway',\n      detail: 'Gateway is bound to a non-loopback address but auth rate limiting is disabled. ' +\n        'This allows unlimited brute-force authentication attempts.',\n      remediation: 'Set gateway.auth.rateLimit ' +\n        '(e.g. { maxAttempts: 10, windowMs: 60000, lockoutMs: 300000 }).',\n    });\n  }\n\n  if (\n    !loopback &&\n    params.strictSecurityEnabled === true &&\n    params.rateLimitConfigured !== true\n  ) {\n    findings.push({\n      checkId: 'gateway.security.strict_no_rate_limit',\n      severity: 'critical',\n      title: 'Strict security requires explicit auth rate limit configuration',\n      detail: 'gateway.security.strict is enabled on a network-accessible bind but gateway.auth.rateLimit is missing.',\n      remediation:\n        'Set gateway.auth.rateLimit (e.g. { maxAttempts: 10, windowMs: 60000, blockDurationMs: 300000 }).',\n    });\n  }\n\n  if (!loopback && !params.tlsEnabled) {\n    findings.push({\n      checkId: 'gateway.transport.no_tls',\n      severity: 'warn',\n      title: 'No TLS on network-accessible gateway',\n      detail: 'Gateway is bound to a non-loopback address without TLS termination. ' +\n        'Tokens and data are transmitted in plaintext unless a reverse proxy or tunnel handles HTTPS.',\n      remediation:\n        'Enable the tunnel feature (`tunnel.enabled`), terminate TLS at a reverse proxy (Caddy/nginx), ' +\n        'or bind to loopback and access via SSH/VPN.',\n    });\n  }\n\n  if (params.bindHost === '0.0.0.0' || params.bindHost === '::') {\n    findings.push({\n      checkId: 'gateway.bind.all_interfaces',\n      severity: 'warn',\n      title: 'Gateway binds to all network interfaces',\n      detail: 'Binding to all interfaces exposes the gateway on every network interface. ' +\n        'Prefer loopback unless remote access is required.',\n      remediation: 'Set gateway.bind to \"loopback\" unless remote access is required.',\n    });\n  }\n\n  if (params.auth.mode === 'trusted-proxy') {\n    const trustedProxies = params.trustedProxies ?? [];\n    const trustedProxyConfig = params.auth.trustedProxy;\n\n    findings.push({\n      checkId: 'gateway.trusted_proxy_auth',\n      severity: 'critical',\n      title: 'Trusted-proxy auth mode enabled',\n      detail:\n        'gateway.auth.mode=\"trusted-proxy\" delegates authentication to a reverse proxy. ' +\n        'Ensure your proxy terminates TLS and authenticates users; gateway.trustedProxies ' +\n        'must only list your proxy server IPs.',\n      remediation:\n        'Verify: (1) Proxy terminates TLS and authenticates users. ' +\n        '(2) gateway.trustedProxies is restricted to proxy IPs only. ' +\n        '(3) Direct access to the gateway port is blocked by firewall.',\n    });\n\n    if (trustedProxies.length === 0) {\n      findings.push({\n        checkId: 'gateway.trusted_proxy_no_proxies',\n        severity: 'critical',\n        title: 'Trusted-proxy auth enabled but no trusted proxies configured',\n        detail:\n          'gateway.auth.mode=\"trusted-proxy\" but gateway.trustedProxies is empty. ' +\n          'All requests will be rejected and startup guards will fail.',\n        remediation: 'Set gateway.trustedProxies to the IP(s) of your reverse proxy.',\n      });\n    }\n\n    if (!trustedProxyConfig?.userHeader) {\n      findings.push({\n        checkId: 'gateway.trusted_proxy_no_user_header',\n        severity: 'critical',\n        title: 'Trusted-proxy auth missing userHeader config',\n        detail:\n          'gateway.auth.mode=\"trusted-proxy\" but gateway.auth.trustedProxy.userHeader is not configured.',\n        remediation:\n          'Set gateway.auth.trustedProxy.userHeader to the header your proxy uses ' +\n          '(e.g. \"x-forwarded-user\", \"x-pomerium-claim-email\").',\n      });\n    }\n\n    if (trustedProxyConfig?.allowLoopback === true) {\n      findings.push({\n        checkId: 'gateway.trusted_proxy_allow_loopback',\n        severity: 'warn',\n        title: 'Trusted-proxy auth allows loopback proxy sources',\n        detail:\n          'gateway.auth.trustedProxy.allowLoopback=true allows loopback-source requests ' +\n          'from configured gateway.trustedProxies entries to satisfy trusted-proxy auth.',\n        remediation:\n          'Enable only when a same-host reverse proxy is the intended trust boundary.',\n      });\n    }\n\n    const allowUsers = trustedProxyConfig?.allowUsers ?? [];\n    if (allowUsers.length === 0) {\n      findings.push({\n        checkId: 'gateway.trusted_proxy_no_allowlist',\n        severity: 'warn',\n        title: 'Trusted-proxy auth allows all authenticated users',\n        detail:\n          'gateway.auth.trustedProxy.allowUsers is empty, so any user authenticated by your proxy can access the gateway.',\n        remediation:\n          'Consider setting gateway.auth.trustedProxy.allowUsers to restrict access to specific users.',\n      });\n    }\n\n    if (params.allowRealIpFallback === true) {\n      findings.push({\n        checkId: 'gateway.trusted_proxy_real_ip_fallback',\n        severity: 'warn',\n        title: 'X-Real-IP fallback is enabled for trusted-proxy client IP resolution',\n        detail:\n          'gateway.allowRealIpFallback=true uses X-Real-IP when X-Forwarded-For chain parsing fails.',\n        remediation:\n          'Keep gateway.allowRealIpFallback=false unless your trusted proxy only sets X-Real-IP.',\n      });\n    }\n  }\n\n  return findings;\n}\n\nexport function collectExposureAuditFindings(cfg: Config): SecurityAuditFinding[] {\n  const findings: SecurityAuditFinding[] = [];\n  const tailscaleMode = cfg.gateway?.tailscale?.mode ?? 'off';\n  const bindMode = cfg.gateway?.bind ?? 'loopback';\n\n  for (const conflict of collectExposureConflicts(cfg)) {\n    findings.push({\n      checkId: `gateway.exposure.${conflict.code}`,\n      severity: 'critical',\n      title: 'Remote exposure configuration conflict',\n      detail: conflict.message,\n      remediation: 'Adjust gateway.tailscale and tunnel settings so only one auto-exposure path is active.',\n    });\n  }\n\n  if (tailscaleMode === 'funnel' && cfg.gateway?.auth?.mode !== 'password') {\n    findings.push({\n      checkId: 'gateway.tailscale.funnel_without_password',\n      severity: 'critical',\n      title: 'Tailscale Funnel requires password auth',\n      detail: 'gateway.tailscale.mode=funnel exposes the gateway on the public internet and requires gateway.auth.mode=password.',\n      remediation: 'Set gateway.auth.mode to password and configure gateway.auth.password.',\n    });\n  }\n\n  if (tailscaleMode !== 'off' && bindMode !== 'loopback') {\n    findings.push({\n      checkId: 'gateway.tailscale.serve_with_non_loopback_bind',\n      severity: 'critical',\n      title: 'Tailscale exposure requires loopback bind',\n      detail: `Tailscale ${tailscaleMode} is enabled but gateway.bind=${bindMode}.`,\n      remediation: 'Set gateway.bind to loopback when using Tailscale Serve or Funnel.',\n    });\n  }\n\n  if (isTailnetBindUnavailable(cfg)) {\n    findings.push({\n      checkId: 'gateway.bind.tailnet_ip_unavailable',\n      severity: 'warn',\n      title: 'Tailnet bind requested but Tailscale IP unavailable',\n      detail: 'gateway.bind=tailnet but no Tailscale IPv4 (100.x) was detected; gateway falls back to loopback.',\n      remediation: 'Install and connect Tailscale, or use gateway.tailscale.mode=serve instead.',\n    });\n  }\n\n  if (isRemoteGatewayInsecure(cfg)) {\n    findings.push({\n      checkId: 'gateway.remote.insecure_url',\n      severity: 'warn',\n      title: 'Remote gateway URL uses plaintext HTTP',\n      detail: 'gateway.mode=remote points to a non-loopback http:// URL without TLS.',\n      remediation: 'Use https://, SSH tunnel to loopback, or Tailscale Serve.',\n    });\n  }\n\n  if (tailscaleMode === 'funnel') {\n    findings.push({\n      checkId: 'gateway.tailscale.funnel_public',\n      severity: 'critical',\n      title: 'Tailscale Funnel exposes gateway to the public internet',\n      detail: 'Funnel publishes HTTPS endpoints reachable from the public internet.',\n      remediation: 'Prefer Tailscale Serve for tailnet-only access, or use FRP with consent for controlled public exposure.',\n    });\n  }\n\n  return findings;\n}\n\n/** Findings from fail-closed startup guards (`assertGatewayRuntimeConfig`). */\nexport function collectGatewayStartupGuardFindings(\n  cfg: Config,\n  env: NodeJS.ProcessEnv = process.env,\n): SecurityAuditFinding[] {\n  try {\n    const auth = resolveGatewayAuth({ authConfig: cfg.gateway?.auth, env });\n    assertGatewayAuthConfigured(auth);\n    assertGatewayRuntimeConfig({\n      cfg,\n      auth,\n      port: cfg.gateway?.port ?? 18790,\n    });\n    return [];\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err);\n    return [{\n      checkId: 'gateway.runtime_config.blocked',\n      severity: 'critical',\n      title: 'Gateway startup guards would reject this configuration',\n      detail: message,\n      remediation: 'Fix the configuration issue above, then run `xopc gateway` again.',\n    }];\n  }\n}\n\nfunction mergeFindings(findings: SecurityAuditFinding[]): SecurityAuditFinding[] {\n  const byId = new Map<string, SecurityAuditFinding>();\n  const severityRank = { critical: 3, warn: 2, info: 1 } as const;\n\n  for (const finding of findings) {\n    const existing = byId.get(finding.checkId);\n    if (!existing || severityRank[finding.severity] > severityRank[existing.severity]) {\n      byId.set(finding.checkId, finding);\n    }\n  }\n  return [...byId.values()];\n}\n\n/**\n * Full gateway security findings for doctor / CLI audit (config + startup guards).\n */\nexport function collectGatewaySecurityFindings(\n  cfg: Config,\n  env: NodeJS.ProcessEnv = process.env,\n): SecurityAuditFinding[] {\n  const inputs = resolveAuditInputs(cfg, env);\n  const configFindings = collectGatewayConfigFindings({\n    auth: inputs.auth,\n    bindHost: inputs.bindHost,\n    corsOrigins: inputs.corsOrigins,\n    rateLimitEnabled: inputs.rateLimitEnabled,\n    tlsEnabled: inputs.tlsEnabled,\n    trustedProxies: inputs.trustedProxies,\n    allowRealIpFallback: inputs.allowRealIpFallback,\n    dangerouslyAllowHostHeaderOriginFallback: inputs.dangerouslyAllowHostHeaderOriginFallback,\n    strictSecurityEnabled: isGatewayStrictSecurityEnabled(cfg),\n    rateLimitConfigured: cfg.gateway?.auth?.rateLimit !== undefined,\n  });\n  const startupFindings = collectGatewayStartupGuardFindings(cfg, env);\n  const exposureFindings = collectExposureAuditFindings(cfg);\n  return mergeFindings([...configFindings, ...startupFindings, ...exposureFindings]);\n}\n\nfunction emitFindings(findings: SecurityAuditFinding[]): void {\n  for (const finding of findings) {\n    const logData = {\n      checkId: finding.checkId,\n      detail: finding.detail,\n      ...(finding.remediation ? { remediation: finding.remediation } : {}),\n    };\n    switch (finding.severity) {\n      case 'critical':\n        log.error(logData, `Security audit: ${finding.title}`);\n        break;\n      case 'warn':\n        log.warn(logData, `Security audit: ${finding.title}`);\n        break;\n      case 'info':\n        log.info(logData, `Security audit: ${finding.title}`);\n        break;\n    }\n  }\n}\n\n/**\n * Audit the gateway configuration at startup and log security findings.\n */\nexport function auditGatewayConfig(params: {\n  auth: ResolvedGatewayAuth;\n  bindHost?: string;\n  corsOrigins?: string[];\n  rateLimitEnabled?: boolean;\n  tlsEnabled?: boolean;\n  trustedProxies?: string[];\n  allowRealIpFallback?: boolean;\n  dangerouslyAllowHostHeaderOriginFallback?: boolean;\n  strictSecurityEnabled?: boolean;\n  rateLimitConfigured?: boolean;\n}): SecurityAuditFinding[] {\n  const findings = collectGatewayConfigFindings(params);\n  emitFindings(findings);\n  return findings;\n}\n"],"mappings":";;;;;;;;;aAWqD;AAErD,MAAM,MAAM,aAAa,gBAAgB;;AAYzC,MAAM,yBAAyB;AAE/B,SAAS,eAAe,MAAmC;AACzD,QAAO,CAAC,QACN,SAAS,eACT,SAAS,eACT,SAAS;;AAGb,SAAS,qBAAqB,KAAuB;AACnD,SAAQ,IAAI,SAAS,eAAe,EAAE,EACnC,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,OAAO,QAAQ;;AAGpB,SAAS,mBAAmB,KAAa,MAAyB,QAAQ,KAUxE;CACA,MAAM,OAAO,mBAAmB;EAAE,YAAY,IAAI,SAAS;EAAM;EAAK,CAAC;CACvE,MAAM,OAAO,yBAAyB,EAAE,KAAK,CAAC;CAC9C,MAAM,cAAc,qBAAqB,IAAI;CAC7C,MAAM,mBACJ,IAAI,SAAS,MAAM,WAAW,YAAY,SAC1C,CAAC,iCAAiC;CACpC,MAAM,aACJ,IAAI,QAAQ,YAAY,SACvB,IAAI,SAAS,WAAW,QAAQ,WAAW,SAC5C,IAAI,SAAS,KAAK,YAAY;CAChC,MAAM,WAAW,eAAe,KAAK,SAAS;AAE9C,QAAO;EACL;EACA,UAAU,KAAK;EACf;EACA;EACA;EACA,gBAAgB,IAAI,SAAS;EAC7B,qBAAqB,IAAI,SAAS,wBAAwB;EAC1D,0CACE,IAAI,SAAS,6CAA6C;EAC5D;EACD;;;;;AAMH,SAAgB,6BAA6B,QAWlB;CACzB,MAAM,WAAmC,EAAE;CAC3C,MAAM,WAAW,eAAe,OAAO,SAAS;AAEhD,KAAI,OAAO,KAAK,SAAS,OACvB,KAAI,CAAC,SACH,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ,4CAA4C,OAAO,SAAS;EAEpE,aAAa;EAEd,CAAC;KAEF,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EAER,aAAa;EACd,CAAC;AAIN,KACE,CAAC,YACD,OAAO,KAAK,SAAS,WACrB,CAAC,OAAO,KAAK,OAAO,MAAM,CAE1B,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EACR,aAAa;EACd,CAAC;AAGJ,KACE,CAAC,YACD,OAAO,KAAK,SAAS,cACrB,CAAC,OAAO,KAAK,UAAU,MAAM,CAE7B,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EACR,aAAa;EACd,CAAC;AAGJ,KAAI,OAAO,KAAK,SAAS,WAAW,OAAO,KAAK,OAAO;EACrD,MAAM,QAAQ,OAAO,KAAK;AAE1B,MAAI,MAAM,SAAS,uBACjB,UAAS,KAAK;GACZ,SAAS;GACT,UAAU;GACV,OAAO;GACP,QAAQ,mBAAmB,MAAM,OAAO;GAExC,aAAa,2BAA2B,uBAAuB;GAEhE,CAAC;AAGJ,MAAI,WAAW,KAAK,MAAM,CACxB,UAAS,KAAK;GACZ,SAAS;GACT,UAAU;GACV,OAAO;GACP,QAAQ;GACR,aAAa;GACd,CAAC;AAIJ,MAAI,CADa,QAAQ,IAAI,mBAE3B,UAAS,KAAK;GACZ,SAAS;GACT,UAAU;GACV,OAAO;GACP,QAAQ;GAER,aAAa;GACd,CAAC;;AAIN,KAAI,OAAO,aAAa,SAAS,IAAI,CACnC,UAAS,KAAK;EACZ,SAAS;EACT,UAAU,CAAC,WAAW,aAAa;EACnC,OAAO;EACP,QAAQ;EAER,aAAa;EAEd,CAAC;AAGJ,KAAI,OAAO,eAAe,OAAO,YAAY,SAAS,GACpD,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ,GAAG,OAAO,YAAY,OAAO;EACtC,CAAC;AAGJ,KACE,CAAC,aACA,CAAC,OAAO,eAAe,OAAO,YAAY,WAAW,MACtD,OAAO,6CAA6C,KAEpD,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QACE;EAGF,aACE;EAEH,CAAC;AAGJ,KACE,CAAC,YACD,OAAO,KAAK,SAAS,UACrB,OAAO,KAAK,SAAS,mBACrB,OAAO,qBAAqB,MAE5B,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EAER,aAAa;EAEd,CAAC;AAGJ,KACE,CAAC,YACD,OAAO,0BAA0B,QACjC,OAAO,wBAAwB,KAE/B,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EACR,aACE;EACH,CAAC;AAGJ,KAAI,CAAC,YAAY,CAAC,OAAO,WACvB,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EAER,aACE;EAEH,CAAC;AAGJ,KAAI,OAAO,aAAa,aAAa,OAAO,aAAa,KACvD,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EAER,aAAa;EACd,CAAC;AAGJ,KAAI,OAAO,KAAK,SAAS,iBAAiB;EACxC,MAAM,iBAAiB,OAAO,kBAAkB,EAAE;EAClD,MAAM,qBAAqB,OAAO,KAAK;AAEvC,WAAS,KAAK;GACZ,SAAS;GACT,UAAU;GACV,OAAO;GACP,QACE;GAGF,aACE;GAGH,CAAC;AAEF,MAAI,eAAe,WAAW,EAC5B,UAAS,KAAK;GACZ,SAAS;GACT,UAAU;GACV,OAAO;GACP,QACE;GAEF,aAAa;GACd,CAAC;AAGJ,MAAI,CAAC,oBAAoB,WACvB,UAAS,KAAK;GACZ,SAAS;GACT,UAAU;GACV,OAAO;GACP,QACE;GACF,aACE;GAEH,CAAC;AAGJ,MAAI,oBAAoB,kBAAkB,KACxC,UAAS,KAAK;GACZ,SAAS;GACT,UAAU;GACV,OAAO;GACP,QACE;GAEF,aACE;GACH,CAAC;AAIJ,OADmB,oBAAoB,cAAc,EAAE,EACxC,WAAW,EACxB,UAAS,KAAK;GACZ,SAAS;GACT,UAAU;GACV,OAAO;GACP,QACE;GACF,aACE;GACH,CAAC;AAGJ,MAAI,OAAO,wBAAwB,KACjC,UAAS,KAAK;GACZ,SAAS;GACT,UAAU;GACV,OAAO;GACP,QACE;GACF,aACE;GACH,CAAC;;AAIN,QAAO;;AAGT,SAAgB,6BAA6B,KAAqC;CAChF,MAAM,WAAmC,EAAE;CAC3C,MAAM,gBAAgB,IAAI,SAAS,WAAW,QAAQ;CACtD,MAAM,WAAW,IAAI,SAAS,QAAQ;AAEtC,MAAK,MAAM,YAAY,yBAAyB,IAAI,CAClD,UAAS,KAAK;EACZ,SAAS,oBAAoB,SAAS;EACtC,UAAU;EACV,OAAO;EACP,QAAQ,SAAS;EACjB,aAAa;EACd,CAAC;AAGJ,KAAI,kBAAkB,YAAY,IAAI,SAAS,MAAM,SAAS,WAC5D,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EACR,aAAa;EACd,CAAC;AAGJ,KAAI,kBAAkB,SAAS,aAAa,WAC1C,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ,aAAa,cAAc,+BAA+B,SAAS;EAC3E,aAAa;EACd,CAAC;AAGJ,KAAI,yBAAyB,IAAI,CAC/B,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EACR,aAAa;EACd,CAAC;AAGJ,KAAI,wBAAwB,IAAI,CAC9B,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EACR,aAAa;EACd,CAAC;AAGJ,KAAI,kBAAkB,SACpB,UAAS,KAAK;EACZ,SAAS;EACT,UAAU;EACV,OAAO;EACP,QAAQ;EACR,aAAa;EACd,CAAC;AAGJ,QAAO;;;AAIT,SAAgB,mCACd,KACA,MAAyB,QAAQ,KACT;AACxB,KAAI;EACF,MAAM,OAAO,mBAAmB;GAAE,YAAY,IAAI,SAAS;GAAM;GAAK,CAAC;AACvE,8BAA4B,KAAK;AACjC,6BAA2B;GACzB;GACA;GACA,MAAM,IAAI,SAAS,QAAQ;GAC5B,CAAC;AACF,SAAO,EAAE;UACF,KAAK;AAEZ,SAAO,CAAC;GACN,SAAS;GACT,UAAU;GACV,OAAO;GACP,QALc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;GAM9D,aAAa;GACd,CAAC;;;AAIN,SAAS,cAAc,UAA0D;CAC/E,MAAM,uBAAO,IAAI,KAAmC;CACpD,MAAM,eAAe;EAAE,UAAU;EAAG,MAAM;EAAG,MAAM;EAAG;AAEtD,MAAK,MAAM,WAAW,UAAU;EAC9B,MAAM,WAAW,KAAK,IAAI,QAAQ,QAAQ;AAC1C,MAAI,CAAC,YAAY,aAAa,QAAQ,YAAY,aAAa,SAAS,UACtE,MAAK,IAAI,QAAQ,SAAS,QAAQ;;AAGtC,QAAO,CAAC,GAAG,KAAK,QAAQ,CAAC;;;;;AAM3B,SAAgB,+BACd,KACA,MAAyB,QAAQ,KACT;CACxB,MAAM,SAAS,mBAAmB,KAAK,IAAI;CAC3C,MAAM,iBAAiB,6BAA6B;EAClD,MAAM,OAAO;EACb,UAAU,OAAO;EACjB,aAAa,OAAO;EACpB,kBAAkB,OAAO;EACzB,YAAY,OAAO;EACnB,gBAAgB,OAAO;EACvB,qBAAqB,OAAO;EAC5B,0CAA0C,OAAO;EACjD,uBAAuB,+BAA+B,IAAI;EAC1D,qBAAqB,IAAI,SAAS,MAAM,cAAc,KAAA;EACvD,CAAC;CACF,MAAM,kBAAkB,mCAAmC,KAAK,IAAI;CACpE,MAAM,mBAAmB,6BAA6B,IAAI;AAC1D,QAAO,cAAc;EAAC,GAAG;EAAgB,GAAG;EAAiB,GAAG;EAAiB,CAAC;;AAGpF,SAAS,aAAa,UAAwC;AAC5D,MAAK,MAAM,WAAW,UAAU;EAC9B,MAAM,UAAU;GACd,SAAS,QAAQ;GACjB,QAAQ,QAAQ;GAChB,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,aAAa,GAAG,EAAE;GACpE;AACD,UAAQ,QAAQ,UAAhB;GACE,KAAK;AACH,QAAI,MAAM,SAAS,mBAAmB,QAAQ,QAAQ;AACtD;GACF,KAAK;AACH,QAAI,KAAK,SAAS,mBAAmB,QAAQ,QAAQ;AACrD;GACF,KAAK;AACH,QAAI,KAAK,SAAS,mBAAmB,QAAQ,QAAQ;AACrD;;;;;;;AAQR,SAAgB,mBAAmB,QAWR;CACzB,MAAM,WAAW,6BAA6B,OAAO;AACrD,cAAa,SAAS;AACtB,QAAO"}

package/dist/src/gateway/security/index.d.ts

@@ -5,6 +5,5 @@ export { computeInlineScriptHashes, buildGatewayConsoleCspHeader } from './csp.j
 export { ADMIN_SCOPE, READ_SCOPE, WRITE_SCOPE, KNOWN_OPERATOR_SCOPES, DEFAULT_OPERATOR_SCOPES, isOperatorScope, authorizeRouteScope, authorizeScope, parseScopesHeader, type OperatorScope, } from './operator-scopes.js';
 export { DEFAULT_GATEWAY_HTTP_TOOL_DENY, isDangerousHttpTool, filterDangerousHttpTools, } from './dangerous-tools.js';
 export { createPreauthConnectionBudget, getMaxPreauthConnectionsPerIp, type PreauthConnectionBudget, } from './preauth-connection-budget.js';
-export { UnauthorizedFloodGuard, type FloodGuardOptions, type FloodGuardDecision, } from './flood-guard.js';
 export { auditGatewayConfig, collectGatewayConfigFindings, collectGatewaySecurityFindings, collectGatewayStartupGuardFindings, type SecurityAuditFinding, } from './audit.js';
 export { wrapExternalContent, wrapWebContent, detectSuspiciousPatterns, type ExternalContentSource, type WrapExternalContentOptions, } from './external-content.js';

package/dist/src/gateway/security/index.js

@@ -6,6 +6,5 @@ import { checkBrowserOrigin } from "./origin-check.js";
 import { ADMIN_SCOPE, DEFAULT_OPERATOR_SCOPES, KNOWN_OPERATOR_SCOPES, READ_SCOPE, WRITE_SCOPE, authorizeRouteScope, authorizeScope, isOperatorScope, parseScopesHeader } from "./operator-scopes.js";
 import { DEFAULT_GATEWAY_HTTP_TOOL_DENY, filterDangerousHttpTools, isDangerousHttpTool } from "./dangerous-tools.js";
 import { detectSuspiciousPatterns, wrapExternalContent, wrapWebContent } from "./external-content.js";
-import { UnauthorizedFloodGuard } from "./flood-guard.js";
 import { createPreauthConnectionBudget, getMaxPreauthConnectionsPerIp } from "./preauth-connection-budget.js";
-export { ADMIN_SCOPE, DEFAULT_GATEWAY_HTTP_TOOL_DENY, DEFAULT_OPERATOR_SCOPES, KNOWN_OPERATOR_SCOPES, KNOWN_WEAK_GATEWAY_TOKEN_PLACEHOLDERS, READ_SCOPE, UnauthorizedFloodGuard, WRITE_SCOPE, assertGatewayAuthNotKnownWeak, auditGatewayConfig, authorizeRouteScope, authorizeScope, buildGatewayConsoleCspHeader, checkBrowserOrigin, collectGatewayConfigFindings, collectGatewaySecurityFindings, collectGatewayStartupGuardFindings, computeInlineScriptHashes, createPreauthConnectionBudget, detectSuspiciousPatterns, filterDangerousHttpTools, getMaxPreauthConnectionsPerIp, isDangerousHttpTool, isOperatorScope, parseScopesHeader, safeEqualSecret, wrapExternalContent, wrapWebContent };
+export { ADMIN_SCOPE, DEFAULT_GATEWAY_HTTP_TOOL_DENY, DEFAULT_OPERATOR_SCOPES, KNOWN_OPERATOR_SCOPES, KNOWN_WEAK_GATEWAY_TOKEN_PLACEHOLDERS, READ_SCOPE, WRITE_SCOPE, assertGatewayAuthNotKnownWeak, auditGatewayConfig, authorizeRouteScope, authorizeScope, buildGatewayConsoleCspHeader, checkBrowserOrigin, collectGatewayConfigFindings, collectGatewaySecurityFindings, collectGatewayStartupGuardFindings, computeInlineScriptHashes, createPreauthConnectionBudget, detectSuspiciousPatterns, filterDangerousHttpTools, getMaxPreauthConnectionsPerIp, isDangerousHttpTool, isOperatorScope, parseScopesHeader, safeEqualSecret, wrapExternalContent, wrapWebContent };