govyn 0.0.1 → 0.2.5

package/dist/action-logger.js

@@ -0,0 +1,356 @@
+/**
+ * Async action logger for the Govyn proxy server.
+ *
+ * Writes structured JSONL log entries for every proxied request.
+ * Supports two modes:
+ * - metadata: summary fields only (default)
+ * - full-payload: stores request/response bodies as separate JSON files
+ *
+ * Design:
+ * - log() is synchronous and non-blocking (zero added latency)
+ * - Entries are buffered in memory and flushed to disk on a 1-second interval
+ * - storePayload() is fire-and-forget async (errors logged to stderr)
+ * - Dual output: stdout AND/OR file, either disableable in config
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as crypto from 'node:crypto';
+import * as zlib from 'node:zlib';
+import { LogRotator } from './log-rotator.js';
+/**
+ * ActionLogger writes structured JSONL log entries for proxied requests.
+ *
+ * Non-blocking by design: log() pushes to an in-memory buffer that is
+ * flushed to disk on a 1-second unref'd interval. storePayload() writes
+ * payload files asynchronously without awaiting in the request path.
+ */
+export class ActionLogger {
+    /** Exposed config for consumers that need to read settings (e.g., maxBodySize) */
+    config;
+    /** Internal write buffer — entries waiting to be flushed to disk */
+    buffer = [];
+    /** Path to the current active JSONL log file */
+    currentFilePath;
+    /** Path to the payloads subdirectory */
+    payloadsDir;
+    /** Periodic flush interval handle */
+    flushInterval = null;
+    /** Log rotator for size/time-based rotation and retention cleanup */
+    rotator;
+    constructor(config) {
+        this.config = config;
+        // Create log directory and payloads subdirectory
+        const logDir = path.resolve(config.directory);
+        this.payloadsDir = path.join(logDir, 'payloads');
+        fs.mkdirSync(logDir, { recursive: true });
+        fs.mkdirSync(this.payloadsDir, { recursive: true });
+        // Build initial JSONL file path: govyn-YYYY-MM-DD.jsonl
+        const dateStr = new Date().toISOString().slice(0, 10);
+        this.currentFilePath = path.join(logDir, `govyn-${dateStr}.jsonl`);
+        // Create log rotator for rotation and retention
+        this.rotator = new LogRotator(config);
+        // Start periodic flush (every 1 second, unref'd so it doesn't keep the process alive)
+        if (config.file) {
+            this.flushInterval = setInterval(() => this.flush(), 1000);
+            this.flushInterval.unref();
+        }
+    }
+    /**
+     * Read-only access to the log directory path.
+     * Used by the log query API to locate JSONL files.
+     */
+    get logDirectory() {
+        return this.config.directory;
+    }
+    /**
+     * Get the full filesystem path to a payload file.
+     *
+     * @param payloadId - The payload ID (used as filename stem)
+     * @returns Full path to the payload JSON file
+     */
+    getPayloadPath(payloadId) {
+        return path.join(this.payloadsDir, `${payloadId}.json`);
+    }
+    /**
+     * Log a structured entry. Non-blocking — adds to buffer and optionally writes to stdout.
+     * This is the zero-latency guarantee: no file I/O in the hot path.
+     * Automatically sets storage_region from config if not already set on the entry.
+     *
+     * @param entry - The structured log entry to record
+     */
+    log(entry) {
+        // Ensure storage_region is set from config
+        if (!entry.storage_region) {
+            entry.storage_region = this.config.storageRegion;
+        }
+        const line = JSON.stringify(entry);
+        if (this.config.stdout) {
+            process.stdout.write(line + '\n');
+        }
+        if (this.config.file) {
+            this.buffer.push(line);
+        }
+    }
+    /**
+     * Store a full payload (request + response bodies) as a separate JSON file.
+     * Fully async — fire and forget. Errors are logged to stderr but never thrown.
+     *
+     * @param payloadId - Unique ID for this payload (used as filename)
+     * @param requestBody - Raw request body buffer (or null)
+     * @param responseBody - Raw response body buffer (or null)
+     * @param truncated - Whether either body was truncated due to size limits
+     */
+    storePayload(payloadId, requestBody, responseBody, truncated) {
+        const maxSize = this.config.maxBodySize;
+        // Truncate bodies if they exceed maxBodySize
+        let reqBody = requestBody;
+        let resBody = responseBody;
+        let wasTruncated = truncated;
+        if (reqBody && reqBody.length > maxSize) {
+            reqBody = reqBody.subarray(0, maxSize);
+            wasTruncated = true;
+        }
+        if (resBody && resBody.length > maxSize) {
+            resBody = resBody.subarray(0, maxSize);
+            wasTruncated = true;
+        }
+        const payload = {
+            request_body: reqBody ? reqBody.toString('base64') : null,
+            response_body: resBody ? resBody.toString('base64') : null,
+            truncated: wasTruncated,
+            stored_at: new Date().toISOString(),
+        };
+        const filePath = path.join(this.payloadsDir, `${payloadId}.json`);
+        // Fire and forget — async write, errors go to stderr
+        fs.promises.writeFile(filePath, JSON.stringify(payload), 'utf8').catch((err) => {
+            const message = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`[govyn] Failed to store payload ${payloadId}: ${message}\n`);
+        });
+    }
+    /**
+     * Flush buffered entries to the current JSONL file.
+     * Uses synchronous append to ensure atomicity of the batch write.
+     */
+    flush() {
+        if (this.buffer.length === 0)
+            return;
+        // Check rotation before writing
+        try {
+            if (fs.existsSync(this.currentFilePath)) {
+                const result = this.rotator.checkRotation(this.currentFilePath);
+                if (result.shouldRotate) {
+                    const freshPath = this.rotator.rotate(this.currentFilePath);
+                    this.currentFilePath = freshPath;
+                }
+            }
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`[govyn] Rotation check failed: ${message}\n`);
+        }
+        const lines = this.buffer.join('\n') + '\n';
+        this.buffer = [];
+        try {
+            fs.appendFileSync(this.currentFilePath, lines, 'utf8');
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`[govyn] Failed to flush log entries: ${message}\n`);
+        }
+    }
+    /**
+     * Get the logging mode for a specific agent.
+     * Returns the agent-specific override if set, otherwise the default mode.
+     *
+     * @param agentId - The agent to look up
+     * @returns The LoggingMode to use for this agent
+     */
+    getMode(agentId) {
+        return this.config.agentModes.get(agentId) ?? this.config.defaultMode;
+    }
+    /**
+     * Set the logging mode for a specific agent at runtime.
+     * Does NOT persist to YAML — runtime-only toggle.
+     *
+     * @param agentId - The agent to configure
+     * @param mode - The logging mode to set
+     */
+    setMode(agentId, mode) {
+        this.config.agentModes.set(agentId, mode);
+    }
+    /**
+     * Get the path of the current active JSONL log file.
+     * Useful for rotation logic and diagnostics.
+     */
+    getCurrentFilePath() {
+        return this.currentFilePath;
+    }
+    /**
+     * Purge all log entries and associated payload files older than the given date.
+     *
+     * - Reads all JSONL files (current + rotated) in the log directory
+     * - For each file: filters out entries with timestamps before the date
+     * - Deletes payload files for removed entries that have has_payload=true
+     * - Handles gzipped rotated files: decompress, filter, recompress or delete
+     * - Returns counts of deleted log entries and deleted payload files
+     *
+     * @param date - Purge entries with timestamps strictly before this date
+     * @returns Counts of deleted log entries and payload files
+     */
+    purgeBefore(date) {
+        // Flush buffer first so all entries are on disk
+        this.flush();
+        const logDir = path.resolve(this.config.directory);
+        const dateIso = date.toISOString();
+        let deletedLogs = 0;
+        let deletedPayloads = 0;
+        if (!fs.existsSync(logDir)) {
+            return { deletedLogs, deletedPayloads };
+        }
+        const files = fs.readdirSync(logDir);
+        for (const file of files) {
+            const filePath = path.join(logDir, file);
+            if (file.endsWith('.jsonl')) {
+                // Process uncompressed JSONL files
+                const result = this.purgeJsonlFile(filePath, dateIso);
+                deletedLogs += result.deletedLogs;
+                deletedPayloads += result.deletedPayloads;
+            }
+            else if (file.endsWith('.jsonl.gz')) {
+                // Process gzipped rotated files
+                const result = this.purgeGzipFile(filePath, dateIso);
+                deletedLogs += result.deletedLogs;
+                deletedPayloads += result.deletedPayloads;
+            }
+        }
+        return { deletedLogs, deletedPayloads };
+    }
+    /**
+     * Purge entries from a plain JSONL file.
+     * Rewrites the file with only entries newer than the cutoff date.
+     */
+    purgeJsonlFile(filePath, dateIso) {
+        let deletedLogs = 0;
+        let deletedPayloads = 0;
+        try {
+            const content = fs.readFileSync(filePath, 'utf8');
+            const lines = content.trim().split('\n').filter((l) => l.length > 0);
+            const kept = [];
+            for (const line of lines) {
+                try {
+                    const entry = JSON.parse(line);
+                    if (entry.timestamp < dateIso) {
+                        // Entry is older than cutoff — remove it
+                        deletedLogs++;
+                        // Delete associated payload file if present
+                        if (entry.has_payload && entry.payload_id) {
+                            const payloadPath = path.join(this.payloadsDir, `${entry.payload_id}.json`);
+                            try {
+                                if (fs.existsSync(payloadPath)) {
+                                    fs.unlinkSync(payloadPath);
+                                    deletedPayloads++;
+                                }
+                            }
+                            catch {
+                                // Skip payload deletion errors
+                            }
+                        }
+                    }
+                    else {
+                        kept.push(line);
+                    }
+                }
+                catch {
+                    // Keep malformed lines (don't delete data we can't parse)
+                    kept.push(line);
+                }
+            }
+            // Rewrite file with kept entries
+            if (kept.length === 0) {
+                fs.writeFileSync(filePath, '', 'utf8');
+            }
+            else {
+                fs.writeFileSync(filePath, kept.join('\n') + '\n', 'utf8');
+            }
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`[govyn] Purge error for ${filePath}: ${message}\n`);
+        }
+        return { deletedLogs, deletedPayloads };
+    }
+    /**
+     * Purge entries from a gzipped rotated JSONL file.
+     * Decompresses, filters, and either recompresses or deletes if empty.
+     */
+    purgeGzipFile(filePath, dateIso) {
+        let deletedLogs = 0;
+        let deletedPayloads = 0;
+        try {
+            const compressed = fs.readFileSync(filePath);
+            const content = zlib.gunzipSync(compressed).toString('utf8');
+            const lines = content.trim().split('\n').filter((l) => l.length > 0);
+            const kept = [];
+            for (const line of lines) {
+                try {
+                    const entry = JSON.parse(line);
+                    if (entry.timestamp < dateIso) {
+                        deletedLogs++;
+                        if (entry.has_payload && entry.payload_id) {
+                            const payloadPath = path.join(this.payloadsDir, `${entry.payload_id}.json`);
+                            try {
+                                if (fs.existsSync(payloadPath)) {
+                                    fs.unlinkSync(payloadPath);
+                                    deletedPayloads++;
+                                }
+                            }
+                            catch {
+                                // Skip payload deletion errors
+                            }
+                        }
+                    }
+                    else {
+                        kept.push(line);
+                    }
+                }
+                catch {
+                    kept.push(line);
+                }
+            }
+            if (kept.length === 0) {
+                // All entries removed — delete the gzip file
+                fs.unlinkSync(filePath);
+            }
+            else {
+                // Recompress with remaining entries
+                const newContent = kept.join('\n') + '\n';
+                const recompressed = zlib.gzipSync(Buffer.from(newContent, 'utf8'));
+                fs.writeFileSync(filePath, recompressed);
+            }
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`[govyn] Purge error for gzip ${filePath}: ${message}\n`);
+        }
+        return { deletedLogs, deletedPayloads };
+    }
+    /**
+     * Close the logger: flush remaining buffer and stop the flush interval.
+     */
+    close() {
+        this.flush();
+        if (this.flushInterval !== null) {
+            clearInterval(this.flushInterval);
+            this.flushInterval = null;
+        }
+        this.rotator.stop();
+    }
+    /**
+     * Generate a unique ID for log entries and payload files.
+     * Uses crypto.randomUUID() for guaranteed uniqueness.
+     */
+    static generateId() {
+        return crypto.randomUUID();
+    }
+}
+//# sourceMappingURL=action-logger.js.map

package/dist/action-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-logger.js","sourceRoot":"","sources":["../src/action-logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,OAAO,YAAY;IACvB,kFAAkF;IACzE,MAAM,CAAgB;IAE/B,oEAAoE;IAC5D,MAAM,GAAa,EAAE,CAAC;IAE9B,gDAAgD;IACxC,eAAe,CAAS;IAEhC,wCAAwC;IAChC,WAAW,CAAS;IAE5B,qCAAqC;IAC7B,aAAa,GAA0C,IAAI,CAAC;IAEpE,qEAAqE;IAC7D,OAAO,CAAa;IAE5B,YAAY,MAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,iDAAiD;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACjD,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpD,wDAAwD;QACxD,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,OAAO,QAAQ,CAAC,CAAC;QAEnE,gDAAgD;QAChD,IAAI,CAAC,OAAO,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtC,sFAAsF;QACtF,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,SAAiB;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;OAMG;IACH,GAAG,CAAC,KAAe;QACjB,2CAA2C;QAC3C,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1B,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAEnC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,YAAY,CACV,SAAiB,EACjB,WAA0B,EAC1B,YAA2B,EAC3B,SAAkB;QAElB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QAExC,6CAA6C;QAC7C,IAAI,OAAO,GAAG,WAAW,CAAC;QAC1B,IAAI,OAAO,GAAG,YAAY,CAAC;QAC3B,IAAI,YAAY,GAAG,SAAS,CAAC;QAE7B,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;YACxC,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACvC,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;QACD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;YACxC,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACvC,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;QAED,MAAM,OAAO,GAAG;YACd,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YACzD,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YAC1D,SAAS,EAAE,YAAY;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;QAElE,qDAAqD;QACrD,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7E,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,SAAS,KAAK,OAAO,IAAI,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAErC,gCAAgC;QAChC,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;gBACxC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAChE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;oBACxB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;oBAC5D,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,OAAO,IAAI,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QAEjB,IAAI,CAAC;YACH,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,OAAO,IAAI,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,OAAe;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;IACxE,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,OAAe,EAAE,IAAiB;QACxC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,IAAU;QACpB,gDAAgD;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QAEb,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,eAAe,GAAG,CAAC,CAAC;QAExB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAEzC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,mCAAmC;gBACnC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBACtD,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC;gBAClC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC;YAC5C,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,gCAAgC;gBAChC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBACrD,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC;gBAClC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACK,cAAc,CACpB,QAAgB,EAChB,OAAe;QAEf,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,eAAe,GAAG,CAAC,CAAC;QAExB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACrE,MAAM,IAAI,GAAa,EAAE,CAAC;YAE1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC;oBAC3C,IAAI,KAAK,CAAC,SAAS,GAAG,OAAO,EAAE,CAAC;wBAC9B,yCAAyC;wBACzC,WAAW,EAAE,CAAC;wBACd,4CAA4C;wBAC5C,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;4BAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,UAAU,OAAO,CAAC,CAAC;4BAC5E,IAAI,CAAC;gCACH,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;oCAC/B,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;oCAC3B,eAAe,EAAE,CAAC;gCACpB,CAAC;4BACH,CAAC;4BAAC,MAAM,CAAC;gCACP,+BAA+B;4BACjC,CAAC;wBACH,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,0DAA0D;oBAC1D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,iCAAiC;YACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACK,aAAa,CACnB,QAAgB,EAChB,OAAe;QAEf,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,eAAe,GAAG,CAAC,CAAC;QAExB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACrE,MAAM,IAAI,GAAa,EAAE,CAAC;YAE1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC;oBAC3C,IAAI,KAAK,CAAC,SAAS,GAAG,OAAO,EAAE,CAAC;wBAC9B,WAAW,EAAE,CAAC;wBACd,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;4BAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,UAAU,OAAO,CAAC,CAAC;4BAC5E,IAAI,CAAC;gCACH,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;oCAC/B,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;oCAC3B,eAAe,EAAE,CAAC;gCACpB,CAAC;4BACH,CAAC;4BAAC,MAAM,CAAC;gCACP,+BAA+B;4BACjC,CAAC;wBACH,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,6CAA6C;gBAC7C,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,oCAAoC;gBACpC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;gBAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;gBACpE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC;QACjF,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAChC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAClC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,UAAU;QACf,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;CACF"}

package/dist/admin-cli.d.ts

@@ -0,0 +1,2 @@
+export declare function runAdminSetup(authFile?: string): Promise<void>;
+export declare function runAdminResetPassword(authFile?: string): Promise<void>;

package/dist/admin-cli.js

@@ -0,0 +1,36 @@
+import { LocalAuthManager, DEFAULT_AUTH_FILE } from './auth.js';
+import { createPrompt } from './prompt.js';
+export async function runAdminSetup(authFile = DEFAULT_AUTH_FILE) {
+    const authManager = new LocalAuthManager(authFile);
+    const { ask, askHidden, close } = createPrompt();
+    try {
+        const username = (await ask("Admin username (default: 'admin'): ")) || 'admin';
+        const password = await askHidden('Admin password: ');
+        const confirmation = await askHidden('Confirm password: ');
+        if (password !== confirmation) {
+            throw new Error('Passwords did not match');
+        }
+        const normalizedUsername = authManager.setupAdmin(username, password);
+        console.log(`[govyn] Local admin "${normalizedUsername}" created at ${authManager.authFile}`);
+    }
+    finally {
+        close();
+    }
+}
+export async function runAdminResetPassword(authFile = DEFAULT_AUTH_FILE) {
+    const authManager = new LocalAuthManager(authFile);
+    const { askHidden, close } = createPrompt();
+    try {
+        const password = await askHidden('New admin password: ');
+        const confirmation = await askHidden('Confirm new password: ');
+        if (password !== confirmation) {
+            throw new Error('Passwords did not match');
+        }
+        const username = authManager.resetPassword(password);
+        console.log(`[govyn] Password reset for "${username}" using ${authManager.authFile}`);
+    }
+    finally {
+        close();
+    }
+}
+//# sourceMappingURL=admin-cli.js.map

package/dist/admin-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-cli.js","sourceRoot":"","sources":["../src/admin-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAQ,GAAG,iBAAiB;IAC9D,MAAM,WAAW,GAAG,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;IAEjD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,qCAAqC,CAAC,CAAC,IAAI,OAAO,CAAC;QAC/E,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAE3D,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,kBAAkB,GAAG,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,wBAAwB,kBAAkB,gBAAgB,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChG,CAAC;YAAS,CAAC;QACT,KAAK,EAAE,CAAC;IACV,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAQ,GAAG,iBAAiB;IACtE,MAAM,WAAW,GAAG,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,wBAAwB,CAAC,CAAC;QAE/D,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,+BAA+B,QAAQ,WAAW,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxF,CAAC;YAAS,CAAC;QACT,KAAK,EAAE,CAAC;IACV,CAAC;AACH,CAAC"}

package/dist/agents.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Agent identification module for the Govyn proxy server.
+ *
+ * Resolves the identity of the agent making a request using:
+ * 1. X-Govyn-Agent header (self-identified, highest priority)
+ * 2. API key scoped to an agent (from Authorization Bearer token)
+ * 3. Default 'unknown' agent
+ */
+import type { IncomingMessage } from 'node:http';
+import type { AgentConfig, AgentIdentity } from './types.js';
+/**
+ * Resolve the agent identity from an incoming HTTP request.
+ *
+ * Resolution order (per ADR-014):
+ * 1. X-Govyn-Agent header — any string is accepted (agents self-identify; no config lookup)
+ * 2. Authorization Bearer token — looked up in the agents map for API key scoping
+ * 3. Default — returns { agentId: 'unknown', source: 'default' }
+ *
+ * @param req - Incoming HTTP request
+ * @param agents - Map of agent name to AgentConfig (from ProxyConfig)
+ * @returns Resolved AgentIdentity
+ */
+export declare function resolveAgentId(req: IncomingMessage, agents: Map<string, AgentConfig>): AgentIdentity;

package/dist/agents.js

@@ -0,0 +1,59 @@
+/**
+ * Agent identification module for the Govyn proxy server.
+ *
+ * Resolves the identity of the agent making a request using:
+ * 1. X-Govyn-Agent header (self-identified, highest priority)
+ * 2. API key scoped to an agent (from Authorization Bearer token)
+ * 3. Default 'unknown' agent
+ */
+/**
+ * Resolve the agent identity from an incoming HTTP request.
+ *
+ * Resolution order (per ADR-014):
+ * 1. X-Govyn-Agent header — any string is accepted (agents self-identify; no config lookup)
+ * 2. Authorization Bearer token — looked up in the agents map for API key scoping
+ * 3. Default — returns { agentId: 'unknown', source: 'default' }
+ *
+ * @param req - Incoming HTTP request
+ * @param agents - Map of agent name to AgentConfig (from ProxyConfig)
+ * @returns Resolved AgentIdentity
+ */
+export function resolveAgentId(req, agents) {
+    // Priority 1: Authorization Bearer token matched against agent API keys.
+    // Authenticated identity must win over self-declared headers to prevent impersonation.
+    const authHeader = req.headers['authorization'];
+    if (authHeader) {
+        const token = extractBearerToken(authHeader);
+        if (token) {
+            for (const [agentName, agentConfig] of agents) {
+                if (agentConfig.apiKeys && agentConfig.apiKeys.includes(token)) {
+                    return { agentId: agentName, source: 'api-key' };
+                }
+            }
+        }
+    }
+    // Priority 2: X-Govyn-Agent header (case-insensitive — Node.js lowercases all headers)
+    const agentHeader = req.headers['x-govyn-agent'];
+    if (agentHeader) {
+        const agentId = Array.isArray(agentHeader) ? agentHeader[0] : agentHeader;
+        if (agentId && agentId.trim().length > 0) {
+            return { agentId: agentId.trim(), source: 'header' };
+        }
+    }
+    // Priority 3: Default unknown agent
+    return { agentId: 'unknown', source: 'default' };
+}
+/**
+ * Extract Bearer token from an Authorization header value.
+ *
+ * @param authHeader - Raw Authorization header value (e.g. "Bearer gvn_ra_xxxx")
+ * @returns The token string, or null if not a Bearer token
+ */
+function extractBearerToken(authHeader) {
+    const header = Array.isArray(authHeader) ? authHeader[0] : authHeader;
+    if (!header)
+        return null;
+    const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+    return match ? (match[1] ?? null) : null;
+}
+//# sourceMappingURL=agents.js.map

package/dist/agents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAoB,EACpB,MAAgC;IAEhC,yEAAyE;IACzE,uFAAuF;IACvF,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,EAAE,CAAC;gBAC9C,IAAI,WAAW,CAAC,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/D,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBACnD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,uFAAuF;IACvF,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAC1E,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,UAA6B;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACtE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC"}

package/dist/alert-api.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Alert API handler for the Govyn proxy.
+ *
+ * Handles all /api/alerts/* routes:
+ * - GET /api/alerts/rules — list all alert rules
+ * - POST /api/alerts/rules — create a new alert rule
+ * - PUT /api/alerts/rules/:id — update an existing rule
+ * - DELETE /api/alerts/rules/:id — delete a rule
+ * - GET /api/alerts/history — list alert history with pagination
+ * - POST /api/alerts/test — test webhook delivery
+ */
+import type http from 'node:http';
+import type { AlertManager } from './alert-manager.js';
+export declare function handleAlertApi(req: http.IncomingMessage, res: http.ServerResponse, alertManager: AlertManager): void;