la-machina-engine 0.15.0 → 0.15.1

package/dist/index.cjs

@@ -1278,6 +1278,14 @@ var RESERVED_HEADER_NAMES = /* @__PURE__ */ new Set([
   "set-cookie",
   "proxy-authorization"
 ]);
+var SECRET_PATTERN_RE = /(-secret|-token|-key)$/i;
+var RESERVED_DEFAULT_HEADER_EXACT = /* @__PURE__ */ new Set([
+  "authorization",
+  "cookie",
+  "set-cookie",
+  "proxy-authorization",
+  "x-auth-token"
+]);
 var ApiServiceSchema = import_zod.z.object({
   name: import_zod.z.string().min(1),
   description: import_zod.z.string().optional(),
@@ -1292,6 +1300,34 @@ var ApiServiceSchema = import_zod.z.object({
   endpoints: import_zod.z.array(ApiEndpointSchema).optional(),
   secretHeaders: import_zod.z.record(import_zod.z.string(), import_zod.z.string().min(1)).optional()
 }).strict().superRefine((svc, ctx) => {
+  if (svc.defaultHeaders !== void 0) {
+    for (const headerName of Object.keys(svc.defaultHeaders)) {
+      if (!HEADER_NAME_RE.test(headerName)) {
+        ctx.addIssue({
+          code: "custom",
+          message: `defaultHeaders key "${headerName}" is not a valid HTTP header name (RFC 7230 token charset)`,
+          path: ["defaultHeaders", headerName]
+        });
+        continue;
+      }
+      const lower = headerName.toLowerCase();
+      if (RESERVED_DEFAULT_HEADER_EXACT.has(lower)) {
+        ctx.addIssue({
+          code: "custom",
+          message: `defaultHeaders key "${headerName}" is reserved \u2014 move secret-bearing values to secretHeaders or primary auth`,
+          path: ["defaultHeaders", headerName]
+        });
+        continue;
+      }
+      if (SECRET_PATTERN_RE.test(headerName)) {
+        ctx.addIssue({
+          code: "custom",
+          message: `defaultHeaders key "${headerName}" looks like a secret-bearing name (matches *-secret/*-token/*-key). Move to secretHeaders so the value is vault-resolved + scrubbed.`,
+          path: ["defaultHeaders", headerName]
+        });
+      }
+    }
+  }
   if (svc.secretHeaders === void 0) return;
   const lowerDefault = /* @__PURE__ */ new Set();
   for (const k of Object.keys(svc.defaultHeaders ?? {})) lowerDefault.add(k.toLowerCase());