ldrouter 1.5.1

package/dist/server/routing/ratelimit.js

@@ -0,0 +1,58 @@
+// In-memory rate limiter: token bucket per key for RPM, TPM, concurrency.
+const rpmBuckets = new Map();
+const tpmBuckets = new Map();
+const concurrentCounters = new Map();
+export function checkRpm(keyId, rpmLimit) {
+    if (rpmLimit == null || rpmLimit <= 0)
+        return { allowed: true };
+    const now = Date.now();
+    const bucket = rpmBuckets.get(keyId) ?? { tokens: rpmLimit, lastRefill: now };
+    // Refill 1 token per (60_000 / rpm) ms
+    const elapsed = now - bucket.lastRefill;
+    const refillPerMs = rpmLimit / 60_000;
+    const newTokens = Math.min(rpmLimit, bucket.tokens + elapsed * refillPerMs);
+    if (newTokens < 1) {
+        rpmBuckets.set(keyId, { tokens: newTokens, lastRefill: now });
+        const wait = (1 - newTokens) / refillPerMs / 1000;
+        return { allowed: false, reason: 'rpm', retryAfterSeconds: Math.ceil(wait) };
+    }
+    rpmBuckets.set(keyId, { tokens: newTokens - 1, lastRefill: now });
+    return { allowed: true };
+}
+export function checkTpm(keyId, tpmLimit, tokensToConsume) {
+    if (tpmLimit == null || tpmLimit <= 0)
+        return { allowed: true };
+    const now = Date.now();
+    const bucket = tpmBuckets.get(keyId) ?? { tokens: tpmLimit, lastRefill: now };
+    const elapsed = now - bucket.lastRefill;
+    const refillPerMs = tpmLimit / 60_000;
+    const newTokens = Math.min(tpmLimit, bucket.tokens + elapsed * refillPerMs);
+    if (newTokens < tokensToConsume) {
+        tpmBuckets.set(keyId, { tokens: newTokens, lastRefill: now });
+        const wait = (tokensToConsume - newTokens) / refillPerMs / 1000;
+        return { allowed: false, reason: 'tpm', retryAfterSeconds: Math.ceil(wait) };
+    }
+    tpmBuckets.set(keyId, { tokens: newTokens - tokensToConsume, lastRefill: now });
+    return { allowed: true };
+}
+export function acquireConcurrent(keyId, max) {
+    if (max == null || max <= 0) {
+        concurrentCounters.set(keyId, (concurrentCounters.get(keyId) ?? 0) + 1);
+        return true;
+    }
+    const cur = concurrentCounters.get(keyId) ?? 0;
+    if (cur >= max)
+        return false;
+    concurrentCounters.set(keyId, cur + 1);
+    return true;
+}
+export function releaseConcurrent(keyId) {
+    const cur = concurrentCounters.get(keyId) ?? 0;
+    concurrentCounters.set(keyId, Math.max(0, cur - 1));
+}
+export function activeRequests() {
+    let total = 0;
+    for (const v of concurrentCounters.values())
+        total += v;
+    return total;
+}

package/dist/server/routing/resolver.js

@@ -0,0 +1,43 @@
+// Model resolution: physical model, combo, or alias (one hop only).
+import { eq, and } from 'drizzle-orm';
+import { getDb, schema } from '../db/index.js';
+import { GatewayError } from '../errors.js';
+export function resolveRequestedModel(requested) {
+    const db = getDb();
+    // Physical model
+    const model = db.select().from(schema.models).where(eq(schema.models.publicModelId, requested)).get();
+    if (model && model.enabled) {
+        return { kind: 'model', modelId: model.id, publicModelId: model.publicModelId };
+    }
+    // Combo by exact public ID — with-prefix ("combo/<slug>") or the
+    // prefix-less default (<slug>).
+    const combo = db.select().from(schema.combos).where(eq(schema.combos.publicModelId, requested)).get();
+    if (combo && combo.enabled)
+        return { kind: 'combo', comboId: combo.id, publicModelId: combo.publicModelId };
+    // Alias (one hop only)
+    const alias = db.select().from(schema.modelAliases).where(and(eq(schema.modelAliases.alias, requested), eq(schema.modelAliases.enabled, true))).get();
+    if (alias) {
+        if (alias.targetKind === 'model') {
+            const m = db.select().from(schema.models).where(eq(schema.models.id, alias.targetId)).get();
+            if (m && m.enabled)
+                return { kind: 'alias', aliasId: alias.id, alias: alias.alias, resolved: { kind: 'model', modelId: m.id, publicModelId: m.publicModelId } };
+        }
+        else {
+            const c = db.select().from(schema.combos).where(eq(schema.combos.id, alias.targetId)).get();
+            if (c && c.enabled)
+                return { kind: 'alias', aliasId: alias.id, alias: alias.alias, resolved: { kind: 'combo', comboId: c.id, publicModelId: c.publicModelId } };
+        }
+    }
+    // Maybe the user typed the combo slug without the prefix
+    if (!requested.includes('/')) {
+        const c = db.select().from(schema.combos).where(eq(schema.combos.slug, requested)).get();
+        if (c && c.enabled)
+            return { kind: 'combo', comboId: c.id, publicModelId: c.publicModelId };
+    }
+    throw new GatewayError('model_not_found', `Unknown model: ${requested}`, { status: 404 });
+}
+export function unwrapAlias(t) {
+    if (t.kind === 'alias')
+        return t.resolved;
+    return t;
+}

package/dist/server/security/redact.js

@@ -0,0 +1,111 @@
+// Recursive structured redaction + defensive string redaction.
+// Never let secrets reach logs, audit metadata, or error responses.
+const DEFAULT_SECRET_KEYS = [
+    'authorization',
+    'authorizationheader',
+    'x-api-key',
+    'xapikey',
+    'api-key',
+    'apikey',
+    'api_key',
+    'apiKey',
+    'api_key_plain',
+    'apiKeyPlain',
+    'cookie',
+    'set-cookie',
+    'setcookie',
+    'session',
+    'sessiontoken',
+    'token',
+    'accesstoken',
+    'refresh_token',
+    'password',
+    'passwd',
+    'currentpassword',
+    'newpassword',
+    'masterkey',
+    'master_key',
+    'encrypted_api_key',
+    'apiKeyNonce',
+    'api_key_nonce',
+    'totpsecret',
+    'totp_secret',
+    'recoverycode',
+    'recoverycodes',
+    'secret',
+    'client_secret',
+    'privatekey',
+    'x-goog-api-key',
+];
+const SECRET_KEY_REGEX = /(authorization|api[-_]?key|api[-_]?secret|password|passwd|secret|token|cookie|master[-_]?key|totp|recovery|private[-_]?key|session)/i;
+const PLAINTEXT_PATTERNS = [
+    /\bld-[A-Za-z0-9_-]{20,}\b/g, // gateway api keys
+    /(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi,
+    /sk-[A-Za-z0-9_-]{12,}/g, // OpenAI-style
+    /anthropic[_-]?[A-Za-z0-9_-]{20,}/gi,
+    /sk-ant-[A-Za-z0-9_-]{10,}/g,
+    /x-api-key[":= ]+[A-Za-z0-9._~+/=-]{8,}/gi,
+    /Authorization[":= ]+[A-Za-z0-9._~+/=-]{8,}/gi,
+];
+const REDACTED = '[REDACTED]';
+export function redactValue(value, opts = {}) {
+    const { secrets = [], keyMarker = REDACTED, secretKeys = DEFAULT_SECRET_KEYS } = opts;
+    const allSecrets = new Set(secrets.filter((s) => s && s.length >= 6));
+    return redactInternal(value, allSecrets, keyMarker, secretKeys);
+}
+function redactInternal(value, secrets, marker, secretKeys) {
+    if (value === null || value === undefined)
+        return value;
+    if (typeof value === 'string') {
+        let out = value;
+        for (const s of secrets) {
+            if (s && out.includes(s))
+                out = out.split(s).join(marker);
+        }
+        for (const re of PLAINTEXT_PATTERNS) {
+            out = out.replace(re, marker);
+        }
+        return out;
+    }
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return value;
+    if (Array.isArray(value))
+        return value.map((v) => redactInternal(v, secrets, marker, secretKeys));
+    if (typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            if (secretKeys.includes(k) || SECRET_KEY_REGEX.test(k)) {
+                out[k] = v === null || v === undefined ? v : marker;
+            }
+            else {
+                out[k] = redactInternal(v, secrets, marker, secretKeys);
+            }
+        }
+        return out;
+    }
+    return value;
+}
+/** Redact any known secrets from a string (for error messages). */
+export function redactString(input, opts = {}) {
+    const { secrets = [] } = opts;
+    let out = input;
+    for (const s of secrets) {
+        if (s && out.includes(s))
+            out = out.split(s).join(REDACTED);
+    }
+    for (const re of PLAINTEXT_PATTERNS) {
+        out = out.replace(re, REDACTED);
+    }
+    return out;
+}
+export function redactJsonString(json, opts) {
+    if (!json)
+        return json ?? null;
+    try {
+        const parsed = JSON.parse(json);
+        return JSON.stringify(redactValue(parsed, opts));
+    }
+    catch {
+        return redactString(json, opts);
+    }
+}

package/dist/server/selfupdate/index.js

@@ -0,0 +1,154 @@
+// Self-update: check the npm registry for newer versions and update the
+// globally installed package in place. Docker deployments are excluded —
+// their version comes from the image tag and updates happen by pulling a new
+// image, never by installing over the running container.
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+import { execa } from 'execa';
+import semver from 'semver';
+import { getLogger } from '../logging/logger.js';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+// Pure: compare two semver versions. Returns null when either side is not a
+// valid semver string (e.g. dev builds), which callers treat as "no update".
+export function compareUpdate(currentVersion, latestVersion) {
+    const cur = semver.valid(semver.coerce(currentVersion));
+    const latest = semver.valid(semver.coerce(latestVersion));
+    if (!cur || !latest)
+        return null;
+    return semver.gt(latest, cur);
+}
+// Pure: derive the global-install command from where npm resolves its own
+// executable. When the gateway was installed globally with pnpm/yarn/bun,
+// those tools still run `npm exec`/npx under the hood, so
+// process.env.npm_execpath carries the invoking package manager's script.
+export function resolvePackageManager(npmExecPath) {
+    const pm = npmExecPath ? path.basename(npmExecPath).toLowerCase() : '';
+    if (pm.startsWith('pnpm'))
+        return { pm: 'pnpm', installArgs: (pkg) => ['add', '-g', pkg] };
+    if (pm.startsWith('yarn'))
+        return { pm: 'yarn', installArgs: (pkg) => ['global', 'add', pkg] };
+    if (pm.startsWith('bun'))
+        return { pm: 'bun', installArgs: (pkg) => ['add', '-g', pkg] };
+    return { pm: 'npm', installArgs: (pkg) => ['install', '-g', pkg] };
+}
+export class SelfUpdater {
+    packageName;
+    currentVersion;
+    inDocker = fs.existsSync('/.dockerenv');
+    cached = null;
+    updating = false;
+    constructor(packageName, currentVersion) {
+        this.packageName = packageName;
+        this.currentVersion = currentVersion;
+    }
+    status() {
+        if (this.inDocker) {
+            return { available: false, reason: 'Docker deployment — update by pulling the new image tag', updating: this.updating, docker: true };
+        }
+        if (this.updating)
+            return { available: false, reason: 'Update already running', updating: true, docker: false };
+        return { available: true, reason: null, updating: false, docker: false };
+    }
+    // Checks the npm registry (10s timeout). Cached for 15 minutes; a failed
+    // check never raises — it just reports no update.
+    async check(force = false) {
+        const fresh = !force &&
+            this.cached &&
+            Date.now() - new Date(this.cached.checkedAt).getTime() < 15 * 60 * 1000;
+        if (fresh)
+            return this.cached;
+        try {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), 10_000);
+            const res = await fetch(`https://registry.npmjs.org/${this.packageName}/latest`, {
+                signal: controller.signal,
+                headers: { accept: 'application/json' },
+            });
+            clearTimeout(timer);
+            const meta = (res.ok ? (await res.json()) : {});
+            const coerced = typeof meta.version === 'string' ? semver.coerce(meta.version) : null;
+            const latest = coerced && semver.valid(coerced) ? coerced.version : null;
+            const tarball = meta.dist?.tarball ?? null;
+            const result = {
+                currentVersion: this.currentVersion,
+                latestVersion: latest,
+                hasUpdate: latest ? compareUpdate(this.currentVersion, latest) === true : false,
+                // registry.npmjs.org serves package files (including CHANGELOG.md)
+                // straight from the tarball URL.
+                changelogUrl: tarball ? tarball.replace(/\/-\/.+$/, '/-/CHANGELOG.md') : null,
+                checkedAt: new Date().toISOString(),
+            };
+            this.cached = result;
+            return result;
+        }
+        catch (e) {
+            getLogger().warn({ err: e.message }, 'update check failed');
+            return {
+                currentVersion: this.currentVersion,
+                latestVersion: null,
+                hasUpdate: false,
+                changelogUrl: null,
+                checkedAt: new Date().toISOString(),
+            };
+        }
+    }
+    // Installs the latest version globally with the detected package manager,
+    // then terminates the process so the supervisor (systemd, pm2, Docker
+    // restart policy…) restarts us on the new version.
+    async run() {
+        const st = this.status();
+        if (!st.available)
+            throw new Error(st.reason ?? 'Update not available');
+        const check = await this.check(true);
+        if (!check.latestVersion || !check.hasUpdate)
+            throw new Error('No update available');
+        this.updating = true;
+        const log = getLogger();
+        try {
+            const { pm, installArgs } = resolvePackageManager(process.env.npm_execpath);
+            log.info({ pm, pkg: this.packageName, to: check.latestVersion }, 'self-update: installing new version');
+            await execa(pm, installArgs(`${this.packageName}@${check.latestVersion}`), {
+                stdio: 'inherit',
+                timeout: 5 * 60 * 1000,
+            });
+            log.info({ from: this.currentVersion, to: check.latestVersion }, 'self-update: installed, restarting');
+            // Graceful exit: Fastify/supervisor restart policies bring the new
+            // version up. (When there is no supervisor the process simply stops —
+            // the install already succeeded.)
+            setTimeout(() => process.exit(0), 500).unref();
+            return { ok: true, message: `Updated ${this.currentVersion} → ${check.latestVersion}. Restarting…` };
+        }
+        finally {
+            // If the install failed, allow retries.
+            setTimeout(() => { this.updating = false; }, 2000).unref();
+        }
+    }
+}
+// The running version: walk up from this file to the first package.json
+// (works from dist/server/selfupdate AND the source tree, and in Docker
+// where npm_package_version is unset) and fall back to the npm-injected
+// env var.
+function readInstalledVersion() {
+    let dir = __dirname;
+    for (let i = 0; i < 6; i++) {
+        try {
+            const v = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).version;
+            if (v)
+                return v;
+        }
+        catch { /* keep climbing */ }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return process.env.npm_package_version ?? '0.0.0';
+}
+let updater = null;
+export function getSelfUpdater() {
+    if (!updater)
+        updater = new SelfUpdater('ldrouter', readInstalledVersion());
+    return updater;
+}

package/dist/server/upstream/client.js

@@ -0,0 +1,179 @@
+// Upstream HTTP client: streaming + non-streaming with timeouts and error normalization.
+import { decryptSecret, decryptCustomHeaders } from '../auth/crypto.js';
+import { GatewayError } from '../errors.js';
+import { buildHeaders, stripSlash } from '../providers/index.js';
+export function providerToUpstreamConfig(p) {
+    return {
+        type: p.type,
+        baseUrl: p.baseUrl,
+        apiKey: decryptSecret({ ciphertext: p.encryptedApiKey, nonce: p.apiKeyNonce, version: p.apiKeyVersion }),
+        customHeaders: decryptCustomHeaders(p.customHeadersEncrypted && p.customHeadersNonce
+            ? { ciphertext: p.customHeadersEncrypted, nonce: p.customHeadersNonce, version: 1 }
+            : null),
+        connectTimeoutMs: p.connectTimeoutMs,
+        firstTokenTimeoutMs: p.firstTokenTimeoutMs,
+        streamIdleTimeoutMs: p.streamIdleTimeoutMs,
+        totalTimeoutMs: p.totalTimeoutMs,
+    };
+}
+export async function callUpstreamNonStreaming(cfg, url, payload) {
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), cfg.totalTimeoutMs);
+    const start = Date.now();
+    try {
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: { ...buildHeaders(cfg), 'content-type': 'application/json', accept: 'application/json' },
+            body: JSON.stringify(payload),
+            signal: ctl.signal,
+        });
+        const text = await res.text();
+        const ttft = Date.now() - start;
+        return {
+            status: res.status,
+            ok: res.ok,
+            text,
+            headers: Object.fromEntries(res.headers.entries()),
+            upstreamRequestId: extractUpstreamRequestId(res.headers),
+            ttftMs: ttft,
+        };
+    }
+    catch (e) {
+        const err = e;
+        if (err.name === 'AbortError') {
+            throw new GatewayError('timeout_error', 'Upstream request timed out', { status: 504, cause: e });
+        }
+        throw new GatewayError('upstream_unavailable', `Upstream connection failed: ${err.message}`, { status: 502, cause: e });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export function extractUpstreamRequestId(headers) {
+    if (headers instanceof Headers) {
+        return headers.get('x-request-id') ?? headers.get('request-id') ?? headers.get('x-amzn-requestid') ?? null;
+    }
+    return headers['x-request-id'] ?? headers['request-id'] ?? headers['x-amzn-requestid'] ?? null;
+}
+/**
+ * Call upstream with SSE streaming. Invokes onChunk for each SSE event.
+ * Returns a promise resolving when the stream completes or rejects on failure.
+ */
+export async function callUpstreamStreaming(cfg, url, payload, onChunk) {
+    const ctl = new AbortController();
+    const totalTimer = setTimeout(() => ctl.abort(), cfg.totalTimeoutMs);
+    const start = Date.now();
+    let ttft = null;
+    let firstTokenTimer = null;
+    let idleTimer = null;
+    const resetIdle = () => {
+        if (idleTimer)
+            clearTimeout(idleTimer);
+        idleTimer = setTimeout(() => ctl.abort(), cfg.streamIdleTimeoutMs);
+    };
+    try {
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: { ...buildHeaders(cfg), 'content-type': 'application/json', accept: 'text/event-stream' },
+            body: JSON.stringify(payload),
+            signal: ctl.signal,
+        });
+        if (!res.ok || !res.body) {
+            const text = await res.text();
+            throw new UpstreamHttpError(res.status, text, extractUpstreamRequestId(res.headers));
+        }
+        // First-token watchdog
+        firstTokenTimer = setTimeout(() => ctl.abort(), cfg.firstTokenTimeoutMs);
+        resetIdle();
+        const reader = res.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = '';
+        let isFirst = true;
+        let done = false;
+        while (!done) {
+            const { value, done: streamDone } = await reader.read();
+            done = streamDone;
+            if (done)
+                break;
+            buffer += decoder.decode(value, { stream: true });
+            // Process complete SSE events (split on blank line)
+            let idx;
+            while ((idx = buffer.indexOf('\n\n')) >= 0) {
+                const rawEvent = buffer.slice(0, idx);
+                buffer = buffer.slice(idx + 2);
+                const lines = rawEvent.split('\n');
+                let data = '';
+                let event = 'message';
+                for (const line of lines) {
+                    if (line.startsWith('data:'))
+                        data = line.slice(5).trimStart();
+                    else if (line.startsWith('event:'))
+                        event = line.slice(6).trimStart();
+                }
+                if (data === '[DONE]') {
+                    done = true;
+                    break;
+                }
+                if (data) {
+                    if (ttft === null) {
+                        ttft = Date.now() - start;
+                        if (firstTokenTimer)
+                            clearTimeout(firstTokenTimer);
+                    }
+                    resetIdle();
+                    onChunk({ data, event }, isFirst);
+                    isFirst = false;
+                }
+            }
+        }
+        return {
+            headers: Object.fromEntries(res.headers.entries()),
+            upstreamRequestId: extractUpstreamRequestId(res.headers),
+            ttftMs: ttft ?? Date.now() - start,
+        };
+    }
+    catch (e) {
+        if (e instanceof UpstreamHttpError) {
+            if (e.status >= 500)
+                throw new GatewayError('upstream_error', `Upstream HTTP ${e.status}`, { status: 502, cause: e, code: 'upstream_http_' + e.status });
+            if (e.status === 429)
+                throw new GatewayError('upstream_rate_limit', 'Upstream rate limited', { status: 529, cause: e });
+            if (e.status === 401 || e.status === 403)
+                throw new GatewayError('upstream_auth_error', 'Upstream authentication failed', { status: 502, cause: e });
+            throw new GatewayError('upstream_error', `Upstream HTTP ${e.status}: ${e.bodyExcerpt}`, { status: 502, cause: e });
+        }
+        const err = e;
+        if (err.name === 'AbortError') {
+            if (ttft === null && firstTokenTimer) {
+                throw new GatewayError('timeout_error', 'Upstream first token timeout', { status: 504, cause: e });
+            }
+            throw new GatewayError('timeout_error', 'Upstream stream idle timeout', { status: 504, cause: e });
+        }
+        throw new GatewayError('upstream_unavailable', `Upstream connection failed: ${err.message}`, { status: 502, cause: e });
+    }
+    finally {
+        clearTimeout(totalTimer);
+        if (firstTokenTimer)
+            clearTimeout(firstTokenTimer);
+        if (idleTimer)
+            clearTimeout(idleTimer);
+    }
+}
+export class UpstreamHttpError extends Error {
+    status;
+    body;
+    requestId;
+    constructor(status, body, requestId) {
+        super(`Upstream HTTP ${status}`);
+        this.status = status;
+        this.body = body;
+        this.requestId = requestId;
+        this.name = 'UpstreamHttpError';
+    }
+    get bodyExcerpt() {
+        return this.body.slice(0, 500);
+    }
+}
+export function upstreamUrl(cfg, path) {
+    return `${stripSlash(cfg.baseUrl)}${path.startsWith('/') ? path : '/' + path}`;
+}

package/dist/server/util/cidr.js

@@ -0,0 +1,91 @@
+// CIDR matching for IPv4 + IPv6.
+import ipaddr from 'ipaddr.js';
+export function parseCidr(input) {
+    const cidr = input.trim();
+    if (!cidr)
+        throw new Error('empty cidr');
+    let base;
+    let prefix;
+    if (cidr.includes('/')) {
+        const parts = cidr.split('/');
+        base = parts[0];
+        prefix = Number(parts[1]);
+    }
+    else {
+        base = cidr;
+        prefix = -1; // -1 = single host, normalized
+    }
+    const parsed = ipaddr.parse(base);
+    const family = parsed.kind() === 'ipv4' ? 'ipv4' : 'ipv6';
+    if (prefix === -1) {
+        prefix = family === 'ipv4' ? 32 : 128;
+    }
+    if (family === 'ipv4' && (prefix < 0 || prefix > 32))
+        throw new Error('invalid ipv4 prefix');
+    if (family === 'ipv6' && (prefix < 0 || prefix > 128))
+        throw new Error('invalid ipv6 prefix');
+    const normalized = `${parsed.toString()}/${prefix}`;
+    return {
+        cidr: normalized,
+        family,
+        prefix,
+        matches(ip) {
+            try {
+                const addr = ipaddr.parse(ip);
+                const addrKind = addr.kind();
+                if (addrKind === family) {
+                    return samePrefix(parsed, addr, prefix);
+                }
+                // IPv4-mapped IPv6 (::ffff:a.b.c.d) satisfies IPv4 CIDR rules.
+                if (family === 'ipv4' && addrKind === 'ipv6') {
+                    const v4 = addr.toIPv4Address();
+                    if (!v4)
+                        return false;
+                    return samePrefix(parsed, v4, prefix);
+                }
+                return false;
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+}
+function samePrefix(a, b, prefix) {
+    const aBytes = octets(a);
+    const bBytes = octets(b);
+    const full = aBytes.length * 8;
+    if (prefix === 0)
+        return true;
+    if (prefix >= full)
+        return a.toString() === b.toString();
+    const fullBytes = Math.floor(prefix / 8);
+    const remBits = prefix % 8;
+    for (let i = 0; i < fullBytes; i++) {
+        if (aBytes[i] !== bBytes[i])
+            return false;
+    }
+    if (remBits === 0)
+        return true;
+    const mask = (0xff << (8 - remBits)) & 0xff;
+    return (aBytes[fullBytes] & mask) === (bBytes[fullBytes] & mask);
+}
+function octets(a) {
+    if (a.kind() === 'ipv4') {
+        return a.toByteArray();
+    }
+    return a.toByteArray();
+}
+export function ipMatchesAny(ip, cidrs) {
+    for (const c of cidrs) {
+        try {
+            const parsed = parseCidr(c);
+            if (parsed.matches(ip))
+                return true;
+        }
+        catch {
+            // ignore invalid cidr
+        }
+    }
+    return false;
+}

package/dist/server/util/client-ip.js

@@ -0,0 +1,15 @@
+// Client-IP resolution: trust X-Forwarded-For only when trustProxyHops > 0.
+import { loadConfig } from '../config/index.js';
+export function resolveClientIp(req) {
+    const cfg = loadConfig();
+    if (cfg.trustProxyHops > 0) {
+        const xff = req.headers['x-forwarded-for'];
+        if (typeof xff === 'string') {
+            const chain = xff.split(',').map((s) => s.trim()).filter(Boolean);
+            const idx = Math.max(0, chain.length - cfg.trustProxyHops);
+            if (chain[idx])
+                return chain[idx];
+        }
+    }
+    return req.ip || (req.socket?.remoteAddress ?? '0.0.0.0');
+}

package/dist/server/util/stable-json.js

@@ -0,0 +1,19 @@
+// Stable deterministic JSON serialization for cache key derivation.
+export function stableStringify(value) {
+    return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+    if (value === null || value === undefined)
+        return value;
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (typeof value === 'object') {
+        const obj = value;
+        const sorted = {};
+        for (const k of Object.keys(obj).sort()) {
+            sorted[k] = sortKeys(obj[k]);
+        }
+        return sorted;
+    }
+    return value;
+}

package/dist/shared/types.js

@@ -0,0 +1,2 @@
+// Shared public types between server and web admin UI.
+export {};