veryfront 0.1.1067 → 0.1.1069

package/esm/src/proxy/routing-invalidation-redis.js

@@ -0,0 +1,394 @@
+import * as dntShim from "../../_dnt.shims.js";
+import { getRedisModule } from "../platform/adapters/redis/modules.js";
+import { getEnv } from "../platform/compat/process.js";
+const ROUTING_INVALIDATION_CHANNEL = "vf-proxy-routing-invalidations-v1";
+const ROUTING_INVALIDATION_ACK_PREFIX = `${ROUTING_INVALIDATION_CHANNEL}:ack:`;
+const DEFAULT_ACKNOWLEDGEMENT_TIMEOUT_MS = 1_500;
+const DEFAULT_CONNECT_TIMEOUT_MS = 3_000;
+const MAX_RECONNECT_ATTEMPTS = 5;
+const MAX_RECENT_EVENT_IDS = 1_000;
+const MAX_SIGNED_ENVELOPE_BYTES = 24 * 1024;
+const MAX_SIGNED_PAYLOAD_BYTES = 16 * 1024;
+const DEFAULT_MAX_ENVELOPE_AGE_MS = 60_000;
+const DEFAULT_MAX_ENVELOPE_FUTURE_MS = 5_000;
+const INTEGRITY_SECRET_ENV_VAR = "VERYFRONT_PROXY_ROUTING_INVALIDATION_SECRET";
+const EVENT_SIGNATURE_DOMAIN = "vf-proxy-routing-invalidation:event:v1";
+const ACK_SIGNATURE_DOMAIN = "vf-proxy-routing-invalidation:ack:v1";
+function positiveInteger(value, fallback) {
+    const parsed = Number(value);
+    return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+}
+function encodedByteLength(value) {
+    return new TextEncoder().encode(value).byteLength;
+}
+function parseSignedEnvelope(message) {
+    if (encodedByteLength(message) > MAX_SIGNED_ENVELOPE_BYTES)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(message);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return null;
+    const envelope = parsed;
+    if (envelope.version !== 1 ||
+        typeof envelope.issuedAtMs !== "number" ||
+        !Number.isInteger(envelope.issuedAtMs) ||
+        envelope.issuedAtMs <= 0 ||
+        typeof envelope.payload !== "string" ||
+        encodedByteLength(envelope.payload) > MAX_SIGNED_PAYLOAD_BYTES ||
+        typeof envelope.signature !== "string" ||
+        envelope.signature.length < 32 ||
+        envelope.signature.length > 128) {
+        return null;
+    }
+    return envelope;
+}
+function signatureDomainPrefix(domain) {
+    return domain === "event" ? EVENT_SIGNATURE_DOMAIN : ACK_SIGNATURE_DOMAIN;
+}
+function signatureInput(domain, issuedAtMs, payload) {
+    const encoded = new TextEncoder().encode(`${signatureDomainPrefix(domain)}\0${issuedAtMs}\0${payload}`);
+    return encoded.buffer.slice(encoded.byteOffset, encoded.byteOffset + encoded.byteLength);
+}
+function base64UrlEncode(bytes) {
+    const binary = Array.from(new Uint8Array(bytes), (byte) => String.fromCharCode(byte)).join("");
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+}
+function base64UrlDecode(value) {
+    if (!/^[A-Za-z0-9_-]+$/u.test(value))
+        return null;
+    const padded = value.replaceAll("-", "+").replaceAll("_", "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+    try {
+        return Uint8Array.from(atob(padded), (char) => char.charCodeAt(0)).buffer;
+    }
+    catch {
+        return null;
+    }
+}
+async function createHmacKey(secret) {
+    return dntShim.crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+}
+async function signPayload(key, domain, issuedAtMs, payload) {
+    return base64UrlEncode(await dntShim.crypto.subtle.sign("HMAC", key, signatureInput(domain, issuedAtMs, payload)));
+}
+async function verifyPayloadSignature(key, domain, issuedAtMs, payload, signature) {
+    const signatureBytes = base64UrlDecode(signature);
+    if (!signatureBytes)
+        return false;
+    return await dntShim.crypto.subtle.verify("HMAC", key, signatureBytes, signatureInput(domain, issuedAtMs, payload));
+}
+async function serializeSignedEnvelope(key, domain, payload, now) {
+    if (encodedByteLength(payload) > MAX_SIGNED_PAYLOAD_BYTES) {
+        throw new Error("Proxy routing invalidation payload is too large");
+    }
+    const issuedAtMs = Math.trunc(now());
+    return JSON.stringify({
+        version: 1,
+        issuedAtMs,
+        payload,
+        signature: await signPayload(key, domain, issuedAtMs, payload),
+    });
+}
+async function verifySignedEnvelope(key, domain, message, now) {
+    const envelope = parseSignedEnvelope(message);
+    if (!envelope)
+        return null;
+    const currentTimeMs = now();
+    if (envelope.issuedAtMs < currentTimeMs - DEFAULT_MAX_ENVELOPE_AGE_MS ||
+        envelope.issuedAtMs > currentTimeMs + DEFAULT_MAX_ENVELOPE_FUTURE_MS) {
+        return null;
+    }
+    const verified = await verifyPayloadSignature(key, domain, envelope.issuedAtMs, envelope.payload, envelope.signature);
+    return verified ? envelope.payload : null;
+}
+function parseEvent(message) {
+    if (encodedByteLength(message) > MAX_SIGNED_PAYLOAD_BYTES)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(message);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return null;
+    const event = parsed;
+    if (event.version !== 1 ||
+        typeof event.eventId !== "string" || !event.eventId ||
+        typeof event.projectId !== "string" || !event.projectId ||
+        typeof event.projectSlug !== "string" || !event.projectSlug ||
+        typeof event.deploymentId !== "string" || !event.deploymentId ||
+        typeof event.environmentId !== "string" || !event.environmentId ||
+        typeof event.environmentName !== "string" || !event.environmentName ||
+        typeof event.releaseId !== "string" || !event.releaseId) {
+        return null;
+    }
+    return event;
+}
+function parseAcknowledgement(message) {
+    if (encodedByteLength(message) > MAX_SIGNED_PAYLOAD_BYTES)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(message);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return null;
+    const acknowledgement = parsed;
+    if (typeof acknowledgement.eventId !== "string" || !acknowledgement.eventId ||
+        typeof acknowledgement.replicaId !== "string" || !acknowledgement.replicaId) {
+        return null;
+    }
+    return acknowledgement;
+}
+async function createDefaultClient(redisUrl) {
+    const { NodeRedis } = await getRedisModule();
+    if (!NodeRedis)
+        throw new Error("Redis client module is unavailable");
+    const createClient = NodeRedis.createClient;
+    return createClient({
+        url: redisUrl,
+        socket: {
+            connectTimeout: DEFAULT_CONNECT_TIMEOUT_MS,
+            reconnectStrategy: (retries) => retries >= MAX_RECONNECT_ATTEMPTS
+                ? new Error("Routing invalidation Redis reconnect limit reached")
+                : Math.min(100 * 2 ** retries, 1_000),
+        },
+    });
+}
+async function closeClient(client, logger) {
+    try {
+        await client.close();
+    }
+    catch (error) {
+        client.destroy();
+        logger?.warn("Failed to close routing invalidation Redis client cleanly", {
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+export async function startProxyRoutingInvalidationBus(options) {
+    const redisUrl = options.redisUrl === undefined ? getEnv("REDIS_URL") : options.redisUrl;
+    if (!redisUrl)
+        return null;
+    const integritySecret = options.integritySecret ?? getEnv(INTEGRITY_SECRET_ENV_VAR) ?? "";
+    if (!integritySecret)
+        return null;
+    const expectedReplicas = positiveInteger(options.expectedReplicas ?? getEnv("VERYFRONT_PROXY_EXPECTED_REPLICAS"), 1);
+    const acknowledgementTimeoutMs = positiveInteger(options.acknowledgementTimeoutMs, DEFAULT_ACKNOWLEDGEMENT_TIMEOUT_MS);
+    const replicaId = options.replicaId ?? getEnv("HOSTNAME") ?? dntShim.crypto.randomUUID();
+    const createClient = options.createClient ?? createDefaultClient;
+    const publishClient = await createClient(redisUrl);
+    const subscribeClient = await createClient(redisUrl);
+    const processedEventIds = new Set();
+    const eventProcessing = new Map();
+    const hmacKey = await createHmacKey(integritySecret);
+    const now = options.now ?? (() => Date.now());
+    const acknowledgementListeners = new Map();
+    const activeAcknowledgementChannels = new Set();
+    const closeWaiters = new Set();
+    let closed = false;
+    const waitForClose = () => {
+        if (closed)
+            return Promise.resolve();
+        return new Promise((resolve) => {
+            closeWaiters.add(resolve);
+        });
+    };
+    const resolveCloseWaiters = () => {
+        for (const resolve of closeWaiters)
+            resolve();
+        closeWaiters.clear();
+    };
+    const subscribeAcknowledgement = async (channel, listener) => {
+        let listeners = acknowledgementListeners.get(channel);
+        if (!listeners) {
+            listeners = new Set();
+            acknowledgementListeners.set(channel, listeners);
+            await subscribeClient.subscribe(channel, (message, receivedChannel) => {
+                if (receivedChannel !== channel)
+                    return;
+                for (const acknowledgementListener of listeners ?? []) {
+                    acknowledgementListener(message, receivedChannel);
+                }
+            });
+        }
+        listeners.add(listener);
+        activeAcknowledgementChannels.add(channel);
+    };
+    const unsubscribeAcknowledgement = async (channel, listener) => {
+        const listeners = acknowledgementListeners.get(channel);
+        if (!listeners)
+            return;
+        listeners.delete(listener);
+        if (listeners.size > 0)
+            return;
+        acknowledgementListeners.delete(channel);
+        activeAcknowledgementChannels.delete(channel);
+        if (!closed)
+            await subscribeClient.unsubscribe(channel);
+    };
+    const rememberProcessedEvent = (eventId) => {
+        processedEventIds.delete(eventId);
+        processedEventIds.add(eventId);
+        while (processedEventIds.size > MAX_RECENT_EVENT_IDS) {
+            const oldestEventId = processedEventIds.values().next().value;
+            if (!oldestEventId)
+                break;
+            processedEventIds.delete(oldestEventId);
+        }
+    };
+    const processEvent = (event) => {
+        if (processedEventIds.has(event.eventId))
+            return Promise.resolve();
+        const existing = eventProcessing.get(event.eventId);
+        if (existing)
+            return existing;
+        const processing = Promise.resolve()
+            .then(() => options.onInvalidate(event))
+            .then(() => {
+            rememberProcessedEvent(event.eventId);
+            eventProcessing.delete(event.eventId);
+        }, (error) => {
+            eventProcessing.delete(event.eventId);
+            throw error;
+        });
+        eventProcessing.set(event.eventId, processing);
+        return processing;
+    };
+    const logRedisError = (error) => {
+        options.logger?.error("Proxy routing invalidation Redis error", error instanceof Error ? error : new Error(String(error)));
+    };
+    publishClient.on?.("error", logRedisError);
+    subscribeClient.on?.("error", logRedisError);
+    try {
+        await Promise.all([publishClient.connect(), subscribeClient.connect()]);
+        await subscribeClient.subscribe(ROUTING_INVALIDATION_CHANNEL, (message, channel) => {
+            if (channel !== ROUTING_INVALIDATION_CHANNEL)
+                return;
+            void verifySignedEnvelope(hmacKey, "event", message, now)
+                .then((payload) => {
+                if (!payload || closed)
+                    return null;
+                const event = parseEvent(payload);
+                if (!event)
+                    return null;
+                return processEvent(event).then(async () => {
+                    if (closed)
+                        return;
+                    const acknowledgementPayload = JSON.stringify({ eventId: event.eventId, replicaId });
+                    await publishClient.publish(`${ROUTING_INVALIDATION_ACK_PREFIX}${event.eventId}`, await serializeSignedEnvelope(hmacKey, "ack", acknowledgementPayload, now));
+                });
+            })
+                .catch((error) => {
+                options.logger?.error("Failed to apply proxy routing invalidation", error instanceof Error ? error : new Error(String(error)));
+            });
+        });
+    }
+    catch (error) {
+        publishClient.destroy();
+        subscribeClient.destroy();
+        throw error;
+    }
+    options.logger?.info("Proxy routing invalidation bus connected", {
+        expectedReplicas,
+        replicaId,
+    });
+    return {
+        async publish(event) {
+            if (closed)
+                throw new Error("Proxy routing invalidation bus is closed");
+            const acknowledgementChannel = `${ROUTING_INVALIDATION_ACK_PREFIX}${event.eventId}`;
+            const acknowledgedReplicas = new Set();
+            let recipients = 0;
+            let resolveAcknowledged;
+            const acknowledgementReceived = new Promise((resolve) => {
+                resolveAcknowledged = resolve;
+            });
+            const acknowledgementListener = (message, channel) => {
+                if (channel !== acknowledgementChannel)
+                    return;
+                void verifySignedEnvelope(hmacKey, "ack", message, now)
+                    .then((payload) => {
+                    if (!payload)
+                        return;
+                    const acknowledgement = parseAcknowledgement(payload);
+                    if (!acknowledgement || acknowledgement.eventId !== event.eventId)
+                        return;
+                    acknowledgedReplicas.add(acknowledgement.replicaId);
+                    if (recipients > 0 && acknowledgedReplicas.size >= recipients) {
+                        resolveAcknowledged?.();
+                    }
+                })
+                    .catch((error) => {
+                    options.logger?.error("Failed to verify proxy routing invalidation acknowledgement", error instanceof Error ? error : new Error(String(error)), { eventId: event.eventId });
+                });
+            };
+            await subscribeAcknowledgement(acknowledgementChannel, acknowledgementListener);
+            try {
+                const eventPayload = JSON.stringify(event);
+                try {
+                    recipients = await publishClient.publish(ROUTING_INVALIDATION_CHANNEL, await serializeSignedEnvelope(hmacKey, "event", eventPayload, now));
+                }
+                catch (error) {
+                    if (!closed)
+                        throw error;
+                    return {
+                        acknowledged: acknowledgedReplicas.size,
+                        converged: false,
+                        recipients,
+                    };
+                }
+                if (recipients > 0 && acknowledgedReplicas.size >= recipients)
+                    resolveAcknowledged?.();
+                if (recipients > 0) {
+                    let timeout;
+                    await Promise.race([
+                        acknowledgementReceived,
+                        waitForClose(),
+                        new Promise((resolve) => {
+                            timeout = setTimeout(resolve, acknowledgementTimeoutMs);
+                        }),
+                    ]);
+                    if (timeout !== undefined)
+                        clearTimeout(timeout);
+                }
+                const acknowledged = acknowledgedReplicas.size;
+                return {
+                    acknowledged,
+                    converged: recipients >= expectedReplicas && acknowledged >= recipients,
+                    recipients,
+                };
+            }
+            finally {
+                await unsubscribeAcknowledgement(acknowledgementChannel, acknowledgementListener);
+            }
+        },
+        async close() {
+            if (closed)
+                return;
+            closed = true;
+            resolveCloseWaiters();
+            try {
+                await Promise.allSettled([
+                    subscribeClient.unsubscribe(ROUTING_INVALIDATION_CHANNEL),
+                    ...[...activeAcknowledgementChannels].map((channel) => subscribeClient.unsubscribe(channel)),
+                ]);
+            }
+            finally {
+                await Promise.all([
+                    closeClient(publishClient, options.logger),
+                    closeClient(subscribeClient, options.logger),
+                ]);
+            }
+        },
+    };
+}

package/esm/src/proxy/routing-invalidation.d.ts

@@ -0,0 +1,32 @@
+export declare const PROXY_ROUTING_INVALIDATION_PATH = "/_proxy/internal/routing-invalidation";
+export declare const PROXY_ROUTING_INVALIDATION_PLATFORM = "proxy-routing";
+export declare const PROXY_ROUTING_INVALIDATION_SUBJECT = "deployment-routing-invalidation";
+export interface ProxyRoutingInvalidationRequest {
+    version: 1;
+    projectId: string;
+    projectSlug: string;
+    deploymentId: string;
+    environmentId: string;
+    environmentName: string;
+    releaseId: string;
+}
+export interface ProxyRoutingInvalidationEvent extends ProxyRoutingInvalidationRequest {
+    eventId: string;
+}
+export interface ProxyRoutingInvalidationPublishResult {
+    acknowledged: number;
+    converged: boolean;
+    recipients: number;
+}
+export interface ProxyRoutingInvalidationPublisher {
+    publish(event: ProxyRoutingInvalidationEvent): Promise<ProxyRoutingInvalidationPublishResult>;
+}
+interface ProxyRoutingInvalidationHandlerOptions {
+    createEventId?: () => string;
+    publicKeyPem?: string;
+    publisher: ProxyRoutingInvalidationPublisher | null;
+}
+export declare function parseProxyRoutingInvalidationRequest(body: string): ProxyRoutingInvalidationRequest | null;
+export declare function handleProxyRoutingInvalidationRequest(req: Request, options: ProxyRoutingInvalidationHandlerOptions): Promise<Response>;
+export {};
+//# sourceMappingURL=routing-invalidation.d.ts.map

package/esm/src/proxy/routing-invalidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing-invalidation.d.ts","sourceRoot":"","sources":["../../../src/src/proxy/routing-invalidation.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,+BAA+B,0CAA0C,CAAC;AACvF,eAAO,MAAM,mCAAmC,kBAAkB,CAAC;AACnE,eAAO,MAAM,kCAAkC,oCAAoC,CAAC;AAOpF,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA8B,SAAQ,+BAA+B;IACpF,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qCAAqC;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,CACL,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,qCAAqC,CAAC,CAAC;CACnD;AAED,UAAU,sCAAsC;IAC9C,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,iCAAiC,GAAG,IAAI,CAAC;CACrD;AAkDD,wBAAgB,oCAAoC,CAClD,IAAI,EAAE,MAAM,GACX,+BAA+B,GAAG,IAAI,CA+BxC;AAED,wBAAsB,qCAAqC,CACzD,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,QAAQ,CAAC,CAqDnB"}

package/esm/src/proxy/routing-invalidation.js

@@ -0,0 +1,135 @@
+import * as dntShim from "../../_dnt.shims.js";
+import { verifyDispatchJws } from "../channels/control-plane.js";
+import { getHostEnv } from "../platform/compat/process.js";
+export const PROXY_ROUTING_INVALIDATION_PATH = "/_proxy/internal/routing-invalidation";
+export const PROXY_ROUTING_INVALIDATION_PLATFORM = "proxy-routing";
+export const PROXY_ROUTING_INVALIDATION_SUBJECT = "deployment-routing-invalidation";
+const DISPATCH_JWS_HEADER = "x-veryfront-dispatch-jws";
+const PUBLIC_KEY_ENV_VAR = "CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY";
+const MAX_SIGNATURE_AGE_SECONDS = 60;
+const MAX_REQUEST_BODY_BYTES = 16 * 1024;
+function jsonResponse(status, body) {
+    return Response.json(body, {
+        status,
+        headers: { "cache-control": "no-store" },
+    });
+}
+function nonEmptyString(value) {
+    return typeof value === "string" && value.length > 0;
+}
+async function readBoundedRequestBody(req) {
+    if (!req.body)
+        return { body: "" };
+    const reader = req.body.getReader();
+    const chunks = [];
+    let totalBytes = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            totalBytes += value.byteLength;
+            if (totalBytes > MAX_REQUEST_BODY_BYTES) {
+                await reader.cancel("Request body is too large").catch(() => undefined);
+                return { error: "too-large" };
+            }
+            chunks.push(value);
+        }
+    }
+    catch {
+        return { error: "unreadable" };
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(totalBytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return { body: new TextDecoder().decode(bytes) };
+}
+export function parseProxyRoutingInvalidationRequest(body) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return null;
+    const input = parsed;
+    if (input.version !== 1 ||
+        !nonEmptyString(input.projectId) ||
+        !nonEmptyString(input.projectSlug) ||
+        !nonEmptyString(input.deploymentId) ||
+        !nonEmptyString(input.environmentId) ||
+        !nonEmptyString(input.environmentName) ||
+        !nonEmptyString(input.releaseId)) {
+        return null;
+    }
+    return {
+        version: 1,
+        projectId: input.projectId,
+        projectSlug: input.projectSlug,
+        deploymentId: input.deploymentId,
+        environmentId: input.environmentId,
+        environmentName: input.environmentName,
+        releaseId: input.releaseId,
+    };
+}
+export async function handleProxyRoutingInvalidationRequest(req, options) {
+    if (req.method !== "POST") {
+        return new Response(null, { status: 405, headers: { allow: "POST" } });
+    }
+    const publicKeyPem = options.publicKeyPem ?? getHostEnv(PUBLIC_KEY_ENV_VAR) ?? "";
+    if (!publicKeyPem || !options.publisher) {
+        return jsonResponse(503, { error: "Routing invalidation is unavailable" });
+    }
+    const declaredLength = Number(req.headers.get("content-length") ?? 0);
+    if (Number.isFinite(declaredLength) && declaredLength > MAX_REQUEST_BODY_BYTES) {
+        return jsonResponse(413, { error: "Request body is too large" });
+    }
+    const bodyResult = await readBoundedRequestBody(req);
+    if ("error" in bodyResult && bodyResult.error === "too-large") {
+        return jsonResponse(413, { error: "Request body is too large" });
+    }
+    if ("error" in bodyResult) {
+        return jsonResponse(400, { error: "Invalid routing invalidation request" });
+    }
+    const { body } = bodyResult;
+    const input = parseProxyRoutingInvalidationRequest(body);
+    if (!input)
+        return jsonResponse(400, { error: "Invalid routing invalidation request" });
+    const jws = req.headers.get(DISPATCH_JWS_HEADER);
+    if (!jws)
+        return jsonResponse(401, { error: "Invalid routing invalidation signature" });
+    try {
+        await verifyDispatchJws(jws, body, {
+            audience: input.projectSlug,
+            expectedPlatform: PROXY_ROUTING_INVALIDATION_PLATFORM,
+            expectedProjectId: input.projectId,
+            expectedSubject: PROXY_ROUTING_INVALIDATION_SUBJECT,
+            maxAgeSeconds: MAX_SIGNATURE_AGE_SECONDS,
+            publicKeyPem,
+        });
+    }
+    catch {
+        return jsonResponse(401, { error: "Invalid routing invalidation signature" });
+    }
+    try {
+        const createEventId = options.createEventId ?? (() => dntShim.crypto.randomUUID());
+        const result = await options.publisher.publish({
+            eventId: createEventId(),
+            ...input,
+        });
+        return jsonResponse(result.converged ? 200 : 503, { ...result });
+    }
+    catch {
+        return jsonResponse(503, { error: "Routing invalidation did not converge" });
+    }
+}

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.1067";
+export declare const VERSION = "0.1.1069";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.1067";
+export const VERSION = "0.1.1069";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.1067",
+  "version": "0.1.1069",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",
@@ -328,10 +328,10 @@
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
     "ws": "8.21.0",
-    "@veryfront/ext-bundler-esbuild": "0.1.1067",
-    "@veryfront/ext-content-mdx": "0.1.1067",
-    "@veryfront/ext-css-tailwind": "0.1.1067",
-    "@veryfront/ext-parser-babel": "0.1.1067"
+    "@veryfront/ext-bundler-esbuild": "0.1.1069",
+    "@veryfront/ext-content-mdx": "0.1.1069",
+    "@veryfront/ext-css-tailwind": "0.1.1069",
+    "@veryfront/ext-parser-babel": "0.1.1069"
   },
   "devDependencies": {
     "@types/node": "20.9.0"