Gatekeeper

npm install @mira.network/gatekeeper

import { Hono } from 'hono';
import {
  init,
  auth,
  rateLimit,
  type AuthContext,
  type MiraContext,
} from '@mira.network/gatekeeper';

const app = new Hono<{
  Bindings: Env;
  Variables: { auth: AuthContext; mira: MiraContext };
}>();

// 1. Initialize Mira context (top of middleware stack)
app.use('/*', init((c) => ({
  serviceId: 'verify',  // Required: 'verify' or 'inference'
  aiGateway: {
    accountId: c.env.CF_ACCOUNT_ID,
    gatewayId: c.env.CF_GATEWAY_ID,
    token: c.env.CF_AI_GATEWAY_TOKEN,
  },
})));

// 2. Apply auth and rate limiting to protected routes
app.use('/api/*', auth());
app.use('/api/*', rateLimit({ rpm: 60, rpd: 1000 }));

app.post('/api/endpoint', (c) => {
  const { traceId, serviceId, openai } = c.get('mira');
  const { keyId, appId } = c.get('auth');

  // Use pre-configured OpenAI client
  // All requests include traceId, serviceId + auth metadata in AI Gateway logs

  return c.json({ message: 'Success!' });
});

export default app;

interface Env {
  // AI Gateway configuration
  CF_ACCOUNT_ID: string;
  CF_GATEWAY_ID: string;
  CF_AI_GATEWAY_TOKEN: string;

  // Service bindings
  CONSOLE_SERVICE: Service;  // For API key validation
  RATE_LIMIT_KV: KVNamespace; // For rate limit state
}

const mira = c.get('mira');
// {
//   traceId: string;           // Unique request ID (UUID)
//   serviceId: string;         // Service identifier ('verify' | 'inference')
//   openai: OpenAI;            // Pre-configured OpenAI client
//   _aiGatewayConfig: {...};   // Internal config
// }

const auth = c.get('auth');
// {
//   keyId: string;   // API key identifier
//   appId: string;   // App identifier
//   userId: string;  // User identifier
// }