fix(federation/client): pin Step-CA root, fix lockfile, harden cache test

CRIT-1: regenerate pnpm-lock.yaml so apps/gateway resolves [email protected].6
(prior PR pushed package.json without lockfile update; CI failed with
ERR_PNPM_OUTDATED_LOCKFILE). Incidentally cleans 57 lines of stale
peer-dep entries.

CRIT-2: cache-hit test no longer swallows resolveEntry errors. Calls the
private method directly twice and asserts identity equality plus a
single DB select, removing the silent-failure path the prior assertion
allowed.

HIGH-1: mTLS Agent now pins Step-CA root via STEP_CA_ROOT_CERT_PATH.
Without the env var resolveEntry throws PEER_MISCONFIGURED, refusing to
dial peers against the public trust store. PEM is read once and cached
on the service instance.

Co-Authored-By: Claude Opus 4.7 <[email protected]>
This commit is contained in:
2026-04-23 22:30:09 -05:00
co-authored by Claude Opus 4.7
parent 21650fb194
commit a4a6769a6d
3 changed files with 87 additions and 82 deletions
+7 -57
View File
@@ -179,6 +179,9 @@ importers:
socket.io:
specifier: ^4.8.0
version: 4.8.3
undici:
specifier: ^7.24.6
version: 7.24.6
uuid:
specifier: ^11.0.0
version: 11.1.0
@@ -713,10 +716,10 @@ importers:
dependencies:
'@mariozechner/pi-agent-core':
specifier: ^0.63.1
version: 0.63.2(@modelcontextprotocol/[email protected]([email protected]))([email protected])(zod@3.25.76)
version: 0.63.2(@modelcontextprotocol/[email protected]([email protected]))([email protected])(zod@4.3.6)
'@mariozechner/pi-ai':
specifier: ^0.63.1
version: 0.63.2(@modelcontextprotocol/[email protected]([email protected]))([email protected])(zod@3.25.76)
version: 0.63.2(@modelcontextprotocol/[email protected]([email protected]))([email protected])(zod@4.3.6)
'@sinclair/typebox':
specifier: ^0.34.41
version: 0.34.48
@@ -6993,10 +6996,6 @@ packages:
resolution: {integrity: sha512-gBLkYIlEnSp8pFbT64yFgGE6UIB9tAkhukC23PmMDCe5Nd+cRqKxSjw5y54MK2AZMgZfJWMaNE4nYUHgi1XEOw==}
engines: {node: '>=18.17'}
[email protected]:
resolution: {integrity: sha512-eJdUmK/Wrx2d+mnWWmwwLRyA7OQCkLap60sk3dOK4ViZR7DKwwptwuIvFBg2HaiP9ESaEdhtpSymQPvytpmkCA==}
engines: {node: '>=20.18.1'}
[email protected]:
resolution: {integrity: sha512-Xi4agocCbRzt0yYMZGMA6ApD7gvtUFaxm4ZmeacWI4cZxaF6C+8I8QfofC20NAePiB/IcvZmzkJ7XPa471AEtA==}
engines: {node: '>=20.18.1'}
@@ -7329,12 +7328,6 @@ snapshots:
'@jridgewell/gen-mapping': 0.3.13
'@jridgewell/trace-mapping': 0.3.31
'@anthropic-ai/[email protected]([email protected])':
dependencies:
json-schema-to-ts: 3.1.1
optionalDependencies:
zod: 3.25.76
'@anthropic-ai/[email protected]([email protected])':
dependencies:
json-schema-to-ts: 3.1.1
@@ -8676,18 +8669,6 @@ snapshots:
- ws
- zod
'@mariozechner/[email protected](@modelcontextprotocol/[email protected]([email protected]))([email protected])([email protected])':
dependencies:
'@mariozechner/pi-ai': 0.63.2(@modelcontextprotocol/[email protected]([email protected]))([email protected])([email protected])
transitivePeerDependencies:
- '@modelcontextprotocol/sdk'
- aws-crt
- bufferutil
- supports-color
- utf-8-validate
- ws
- zod
'@mariozechner/[email protected](@modelcontextprotocol/[email protected]([email protected]))([email protected])([email protected])':
dependencies:
'@mariozechner/pi-ai': 0.63.2(@modelcontextprotocol/[email protected]([email protected]))([email protected])([email protected])
@@ -8736,30 +8717,6 @@ snapshots:
- ws
- zod
'@mariozechner/[email protected](@modelcontextprotocol/[email protected]([email protected]))([email protected])([email protected])':
dependencies:
'@anthropic-ai/sdk': 0.73.0([email protected])
'@aws-sdk/client-bedrock-runtime': 3.1008.0
'@google/genai': 1.45.0(@modelcontextprotocol/[email protected]([email protected]))
'@mistralai/mistralai': 1.14.1
'@sinclair/typebox': 0.34.48
ajv: 8.18.0
ajv-formats: 3.0.1([email protected])
chalk: 5.6.2
openai: 6.26.0([email protected])([email protected])
partial-json: 0.1.7
proxy-agent: 6.5.0
undici: 7.24.3
zod-to-json-schema: 3.25.1([email protected])
transitivePeerDependencies:
- '@modelcontextprotocol/sdk'
- aws-crt
- bufferutil
- supports-color
- utf-8-validate
- ws
- zod
'@mariozechner/[email protected](@modelcontextprotocol/[email protected]([email protected]))([email protected])([email protected])':
dependencies:
'@anthropic-ai/sdk': 0.73.0([email protected])
@@ -8773,7 +8730,7 @@ snapshots:
openai: 6.26.0([email protected])([email protected])
partial-json: 0.1.7
proxy-agent: 6.5.0
undici: 7.24.3
undici: 7.24.6
zod-to-json-schema: 3.25.1([email protected])
transitivePeerDependencies:
- '@modelcontextprotocol/sdk'
@@ -12632,7 +12589,7 @@ snapshots:
saxes: 6.0.0
symbol-tree: 3.2.4
tough-cookie: 6.0.1
undici: 7.24.3
undici: 7.24.6
w3c-xmlserializer: 5.0.0
webidl-conversions: 8.0.1
whatwg-mimetype: 5.0.0
@@ -13352,11 +13309,6 @@ snapshots:
dependencies:
mimic-function: 5.0.1
[email protected]([email protected])([email protected]):
optionalDependencies:
ws: 8.20.0
zod: 3.25.76
[email protected]([email protected])([email protected]):
optionalDependencies:
ws: 8.20.0
@@ -14488,8 +14440,6 @@ snapshots:
[email protected]: {}
[email protected]: {}
[email protected]: {}
[email protected]: {}