feat: add support for split config in cdn

[pepol]

Summary by CodeRabbit

• New Features

  • Added new manifest upload endpoints under /manifest/ for mapper configuration, latest versions, and feature flags.
  • Introduced feature-gating for split-config-loading to control access to new manifest endpoints.
  • Enhanced JWT authentication to support feature claims for granular access control.

• Tests

  • Added comprehensive tests for new manifest endpoints and feature-gating behavior.

Checklist

• I have discussed my proposed changes in an issue and have received approval to proceed.
• I have followed the coding standards of the project.
• Tests or benchmarks have been added or updated.
• Documentation has been updated on https://github.com/wundergraph/docs-website.
• I have read the Contributors Guide.

Open Source AI Manifesto

This project follows the principles of the Open Source AI Manifesto. Please ensure your contribution aligns with its principles.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: fddddb9d-38d9-4825-b1c4-e5d8438ff301

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• ✅ Review completed - (🔄 Check again to review again)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cdn-server/cdn/src/index.ts`:
- Around line 381-382: The manifestBlob helper currently calls "const body =
await c.req.json()" without handling malformed/empty JSON; wrap the await
c.req.json() call in a try-catch inside manifestBlob (and any call sites) and on
a SyntaxError return a 400 response with a clear client error message (instead
of letting it throw a 500). Validate that body is present/has required fields
after parsing and return a 400 for missing/invalid payloads; rethrow or
propagate non-SyntaxError exceptions as appropriate. Ensure the changes
reference the manifestBlob helper and the POST manifest endpoints that invoke it
so the error handling covers all three new routes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8cfc60d7-fcd2-4637-a4c0-ec0e1848faf3

📥 Commits

Reviewing files that changed from the base of the PR and between 6bf713b and c0e21c5.

📒 Files selected for processing (2)

• cdn-server/cdn/src/index.ts
• cdn-server/cdn/test/cdn.test.ts

[Aenimus]

LGTM!