@lensmcp/cluster 1.0.0 → 1.1.0

package/executors/gateway/gateway.lib.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.lib.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/gateway.lib.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG9D,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAqE,KAAK,UAAU,EAAc,MAAM,YAAY,CAAC;AAE5H,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAKzC;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAiB3F;AAED,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAQ9F;AASD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACzE;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sGAAsG;IACtG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B;;iGAE6F;IAC7F,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,2FAA2F;IAC3F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,QAAQ;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAE1F,MAAM,WAAW,KAAK;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,2DAA2D;AAC3D,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAKD,uFAAuF;AACvF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,SAAO,GAAG,MAAM,GAAG,SAAS,CAa7E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAC1C,WAAW,SAAc,GACxB;IAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE,CA8C7C;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAulBxB"}
+{"version":3,"file":"gateway.lib.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/gateway.lib.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG9D,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAqE,KAAK,UAAU,EAAc,MAAM,YAAY,CAAC;AAE5H,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAKzC;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAiB3F;AAED,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAQ9F;AASD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACzE;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sGAAsG;IACtG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B;;iGAE6F;IAC7F,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,2FAA2F;IAC3F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,QAAQ;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAE1F,MAAM,WAAW,KAAK;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,2DAA2D;AAC3D,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAKD,uFAAuF;AACvF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,SAAO,GAAG,MAAM,GAAG,SAAS,CAa7E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAC1C,WAAW,SAAc,GACxB;IAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE,CA8C7C;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAwlBxB"}

package/executors/gateway/gateway.lib.js

@@ -253,6 +253,7 @@ async function startGateway(options, context) {
             const text = d.toString();
             for (const line of text.split('\n')) {
                 if (/ERROR in |error TS\d+|Found \d+ error|Unhandled 'error' event|EADDRINUSE/.test(line)) {
+                    // eslint-disable-next-line no-control-regex -- strip ANSI color codes from child output
                     svc.lastErrors.push(line.replace(/\x1b\[[0-9;]*m/g, '').trim());
                     if (svc.lastErrors.length > 12)
                         svc.lastErrors.shift();

package/executors/gateway/health-check.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Active upstream health-checking — opt-in. Periodically probes every known
+ * upstream URL and tracks healthy/unhealthy per endpoint, so the gateway routes
+ * a pooled service AROUND dead endpoints (instead of only discovering death
+ * passively, one failed request at a time) and the /statusz rollup reflects true
+ * liveness even with zero traffic.
+ *
+ * Liveness, not readiness: a probe is "healthy" when the endpoint ANSWERS with
+ * status < 500 — so a service without the health path still reads up on a 404;
+ * only a 5xx or a connection failure/timeout is down. New endpoints start
+ * optimistically healthy, so a not-yet-probed endpoint is never black-holed.
+ *
+ * Fail-open by design (see providers-prod `pick`): only multi-endpoint POOLS are
+ * health-filtered, and even then the gateway falls back to an unhealthy endpoint
+ * rather than 503 if a whole pool looks down — a checker false-positive must
+ * never take a service fully offline.
+ */
+export interface HealthCheckerOptions {
+    /** Probe path appended to each upstream URL. Default `/healthz`. */
+    path?: string;
+    /** Probe period (ms). Default 5000. */
+    intervalMs?: number;
+    /** Per-probe timeout (ms). Default 2000. */
+    timeoutMs?: number;
+    /** Consecutive failures before an endpoint is marked unhealthy. Default 2. */
+    unhealthyThreshold?: number;
+    /** Consecutive successes before a down endpoint is marked healthy again. Default 1. */
+    healthyThreshold?: number;
+    /** Injectable fetch (tests). Defaults to global fetch. */
+    fetchImpl?: typeof fetch;
+    /** Notified when an endpoint flips health. */
+    onChange?: (url: string, healthy: boolean) => void;
+}
+export interface EndpointHealth {
+    url: string;
+    healthy: boolean;
+    fails: number;
+    lastCheckedAt: number | null;
+}
+export interface HealthChecker {
+    /** Set the current URL set to monitor (called on every route rebuild). */
+    track(urls: string[]): void;
+    /** Current health (default true for an untracked / not-yet-probed URL). */
+    isHealthy(url: string): boolean;
+    /** Per-endpoint health for the status page. */
+    snapshot(): EndpointHealth[];
+    /** Probe every tracked URL once (used by start()'s loop and by tests). */
+    probeOnce(): Promise<void>;
+    start(): void;
+    stop(): void;
+}
+export declare function createHealthChecker(opts?: HealthCheckerOptions): HealthChecker;
+//# sourceMappingURL=health-check.d.ts.map

package/executors/gateway/health-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health-check.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/health-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,cAAc;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AAE9G,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC5B,2EAA2E;IAC3E,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,+CAA+C;IAC/C,QAAQ,IAAI,cAAc,EAAE,CAAC;IAC7B,0EAA0E;IAC1E,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,KAAK,IAAI,IAAI,CAAC;IACd,IAAI,IAAI,IAAI,CAAC;CACd;AAID,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,oBAAyB,GAAG,aAAa,CAyClF"}

package/executors/gateway/health-check.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createHealthChecker = createHealthChecker;
+function createHealthChecker(opts = {}) {
+    const path = opts.path ?? '/healthz';
+    const intervalMs = opts.intervalMs ?? 5000;
+    const timeoutMs = opts.timeoutMs ?? 2000;
+    const downAt = Math.max(1, opts.unhealthyThreshold ?? 2);
+    const upAt = Math.max(1, opts.healthyThreshold ?? 1);
+    const doFetch = opts.fetchImpl ?? globalThis.fetch;
+    const state = new Map();
+    let timer;
+    const probeUrl = (url) => url.replace(/\/+$/, '') + (path.startsWith('/') ? path : '/' + path);
+    const probe = async (url) => {
+        const st = state.get(url);
+        if (!st)
+            return;
+        let ok = false;
+        const ctl = new AbortController();
+        const t = setTimeout(() => ctl.abort(), timeoutMs);
+        try {
+            const res = await doFetch(probeUrl(url), { method: 'GET', signal: ctl.signal, redirect: 'manual' });
+            ok = res.status < 500; // answered → up (even 404); only 5xx counts as down
+        }
+        catch { /* network error / timeout → unhealthy (ok stays false) */ }
+        finally {
+            clearTimeout(t);
+        }
+        st.lastCheckedAt = Date.now();
+        if (ok) {
+            st.oks += 1;
+            st.fails = 0;
+            if (!st.healthy && st.oks >= upAt) {
+                st.healthy = true;
+                opts.onChange?.(url, true);
+            }
+        }
+        else {
+            st.fails += 1;
+            st.oks = 0;
+            if (st.healthy && st.fails >= downAt) {
+                st.healthy = false;
+                opts.onChange?.(url, false);
+            }
+        }
+    };
+    const probeOnce = () => Promise.allSettled([...state.keys()].map(probe)).then(() => undefined);
+    return {
+        track(urls) {
+            const next = new Set(urls);
+            for (const u of urls)
+                if (!state.has(u))
+                    state.set(u, { healthy: true, fails: 0, oks: 0, lastCheckedAt: null });
+            for (const u of [...state.keys()])
+                if (!next.has(u))
+                    state.delete(u);
+        },
+        isHealthy: (url) => state.get(url)?.healthy ?? true,
+        snapshot: () => [...state.entries()].map(([url, s]) => ({ url, healthy: s.healthy, fails: s.fails, lastCheckedAt: s.lastCheckedAt })),
+        probeOnce,
+        start() { if (timer)
+            return; timer = setInterval(() => void probeOnce(), intervalMs); timer.unref?.(); void probeOnce(); },
+        stop() { if (timer)
+            clearInterval(timer); timer = undefined; },
+    };
+}

package/executors/gateway/main.prod-gateway.js

@@ -18,8 +18,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
  *   LENSMCP_GW_KEYS          path to a {service: x-internal-token} JSON (the trust registry)
  *   LENSMCP_GW_TLS_KEY       path to TLS private key PEM (enables https)
  *   LENSMCP_GW_TLS_CERT      path to TLS cert PEM
- *   LENSMCP_GW_JWT_REQUIRED  "1" → jwt-mode routes require an `Authorization: Bearer …`
- *                           (minimal edge guard; swap in a full JWKS validator here)
+ *   jwt routes ALWAYS require auth: validated against the verifier (JWKS/HS256) when
+ *   configured, else FAIL CLOSED (401). LENSMCP_GW_JWT_PRESENCE_ONLY=1 opts into a
+ *   weak bearer-presence-only edge guard when no verifier is wired (not recommended).
  *   LENSMCP_EVENT_FILE       set → enable the lens bus (OPT-IN; off by default)
  *
  *   Targeted rollout (attribute-based routing; docs/design/targeted-rollout.md):
@@ -35,14 +36,68 @@ Object.defineProperty(exports, "__esModule", { value: true });
  *   LENSMCP_GW_COOKIE_DOMAIN cookie Domain (e.g. ".tetros.ai" to span subdomains)
  *   LENSMCP_GW_COOKIE_MAXAGE cookie Max-Age seconds (default 31536000)
  *
+ *   Edge tuning (all optional — lib defaults are production-shaped):
+ *   PORT                     platform-injected bind port (used when LENSMCP_GW_PORTS is unset)
+ *   LENSMCP_GW_ACCESS_LOG    "1" → one Cloud-Logging-shaped JSON line per request to stdout
+ *   LENSMCP_GW_UPSTREAM_TLS_VERIFY "1" → verify upstream TLS certs (set for east-west on GCP;
+ *                           default off keeps local-CA / self-signed upstreams working)
+ *   LENSMCP_GW_UPSTREAM_H2    "1" → HTTP/2 to upstreams (multiplex many MCP streams; Cloud Run speaks h2).
+ *                           Auto-on when mTLS is configured; set "0" to force h1.1.
+ *   mTLS to upstreams (optional client cert; rides on h2). Server validation is the
+ *   LENSMCP_GW_UPSTREAM_TLS_VERIFY toggle above ("option to not validate" = leave it off):
+ *   LENSMCP_GW_MTLS_FROM_REDIS "1" → load cert/key/ca from shared Redis keys
+ *                           <prefix>:mtls:{cert,key,ca} (rotate by writing Redis; rolling-restart to apply)
+ *   LENSMCP_GW_MTLS_CERT / _KEY / _CA  PEM file paths (used when not loading from Redis)
+ *   LENSMCP_GW_CLIENT_IP_HEADER  header with the authoritative client IP from the front
+ *                           proxy (set `cf-connecting-ip` behind Cloudflare; feeds IP-based ABAC)
+ *   LENSMCP_GW_CLIENT_IP_TRUSTED_PROXIES  csv of CIDRs allowed to set that header
+ *                           (default loopback only — prevents off-proxy IP spoofing)
+ *   LENSMCP_GW_UNDICI_CONNECTIONS    per-origin connection pool size (default 256)
+ *   LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS undici response-body timeout; default 0 = unlimited
+ *                           (keeps long-lived SSE / streaming MCP responses open)
+ *   LENSMCP_GW_KEEPALIVE_MS  server keep-alive timeout; default 620000, kept ABOVE the GCP
+ *                           external ALB's 600s backend keep-alive (avoids intermittent 502s)
+ *   LENSMCP_GW_REQUEST_TIMEOUT_MS inbound request timeout; default 0 = disabled (streaming)
+ *
+ *   Distributed tracing (OpenTelemetry — on only when the OTLP endpoint is set):
+ *   OTEL_EXPORTER_OTLP_ENDPOINT  OTLP/HTTP endpoint (Cloud Trace / Collector / X-Ray / Tempo / Jaeger).
+ *                           Set → gateway emits a SERVER span per request + propagates W3C traceparent downstream.
+ *   OTEL_SERVICE_NAME        resource service.name (default "lensmcp-gateway")
+ *   OTEL_EXPORTER_OTLP_HEADERS   exporter auth headers (standard OTLP env, read by the exporter)
+ *   LENSMCP_GW_OTEL_SAMPLE   head sample ratio 0..1 for root spans (default 1)
+ *
+ *   Status rollup (for a status page — observed health, not the routing registry):
+ *   LENSMCP_GW_STATUS        "1" → expose GET /statusz + (with Redis) fan health to status:<svc>:<instance>
+ *   LENSMCP_GW_STATUS_TOKEN  if set, /statusz (and /metricsz) require ?token= or x-status-token to match
+ *   LENSMCP_GW_METRICS       "1" → expose token-gated /metricsz (event-loop lag / rss / cpu / req rates) for load tests
+ *
+ *   Active health-checking (probe upstreams; route pools around dead endpoints):
+ *   LENSMCP_GW_HEALTH_CHECK  "1" → probe every upstream and steer pooled picks to healthy ones
+ *   LENSMCP_GW_HEALTH_PATH   probe path (default /healthz); healthy = answers with status < 500
+ *   LENSMCP_GW_HEALTH_INTERVAL_MS / LENSMCP_GW_HEALTH_TIMEOUT_MS  probe period / timeout
+ *
+ *   Rate limit (opt-in, per client IP; defense-in-depth behind the edge throttle):
+ *   LENSMCP_GW_RATE_LIMIT    requests allowed per window (enables the limiter)
+ *   LENSMCP_GW_RATE_WINDOW_MS window the limit refills over (default 60000)
+ *   LENSMCP_GW_RATE_LIMIT_REDIS  "1" → ONE GLOBAL budget across all containers via the
+ *                           shared registry Redis (atomic Lua token-bucket); else per-instance
+ *   LENSMCP_GW_RATE_LIMIT_REDIS_URL  dedicated Redis for the limiter (else reuse the registry one)
+ *   LENSMCP_GW_RATE_LIMIT_TIMEOUT_MS  per-request Redis budget before the fail policy (default 100)
+ *   LENSMCP_GW_RATE_LIMIT_FAIL_CLOSED "1" → deny on a Redis error/timeout (default: fail OPEN)
+ *
  * Manifests + endpoints + keys are FILE-backed here; a registry-backed
  * ManifestProvider (Redis/ConfigMap) drops in behind the same interface.
  */
 const node_fs_1 = require("node:fs");
 const node_crypto_1 = require("node:crypto");
 const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
 const prod_gateway_lib_1 = require("./prod-gateway.lib");
 const jwks_verify_1 = require("./jwks-verify");
+const otel_tracing_1 = require("./otel-tracing");
+const health_check_1 = require("./health-check");
+const rate_limit_1 = require("./rate-limit");
+const metrics_1 = require("./metrics");
 const registry_source_1 = require("./registry-source");
 const providers_prod_1 = require("./providers-prod");
 function readJson(path, fallback) {
@@ -95,7 +150,9 @@ function watchJsonFile(path, onChange, pollMs = 1000) {
 }
 async function main() {
     const env = process.env;
-    const ports = (env['LENSMCP_GW_PORTS'] ?? '').split(',').map((s) => Number(s.trim())).filter(Boolean);
+    // Bind ports: explicit LENSMCP_GW_PORTS wins; else honor the platform `PORT`
+    // contract (Cloud Run / buildpacks inject it); else the lib default (8080/8443).
+    const ports = (env['LENSMCP_GW_PORTS'] ?? env['PORT'] ?? '').split(',').map((s) => Number(s.trim())).filter(Boolean);
     // Process-level safety net: a single uncaught async error must not kill the
     // pod and 503 every in-flight request — log and keep serving.
     process.on('uncaughtException', (err) => console.error('[gateway] uncaughtException:', err));
@@ -108,10 +165,13 @@ async function main() {
     let pods;
     let stopEndpointsWatch;
     let registry;
+    // Reused (when present) for the status:* fan-out and shared mTLS material reads.
+    let redisClient;
     if (redisUrl) {
         // eslint-disable-next-line @typescript-eslint/no-require-imports
         const Redis = require('ioredis');
         const client = new Redis(redisUrl);
+        redisClient = client;
         const reg = (0, registry_source_1.createRegistryProviders)((0, registry_source_1.redisRegistrySource)(client, env['LENSMCP_GW_REDIS_PREFIX'] ? { prefix: env['LENSMCP_GW_REDIS_PREFIX'] } : {}), { onError: (e) => console.error('[gateway] registry:', e instanceof Error ? e.message : e) });
         await reg.start(); // warm the route table before serving
         manifests = reg.manifests;
@@ -160,10 +220,10 @@ async function main() {
         : undefined;
     // ── JWT verification: JWKS (RS256, prod) preferred, HS256 secret as fallback ──
     // One verifier powers BOTH identify() (claims → ABAC attributes) and the edge
-    // authenticate() (reject jwt routes when LENSMCP_GW_JWT_REQUIRED). With neither
-    // configured, jwt routes fall back to a bearer-presence check and identity
-    // attributes are absent (IP/header/cookie rules still work).
-    const jwtRequired = env['LENSMCP_GW_JWT_REQUIRED'] === '1';
+    // authenticate(). A `jwt` route with NO verifier configured FAILS CLOSED (401),
+    // unless LENSMCP_GW_JWT_PRESENCE_ONLY=1 explicitly opts into a weak bearer-presence
+    // edge guard (no signature check). Default is fail-closed, not pass-through.
+    const jwtPresenceOnly = env['LENSMCP_GW_JWT_PRESENCE_ONLY'] === '1';
     const jwksUrl = env['LENSMCP_GW_JWKS_URL'];
     const jwtSecret = env['LENSMCP_GW_JWT_SECRET'];
     const jwks = jwksUrl
@@ -202,13 +262,16 @@ async function main() {
     };
     const identify = (jwks || jwtSecret) ? bearerClaims : undefined;
     const authenticate = (mode, req) => {
-        if (mode !== 'jwt' || !jwtRequired)
+        if (mode !== 'jwt')
             return;
         if (jwks || jwtSecret) {
             if (!bearerClaims(req))
                 throw new Error('invalid or missing token');
             return;
         } // real verification
+        // No verifier configured → FAIL CLOSED, unless presence-only is explicitly opted in.
+        if (!jwtPresenceOnly)
+            throw new Error('jwt route but no verifier configured (set LENSMCP_GW_JWKS_URL or LENSMCP_GW_JWT_SECRET)');
         if (!String(req.headers['authorization'] ?? '').startsWith('Bearer '))
             throw new Error('missing bearer token');
     };
@@ -248,6 +311,133 @@ async function main() {
             console.error('[gateway] initial JWKS load failed (will retry in background):', e.message);
         }
     }
+    // ── edge tuning (all optional; sensible prod defaults live in the lib) ──
+    const accessLog = env['LENSMCP_GW_ACCESS_LOG'] === '1';
+    const clientIpHeader = env['LENSMCP_GW_CLIENT_IP_HEADER']; // e.g. cf-connecting-ip behind Cloudflare
+    // CIDRs of trusted front proxies that may set the client-IP header (default: loopback only).
+    const clientIpTrustedProxies = (env['LENSMCP_GW_CLIENT_IP_TRUSTED_PROXIES'] ?? '').split(',').map((s) => s.trim()).filter(Boolean);
+    const undici = {};
+    if (env['LENSMCP_GW_UPSTREAM_TLS_VERIFY'] === '1')
+        undici.rejectUnauthorized = true; // "option to not validate" = leave unset
+    if (env['LENSMCP_GW_UPSTREAM_H2'] === '1')
+        undici.allowH2 = true;
+    if (env['LENSMCP_GW_UNDICI_CONNECTIONS'])
+        undici.connections = Number(env['LENSMCP_GW_UNDICI_CONNECTIONS']);
+    if (env['LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS'])
+        undici.bodyTimeout = Number(env['LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS']);
+    // ── mTLS client materials (optional): from the shared registry Redis, or files ──
+    if (env['LENSMCP_GW_MTLS_FROM_REDIS'] === '1' && redisClient) {
+        const p = env['LENSMCP_GW_REDIS_PREFIX'] ?? 'lensmcp:gw';
+        const [cert, key, ca] = await redisClient.mget(`${p}:mtls:cert`, `${p}:mtls:key`, `${p}:mtls:ca`);
+        if (cert)
+            undici.cert = cert;
+        if (key)
+            undici.key = key;
+        if (ca)
+            undici.ca = ca;
+        if (cert || key)
+            console.log('[gateway] mTLS materials loaded from Redis');
+    }
+    else {
+        if (env['LENSMCP_GW_MTLS_CERT'])
+            undici.cert = (0, node_fs_1.readFileSync)(env['LENSMCP_GW_MTLS_CERT']);
+        if (env['LENSMCP_GW_MTLS_KEY'])
+            undici.key = (0, node_fs_1.readFileSync)(env['LENSMCP_GW_MTLS_KEY']);
+        if (env['LENSMCP_GW_MTLS_CA'])
+            undici.ca = (0, node_fs_1.readFileSync)(env['LENSMCP_GW_MTLS_CA']);
+    }
+    // mTLS rides on HTTP/2 by default (unless explicitly disabled with LENSMCP_GW_UPSTREAM_H2=0).
+    if (undici.cert && undici.key) {
+        if (env['LENSMCP_GW_UPSTREAM_H2'] !== '0')
+            undici.allowH2 = true;
+        console.log(`[gateway] mTLS to upstreams ON over ${undici.allowH2 ? 'h2' : 'h1.1'} (server validation ${undici.rejectUnauthorized ? 'enabled' : 'OFF'})`);
+    }
+    const server = {};
+    if (env['LENSMCP_GW_KEEPALIVE_MS'])
+        server.keepAliveTimeout = Number(env['LENSMCP_GW_KEEPALIVE_MS']);
+    if (env['LENSMCP_GW_REQUEST_TIMEOUT_MS'])
+        server.requestTimeout = Number(env['LENSMCP_GW_REQUEST_TIMEOUT_MS']);
+    // OTel distributed tracing — on only when OTEL_EXPORTER_OTLP_ENDPOINT is set.
+    const tracing = (0, otel_tracing_1.setupTracing)({
+        ...(env['OTEL_SERVICE_NAME'] ? { serviceName: env['OTEL_SERVICE_NAME'] } : {}),
+        ...(env['LENSMCP_GW_OTEL_SAMPLE'] ? { sampleRatio: Number(env['LENSMCP_GW_OTEL_SAMPLE']) } : {}),
+    });
+    if (tracing)
+        console.log(`[gateway] OTLP tracing on → ${env['OTEL_EXPORTER_OTLP_ENDPOINT']}`);
+    // Status rollup: /statusz endpoint (token-guarded) + a per-instance Redis
+    // `status:<service>:<host>` fan-out (TTL'd) that a status page reads with a
+    // read-only ACL scoped to `status:*` — never the routing control-plane keys.
+    const statusEnabled = env['LENSMCP_GW_STATUS'] === '1';
+    const statusToken = env['LENSMCP_GW_STATUS_TOKEN'];
+    const instance = (0, node_os_1.hostname)();
+    const statusTtl = Math.max(3, Math.ceil((Number(env['LENSMCP_GW_TRAFFIC_FLUSH_MS'] ?? 5000) / 1000) * 3));
+    const statusRedis = redisClient;
+    const onStatus = (statusEnabled && statusRedis)
+        ? (snapshot) => {
+            for (const s of snapshot) {
+                void statusRedis.set(`status:${s.service}:${instance}`, JSON.stringify({ ...s, instance, at: Date.now() }), 'EX', statusTtl).catch(() => undefined);
+            }
+        }
+        : undefined;
+    if (statusEnabled && !statusToken)
+        console.warn('[gateway] LENSMCP_GW_STATUS=1 but no LENSMCP_GW_STATUS_TOKEN — /statusz stays DISABLED (404) until a token is set (fail-closed). The Redis status:* fan-out still runs.');
+    if (statusEnabled)
+        console.log(`[gateway] status on — /statusz${statusToken ? '' : ' (endpoint disabled: no token)'}${onStatus ? ' + Redis status:* fan-out' : ''}`);
+    // Active upstream health-checking — probes upstreams, routes pools around dead
+    // endpoints, and feeds true liveness into /statusz. Default off (passive only).
+    const healthChecker = env['LENSMCP_GW_HEALTH_CHECK'] === '1'
+        ? (0, health_check_1.createHealthChecker)({
+            ...(env['LENSMCP_GW_HEALTH_PATH'] ? { path: env['LENSMCP_GW_HEALTH_PATH'] } : {}),
+            ...(env['LENSMCP_GW_HEALTH_INTERVAL_MS'] ? { intervalMs: Number(env['LENSMCP_GW_HEALTH_INTERVAL_MS']) } : {}),
+            ...(env['LENSMCP_GW_HEALTH_TIMEOUT_MS'] ? { timeoutMs: Number(env['LENSMCP_GW_HEALTH_TIMEOUT_MS']) } : {}),
+        })
+        : undefined;
+    if (healthChecker)
+        console.log(`[gateway] active health-checking on (path ${env['LENSMCP_GW_HEALTH_PATH'] ?? '/healthz'})`);
+    // Per-client-IP rate limit (opt-in; defense-in-depth behind Cloudflare/Cloud Armor).
+    // LENSMCP_GW_RATE_LIMIT_REDIS=1 makes it ONE GLOBAL budget shared by every gateway
+    // container (atomic Lua token-bucket on the shared registry Redis — or a dedicated
+    // LENSMCP_GW_RATE_LIMIT_REDIS_URL); fail-open on a Redis blip. Otherwise it's the
+    // per-instance in-memory limiter (whose effective limit multiplies by container count).
+    let rateLimiter;
+    let rlRedisClient; // a dedicated client we own and must quit
+    if (env['LENSMCP_GW_RATE_LIMIT']) {
+        const limit = Number(env['LENSMCP_GW_RATE_LIMIT']);
+        const windowMs = Number(env['LENSMCP_GW_RATE_WINDOW_MS'] ?? 60_000);
+        const wantRedis = env['LENSMCP_GW_RATE_LIMIT_REDIS'] === '1' || !!env['LENSMCP_GW_RATE_LIMIT_REDIS_URL'];
+        if (wantRedis) {
+            const dedicatedUrl = env['LENSMCP_GW_RATE_LIMIT_REDIS_URL'];
+            let client;
+            if (dedicatedUrl) {
+                const Redis = require('ioredis');
+                rlRedisClient = new Redis(dedicatedUrl);
+                client = rlRedisClient;
+            }
+            else if (redisClient) {
+                client = redisClient; // reuse the registry Redis
+            }
+            if (client) {
+                const failClosed = env['LENSMCP_GW_RATE_LIMIT_FAIL_CLOSED'] === '1';
+                rateLimiter = (0, rate_limit_1.createRedisRateLimiter)(client, {
+                    limit, windowMs,
+                    ...(env['LENSMCP_GW_RATE_LIMIT_TIMEOUT_MS'] ? { timeoutMs: Number(env['LENSMCP_GW_RATE_LIMIT_TIMEOUT_MS']) } : {}),
+                    ...(failClosed ? { failOpen: false } : {}),
+                });
+                console.log(`[gateway] rate limit on — ${limit} req / ${windowMs}ms GLOBAL (Redis: ${dedicatedUrl ? 'dedicated' : 'shared registry'}, fail-${failClosed ? 'closed' : 'open'}) per client IP`);
+            }
+            else {
+                console.warn('[gateway] LENSMCP_GW_RATE_LIMIT_REDIS set but no Redis configured (set LENSMCP_GW_REDIS_URL or LENSMCP_GW_RATE_LIMIT_REDIS_URL) — falling back to PER-INSTANCE in-memory limiting.');
+            }
+        }
+        if (!rateLimiter) {
+            rateLimiter = (0, rate_limit_1.createRateLimiter)({ limit, windowMs });
+            console.log(`[gateway] rate limit on — ${limit} req / ${windowMs}ms per client IP (in-memory, per-instance)`);
+        }
+    }
+    // Process self-metrics (event-loop lag / rss / cpu / req rates) for load tests + monitoring.
+    const metrics = env['LENSMCP_GW_METRICS'] === '1' ? (0, metrics_1.createProcessMetrics)() : undefined;
+    if (metrics)
+        console.log(`[gateway] process metrics on — /metricsz${statusToken ? ' (token-gated)' : ' (DISABLED: needs LENSMCP_GW_STATUS_TOKEN)'}`);
     const handle = await (0, prod_gateway_lib_1.startProdGateway)({
         ...(ports.length ? { ports } : {}),
         manifests,
@@ -261,6 +451,19 @@ async function main() {
         ...(trustProxyIp ? { trustProxyIp } : {}),
         ...(cookie ? { cookie } : {}),
         ...(uidHeader ? { uidHeader } : {}),
+        ...(accessLog ? { accessLog: true } : {}),
+        ...(clientIpHeader ? { clientIpHeader } : {}),
+        ...(clientIpTrustedProxies.length ? { clientIpTrustedProxies } : {}),
+        ...(tracing ? { tracing } : {}),
+        ...(statusEnabled ? { statusEndpoint: true } : {}),
+        ...(statusToken ? { statusToken } : {}),
+        ...(onStatus ? { onStatus } : {}),
+        ...(healthChecker ? { healthChecker } : {}),
+        ...(rateLimiter ? { rateLimiter } : {}),
+        ...(metrics ? { metrics } : {}),
+        ...(env['LENSMCP_GW_TRAFFIC_FLUSH_MS'] ? { trafficFlushMs: Number(env['LENSMCP_GW_TRAFFIC_FLUSH_MS']) } : {}),
+        ...(Object.keys(undici).length ? { undici } : {}),
+        ...(Object.keys(server).length ? { server } : {}),
     });
     console.log(`[gateway] production gateway up on ${handle.ports.join(', ')} (${handle.routes().length} routes${emit ? ', lens ON' : ''})`);
     const shutdown = async (sig) => {
@@ -277,11 +480,19 @@ async function main() {
             registry?.stop();
         }
         catch { /* ignore */ }
+        try {
+            await rlRedisClient?.quit();
+        }
+        catch { /* ignore */ } // the dedicated rate-limit client we created (handle.stop() stops the limiter itself)
         try {
             jwks?.stop();
         }
         catch { /* ignore */ }
         await handle.stop();
+        try {
+            await tracing?.shutdown();
+        }
+        catch { /* ignore */ } // flush buffered spans before exit
         process.exit(0);
     };
     for (const sig of ['SIGTERM', 'SIGINT'])

package/executors/gateway/manifest.d.ts

@@ -114,10 +114,15 @@ export interface ManifestProvider {
 /** Resolves a service to a concrete upstream, with optional scale-from-zero. */
 export interface PodProvider {
     /** Pick an upstream for this service. `opts.version` pins a rollout cohort
-     *  (sticky canary / debugging); otherwise traffic is split by cohort weight. */
+     *  (sticky canary / debugging); otherwise traffic is split by cohort weight.
+     *  `opts.isHealthy` (when given) steers a pooled pick toward healthy endpoints
+     *  — fail-open: if a whole pool looks down it still returns one. */
     pick(service: string, opts?: {
         version?: string;
+        isHealthy?: (url: string) => boolean;
     }): Upstream | undefined;
+    /** All upstream URLs this provider could route to — for active health-checking. */
+    endpoints?(): string[];
     /** Bring a scaled-to-zero service up (dev). Prod returns true (always on). */
     ensureUp?(service: string): Promise<boolean>;
     /** Drop a dead upstream so the next pick avoids it (refused socket / 502). */
@@ -235,7 +240,7 @@ export declare function manifestFromClusterDecl(project: string, decl: {
 /** A flat, read-only attribute bag assembled per request: verified JWT claims,
  *  `ip`, `header.<name>`, `device` (sticky key), `path`, `method`. */
 export type Attrs = Record<string, unknown>;
-export type RuleOp = 'eq' | 'ne' | 'in' | 'nin' | 'prefix' | 'suffix' | 'contains' | 'regex' | 'exists' | 'gt' | 'lt' | 'cidr';
+export type RuleOp = 'eq' | 'ne' | 'in' | 'nin' | 'prefix' | 'suffix' | 'contains' | 'hastoken' | 'regex' | 'exists' | 'gt' | 'lt' | 'cidr';
 export interface Condition {
     attr: string;
     op: RuleOp;

package/executors/gateway/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,6EAA6E;AAC7E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;6BAE6B;AAC7B,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,UAAU,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AACD,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,QAAQ,CAAC;IACnB,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;CAC5B;AAED;qEACqE;AACrE,MAAM,WAAW,SAAS;IACxB,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,uFAAuF;IACvF,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B,6DAA6D;IAC7D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;0EACsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CAC1B;AAED;;oEAEoE;AACpE,MAAM,MAAM,QAAQ,GAAG,CAAC;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzF;;yBAEyB;AACzB,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,IAAI,IAAI,aAAa,EAAE,CAAC;IACxB,+EAA+E;IAC/E,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CAC9D;AAED,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B;oFACgF;IAChF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzE,8EAA8E;IAC9E,QAAQ,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IACjD;mEAC+D;IAC/D,cAAc,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC/F;mFAC+E;IAC/E,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CACxE;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,MAAM,CAa/E;AAED;kFACkF;AAClF,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAIlE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACrE,MAAM,EAAE,SAAS,CAAC,EAAE,EACpB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,CAAC,GAAG,SAAS,CASf;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAGhG;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAK9F;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED;;;;;GAKG;AACH;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAUtE;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,CAUtG;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,aAAa,EACvB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,OAAO,GAChB,YAAY,CAGd;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,SAAS,aAAa,EAAE,GAAG,KAAK,EAAE,CAgC5E;AAED;;kEAEkE;AAClE,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,IAAI,CAAC,EAAE,UAAU,CAAC;CAC7F,GACA,aAAa,GAAG,SAAS,CAe3B;AAUD;sEACsE;AACtE,MAAM,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE5C,MAAM,MAAM,MAAM,GACd,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK,GAC1B,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAChC,OAAO,GAAG,QAAQ,GAClB,IAAI,GAAG,IAAI,GACX,MAAM,CAAC;AAEX,MAAM,WAAW,SAAS;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE;AACxE,MAAM,WAAW,SAAS;IAAG,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC;IAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC;IAAC,GAAG,CAAC,EAAE,QAAQ,CAAA;CAAE;AACjF,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAE7C,0FAA0F;AAC1F,MAAM,WAAW,UAAU;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AA6B9E,iFAAiF;AACjF,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAW3D;AA8BD,sFAAsF;AACtF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAO9D;AAED,mEAAmE;AACnE,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,SAAS,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,GACzC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAKhD;AAED,4EAA4E;AAC5E,wBAAgB,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAIvC;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAU9E"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,6EAA6E;AAC7E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;6BAE6B;AAC7B,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,UAAU,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AACD,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,QAAQ,CAAC;IACnB,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;CAC5B;AAED;qEACqE;AACrE,MAAM,WAAW,SAAS;IACxB,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,uFAAuF;IACvF,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B,6DAA6D;IAC7D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;0EACsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CAC1B;AAED;;oEAEoE;AACpE,MAAM,MAAM,QAAQ,GAAG,CAAC;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzF;;yBAEyB;AACzB,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,IAAI,IAAI,aAAa,EAAE,CAAC;IACxB,+EAA+E;IAC/E,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CAC9D;AAED,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B;;;wEAGoE;IACpE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAA;KAAE,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC/G,mFAAmF;IACnF,SAAS,CAAC,IAAI,MAAM,EAAE,CAAC;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IACjD;mEAC+D;IAC/D,cAAc,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC/F;mFAC+E;IAC/E,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CACxE;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,MAAM,CAa/E;AAED;kFACkF;AAClF,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAIlE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACrE,MAAM,EAAE,SAAS,CAAC,EAAE,EACpB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,CAAC,GAAG,SAAS,CASf;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAGhG;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAK9F;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED;;;;;GAKG;AACH;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAUtE;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,CAatG;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,aAAa,EACvB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,OAAO,GAChB,YAAY,CAGd;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,SAAS,aAAa,EAAE,GAAG,KAAK,EAAE,CAgC5E;AAED;;kEAEkE;AAClE,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,IAAI,CAAC,EAAE,UAAU,CAAC;CAC7F,GACA,aAAa,GAAG,SAAS,CAe3B;AAUD;sEACsE;AACtE,MAAM,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE5C,MAAM,MAAM,MAAM,GACd,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK,GAC1B,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAChC,UAAU,GACV,OAAO,GAAG,QAAQ,GAClB,IAAI,GAAG,IAAI,GACX,MAAM,CAAC;AAEX,MAAM,WAAW,SAAS;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE;AACxE,MAAM,WAAW,SAAS;IAAG,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC;IAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC;IAAC,GAAG,CAAC,EAAE,QAAQ,CAAA;CAAE;AACjF,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAE7C,0FAA0F;AAC1F,MAAM,WAAW,UAAU;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AA6B9E,iFAAiF;AACjF,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAW3D;AAiCD,sFAAsF;AACtF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAW9D;AAED,mEAAmE;AACnE,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,SAAS,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,GACzC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAKhD;AAED,4EAA4E;AAC5E,wBAAgB,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAIvC;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAU9E"}

package/executors/gateway/manifest.js

@@ -138,8 +138,11 @@ function authRuleFor(policy, path, method) {
             continue;
         if (o.methods && !o.methods.some((x) => x.toUpperCase() === m))
             continue;
-        const rule = o.rule ?? (o.permission ? { attr: 'perms', op: 'contains', value: o.permission } : undefined);
-        return { mode: o.mode, ...(rule ? { rule } : {}) };
+        const rule = o.rule ?? (o.permission ? { attr: 'perms', op: 'hastoken', value: o.permission } : undefined);
+        // An override that omits `mode` INHERITS the service default — otherwise a
+        // permission-only override would resolve to mode=undefined and the gateway
+        // would skip the jwt branch entirely, silently NOT enforcing the permission.
+        return { mode: o.mode ?? policy?.default ?? 'jwt', ...(rule ? { rule } : {}) };
     }
     return { mode: policy?.default ?? 'jwt' };
 }
@@ -281,7 +284,13 @@ function evalCondition(c, attrs) {
         case 'nin': return !(Array.isArray(c.value) && c.value.some((x) => Array.isArray(v) ? v.some((vv) => eq(vv, x)) : eq(v, x)));
         case 'prefix': return str(v).startsWith(str(c.value));
         case 'suffix': return str(v).endsWith(str(c.value));
-        case 'contains': return Array.isArray(v) ? v.some((vv) => eq(vv, c.value)) : str(v).includes(str(c.value));
+        case 'contains': return Array.isArray(v) ? v.some((vv) => eq(vv, c.value)) : str(v).includes(str(c.value)); // substring / array element (general op)
+        // EXACT token in a list — a `perms`/scope STRING is delimited, so "superadmin"/"billing,adminx"
+        // must NOT satisfy hastoken:"admin". This is what `permission` compiles to (authz, no substring bypass).
+        case 'hastoken': {
+            const cv = str(c.value);
+            return Array.isArray(v) ? v.some((vv) => eq(vv, c.value)) : str(v).split(/[\s,]+/).filter(Boolean).includes(cv);
+        }
         case 'regex': {
             const re = compileRe(str(c.value));
             return re ? re.test(str(v)) : false;
@@ -296,14 +305,18 @@ function evalCondition(c, attrs) {
 function evalRule(node, attrs) {
     if (!isGroup(node))
         return evalCondition(node, attrs);
-    if (node.all && !node.all.every((n) => evalRule(n, attrs)))
-        return false;
-    if (node.any && !node.any.some((n) => evalRule(n, attrs)))
+    // Only MEANINGFUL clauses count — an empty all:[]/any:[]/not:{} must NOT vacuously admit (fail closed),
+    // while a real `not:{cond}`-only rule still grants when its veto passes.
+    const all = Array.isArray(node.all) && node.all.length ? node.all : undefined;
+    const any = Array.isArray(node.any) && node.any.length ? node.any : undefined;
+    const not = node.not && Object.keys(node.not).length ? node.not : undefined;
+    if (not && evalRule(not, attrs))
+        return false; // veto
+    if (all && !all.every((n) => evalRule(n, attrs)))
         return false;
-    if (node.not && evalRule(node.not, attrs))
+    if (any && !any.some((n) => evalRule(n, attrs)))
         return false;
-    // an empty group ({}) matches nothing meaningful → treat as no-match
-    return !!(node.all || node.any || node.not);
+    return !!(all || any || not); // grant only if ≥1 meaningful clause was present (and satisfied)
 }
 /** First matching rule's version (top-to-bottom), or undefined. */
 function pickTargetedVersion(rules, attrs) {

package/executors/gateway/metrics.d.ts

@@ -0,0 +1,37 @@
+export interface MetricsSnapshot {
+    uptimeSec: number;
+    rssMB: number;
+    heapUsedMB: number;
+    heapTotalMB: number;
+    externalMB: number;
+    /** CPU consumed in the interval since the previous snapshot. `percent` is of one core (single-threaded gateway). */
+    cpu: {
+        userMs: number;
+        systemMs: number;
+        percent: number;
+    };
+    /** Event-loop delay over the interval (ms). p99/max are the latency-killers to watch. */
+    loopLagMs: {
+        mean: number;
+        p50: number;
+        p90: number;
+        p99: number;
+        max: number;
+    };
+    requests: {
+        total: number;
+        sinceLast: number;
+        perSec: number;
+        s2xx: number;
+        s4xx: number;
+        s5xx: number;
+    };
+}
+export interface ProcessMetrics {
+    recordRequest(status: number): void;
+    /** Read-and-reset: returns interval deltas and resets the CPU/req/loop-lag windows. */
+    snapshot(): MetricsSnapshot;
+    stop(): void;
+}
+export declare function createProcessMetrics(): ProcessMetrics;
+//# sourceMappingURL=metrics.d.ts.map

package/executors/gateway/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/metrics.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAC3E,oHAAoH;IACpH,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,yFAAyF;IACzF,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAChF,QAAQ,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1G;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,uFAAuF;IACvF,QAAQ,IAAI,eAAe,CAAC;IAC5B,IAAI,IAAI,IAAI,CAAC;CACd;AAKD,wBAAgB,oBAAoB,IAAI,cAAc,CAkCrD"}