@lensmcp/cluster 1.0.0

package/executors/gateway/jwks-verify.d.ts

@@ -0,0 +1,28 @@
+export interface JwksVerifierOptions {
+    /** The IdP JWKS endpoint, e.g. `https://issuer/.well-known/jwks.json`. */
+    jwksUrl: string;
+    /** Expected `iss` claim (optional). */
+    issuer?: string;
+    /** Expected `aud` claim — string or any-of list (optional). */
+    audience?: string | string[];
+    /** Accepted JWS algorithms. Default `['RS256']`. RSA family only. */
+    algorithms?: string[];
+    /** Periodic JWKS refresh interval (ms). Default 600000 (10 min). */
+    cacheMaxAgeMs?: number;
+    /** Min interval between on-miss (unknown-kid) refreshes (ms). Default 30000. */
+    missRefreshMs?: number;
+    /** Clock skew tolerance for exp/nbf (seconds). Default 60. */
+    clockToleranceSec?: number;
+    /** Injectable fetch (tests). Defaults to global fetch. */
+    fetchImpl?: typeof fetch;
+}
+export interface JwtVerifier {
+    /** Verify a compact JWS; returns the claims, or undefined if invalid/unknown. Sync. */
+    verify(token: string): Record<string, unknown> | undefined;
+    /** Force a JWKS reload (awaited at startup; safe to call any time). */
+    refresh(): Promise<void>;
+    /** Stop the periodic refresh timer. */
+    stop(): void;
+}
+export declare function createJwksVerifier(opts: JwksVerifierOptions): JwtVerifier;
+//# sourceMappingURL=jwks-verify.d.ts.map

package/executors/gateway/jwks-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks-verify.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/jwks-verify.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0DAA0D;IAC1D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,uFAAuF;IACvF,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC3D,uEAAuE;IACvE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,uCAAuC;IACvC,IAAI,IAAI,IAAI,CAAC;CACd;AAQD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,WAAW,CAkEzE"}

package/executors/gateway/jwks-verify.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createJwksVerifier = createJwksVerifier;
+/**
+ * RS256/JWKS JWT verifier — the production identity source for the prod
+ * gateway's attribute-based routing (`identify`). Fetches the IdP's JWKS,
+ * caches public keys by `kid`, and verifies tokens SYNCHRONOUSLY against that
+ * cache so it slots into the gateway's per-request `identify(req)` and rule
+ * evaluation without making the hot path async.
+ *
+ * Freshness without blocking the request:
+ *   - initial JWKS load is awaited at startup (`refresh()`),
+ *   - a periodic refresh keeps keys current (rotation),
+ *   - an unknown `kid` triggers a rate-limited background refresh and the
+ *     CURRENT request fails closed (undefined) — the token verifies on a later
+ *     request once the new key is cached.
+ *
+ * Security: only the configured algorithms are accepted (default RS256) — `none`
+ * and HS* are rejected (alg-confusion guard); `exp`/`nbf` honoured with a small
+ * clock tolerance; `iss`/`aud` checked when configured.
+ *
+ * Scope: RSA families (RS256/384/512). EC (ES*) needs JOSE→DER signature
+ * conversion — a documented follow-up; most IdPs default to RS256.
+ */
+const node_crypto_1 = require("node:crypto");
+const ALG_TO_HASH = { RS256: 'sha256', RS384: 'sha384', RS512: 'sha512' };
+const b64urlJsonSafe = (s) => JSON.parse(Buffer.from(s, 'base64url').toString('utf8'));
+function createJwksVerifier(opts) {
+    const algorithms = (opts.algorithms ?? ['RS256']).filter((a) => a in ALG_TO_HASH);
+    const cacheMaxAgeMs = opts.cacheMaxAgeMs ?? 600_000;
+    const missRefreshMs = opts.missRefreshMs ?? 30_000;
+    const tol = opts.clockToleranceSec ?? 60;
+    const doFetch = opts.fetchImpl ?? globalThis.fetch;
+    const audiences = opts.audience === undefined ? undefined : (Array.isArray(opts.audience) ? opts.audience : [opts.audience]);
+    let keys = new Map(); // kid → public key
+    let inflight;
+    let lastMissAt = 0;
+    const load = async () => {
+        const res = await doFetch(opts.jwksUrl, { headers: { accept: 'application/json' } });
+        if (!res.ok)
+            throw new Error(`JWKS ${opts.jwksUrl} → HTTP ${res.status}`);
+        const body = (await res.json());
+        const next = new Map();
+        for (const jwk of body.keys ?? []) {
+            if (jwk.kty !== 'RSA' || !jwk.n || !jwk.e)
+                continue;
+            if (jwk.use && jwk.use !== 'sig')
+                continue;
+            try {
+                const key = (0, node_crypto_1.createPublicKey)({ key: jwk, format: 'jwk' });
+                next.set(jwk.kid ?? '__single__', key);
+            }
+            catch { /* skip an unparseable key, keep the rest */ }
+        }
+        if (next.size > 0)
+            keys = next; // never blank out a working set on a bad fetch
+    };
+    const refresh = () => {
+        if (!inflight)
+            inflight = load().finally(() => { inflight = undefined; });
+        return inflight;
+    };
+    const refreshOnMiss = (nowMs) => {
+        if (nowMs - lastMissAt < missRefreshMs)
+            return;
+        lastMissAt = nowMs;
+        void refresh().catch(() => undefined); // background; this request already failed closed
+    };
+    const timer = setInterval(() => void refresh().catch(() => undefined), cacheMaxAgeMs);
+    timer.unref?.();
+    const verify = (token) => {
+        const parts = token.split('.');
+        if (parts.length !== 3)
+            return undefined;
+        let header;
+        try {
+            header = b64urlJsonSafe(parts[0]);
+        }
+        catch {
+            return undefined;
+        }
+        if (!header.alg || !algorithms.includes(header.alg))
+            return undefined; // reject none/HS*/unconfigured
+        const key = keys.get(header.kid ?? '__single__') ?? (keys.size === 1 ? [...keys.values()][0] : undefined);
+        if (!key) {
+            refreshOnMiss(Date.now());
+            return undefined;
+        }
+        let ok;
+        try {
+            ok = (0, node_crypto_1.verify)(ALG_TO_HASH[header.alg], Buffer.from(`${parts[0]}.${parts[1]}`), key, Buffer.from(parts[2], 'base64url'));
+        }
+        catch {
+            return undefined;
+        }
+        if (!ok)
+            return undefined;
+        let payload;
+        try {
+            payload = b64urlJsonSafe(parts[1]);
+        }
+        catch {
+            return undefined;
+        }
+        const now = Date.now() / 1000;
+        if (typeof payload.exp === 'number' && now > payload.exp + tol)
+            return undefined;
+        if (typeof payload.nbf === 'number' && now < payload.nbf - tol)
+            return undefined;
+        if (opts.issuer && payload.iss !== opts.issuer)
+            return undefined;
+        if (audiences) {
+            const aud = payload.aud;
+            const audList = Array.isArray(aud) ? aud : [aud];
+            if (!audList.some((a) => audiences.includes(a)))
+                return undefined;
+        }
+        return payload;
+    };
+    return { verify, refresh, stop: () => clearInterval(timer) };
+}

package/executors/gateway/main.prod-gateway.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=main.prod-gateway.d.ts.map

package/executors/gateway/main.prod-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.prod-gateway.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/main.prod-gateway.ts"],"names":[],"mappings":""}

package/executors/gateway/main.prod-gateway.js

@@ -0,0 +1,290 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Production gateway process entry — the thing the Docker image runs. Reads
+ * its whole configuration from the environment (12-factor) and composes
+ * `startProdGateway` with the file-backed manifest provider + endpoint pod
+ * provider. Stateless and replica-safe.
+ *
+ * Env:
+ *   LENSMCP_GW_PORTS         csv of ports (default "8080", or "8443" with TLS)
+ *   LENSMCP_GW_MANIFESTS     path to a manifests JSON file (array or {manifests:[]})
+ *   LENSMCP_GW_ENDPOINTS     path to an endpoints JSON for gateway-side LB / rollout
+ *                           (only needed for services whose manifest has no `upstream`).
+ *                           Flat:    {service:[url,...]}
+ *                           Rollout: {service:[{version,weight,urls:[url,...]}]}  ← weighted
+ *                           split across version cohorts; file is watched so weight
+ *                           changes ramp/rollback traffic LIVE (no redeploy).
+ *   LENSMCP_GW_KEYS          path to a {service: x-internal-token} JSON (the trust registry)
+ *   LENSMCP_GW_TLS_KEY       path to TLS private key PEM (enables https)
+ *   LENSMCP_GW_TLS_CERT      path to TLS cert PEM
+ *   LENSMCP_GW_JWT_REQUIRED  "1" → jwt-mode routes require an `Authorization: Bearer …`
+ *                           (minimal edge guard; swap in a full JWKS validator here)
+ *   LENSMCP_EVENT_FILE       set → enable the lens bus (OPT-IN; off by default)
+ *
+ *   Targeted rollout (attribute-based routing; docs/design/targeted-rollout.md):
+ *   LENSMCP_GW_ENDPOINTS     also accepts the targeted shape per service:
+ *                           {service:{rules:[{name,when,version}],cohorts:[…]}}
+ *   LENSMCP_GW_JWT_SECRET    HS256 secret → identify() exposes VERIFIED claims as
+ *                           rule attributes (sub/email/tenant/roles…). RS256/JWKS = prod upgrade.
+ *   LENSMCP_GW_ATTR_HEADERS  csv of request headers exposed to rules as `header.<name>`
+ *   LENSMCP_GW_TRUST_PROXY   "1" → take the `ip` attribute from X-Forwarded-For (behind an LB)
+ *   LENSMCP_GW_UID_HEADER    header carrying a device/user id — sticky key when no cookie
+ *   LENSMCP_GW_COOKIE_SECRET set → enable the HMAC-signed device cookie (sticky bucketing)
+ *   LENSMCP_GW_COOKIE_NAME   device cookie name (default "lensmcp_did")
+ *   LENSMCP_GW_COOKIE_DOMAIN cookie Domain (e.g. ".tetros.ai" to span subdomains)
+ *   LENSMCP_GW_COOKIE_MAXAGE cookie Max-Age seconds (default 31536000)
+ *
+ * Manifests + endpoints + keys are FILE-backed here; a registry-backed
+ * ManifestProvider (Redis/ConfigMap) drops in behind the same interface.
+ */
+const node_fs_1 = require("node:fs");
+const node_crypto_1 = require("node:crypto");
+const node_path_1 = require("node:path");
+const prod_gateway_lib_1 = require("./prod-gateway.lib");
+const jwks_verify_1 = require("./jwks-verify");
+const registry_source_1 = require("./registry-source");
+const providers_prod_1 = require("./providers-prod");
+function readJson(path, fallback) {
+    if (!path)
+        return fallback;
+    try {
+        return JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8'));
+    }
+    catch (e) {
+        console.error(`[gateway] could not read ${path}:`, e.message);
+        return fallback;
+    }
+}
+/** Endpoints file is either flat `{svc:[url]}` or rollout `{svc:[{version,weight,urls}]}`. */
+function isCohortShape(eps) {
+    const first = Object.values(eps)[0];
+    return Array.isArray(first) && first.length > 0 && typeof first[0] === 'object' && first[0] !== null && 'urls' in first[0];
+}
+/** Poll a JSON file and invoke `onChange` with its parsed contents whenever it
+ *  changes — drives LIVE rollout ramps (edit weights → traffic shifts, no
+ *  redeploy). Returns a stop fn. */
+function watchJsonFile(path, onChange, pollMs = 1000) {
+    let mtime = -1;
+    const tick = () => {
+        if (!(0, node_fs_1.existsSync)(path))
+            return;
+        let m;
+        try {
+            m = (0, node_fs_1.statSync)(path).mtimeMs;
+        }
+        catch {
+            return;
+        }
+        if (m === mtime)
+            return;
+        let data;
+        try {
+            data = JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8'));
+        }
+        catch (e) {
+            console.error('[gateway] endpoints reload:', e.message);
+            return;
+        }
+        mtime = m;
+        onChange(data);
+    };
+    const timer = setInterval(tick, pollMs);
+    timer.unref?.();
+    return () => clearInterval(timer);
+}
+async function main() {
+    const env = process.env;
+    const ports = (env['LENSMCP_GW_PORTS'] ?? '').split(',').map((s) => Number(s.trim())).filter(Boolean);
+    // Process-level safety net: a single uncaught async error must not kill the
+    // pod and 503 every in-flight request — log and keep serving.
+    process.on('uncaughtException', (err) => console.error('[gateway] uncaughtException:', err));
+    process.on('unhandledRejection', (reason) => console.error('[gateway] unhandledRejection:', reason));
+    // Config source: a Redis REGISTRY (zero-touch auto-sync — a deploy / the
+    // `lensmcp rollout --redis` helper writes keys + publishes, gateway re-reads
+    // live) takes precedence; otherwise file-backed manifests + endpoints (watched).
+    const redisUrl = env['LENSMCP_GW_REDIS_URL'];
+    let manifests;
+    let pods;
+    let stopEndpointsWatch;
+    let registry;
+    if (redisUrl) {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const Redis = require('ioredis');
+        const client = new Redis(redisUrl);
+        const reg = (0, registry_source_1.createRegistryProviders)((0, registry_source_1.redisRegistrySource)(client, env['LENSMCP_GW_REDIS_PREFIX'] ? { prefix: env['LENSMCP_GW_REDIS_PREFIX'] } : {}), { onError: (e) => console.error('[gateway] registry:', e instanceof Error ? e.message : e) });
+        await reg.start(); // warm the route table before serving
+        manifests = reg.manifests;
+        pods = reg.pods;
+        registry = reg;
+        console.log(`[gateway] registry: Redis-backed, live (${manifests.list().length} service(s))`);
+    }
+    else {
+        const manifestFile = env['LENSMCP_GW_MANIFESTS'];
+        if (manifestFile) {
+            manifests = (0, providers_prod_1.fileManifestProvider)(manifestFile, { onError: (e) => console.error('[gateway] manifest:', e instanceof Error ? e.message : e) });
+        }
+        else {
+            console.warn('[gateway] no LENSMCP_GW_MANIFESTS / LENSMCP_GW_REDIS_URL — starting with an EMPTY route table (all requests 404 until manifests arrive).');
+            manifests = (0, providers_prod_1.staticManifestProvider)([]);
+        }
+        // Endpoints drive gateway-side LB / progressive rollout. Shapes:
+        //   flat     {svc:[url,...]}                       → endpointsPodProvider
+        //   rollout  {svc:[{version,weight,urls:[...]}]}   → rolloutPodProvider (weighted split)
+        //   targeted {svc:{rules,cohorts}}                 → rolloutPodProvider (ABAC)
+        // The file is watched so weights ramp or roll back LIVE — no gateway redeploy.
+        const endpointsFile = env['LENSMCP_GW_ENDPOINTS'];
+        const endpointsRaw = readJson(endpointsFile, {});
+        if (Object.keys(endpointsRaw).length) {
+            const rollout = isCohortShape(endpointsRaw);
+            pods = rollout
+                ? (0, providers_prod_1.rolloutPodProvider)(endpointsRaw)
+                : (0, providers_prod_1.endpointsPodProvider)(endpointsRaw);
+            console.log(`[gateway] endpoints: ${rollout ? 'ROLLOUT (weighted cohorts)' : 'flat'} — ${Object.keys(endpointsRaw).length} service(s)`);
+            if (endpointsFile) {
+                stopEndpointsWatch = watchJsonFile(endpointsFile, (next) => {
+                    try {
+                        pods?.update?.(next);
+                        console.log('[gateway] endpoints reloaded');
+                    }
+                    catch (e) {
+                        console.error('[gateway] endpoints reload failed:', e.message);
+                    }
+                });
+            }
+        }
+    }
+    const serviceKeys = readJson(env['LENSMCP_GW_KEYS'], {});
+    const tls = env['LENSMCP_GW_TLS_KEY'] && env['LENSMCP_GW_TLS_CERT']
+        ? { key: (0, node_fs_1.readFileSync)(env['LENSMCP_GW_TLS_KEY']), cert: (0, node_fs_1.readFileSync)(env['LENSMCP_GW_TLS_CERT']) }
+        : undefined;
+    // ── JWT verification: JWKS (RS256, prod) preferred, HS256 secret as fallback ──
+    // One verifier powers BOTH identify() (claims → ABAC attributes) and the edge
+    // authenticate() (reject jwt routes when LENSMCP_GW_JWT_REQUIRED). With neither
+    // configured, jwt routes fall back to a bearer-presence check and identity
+    // attributes are absent (IP/header/cookie rules still work).
+    const jwtRequired = env['LENSMCP_GW_JWT_REQUIRED'] === '1';
+    const jwksUrl = env['LENSMCP_GW_JWKS_URL'];
+    const jwtSecret = env['LENSMCP_GW_JWT_SECRET'];
+    const jwks = jwksUrl
+        ? (0, jwks_verify_1.createJwksVerifier)({
+            jwksUrl,
+            ...(env['LENSMCP_GW_JWT_ISS'] ? { issuer: env['LENSMCP_GW_JWT_ISS'] } : {}),
+            ...(env['LENSMCP_GW_JWT_AUD'] ? { audience: env['LENSMCP_GW_JWT_AUD'].split(',').map((s) => s.trim()) } : {}),
+        })
+        : undefined;
+    const hs256 = (tok) => {
+        if (!jwtSecret)
+            return undefined;
+        const parts = tok.split('.');
+        if (parts.length !== 3)
+            return undefined;
+        try {
+            const expect = (0, node_crypto_1.createHmac)('sha256', jwtSecret).update(parts[0] + '.' + parts[1]).digest('base64url');
+            const a = Buffer.from(parts[2]), b = Buffer.from(expect);
+            if (a.length !== b.length || !(0, node_crypto_1.timingSafeEqual)(a, b))
+                return undefined;
+            const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
+            if (typeof payload.exp === 'number' && Date.now() / 1000 > payload.exp)
+                return undefined;
+            return payload;
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const bearerClaims = (req) => {
+        const auth = String(req.headers['authorization'] ?? '');
+        if (!auth.startsWith('Bearer '))
+            return undefined;
+        const tok = auth.slice(7);
+        return jwks ? jwks.verify(tok) : hs256(tok);
+    };
+    const identify = (jwks || jwtSecret) ? bearerClaims : undefined;
+    const authenticate = (mode, req) => {
+        if (mode !== 'jwt' || !jwtRequired)
+            return;
+        if (jwks || jwtSecret) {
+            if (!bearerClaims(req))
+                throw new Error('invalid or missing token');
+            return;
+        } // real verification
+        if (!String(req.headers['authorization'] ?? '').startsWith('Bearer '))
+            throw new Error('missing bearer token');
+    };
+    const attributeHeaders = (env['LENSMCP_GW_ATTR_HEADERS'] ?? '').split(',').map((s) => s.trim()).filter(Boolean);
+    const trustProxyIp = env['LENSMCP_GW_TRUST_PROXY'] === '1';
+    const uidHeader = env['LENSMCP_GW_UID_HEADER'];
+    const cookie = (env['LENSMCP_GW_COOKIE_SECRET'] || env['LENSMCP_GW_COOKIE_NAME'] || env['LENSMCP_GW_COOKIE_DOMAIN'])
+        ? {
+            ...(env['LENSMCP_GW_COOKIE_NAME'] ? { name: env['LENSMCP_GW_COOKIE_NAME'] } : {}),
+            ...(env['LENSMCP_GW_COOKIE_SECRET'] ? { secret: env['LENSMCP_GW_COOKIE_SECRET'] } : {}),
+            ...(env['LENSMCP_GW_COOKIE_DOMAIN'] ? { domain: env['LENSMCP_GW_COOKIE_DOMAIN'] } : {}),
+            ...(env['LENSMCP_GW_COOKIE_MAXAGE'] ? { maxAge: Number(env['LENSMCP_GW_COOKIE_MAXAGE']) } : {}),
+        }
+        : undefined;
+    // Lens bus is OPT-IN: only when LENSMCP_EVENT_FILE is set do we attach a sink.
+    const eventFile = env['LENSMCP_EVENT_FILE'];
+    let dirReady = false;
+    const emit = eventFile
+        ? (event) => {
+            try {
+                if (!dirReady) {
+                    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(eventFile), { recursive: true });
+                    dirReady = true;
+                }
+                (0, node_fs_1.appendFileSync)(eventFile, JSON.stringify(event) + '\n');
+            }
+            catch { /* lens offline — never block traffic */ }
+        }
+        : undefined;
+    // Warm the JWKS before serving so the first identity-routed requests have keys.
+    if (jwks) {
+        try {
+            await jwks.refresh();
+            console.log('[gateway] JWKS loaded');
+        }
+        catch (e) {
+            console.error('[gateway] initial JWKS load failed (will retry in background):', e.message);
+        }
+    }
+    const handle = await (0, prod_gateway_lib_1.startProdGateway)({
+        ...(ports.length ? { ports } : {}),
+        manifests,
+        ...(pods ? { pods } : {}),
+        serviceKeys,
+        authenticate,
+        ...(tls ? { tls } : {}),
+        ...(emit ? { emit } : {}),
+        ...(identify ? { identify } : {}),
+        ...(attributeHeaders.length ? { attributeHeaders } : {}),
+        ...(trustProxyIp ? { trustProxyIp } : {}),
+        ...(cookie ? { cookie } : {}),
+        ...(uidHeader ? { uidHeader } : {}),
+    });
+    console.log(`[gateway] production gateway up on ${handle.ports.join(', ')} (${handle.routes().length} routes${emit ? ', lens ON' : ''})`);
+    const shutdown = async (sig) => {
+        console.log(`[gateway] ${sig} — draining…`);
+        try {
+            manifests.stop?.();
+        }
+        catch { /* ignore */ }
+        try {
+            stopEndpointsWatch?.();
+        }
+        catch { /* ignore */ }
+        try {
+            registry?.stop();
+        }
+        catch { /* ignore */ }
+        try {
+            jwks?.stop();
+        }
+        catch { /* ignore */ }
+        await handle.stop();
+        process.exit(0);
+    };
+    for (const sig of ['SIGTERM', 'SIGINT'])
+        process.on(sig, () => void shutdown(sig));
+}
+void main();

package/executors/gateway/main.rollout.d.ts

@@ -0,0 +1,2 @@
+export declare function runRollout(argv: string[]): Promise<number>;
+//# sourceMappingURL=main.rollout.d.ts.map

package/executors/gateway/main.rollout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.rollout.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/main.rollout.ts"],"names":[],"mappings":"AAuFA,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAKhE"}

package/executors/gateway/main.rollout.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runRollout = runRollout;
+/**
+ * `lensmcp rollout` CD helper entry — safe, scriptable edits to the gateway
+ * rollout config. Two targets:
+ *   - a FILE (default): the watched config / mounted ConfigMap. Atomic write
+ *     (tmp + rename) so the gateway watcher never reads a half file.
+ *   - a REDIS registry (`--redis <url>`): writes the service's rollout key and
+ *     PUBLISHES the change channel, so a registry-backed gateway re-reads live
+ *     (zero-touch auto-sync; no file mounts).
+ *
+ *   node main.rollout.js <config.json> <command> [args]
+ *   node main.rollout.js --redis <url> [--prefix <p>] <command> [args]
+ *
+ * Available from the published @lensmcp/cluster package; `lensmcp rollout …`
+ * wraps it. See docs/design/targeted-rollout.md.
+ */
+const node_fs_1 = require("node:fs");
+const rollout_ops_1 = require("./rollout-ops");
+const registry_source_1 = require("./registry-source");
+const USAGE = `lensmcp rollout — edit the gateway rollout config (file or Redis registry)
+
+Usage: <config.json> <command> [args]
+       --redis <url> [--prefix <p>] <command> [args]
+
+Commands:
+  status [service]                                       show cohorts + rules
+  add-cohort  <svc> <version> <weight> <url> [url...]    add a version cohort
+  set-weight  <svc> <version> <weight>                   ramp / adjust a cohort weight
+  remove-cohort <svc> <version>                          drop a cohort
+  promote     <svc> <version>                            set version=100%, others=0
+  abort       <svc> <version>                            set version weight=0 (rollback)
+  add-rule    <svc> <name> <attr> <op> <value> <version> add/replace a targeting rule
+  remove-rule <svc> <name>                               remove a targeting rule
+`;
+const out = (s) => process.stdout.write(s.endsWith('\n') ? s : s + '\n');
+const err = (s) => process.stderr.write(s.endsWith('\n') ? s : s + '\n');
+/** Pull `--flag <value>` out of argv, returning its value + the remaining args. */
+function extractFlag(argv, name) {
+    const i = argv.indexOf(name);
+    if (i < 0)
+        return { rest: argv };
+    return { value: argv[i + 1], rest: [...argv.slice(0, i), ...argv.slice(i + 2)] };
+}
+function runFile(argv) {
+    const [file, ...rest] = argv;
+    if (!file || !rest.length) {
+        err(USAGE);
+        return 2;
+    }
+    let config;
+    try {
+        config = JSON.parse((0, node_fs_1.readFileSync)(file, 'utf8'));
+    }
+    catch (e) {
+        err(`cannot read ${file}: ${e.message}`);
+        return 1;
+    }
+    try {
+        const parsed = (0, rollout_ops_1.parseRolloutCommand)(rest);
+        if (!parsed.op) {
+            out((0, rollout_ops_1.summarizeRollout)(config, parsed.status));
+            return 0;
+        }
+        const next = (0, rollout_ops_1.applyRolloutOp)(config, parsed.op);
+        (0, node_fs_1.writeFileSync)(`${file}.tmp`, JSON.stringify(next, null, 2) + '\n');
+        (0, node_fs_1.renameSync)(`${file}.tmp`, file); // atomic — the watcher never sees a partial file
+        out(`✓ ${parsed.op.kind} ${parsed.op.service}\n\n${(0, rollout_ops_1.summarizeRollout)(next, parsed.op.service)}`);
+        return 0;
+    }
+    catch (e) {
+        err(`✗ ${e.message}`);
+        return 1;
+    }
+}
+async function runRedis(url, prefix, argv) {
+    if (!argv.length) {
+        err(USAGE);
+        return 2;
+    }
+    let client;
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const Redis = require('ioredis');
+        client = new Redis(url);
+    }
+    catch {
+        err('--redis needs the "ioredis" package installed (peer dep of @lensmcp/cluster)');
+        return 1;
+    }
+    try {
+        const { endpoints } = await (0, registry_source_1.redisRegistrySource)(client, { prefix }).read();
+        const parsed = (0, rollout_ops_1.parseRolloutCommand)(argv);
+        if (!parsed.op) {
+            out((0, rollout_ops_1.summarizeRollout)(endpoints, parsed.status));
+            return 0;
+        }
+        const next = (0, rollout_ops_1.applyRolloutOp)(endpoints, parsed.op);
+        const svc = parsed.op.service;
+        const entry = next[svc];
+        if (entry === undefined)
+            await client.del((0, registry_source_1.rolloutKey)(prefix, svc));
+        else
+            await client.set((0, registry_source_1.rolloutKey)(prefix, svc), JSON.stringify(entry));
+        await client.publish((0, registry_source_1.changeChannel)(prefix), svc); // gateway re-reads live
+        out(`✓ ${parsed.op.kind} ${svc} → redis ${prefix} (published)\n\n${(0, rollout_ops_1.summarizeRollout)(next, svc)}`);
+        return 0;
+    }
+    catch (e) {
+        err(`✗ ${e.message}`);
+        return 1;
+    }
+    finally {
+        try {
+            await client.quit();
+        }
+        catch { /* ignore */ }
+    }
+}
+async function runRollout(argv) {
+    const redis = extractFlag(argv, '--redis');
+    const pref = extractFlag(redis.rest, '--prefix');
+    if (redis.value)
+        return runRedis(redis.value, pref.value ?? registry_source_1.DEFAULT_REGISTRY_PREFIX, pref.rest);
+    return runFile(pref.rest);
+}
+// Run only when invoked directly (not when imported, e.g. by the lensmcp CLI).
+if (require.main === module)
+    void runRollout(process.argv.slice(2)).then((code) => process.exit(code));