@lensmcp/cluster 1.11.0 → 1.13.0

package/executors/gateway/prod-runtime/access-log.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Opt-in one-JSON-line-per-request access log to stdout, shaped for Cloud
+ * Logging (severity + time + message). Covers EVERY response (incl. 401/404/503
+ * that never reached an upstream); `reply.elapsedTime` gives latency for free.
+ */
+import type { FastifyReply, FastifyRequest } from 'fastify';
+import type { ReqState } from './types';
+export declare const logAccess: (request: FastifyRequest, reply: FastifyReply, st: ReqState | undefined) => void;
+//# sourceMappingURL=access-log.d.ts.map

package/executors/gateway/prod-runtime/access-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-log.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/prod-runtime/access-log.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,eAAO,MAAM,SAAS,GAAI,SAAS,cAAc,EAAE,OAAO,YAAY,EAAE,IAAI,QAAQ,GAAG,SAAS,KAAG,IAkBlG,CAAC"}

package/executors/gateway/prod-runtime/access-log.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logAccess = void 0;
+const logAccess = (request, reply, st) => {
+    const req = request.raw;
+    const status = reply.statusCode ?? 0;
+    const host = (req.headers.host || '').split(':')[0];
+    const path = (req.url || '/').split('?')[0];
+    const ms = Math.round(reply.elapsedTime);
+    try {
+        console.log(JSON.stringify({
+            severity: status >= 500 ? 'ERROR' : status >= 400 ? 'WARNING' : 'INFO',
+            time: new Date().toISOString(),
+            message: `${req.method} ${host}${path} ${status} ${ms}ms`,
+            method: req.method, host, path, status, ms,
+            ...(st ? { service: st.route.service, upstream: st.upLabel } : {}),
+            ...(st?.version ? { version: st.version } : {}),
+            ...(st?.caller ? { caller: st.caller } : {}),
+            ...(req.headers['x-request-id'] ? { requestId: String(req.headers['x-request-id']) } : {}),
+        }));
+    }
+    catch { /* never let logging break the response */ }
+};
+exports.logAccess = logAccess;

package/executors/gateway/prod-runtime/app.d.ts

@@ -0,0 +1,23 @@
+import type * as http from 'node:http';
+import type * as net from 'node:net';
+import { type FastifyInstance, type FastifyReply, type FastifyRequest } from 'fastify';
+import type { TraceSpan } from '../otel-tracing';
+import type { ProdHookContext, ProdRuntime, ReqState } from './types';
+import type { Observability } from './observability';
+import type { CorsLayer } from './cors';
+import type { HooksLayer } from './hooks';
+export interface AppDeps {
+    rt: ProdRuntime;
+    obs: Observability;
+    cors: CorsLayer;
+    hooks: HooksLayer;
+    handler: (request: FastifyRequest, reply: FastifyReply) => Promise<unknown>;
+    upgrade: (req: http.IncomingMessage, socket: net.Socket, head: Buffer) => void;
+    reqState: WeakMap<FastifyRequest, ReqState>;
+    spanByReq: WeakMap<FastifyRequest, TraceSpan>;
+    ctxByReq: WeakMap<FastifyRequest, ProdHookContext>;
+}
+export declare function createApp(deps: AppDeps): {
+    buildApp: () => Promise<FastifyInstance>;
+};
+//# sourceMappingURL=app.d.ts.map

package/executors/gateway/prod-runtime/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/prod-runtime/app.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,KAAK,GAAG,MAAM,UAAU,CAAC;AACrC,OAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAKhG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,WAAW,CAAC;IAChB,GAAG,EAAE,aAAa,CAAC;IACnB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/E,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC5C,SAAS,EAAE,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IAC9C,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;CACpD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG;IAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAA;CAAE,CA0FrF"}

package/executors/gateway/prod-runtime/app.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createApp = createApp;
+const tslib_1 = require("tslib");
+/**
+ * Builds one Fastify app per port (shared route table + providers). Streams
+ * every body straight through (never parses/buffers — this is a proxy), wires
+ * reply-from's undici pool, the operational probes (/livez /readyz /statusz
+ * /metricsz), and the trust / CORS / edge-finish hooks.
+ */
+const node_crypto_1 = require("node:crypto");
+const fastify_1 = tslib_1.__importDefault(require("fastify"));
+const reply_from_1 = tslib_1.__importDefault(require("@fastify/reply-from"));
+const edge_1 = require("./edge");
+const trust_1 = require("./trust");
+const access_log_1 = require("./access-log");
+function createApp(deps) {
+    const { rt, obs, cors, hooks, handler, upgrade, reqState, spanByReq, ctxByReq } = deps;
+    const opts = rt.opts;
+    const buildApp = async () => {
+        const keepAlive = opts.server?.keepAliveTimeout ?? 620_000; // > GCP external ALB 600s backend keep-alive
+        const app = (0, fastify_1.default)({
+            logger: false,
+            keepAliveTimeout: keepAlive,
+            requestTimeout: opts.server?.requestTimeout ?? 0, // 0 = no inbound request timeout (long-lived streaming)
+            ...(opts.server?.connectionTimeout !== undefined ? { connectionTimeout: opts.server.connectionTimeout } : {}),
+            ...(opts.trustProxyIp ? { trustProxy: true } : {}),
+            ...(opts.tls ? { https: { key: opts.tls.key, cert: opts.tls.cert } } : {}),
+        });
+        // headersTimeout must stay above keepAliveTimeout, else Node may close an idle
+        // keep-alive socket mid-request under load. Default: just above keepAlive.
+        app.server.headersTimeout = opts.server?.headersTimeout ?? keepAlive + 10_000;
+        // Stream every body straight through — never parse/buffer (this is a proxy).
+        app.removeAllContentTypeParsers();
+        app.addContentTypeParser('*', (_req, payload, done) => done(null, payload));
+        await app.register(reply_from_1.default, {
+            disableRequestLogging: true,
+            undici: {
+                connections: opts.undici?.connections ?? 256,
+                pipelining: opts.undici?.pipelining ?? 1,
+                keepAliveTimeout: opts.undici?.keepAliveTimeout ?? 60_000,
+                bodyTimeout: opts.undici?.bodyTimeout ?? 0, // 0 = unlimited — never cut long-lived SSE / streaming MCP responses
+                headersTimeout: opts.undici?.headersTimeout ?? 60_000, // upstream must send response headers within 60s
+                ...(opts.undici?.allowH2 ? { allowH2: true } : {}), // multiplex many MCP streams over few h2 conns
+                connect: {
+                    rejectUnauthorized: opts.undici?.rejectUnauthorized ?? false, // local-CA/self-signed by default
+                    ...(opts.undici?.cert ? { cert: opts.undici.cert } : {}), // ── mTLS: present a client cert to upstreams ──
+                    ...(opts.undici?.key ? { key: opts.undici.key } : {}),
+                    ...(opts.undici?.ca ? { ca: opts.undici.ca } : {}), // trust a private CA for the server side
+                },
+            },
+        });
+        // Host-agnostic operational probes (answered before routing).
+        app.get('/livez', (_req, reply) => { reply.type('text/plain').send('ok'); });
+        app.get('/readyz', (_req, reply) => {
+            const ready = rt.table.routes.length > 0;
+            reply.code(ready ? 200 : 503).type('text/plain').send(ready ? 'ready' : 'no routes loaded');
+        });
+        // Per-service health rollup (opt-in; token-guarded). Off by default → 404 (don't leak topology).
+        app.get('/statusz', (request, reply) => {
+            // Fail closed: served ONLY when both enabled AND a token is set. Constant-time token compare.
+            if (!opts.statusEndpoint || !opts.statusToken) {
+                reply.code(404).type('text/plain').send('not found');
+                return;
+            }
+            const tok = request.query?.token ?? (0, edge_1.hdr)(request.raw.headers['x-status-token']) ?? '';
+            const a = Buffer.from(tok), b = Buffer.from(opts.statusToken);
+            if (a.length !== b.length || !(0, node_crypto_1.timingSafeEqual)(a, b)) {
+                reply.code(401).type('text/plain').send('unauthorized');
+                return;
+            }
+            reply.type('application/json').send(JSON.stringify({ generatedAt: Date.now(), services: obs.buildStatusSnapshot(), endpoints: opts.healthChecker?.snapshot() ?? [] }));
+        });
+        // Process self-metrics — same token gate as /statusz.
+        app.get('/metricsz', (request, reply) => {
+            if (!opts.metrics || !opts.statusToken) {
+                reply.code(404).type('text/plain').send('not found');
+                return;
+            }
+            const tok = request.query?.token ?? (0, edge_1.hdr)(request.raw.headers['x-status-token']) ?? '';
+            const a = Buffer.from(tok), b = Buffer.from(opts.statusToken);
+            if (a.length !== b.length || !(0, node_crypto_1.timingSafeEqual)(a, b)) {
+                reply.code(401).type('text/plain').send('unauthorized');
+                return;
+            }
+            reply.type('application/json').send(JSON.stringify(opts.metrics.snapshot()));
+        });
+        app.addHook('onRequest', (request, _reply, done) => { (0, trust_1.stripTrust)(request.raw); done(); });
+        // Edge CORS authority: stamp Access-Control-Allow-Origin on EVERY response that lacks it (gateway-generated),
+        // but NEVER bless a proxied upstream success cross-origin (see cors.applyResponseCors).
+        app.addHook('onSend', (request, reply, payload, done) => { cors.applyResponseCors(request, reply); done(null, payload); });
+        app.addHook('onResponse', (request, reply, done) => {
+            const st = reqState.get(request);
+            if (st) {
+                obs.recordEdge(st.route, Date.now() - st.startedAt, reply.statusCode ?? 0, st.caller, st.version);
+                obs.finish(st.trace, st.route.service, reply.statusCode ?? 0, { upstream: st.upLabel, ...(st.version ? { version: st.version } : {}), ...(st.caller ? { caller: st.caller } : {}) });
+                reqState.delete(request);
+            }
+            const sp = spanByReq.get(request);
+            if (sp) {
+                opts.tracing.end(sp, reply.statusCode ?? 0, { ...(st?.upLabel ? { 'upstream.url': st.upLabel } : {}), ...(st?.version ? { 'lensmcp.version': st.version } : {}) });
+                spanByReq.delete(request);
+            }
+            opts.metrics?.recordRequest(reply.statusCode ?? 0);
+            if (rt.accessLog)
+                (0, access_log_1.logAccess)(request, reply, st);
+            // Customer onResponse (terminal phase — observes the finished response).
+            const ctx = ctxByReq.get(request);
+            if (ctx) {
+                ctx.status = reply.statusCode ?? 0;
+                if (hooks.has('onResponse'))
+                    void hooks.run('onResponse', ctx);
+                ctxByReq.delete(request);
+            }
+            done();
+        });
+        app.all('/', handler);
+        app.all('/*', handler);
+        app.server.on('upgrade', upgrade);
+        return app;
+    };
+    return { buildApp };
+}

package/executors/gateway/prod-runtime/auth.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The edge-auth layer — ONE source for the HTTP handler and the WS upgrade so
+ * they can't drift. `internal(...)` validates the caller's `x-api-key` on an
+ * `internal.<host>` route; `public(...)` runs the JWT/authz seam (verify →
+ * fail-closed ABAC → stamp identity). Each returns a verdict; the caller turns a
+ * denial into its own rejection (handler → `finish`+`sendError`; upgrade → `socket.destroy()`).
+ *
+ * NOTE: `public()` calls `stampIdentity` and `internal()` mutates `req.headers`;
+ * the upgrade path rebuilds its request from `req.rawHeaders` (re-adding identity
+ * explicitly), so those header mutations are simply ignored there — no divergence.
+ */
+import * as http from 'node:http';
+import { type AuthMode, type Route } from '../manifest';
+import type { GatewayErrorReason } from '../gateway-errors';
+import type { GwTrace, ProdRuntime } from './types';
+import type { Observability } from './observability';
+import type { RolloutLayer } from './rollout';
+export interface AuthVerdict {
+    ok: boolean;
+    caller?: string;
+    status?: number;
+    reason?: GatewayErrorReason;
+    detail?: string;
+}
+export interface EdgeAuth {
+    internal(req: http.IncomingMessage, route: Route, trace: GwTrace | undefined): AuthVerdict;
+    public(req: http.IncomingMessage, route: Route, cpath: string, claims: Record<string, unknown> | undefined, fallbackIp: string, trace: GwTrace | undefined): AuthVerdict;
+}
+export declare function createEdgeAuth(rt: ProdRuntime, obs: Observability, rollout: RolloutLayer, authenticate: (mode: AuthMode, req: http.IncomingMessage) => void): EdgeAuth;
+//# sourceMappingURL=auth.d.ts.map

package/executors/gateway/prod-runtime/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/prod-runtime/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAA6B,KAAK,QAAQ,EAAqB,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAEtG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE9C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IAC3F,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;CAC1K;AAED,wBAAgB,cAAc,CAC5B,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,YAAY,EACrB,YAAY,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI,GAChE,QAAQ,CAiCV"}

package/executors/gateway/prod-runtime/auth.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createEdgeAuth = createEdgeAuth;
+const manifest_1 = require("../manifest");
+const trust_1 = require("./trust");
+function createEdgeAuth(rt, obs, rollout, authenticate) {
+    const internal = (req, _route, trace) => {
+        const caller = rt.keyToProject.get(String(req.headers['x-api-key'] ?? ''));
+        if (!caller) {
+            obs.step(trace, 'auth', { mode: 'x-api-key', ok: false });
+            return { ok: false, status: 401, reason: 'unauthorized', detail: 'Invalid or missing x-api-key for internal route.' };
+        }
+        req.headers['x-api-key-id'] = caller;
+        delete req.headers['x-api-key'];
+        obs.step(trace, 'auth', { mode: 'x-api-key', ok: true, caller });
+        return { ok: true, caller };
+    };
+    const publicAuth = (req, route, cpath, claims, fallbackIp, trace) => {
+        const m = rt.table.manifestByService.get(route.service);
+        const resolved = m ? (0, manifest_1.authRuleForPath)(m, cpath, req.method ?? 'GET', false) : { mode: route.auth };
+        if (resolved.mode === 'jwt') {
+            if (rt.opts.identify) {
+                if (!claims) {
+                    obs.step(trace, 'auth', { mode: 'jwt', ok: false });
+                    return { ok: false, status: 401, reason: 'unauthorized', detail: 'Unauthorized: invalid or missing token' };
+                }
+            }
+            else {
+                try {
+                    authenticate('jwt', req);
+                }
+                catch (e) {
+                    obs.step(trace, 'auth', { mode: 'jwt', ok: false });
+                    return { ok: false, status: 401, reason: 'unauthorized', detail: `Unauthorized: ${e.message}` };
+                }
+            }
+            // edge ABAC: a present rule MUST be satisfied by VERIFIED claims. No claims (no verifier) → DENY (fail closed).
+            if (resolved.rule && (!claims || !(0, manifest_1.evalRule)(resolved.rule, rollout.buildAttrs(req, fallbackIp, claims, undefined)))) {
+                obs.step(trace, 'authz', { ok: false });
+                return { ok: false, status: 403, reason: 'forbidden', detail: 'Forbidden: insufficient permission' };
+            }
+            obs.step(trace, 'auth', { mode: 'jwt', ok: true });
+            if (claims)
+                (0, trust_1.stampIdentity)(req, claims);
+            return { ok: true };
+        }
+        obs.step(trace, 'auth', { mode: resolved.mode });
+        return { ok: true };
+    };
+    return { internal, public: publicAuth };
+}

package/executors/gateway/prod-runtime/cors.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The edge CORS authority. The gateway is the CORS authority for its OWN
+ * responses (no-route / errors / preflights) and for credentialed first-party
+ * origins, but must NEVER bless a proxied upstream success cross-origin (the
+ * upstream owns CORS on its own app data — CWE-942).
+ */
+import type * as http from 'node:http';
+import type { FastifyReply, FastifyRequest } from 'fastify';
+import type { ProdRuntime, ReqState } from './types';
+export interface CorsLayer {
+    /** Stamp CORS on a gateway-generated reply (no-route / preflight): exact origin +
+     *  credentials for an allowlisted origin, else a reflected origin WITHOUT credentials. */
+    setCors(reply: FastifyReply, req: http.IncomingMessage): void;
+    /** onSend: add CORS to any response that lacks it — a credentialed-allowlist origin always
+     *  (proxied or generated); a non-allowlisted origin ONLY on a gateway-GENERATED reply. */
+    applyResponseCors(request: FastifyRequest, reply: FastifyReply): void;
+}
+export declare function createCors(rt: ProdRuntime, reqState: WeakMap<FastifyRequest, ReqState>): CorsLayer;
+//# sourceMappingURL=cors.d.ts.map

package/executors/gateway/prod-runtime/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/prod-runtime/cors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAErD,MAAM,WAAW,SAAS;IACxB;8FAC0F;IAC1F,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC9D;8FAC0F;IAC1F,iBAAiB,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;CACvE;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,GAAG,SAAS,CAqClG"}

package/executors/gateway/prod-runtime/cors.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCors = createCors;
+function createCors(rt, reqState) {
+    const setCors = (reply, req) => {
+        const origin = req.headers.origin;
+        // Credentialed allowlist: echo the EXACT origin + allow credentials (cookies). NEVER `*` with
+        // credentials (forbidden by the Fetch spec; a cross-site read hole).
+        if (origin && rt.corsCredentialOrigins.has(origin.toLowerCase())) {
+            reply.header('access-control-allow-origin', origin);
+            reply.header('access-control-allow-credentials', 'true');
+            reply.header('vary', 'Origin');
+            return;
+        }
+        // Otherwise — UNAUTHENTICATED gateway responses (404 / health / discovery / preflight):
+        // reflect the Origin for convenience but DO NOT allow credentials.
+        reply.header('access-control-allow-origin', String(origin ?? '*'));
+        reply.header('vary', 'Origin');
+    };
+    const applyResponseCors = (request, reply) => {
+        const origin = request.headers.origin;
+        if (origin && !reply.getHeader('access-control-allow-origin')) {
+            // Credentialed allowlist: EXACT origin + ACAC:true so a credentialed first-party app can read a
+            // cookie-setting routed response AND a gateway-generated 401/403/5xx passes the browser CORS check.
+            if (rt.corsCredentialOrigins.has(origin.toLowerCase())) {
+                reply.header('access-control-allow-origin', origin);
+                reply.header('access-control-allow-credentials', 'true');
+                reply.header('vary', 'Origin');
+            }
+            else if (!reqState.get(request)?.proxied) {
+                // A non-allowlisted origin is reflected ONLY on a gateway-GENERATED reply (error / no-route),
+                // NEVER on a successful PROXIED upstream response — that would be a blanket cross-origin read
+                // of app data (CWE-942). The upstream owns CORS on its own responses.
+                reply.header('access-control-allow-origin', String(origin));
+                reply.header('vary', 'Origin');
+            }
+        }
+    };
+    return { setCors, applyResponseCors };
+}

package/executors/gateway/prod-runtime/edge.d.ts

@@ -0,0 +1,16 @@
+import type * as http from 'node:http';
+import { type GatewayErrorReason } from '../gateway-errors';
+import type { ReplyLike } from './types';
+export declare const eid: () => string;
+export declare const hdr: (v: string | string[] | undefined) => string | undefined;
+/**
+ * Send a gateway-generated edge error as the JSON envelope `{ key, status, traceId, message? }` (NOT
+ * `text/plain`), stamping `x-request-id` so the trace id is on the response. The SAME `{ key, status }`
+ * localized contract a service returns, so a browser app renders `t(key)` and surfaces the trace id.
+ * `detail` is the dev-facing hint (the old plain-text reason), never shown to end users.
+ */
+export declare const sendError: (reply: ReplyLike, req: http.IncomingMessage, status: number, reason: GatewayErrorReason, detail?: string) => ReplyLike;
+export declare const ENCODED_STRUCTURE: RegExp;
+/** Canonical path for auth matching, or undefined if the path is unsafe (→ 400 / drop). */
+export declare const canonicalPath: (rawUrl: string) => string | undefined;
+//# sourceMappingURL=edge.d.ts.map

package/executors/gateway/prod-runtime/edge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/prod-runtime/edge.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,EAAiE,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC3H,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,eAAO,MAAM,GAAG,QAAO,MAAkE,CAAC;AAE1F,eAAO,MAAM,GAAG,GAAI,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,KAAG,MAAM,GAAG,SACa,CAAC;AAE9E;;;;;GAKG;AACH,eAAO,MAAM,SAAS,GACpB,OAAO,SAAS,EAChB,KAAK,IAAI,CAAC,eAAe,EACzB,QAAQ,MAAM,EACd,QAAQ,kBAAkB,EAC1B,SAAS,MAAM,KACd,SAOF,CAAC;AAQF,eAAO,MAAM,iBAAiB,QAAwB,CAAC;AAIvD,2FAA2F;AAC3F,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,KAAG,MAAM,GAAG,SAgBvD,CAAC"}

package/executors/gateway/prod-runtime/edge.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalPath = exports.ENCODED_STRUCTURE = exports.sendError = exports.hdr = exports.eid = void 0;
+/**
+ * Edge primitives for the prod gateway: id/header helpers, the localized JSON
+ * error envelope, and the path-canonicalization guard. Pure (no runtime state).
+ */
+const node_crypto_1 = require("node:crypto");
+const gateway_errors_1 = require("../gateway-errors");
+const eid = () => Date.now().toString(36) + (0, node_crypto_1.randomBytes)(6).toString('hex');
+exports.eid = eid;
+const hdr = (v) => typeof v === 'string' && v !== '' ? v : Array.isArray(v) ? v[0] : undefined;
+exports.hdr = hdr;
+/**
+ * Send a gateway-generated edge error as the JSON envelope `{ key, status, traceId, message? }` (NOT
+ * `text/plain`), stamping `x-request-id` so the trace id is on the response. The SAME `{ key, status }`
+ * localized contract a service returns, so a browser app renders `t(key)` and surfaces the trace id.
+ * `detail` is the dev-facing hint (the old plain-text reason), never shown to end users.
+ */
+const sendError = (reply, req, status, reason, detail) => {
+    const traceId = (0, gateway_errors_1.ensureRequestId)(req);
+    return reply
+        .code(status)
+        .header('x-request-id', traceId)
+        .type(gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE)
+        .send((0, gateway_errors_1.gatewayErrorBody)(status, reason, traceId, detail));
+};
+exports.sendError = sendError;
+// Path-canonicalization guard (CWE-288): a reverse proxy and its backend must agree
+// on the request path, or auth gets evaluated against a DIFFERENT path than the one
+// served (AWS API Gateway trailing-slash bypass, IBM API Connect CVE-2025-13915,
+// Kong/Envoy/NGINX normalization mismatch). We REJECT structurally-encoded paths
+// (encoded dot/slash/backslash/null) outright, and return the DECODED path for auth
+// matching so `/%61dmin` is matched as `/admin` — never skipped because it's encoded.
+exports.ENCODED_STRUCTURE = /%2e|%2f|%5c|%00|\\/i; // encoded . / \ NUL, or a raw backslash
+const NEEDS_NORMALIZE = /[%;#\\]/; // percent-encoding, matrix param, fragment, or backslash
+const TRAVERSAL = /(^|\/)\.\.(?=\/|$)/; // a `..` path segment
+/** Canonical path for auth matching, or undefined if the path is unsafe (→ 400 / drop). */
+const canonicalPath = (rawUrl) => {
+    const q = rawUrl.indexOf('?');
+    const p = q === -1 ? rawUrl : rawUrl.slice(0, q);
+    if (p.indexOf('\0') !== -1)
+        return undefined; // raw NUL is never a valid path (mirrors the decoded-NUL reject)
+    // FAST PATH (the overwhelming majority of production traffic): a clean path — no percent-encoding,
+    // matrix params, fragment, or backslash — needs no decoding or normalization (it already equals what
+    // the backend resolves). Only the `..` traversal check remains. Saves a decodeURIComponent + two regex
+    // + a split/map/join on every request.
+    if (!NEEDS_NORMALIZE.test(p))
+        return TRAVERSAL.test(p) ? undefined : (p || '/');
+    // SLOW PATH: structurally-encoded → reject outright; else decode + strip matrix/fragment so
+    // /admin;x=1 and /admin#.css can't skip the /admin policy (CWE-288), and /%61dmin matches /admin.
+    if (exports.ENCODED_STRUCTURE.test(p))
+        return undefined;
+    let decoded;
+    try {
+        decoded = decodeURIComponent(p);
+    }
+    catch {
+        return undefined;
+    } // malformed %xx
+    if (decoded.includes('\0') || TRAVERSAL.test(decoded))
+        return undefined; // NUL or `..` traversal
+    return decoded.split('#')[0].split('/').map((s) => s.split(';')[0]).join('/') || '/';
+};
+exports.canonicalPath = canonicalPath;

package/executors/gateway/prod-runtime/handler.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The prod HTTP request pipeline: route → trust → auth → forward, with the
+ * security guards (HTTP/0.9 reject, path-canonicalization, rate-limit) BEFORE
+ * routing and the rollout/sticky version selection before the undici hop.
+ *
+ * Customer hook phases slot in at the analogous points, but EVERY hook call is
+ * guarded by `ctx` (built only when hooks are configured) — so with no hooks the
+ * pipeline is byte-for-byte the original (zero overhead; the pentest/perf path).
+ */
+import type { FastifyReply, FastifyRequest } from 'fastify';
+import type { TraceSpan } from '../otel-tracing';
+import type { ProdHookContext, ProdRuntime, ReqState } from './types';
+import type { Observability } from './observability';
+import type { CorsLayer } from './cors';
+import type { EdgeAuth } from './auth';
+import type { UpstreamLayer } from './upstream';
+import type { RolloutLayer } from './rollout';
+import type { HooksLayer } from './hooks';
+export interface HandlerDeps {
+    rt: ProdRuntime;
+    obs: Observability;
+    cors: CorsLayer;
+    auth: EdgeAuth;
+    upstream: UpstreamLayer;
+    rollout: RolloutLayer;
+    hooks: HooksLayer;
+    reqState: WeakMap<FastifyRequest, ReqState>;
+    spanByReq: WeakMap<FastifyRequest, TraceSpan>;
+    ctxByReq: WeakMap<FastifyRequest, ProdHookContext>;
+}
+export declare function createHandler(deps: HandlerDeps): (request: FastifyRequest, reply: FastifyReply) => Promise<unknown>;
+//# sourceMappingURL=handler.d.ts.map

package/executors/gateway/prod-runtime/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/prod-runtime/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,WAAW,CAAC;IAChB,GAAG,EAAE,aAAa,CAAC;IACnB,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,UAAU,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC5C,SAAS,EAAE,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IAC9C,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;CACpD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,CAmKnH"}