@lensmcp/cluster 1.12.0 → 1.13.0

package/executors/gateway/main.prod-gateway.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
 /**
  * Production gateway process entry — the thing the Docker image runs. Reads
  * its whole configuration from the environment (12-factor) and composes
@@ -8,6 +9,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
  *
  * Env:
  *   LENSMCP_GW_PORTS         csv of ports (default "8080", or "8443" with TLS)
+ *   LENSMCP_GW_WORKERS       cluster worker processes for multi-core (default 1; "auto"/"max" =
+ *                            os.cpus().length). Each worker shares the port. SECURITY: with the
+ *                            IN-MEMORY rate limiter the limit is enforced PER WORKER (~N×) — set
+ *                            LENSMCP_GW_RATE_LIMIT_REDIS=1 (one shared budget) when running >1 worker.
  *   LENSMCP_GW_MANIFESTS     path to a manifests JSON file (array or {manifests:[]})
  *   LENSMCP_GW_ENDPOINTS     path to an endpoints JSON for gateway-side LB / rollout
  *                           (only needed for services whose manifest has no `upstream`).
@@ -52,8 +57,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
  *                           proxy (set `cf-connecting-ip` behind Cloudflare; feeds IP-based ABAC)
  *   LENSMCP_GW_CLIENT_IP_TRUSTED_PROXIES  csv of CIDRs allowed to set that header
  *                           (default loopback only — prevents off-proxy IP spoofing)
- *   LENSMCP_GW_UNDICI_CONNECTIONS    per-origin connection pool size (default 256)
+ *   LENSMCP_GW_UNDICI_CONNECTIONS    per-origin connection pool size (default 256; RIGHT-SIZE to the
+ *                                    upstream latency — fewer is faster for a fast/local upstream)
  *   LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS undici response-body timeout; default 0 = unlimited
+ *   LENSMCP_GW_UNDICI_PIPELINING     requests packed per upstream connection (default 1; >1 lifts
+ *                                    throughput on uniformly-fast upstreams but risks head-of-line
+ *                                    blocking on streaming responses — leave 1 for mixed traffic)
+ *   LENSMCP_GW_UNDICI_HEADERS_TIMEOUT_MS upstream response-headers timeout (default 60000)
+ *   LENSMCP_GW_UNDICI_KEEPALIVE_MS   undici per-origin keep-alive timeout (default 60000)
  *                           (keeps long-lived SSE / streaming MCP responses open)
  *   LENSMCP_GW_KEEPALIVE_MS  server keep-alive timeout; default 620000, kept ABOVE the GCP
  *                           external ALB's 600s backend keep-alive (avoids intermittent 502s)
@@ -92,6 +103,7 @@ const node_fs_1 = require("node:fs");
 const node_crypto_1 = require("node:crypto");
 const node_path_1 = require("node:path");
 const node_os_1 = require("node:os");
+const node_cluster_1 = tslib_1.__importDefault(require("node:cluster"));
 const prod_gateway_lib_1 = require("./prod-gateway.lib");
 const jwks_verify_1 = require("./jwks-verify");
 const otel_tracing_1 = require("./otel-tracing");
@@ -325,6 +337,15 @@ async function main() {
         undici.connections = Number(env['LENSMCP_GW_UNDICI_CONNECTIONS']);
     if (env['LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS'])
         undici.bodyTimeout = Number(env['LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS']);
+    // Pipelining > 1 packs more requests per upstream connection (higher throughput on fast upstreams) but
+    // risks head-of-line blocking — a slow/streaming response stalls the requests queued behind it on that
+    // connection. Default 1 (safe for mixed/streaming traffic); raise only for uniformly-fast upstreams.
+    if (env['LENSMCP_GW_UNDICI_PIPELINING'])
+        undici.pipelining = Number(env['LENSMCP_GW_UNDICI_PIPELINING']);
+    if (env['LENSMCP_GW_UNDICI_HEADERS_TIMEOUT_MS'])
+        undici.headersTimeout = Number(env['LENSMCP_GW_UNDICI_HEADERS_TIMEOUT_MS']);
+    if (env['LENSMCP_GW_UNDICI_KEEPALIVE_MS'])
+        undici.keepAliveTimeout = Number(env['LENSMCP_GW_UNDICI_KEEPALIVE_MS']);
     // ── mTLS client materials (optional): from the shared registry Redis, or files ──
     if (env['LENSMCP_GW_MTLS_FROM_REDIS'] === '1' && redisClient) {
         const p = env['LENSMCP_GW_REDIS_PREFIX'] ?? 'lensmcp:gw';
@@ -498,4 +519,55 @@ async function main() {
     for (const sig of ['SIGTERM', 'SIGINT'])
         process.on(sig, () => void shutdown(sig));
 }
-void main();
+// ── Multi-core (opt-in via LENSMCP_GW_WORKERS) ──────────────────────────────
+// A single Node process is ONE thread; a high-RPS edge should use every core. `LENSMCP_GW_WORKERS`
+// forks N worker processes (default 1; `auto`/`max`/`0` ⇒ os.cpus().length). The PRIMARY only supervises
+// — fork, respawn on crash, propagate SIGTERM — while each WORKER runs the full gateway and shares the
+// listening port via Node's cluster module (connections round-robin across workers), so throughput scales
+// ~linearly with cores. NB: state is per-worker — use the Redis rate limiter + Redis status fan-out for
+// cross-worker consistency; a stateless route-and-forward proxy needs nothing extra.
+function workerCount() {
+    const v = (process.env['LENSMCP_GW_WORKERS'] ?? '1').trim().toLowerCase();
+    if (v === 'auto' || v === 'max' || v === '0')
+        return Math.max(1, (0, node_os_1.cpus)().length);
+    const n = Math.floor(Number(v));
+    return Number.isFinite(n) && n > 0 ? n : 1;
+}
+const WORKERS = workerCount();
+if (WORKERS > 1 && node_cluster_1.default.isPrimary) {
+    console.log(`[gateway] primary ${process.pid}: forking ${WORKERS} workers (one per core)…`);
+    // SECURITY: the in-memory rate limiter holds per-PROCESS buckets, so with N workers the effective
+    // global limit is ~N× the configured value (abuse/DoS protection is weakened). Use the Redis-backed
+    // limiter (one shared budget across workers) when running multi-core, or divide the per-worker limit.
+    if (process.env['LENSMCP_GW_RATE_LIMIT'] && !(process.env['LENSMCP_GW_RATE_LIMIT_REDIS'] === '1' || process.env['LENSMCP_GW_RATE_LIMIT_REDIS_URL'])) {
+        console.warn(`[gateway] WARNING: in-memory rate limiter + ${WORKERS} workers → the limit is enforced PER WORKER (effective ≈ ${WORKERS}× ${process.env['LENSMCP_GW_RATE_LIMIT']}/window). Set LENSMCP_GW_RATE_LIMIT_REDIS=1 for one shared global budget, or divide LENSMCP_GW_RATE_LIMIT by ${WORKERS}.`);
+    }
+    let stopping = false;
+    for (let i = 0; i < WORKERS; i++)
+        node_cluster_1.default.fork();
+    node_cluster_1.default.on('exit', (w, code, sig) => {
+        if (stopping)
+            return;
+        console.warn(`[gateway] worker ${w.process.pid} exited (code=${code} sig=${sig ?? ''}) — respawning.`);
+        node_cluster_1.default.fork();
+    });
+    const stopAll = (sig) => {
+        if (stopping)
+            return;
+        stopping = true;
+        console.log(`[gateway] primary: ${sig} — stopping ${Object.keys(node_cluster_1.default.workers ?? {}).length} workers…`);
+        for (const w of Object.values(node_cluster_1.default.workers ?? {})) {
+            try {
+                w?.kill(sig);
+            }
+            catch { /* gone */ }
+        }
+        setTimeout(() => process.exit(0), 12_000).unref(); // hard cap after workers drain
+    };
+    process.on('SIGTERM', () => stopAll('SIGTERM'));
+    process.on('SIGINT', () => stopAll('SIGINT'));
+}
+else {
+    // Worker (or single-process default): run the full gateway.
+    void main();
+}

package/executors/gateway/prod-gateway.lib.d.ts

@@ -1,152 +1,20 @@
-import * as http from 'node:http';
-import { type AuthMode, type ManifestProvider, type PodProvider, type Route } from './manifest';
-import type { GatewayTracer } from './otel-tracing';
-import type { HealthChecker } from './health-check';
-import type { RateLimiter } from './rate-limit';
-import type { ProcessMetrics } from './metrics';
-/** Per-service health rollup, derived from observed traffic over a rolling window.
- *  `status` is inferred from the recent error rate (passive — not an active probe):
- *  healthy <5% err · degraded 5–50% · down ≥50% · idle (no recent traffic). */
-export interface ServiceStatus {
-    service: string;
-    hosts: string[];
-    status: 'healthy' | 'degraded' | 'down' | 'idle';
-    requests: number;
-    errorRate: number;
-    avgMs: number;
-    versions: string[];
-    lastSeen: number | null;
-}
-export interface ProdGatewayOptions {
-    /** Ports to bind. Default `[8080]` (or `[8443]` with TLS). One Fastify
-     *  instance per port; all share the route table + providers. */
-    ports?: number[];
-    manifests: ManifestProvider;
-    /** Resolves a service → upstream when a route has no direct `upstream`. */
-    pods?: PodProvider;
-    /** service → its `x-internal-token` (from a k8s Secret / Vault in prod). */
-    serviceKeys?: Record<string, string>;
-    /** Validate a `jwt`-mode request; THROW to reject (→ 401). Default: a
-     *  pass-through with a one-time warning — wire a real JWKS validator in prod. */
-    authenticate?: (mode: AuthMode, req: http.IncomingMessage) => void;
-    tls?: {
-        key: string | Buffer;
-        cert: string | Buffer;
-    };
-    /** Lens bus sink — OPT-IN. Omit (default) for zero observability overhead. */
-    emit?: (event: Record<string, unknown>) => void;
-    /** Traffic-edge flush period (ms). Default 5000. */
-    trafficFlushMs?: number;
-    /** Request header that PINS a rollout cohort (sticky canary / debugging).
-     *  Default `x-lensmcp-version`. The chosen version is echoed on the response. */
-    versionHeader?: string;
-    /** undici pool tuning passed to reply-from. `bodyTimeout: 0` (default) keeps
-     *  long-lived SSE / streamable-HTTP MCP responses open — undici's 300s default
-     *  would otherwise abort an idle stream. `rejectUnauthorized` defaults false
-     *  (local-CA / self-signed upstreams); set true for verified east-west on GCP.
-     *  `allowH2` multiplexes many concurrent streams over few HTTP/2 connections
-     *  (Cloud Run supports h2 end-to-end) — useful when one upstream fans many MCP streams.
-     *  `cert`/`key` present a client certificate to upstreams (mTLS); `ca` trusts a
-     *  private CA for the server side. `rejectUnauthorized:false` keeps mTLS while
-     *  skipping server-cert validation (self-signed internal services). */
-    undici?: {
-        connections?: number;
-        pipelining?: number;
-        keepAliveTimeout?: number;
-        bodyTimeout?: number;
-        headersTimeout?: number;
-        rejectUnauthorized?: boolean;
-        allowH2?: boolean;
-        cert?: string | Buffer;
-        key?: string | Buffer;
-        ca?: string | Buffer;
-    };
-    /** Header carrying the AUTHORITATIVE client IP from a trusted front proxy
-     *  (e.g. `cf-connecting-ip` behind Cloudflare). When set, the `ip` ABAC
-     *  attribute comes from this header instead of the (multi-proxy, spoofable)
-     *  X-Forwarded-For chain. Safe only when the origin is locked to that proxy —
-     *  which Cloudflare Tunnel guarantees (there is no public origin to bypass). */
-    clientIpHeader?: string;
-    /** CIDRs of trusted front proxies. `clientIpHeader` is honored ONLY when the
-     *  immediate peer (socket address) is in this set — otherwise the header is
-     *  ignored and the socket IP is used (prevents spoofing the `ip` ABAC attribute
-     *  by hitting the origin directly). Default when omitted: loopback only
-     *  (matches a co-located cloudflared/sidecar). */
-    clientIpTrustedProxies?: string[];
-    /** OpenTelemetry tracer (from `setupTracing`). When set, each request gets a
-     *  SERVER span whose context is propagated downstream (W3C `traceparent`), so
-     *  the gateway hop stitches into the distributed trace. Omit → no span work. */
-    tracing?: GatewayTracer;
-    /** Expose `GET /statusz` — the per-service health rollup as JSON. Requires
-     *  `statusToken` too (fail-closed: served only when both are set). Default off (404). */
-    statusEndpoint?: boolean;
-    /** Token `/statusz` requires (via `?token=` or `x-status-token`), compared in
-     *  constant time. REQUIRED for the endpoint to serve — no token → /statusz is 404. */
-    statusToken?: string;
-    /** How many flush windows the rolling status sums over (default 12 → ~60s at the 5s flush). */
-    statusWindows?: number;
-    /** Called each flush window with the per-service status snapshot — wire it to a
-     *  Redis `status:*` fan-out / status page. The gateway is the only thing that
-     *  sees every request, so this is the natural source of observed health. */
-    onStatus?: (snapshot: ServiceStatus[]) => void;
-    /** Active upstream health-checker (from `createHealthChecker`). When set, the
-     *  gateway probes upstreams, steers pooled picks toward healthy endpoints, and
-     *  reflects true liveness in /statusz. Omit → passive drop-on-error only. */
-    healthChecker?: HealthChecker;
-    /** Opt-in per-client-IP rate limiter — defense-in-depth behind the edge throttle.
-     *  In-memory + per-instance (`createRateLimiter`) or ONE global budget across all
-     *  containers (`createRedisRateLimiter`). The check is `await`ed either way; it
-     *  runs before routing/auth and applies only to proxied traffic (ops endpoints exempt). */
-    rateLimiter?: RateLimiter;
-    /** Process self-metrics (event-loop lag / rss / cpu / req rates) from `createProcessMetrics`;
-     *  exposed at the token-gated `/metricsz` for load/stress tests + production monitoring. */
-    metrics?: ProcessMetrics;
-    /** Server-side HTTP timeouts (ms). `keepAliveTimeout` default 620000 — kept
-     *  ABOVE the GCP external ALB's 600s backend keep-alive so the gateway never
-     *  closes a pooled connection the LB still considers live (the classic
-     *  intermittent-502 race). `requestTimeout` default 0 (disabled) for streaming. */
-    server?: {
-        keepAliveTimeout?: number;
-        requestTimeout?: number;
-        connectionTimeout?: number;
-        headersTimeout?: number;
-    };
-    /** Opt-in one-JSON-line-per-request access log to stdout, shaped for Cloud
-     *  Logging (severity + time + message). Default off (zero overhead). */
-    accessLog?: boolean;
-    /** Browser origins allowed to make CREDENTIALED cross-origin requests (cookies /
-     *  `credentials: 'include'`). For an origin in this allowlist the gateway answers preflights — and
-     *  stamps gateway-generated responses — with `Access-Control-Allow-Origin: <exact origin>` +
-     *  `Access-Control-Allow-Credentials: true` (NEVER `*`: a credentialed `*` is forbidden by the Fetch
-     *  spec and a cross-site read hole). Needed when a first-party browser app POSTs to a routed service
-     *  that sets a cookie (e.g. an IdP SSO cookie set across `login.example.com → auth.example.com`).
-     *  Exact-matched, case-insensitive. Omit (default) → no credentialed CORS (the Bearer-only edge). */
-    corsCredentialOrigins?: string[];
-    /** Return verified subject attributes (e.g. JWT claims) for ABAC routing.
-     *  MUST verify (signature/exp) — forged claims must not reach the rules. */
-    identify?: (req: http.IncomingMessage) => Record<string, unknown> | undefined;
-    /** Allowlist of request headers exposed to rules as `header.<name>` attributes. */
-    attributeHeaders?: string[];
-    /** Take the `ip` attribute from `X-Forwarded-For` (behind a trusted LB) via
-     *  Fastify `trustProxy`; default false → socket IP. */
-    trustProxyIp?: boolean;
-    /** Gateway-issued device cookie for sticky bucketing (anonymous-friendly).
-     *  Omit to disable cookie stickiness. `secret` enables HMAC signing. */
-    cookie?: {
-        name?: string;
-        secret?: string;
-        domain?: string;
-        maxAge?: number;
-    };
-    /** Header carrying a client device/user id — the sticky key when no cookie
-     *  is present (native/mobile/API clients), e.g. `x-device-id`. */
-    uidHeader?: string;
-}
-export interface ProdGatewayHandle {
-    ports: number[];
-    routes: () => Route[];
-    status: () => ServiceStatus[];
-    stop: () => Promise<void>;
-}
-export declare function startProdGateway(opts: ProdGatewayOptions): Promise<ProdGatewayHandle>;
+/**
+ * Public facade for the PRODUCTION gateway runtime (Fastify + @fastify/reply-from).
+ *
+ * The implementation now lives in `./prod-runtime/*` as composable LAYERS,
+ * mirroring the dev gateway's `./runtime/*` — see `prod-runtime/server.ts` for the
+ * composition root (`startProdGateway`), `prod-runtime/types.ts` for the shared
+ * types + the customer **hooks** API, and the sibling modules for each layer
+ * (routing, observability, rollout, upstream, auth, cors, trust, handler, upgrade,
+ * app, access-log, hooks). This barrel preserves the original module's public
+ * surface so the entry (`main.prod-gateway.ts`), the `@lensmcp/cluster` re-export
+ * (`gateway.ts`), the e2e suite, and the pentest/perf suites import from one stable
+ * path, and additionally exposes the hooks types for customer-authored layers.
+ *
+ * The same routing brain as dev (shared `matchRoute` / `buildRouteTable` / manifest
+ * schema); the HTTP transport differs on purpose (dev: node:http + http-proxy over
+ * unix-socket pods; prod: Fastify + reply-from's undici pool for the high-RPS edge).
+ */
+export { startProdGateway } from './prod-runtime/server';
+export type { ServiceStatus, ProdGatewayOptions, ProdGatewayHandle, ProdGatewayHooks, ProdGatewayPhase, ProdHookHandler, ProdHookContext, } from './prod-runtime/types';
 //# sourceMappingURL=prod-gateway.lib.d.ts.map

package/executors/gateway/prod-gateway.lib.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prod-gateway.lib.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/prod-gateway.lib.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,OAAO,EAEL,KAAK,QAAQ,EAAc,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAqB,KAAK,KAAK,EAClG,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,aAAa,EAAa,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGhD;;+EAE+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC;oEACgE;IAChE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,2EAA2E;IAC3E,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;qFACiF;IACjF,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC;IACnE,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IACtD,8EAA8E;IAC9E,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAChD,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;qFACiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;2EAQuE;IACvE,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IACvP;;;;oFAIgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;sDAIkD;IAClD,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC;;oFAEgF;IAChF,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;6FACyF;IACzF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;0FACsF;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+FAA+F;IAC/F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;gFAE4E;IAC5E,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,IAAI,CAAC;IAC/C;;iFAE6E;IAC7E,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;+FAG2F;IAC3F,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;gGAC4F;IAC5F,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;uFAGmF;IACnF,MAAM,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrH;4EACwE;IACxE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;yGAMqG;IACrG,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IAGjC;gFAC4E;IAC5E,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC9E,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;2DACuD;IACvD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;4EACwE;IACxE,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9E;sEACkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,KAAK,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,aAAa,EAAE,CAAC;IAC9B,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AA6DD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAynB3F"}
+{"version":3,"file":"prod-gateway.lib.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/prod-gateway.lib.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EAEjB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,eAAe,GAChB,MAAM,sBAAsB,CAAC"}