@lensmcp/cluster 1.12.0 → 1.13.0

package/executors/gateway/prod-gateway.lib.js

@@ -1,869 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.startProdGateway = startProdGateway;
-const tslib_1 = require("tslib");
+exports.startProdGateway = void 0;
 /**
- * Production gateway runtime — Fastify + @fastify/reply-from (undici) engine.
+ * Public facade for the PRODUCTION gateway runtime (Fastify + @fastify/reply-from).
  *
- * The SAME routing brain as dev (shared `matchRoute` / `buildRouteTable` /
- * manifest schema) composed over the prod providers (a manifest source +
- * endpoint resolution). The HTTP transport differs from dev on purpose: dev
- * uses node:http + http-proxy (it manages unix-socket pods + scale-from-zero),
- * prod uses Fastify + reply-from's undici pool — connection-reusing, HTTP/1.1
- * pipelined, materially faster than node-http-proxy for the high-RPS edge.
+ * The implementation now lives in `./prod-runtime/*` as composable LAYERS,
+ * mirroring the dev gateway's `./runtime/*` — see `prod-runtime/server.ts` for the
+ * composition root (`startProdGateway`), `prod-runtime/types.ts` for the shared
+ * types + the customer **hooks** API, and the sibling modules for each layer
+ * (routing, observability, rollout, upstream, auth, cors, trust, handler, upgrade,
+ * app, access-log, hooks). This barrel preserves the original module's public
+ * surface so the entry (`main.prod-gateway.ts`), the `@lensmcp/cluster` re-export
+ * (`gateway.ts`), the e2e suite, and the pentest/perf suites import from one stable
+ * path, and additionally exposes the hooks types for customer-authored layers.
  *
- * The exported contract (`startProdGateway` / `ProdGatewayOptions` /
- * `ProdGatewayHandle`) is unchanged from the previous engine, so the entry,
- * the e2e suite, and the perf suite drive it identically — the swap is proven
- * behind a stable seam.
- *
- * It keeps the dev trust boundary verbatim — strip client-supplied trust
- * headers, validate `x-api-key` on internal routes, inject the target's
- * `x-internal-token` — and the header-gated `gateway-request` flow trace, so
- * the lens (when ENABLED via opts.emit; off by default) sees identical events.
- * Per-request upstream selection (rollout cohort + sticky version) rides on
- * reply-from's `getUpstream` hook. WebSocket upgrades are proxied raw (a
- * net-level pipe) with the same trust model — no http-proxy in the prod path.
- *
- * No autoscale / idle-kill / process management here — prod pods are
- * always-on (k8s keeps them up); that machinery is the dev PodProvider's.
- */
-const node_crypto_1 = require("node:crypto");
-const net = tslib_1.__importStar(require("node:net"));
-const fastify_1 = tslib_1.__importDefault(require("fastify"));
-const reply_from_1 = tslib_1.__importDefault(require("@fastify/reply-from"));
-const manifest_1 = require("./manifest");
-const gateway_errors_1 = require("./gateway-errors");
-const eid = () => Date.now().toString(36) + (0, node_crypto_1.randomBytes)(6).toString('hex');
-const hdr = (v) => typeof v === 'string' && v !== '' ? v : Array.isArray(v) ? v[0] : undefined;
-/**
- * Send a gateway-generated edge error as the JSON envelope `{ key, status, traceId, message? }` (NOT
- * `text/plain`), stamping `x-request-id` so the trace id is on the response. The SAME `{ key, status }`
- * localized contract a service returns, so a browser app renders `t(key)` and surfaces the trace id.
- * `detail` is the dev-facing hint (the old plain-text reason), never shown to end users.
+ * The same routing brain as dev (shared `matchRoute` / `buildRouteTable` / manifest
+ * schema); the HTTP transport differs on purpose (dev: node:http + http-proxy over
+ * unix-socket pods; prod: Fastify + reply-from's undici pool for the high-RPS edge).
  */
-const sendError = (reply, req, status, reason, detail) => {
-    const traceId = (0, gateway_errors_1.ensureRequestId)(req);
-    return reply
-        .code(status)
-        .header('x-request-id', traceId)
-        .type(gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE)
-        .send((0, gateway_errors_1.gatewayErrorBody)(status, reason, traceId, detail));
-};
-// Path-canonicalization guard (CWE-288): a reverse proxy and its backend must agree
-// on the request path, or auth gets evaluated against a DIFFERENT path than the one
-// served (AWS API Gateway trailing-slash bypass, IBM API Connect CVE-2025-13915,
-// Kong/Envoy/NGINX normalization mismatch). We REJECT structurally-encoded paths
-// (encoded dot/slash/backslash/null) outright, and return the DECODED path for auth
-// matching so `/%61dmin` is matched as `/admin` — never skipped because it's encoded.
-const ENCODED_STRUCTURE = /%2e|%2f|%5c|%00|\\/i; // encoded . / \ NUL, or a raw backslash
-/** Canonical path for auth matching, or undefined if the path is unsafe (→ 400 / drop). */
-const canonicalPath = (rawUrl) => {
-    const p = rawUrl.split('?')[0] ?? '/';
-    if (ENCODED_STRUCTURE.test(p))
-        return undefined;
-    let decoded;
-    try {
-        decoded = decodeURIComponent(p);
-    }
-    catch {
-        return undefined;
-    } // malformed %xx
-    if (decoded.includes('\0') || /(^|\/)\.\.(?=\/|$)/.test(decoded))
-        return undefined; // NUL or `..` traversal
-    // Strip fragment (#…) and per-segment matrix params (;…) so we match the path the
-    // BACKEND resolves to — defeats /admin;x=1 and /admin#.css permission-skip bypass (CWE-288).
-    return decoded.split('#')[0].split('/').map((s) => s.split(';')[0]).join('/') || '/';
-};
-async function startProdGateway(opts) {
-    const ports = opts.ports?.length ? opts.ports : [opts.tls ? 8443 : 8080];
-    // Default authenticator FAILS CLOSED: a jwt route with no authenticator wired is
-    // rejected, never passed through. Provide opts.authenticate (or a verifier in the
-    // entry) to actually validate tokens.
-    const authenticate = opts.authenticate ?? ((mode) => {
-        if (mode === 'jwt')
-            throw new Error('jwt route but no authenticator configured');
-    });
-    const emit = (severity, title, fingerprint, raw, ctx) => {
-        if (!opts.emit)
-            return; // lens off by default — no work, no allocation beyond the call
-        try {
-            opts.emit({
-                id: eid(), sessionId: 'pending', timestamp: Date.now(),
-                source: 'gateway', category: 'cluster', severity,
-                context: { sessionId: 'pending', ...ctx }, fingerprint, title, raw,
-            });
-        }
-        catch { /* never let the bus break traffic */ }
-    };
-    // ---- route table (rebuilt atomically from the manifest source) ----
-    let manifests = opts.manifests.list();
-    let routes = (0, manifest_1.buildRouteTable)(manifests);
-    let manifestByService = new Map(manifests.map((m) => [m.service, m]));
-    const rebuild = (next) => {
-        manifests = next;
-        routes = (0, manifest_1.buildRouteTable)(next);
-        manifestByService = new Map(next.map((m) => [m.service, m]));
-        if (opts.healthChecker) { // monitor every reachable upstream: direct manifest URLs + pooled endpoints
-            const urls = new Set();
-            for (const r of routes)
-                if (r.upstream)
-                    urls.add(r.upstream);
-            for (const u of opts.pods?.endpoints?.() ?? [])
-                urls.add(u);
-            opts.healthChecker.track([...urls]);
-        }
-        emit('info', `gateway routes: ${routes.length} on ${manifests.length} services`, 'gateway-up', { kind: 'gateway-up', routes: routes.map((r) => ({ host: r.host ?? '(default)', service: r.service, internal: !!r.internal })) });
-    };
-    const unwatch = opts.manifests.watch?.((next) => rebuild(next));
-    const keyToProject = new Map(Object.entries(opts.serviceKeys ?? {}).map(([p, k]) => [k, p]));
-    const versionHeader = (opts.versionHeader ?? 'x-lensmcp-version').toLowerCase();
-    const accessLog = !!opts.accessLog;
-    // Origins allowed to make CREDENTIALED CORS requests (cookies). Exact-matched, lower-cased.
-    const corsCredentialOrigins = new Set((opts.corsCredentialOrigins ?? []).map((o) => o.toLowerCase()));
-    const clientIpHeader = opts.clientIpHeader?.toLowerCase();
-    // `clientIpHeader` is only trusted from a known front proxy. Default: loopback
-    // only (a co-located cloudflared/sidecar) — an off-proxy attacker hitting the
-    // origin directly cannot spoof the `ip` ABAC attribute.
-    const trustedProxies = opts.clientIpTrustedProxies ?? [];
-    const peerTrusted = (peer) => {
-        if (!peer)
-            return false;
-        const ip = peer.startsWith('::ffff:') ? peer.slice(7) : peer;
-        if (trustedProxies.length === 0)
-            return ip === '127.0.0.1' || peer === '::1';
-        return trustedProxies.some((c) => (0, manifest_1.matchCidr)(ip, c));
-    };
-    /** Resolve the client IP: the trusted front-proxy header if the peer is trusted, else the fallback. */
-    const clientIpOf = (req, fallback) => {
-        if (clientIpHeader && peerTrusted(req.socket?.remoteAddress ?? undefined)) {
-            const h = hdr(req.headers[clientIpHeader]);
-            if (h)
-                return h;
-        }
-        return fallback;
-    };
-    // ---- targeted rollout: attributes + sticky device key (cookie → uid header) ----
-    const attrHeaders = (opts.attributeHeaders ?? []).map((h) => h.toLowerCase());
-    const uidHeader = opts.uidHeader?.toLowerCase();
-    const cookieOn = !!opts.cookie;
-    const cookieName = opts.cookie?.name ?? 'lensmcp_did';
-    const cookieSecret = opts.cookie?.secret;
-    const cookieDomain = opts.cookie?.domain;
-    const cookieMaxAge = opts.cookie?.maxAge ?? 31_536_000; // 1y
-    if (cookieOn && !cookieSecret)
-        console.warn('[gateway] device cookie has no secret — values are UNSIGNED (set cookie.secret to prevent bucket-grinding).');
-    const signId = (id) => (0, node_crypto_1.createHmac)('sha256', cookieSecret).update(id).digest('base64url');
-    const signedCookie = (id) => (cookieSecret ? `${id}.${signId(id)}` : id);
-    const verifyCookie = (val) => {
-        if (!cookieSecret)
-            return val || undefined; // unsigned mode
-        const i = val.lastIndexOf('.');
-        if (i < 0)
-            return undefined;
-        const id = val.slice(0, i);
-        const a = Buffer.from(val.slice(i + 1)), b = Buffer.from(signId(id));
-        return a.length === b.length && (0, node_crypto_1.timingSafeEqual)(a, b) ? id : undefined;
-    };
-    const parseCookie = (header, name) => {
-        if (!header)
-            return undefined;
-        for (const part of header.split(';')) {
-            const eq = part.indexOf('=');
-            if (eq > 0 && part.slice(0, eq).trim() === name)
-                return decodeURIComponent(part.slice(eq + 1).trim());
-        }
-        return undefined;
-    };
-    const mintCookieHeader = (id) => {
-        let c = `${cookieName}=${encodeURIComponent(signedCookie(id))}; Path=/; Max-Age=${cookieMaxAge}; HttpOnly; SameSite=Lax; Secure`;
-        if (cookieDomain)
-            c += `; Domain=${cookieDomain}`;
-        return c;
-    };
-    /** Resolve the sticky key: valid cookie → UID header → freshly minted (cookie clients). */
-    const resolveStickyKey = (req) => {
-        if (cookieOn) {
-            const c = parseCookie(req.headers.cookie, cookieName);
-            const id = c ? verifyCookie(c) : undefined;
-            if (id)
-                return { key: id, mint: false };
-        }
-        if (uidHeader) {
-            const u = hdr(req.headers[uidHeader]);
-            if (u)
-                return { key: u, mint: false };
-        }
-        if (cookieOn)
-            return { key: 'd_' + (0, node_crypto_1.randomBytes)(12).toString('base64url'), mint: true };
-        return { mint: false };
-    };
-    /** Assemble the flat attribute bag a rule evaluates against. Shared by the HTTP
-     *  and WebSocket paths so ABAC sees an identical bag on both (no divergence). */
-    const buildAttrs = (req, fallbackIp, principal, key) => {
-        const a = { ...(principal ?? {}) };
-        a['ip'] = clientIpOf(req, fallbackIp);
-        a['method'] = (req.method ?? 'GET').toUpperCase();
-        a['path'] = (req.url ?? '/').split('?')[0];
-        if (key)
-            a['device'] = key;
-        for (const h of attrHeaders) {
-            const v = hdr(req.headers[h]);
-            if (v !== undefined)
-                a['header.' + h] = v;
-        }
-        return a;
-    };
-    // ---- traffic edges (host→service[@version]), flushed to the lens periodically ----
-    const edges = new Map();
-    const recordEdge = (route, ms, status, caller, version) => {
-        const host = route.host ?? '(default)';
-        const key = (caller ? caller + '⇒' : '') + host + '→' + route.service + (version ? '@' + version : '');
-        const e = edges.get(key) ?? { host, service: route.service, caller, version, count: 0, totalMs: 0, errors: 0 };
-        e.count += 1;
-        e.totalMs += ms;
-        if (status >= 500 || status === 0)
-            e.errors += 1;
-        edges.set(key, e);
-    };
-    // ---- per-service health rollup (feeds /statusz + the Redis status fan-out) ----
-    // A ring of the last N flush windows, summed at read time → a rolling view that
-    // doesn't flap to "idle" the instant traffic pauses. Derived purely from the
-    // edges the gateway already records, so it's effectively free.
-    const statusWindowCount = Math.max(1, opts.statusWindows ?? 12);
-    const statusWindows = [];
-    const lastSeenAt = new Map();
-    const routeServices = () => [...new Set(routes.map((r) => r.service))];
-    const pushStatusWindow = () => {
-        const w = new Map();
-        for (const e of edges.values()) {
-            const s = w.get(e.service) ?? { requests: 0, errors: 0, totalMs: 0, versions: new Set() };
-            s.requests += e.count;
-            s.errors += e.errors;
-            s.totalMs += e.totalMs;
-            if (e.version)
-                s.versions.add(e.version);
-            w.set(e.service, s);
-        }
-        const now = Date.now();
-        for (const [svc, s] of w)
-            if (s.requests > 0)
-                lastSeenAt.set(svc, now);
-        statusWindows.push(w);
-        while (statusWindows.length > statusWindowCount)
-            statusWindows.shift();
-    };
-    const buildStatusSnapshot = () => {
-        const agg = new Map();
-        for (const w of statusWindows)
-            for (const [svc, s] of w) {
-                const a = agg.get(svc) ?? { requests: 0, errors: 0, totalMs: 0, versions: new Set() };
-                a.requests += s.requests;
-                a.errors += s.errors;
-                a.totalMs += s.totalMs;
-                for (const v of s.versions)
-                    a.versions.add(v);
-                agg.set(svc, a);
-            }
-        return routeServices().map((svc) => {
-            const a = agg.get(svc) ?? { requests: 0, errors: 0, totalMs: 0, versions: new Set() };
-            const hosts = [...new Set(routes.filter((r) => r.service === svc).map((r) => r.host ?? '(default)'))];
-            const er = a.requests ? a.errors / a.requests : 0;
-            let status = a.requests === 0 ? 'idle' : er >= 0.5 ? 'down' : er >= 0.05 ? 'degraded' : 'healthy';
-            // active liveness: if every known upstream for this service is failing probes, it's down (even with no traffic)
-            if (opts.healthChecker) {
-                const svcUrls = routes.filter((r) => r.service === svc && r.upstream).map((r) => r.upstream);
-                if (svcUrls.length && svcUrls.every((u) => !opts.healthChecker.isHealthy(u)))
-                    status = 'down';
-            }
-            return { service: svc, hosts, status, requests: a.requests, errorRate: +er.toFixed(4), avgMs: a.requests ? Math.round(a.totalMs / a.requests) : 0, versions: [...a.versions], lastSeen: lastSeenAt.get(svc) ?? null };
-        });
-    };
-    const edgeFlusher = setInterval(() => {
-        pushStatusWindow(); // always: roll the health window (independent of the lens)
-        if (opts.onStatus) {
-            try {
-                opts.onStatus(buildStatusSnapshot());
-            }
-            catch { /* never let a status sink break traffic */ }
-        }
-        if (opts.emit) {
-            for (const e of edges.values()) {
-                emit(e.errors ? 'warning' : 'info', `traffic ${e.host} → ${e.service}${e.version ? '@' + e.version : ''}: ${e.count} req`, `gateway-traffic:${e.host}->${e.service}${e.version ? '@' + e.version : ''}`, { kind: 'gateway-traffic', host: e.host, project: e.service, caller: e.caller, version: e.version, count: e.count, avgMs: Math.round(e.totalMs / e.count), errors: e.errors });
-            }
-        }
-        edges.clear();
-    }, opts.trafficFlushMs ?? 5000);
-    edgeFlusher.unref?.();
-    // ---- per-request flow trace (only for flow-header-carrying requests) ----
-    const beginTrace = (req) => {
-        if (!opts.emit)
-            return undefined; // no lens → no trace overhead
-        const flowId = hdr(req.headers['x-lensmcp-flow-id']);
-        let requestId = hdr(req.headers['x-request-id']);
-        if (!flowId && !requestId && !hdr(req.headers['traceparent']))
-            return undefined;
-        if (!requestId) {
-            requestId = eid();
-            req.headers['x-request-id'] = requestId;
-        }
-        return { startedAt: Date.now(), method: (req.method ?? 'GET').toUpperCase(), host: (req.headers.host || '').split(':')[0], url: req.url ?? '/', steps: [], ...(flowId ? { flowId } : {}), ...(requestId ? { requestId } : {}) };
-    };
-    const step = (t, name, info) => { if (t)
-        t.steps.push({ step: name, atMs: Date.now() - t.startedAt, ...info }); };
-    const finish = (t, service, status, extra) => {
-        if (!t || t.done)
-            return;
-        t.done = true;
-        emit(status >= 500 ? 'error' : 'info', `gateway ${t.method} ${t.host}${t.url} → ${status} (${Date.now() - t.startedAt}ms)`, `gateway-request:${service}`, { kind: 'gateway-request', project: service, host: t.host, method: t.method, url: t.url, status, durationMs: Date.now() - t.startedAt, startedAt: t.startedAt, steps: t.steps, ...extra }, { ...(t.flowId ? { flowId: t.flowId } : {}), ...(t.requestId ? { requestId: t.requestId } : {}) });
-    };
-    rebuild(manifests); // emit initial gateway-up
-    // ---- trust boundary (verbatim dev model) ----
-    // The gateway OWNS these headers — drop any client-supplied copy at ingress so identity
-    // can only originate from a verified token (closes header spoofing), then re-stamp on forward.
-    const TRUST_HEADERS = ['x-internal-token', 'x-api-key-id', 'x-user-id', 'x-tenant-id', 'x-user-roles', 'x-user-permissions'];
-    // Also drop client-supplied hop-by-hop control headers: a `Connection: x-internal-token`
-    // would otherwise make undici strip the gateway's OWN injected trust headers before the
-    // upstream (CVE-2026-33805). The proxy manages its own upstream connection semantics.
-    const HOP_BY_HOP = ['connection', 'proxy-connection', 'keep-alive'];
-    const stripTrust = (req) => { for (const h of TRUST_HEADERS)
-        delete req.headers[h]; for (const h of HOP_BY_HOP)
-        delete req.headers[h]; };
-    /** Stamp the verified identity onto the forwarded request — tenant from the `tid` CLAIM, never a client header. */
-    const stampIdentity = (req, claims) => {
-        // Only stamp SCALAR claims — an object/array sub/tid must never coerce to
-        // "[object Object]" / a CSV tenant header (claim type-confusion).
-        const set = (k, v) => { if ((typeof v === 'string' && v !== '') || typeof v === 'number')
-            req.headers[k] = String(v); };
-        set('x-user-id', claims['sub']);
-        set('x-tenant-id', claims['tid']);
-        const roles = claims['roles'];
-        if (Array.isArray(roles) && roles.length)
-            req.headers['x-user-roles'] = roles.map(String).join(',');
-        const perms = claims['perms'];
-        if (Array.isArray(perms) && perms.length)
-            req.headers['x-user-permissions'] = perms.map(String).join(',');
-    };
-    // ---- per-request upstream resolution (direct upstream OR pod pick + sticky version) ----
-    const resolveUpstream = async (route, trace, pinned) => {
-        if (route.upstream)
-            return { url: route.upstream };
-        const opt = {
-            ...(pinned ? { version: pinned } : {}),
-            ...(opts.healthChecker ? { isHealthy: (u) => opts.healthChecker.isHealthy(u) } : {}),
-        };
-        let up = opts.pods?.pick(route.service, opt);
-        if (!up && opts.pods?.ensureUp) {
-            step(trace, 'ensure-up', { project: route.service });
-            if (await opts.pods.ensureUp(route.service))
-                up = opts.pods.pick(route.service, opt);
-        }
-        return up;
-    };
-    const reqState = new WeakMap();
-    const spanByReq = new WeakMap(); // OTel span per in-flight request (ended in onResponse)
-    // ---- no-route fallbacks: CORS preflight, health, discovery, 404 ----
-    const setCors = (reply, req) => {
-        const origin = req.headers.origin;
-        // Credentialed allowlist: echo the EXACT origin + allow credentials (cookies). NEVER `*` with
-        // credentials (forbidden by the Fetch spec; a cross-site read hole). Needed for a first-party
-        // browser app that POSTs to a cookie-setting routed service (e.g. an IdP SSO cookie).
-        if (origin && corsCredentialOrigins.has(origin.toLowerCase())) {
-            reply.header('access-control-allow-origin', origin);
-            reply.header('access-control-allow-credentials', 'true');
-            reply.header('vary', 'Origin');
-            return;
-        }
-        // Otherwise — UNAUTHENTICATED gateway responses (404 / health / route discovery / preflight):
-        // reflect the Origin for convenience but DO NOT allow credentials — a reflected origin +
-        // credentials would let any site read these cross-origin.
-        reply.header('access-control-allow-origin', String(origin ?? '*'));
-        reply.header('vary', 'Origin');
-    };
-    const handleNoRoute = (request, reply, host, url) => {
-        const req = request.raw;
-        setCors(reply, req);
-        if (req.method === 'OPTIONS') {
-            reply.code(204)
-                .header('access-control-allow-methods', 'GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS')
-                .header('access-control-allow-headers', String(req.headers['access-control-request-headers'] ?? '*'))
-                .send();
-            return;
-        }
-        const mounted = routes.filter((r) => r.host && (0, manifest_1.hostMatches)(r.host, host) && r.prefix);
-        const p = url.split('?')[0];
-        if (mounted.length > 0 && (p === '/health' || p === '/healthz')) {
-            reply.code(200).type('application/json').send(JSON.stringify({ status: 'ok', host, services: mounted.map((r) => ({ service: r.service, prefix: r.prefix })) }));
-            return;
-        }
-        if (p === '/.well-known/lensmcp-routes') {
-            reply.code(200).type('application/json').send(JSON.stringify({ host, routes: routes.filter((r) => !r.host || (0, manifest_1.hostMatches)(r.host, host)).map((r) => ({ host: r.host ?? '(default)', service: r.service, prefix: r.prefix, internal: !!r.internal, auth: r.auth })) }));
-            return;
-        }
-        sendError(reply, req, 404, 'not_found', mounted.length > 0 ? `No service mounted at ${url} on ${host}.` : 'No gateway route for this hostname.');
-    };
-    // ---- the request handler (catch-all): route → trust → auth → forward ----
-    const handler = async (request, reply) => {
-        const req = request.raw;
-        const host = (req.headers.host || '').split(':')[0];
-        const url = req.url ?? '/';
-        const trace = beginTrace(req);
-        // Mint a trace id for EVERY request (not just lens-traced ones): it's forwarded to the upstream (the
-        // pod adopts it as its traceId) and returned on the response — so any request is traceable end-to-end.
-        (0, gateway_errors_1.ensureRequestId)(req);
-        step(trace, 'received', { host, method: req.method, url });
-        // Reject HTTP/0.9 — a header-less simple request has no Host, defeating host-keyed routing/policy.
-        if (req.httpVersionMajor < 1) {
-            finish(trace, 'gateway', 400);
-            return sendError(reply, req, 400, 'bad_request', 'Bad Request');
-        }
-        // Reject path-canonicalization attacks BEFORE routing/auth (proxy↔backend mismatch).
-        const cpath = canonicalPath(url);
-        if (cpath === undefined) {
-            step(trace, 'bad-path', {});
-            finish(trace, 'gateway', 400);
-            return sendError(reply, req, 400, 'bad_request', 'Bad Request');
-        }
-        // Rate limit (opt-in) BEFORE routing/auth, per real client IP — defense-in-depth.
-        if (opts.rateLimiter) {
-            // Key on the trusted client IP (header only from a trusted peer) else the SOCKET ip —
-            // never request.ip, which is the spoofable X-Forwarded-For chain under trustProxy.
-            const d = await opts.rateLimiter.check(clientIpOf(req, req.socket?.remoteAddress ?? request.ip));
-            if (!d.allowed) {
-                reply.header('retry-after', String(Math.ceil(d.retryAfterMs / 1000)));
-                step(trace, 'rate-limited', {});
-                finish(trace, 'gateway', 429);
-                return sendError(reply, req, 429, 'rate_limited', 'Too Many Requests');
-            }
-        }
-        const route = (0, manifest_1.matchRoute)(routes, host, url);
-        if (!route) {
-            handleNoRoute(request, reply, host, url);
-            return reply;
-        }
-        step(trace, 'route-match', { project: route.service, ...(route.prefix ? { prefix: route.prefix } : {}), ...(route.internal ? { internal: true } : {}) });
-        // CORS preflight on a ROUTED path: answer it HERE, BEFORE edge auth — an OPTIONS preflight carries no
-        // token by spec, so the auth below would 401 it and the browser's CORS check fails. The real request
-        // still authenticates. (handleNoRoute covers UNROUTED preflights; this covers routed ones.)
-        if (req.method === 'OPTIONS') {
-            setCors(reply, req);
-            reply.code(204)
-                .header('access-control-allow-methods', 'GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS')
-                .header('access-control-allow-headers', String(req.headers['access-control-request-headers'] ?? '*'))
-                .send();
-            return reply;
-        }
-        // OTel SERVER span (opt-in): continues the incoming traceparent. Stored now so
-        // onResponse ends it on ANY exit path (auth reject / 503 / forward). Context is
-        // injected into req.headers just before forwarding (below) so downstream parents to it.
-        const span = opts.tracing?.startSpan(req, `gateway ${route.service}`, {
-            'http.request.method': (req.method ?? 'GET'),
-            'url.path': url.split('?')[0],
-            'server.address': host,
-            'lensmcp.service': route.service,
-            ...(route.internal ? { 'lensmcp.internal': true } : {}),
-        });
-        if (span)
-            spanByReq.set(request, span);
-        // Verify the end-user JWT ONCE (when a verifier is configured) — reused for both edge
-        // authorization and rollout targeting. Internal east-west routes use x-api-key instead.
-        const claims = route.internal ? undefined : opts.identify?.(req);
-        let caller;
-        if (route.internal) {
-            caller = keyToProject.get(String(req.headers['x-api-key'] ?? ''));
-            if (!caller) {
-                step(trace, 'auth', { mode: 'x-api-key', ok: false });
-                finish(trace, route.service, 401);
-                return sendError(reply, req, 401, 'unauthorized', 'Invalid or missing x-api-key for internal route.');
-            }
-            req.headers['x-api-key-id'] = caller;
-            delete req.headers['x-api-key'];
-            step(trace, 'auth', { mode: 'x-api-key', ok: true, caller });
-        }
-        else {
-            const m = manifestByService.get(route.service);
-            const resolved = m ? (0, manifest_1.authRuleForPath)(m, cpath, req.method ?? 'GET', false) : { mode: route.auth };
-            if (resolved.mode === 'jwt') {
-                if (opts.identify) {
-                    if (!claims) {
-                        step(trace, 'auth', { mode: 'jwt', ok: false });
-                        finish(trace, route.service, 401);
-                        return sendError(reply, req, 401, 'unauthorized', 'Unauthorized: invalid or missing token');
-                    }
-                }
-                else {
-                    try {
-                        authenticate('jwt', req);
-                    }
-                    catch (e) {
-                        step(trace, 'auth', { mode: 'jwt', ok: false });
-                        finish(trace, route.service, 401);
-                        return sendError(reply, req, 401, 'unauthorized', `Unauthorized: ${e.message}`);
-                    }
-                }
-                // edge ABAC: the required permission/rule must hold against the VERIFIED claims.
-                // A present rule MUST be satisfied by VERIFIED claims. No claims (no verifier) → cannot satisfy → DENY (fail closed).
-                if (resolved.rule && (!claims || !(0, manifest_1.evalRule)(resolved.rule, buildAttrs(req, request.ip, claims, undefined)))) {
-                    step(trace, 'authz', { ok: false });
-                    finish(trace, route.service, 403);
-                    return sendError(reply, req, 403, 'forbidden', 'Forbidden: insufficient permission');
-                }
-                step(trace, 'auth', { mode: 'jwt', ok: true });
-                if (claims)
-                    stampIdentity(req, claims);
-            }
-            else {
-                step(trace, 'auth', { mode: resolved.mode });
-            }
-        }
-        if (opts.serviceKeys?.[route.service])
-            req.headers['x-internal-token'] = opts.serviceKeys[route.service];
-        if (route.prependPrefix) {
-            const u = req.url ?? '/';
-            const pp = route.prependPrefix;
-            if (u !== pp && !u.startsWith(pp + '/'))
-                req.url = pp + u;
-        } // segment-boundary, not bare startsWith (/apidoc must not escape /api)
-        // ── version selection: explicit pin → ABAC rule → sticky-key weighted → SWRR ──
-        // (targeting/stickiness only for external routes; internal east-west has no "device")
-        const explicit = hdr(req.headers[versionHeader]);
-        let pinned = explicit;
-        let mintKey; // set → append Set-Cookie on the response
-        if (!route.internal && !explicit) {
-            const sk = resolveStickyKey(req);
-            if (sk.mint)
-                mintKey = sk.key;
-            const attrs = buildAttrs(req, request.ip, claims, sk.key);
-            const targeted = opts.pods?.resolveVersion?.(route.service, attrs);
-            if (targeted) {
-                pinned = targeted.version;
-                step(trace, 'targeting', { rule: targeted.rule, version: targeted.version });
-            }
-            else if (sk.key) {
-                const b = opts.pods?.bucket?.(route.service, sk.key);
-                if (b) {
-                    pinned = b.version;
-                    step(trace, 'targeting', { mode: 'sticky', version: b.version });
-                }
-            }
-        }
-        const up = await resolveUpstream(route, trace, pinned);
-        if (!up) {
-            finish(trace, route.service, 503);
-            return sendError(reply, req, 503, 'unavailable', `Service ${route.service} has no available upstream.`);
-        }
-        if (!('url' in up)) {
-            finish(trace, route.service, 502);
-            return sendError(reply, req, 502, 'unavailable', `Service ${route.service}: socket upstreams are not supported by the prod gateway.`);
-        }
-        const origin = new URL(up.url).origin;
-        const upLabel = up.url;
-        reqState.set(request, { route, caller, startedAt: Date.now(), trace, version: up.version, upLabel });
-        step(trace, up.version ? 'rollout' : 'upstream', { upstream: upLabel, ...(up.version ? { version: up.version, ...(explicit ? { pinned: true } : {}) } : {}) });
-        // Propagate the gateway span's context downstream (W3C traceparent on the forwarded request).
-        if (span)
-            opts.tracing.inject(span, req.headers);
-        // No source → reply-from forwards the (prefix-rewritten) req.url to `origin`.
-        return reply.from(undefined, {
-            getUpstream: () => origin,
-            rewriteHeaders: (headers) => {
-                headers['x-lensmcp-upstream'] = upLabel;
-                if (!headers['x-request-id'])
-                    headers['x-request-id'] = (0, gateway_errors_1.ensureRequestId)(req); // trace id on success too (if the upstream didn't echo it)
-                if (up.version)
-                    headers['x-lensmcp-version'] = up.version; // which rollout cohort served
-                // The gateway owns the edge response: drop the upstream framework leak
-                // (e.g. NestJS/Express `x-powered-by`) and brand the hop as the LensMCP gateway.
-                delete headers['x-powered-by'];
-                delete headers['connection'];
-                delete headers['keep-alive'];
-                delete headers['proxy-connection']; // strip hop-by-hop from the upstream response
-                headers['server'] = 'LensMCP';
-                if (mintKey) { // first contact → stamp the device cookie (appended to any upstream Set-Cookie)
-                    const ex = headers['set-cookie'];
-                    const list = Array.isArray(ex) ? ex : ex ? [ex] : [];
-                    headers['set-cookie'] = [...list, mintCookieHeader(mintKey)];
-                }
-                return headers;
-            },
-            onError: (rep, { error }) => {
-                opts.pods?.drop?.(route.service, up);
-                void error; // don't reflect the raw upstream error (host:port / errno) to the client
-                sendError(rep, req, 502, 'unavailable', `Upstream ${route.service} unavailable.`);
-            },
-        });
-    };
-    // ---- raw WebSocket upgrade proxy (same trust model; net-level pipe) ----
-    const upgrade = (req, socket, head) => {
-        stripTrust(req);
-        const host = (req.headers.host || '').split(':')[0];
-        const cpath = canonicalPath(req.url ?? '/');
-        if (cpath === undefined) {
-            socket.destroy();
-            return;
-        } // reject path-canonicalization attacks
-        const route = (0, manifest_1.matchRoute)(routes, host, req.url ?? '/');
-        if (!route) {
-            socket.destroy();
-            return;
-        }
-        const claims = route.internal ? undefined : opts.identify?.(req);
-        let caller;
-        if (route.internal) {
-            caller = keyToProject.get(String(req.headers['x-api-key'] ?? ''));
-            if (!caller) {
-                socket.destroy();
-                return;
-            }
-        }
-        else {
-            const m = manifestByService.get(route.service);
-            const resolved = m ? (0, manifest_1.authRuleForPath)(m, cpath, req.method ?? 'GET', false) : { mode: route.auth };
-            if (resolved.mode === 'jwt') {
-                if (opts.identify) {
-                    if (!claims) {
-                        socket.destroy();
-                        return;
-                    }
-                }
-                else {
-                    try {
-                        authenticate('jwt', req);
-                    }
-                    catch {
-                        socket.destroy();
-                        return;
-                    }
-                }
-                // Same fail-closed ABAC + identical attribute bag as the HTTP path (no divergence).
-                if (resolved.rule && (!claims || !(0, manifest_1.evalRule)(resolved.rule, buildAttrs(req, req.socket.remoteAddress ?? '', claims, undefined)))) {
-                    socket.destroy();
-                    return;
-                }
-            }
-        }
-        if (route.prependPrefix) {
-            const u = req.url ?? '/';
-            const pp = route.prependPrefix;
-            if (u !== pp && !u.startsWith(pp + '/'))
-                req.url = pp + u;
-        } // segment-boundary, not bare startsWith (/apidoc must not escape /api)
-        const pinned = hdr(req.headers[versionHeader]);
-        void (async () => {
-            const up = await resolveUpstream(route, undefined, pinned);
-            if (!up || !('url' in up)) {
-                socket.destroy();
-                return;
-            }
-            const u = new URL(up.url);
-            const upstream = net.connect(Number(u.port) || (u.protocol === 'https:' ? 443 : 80), u.hostname, () => {
-                // rebuild the upgrade request from rawHeaders (verbatim), minus the trust headers
-                // we own (incl. client identity), plus the validated caller + target token + identity.
-                // Strip the trust headers AND the client's hop-by-hop control (connection/keep-alive),
-                // so a `Connection: x-internal-token` can't strip the gateway's injected headers downstream.
-                const strip = new Set(['x-internal-token', 'x-api-key-id', 'x-api-key', 'x-user-id', 'x-tenant-id', 'x-user-roles', 'x-user-permissions', 'connection', 'proxy-connection', 'keep-alive']);
-                const lines = [`${req.method} ${req.url} HTTP/1.1`, 'Connection: Upgrade']; // gateway-owned, clean upgrade
-                for (let i = 0; i < req.rawHeaders.length; i += 2) {
-                    const k = req.rawHeaders[i];
-                    if (!strip.has(k.toLowerCase()))
-                        lines.push(`${k}: ${req.rawHeaders[i + 1]}`);
-                }
-                if (caller)
-                    lines.push(`x-api-key-id: ${caller}`);
-                const token = opts.serviceKeys?.[route.service];
-                if (token)
-                    lines.push(`x-internal-token: ${token}`);
-                if (claims) { // stamp the verified identity (mirrors the HTTP path's stampIdentity)
-                    if (claims['sub'])
-                        lines.push(`x-user-id: ${String(claims['sub'])}`);
-                    if (claims['tid'])
-                        lines.push(`x-tenant-id: ${String(claims['tid'])}`);
-                    const roles = claims['roles'];
-                    if (Array.isArray(roles) && roles.length)
-                        lines.push(`x-user-roles: ${roles.map(String).join(',')}`);
-                    const perms = claims['perms'];
-                    if (Array.isArray(perms) && perms.length)
-                        lines.push(`x-user-permissions: ${perms.map(String).join(',')}`);
-                }
-                upstream.write(lines.join('\r\n') + '\r\n\r\n');
-                if (head?.length)
-                    upstream.write(head);
-                socket.pipe(upstream);
-                upstream.pipe(socket);
-            });
-            upstream.on('error', () => socket.destroy());
-            socket.on('error', () => upstream.destroy());
-        })();
-    };
-    // ---- opt-in access log: one Cloud-Logging-shaped JSON line per response ----
-    // Covers EVERY response (incl. 401/404/503 that never reached an upstream),
-    // not just forwarded ones; `reply.elapsedTime` gives latency without our own timer.
-    const logAccess = (request, reply, st) => {
-        const req = request.raw;
-        const status = reply.statusCode ?? 0;
-        const host = (req.headers.host || '').split(':')[0];
-        const path = (req.url || '/').split('?')[0];
-        const ms = Math.round(reply.elapsedTime);
-        try {
-            console.log(JSON.stringify({
-                severity: status >= 500 ? 'ERROR' : status >= 400 ? 'WARNING' : 'INFO',
-                time: new Date().toISOString(),
-                message: `${req.method} ${host}${path} ${status} ${ms}ms`,
-                method: req.method, host, path, status, ms,
-                ...(st ? { service: st.route.service, upstream: st.upLabel } : {}),
-                ...(st?.version ? { version: st.version } : {}),
-                ...(st?.caller ? { caller: st.caller } : {}),
-                ...(req.headers['x-request-id'] ? { requestId: String(req.headers['x-request-id']) } : {}),
-            }));
-        }
-        catch { /* never let logging break the response */ }
-    };
-    // ---- build one Fastify app per port (shared route table + providers) ----
-    const buildApp = async () => {
-        const keepAlive = opts.server?.keepAliveTimeout ?? 620_000; // > GCP external ALB 600s backend keep-alive
-        const app = (0, fastify_1.default)({
-            logger: false,
-            keepAliveTimeout: keepAlive,
-            requestTimeout: opts.server?.requestTimeout ?? 0, // 0 = no inbound request timeout (long-lived streaming)
-            ...(opts.server?.connectionTimeout !== undefined ? { connectionTimeout: opts.server.connectionTimeout } : {}),
-            ...(opts.trustProxyIp ? { trustProxy: true } : {}),
-            ...(opts.tls ? { https: { key: opts.tls.key, cert: opts.tls.cert } } : {}),
-        });
-        // headersTimeout must stay above keepAliveTimeout, else Node may close an idle
-        // keep-alive socket mid-request under load. Default: just above keepAlive.
-        app.server.headersTimeout = opts.server?.headersTimeout ?? keepAlive + 10_000;
-        // Stream every body straight through — never parse/buffer (this is a proxy).
-        app.removeAllContentTypeParsers();
-        app.addContentTypeParser('*', (_req, payload, done) => done(null, payload));
-        await app.register(reply_from_1.default, {
-            disableRequestLogging: true,
-            undici: {
-                connections: opts.undici?.connections ?? 256,
-                pipelining: opts.undici?.pipelining ?? 1,
-                keepAliveTimeout: opts.undici?.keepAliveTimeout ?? 60_000,
-                bodyTimeout: opts.undici?.bodyTimeout ?? 0, // 0 = unlimited — never cut long-lived SSE / streaming MCP responses
-                headersTimeout: opts.undici?.headersTimeout ?? 60_000, // upstream must send response headers within 60s
-                ...(opts.undici?.allowH2 ? { allowH2: true } : {}), // multiplex many MCP streams over few h2 conns (Cloud Run speaks h2)
-                connect: {
-                    rejectUnauthorized: opts.undici?.rejectUnauthorized ?? false, // local-CA/self-signed by default; set true for verified east-west on GCP
-                    ...(opts.undici?.cert ? { cert: opts.undici.cert } : {}), // ── mTLS: present a client cert to upstreams ──
-                    ...(opts.undici?.key ? { key: opts.undici.key } : {}),
-                    ...(opts.undici?.ca ? { ca: opts.undici.ca } : {}), // trust a private CA for the server side
-                },
-            },
-        });
-        // Host-agnostic operational probes (answered before routing).
-        app.get('/livez', (_req, reply) => { reply.type('text/plain').send('ok'); });
-        app.get('/readyz', (_req, reply) => {
-            const ready = routes.length > 0;
-            reply.code(ready ? 200 : 503).type('text/plain').send(ready ? 'ready' : 'no routes loaded');
-        });
-        // Per-service health rollup (opt-in; token-guarded). For a status page that
-        // prefers HTTP over the Redis `status:*` fan-out. Off by default → 404 (don't
-        // leak topology on a public edge unless explicitly enabled).
-        app.get('/statusz', (request, reply) => {
-            // Fail closed: /statusz is served ONLY when both enabled AND a token is set
-            // (never expose topology/health unauthenticated). Constant-time token compare.
-            if (!opts.statusEndpoint || !opts.statusToken) {
-                reply.code(404).type('text/plain').send('not found');
-                return;
-            }
-            const tok = request.query?.token ?? hdr(request.raw.headers['x-status-token']) ?? '';
-            const a = Buffer.from(tok), b = Buffer.from(opts.statusToken);
-            if (a.length !== b.length || !(0, node_crypto_1.timingSafeEqual)(a, b)) {
-                reply.code(401).type('text/plain').send('unauthorized');
-                return;
-            }
-            reply.type('application/json').send(JSON.stringify({ generatedAt: Date.now(), services: buildStatusSnapshot(), endpoints: opts.healthChecker?.snapshot() ?? [] }));
-        });
-        // Process self-metrics (event-loop lag / rss / cpu / req rates) — same token gate as /statusz.
-        app.get('/metricsz', (request, reply) => {
-            if (!opts.metrics || !opts.statusToken) {
-                reply.code(404).type('text/plain').send('not found');
-                return;
-            }
-            const tok = request.query?.token ?? hdr(request.raw.headers['x-status-token']) ?? '';
-            const a = Buffer.from(tok), b = Buffer.from(opts.statusToken);
-            if (a.length !== b.length || !(0, node_crypto_1.timingSafeEqual)(a, b)) {
-                reply.code(401).type('text/plain').send('unauthorized');
-                return;
-            }
-            reply.type('application/json').send(JSON.stringify(opts.metrics.snapshot()));
-        });
-        app.addHook('onRequest', (request, _reply, done) => { stripTrust(request.raw); done(); });
-        // Edge CORS authority: stamp Access-Control-Allow-Origin on EVERY response that lacks it — including the
-        // 401/403/5xx the gateway generates ITSELF (edge auth/authz/proxy errors) which never reach an upstream.
-        // Without it the browser sees the error WITHOUT CORS and reports a CORS failure that MASKS the real
-        // status (e.g. a 401 the app should handle by re-authing). Add ONLY if absent so a proxied success keeps
-        // the upstream's header (no duplicate). No credentials (Bearer APIs; matches setCors).
-        app.addHook('onSend', (request, reply, payload, done) => {
-            const origin = request.headers.origin;
-            if (origin && !reply.getHeader('access-control-allow-origin')) {
-                // A credentialed-allowlist origin gets the EXACT origin + ACAC:true (so a gateway-generated
-                // 401/403/5xx on a credentialed first-party origin still passes the browser's CORS check);
-                // everyone else gets the reflected origin WITHOUT credentials (matches setCors).
-                if (corsCredentialOrigins.has(origin.toLowerCase())) {
-                    reply.header('access-control-allow-origin', origin);
-                    reply.header('access-control-allow-credentials', 'true');
-                }
-                else {
-                    reply.header('access-control-allow-origin', String(origin));
-                }
-                reply.header('vary', 'Origin');
-            }
-            done(null, payload);
-        });
-        app.addHook('onResponse', (request, reply, done) => {
-            const st = reqState.get(request);
-            if (st) {
-                recordEdge(st.route, Date.now() - st.startedAt, reply.statusCode ?? 0, st.caller, st.version);
-                finish(st.trace, st.route.service, reply.statusCode ?? 0, { upstream: st.upLabel, ...(st.version ? { version: st.version } : {}), ...(st.caller ? { caller: st.caller } : {}) });
-                reqState.delete(request);
-            }
-            const sp = spanByReq.get(request);
-            if (sp) {
-                opts.tracing.end(sp, reply.statusCode ?? 0, { ...(st?.upLabel ? { 'upstream.url': st.upLabel } : {}), ...(st?.version ? { 'lensmcp.version': st.version } : {}) });
-                spanByReq.delete(request);
-            }
-            opts.metrics?.recordRequest(reply.statusCode ?? 0);
-            if (accessLog)
-                logAccess(request, reply, st);
-            done();
-        });
-        app.all('/', handler);
-        app.all('/*', handler);
-        app.server.on('upgrade', upgrade);
-        return app;
-    };
-    // ---- listeners ----
-    const apps = [];
-    const boundPorts = [];
-    for (const port of ports) {
-        const app = await buildApp();
-        await app.listen({ port, host: '0.0.0.0' });
-        const addr = app.server.address();
-        const bound = typeof addr === 'object' && addr ? addr.port : port;
-        boundPorts.push(bound);
-        console.log(`[gateway] listening on ${opts.tls ? 'https' : 'http'}://0.0.0.0:${bound}`);
-        apps.push(app);
-    }
-    opts.healthChecker?.start(); // begin probing now that the route table (and tracked URLs) is warm
-    let stopped = false;
-    return {
-        ports: boundPorts,
-        routes: () => routes,
-        status: buildStatusSnapshot,
-        stop: async () => {
-            if (stopped)
-                return;
-            stopped = true;
-            clearInterval(edgeFlusher);
-            unwatch?.();
-            opts.healthChecker?.stop();
-            opts.rateLimiter?.stop();
-            opts.metrics?.stop();
-            emit('info', 'gateway down', 'gateway-down', { kind: 'gateway-down' });
-            await Promise.all(apps.map((a) => a.close())); // reply-from closes its undici pool on close
-        },
-    };
-}
+var server_1 = require("./prod-runtime/server");
+Object.defineProperty(exports, "startProdGateway", { enumerable: true, get: function () { return server_1.startProdGateway; } });