@lensmcp/cluster 1.12.0 → 1.13.0

package/executors/gateway/prod-runtime/server.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startProdGateway = startProdGateway;
+const observability_1 = require("./observability");
+const routing_1 = require("./routing");
+const rollout_1 = require("./rollout");
+const upstream_1 = require("./upstream");
+const auth_1 = require("./auth");
+const hooks_1 = require("./hooks");
+const cors_1 = require("./cors");
+const handler_1 = require("./handler");
+const upgrade_1 = require("./upgrade");
+const app_1 = require("./app");
+async function startProdGateway(opts) {
+    const ports = opts.ports?.length ? opts.ports : [opts.tls ? 8443 : 8080];
+    // Default authenticator FAILS CLOSED: a jwt route with no authenticator wired is rejected.
+    const authenticate = opts.authenticate ?? ((mode) => {
+        if (mode === 'jwt')
+            throw new Error('jwt route but no authenticator configured');
+    });
+    // ---- option-derived config (resolved once) ----
+    const versionHeader = (opts.versionHeader ?? 'x-lensmcp-version').toLowerCase();
+    const accessLog = !!opts.accessLog;
+    const corsCredentialOrigins = new Set((opts.corsCredentialOrigins ?? []).map((o) => o.toLowerCase()));
+    const keyToProject = new Map(Object.entries(opts.serviceKeys ?? {}).map(([p, k]) => [k, p]));
+    // ---- route table + observability (lazy getRoutes breaks the table↔obs cycle) ----
+    // A holder, so obs can read the routes lazily while `table` stays a const (assigned once,
+    // before any request — obs's getter only runs at request time).
+    const tableRef = {};
+    const obs = (0, observability_1.createObservability)(opts, () => tableRef.current.routes);
+    const table = (0, routing_1.createRouteTable)(opts, obs);
+    tableRef.current = table;
+    const rt = { opts, table, keyToProject, versionHeader, accessLog, corsCredentialOrigins };
+    // ---- layers ----
+    const rollout = (0, rollout_1.createRollout)(opts);
+    const upstream = (0, upstream_1.createUpstream)(opts, obs);
+    const edgeAuth = (0, auth_1.createEdgeAuth)(rt, obs, rollout, authenticate);
+    const hooks = (0, hooks_1.createHooks)(opts.hooks ?? {});
+    const reqState = new WeakMap();
+    const spanByReq = new WeakMap();
+    const ctxByReq = new WeakMap();
+    const cors = (0, cors_1.createCors)(rt, reqState);
+    const handler = (0, handler_1.createHandler)({ rt, obs, cors, auth: edgeAuth, upstream, rollout, hooks, reqState, spanByReq, ctxByReq });
+    const upgrade = (0, upgrade_1.createUpgrade)({ rt, auth: edgeAuth, upstream, hooks });
+    const { buildApp } = (0, app_1.createApp)({ rt, obs, cors, hooks, handler, upgrade, reqState, spanByReq, ctxByReq });
+    const flusher = obs.startFlusher();
+    table.rebuild(table.manifests()); // emit initial gateway-up (+ healthChecker.track)
+    // ---- listeners ----
+    const apps = [];
+    const boundPorts = [];
+    for (const port of ports) {
+        const app = await buildApp();
+        await app.listen({ port, host: '0.0.0.0' });
+        const addr = app.server.address();
+        const bound = typeof addr === 'object' && addr ? addr.port : port;
+        boundPorts.push(bound);
+        console.log(`[gateway] listening on ${opts.tls ? 'https' : 'http'}://0.0.0.0:${bound}`);
+        apps.push(app);
+    }
+    opts.healthChecker?.start(); // begin probing now that the route table (and tracked URLs) is warm
+    let stopped = false;
+    return {
+        ports: boundPorts,
+        routes: () => table.routes,
+        status: obs.buildStatusSnapshot,
+        stop: async () => {
+            if (stopped)
+                return;
+            stopped = true;
+            clearInterval(flusher);
+            table.stop();
+            opts.healthChecker?.stop();
+            opts.rateLimiter?.stop();
+            opts.metrics?.stop();
+            obs.emit('info', 'gateway down', 'gateway-down', { kind: 'gateway-down' });
+            await Promise.all(apps.map((a) => a.close())); // reply-from closes its undici pool on close
+        },
+    };
+}

package/executors/gateway/prod-runtime/trust.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The trust boundary (verbatim dev model). The gateway OWNS the identity/trust
+ * headers — drop any client-supplied copy at ingress so identity can only
+ * originate from a verified token, then re-stamp on forward. Pure.
+ */
+import type * as http from 'node:http';
+export declare const TRUST_HEADERS: string[];
+export declare const HOP_BY_HOP: string[];
+export declare const stripTrust: (req: http.IncomingMessage) => void;
+/** Stamp the verified identity onto the forwarded request — tenant from the `tid` CLAIM, never a client header. */
+export declare const stampIdentity: (req: http.IncomingMessage, claims: Record<string, unknown>) => void;
+//# sourceMappingURL=trust.d.ts.map

package/executors/gateway/prod-runtime/trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/prod-runtime/trust.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAGvC,eAAO,MAAM,aAAa,UAAyG,CAAC;AAIpI,eAAO,MAAM,UAAU,UAAmD,CAAC;AAE3E,eAAO,MAAM,UAAU,GAAI,KAAK,IAAI,CAAC,eAAe,KAAG,IAGtD,CAAC;AAEF,mHAAmH;AACnH,eAAO,MAAM,aAAa,GAAI,KAAK,IAAI,CAAC,eAAe,EAAE,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,IAQ1F,CAAC"}

package/executors/gateway/prod-runtime/trust.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stampIdentity = exports.stripTrust = exports.HOP_BY_HOP = exports.TRUST_HEADERS = void 0;
+// Drop any client-supplied copy at ingress so identity can only originate from a verified token.
+exports.TRUST_HEADERS = ['x-internal-token', 'x-api-key-id', 'x-user-id', 'x-tenant-id', 'x-user-roles', 'x-user-permissions'];
+// Also drop client-supplied hop-by-hop control headers: a `Connection: x-internal-token`
+// would otherwise make undici strip the gateway's OWN injected trust headers before the
+// upstream (CVE-2026-33805). The proxy manages its own upstream connection semantics.
+exports.HOP_BY_HOP = ['connection', 'proxy-connection', 'keep-alive'];
+const stripTrust = (req) => {
+    for (const h of exports.TRUST_HEADERS)
+        delete req.headers[h];
+    for (const h of exports.HOP_BY_HOP)
+        delete req.headers[h];
+};
+exports.stripTrust = stripTrust;
+/** Stamp the verified identity onto the forwarded request — tenant from the `tid` CLAIM, never a client header. */
+const stampIdentity = (req, claims) => {
+    // Only stamp SCALAR claims — an object/array sub/tid must never coerce to
+    // "[object Object]" / a CSV tenant header (claim type-confusion).
+    const set = (k, v) => { if ((typeof v === 'string' && v !== '') || typeof v === 'number')
+        req.headers[k] = String(v); };
+    set('x-user-id', claims['sub']);
+    set('x-tenant-id', claims['tid']);
+    const roles = claims['roles'];
+    if (Array.isArray(roles) && roles.length)
+        req.headers['x-user-roles'] = roles.map(String).join(',');
+    const perms = claims['perms'];
+    if (Array.isArray(perms) && perms.length)
+        req.headers['x-user-permissions'] = perms.map(String).join(',');
+};
+exports.stampIdentity = stampIdentity;

package/executors/gateway/prod-runtime/types.d.ts

@@ -0,0 +1,241 @@
+/**
+ * Shared types for the layered PROD gateway runtime. TYPES-ONLY (imports only
+ * `node:*`, `fastify`, `../manifest`, the provider modules, and `../gateway-errors`
+ * — never a runtime layer) so every layer imports it without a cycle. The
+ * composition root (`server.ts`) is the only place concrete layers are wired.
+ */
+import type * as http from 'node:http';
+import type { FastifyReply, FastifyRequest } from 'fastify';
+import type { AuthMode, Attrs, ManifestProvider, PodProvider, Route, RouteManifest } from '../manifest';
+import type { GatewayTracer } from '../otel-tracing';
+import type { HealthChecker } from '../health-check';
+import type { RateLimiter } from '../rate-limit';
+import type { ProcessMetrics } from '../metrics';
+export type { Attrs };
+/** Per-service health rollup, derived from observed traffic over a rolling window.
+ *  `status` is inferred from the recent error rate (passive — not an active probe):
+ *  healthy <5% err · degraded 5–50% · down ≥50% · idle (no recent traffic). */
+export interface ServiceStatus {
+    service: string;
+    hosts: string[];
+    status: 'healthy' | 'degraded' | 'down' | 'idle';
+    requests: number;
+    errorRate: number;
+    avgMs: number;
+    versions: string[];
+    lastSeen: number | null;
+}
+export interface ProdGatewayOptions {
+    /** Ports to bind. Default `[8080]` (or `[8443]` with TLS). One Fastify
+     *  instance per port; all share the route table + providers. */
+    ports?: number[];
+    manifests: ManifestProvider;
+    /** Resolves a service → upstream when a route has no direct `upstream`. */
+    pods?: PodProvider;
+    /** service → its `x-internal-token` (from a k8s Secret / Vault in prod). */
+    serviceKeys?: Record<string, string>;
+    /** Validate a `jwt`-mode request; THROW to reject (→ 401). Default: a
+     *  pass-through with a one-time warning — wire a real JWKS validator in prod. */
+    authenticate?: (mode: AuthMode, req: http.IncomingMessage) => void;
+    tls?: {
+        key: string | Buffer;
+        cert: string | Buffer;
+    };
+    /** Lens bus sink — OPT-IN. Omit (default) for zero observability overhead. */
+    emit?: (event: Record<string, unknown>) => void;
+    /** Traffic-edge flush period (ms). Default 5000. */
+    trafficFlushMs?: number;
+    /** Request header that PINS a rollout cohort (sticky canary / debugging).
+     *  Default `x-lensmcp-version`. The chosen version is echoed on the response. */
+    versionHeader?: string;
+    /** undici pool tuning passed to reply-from. `bodyTimeout: 0` (default) keeps
+     *  long-lived SSE / streamable-HTTP MCP responses open — undici's 300s default
+     *  would otherwise abort an idle stream. `rejectUnauthorized` defaults false
+     *  (local-CA / self-signed upstreams); set true for verified east-west on GCP.
+     *  `allowH2` multiplexes many concurrent streams over few HTTP/2 connections
+     *  (Cloud Run supports h2 end-to-end) — useful when one upstream fans many MCP streams.
+     *  `cert`/`key` present a client certificate to upstreams (mTLS); `ca` trusts a
+     *  private CA for the server side. `rejectUnauthorized:false` keeps mTLS while
+     *  skipping server-cert validation (self-signed internal services). */
+    undici?: {
+        connections?: number;
+        pipelining?: number;
+        keepAliveTimeout?: number;
+        bodyTimeout?: number;
+        headersTimeout?: number;
+        rejectUnauthorized?: boolean;
+        allowH2?: boolean;
+        cert?: string | Buffer;
+        key?: string | Buffer;
+        ca?: string | Buffer;
+    };
+    /** Header carrying the AUTHORITATIVE client IP from a trusted front proxy
+     *  (e.g. `cf-connecting-ip` behind Cloudflare). When set, the `ip` ABAC
+     *  attribute comes from this header instead of the (multi-proxy, spoofable)
+     *  X-Forwarded-For chain. Safe only when the origin is locked to that proxy —
+     *  which Cloudflare Tunnel guarantees (there is no public origin to bypass). */
+    clientIpHeader?: string;
+    /** CIDRs of trusted front proxies. `clientIpHeader` is honored ONLY when the
+     *  immediate peer (socket address) is in this set — otherwise the header is
+     *  ignored and the socket IP is used (prevents spoofing the `ip` ABAC attribute
+     *  by hitting the origin directly). Default when omitted: loopback only
+     *  (matches a co-located cloudflared/sidecar). */
+    clientIpTrustedProxies?: string[];
+    /** OpenTelemetry tracer (from `setupTracing`). When set, each request gets a
+     *  SERVER span whose context is propagated downstream (W3C `traceparent`), so
+     *  the gateway hop stitches into the distributed trace. Omit → no span work. */
+    tracing?: GatewayTracer;
+    /** Expose `GET /statusz` — the per-service health rollup as JSON. Requires
+     *  `statusToken` too (fail-closed: served only when both are set). Default off (404). */
+    statusEndpoint?: boolean;
+    /** Token `/statusz` requires (via `?token=` or `x-status-token`), compared in
+     *  constant time. REQUIRED for the endpoint to serve — no token → /statusz is 404. */
+    statusToken?: string;
+    /** How many flush windows the rolling status sums over (default 12 → ~60s at the 5s flush). */
+    statusWindows?: number;
+    /** Called each flush window with the per-service status snapshot — wire it to a
+     *  Redis `status:*` fan-out / status page. The gateway is the only thing that
+     *  sees every request, so this is the natural source of observed health. */
+    onStatus?: (snapshot: ServiceStatus[]) => void;
+    /** Active upstream health-checker (from `createHealthChecker`). When set, the
+     *  gateway probes upstreams, steers pooled picks toward healthy endpoints, and
+     *  reflects true liveness in /statusz. Omit → passive drop-on-error only. */
+    healthChecker?: HealthChecker;
+    /** Opt-in per-client-IP rate limiter — defense-in-depth behind the edge throttle.
+     *  In-memory + per-instance (`createRateLimiter`) or ONE global budget across all
+     *  containers (`createRedisRateLimiter`). The check is `await`ed either way; it
+     *  runs before routing/auth and applies only to proxied traffic (ops endpoints exempt). */
+    rateLimiter?: RateLimiter;
+    /** Process self-metrics (event-loop lag / rss / cpu / req rates) from `createProcessMetrics`;
+     *  exposed at the token-gated `/metricsz` for load/stress tests + production monitoring. */
+    metrics?: ProcessMetrics;
+    /** Server-side HTTP timeouts (ms). `keepAliveTimeout` default 620000 — kept
+     *  ABOVE the GCP external ALB's 600s backend keep-alive so the gateway never
+     *  closes a pooled connection the LB still considers live (the classic
+     *  intermittent-502 race). `requestTimeout` default 0 (disabled) for streaming. */
+    server?: {
+        keepAliveTimeout?: number;
+        requestTimeout?: number;
+        connectionTimeout?: number;
+        headersTimeout?: number;
+    };
+    /** Opt-in one-JSON-line-per-request access log to stdout, shaped for Cloud
+     *  Logging (severity + time + message). Default off (zero overhead). */
+    accessLog?: boolean;
+    /** Browser origins allowed to make CREDENTIALED cross-origin requests (cookies /
+     *  `credentials: 'include'`). For an origin in this allowlist the gateway answers preflights — and
+     *  stamps gateway-generated responses — with `Access-Control-Allow-Origin: <exact origin>` +
+     *  `Access-Control-Allow-Credentials: true` (NEVER `*`: a credentialed `*` is forbidden by the Fetch
+     *  spec and a cross-site read hole). Needed when a first-party browser app POSTs to a routed service
+     *  that sets a cookie (e.g. an IdP SSO cookie set across `login.example.com → auth.example.com`).
+     *  Exact-matched, case-insensitive. Omit (default) → no credentialed CORS (the Bearer-only edge). */
+    corsCredentialOrigins?: string[];
+    /** Return verified subject attributes (e.g. JWT claims) for ABAC routing.
+     *  MUST verify (signature/exp) — forged claims must not reach the rules. */
+    identify?: (req: http.IncomingMessage) => Record<string, unknown> | undefined;
+    /** Allowlist of request headers exposed to rules as `header.<name>` attributes. */
+    attributeHeaders?: string[];
+    /** Take the `ip` attribute from `X-Forwarded-For` (behind a trusted LB) via
+     *  Fastify `trustProxy`; default false → socket IP. */
+    trustProxyIp?: boolean;
+    /** Gateway-issued device cookie for sticky bucketing (anonymous-friendly).
+     *  Omit to disable cookie stickiness. `secret` enables HMAC signing. */
+    cookie?: {
+        name?: string;
+        secret?: string;
+        domain?: string;
+        maxAge?: number;
+    };
+    /** Header carrying a client device/user id — the sticky key when no cookie
+     *  is present (native/mobile/API clients), e.g. `x-device-id`. */
+    uidHeader?: string;
+    /** Customer-supplied lifecycle hooks layered on the built-in pipeline (see hooks.ts). */
+    hooks?: ProdGatewayHooks;
+}
+export interface ProdGatewayHandle {
+    ports: number[];
+    routes: () => Route[];
+    status: () => ServiceStatus[];
+    stop: () => Promise<void>;
+}
+/** The reply surface {@link sendError} uses — structural so BOTH the HTTP/1 and HTTP/2 fastify reply
+ *  generics (e.g. the `@fastify/reply-from` `onError` reply) satisfy it without a cast. */
+export interface ReplyLike {
+    code(statusCode: number): ReplyLike;
+    header(key: string, value: string): ReplyLike;
+    type(contentType: string): ReplyLike;
+    send(payload: string): ReplyLike;
+}
+/** Per-request state stashed between the handler and the onResponse hook
+ *  (edge + trace finish) — keyed by the request object, no decoration needed. */
+export interface ReqState {
+    route: Route;
+    caller?: string;
+    startedAt: number;
+    trace?: GwTrace;
+    version?: string;
+    upLabel: string;
+    proxied?: boolean;
+}
+export interface GwTrace {
+    startedAt: number;
+    method: string;
+    host: string;
+    url: string;
+    steps: Array<Record<string, unknown>>;
+    flowId?: string;
+    requestId?: string;
+    done?: boolean;
+}
+/** The mutable route table, content-replaced atomically on a manifest rebuild
+ *  (the array + map identities are STABLE so layers can hold the reference). */
+export interface RouteTable {
+    routes: Route[];
+    manifestByService: Map<string, RouteManifest>;
+    rebuild(next: RouteManifest[]): void;
+    manifests(): RouteManifest[];
+    stop(): void;
+}
+/** Shared state + config for the prod layers (no layer-produced functions → acyclic).
+ *  `opts` is read pervasively (providers are DI'd through it); `table` holds the live
+ *  route refs; the rest is option-derived config resolved once in `server.ts`. */
+export interface ProdRuntime {
+    readonly opts: ProdGatewayOptions;
+    readonly table: RouteTable;
+    readonly keyToProject: ReadonlyMap<string, string>;
+    readonly versionHeader: string;
+    readonly accessLog: boolean;
+    readonly corsCredentialOrigins: ReadonlySet<string>;
+}
+export type ProdGatewayPhase = 'onRequest' | 'beforeAuth' | 'afterAuth' | 'beforeForward' | 'onResponse' | 'onError' | 'onUpgrade';
+export type ProdHookHandler = (ctx: ProdHookContext) => void | Promise<void>;
+export interface ProdGatewayHooks {
+    onRequest?: ProdHookHandler[];
+    beforeAuth?: ProdHookHandler[];
+    afterAuth?: ProdHookHandler[];
+    beforeForward?: ProdHookHandler[];
+    onResponse?: ProdHookHandler[];
+    onError?: ProdHookHandler[];
+    onUpgrade?: ProdHookHandler[];
+}
+/** Context passed to every prod hook — a typed view over the in-flight request. */
+export interface ProdHookContext {
+    /** Raw node request (header mutation flows downstream to the upstream). */
+    readonly req: http.IncomingMessage;
+    /** The Fastify request (absent on the `onUpgrade` path). */
+    readonly request?: FastifyRequest;
+    /** The Fastify reply (absent on the `onUpgrade` path). */
+    readonly reply?: FastifyReply;
+    /** The raw upgrade socket (present only on `onUpgrade`). */
+    readonly socket?: import('node:net').Socket;
+    route?: Route;
+    caller?: string;
+    claims?: Record<string, unknown>;
+    version?: string;
+    readonly trace?: GwTrace;
+    error?: Error;
+    status?: number;
+    sendError(status: number, reason: import('../gateway-errors').GatewayErrorReason, detail?: string): void;
+    responded(): boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/executors/gateway/prod-runtime/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/prod-runtime/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACxG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,YAAY,EAAE,KAAK,EAAE,CAAC;AAEtB;;+EAE+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC;oEACgE;IAChE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,2EAA2E;IAC3E,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;qFACiF;IACjF,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC;IACnE,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IACtD,8EAA8E;IAC9E,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAChD,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;qFACiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;2EAQuE;IACvE,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IACvP;;;;oFAIgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;sDAIkD;IAClD,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC;;oFAEgF;IAChF,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;6FACyF;IACzF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;0FACsF;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+FAA+F;IAC/F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;gFAE4E;IAC5E,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,IAAI,CAAC;IAC/C;;iFAE6E;IAC7E,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;+FAG2F;IAC3F,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;gGAC4F;IAC5F,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;uFAGmF;IACnF,MAAM,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrH;4EACwE;IACxE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;yGAMqG;IACrG,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IAGjC;gFAC4E;IAC5E,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC9E,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;2DACuD;IACvD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;4EACwE;IACxE,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9E;sEACkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,yFAAyF;IACzF,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,KAAK,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,aAAa,EAAE,CAAC;IAC9B,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;2FAC2F;AAC3F,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;iFACiF;AACjF,MAAM,WAAW,QAAQ;IAAG,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE;AAErJ,MAAM,WAAW,OAAO;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE;AAErL;gFACgF;AAChF,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC9C,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IACrC,SAAS,IAAI,aAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,IAAI,CAAC;CACd;AAED;;kFAEkF;AAClF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACrD;AAGD,MAAM,MAAM,gBAAgB,GACxB,WAAW,GAAG,YAAY,GAAG,WAAW,GAAG,eAAe,GAAG,YAAY,GAAG,SAAS,GAAG,WAAW,CAAC;AACxG,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,eAAe,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,SAAS,CAAC,EAAE,eAAe,EAAE,CAAC;IAC9B,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,UAAU,EAAE,MAAM,CAAC;IAC5C,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzG,SAAS,IAAI,OAAO,CAAC;CACtB"}

package/executors/gateway/prod-runtime/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/executors/gateway/prod-runtime/upgrade.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Raw WebSocket upgrade proxy (same trust model; net-level pipe). The upgrade
+ * request is rebuilt from `req.rawHeaders` verbatim — minus the gateway-owned
+ * trust headers + the client's hop-by-hop control — plus the validated caller +
+ * target token + verified identity. Reuses the shared auth + upstream layers.
+ */
+import * as net from 'node:net';
+import type * as http from 'node:http';
+import type { ProdRuntime } from './types';
+import type { EdgeAuth } from './auth';
+import type { UpstreamLayer } from './upstream';
+import type { HooksLayer } from './hooks';
+export interface UpgradeDeps {
+    rt: ProdRuntime;
+    auth: EdgeAuth;
+    upstream: UpstreamLayer;
+    hooks: HooksLayer;
+}
+export type UpgradeListener = (req: http.IncomingMessage, socket: net.Socket, head: Buffer) => void;
+export declare function createUpgrade(deps: UpgradeDeps): UpgradeListener;
+//# sourceMappingURL=upgrade.d.ts.map

package/executors/gateway/prod-runtime/upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/prod-runtime/upgrade.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAIvC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,WAAW,CAAC;IAChB,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,aAAa,CAAC;IACxB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAEpG,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,eAAe,CA4DhE"}

package/executors/gateway/prod-runtime/upgrade.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createUpgrade = createUpgrade;
+const tslib_1 = require("tslib");
+/**
+ * Raw WebSocket upgrade proxy (same trust model; net-level pipe). The upgrade
+ * request is rebuilt from `req.rawHeaders` verbatim — minus the gateway-owned
+ * trust headers + the client's hop-by-hop control — plus the validated caller +
+ * target token + verified identity. Reuses the shared auth + upstream layers.
+ */
+const net = tslib_1.__importStar(require("node:net"));
+const manifest_1 = require("../manifest");
+const edge_1 = require("./edge");
+const trust_1 = require("./trust");
+function createUpgrade(deps) {
+    const { rt, auth, upstream, hooks } = deps;
+    const run = async (req, socket, head) => {
+        (0, trust_1.stripTrust)(req);
+        const host = (req.headers.host || '').split(':')[0];
+        const cpath = (0, edge_1.canonicalPath)(req.url ?? '/');
+        if (cpath === undefined) {
+            socket.destroy();
+            return;
+        } // reject path-canonicalization attacks
+        const route = (0, manifest_1.matchRoute)(rt.table.routes, host, req.url ?? '/');
+        if (!route) {
+            socket.destroy();
+            return;
+        }
+        const ctx = hooks.any ? hooks.upgradeContext(req, socket, undefined) : undefined;
+        if (ctx)
+            ctx.route = route;
+        const claims = route.internal ? undefined : rt.opts.identify?.(req);
+        let caller;
+        if (route.internal) {
+            const v = auth.internal(req, route, undefined);
+            if (!v.ok) {
+                socket.destroy();
+                return;
+            }
+            caller = v.caller;
+            if (ctx)
+                ctx.caller = caller;
+        }
+        else {
+            // Same fail-closed ABAC + identical attribute bag as the HTTP path (no divergence).
+            const v = auth.public(req, route, cpath, claims, req.socket.remoteAddress ?? '', undefined);
+            if (!v.ok) {
+                socket.destroy();
+                return;
+            }
+            if (ctx)
+                ctx.claims = claims;
+            if (ctx && hooks.has('afterAuth')) {
+                await hooks.run('afterAuth', ctx);
+                if (ctx.responded())
+                    return;
+            }
+        }
+        if (route.prependPrefix) {
+            const u = req.url ?? '/';
+            const pp = route.prependPrefix;
+            if (u !== pp && !u.startsWith(pp + '/'))
+                req.url = pp + u;
+        } // segment-boundary
+        if (ctx && hooks.has('onUpgrade')) {
+            await hooks.run('onUpgrade', ctx);
+            if (ctx.responded())
+                return;
+        }
+        const pinned = (0, edge_1.hdr)(req.headers[rt.versionHeader]);
+        const up = await upstream.resolveUpstream(route, undefined, pinned);
+        if (!up || !('url' in up)) {
+            socket.destroy();
+            return;
+        }
+        const u = new URL(up.url);
+        const upstreamSock = net.connect(Number(u.port) || (u.protocol === 'https:' ? 443 : 80), u.hostname, () => {
+            // rebuild the upgrade request from rawHeaders (verbatim), minus the trust headers we own (incl.
+            // client identity) + the client's hop-by-hop control (so a `Connection: x-internal-token` can't
+            // strip the gateway's injected headers downstream), plus the validated caller + token + identity.
+            const strip = new Set(['x-internal-token', 'x-api-key-id', 'x-api-key', 'x-user-id', 'x-tenant-id', 'x-user-roles', 'x-user-permissions', 'connection', 'proxy-connection', 'keep-alive']);
+            const lines = [`${req.method} ${req.url} HTTP/1.1`, 'Connection: Upgrade']; // gateway-owned, clean upgrade
+            for (let i = 0; i < req.rawHeaders.length; i += 2) {
+                const k = req.rawHeaders[i];
+                if (!strip.has(k.toLowerCase()))
+                    lines.push(`${k}: ${req.rawHeaders[i + 1]}`);
+            }
+            if (caller)
+                lines.push(`x-api-key-id: ${caller}`);
+            const token = rt.opts.serviceKeys?.[route.service];
+            if (token)
+                lines.push(`x-internal-token: ${token}`);
+            if (claims) { // stamp the verified identity (mirrors the HTTP path's stampIdentity)
+                if (claims['sub'])
+                    lines.push(`x-user-id: ${String(claims['sub'])}`);
+                if (claims['tid'])
+                    lines.push(`x-tenant-id: ${String(claims['tid'])}`);
+                const roles = claims['roles'];
+                if (Array.isArray(roles) && roles.length)
+                    lines.push(`x-user-roles: ${roles.map(String).join(',')}`);
+                const perms = claims['perms'];
+                if (Array.isArray(perms) && perms.length)
+                    lines.push(`x-user-permissions: ${perms.map(String).join(',')}`);
+            }
+            upstreamSock.write(lines.join('\r\n') + '\r\n\r\n');
+            if (head?.length)
+                upstreamSock.write(head);
+            socket.pipe(upstreamSock);
+            upstreamSock.pipe(socket);
+        });
+        upstreamSock.on('error', () => socket.destroy());
+        socket.on('error', () => upstreamSock.destroy());
+    };
+    return (req, socket, head) => { void run(req, socket, head); };
+}

package/executors/gateway/prod-runtime/upstream.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Per-request upstream resolution: a direct manifest `upstream`, or a pooled
+ * pod pick (health-steered, version-pinned) with scale-from-zero via the
+ * PodProvider. Shared by the HTTP handler and the WS upgrade.
+ */
+import type { Route, Upstream } from '../manifest';
+import type { GwTrace, ProdGatewayOptions } from './types';
+import type { Observability } from './observability';
+export interface UpstreamLayer {
+    resolveUpstream(route: Route, trace: GwTrace | undefined, pinned?: string): Promise<Upstream | undefined>;
+}
+export declare function createUpstream(opts: ProdGatewayOptions, obs: Observability): UpstreamLayer;
+//# sourceMappingURL=upstream.d.ts.map

package/executors/gateway/prod-runtime/upstream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/prod-runtime/upstream.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,WAAW,aAAa;IAC5B,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;CAC3G;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,aAAa,GAAG,aAAa,CAY1F"}

package/executors/gateway/prod-runtime/upstream.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createUpstream = createUpstream;
+function createUpstream(opts, obs) {
+    const resolveUpstream = async (route, trace, pinned) => {
+        if (route.upstream)
+            return { url: route.upstream };
+        const opt = {
+            ...(pinned ? { version: pinned } : {}),
+            ...(opts.healthChecker ? { isHealthy: (u) => opts.healthChecker.isHealthy(u) } : {}),
+        };
+        let up = opts.pods?.pick(route.service, opt);
+        if (!up && opts.pods?.ensureUp) {
+            obs.step(trace, 'ensure-up', { project: route.service });
+            if (await opts.pods.ensureUp(route.service))
+                up = opts.pods.pick(route.service, opt);
+        }
+        return up;
+    };
+    return { resolveUpstream };
+}

package/executors/gateway/runtime/auth.d.ts

@@ -0,0 +1,8 @@
+import type { AuthVerdict, GatewayRuntime, GwTrace, Route } from './types';
+import type { Observability } from './observability';
+export interface EdgeAuth {
+    internal(req: import('node:http').IncomingMessage, route: Route, trace: GwTrace | undefined): AuthVerdict;
+    public(req: import('node:http').IncomingMessage, route: Route, trace: GwTrace | undefined): AuthVerdict;
+}
+export declare function createEdgeAuth(rt: GatewayRuntime, obs: Observability): EdgeAuth;
+//# sourceMappingURL=auth.d.ts.map

package/executors/gateway/runtime/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/auth.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IAC1G,MAAM,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;CACzG;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,QAAQ,CA8C/E"}

package/executors/gateway/runtime/auth.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createEdgeAuth = createEdgeAuth;
+/**
+ * The edge-auth layer (the JWT seam). Two boundaries, ONE source so the HTTP
+ * handler and the WS upgrade can't drift:
+ *  - `internal(...)`: validate the CALLER's `x-api-key` on an `internal.<host>`
+ *    route, stamp `x-api-key-id` (audit) + `__lensmcpCaller`.
+ *  - `public(...)`: verify the end-user JWT, enforce per-route rules, inject
+ *    trusted identity — mirroring the prod gateway. Only enforced when the
+ *    service declares `cluster.auth` (opt-in; un-migrated services stay open).
+ * Each returns a verdict; the caller turns a denial into its own rejection
+ * (the handler → `finishTrace` + `sendError`; the upgrade → `socket.destroy()`).
+ */
+const manifest_1 = require("../manifest");
+const dev_auth_1 = require("./dev-auth");
+function createEdgeAuth(rt, obs) {
+    const { traceStep } = obs;
+    const internal = (req, _route, trace) => {
+        // service-to-service: validate the CALLER's api key at the boundary
+        const presented = String(req.headers['x-api-key'] ?? '');
+        const caller = rt.keyToProject.get(presented);
+        if (!caller) {
+            traceStep(trace, 'auth', { mode: 'x-api-key', ok: false });
+            return { ok: false, status: 401, reason: 'unauthorized', detail: 'Invalid or missing x-api-key for internal route.' };
+        }
+        req.headers['x-api-key-id'] = caller; // audit + lens attribution
+        req.__lensmcpCaller = caller;
+        delete req.headers['x-api-key'];
+        traceStep(trace, 'auth', { mode: 'x-api-key', ok: true, caller });
+        return { ok: true, caller };
+    };
+    const publicAuth = (req, route, trace) => {
+        const policy = route.auth;
+        if (policy) {
+            const url0 = (req.url ?? '/').split('?')[0];
+            const method = (req.method ?? 'GET').toUpperCase();
+            const resolved = (0, manifest_1.authRuleFor)(policy, url0, method);
+            if (resolved.mode === 'jwt') {
+                const claims = (0, dev_auth_1.verifyDevJwt)(req);
+                if (!claims) {
+                    traceStep(trace, 'auth', { mode: 'jwt', ok: false });
+                    return { ok: false, status: 401, reason: 'unauthorized', detail: 'Unauthorized: invalid or missing token' };
+                }
+                if (resolved.rule && !(0, manifest_1.evalRule)(resolved.rule, (0, dev_auth_1.devAttrs)(req, claims))) {
+                    traceStep(trace, 'authz', { ok: false });
+                    return { ok: false, status: 403, reason: 'forbidden', detail: 'Forbidden: insufficient permission' };
+                }
+                (0, dev_auth_1.stampIdentity)(req, claims);
+                traceStep(trace, 'auth', { mode: 'jwt', ok: true });
+                return { ok: true, claims };
+            }
+            traceStep(trace, 'auth', { mode: resolved.mode });
+            return { ok: true };
+        }
+        traceStep(trace, 'auth', { mode: 'public', unconfigured: true });
+        return { ok: true };
+    };
+    return { internal, public: publicAuth };
+}