@lensmcp/cluster 1.16.3 → 1.16.4

package/executors/gateway/runtime/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAWvC,OAAO,KAAK,EAAE,cAAc,EAAW,MAAM,SAAS,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,cAAc,CAAC;IACnB,GAAG,EAAE,aAAa,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC,eAAe,CA2IrE"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAWvC,OAAO,KAAK,EAAE,cAAc,EAAW,MAAM,SAAS,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,cAAc,CAAC;IACnB,GAAG,EAAE,aAAa,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC,eAAe,CAoJrE"}

package/executors/gateway/runtime/handler.js

@@ -49,6 +49,15 @@ function createHandler(deps) {
             : 'No gateway route for this hostname.');
     };
     const runPipeline = async (req, res) => {
+        // 0. HTTP/2 carries the host in the `:authority` pseudo-header, NOT `host` — the
+        // http2 compat layer exposes it as `req.authority` and omits `host` from `req.headers`.
+        // Every downstream step (route match, trace, CORS) reads `req.headers.host`, so
+        // normalize it here before anything else. No-op for HTTP/1.1 (host is already set).
+        if (!req.headers.host) {
+            const authority = req.authority ?? req.headers[':authority'];
+            if (authority)
+                req.headers.host = authority;
+        }
         // 1. STRIP client-supplied trust headers before anything else: the gateway is
         // the ONLY party allowed to assert `x-internal-token` (came through me) and
         // `x-api-key-id` (validated caller identity). Without this, a keyless/TCP route

package/executors/gateway/runtime/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/proxy.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,KAAK,KAAK,MAAM,MAAM,aAAa,CAAC;AAG3C,OAAO,KAAK,EAAE,cAAc,EAAW,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAqBhD,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC;IACxH,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC;IACnI,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI,GAAG,IAAI,CAAC;IACrG,KAAK,CAAC,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC,KAAK,GAAG,OAAO,YAAY,EAAE,KAAK,CAAC;IACzE,aAAa,IAAI,IAAI,CAAC;IACtB,UAAU,IAAI,IAAI,CAAC;CACpB;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,GAAG,UAAU,CAwItG"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/proxy.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,KAAK,KAAK,MAAM,MAAM,aAAa,CAAC;AAG3C,OAAO,KAAK,EAAE,cAAc,EAAW,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA8BhD,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC;IACxH,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC;IACnI,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI,GAAG,IAAI,CAAC;IACrG,KAAK,CAAC,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC,KAAK,GAAG,OAAO,YAAY,EAAE,KAAK,CAAC;IACzE,aAAa,IAAI,IAAI,CAAC;IACtB,UAAU,IAAI,IAAI,CAAC;CACpB;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,GAAG,UAAU,CA4StG"}

package/executors/gateway/runtime/proxy.js

@@ -27,6 +27,14 @@ function isConnError(err) {
         code === 'ENOENT' ||
         /ECONNREFUSED|ECONNRESET|socket hang up|EPIPE/i.test(err.message));
 }
+/** Hop-by-hop headers (RFC 7230 §6.1) — never forwarded upstream, never copied onto the edge
+ * response. Doubles as the set of connection-specific headers that are ILLEGAL on an HTTP/2 stream
+ * (Node's http2 layer throws on `connection`/`transfer-encoding`/… ), which is why the h2 native
+ * forwarder below must strip them where node-http-proxy (H1-only) never had to. */
+const HOP_BY_HOP = new Set([
+    'connection', 'keep-alive', 'proxy-connection', 'proxy-authenticate', 'proxy-authorization',
+    'te', 'trailer', 'transfer-encoding', 'upgrade',
+]);
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const httpProxy = require('http-proxy');
 function createProxy(rt, obs, svcLayer) {
@@ -58,6 +66,182 @@ function createProxy(rt, obs, svcLayer) {
         delete proxyRes.headers['x-powered-by'];
         proxyRes.headers['server'] = 'LensMCP';
     });
+    // --- native HTTP/2 forwarder ------------------------------------------------
+    // node-http-proxy is HTTP/1.1-only: it copies connection-specific headers onto the
+    // response, which Node's http2 layer rejects. So an h2 EDGE request (a browser, once
+    // the front door speaks h2) is forwarded here with a raw http.request to the H1
+    // upstream (pod unix-socket or TCP dev-server) and the upstream response is piped back
+    // into the h2 stream. It mirrors the node-http-proxy path's branding (x-lensmcp-pod,
+    // drop x-powered-by, server:LensMCP), pod self-heal (evict + wedge timer) and TCP
+    // heal-retry — so h2 and h1 behave identically apart from the wire framing.
+    const pipeUpstream = (target, req, res, cbs) => {
+        const outHeaders = {};
+        for (const [k, v] of Object.entries(req.headers)) {
+            if (v === undefined || k.startsWith(':') || HOP_BY_HOP.has(k))
+                continue; // strip pseudo + hop-by-hop
+            outHeaders[k] = v;
+        }
+        // x-forwarded-* parity with node-http-proxy's xfwd:true.
+        const remote = req.socket?.remoteAddress ?? '';
+        const priorXff = req.headers['x-forwarded-for'];
+        outHeaders['x-forwarded-for'] = priorXff ? `${String(priorXff)}, ${remote}` : remote;
+        outHeaders['x-forwarded-proto'] = 'https';
+        if (!outHeaders['x-forwarded-host'])
+            outHeaders['x-forwarded-host'] = req.headers.host ?? '';
+        let mod = http;
+        let opts;
+        if (typeof target === 'object') {
+            // pod (unix socket): no changeOrigin — the pod ignores Host (matches the h1 path).
+            opts = { socketPath: target.socketPath, path: req.url, method: req.method, headers: outHeaders, agent: httpAgent };
+        }
+        else {
+            const u = new URL(target);
+            const isHttps = u.protocol === 'https:';
+            // eslint-disable-next-line @typescript-eslint/no-require-imports
+            mod = isHttps ? require('node:https') : http;
+            outHeaders['host'] = u.host; // changeOrigin:true parity — a Vite dev server matches on Host
+            opts = {
+                protocol: u.protocol,
+                hostname: u.hostname,
+                port: u.port || (isHttps ? 443 : 80),
+                path: req.url,
+                method: req.method,
+                headers: outHeaders,
+                agent: agentForTarget(target),
+            };
+        }
+        const upstreamReq = mod.request(opts, (upstreamRes) => {
+            cbs.onResponse();
+            if (res.headersSent || res.writableEnded || res.destroyed) {
+                upstreamRes.destroy();
+                return;
+            }
+            const h = {};
+            for (const [k, v] of Object.entries(upstreamRes.headers)) {
+                if (v === undefined || HOP_BY_HOP.has(k))
+                    continue; // hop-by-hop headers are h2-illegal
+                h[k] = v;
+            }
+            delete h['x-powered-by']; // drop the upstream framework leak (parity with proxyRes)
+            h['server'] = 'LensMCP'; // brand the hop
+            const pod = req.__lensmcpPod;
+            if (pod)
+                h['x-lensmcp-pod'] = pod;
+            try {
+                res.writeHead(upstreamRes.statusCode ?? 502, h);
+            }
+            catch (e) {
+                // A header the upstream sent is illegal on an h2 stream (Node throws e.g.
+                // ERR_HTTP2_INVALID_HEADER_VALUE). RESET only THIS stream — left unhandled the throw escapes
+                // the request callback and can tear down the whole h2 SESSION, failing EVERY sibling stream on
+                // the connection at once with ERR_HTTP2_PROTOCOL_ERROR (the "burst of files failed" symptom).
+                console.error('[gateway] h2 relay: bad response header, resetting stream:', e.message);
+                upstreamRes.destroy();
+                if (!res.destroyed)
+                    res.destroy(e);
+                return;
+            }
+            upstreamRes.pipe(res);
+            // The upstream dies MID-BODY (a pod rolling-swap or a Vite restart resets the pooled socket): RST
+            // this h2 stream cleanly instead of leaving it half-written — a dangling h2 stream is what Chrome
+            // reports as ERR_HTTP2_PROTOCOL_ERROR. (Unhandled, 'error' on upstreamRes would also throw.)
+            upstreamRes.on('error', () => { if (!res.writableEnded && !res.destroyed)
+                res.destroy(); });
+            // The client canceled: stop reading the upstream so its pooled keep-alive socket isn't left flowing
+            // (a half-drained socket is corrupt on the next reuse → would break a later request).
+            res.on('close', () => { if (!upstreamRes.destroyed)
+                upstreamRes.destroy(); });
+        });
+        upstreamReq.on('error', (err) => cbs.onError(err));
+        req.on('error', () => upstreamReq.destroy());
+        // GET/HEAD/OPTIONS carry no body — end immediately; else stream the request body upstream.
+        if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS')
+            upstreamReq.end();
+        else
+            req.pipe(upstreamReq);
+    };
+    // The h2 twin of the pool/TCP branches in `forward` below — same pick / cold-start /
+    // evict / wedge / heal-retry, driving `pipeUpstream` instead of node-http-proxy.
+    const forwardNative = async (route, req, res) => {
+        const trace = req.__lensmcpTrace;
+        if (route.pool) {
+            const ctl = route.svc;
+            if (ctl) {
+                ctl.lastUsed = Date.now();
+                ctl.inflight += 1;
+                res.on('close', () => { ctl.inflight -= 1; ctl.lastUsed = Date.now(); });
+            }
+            let sock = (0, discovery_1.pickSock)(route.pool, rt.scanTtlMs);
+            if (!sock && ctl) {
+                traceStep(trace, 'cold-start', { project: route.project });
+                if (await svcLayer.ensureUp(ctl))
+                    sock = (0, discovery_1.pickSock)(route.pool, rt.scanTtlMs);
+            }
+            if (ctl)
+                svcLayer.scaleUp(ctl);
+            if (!sock) {
+                const errs = ctl?.lastErrors?.length ? ` Service errors: ${ctl.lastErrors.join('; ')}` : '';
+                (0, edge_1.sendError)(res, req, 503, 'unavailable', `Service ${route.project} is not reachable (no pods in ${route.pool.dir}).${errs} The watcher recovers and the next request retries automatically.`);
+                return;
+            }
+            const podName = path.basename(sock, '.sock');
+            req.__lensmcpPod = podName;
+            traceStep(trace, 'pod-select', { pod: podName, pods: route.pool.socks.length, strategy: 'round-robin' });
+            let settled = false;
+            const evictPod = (reason) => {
+                route.pool.socks = route.pool.socks.filter((s) => s !== sock);
+                route.pool.idx = -1;
+                try {
+                    fs.unlinkSync(sock);
+                }
+                catch { /* already gone */ }
+                console.error(`[gateway] pod ${podName} of ${route.project}: ${reason}`);
+            };
+            const wedgeTimer = setTimeout(() => {
+                if (settled || res.headersSent || res.writableEnded)
+                    return;
+                settled = true;
+                evictPod(`no response within ${types_1.POD_RESPONSE_TIMEOUT_MS}ms (wedged socket) — evicted + respawning`);
+                (0, edge_1.sendError)(res, req, 502, 'unavailable', `Pod ${podName} of ${route.project} was unresponsive — evicted, retry.`);
+            }, types_1.POD_RESPONSE_TIMEOUT_MS);
+            wedgeTimer.unref?.();
+            res.on('close', () => clearTimeout(wedgeTimer));
+            pipeUpstream({ socketPath: sock }, req, res, {
+                onResponse: () => { clearTimeout(wedgeTimer); settled = true; },
+                onError: (err) => {
+                    clearTimeout(wedgeTimer);
+                    if (settled)
+                        return;
+                    settled = true;
+                    evictPod(err.message);
+                    (0, edge_1.sendError)(res, req, 502, 'unavailable', `Pod ${podName} of ${route.project} unavailable — retry.`);
+                },
+            });
+            return;
+        }
+        const tcpTarget = route.target;
+        const tcpDeadline = Date.now() + types_1.UPSTREAM_HEAL_WINDOW_MS;
+        const tryTcp = () => {
+            pipeUpstream(tcpTarget, req, res, {
+                onResponse: () => { },
+                onError: (err) => {
+                    if (isConnError(err) && Date.now() < tcpDeadline && !res.headersSent && !res.writableEnded) {
+                        setTimeout(tryTcp, types_1.UPSTREAM_HEAL_STEP_MS);
+                        return;
+                    }
+                    // Past the response headers there's nothing to send an error body into — reset the stream.
+                    if (res.headersSent || res.writableEnded || res.destroyed) {
+                        if (!res.destroyed)
+                            res.destroy();
+                        return;
+                    }
+                    console.error(`[gateway] upstream ${route.project} (${String(tcpTarget)}):`, err.message);
+                    (0, edge_1.sendError)(res, req, 502, 'unavailable', `Upstream ${route.project} unavailable.`);
+                },
+            });
+        };
+        tryTcp();
+    };
     const forward = async (route, req, res) => {
         const startedAt = Date.now();
         const trace = req.__lensmcpTrace;
@@ -71,6 +255,13 @@ function createProxy(rt, obs, svcLayer) {
         if (route.prependPrefix && !req.url?.startsWith(route.prependPrefix)) {
             req.url = route.prependPrefix + (req.url ?? '/');
         }
+        // HTTP/2 edge requests (browsers, once the front door speaks h2) can't ride node-http-proxy
+        // — forward them natively. H1 requests (curl, tools, the HMR WebSocket's sibling fetches)
+        // keep the proven path below unchanged.
+        if ((req.httpVersionMajor ?? 1) >= 2) {
+            await forwardNative(route, req, res);
+            return;
+        }
         if (route.pool) {
             const ctl = route.svc;
             if (ctl) {

package/executors/gateway/runtime/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAe,MAAM,SAAS,CAAC;AAEjH,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAmJxB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAe,MAAM,SAAS,CAAC;AAEjH,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAkKxB"}

package/executors/gateway/runtime/server.js

@@ -120,9 +120,21 @@ async function startGateway(options, context) {
     const servers = [];
     const boundPorts = [];
     for (const port of ports) {
+        // HTTP/2 (with allowHTTP1) for the TLS front door. A Vite dev page fetches
+        // HUNDREDS of ESM modules; over HTTP/1.1 the browser's ~6-connection-per-origin
+        // cap serializes that waterfall — each module sits "Stalled" waiting for a
+        // connection slot (measured: ~94% of a module's wall-time is stall, ~6% is the
+        // server), which is what makes dev asset loading feel slow through the gateway.
+        // h2 multiplexes every module over ONE connection + ONE TLS handshake, erasing
+        // both the 6-connection stall and the repeated handshakes. `allowHTTP1: true`
+        // keeps H1 clients working — notably Vite's HMR WebSocket, which browsers open
+        // as an H1 `Upgrade` on a SEPARATE connection (h2 has no Upgrade) and which still
+        // lands on `server.on('upgrade')` below. The forwarder (proxy.ts) branches by
+        // protocol: H1 keeps the proven node-http-proxy path; h2 uses a native forwarder
+        // because node-http-proxy emits connection-specific headers that are illegal in h2.
         const server = pem
             ? // eslint-disable-next-line @typescript-eslint/no-require-imports
-                require('node:https').createServer({ key: pem, cert: pem }, handler)
+                require('node:http2').createSecureServer({ key: pem, cert: pem, allowHTTP1: true }, (req, res) => handler(req, res))
             : http.createServer(handler);
         server.on('upgrade', upgrade);
         server.on('error', (err) => console.error(`[gateway] port ${port}: ${err.code}`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/cluster",
-  "version": "1.16.3",
+  "version": "1.16.4",
   "description": "Run your Nx workspace as a local production cluster: pods on unix sockets with true HMR, one https gateway with per-project domains, scale-from-zero, autoscale, idle-kill, local-CA TLS — observed by the LensMCP lens.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -65,8 +65,8 @@
     }
   },
   "dependencies": {
-    "@lensmcp/node-instrumentation": "1.16.3",
-    "@lensmcp/nx-plugin": "1.16.3",
+    "@lensmcp/node-instrumentation": "1.16.4",
+    "@lensmcp/nx-plugin": "1.16.4",
     "fork-ts-checker-webpack-plugin": "^9.0.0",
     "glob": "^11.0.0",
     "http-proxy": "^1.18.0",