@lensmcp/cluster 1.18.3 → 1.18.6

package/executors/gateway/otel-tracing.js

@@ -1,74 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.setupTracing = setupTracing;
-/**
- * OpenTelemetry tracing for the production gateway — OPT-IN, cloud-neutral.
- *
- * Makes the gateway a first-class span in a distributed trace: it continues the
- * incoming W3C `traceparent`, emits one SERVER span per request, and INJECTS its
- * context into the forwarded headers so the downstream service's spans parent to
- * the gateway hop. Spans export over OTLP/HTTP — point `OTEL_EXPORTER_OTLP_ENDPOINT`
- * at Cloud Trace (GCP), the OTel Collector / X-Ray (AWS), Tempo, Jaeger, etc. The
- * SAME image traces on any cloud; only the endpoint env changes.
- *
- * All OpenTelemetry imports live HERE. The gateway lib takes a `GatewayTracer`
- * (type-only) and calls these helpers, so it never pulls OTel unless tracing is
- * wired — and when no endpoint is set, `setupTracing` returns undefined and the
- * hot path does zero span work.
- *
- * No global context manager (`provider.register()` is intentionally NOT called):
- * context is threaded explicitly via extract/inject, keeping the proxy hot path
- * synchronous and free of async-hooks overhead.
- */
-const api_1 = require("@opentelemetry/api");
-const core_1 = require("@opentelemetry/core");
-const sdk_trace_base_1 = require("@opentelemetry/sdk-trace-base");
-const resources_1 = require("@opentelemetry/resources");
-const exporter_trace_otlp_http_1 = require("@opentelemetry/exporter-trace-otlp-http");
-const firstHeader = (h, k) => {
-    const v = h[k.toLowerCase()];
-    return Array.isArray(v) ? v[0] : v;
-};
-const getter = {
-    keys: (carrier) => Object.keys(carrier),
-    get: (carrier, key) => firstHeader(carrier, key),
-};
-const setter = {
-    set: (carrier, key, value) => { carrier[key.toLowerCase()] = value; },
-};
-/** Build the gateway tracer, or undefined when no OTLP endpoint is configured
- *  (default-off → the lib skips all span work, zero hot-path overhead). */
-function setupTracing(opts = {}) {
-    const endpoint = opts.endpoint ?? process.env['OTEL_EXPORTER_OTLP_ENDPOINT'];
-    if (!endpoint)
-        return undefined;
-    const base = endpoint.replace(/\/+$/, '');
-    const url = /\/v1\/traces$/.test(base) ? base : `${base}/v1/traces`;
-    const exporter = new exporter_trace_otlp_http_1.OTLPTraceExporter({ url, ...(opts.headers ? { headers: opts.headers } : {}) });
-    const provider = new sdk_trace_base_1.BasicTracerProvider({
-        resource: (0, resources_1.resourceFromAttributes)({ 'service.name': opts.serviceName ?? process.env['OTEL_SERVICE_NAME'] ?? 'lensmcp-gateway' }),
-        sampler: new sdk_trace_base_1.ParentBasedSampler({ root: new sdk_trace_base_1.TraceIdRatioBasedSampler(opts.sampleRatio ?? 1) }),
-        // OTel 2.0: span processors are constructor config (the mutating `addSpanProcessor` was removed).
-        spanProcessors: [new sdk_trace_base_1.BatchSpanProcessor(exporter)],
-    });
-    const tracer = provider.getTracer('lensmcp-gateway');
-    const propagator = new core_1.W3CTraceContextPropagator();
-    return {
-        startSpan(req, name, attrs) {
-            const parent = propagator.extract(api_1.ROOT_CONTEXT, req.headers, getter);
-            return tracer.startSpan(name, { kind: api_1.SpanKind.SERVER, attributes: attrs }, parent);
-        },
-        inject(span, headers) {
-            propagator.inject(api_1.trace.setSpan(api_1.ROOT_CONTEXT, span), headers, setter);
-        },
-        end(span, statusCode, attrs) {
-            if (attrs)
-                span.setAttributes(attrs);
-            span.setAttribute('http.response.status_code', statusCode);
-            if (statusCode >= 500 || statusCode === 0)
-                span.setStatus({ code: api_1.SpanStatusCode.ERROR });
-            span.end();
-        },
-        shutdown: () => provider.shutdown(),
-    };
-}
+"use strict";var O=Object.defineProperty;var c=(e,r)=>O(e,"name",{value:r,configurable:!0});var T=Object.defineProperty,o=c((e,r)=>T(e,"name",{value:r,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.setupTracing=setupTracing;const api_1=require("@opentelemetry/api"),core_1=require("@opentelemetry/core"),sdk_trace_base_1=require("@opentelemetry/sdk-trace-base"),resources_1=require("@opentelemetry/resources"),exporter_trace_otlp_http_1=require("@opentelemetry/exporter-trace-otlp-http"),firstHeader=o((e,r)=>{const t=e[r.toLowerCase()];return Array.isArray(t)?t[0]:t},"firstHeader"),getter={keys:o(e=>Object.keys(e),"keys"),get:o((e,r)=>firstHeader(e,r),"get")},setter={set:o((e,r,t)=>{e[r.toLowerCase()]=t},"set")};function setupTracing(e={}){const r=e.endpoint??process.env.OTEL_EXPORTER_OTLP_ENDPOINT;if(!r)return;const t=r.replace(/\/+$/,""),u=/\/v1\/traces$/.test(t)?t:`${t}/v1/traces`,d=new exporter_trace_otlp_http_1.OTLPTraceExporter({url:u,...e.headers?{headers:e.headers}:{}}),p=new sdk_trace_base_1.BasicTracerProvider({resource:(0,resources_1.resourceFromAttributes)({"service.name":e.serviceName??process.env.OTEL_SERVICE_NAME??"lensmcp-gateway"}),sampler:new sdk_trace_base_1.ParentBasedSampler({root:new sdk_trace_base_1.TraceIdRatioBasedSampler(e.sampleRatio??1)}),spanProcessors:[new sdk_trace_base_1.BatchSpanProcessor(d)]}),_=p.getTracer("lensmcp-gateway"),i=new core_1.W3CTraceContextPropagator;return{startSpan(s,a,n){const l=i.extract(api_1.ROOT_CONTEXT,s.headers,getter);return _.startSpan(a,{kind:api_1.SpanKind.SERVER,attributes:n},l)},inject(s,a){i.inject(api_1.trace.setSpan(api_1.ROOT_CONTEXT,s),a,setter)},end(s,a,n){n&&s.setAttributes(n),s.setAttribute("http.response.status_code",a),(a>=500||a===0)&&s.setStatus({code:api_1.SpanStatusCode.ERROR}),s.end()},shutdown:o(()=>p.shutdown(),"shutdown")}}c(setupTracing,"setupTracing"),o(setupTracing,"setupTracing");

package/executors/gateway/prod-gateway.lib.d.ts

@@ -17,4 +17,3 @@
  */
 export { startProdGateway } from './prod-runtime/server';
 export type { ServiceStatus, ProdGatewayOptions, ProdGatewayHandle, ProdGatewayHooks, ProdGatewayPhase, ProdHookHandler, ProdHookContext, } from './prod-runtime/types';
-//# sourceMappingURL=prod-gateway.lib.d.ts.map

package/executors/gateway/prod-gateway.lib.js

@@ -1,22 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.startProdGateway = void 0;
-/**
- * Public facade for the PRODUCTION gateway runtime (Fastify + @fastify/reply-from).
- *
- * The implementation now lives in `./prod-runtime/*` as composable LAYERS,
- * mirroring the dev gateway's `./runtime/*` — see `prod-runtime/server.ts` for the
- * composition root (`startProdGateway`), `prod-runtime/types.ts` for the shared
- * types + the customer **hooks** API, and the sibling modules for each layer
- * (routing, observability, rollout, upstream, auth, cors, trust, handler, upgrade,
- * app, access-log, hooks). This barrel preserves the original module's public
- * surface so the entry (`main.prod-gateway.ts`), the `@lensmcp/cluster` re-export
- * (`gateway.ts`), the e2e suite, and the pentest/perf suites import from one stable
- * path, and additionally exposes the hooks types for customer-authored layers.
- *
- * The same routing brain as dev (shared `matchRoute` / `buildRouteTable` / manifest
- * schema); the HTTP transport differs on purpose (dev: node:http + http-proxy over
- * unix-socket pods; prod: Fastify + reply-from's undici pool for the high-RPS edge).
- */
-var server_1 = require("./prod-runtime/server");
-Object.defineProperty(exports, "startProdGateway", { enumerable: true, get: function () { return server_1.startProdGateway; } });
+"use strict";var s=Object.defineProperty;var o=(r,t)=>s(r,"name",{value:t,configurable:!0});var a=Object.defineProperty,e=o((r,t)=>a(r,"name",{value:t,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.startProdGateway=void 0;var server_1=require("./prod-runtime/server");Object.defineProperty(exports,"startProdGateway",{enumerable:!0,get:e(function(){return server_1.startProdGateway},"get")});

package/executors/gateway/prod-runtime/access-log.d.ts

@@ -6,4 +6,3 @@
 import type { FastifyReply, FastifyRequest } from 'fastify';
 import type { ReqState } from './types';
 export declare const logAccess: (request: FastifyRequest, reply: FastifyReply, st: ReqState | undefined) => void;
-//# sourceMappingURL=access-log.d.ts.map

package/executors/gateway/prod-runtime/access-log.js

@@ -1,24 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.logAccess = void 0;
-const logAccess = (request, reply, st) => {
-    const req = request.raw;
-    const status = reply.statusCode ?? 0;
-    const host = (req.headers.host || '').split(':')[0];
-    const path = (req.url || '/').split('?')[0];
-    const ms = Math.round(reply.elapsedTime);
-    try {
-        console.log(JSON.stringify({
-            severity: status >= 500 ? 'ERROR' : status >= 400 ? 'WARNING' : 'INFO',
-            time: new Date().toISOString(),
-            message: `${req.method} ${host}${path} ${status} ${ms}ms`,
-            method: req.method, host, path, status, ms,
-            ...(st ? { service: st.route.service, upstream: st.upLabel } : {}),
-            ...(st?.version ? { version: st.version } : {}),
-            ...(st?.caller ? { caller: st.caller } : {}),
-            ...(req.headers['x-request-id'] ? { requestId: String(req.headers['x-request-id']) } : {}),
-        }));
-    }
-    catch { /* never let logging break the response */ }
-};
-exports.logAccess = logAccess;
+"use strict";var u=Object.defineProperty;var d=(r,s)=>u(r,"name",{value:s,configurable:!0});var n=Object.defineProperty,l=d((r,s)=>n(r,"name",{value:s,configurable:!0}),"l");Object.defineProperty(exports,"__esModule",{value:!0}),exports.logAccess=void 0;const logAccess=l((r,s,e)=>{const t=r.raw,o=s.statusCode??0,a=(t.headers.host||"").split(":")[0],c=(t.url||"/").split("?")[0],i=Math.round(s.elapsedTime);try{console.log(JSON.stringify({severity:o>=500?"ERROR":o>=400?"WARNING":"INFO",time:new Date().toISOString(),message:`${t.method} ${a}${c} ${o} ${i}ms`,method:t.method,host:a,path:c,status:o,ms:i,...e?{service:e.route.service,upstream:e.upLabel}:{},...e?.version?{version:e.version}:{},...e?.caller?{caller:e.caller}:{},...t.headers["x-request-id"]?{requestId:String(t.headers["x-request-id"])}:{}}))}catch{}},"logAccess");exports.logAccess=logAccess;

package/executors/gateway/prod-runtime/app.d.ts

@@ -20,4 +20,3 @@ export interface AppDeps {
 export declare function createApp(deps: AppDeps): {
     buildApp: () => Promise<FastifyInstance>;
 };
-//# sourceMappingURL=app.d.ts.map

package/executors/gateway/prod-runtime/app.js

@@ -1,123 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createApp = createApp;
-const tslib_1 = require("tslib");
-/**
- * Builds one Fastify app per port (shared route table + providers). Streams
- * every body straight through (never parses/buffers — this is a proxy), wires
- * reply-from's undici pool, the operational probes (/livez /readyz /statusz
- * /metricsz), and the trust / CORS / edge-finish hooks.
- */
-const node_crypto_1 = require("node:crypto");
-const fastify_1 = tslib_1.__importDefault(require("fastify"));
-const reply_from_1 = tslib_1.__importDefault(require("@fastify/reply-from"));
-const edge_1 = require("./edge");
-const trust_1 = require("./trust");
-const access_log_1 = require("./access-log");
-function createApp(deps) {
-    const { rt, obs, cors, hooks, handler, upgrade, reqState, spanByReq, ctxByReq } = deps;
-    const opts = rt.opts;
-    const buildApp = async () => {
-        const keepAlive = opts.server?.keepAliveTimeout ?? 620_000; // > GCP external ALB 600s backend keep-alive
-        const app = (0, fastify_1.default)({
-            logger: false,
-            keepAliveTimeout: keepAlive,
-            requestTimeout: opts.server?.requestTimeout ?? 0, // 0 = no inbound request timeout (long-lived streaming)
-            ...(opts.server?.connectionTimeout !== undefined ? { connectionTimeout: opts.server.connectionTimeout } : {}),
-            ...(opts.trustProxyIp ? { trustProxy: true } : {}),
-            ...(opts.tls ? { https: { key: opts.tls.key, cert: opts.tls.cert } } : {}),
-        });
-        // headersTimeout must stay above keepAliveTimeout, else Node may close an idle
-        // keep-alive socket mid-request under load. Default: just above keepAlive.
-        app.server.headersTimeout = opts.server?.headersTimeout ?? keepAlive + 10_000;
-        // Stream every body straight through — never parse/buffer (this is a proxy).
-        app.removeAllContentTypeParsers();
-        app.addContentTypeParser('*', (_req, payload, done) => done(null, payload));
-        await app.register(reply_from_1.default, {
-            disableRequestLogging: true,
-            undici: {
-                connections: opts.undici?.connections ?? 256,
-                pipelining: opts.undici?.pipelining ?? 1,
-                keepAliveTimeout: opts.undici?.keepAliveTimeout ?? 60_000,
-                bodyTimeout: opts.undici?.bodyTimeout ?? 0, // 0 = unlimited — never cut long-lived SSE / streaming MCP responses
-                headersTimeout: opts.undici?.headersTimeout ?? 60_000, // upstream must send response headers within 60s
-                ...(opts.undici?.allowH2 ? { allowH2: true } : {}), // multiplex many MCP streams over few h2 conns
-                connect: {
-                    rejectUnauthorized: opts.undici?.rejectUnauthorized ?? false, // local-CA/self-signed by default
-                    ...(opts.undici?.cert ? { cert: opts.undici.cert } : {}), // ── mTLS: present a client cert to upstreams ──
-                    ...(opts.undici?.key ? { key: opts.undici.key } : {}),
-                    ...(opts.undici?.ca ? { ca: opts.undici.ca } : {}), // trust a private CA for the server side
-                },
-            },
-        });
-        // Host-agnostic operational probes (answered before routing).
-        app.get('/livez', (_req, reply) => { reply.type('text/plain').send('ok'); });
-        app.get('/readyz', (_req, reply) => {
-            const ready = rt.table.routes.length > 0;
-            reply.code(ready ? 200 : 503).type('text/plain').send(ready ? 'ready' : 'no routes loaded');
-        });
-        // Per-service health rollup (opt-in; token-guarded). Off by default → 404 (don't leak topology).
-        app.get('/statusz', (request, reply) => {
-            // Fail closed: served ONLY when both enabled AND a token is set. Constant-time token compare.
-            if (!opts.statusEndpoint || !opts.statusToken) {
-                reply.code(404).type('text/plain').send('not found');
-                return;
-            }
-            const tok = request.query?.token ?? (0, edge_1.hdr)(request.raw.headers['x-status-token']) ?? '';
-            const a = Buffer.from(tok), b = Buffer.from(opts.statusToken);
-            if (a.length !== b.length || !(0, node_crypto_1.timingSafeEqual)(a, b)) {
-                reply.code(401).type('text/plain').send('unauthorized');
-                return;
-            }
-            reply.type('application/json').send(JSON.stringify({ generatedAt: Date.now(), services: obs.buildStatusSnapshot(), endpoints: opts.healthChecker?.snapshot() ?? [] }));
-        });
-        // Process self-metrics — same token gate as /statusz.
-        app.get('/metricsz', (request, reply) => {
-            if (!opts.metrics || !opts.statusToken) {
-                reply.code(404).type('text/plain').send('not found');
-                return;
-            }
-            const tok = request.query?.token ?? (0, edge_1.hdr)(request.raw.headers['x-status-token']) ?? '';
-            const a = Buffer.from(tok), b = Buffer.from(opts.statusToken);
-            if (a.length !== b.length || !(0, node_crypto_1.timingSafeEqual)(a, b)) {
-                reply.code(401).type('text/plain').send('unauthorized');
-                return;
-            }
-            reply.type('application/json').send(JSON.stringify(opts.metrics.snapshot()));
-        });
-        app.addHook('onRequest', (request, _reply, done) => { (0, trust_1.stripTrust)(request.raw); done(); });
-        // Edge CORS authority: stamp Access-Control-Allow-Origin on EVERY response that lacks it (gateway-generated),
-        // but NEVER bless a proxied upstream success cross-origin (see cors.applyResponseCors).
-        app.addHook('onSend', (request, reply, payload, done) => { cors.applyResponseCors(request, reply); done(null, payload); });
-        app.addHook('onResponse', (request, reply, done) => {
-            const st = reqState.get(request);
-            if (st) {
-                obs.recordEdge(st.route, Date.now() - st.startedAt, reply.statusCode ?? 0, st.caller, st.version);
-                obs.finish(st.trace, st.route.service, reply.statusCode ?? 0, { upstream: st.upLabel, ...(st.version ? { version: st.version } : {}), ...(st.caller ? { caller: st.caller } : {}) });
-                reqState.delete(request);
-            }
-            const sp = spanByReq.get(request);
-            if (sp) {
-                opts.tracing.end(sp, reply.statusCode ?? 0, { ...(st?.upLabel ? { 'upstream.url': st.upLabel } : {}), ...(st?.version ? { 'lensmcp.version': st.version } : {}) });
-                spanByReq.delete(request);
-            }
-            opts.metrics?.recordRequest(reply.statusCode ?? 0);
-            if (rt.accessLog)
-                (0, access_log_1.logAccess)(request, reply, st);
-            // Customer onResponse (terminal phase — observes the finished response).
-            const ctx = ctxByReq.get(request);
-            if (ctx) {
-                ctx.status = reply.statusCode ?? 0;
-                if (hooks.has('onResponse'))
-                    void hooks.run('onResponse', ctx);
-                ctxByReq.delete(request);
-            }
-            done();
-        });
-        app.all('/', handler);
-        app.all('/*', handler);
-        app.server.on('upgrade', upgrade);
-        return app;
-    };
-    return { buildApp };
-}
+"use strict";var q=Object.defineProperty;var p=(a,u)=>q(a,"name",{value:u,configurable:!0});var _=Object.defineProperty,l=p((a,u)=>_(a,"name",{value:u,configurable:!0}),"l");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createApp=createApp;const tslib_1=require("tslib"),node_crypto_1=require("node:crypto"),fastify_1=tslib_1.__importDefault(require("fastify")),reply_from_1=tslib_1.__importDefault(require("@fastify/reply-from")),edge_1=require("./edge"),trust_1=require("./trust"),access_log_1=require("./access-log");function createApp(a){const{rt:u,obs:c,cors:k,hooks:f,handler:y,upgrade:T,reqState:g,spanByReq:m,ctxByReq:h}=a,e=u.opts;return{buildApp:l(async()=>{const v=e.server?.keepAliveTimeout??62e4,n=(0,fastify_1.default)({logger:!1,keepAliveTimeout:v,requestTimeout:e.server?.requestTimeout??0,...e.server?.connectionTimeout!==void 0?{connectionTimeout:e.server.connectionTimeout}:{},...e.trustProxyIp?{trustProxy:!0}:{},...e.tls?{https:{key:e.tls.key,cert:e.tls.cert}}:{}});return n.server.headersTimeout=e.server?.headersTimeout??v+1e4,n.removeAllContentTypeParsers(),n.addContentTypeParser("*",(s,r,o)=>o(null,r)),await n.register(reply_from_1.default,{disableRequestLogging:!0,undici:{connections:e.undici?.connections??256,pipelining:e.undici?.pipelining??1,keepAliveTimeout:e.undici?.keepAliveTimeout??6e4,bodyTimeout:e.undici?.bodyTimeout??0,headersTimeout:e.undici?.headersTimeout??6e4,...e.undici?.allowH2?{allowH2:!0}:{},connect:{rejectUnauthorized:e.undici?.rejectUnauthorized??!1,...e.undici?.cert?{cert:e.undici.cert}:{},...e.undici?.key?{key:e.undici.key}:{},...e.undici?.ca?{ca:e.undici.ca}:{}}}}),n.get("/livez",(s,r)=>{r.type("text/plain").send("ok")}),n.get("/readyz",(s,r)=>{const o=u.table.routes.length>0;r.code(o?200:503).type("text/plain").send(o?"ready":"no routes loaded")}),n.get("/statusz",(s,r)=>{if(!e.statusEndpoint||!e.statusToken){r.code(404).type("text/plain").send("not found");return}const o=s.query?.token??(0,edge_1.hdr)(s.raw.headers["x-status-token"])??"",t=Buffer.from(o),i=Buffer.from(e.statusToken);if(t.length!==i.length||!(0,node_crypto_1.timingSafeEqual)(t,i)){r.code(401).type("text/plain").send("unauthorized");return}r.type("application/json").send(JSON.stringify({generatedAt:Date.now(),services:c.buildStatusSnapshot(),endpoints:e.healthChecker?.snapshot()??[]}))}),n.get("/metricsz",(s,r)=>{if(!e.metrics||!e.statusToken){r.code(404).type("text/plain").send("not found");return}const o=s.query?.token??(0,edge_1.hdr)(s.raw.headers["x-status-token"])??"",t=Buffer.from(o),i=Buffer.from(e.statusToken);if(t.length!==i.length||!(0,node_crypto_1.timingSafeEqual)(t,i)){r.code(401).type("text/plain").send("unauthorized");return}r.type("application/json").send(JSON.stringify(e.metrics.snapshot()))}),n.addHook("onRequest",(s,r,o)=>{(0,trust_1.stripTrust)(s.raw),o()}),n.addHook("onSend",(s,r,o,t)=>{k.applyResponseCors(s,r),t(null,o)}),n.addHook("onResponse",(s,r,o)=>{const t=g.get(s);t&&(c.recordEdge(t.route,Date.now()-t.startedAt,r.statusCode??0,t.caller,t.version),c.finish(t.trace,t.route.service,r.statusCode??0,{upstream:t.upLabel,...t.version?{version:t.version}:{},...t.caller?{caller:t.caller}:{}}),g.delete(s));const i=m.get(s);i&&(e.tracing.end(i,r.statusCode??0,{...t?.upLabel?{"upstream.url":t.upLabel}:{},...t?.version?{"lensmcp.version":t.version}:{}}),m.delete(s)),e.metrics?.recordRequest(r.statusCode??0),u.accessLog&&(0,access_log_1.logAccess)(s,r,t);const d=h.get(s);d&&(d.status=r.statusCode??0,f.has("onResponse")&&f.run("onResponse",d),h.delete(s)),o()}),n.all("/",y),n.all("/*",y),n.server.on("upgrade",T),n},"buildApp")}}p(createApp,"createApp"),l(createApp,"createApp");

package/executors/gateway/prod-runtime/auth.d.ts

@@ -27,4 +27,3 @@ export interface EdgeAuth {
     public(req: http.IncomingMessage, route: Route, cpath: string, claims: Record<string, unknown> | undefined, fallbackIp: string, trace: GwTrace | undefined): AuthVerdict;
 }
 export declare function createEdgeAuth(rt: ProdRuntime, obs: Observability, rollout: RolloutLayer, authenticate: (mode: AuthMode, req: http.IncomingMessage) => void): EdgeAuth;
-//# sourceMappingURL=auth.d.ts.map

package/executors/gateway/prod-runtime/auth.js

@@ -1,51 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createEdgeAuth = createEdgeAuth;
-const manifest_1 = require("../manifest");
-const trust_1 = require("./trust");
-function createEdgeAuth(rt, obs, rollout, authenticate) {
-    const internal = (req, _route, trace) => {
-        const caller = rt.keyToProject.get(String(req.headers['x-api-key'] ?? ''));
-        if (!caller) {
-            obs.step(trace, 'auth', { mode: 'x-api-key', ok: false });
-            return { ok: false, status: 401, reason: 'unauthorized', detail: 'Invalid or missing x-api-key for internal route.' };
-        }
-        req.headers['x-api-key-id'] = caller;
-        delete req.headers['x-api-key'];
-        obs.step(trace, 'auth', { mode: 'x-api-key', ok: true, caller });
-        return { ok: true, caller };
-    };
-    const publicAuth = (req, route, cpath, claims, fallbackIp, trace) => {
-        const m = rt.table.manifestByService.get(route.service);
-        const resolved = m ? (0, manifest_1.authRuleForPath)(m, cpath, req.method ?? 'GET', false) : { mode: route.auth };
-        if (resolved.mode === 'jwt') {
-            if (rt.opts.identify) {
-                if (!claims) {
-                    obs.step(trace, 'auth', { mode: 'jwt', ok: false });
-                    return { ok: false, status: 401, reason: 'unauthorized', detail: 'Unauthorized: invalid or missing token' };
-                }
-            }
-            else {
-                try {
-                    authenticate('jwt', req);
-                }
-                catch (e) {
-                    obs.step(trace, 'auth', { mode: 'jwt', ok: false });
-                    return { ok: false, status: 401, reason: 'unauthorized', detail: `Unauthorized: ${e.message}` };
-                }
-            }
-            // edge ABAC: a present rule MUST be satisfied by VERIFIED claims. No claims (no verifier) → DENY (fail closed).
-            if (resolved.rule && (!claims || !(0, manifest_1.evalRule)(resolved.rule, rollout.buildAttrs(req, fallbackIp, claims, undefined)))) {
-                obs.step(trace, 'authz', { ok: false });
-                return { ok: false, status: 403, reason: 'forbidden', detail: 'Forbidden: insufficient permission' };
-            }
-            obs.step(trace, 'auth', { mode: 'jwt', ok: true });
-            if (claims)
-                (0, trust_1.stampIdentity)(req, claims);
-            return { ok: true };
-        }
-        obs.step(trace, 'auth', { mode: resolved.mode });
-        return { ok: true };
-    };
-    return { internal, public: publicAuth };
-}
+"use strict";var f=Object.defineProperty;var d=(a,e)=>f(a,"name",{value:e,configurable:!0});var k=Object.defineProperty,n=d((a,e)=>k(a,"name",{value:e,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createEdgeAuth=createEdgeAuth;const manifest_1=require("../manifest"),trust_1=require("./trust");function createEdgeAuth(a,e,h,p){return{internal:n((r,u,i)=>{const t=a.keyToProject.get(String(r.headers["x-api-key"]??""));return t?(r.headers["x-api-key-id"]=t,delete r.headers["x-api-key"],e.step(i,"auth",{mode:"x-api-key",ok:!0,caller:t}),{ok:!0,caller:t}):(e.step(i,"auth",{mode:"x-api-key",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Invalid or missing x-api-key for internal route."})},"internal"),public:n((r,u,i,t,c,o)=>{const l=a.table.manifestByService.get(u.service),s=l?(0,manifest_1.authRuleForPath)(l,i,r.method??"GET",!1):{mode:u.auth};if(s.mode==="jwt"){if(a.opts.identify){if(!t)return e.step(o,"auth",{mode:"jwt",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: invalid or missing token"}}else try{p("jwt",r)}catch(m){return e.step(o,"auth",{mode:"jwt",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:`Unauthorized: ${m.message}`}}return s.rule&&(!t||!(0,manifest_1.evalRule)(s.rule,h.buildAttrs(r,c,t,void 0)))?(e.step(o,"authz",{ok:!1}),{ok:!1,status:403,reason:"forbidden",detail:"Forbidden: insufficient permission"}):(e.step(o,"auth",{mode:"jwt",ok:!0}),t&&(0,trust_1.stampIdentity)(r,t),{ok:!0})}return e.step(o,"auth",{mode:s.mode}),{ok:!0}},"publicAuth")}}d(createEdgeAuth,"createEdgeAuth"),n(createEdgeAuth,"createEdgeAuth");

package/executors/gateway/prod-runtime/cors.d.ts

@@ -16,4 +16,3 @@ export interface CorsLayer {
     applyResponseCors(request: FastifyRequest, reply: FastifyReply): void;
 }
 export declare function createCors(rt: ProdRuntime, reqState: WeakMap<FastifyRequest, ReqState>): CorsLayer;
-//# sourceMappingURL=cors.d.ts.map

package/executors/gateway/prod-runtime/cors.js

@@ -1,40 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createCors = createCors;
-function createCors(rt, reqState) {
-    const setCors = (reply, req) => {
-        const origin = req.headers.origin;
-        // Credentialed allowlist: echo the EXACT origin + allow credentials (cookies). NEVER `*` with
-        // credentials (forbidden by the Fetch spec; a cross-site read hole).
-        if (origin && rt.corsCredentialOrigins.has(origin.toLowerCase())) {
-            reply.header('access-control-allow-origin', origin);
-            reply.header('access-control-allow-credentials', 'true');
-            reply.header('vary', 'Origin');
-            return;
-        }
-        // Otherwise — UNAUTHENTICATED gateway responses (404 / health / discovery / preflight):
-        // reflect the Origin for convenience but DO NOT allow credentials.
-        reply.header('access-control-allow-origin', String(origin ?? '*'));
-        reply.header('vary', 'Origin');
-    };
-    const applyResponseCors = (request, reply) => {
-        const origin = request.headers.origin;
-        if (origin && !reply.getHeader('access-control-allow-origin')) {
-            // Credentialed allowlist: EXACT origin + ACAC:true so a credentialed first-party app can read a
-            // cookie-setting routed response AND a gateway-generated 401/403/5xx passes the browser CORS check.
-            if (rt.corsCredentialOrigins.has(origin.toLowerCase())) {
-                reply.header('access-control-allow-origin', origin);
-                reply.header('access-control-allow-credentials', 'true');
-                reply.header('vary', 'Origin');
-            }
-            else if (!reqState.get(request)?.proxied) {
-                // A non-allowlisted origin is reflected ONLY on a gateway-GENERATED reply (error / no-route),
-                // NEVER on a successful PROXIED upstream response — that would be a blanket cross-origin read
-                // of app data (CWE-942). The upstream owns CORS on its own responses.
-                reply.header('access-control-allow-origin', String(origin));
-                reply.header('vary', 'Origin');
-            }
-        }
-    };
-    return { setCors, applyResponseCors };
-}
+"use strict";var c=Object.defineProperty;var t=(s,i)=>c(s,"name",{value:i,configurable:!0});var n=Object.defineProperty,a=t((s,i)=>n(s,"name",{value:i,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createCors=createCors;function createCors(s,i){return{setCors:a((r,o)=>{const e=o.headers.origin;if(e&&s.corsCredentialOrigins.has(e.toLowerCase())){r.header("access-control-allow-origin",e),r.header("access-control-allow-credentials","true"),r.header("vary","Origin");return}r.header("access-control-allow-origin",String(e??"*")),r.header("vary","Origin")},"setCors"),applyResponseCors:a((r,o)=>{const e=r.headers.origin;e&&!o.getHeader("access-control-allow-origin")&&(s.corsCredentialOrigins.has(e.toLowerCase())?(o.header("access-control-allow-origin",e),o.header("access-control-allow-credentials","true"),o.header("vary","Origin")):i.get(r)?.proxied||(o.header("access-control-allow-origin",String(e)),o.header("vary","Origin")))},"applyResponseCors")}}t(createCors,"createCors"),a(createCors,"createCors");

package/executors/gateway/prod-runtime/edge.d.ts

@@ -13,4 +13,3 @@ export declare const sendError: (reply: ReplyLike, req: http.IncomingMessage, st
 export declare const ENCODED_STRUCTURE: RegExp;
 /** Canonical path for auth matching, or undefined if the path is unsafe (→ 400 / drop). */
 export declare const canonicalPath: (rawUrl: string) => string | undefined;
-//# sourceMappingURL=edge.d.ts.map

package/executors/gateway/prod-runtime/edge.js

@@ -1,65 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.canonicalPath = exports.ENCODED_STRUCTURE = exports.sendError = exports.hdr = exports.eid = void 0;
-/**
- * Edge primitives for the prod gateway: id/header helpers, the localized JSON
- * error envelope, and the path-canonicalization guard. Pure (no runtime state).
- */
-const node_crypto_1 = require("node:crypto");
-const gateway_errors_1 = require("../gateway-errors");
-const eid = () => Date.now().toString(36) + (0, node_crypto_1.randomBytes)(6).toString('hex');
-exports.eid = eid;
-const hdr = (v) => typeof v === 'string' && v !== '' ? v : Array.isArray(v) ? v[0] : undefined;
-exports.hdr = hdr;
-/**
- * Send a gateway-generated edge error as the JSON envelope `{ key, status, traceId, message? }` (NOT
- * `text/plain`), stamping `x-request-id` so the trace id is on the response. The SAME `{ key, status }`
- * localized contract a service returns, so a browser app renders `t(key)` and surfaces the trace id.
- * `detail` is the dev-facing hint (the old plain-text reason), never shown to end users.
- */
-const sendError = (reply, req, status, reason, detail) => {
-    const traceId = (0, gateway_errors_1.ensureRequestId)(req);
-    return reply
-        .code(status)
-        .header('x-request-id', traceId)
-        .type(gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE)
-        .send((0, gateway_errors_1.gatewayErrorBody)(status, reason, traceId, detail));
-};
-exports.sendError = sendError;
-// Path-canonicalization guard (CWE-288): a reverse proxy and its backend must agree
-// on the request path, or auth gets evaluated against a DIFFERENT path than the one
-// served (AWS API Gateway trailing-slash bypass, IBM API Connect CVE-2025-13915,
-// Kong/Envoy/NGINX normalization mismatch). We REJECT structurally-encoded paths
-// (encoded dot/slash/backslash/null) outright, and return the DECODED path for auth
-// matching so `/%61dmin` is matched as `/admin` — never skipped because it's encoded.
-exports.ENCODED_STRUCTURE = /%2e|%2f|%5c|%00|\\/i; // encoded . / \ NUL, or a raw backslash
-const NEEDS_NORMALIZE = /[%;#\\]/; // percent-encoding, matrix param, fragment, or backslash
-const TRAVERSAL = /(^|\/)\.\.(?=\/|$)/; // a `..` path segment
-/** Canonical path for auth matching, or undefined if the path is unsafe (→ 400 / drop). */
-const canonicalPath = (rawUrl) => {
-    const q = rawUrl.indexOf('?');
-    const p = q === -1 ? rawUrl : rawUrl.slice(0, q);
-    if (p.indexOf('\0') !== -1)
-        return undefined; // raw NUL is never a valid path (mirrors the decoded-NUL reject)
-    // FAST PATH (the overwhelming majority of production traffic): a clean path — no percent-encoding,
-    // matrix params, fragment, or backslash — needs no decoding or normalization (it already equals what
-    // the backend resolves). Only the `..` traversal check remains. Saves a decodeURIComponent + two regex
-    // + a split/map/join on every request.
-    if (!NEEDS_NORMALIZE.test(p))
-        return TRAVERSAL.test(p) ? undefined : (p || '/');
-    // SLOW PATH: structurally-encoded → reject outright; else decode + strip matrix/fragment so
-    // /admin;x=1 and /admin#.css can't skip the /admin policy (CWE-288), and /%61dmin matches /admin.
-    if (exports.ENCODED_STRUCTURE.test(p))
-        return undefined;
-    let decoded;
-    try {
-        decoded = decodeURIComponent(p);
-    }
-    catch {
-        return undefined;
-    } // malformed %xx
-    if (decoded.includes('\0') || TRAVERSAL.test(decoded))
-        return undefined; // NUL or `..` traversal
-    return decoded.split('#')[0].split('/').map((s) => s.split(';')[0]).join('/') || '/';
-};
-exports.canonicalPath = canonicalPath;
+"use strict";var c=Object.defineProperty;var a=(r,t)=>c(r,"name",{value:t,configurable:!0});var i=Object.defineProperty,o=a((r,t)=>i(r,"name",{value:t,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.canonicalPath=exports.ENCODED_STRUCTURE=exports.sendError=exports.hdr=exports.eid=void 0;const node_crypto_1=require("node:crypto"),gateway_errors_1=require("../gateway-errors"),eid=o(()=>Date.now().toString(36)+(0,node_crypto_1.randomBytes)(6).toString("hex"),"eid");exports.eid=eid;const hdr=o(r=>typeof r=="string"&&r!==""?r:Array.isArray(r)?r[0]:void 0,"hdr");exports.hdr=hdr;const sendError=o((r,t,e,n,s)=>{const d=(0,gateway_errors_1.ensureRequestId)(t);return r.code(e).header("x-request-id",d).type(gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE).send((0,gateway_errors_1.gatewayErrorBody)(e,n,d,s))},"sendError");exports.sendError=sendError,exports.ENCODED_STRUCTURE=/%2e|%2f|%5c|%00|\\/i;const NEEDS_NORMALIZE=/[%;#\\]/,TRAVERSAL=/(^|\/)\.\.(?=\/|$)/,canonicalPath=o(r=>{const t=r.indexOf("?"),e=t===-1?r:r.slice(0,t);if(e.indexOf("\0")!==-1)return;if(!NEEDS_NORMALIZE.test(e))return TRAVERSAL.test(e)?void 0:e||"/";if(exports.ENCODED_STRUCTURE.test(e))return;let n;try{n=decodeURIComponent(e)}catch{return}if(!(n.includes("\0")||TRAVERSAL.test(n)))return n.split("#")[0].split("/").map(s=>s.split(";")[0]).join("/")||"/"},"canonicalPath");exports.canonicalPath=canonicalPath;

package/executors/gateway/prod-runtime/handler.d.ts

@@ -29,4 +29,3 @@ export interface HandlerDeps {
     ctxByReq: WeakMap<FastifyRequest, ProdHookContext>;
 }
 export declare function createHandler(deps: HandlerDeps): (request: FastifyRequest, reply: FastifyReply) => Promise<unknown>;
-//# sourceMappingURL=handler.d.ts.map