@lensmcp/cluster 1.18.3 → 1.18.6

package/executors/gateway/prod-runtime/handler.js

@@ -1,226 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createHandler = createHandler;
-const manifest_1 = require("../manifest");
-const gateway_errors_1 = require("../gateway-errors");
-const edge_1 = require("./edge");
-function createHandler(deps) {
-    const { rt, obs, cors, auth, upstream, rollout, hooks, reqState, spanByReq, ctxByReq } = deps;
-    // Resolved ONCE: is there any reason to run the per-request version-selection block at all? A plain
-    // route-and-forward gateway (no rollout / cookie / sticky bucketing) skips resolveStickyKey + buildAttrs
-    // entirely. `rolloutOn` further gates the (more expensive) ABAC attribute bag to ABAC-targeted services.
-    const rolloutOn = !!rt.opts.pods?.resolveVersion; // ABAC version targeting
-    const cookieOn = !!rt.opts.cookie; // device-cookie minting
-    const stickyOn = !!rt.opts.pods?.bucket && (cookieOn || !!rt.opts.uidHeader); // sticky weighted bucketing
-    const versionSelectionOn = rolloutOn || cookieOn || stickyOn;
-    const handleNoRoute = (request, reply, host, url) => {
-        const req = request.raw;
-        cors.setCors(reply, req);
-        if (req.method === 'OPTIONS') {
-            reply.code(204)
-                .header('access-control-allow-methods', 'GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS')
-                .header('access-control-allow-headers', String(req.headers['access-control-request-headers'] ?? '*'))
-                .send();
-            return;
-        }
-        const mounted = rt.table.routes.filter((r) => r.host && (0, manifest_1.hostMatches)(r.host, host) && r.prefix);
-        const p = url.split('?')[0];
-        if (mounted.length > 0 && (p === '/health' || p === '/healthz')) {
-            reply.code(200).type('application/json').send(JSON.stringify({ status: 'ok', host, services: mounted.map((r) => ({ service: r.service, prefix: r.prefix })) }));
-            return;
-        }
-        if (p === '/.well-known/lensmcp-routes') {
-            reply.code(200).type('application/json').send(JSON.stringify({ host, routes: rt.table.routes.filter((r) => !r.host || (0, manifest_1.hostMatches)(r.host, host)).map((r) => ({ host: r.host ?? '(default)', service: r.service, prefix: r.prefix, internal: !!r.internal, auth: r.auth })) }));
-            return;
-        }
-        (0, edge_1.sendError)(reply, req, 404, 'not_found', mounted.length > 0 ? `No service mounted at ${url} on ${host}.` : 'No gateway route for this hostname.');
-    };
-    return async (request, reply) => {
-        const req = request.raw;
-        const host = (req.headers.host || '').split(':')[0];
-        const url = req.url ?? '/';
-        const trace = obs.beginTrace(req);
-        // Mint a trace id for EVERY request: forwarded to the upstream (adopted as its traceId) and returned.
-        (0, gateway_errors_1.ensureRequestId)(req);
-        obs.step(trace, 'received', { host, method: req.method, url });
-        // Hook context: built ONLY when hooks are configured (otherwise undefined → zero overhead).
-        const ctx = hooks.any ? hooks.httpContext(req, request, reply, trace) : undefined;
-        if (ctx)
-            ctxByReq.set(request, ctx);
-        if (ctx && hooks.has('onRequest')) {
-            await hooks.run('onRequest', ctx);
-            if (ctx.responded())
-                return reply;
-        }
-        // Reject HTTP/0.9 — a header-less simple request has no Host, defeating host-keyed routing/policy.
-        if (req.httpVersionMajor < 1) {
-            obs.finish(trace, 'gateway', 400);
-            return (0, edge_1.sendError)(reply, req, 400, 'bad_request', 'Bad Request');
-        }
-        // Reject path-canonicalization attacks BEFORE routing/auth (proxy↔backend mismatch).
-        const cpath = (0, edge_1.canonicalPath)(url);
-        if (cpath === undefined) {
-            obs.step(trace, 'bad-path', {});
-            obs.finish(trace, 'gateway', 400);
-            return (0, edge_1.sendError)(reply, req, 400, 'bad_request', 'Bad Request');
-        }
-        // Rate limit (opt-in) BEFORE routing/auth, per real client IP — defense-in-depth.
-        if (rt.opts.rateLimiter) {
-            const d = await rt.opts.rateLimiter.check(rollout.clientIpOf(req, req.socket?.remoteAddress ?? request.ip));
-            if (!d.allowed) {
-                reply.header('retry-after', String(Math.ceil(d.retryAfterMs / 1000)));
-                obs.step(trace, 'rate-limited', {});
-                obs.finish(trace, 'gateway', 429);
-                return (0, edge_1.sendError)(reply, req, 429, 'rate_limited', 'Too Many Requests');
-            }
-        }
-        const route = (0, manifest_1.matchRoute)(rt.table.routes, host, url);
-        if (!route) {
-            handleNoRoute(request, reply, host, url);
-            return reply;
-        }
-        if (ctx)
-            ctx.route = route;
-        obs.step(trace, 'route-match', { project: route.service, ...(route.prefix ? { prefix: route.prefix } : {}), ...(route.internal ? { internal: true } : {}) });
-        // CORS preflight on a ROUTED path: answer it HERE, BEFORE edge auth (preflight carries no token).
-        if (req.method === 'OPTIONS') {
-            cors.setCors(reply, req);
-            reply.code(204)
-                .header('access-control-allow-methods', 'GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS')
-                .header('access-control-allow-headers', String(req.headers['access-control-request-headers'] ?? '*'))
-                .send();
-            return reply;
-        }
-        // OTel SERVER span (opt-in): continues the incoming traceparent. Ended in onResponse on ANY exit path.
-        const span = rt.opts.tracing?.startSpan(req, `gateway ${route.service}`, {
-            'http.request.method': (req.method ?? 'GET'),
-            'url.path': url.split('?')[0],
-            'server.address': host,
-            'lensmcp.service': route.service,
-            ...(route.internal ? { 'lensmcp.internal': true } : {}),
-        });
-        if (span)
-            spanByReq.set(request, span);
-        if (ctx && hooks.has('beforeAuth')) {
-            await hooks.run('beforeAuth', ctx);
-            if (ctx.responded())
-                return reply;
-        }
-        // Verify the end-user JWT ONCE (when a verifier is configured) — reused for edge auth + rollout targeting.
-        const claims = route.internal ? undefined : rt.opts.identify?.(req);
-        let caller;
-        if (route.internal) {
-            const v = auth.internal(req, route, trace);
-            if (!v.ok) {
-                obs.finish(trace, route.service, v.status);
-                return (0, edge_1.sendError)(reply, req, v.status, v.reason, v.detail);
-            }
-            caller = v.caller;
-            if (ctx)
-                ctx.caller = caller;
-        }
-        else {
-            const v = auth.public(req, route, cpath, claims, request.ip, trace);
-            if (!v.ok) {
-                obs.finish(trace, route.service, v.status);
-                return (0, edge_1.sendError)(reply, req, v.status, v.reason, v.detail);
-            }
-            if (ctx)
-                ctx.claims = claims;
-            // afterAuth (customer hooks) — public branch ONLY (mirrors dev; internal east-west has no middleware).
-            if (ctx && hooks.has('afterAuth')) {
-                await hooks.run('afterAuth', ctx);
-                if (ctx.responded())
-                    return reply;
-            }
-        }
-        if (rt.opts.serviceKeys?.[route.service])
-            req.headers['x-internal-token'] = rt.opts.serviceKeys[route.service];
-        if (route.prependPrefix) {
-            const u = req.url ?? '/';
-            const pp = route.prependPrefix;
-            if (u !== pp && !u.startsWith(pp + '/'))
-                req.url = pp + u;
-        } // segment-boundary, not bare startsWith
-        // ── version selection: explicit pin → ABAC rule → sticky-key weighted → SWRR ──
-        // Skipped entirely for a plain route-and-forward gateway (no rollout/cookie/sticky) — the common
-        // hot path avoids resolveStickyKey + buildAttrs. buildAttrs only runs when ABAC targeting is wired.
-        const explicit = (0, edge_1.hdr)(req.headers[rt.versionHeader]);
-        let pinned = explicit;
-        let mintKey; // set → append Set-Cookie on the response
-        if (versionSelectionOn && !route.internal && !explicit) {
-            const sk = rollout.resolveStickyKey(req);
-            if (sk.mint)
-                mintKey = sk.key;
-            const targeted = rolloutOn ? rt.opts.pods.resolveVersion(route.service, rollout.buildAttrs(req, request.ip, claims, sk.key)) : undefined;
-            if (targeted) {
-                pinned = targeted.version;
-                obs.step(trace, 'targeting', { rule: targeted.rule, version: targeted.version });
-            }
-            else if (sk.key) {
-                const b = rt.opts.pods?.bucket?.(route.service, sk.key);
-                if (b) {
-                    pinned = b.version;
-                    obs.step(trace, 'targeting', { mode: 'sticky', version: b.version });
-                }
-            }
-        }
-        const up = await upstream.resolveUpstream(route, trace, pinned);
-        if (!up) {
-            obs.finish(trace, route.service, 503);
-            return (0, edge_1.sendError)(reply, req, 503, 'unavailable', `Service ${route.service} has no available upstream.`);
-        }
-        if (!('url' in up)) {
-            obs.finish(trace, route.service, 502);
-            return (0, edge_1.sendError)(reply, req, 502, 'unavailable', `Service ${route.service}: socket upstreams are not supported by the prod gateway.`);
-        }
-        const originUrl = new URL(up.url).origin;
-        const upLabel = up.url;
-        const st = { route, caller, startedAt: Date.now(), trace, version: up.version, upLabel };
-        reqState.set(request, st);
-        if (ctx)
-            ctx.version = up.version;
-        obs.step(trace, up.version ? 'rollout' : 'upstream', { upstream: upLabel, ...(up.version ? { version: up.version, ...(explicit ? { pinned: true } : {}) } : {}) });
-        // Propagate the gateway span's context downstream (W3C traceparent on the forwarded request).
-        if (span)
-            rt.opts.tracing.inject(span, req.headers);
-        if (ctx && hooks.has('beforeForward')) {
-            await hooks.run('beforeForward', ctx);
-            if (ctx.responded())
-                return reply;
-        }
-        // No source → reply-from forwards the (prefix-rewritten) req.url to `origin`.
-        return reply.from(undefined, {
-            getUpstream: () => originUrl,
-            rewriteHeaders: (headers) => {
-                st.proxied = true; // a real upstream response came back → this body is app data, not a gateway reply
-                headers['x-lensmcp-upstream'] = upLabel;
-                if (!headers['x-request-id'])
-                    headers['x-request-id'] = (0, gateway_errors_1.ensureRequestId)(req); // trace id on success too
-                if (up.version)
-                    headers['x-lensmcp-version'] = up.version; // which rollout cohort served
-                // The gateway owns the edge response: drop the upstream framework leak + brand the hop.
-                delete headers['x-powered-by'];
-                delete headers['connection'];
-                delete headers['keep-alive'];
-                delete headers['proxy-connection']; // hop-by-hop
-                headers['server'] = 'LensMCP';
-                if (mintKey) { // first contact → stamp the device cookie (appended to any upstream Set-Cookie)
-                    const ex = headers['set-cookie'];
-                    const list = Array.isArray(ex) ? ex : ex ? [ex] : [];
-                    headers['set-cookie'] = [...list, rollout.mintCookieHeader(mintKey)];
-                }
-                return headers;
-            },
-            onError: (rep, { error }) => {
-                rt.opts.pods?.drop?.(route.service, up);
-                void error; // don't reflect the raw upstream error (host:port / errno) to the client
-                if (ctx && hooks.has('onError')) {
-                    ctx.error = error;
-                    void hooks.run('onError', ctx);
-                }
-                (0, edge_1.sendError)(rep, req, 502, 'unavailable', `Upstream ${route.service} unavailable.`);
-            },
-        });
-    };
-}
+"use strict";var D=Object.defineProperty;var P=(m,a)=>D(m,"name",{value:a,configurable:!0});var j=Object.defineProperty,v=P((m,a)=>j(m,"name",{value:a,configurable:!0}),"v");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHandler=createHandler;const manifest_1=require("../manifest"),gateway_errors_1=require("../gateway-errors"),edge_1=require("./edge");function createHandler(m){const{rt:a,obs:c,cors:S,auth:O,upstream:_,rollout:w,hooks:l,reqState:N,spanByReq:M,ctxByReq:C}=m,A=!!a.opts.pods?.resolveVersion,H=!!a.opts.cookie,I=!!a.opts.pods?.bucket&&(H||!!a.opts.uidHeader),L=A||H||I,U=v((p,o,r,f)=>{const h=p.raw;if(S.setCors(o,h),h.method==="OPTIONS"){o.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(h.headers["access-control-request-headers"]??"*")).send();return}const i=a.table.routes.filter(n=>n.host&&(0,manifest_1.hostMatches)(n.host,r)&&n.prefix),s=f.split("?")[0];if(i.length>0&&(s==="/health"||s==="/healthz")){o.code(200).type("application/json").send(JSON.stringify({status:"ok",host:r,services:i.map(n=>({service:n.service,prefix:n.prefix}))}));return}if(s==="/.well-known/lensmcp-routes"){o.code(200).type("application/json").send(JSON.stringify({host:r,routes:a.table.routes.filter(n=>!n.host||(0,manifest_1.hostMatches)(n.host,r)).map(n=>({host:n.host??"(default)",service:n.service,prefix:n.prefix,internal:!!n.internal,auth:n.auth}))}));return}(0,edge_1.sendError)(o,h,404,"not_found",i.length>0?`No service mounted at ${f} on ${r}.`:"No gateway route for this hostname.")},"handleNoRoute");return async(p,o)=>{const r=p.raw,f=(r.headers.host||"").split(":")[0],h=r.url??"/",i=c.beginTrace(r);(0,gateway_errors_1.ensureRequestId)(r),c.step(i,"received",{host:f,method:r.method,url:h});const s=l.any?l.httpContext(r,p,o,i):void 0;if(s&&C.set(p,s),s&&l.has("onRequest")&&(await l.run("onRequest",s),s.responded()))return o;if(r.httpVersionMajor<1)return c.finish(i,"gateway",400),(0,edge_1.sendError)(o,r,400,"bad_request","Bad Request");const n=(0,edge_1.canonicalPath)(h);if(n===void 0)return c.step(i,"bad-path",{}),c.finish(i,"gateway",400),(0,edge_1.sendError)(o,r,400,"bad_request","Bad Request");if(a.opts.rateLimiter){const e=await a.opts.rateLimiter.check(w.clientIpOf(r,r.socket?.remoteAddress??p.ip));if(!e.allowed)return o.header("retry-after",String(Math.ceil(e.retryAfterMs/1e3))),c.step(i,"rate-limited",{}),c.finish(i,"gateway",429),(0,edge_1.sendError)(o,r,429,"rate_limited","Too Many Requests")}const t=(0,manifest_1.matchRoute)(a.table.routes,f,h);if(!t)return U(p,o,f,h),o;if(s&&(s.route=t),c.step(i,"route-match",{project:t.service,...t.prefix?{prefix:t.prefix}:{},...t.internal?{internal:!0}:{}}),r.method==="OPTIONS")return S.setCors(o,r),o.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(r.headers["access-control-request-headers"]??"*")).send(),o;const g=a.opts.tracing?.startSpan(r,`gateway ${t.service}`,{"http.request.method":r.method??"GET","url.path":h.split("?")[0],"server.address":f,"lensmcp.service":t.service,...t.internal?{"lensmcp.internal":!0}:{}});if(g&&M.set(p,g),s&&l.has("beforeAuth")&&(await l.run("beforeAuth",s),s.responded()))return o;const b=t.internal?void 0:a.opts.identify?.(r);let E;if(t.internal){const e=O.internal(r,t,i);if(!e.ok)return c.finish(i,t.service,e.status),(0,edge_1.sendError)(o,r,e.status,e.reason,e.detail);E=e.caller,s&&(s.caller=E)}else{const e=O.public(r,t,n,b,p.ip,i);if(!e.ok)return c.finish(i,t.service,e.status),(0,edge_1.sendError)(o,r,e.status,e.reason,e.detail);if(s&&(s.claims=b),s&&l.has("afterAuth")&&(await l.run("afterAuth",s),s.responded()))return o}if(a.opts.serviceKeys?.[t.service]&&(r.headers["x-internal-token"]=a.opts.serviceKeys[t.service]),t.prependPrefix){const e=r.url??"/",d=t.prependPrefix;e!==d&&!e.startsWith(d+"/")&&(r.url=d+e)}const k=(0,edge_1.hdr)(r.headers[a.versionHeader]);let x=k,q;if(L&&!t.internal&&!k){const e=w.resolveStickyKey(r);e.mint&&(q=e.key);const d=A?a.opts.pods.resolveVersion(t.service,w.buildAttrs(r,p.ip,b,e.key)):void 0;if(d)x=d.version,c.step(i,"targeting",{rule:d.rule,version:d.version});else if(e.key){const y=a.opts.pods?.bucket?.(t.service,e.key);y&&(x=y.version,c.step(i,"targeting",{mode:"sticky",version:y.version}))}}const u=await _.resolveUpstream(t,i,x);if(!u)return c.finish(i,t.service,503),(0,edge_1.sendError)(o,r,503,"unavailable",`Service ${t.service} has no available upstream.`);if(!("url"in u))return c.finish(i,t.service,502),(0,edge_1.sendError)(o,r,502,"unavailable",`Service ${t.service}: socket upstreams are not supported by the prod gateway.`);const $=new URL(u.url).origin,T=u.url,R={route:t,caller:E,startedAt:Date.now(),trace:i,version:u.version,upLabel:T};return N.set(p,R),s&&(s.version=u.version),c.step(i,u.version?"rollout":"upstream",{upstream:T,...u.version?{version:u.version,...k?{pinned:!0}:{}}:{}}),g&&a.opts.tracing.inject(g,r.headers),s&&l.has("beforeForward")&&(await l.run("beforeForward",s),s.responded())?o:o.from(void 0,{getUpstream:v(()=>$,"getUpstream"),rewriteHeaders:v(e=>{if(R.proxied=!0,e["x-lensmcp-upstream"]=T,e["x-request-id"]||(e["x-request-id"]=(0,gateway_errors_1.ensureRequestId)(r)),u.version&&(e["x-lensmcp-version"]=u.version),delete e["x-powered-by"],delete e.connection,delete e["keep-alive"],delete e["proxy-connection"],e.server="LensMCP",q){const d=e["set-cookie"],y=Array.isArray(d)?d:d?[d]:[];e["set-cookie"]=[...y,w.mintCookieHeader(q)]}return e},"rewriteHeaders"),onError:v((e,{error:d})=>{a.opts.pods?.drop?.(t.service,u),s&&l.has("onError")&&(s.error=d,l.run("onError",s)),(0,edge_1.sendError)(e,r,502,"unavailable",`Upstream ${t.service} unavailable.`)},"onError")})}}P(createHandler,"createHandler"),v(createHandler,"createHandler");

package/executors/gateway/prod-runtime/hooks.d.ts

@@ -17,4 +17,3 @@ export interface HooksLayer {
     upgradeContext(req: http.IncomingMessage, socket: net.Socket, trace: GwTrace | undefined): ProdHookContext;
 }
 export declare function createHooks(hooks: ProdGatewayHooks): HooksLayer;
-//# sourceMappingURL=hooks.d.ts.map

package/executors/gateway/prod-runtime/hooks.js

@@ -1,42 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createHooks = createHooks;
-const edge_1 = require("./edge");
-const TERMINAL_PHASES = new Set(['onResponse', 'onError']);
-function createHooks(hooks) {
-    const run = async (phase, ctx) => {
-        const list = hooks[phase];
-        if (!list || list.length === 0)
-            return;
-        const terminal = TERMINAL_PHASES.has(phase);
-        for (const h of list) {
-            if (!terminal && ctx.responded())
-                return;
-            await h(ctx);
-        }
-    };
-    const has = (phase) => (hooks[phase]?.length ?? 0) > 0;
-    const any = ['onRequest', 'beforeAuth', 'afterAuth', 'beforeForward', 'onResponse', 'onError', 'onUpgrade'].some((p) => has(p));
-    const httpContext = (req, request, reply, trace) => {
-        let didRespond = false;
-        return {
-            req, request, reply, socket: undefined, trace,
-            route: undefined, caller: undefined, claims: undefined, version: undefined, error: undefined, status: undefined,
-            sendError: (status, reason, detail) => { (0, edge_1.sendError)(reply, req, status, reason, detail); didRespond = true; },
-            responded: () => didRespond || reply.raw.writableEnded,
-        };
-    };
-    const upgradeContext = (req, socket, trace) => {
-        let didRespond = false;
-        return {
-            req, request: undefined, reply: undefined, socket, trace,
-            route: undefined, caller: undefined, claims: undefined, version: undefined, error: undefined, status: undefined,
-            sendError: () => { try {
-                socket.destroy();
-            }
-            catch { /* already gone */ } didRespond = true; },
-            responded: () => didRespond || socket.destroyed,
-        };
-    };
-    return { any, run, has, httpContext, upgradeContext };
-}
+"use strict";var f=Object.defineProperty;var i=(t,d)=>f(t,"name",{value:d,configurable:!0});var l=Object.defineProperty,n=i((t,d)=>l(t,"name",{value:d,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHooks=createHooks;const edge_1=require("./edge"),TERMINAL_PHASES=new Set(["onResponse","onError"]);function createHooks(t){const d=n(async(e,o)=>{const r=t[e];if(!r||r.length===0)return;const s=TERMINAL_PHASES.has(e);for(const a of r){if(!s&&o.responded())return;await a(o)}},"run"),u=n(e=>(t[e]?.length??0)>0,"has");return{any:["onRequest","beforeAuth","afterAuth","beforeForward","onResponse","onError","onUpgrade"].some(e=>u(e)),run:d,has:u,httpContext:n((e,o,r,s)=>{let a=!1;return{req:e,request:o,reply:r,socket:void 0,trace:s,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n((c,v,p)=>{(0,edge_1.sendError)(r,e,c,v,p),a=!0},"sendError"),responded:n(()=>a||r.raw.writableEnded,"responded")}},"httpContext"),upgradeContext:n((e,o,r)=>{let s=!1;return{req:e,request:void 0,reply:void 0,socket:o,trace:r,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n(()=>{try{o.destroy()}catch{}s=!0},"sendError"),responded:n(()=>s||o.destroyed,"responded")}},"upgradeContext")}}i(createHooks,"createHooks"),n(createHooks,"createHooks");

package/executors/gateway/prod-runtime/observability.d.ts

@@ -20,4 +20,3 @@ export interface Observability {
     startFlusher(): NodeJS.Timeout;
 }
 export declare function createObservability(opts: ProdGatewayOptions, getRoutes: () => Route[]): Observability;
-//# sourceMappingURL=observability.d.ts.map

package/executors/gateway/prod-runtime/observability.js

@@ -1,125 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createObservability = createObservability;
-const edge_1 = require("./edge");
-function createObservability(opts, getRoutes) {
-    const emit = (severity, title, fingerprint, raw, ctx) => {
-        if (!opts.emit)
-            return; // lens off by default — no work, no allocation beyond the call
-        try {
-            opts.emit({
-                id: (0, edge_1.eid)(), sessionId: 'pending', timestamp: Date.now(),
-                source: 'gateway', category: 'cluster', severity,
-                context: { sessionId: 'pending', ...ctx }, fingerprint, title, raw,
-            });
-        }
-        catch { /* never let the bus break traffic */ }
-    };
-    // ---- traffic edges (host→service[@version]), flushed to the lens periodically ----
-    const edges = new Map();
-    const recordEdge = (route, ms, status, caller, version) => {
-        const host = route.host ?? '(default)';
-        const key = (caller ? caller + '⇒' : '') + host + '→' + route.service + (version ? '@' + version : '');
-        const e = edges.get(key) ?? { host, service: route.service, caller, version, count: 0, totalMs: 0, errors: 0 };
-        e.count += 1;
-        e.totalMs += ms;
-        if (status >= 500 || status === 0)
-            e.errors += 1;
-        edges.set(key, e);
-    };
-    // ---- per-service health rollup (feeds /statusz + the Redis status fan-out) ----
-    // A ring of the last N flush windows, summed at read time → a rolling view that
-    // doesn't flap to "idle" the instant traffic pauses. Derived purely from the edges.
-    const statusWindowCount = Math.max(1, opts.statusWindows ?? 12);
-    const statusWindows = [];
-    const lastSeenAt = new Map();
-    const routeServices = () => [...new Set(getRoutes().map((r) => r.service))];
-    const pushStatusWindow = () => {
-        const w = new Map();
-        for (const e of edges.values()) {
-            const s = w.get(e.service) ?? { requests: 0, errors: 0, totalMs: 0, versions: new Set() };
-            s.requests += e.count;
-            s.errors += e.errors;
-            s.totalMs += e.totalMs;
-            if (e.version)
-                s.versions.add(e.version);
-            w.set(e.service, s);
-        }
-        const now = Date.now();
-        for (const [svc, s] of w)
-            if (s.requests > 0)
-                lastSeenAt.set(svc, now);
-        statusWindows.push(w);
-        while (statusWindows.length > statusWindowCount)
-            statusWindows.shift();
-    };
-    const buildStatusSnapshot = () => {
-        const agg = new Map();
-        for (const w of statusWindows)
-            for (const [svc, s] of w) {
-                const a = agg.get(svc) ?? { requests: 0, errors: 0, totalMs: 0, versions: new Set() };
-                a.requests += s.requests;
-                a.errors += s.errors;
-                a.totalMs += s.totalMs;
-                for (const v of s.versions)
-                    a.versions.add(v);
-                agg.set(svc, a);
-            }
-        const routes = getRoutes();
-        return routeServices().map((svc) => {
-            const a = agg.get(svc) ?? { requests: 0, errors: 0, totalMs: 0, versions: new Set() };
-            const hosts = [...new Set(routes.filter((r) => r.service === svc).map((r) => r.host ?? '(default)'))];
-            const er = a.requests ? a.errors / a.requests : 0;
-            let status = a.requests === 0 ? 'idle' : er >= 0.5 ? 'down' : er >= 0.05 ? 'degraded' : 'healthy';
-            // active liveness: if every known upstream for this service is failing probes, it's down (even with no traffic)
-            if (opts.healthChecker) {
-                const svcUrls = routes.filter((r) => r.service === svc && r.upstream).map((r) => r.upstream);
-                if (svcUrls.length && svcUrls.every((u) => !opts.healthChecker.isHealthy(u)))
-                    status = 'down';
-            }
-            return { service: svc, hosts, status, requests: a.requests, errorRate: +er.toFixed(4), avgMs: a.requests ? Math.round(a.totalMs / a.requests) : 0, versions: [...a.versions], lastSeen: lastSeenAt.get(svc) ?? null };
-        });
-    };
-    const startFlusher = () => {
-        const t = setInterval(() => {
-            pushStatusWindow(); // always: roll the health window (independent of the lens)
-            if (opts.onStatus) {
-                try {
-                    opts.onStatus(buildStatusSnapshot());
-                }
-                catch { /* never let a status sink break traffic */ }
-            }
-            if (opts.emit) {
-                for (const e of edges.values()) {
-                    emit(e.errors ? 'warning' : 'info', `traffic ${e.host} → ${e.service}${e.version ? '@' + e.version : ''}: ${e.count} req`, `gateway-traffic:${e.host}->${e.service}${e.version ? '@' + e.version : ''}`, { kind: 'gateway-traffic', host: e.host, project: e.service, caller: e.caller, version: e.version, count: e.count, avgMs: Math.round(e.totalMs / e.count), errors: e.errors });
-                }
-            }
-            edges.clear();
-        }, opts.trafficFlushMs ?? 5000);
-        t.unref?.();
-        return t;
-    };
-    // ---- per-request flow trace (only for flow-header-carrying requests) ----
-    const beginTrace = (req) => {
-        if (!opts.emit)
-            return undefined; // no lens → no trace overhead
-        const flowId = (0, edge_1.hdr)(req.headers['x-lensmcp-flow-id']);
-        let requestId = (0, edge_1.hdr)(req.headers['x-request-id']);
-        if (!flowId && !requestId && !(0, edge_1.hdr)(req.headers['traceparent']))
-            return undefined;
-        if (!requestId) {
-            requestId = (0, edge_1.eid)();
-            req.headers['x-request-id'] = requestId;
-        }
-        return { startedAt: Date.now(), method: (req.method ?? 'GET').toUpperCase(), host: (req.headers.host || '').split(':')[0], url: req.url ?? '/', steps: [], ...(flowId ? { flowId } : {}), ...(requestId ? { requestId } : {}) };
-    };
-    const step = (t, name, info) => { if (t)
-        t.steps.push({ step: name, atMs: Date.now() - t.startedAt, ...info }); };
-    const finish = (t, service, status, extra) => {
-        if (!t || t.done)
-            return;
-        t.done = true;
-        emit(status >= 500 ? 'error' : 'info', `gateway ${t.method} ${t.host}${t.url} → ${status} (${Date.now() - t.startedAt}ms)`, `gateway-request:${service}`, { kind: 'gateway-request', project: service, host: t.host, method: t.method, url: t.url, status, durationMs: Date.now() - t.startedAt, startedAt: t.startedAt, steps: t.steps, ...extra }, { ...(t.flowId ? { flowId: t.flowId } : {}), ...(t.requestId ? { requestId: t.requestId } : {}) });
-    };
-    return { emit, beginTrace, step, finish, recordEdge, buildStatusSnapshot, startFlusher };
-}
+"use strict";var b=Object.defineProperty;var p=(o,d)=>b(o,"name",{value:d,configurable:!0});var y=Object.defineProperty,c=p((o,d)=>y(o,"name",{value:d,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createObservability=createObservability;const redact_1=require("@lensmcp/core/redact"),edge_1=require("./edge");function createObservability(o,d){const v=c((e,t,s,r,a)=>{if(o.emit)try{o.emit({id:(0,edge_1.eid)(),sessionId:"pending",timestamp:Date.now(),source:"gateway",category:"cluster",severity:e,context:(0,redact_1.redactDeep)({sessionId:"pending",...a}),fingerprint:s,title:(0,redact_1.safeTitle)(t),raw:r&&(0,redact_1.redactDeep)(r)})}catch{}},"emit"),h=new Map,q=c((e,t,s,r,a)=>{const n=e.host??"(default)",u=(r?r+"\u21D2":"")+n+"\u2192"+e.service+(a?"@"+a:""),i=h.get(u)??{host:n,service:e.service,caller:r,version:a,count:0,totalMs:0,errors:0};i.count+=1,i.totalMs+=t,(s>=500||s===0)&&(i.errors+=1),h.set(u,i)},"recordEdge"),m=Math.max(1,o.statusWindows??12),f=[],w=new Map,M=c(()=>[...new Set(d().map(e=>e.service))],"routeServices"),S=c(()=>{const e=new Map;for(const s of h.values()){const r=e.get(s.service)??{requests:0,errors:0,totalMs:0,versions:new Set};r.requests+=s.count,r.errors+=s.errors,r.totalMs+=s.totalMs,s.version&&r.versions.add(s.version),e.set(s.service,r)}const t=Date.now();for(const[s,r]of e)r.requests>0&&w.set(s,t);for(f.push(e);f.length>m;)f.shift()},"pushStatusWindow"),g=c(()=>{const e=new Map;for(const s of f)for(const[r,a]of s){const n=e.get(r)??{requests:0,errors:0,totalMs:0,versions:new Set};n.requests+=a.requests,n.errors+=a.errors,n.totalMs+=a.totalMs;for(const u of a.versions)n.versions.add(u);e.set(r,n)}const t=d();return M().map(s=>{const r=e.get(s)??{requests:0,errors:0,totalMs:0,versions:new Set},a=[...new Set(t.filter(i=>i.service===s).map(i=>i.host??"(default)"))],n=r.requests?r.errors/r.requests:0;let u=r.requests===0?"idle":n>=.5?"down":n>=.05?"degraded":"healthy";if(o.healthChecker){const i=t.filter(l=>l.service===s&&l.upstream).map(l=>l.upstream);i.length&&i.every(l=>!o.healthChecker.isHealthy(l))&&(u="down")}return{service:s,hosts:a,status:u,requests:r.requests,errorRate:+n.toFixed(4),avgMs:r.requests?Math.round(r.totalMs/r.requests):0,versions:[...r.versions],lastSeen:w.get(s)??null}})},"buildStatusSnapshot");return{emit:v,beginTrace:c(e=>{if(!o.emit)return;const t=(0,edge_1.hdr)(e.headers["x-lensmcp-flow-id"]);let s=(0,edge_1.hdr)(e.headers["x-request-id"]);if(!(!t&&!s&&!(0,edge_1.hdr)(e.headers.traceparent)))return s||(s=(0,edge_1.eid)(),e.headers["x-request-id"]=s),{startedAt:Date.now(),method:(e.method??"GET").toUpperCase(),host:(e.headers.host||"").split(":")[0],url:e.url??"/",steps:[],...t?{flowId:t}:{},...s?{requestId:s}:{}}},"beginTrace"),step:c((e,t,s)=>{e&&e.steps.push({step:t,atMs:Date.now()-e.startedAt,...s})},"step"),finish:c((e,t,s,r)=>{!e||e.done||(e.done=!0,v(s>=500?"error":"info",`gateway ${e.method} ${e.host}${e.url} \u2192 ${s} (${Date.now()-e.startedAt}ms)`,`gateway-request:${t}`,{kind:"gateway-request",project:t,host:e.host,method:e.method,url:e.url,status:s,durationMs:Date.now()-e.startedAt,startedAt:e.startedAt,steps:e.steps,...r},{...e.flowId?{flowId:e.flowId}:{},...e.requestId?{requestId:e.requestId}:{}}))},"finish"),recordEdge:q,buildStatusSnapshot:g,startFlusher:c(()=>{const e=setInterval(()=>{if(S(),o.onStatus)try{o.onStatus(g())}catch{}if(o.emit)for(const t of h.values())v(t.errors?"warning":"info",`traffic ${t.host} \u2192 ${t.service}${t.version?"@"+t.version:""}: ${t.count} req`,`gateway-traffic:${t.host}->${t.service}${t.version?"@"+t.version:""}`,{kind:"gateway-traffic",host:t.host,project:t.service,caller:t.caller,version:t.version,count:t.count,avgMs:Math.round(t.totalMs/t.count),errors:t.errors});h.clear()},o.trafficFlushMs??5e3);return e.unref?.(),e},"startFlusher")}}p(createObservability,"createObservability"),c(createObservability,"createObservability");

package/executors/gateway/prod-runtime/rollout.d.ts

@@ -15,4 +15,3 @@ export interface RolloutLayer {
     mintCookieHeader(id: string): string;
 }
 export declare function createRollout(opts: ProdGatewayOptions): RolloutLayer;
-//# sourceMappingURL=rollout.d.ts.map

package/executors/gateway/prod-runtime/rollout.js

@@ -1,103 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createRollout = createRollout;
-/**
- * Targeted-rollout support: authoritative client-IP resolution (trusted
- * front-proxy header, anti-spoof), the sticky device key (signed cookie → uid
- * header → minted), and the flat ABAC attribute bag shared by the HTTP + WS
- * paths so a rule sees an identical bag on both.
- */
-const node_crypto_1 = require("node:crypto");
-const manifest_1 = require("../manifest");
-const edge_1 = require("./edge");
-function createRollout(opts) {
-    const clientIpHeader = opts.clientIpHeader?.toLowerCase();
-    // `clientIpHeader` is only trusted from a known front proxy. Default: loopback only
-    // (a co-located cloudflared/sidecar) — an off-proxy attacker hitting the origin directly
-    // cannot spoof the `ip` ABAC attribute.
-    const trustedProxies = opts.clientIpTrustedProxies ?? [];
-    const peerTrusted = (peer) => {
-        if (!peer)
-            return false;
-        const ip = peer.startsWith('::ffff:') ? peer.slice(7) : peer;
-        if (trustedProxies.length === 0)
-            return ip === '127.0.0.1' || peer === '::1';
-        return trustedProxies.some((c) => (0, manifest_1.matchCidr)(ip, c));
-    };
-    const clientIpOf = (req, fallback) => {
-        if (clientIpHeader && peerTrusted(req.socket?.remoteAddress ?? undefined)) {
-            const h = (0, edge_1.hdr)(req.headers[clientIpHeader]);
-            if (h)
-                return h;
-        }
-        return fallback;
-    };
-    const attrHeaders = (opts.attributeHeaders ?? []).map((h) => h.toLowerCase());
-    const uidHeader = opts.uidHeader?.toLowerCase();
-    const cookieOn = !!opts.cookie;
-    const cookieName = opts.cookie?.name ?? 'lensmcp_did';
-    const cookieSecret = opts.cookie?.secret;
-    const cookieDomain = opts.cookie?.domain;
-    const cookieMaxAge = opts.cookie?.maxAge ?? 31_536_000; // 1y
-    if (cookieOn && !cookieSecret)
-        console.warn('[gateway] device cookie has no secret — values are UNSIGNED (set cookie.secret to prevent bucket-grinding).');
-    const signId = (id) => (0, node_crypto_1.createHmac)('sha256', cookieSecret).update(id).digest('base64url');
-    const signedCookie = (id) => (cookieSecret ? `${id}.${signId(id)}` : id);
-    const verifyCookie = (val) => {
-        if (!cookieSecret)
-            return val || undefined; // unsigned mode
-        const i = val.lastIndexOf('.');
-        if (i < 0)
-            return undefined;
-        const id = val.slice(0, i);
-        const a = Buffer.from(val.slice(i + 1)), b = Buffer.from(signId(id));
-        return a.length === b.length && (0, node_crypto_1.timingSafeEqual)(a, b) ? id : undefined;
-    };
-    const parseCookie = (header, name) => {
-        if (!header)
-            return undefined;
-        for (const part of header.split(';')) {
-            const eq = part.indexOf('=');
-            if (eq > 0 && part.slice(0, eq).trim() === name)
-                return decodeURIComponent(part.slice(eq + 1).trim());
-        }
-        return undefined;
-    };
-    const mintCookieHeader = (id) => {
-        let c = `${cookieName}=${encodeURIComponent(signedCookie(id))}; Path=/; Max-Age=${cookieMaxAge}; HttpOnly; SameSite=Lax; Secure`;
-        if (cookieDomain)
-            c += `; Domain=${cookieDomain}`;
-        return c;
-    };
-    const resolveStickyKey = (req) => {
-        if (cookieOn) {
-            const c = parseCookie(req.headers.cookie, cookieName);
-            const id = c ? verifyCookie(c) : undefined;
-            if (id)
-                return { key: id, mint: false };
-        }
-        if (uidHeader) {
-            const u = (0, edge_1.hdr)(req.headers[uidHeader]);
-            if (u)
-                return { key: u, mint: false };
-        }
-        if (cookieOn)
-            return { key: 'd_' + (0, node_crypto_1.randomBytes)(12).toString('base64url'), mint: true };
-        return { mint: false };
-    };
-    const buildAttrs = (req, fallbackIp, principal, key) => {
-        const a = { ...(principal ?? {}) };
-        a['ip'] = clientIpOf(req, fallbackIp);
-        a['method'] = (req.method ?? 'GET').toUpperCase();
-        a['path'] = (req.url ?? '/').split('?')[0];
-        if (key)
-            a['device'] = key;
-        for (const h of attrHeaders) {
-            const v = (0, edge_1.hdr)(req.headers[h]);
-            if (v !== undefined)
-                a['header.' + h] = v;
-        }
-        return a;
-    };
-    return { clientIpOf, buildAttrs, resolveStickyKey, mintCookieHeader };
-}
+"use strict";var H=Object.defineProperty;var u=(i,c)=>H(i,"name",{value:c,configurable:!0});var S=Object.defineProperty,r=u((i,c)=>S(i,"name",{value:c,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRollout=createRollout;const node_crypto_1=require("node:crypto"),manifest_1=require("../manifest"),edge_1=require("./edge");function createRollout(i){const c=i.clientIpHeader?.toLowerCase(),l=i.clientIpTrustedProxies??[],y=r(e=>{if(!e)return!1;const t=e.startsWith("::ffff:")?e.slice(7):e;return l.length===0?t==="127.0.0.1"||e==="::1":l.some(o=>(0,manifest_1.matchCidr)(t,o))},"peerTrusted"),f=r((e,t)=>{if(c&&y(e.socket?.remoteAddress??void 0)){const o=(0,edge_1.hdr)(e.headers[c]);if(o)return o}return t},"clientIpOf"),C=(i.attributeHeaders??[]).map(e=>e.toLowerCase()),m=i.uidHeader?.toLowerCase(),d=!!i.cookie,p=i.cookie?.name??"lensmcp_did",a=i.cookie?.secret,k=i.cookie?.domain,I=i.cookie?.maxAge??31536e3;d&&!a&&console.warn("[gateway] device cookie has no secret \u2014 values are UNSIGNED (set cookie.secret to prevent bucket-grinding).");const h=r(e=>(0,node_crypto_1.createHmac)("sha256",a).update(e).digest("base64url"),"signId"),b=r(e=>a?`${e}.${h(e)}`:e,"signedCookie"),x=r(e=>{if(!a)return e||void 0;const t=e.lastIndexOf(".");if(t<0)return;const o=e.slice(0,t),n=Buffer.from(e.slice(t+1)),s=Buffer.from(h(o));return n.length===s.length&&(0,node_crypto_1.timingSafeEqual)(n,s)?o:void 0},"verifyCookie"),_=r((e,t)=>{if(e)for(const o of e.split(";")){const n=o.indexOf("=");if(n>0&&o.slice(0,n).trim()===t)return decodeURIComponent(o.slice(n+1).trim())}},"parseCookie");return{clientIpOf:f,buildAttrs:r((e,t,o,n)=>{const s={...o??{}};s.ip=f(e,t),s.method=(e.method??"GET").toUpperCase(),s.path=(e.url??"/").split("?")[0],n&&(s.device=n);for(const g of C){const v=(0,edge_1.hdr)(e.headers[g]);v!==void 0&&(s["header."+g]=v)}return s},"buildAttrs"),resolveStickyKey:r(e=>{if(d){const t=_(e.headers.cookie,p),o=t?x(t):void 0;if(o)return{key:o,mint:!1}}if(m){const t=(0,edge_1.hdr)(e.headers[m]);if(t)return{key:t,mint:!1}}return d?{key:"d_"+(0,node_crypto_1.randomBytes)(12).toString("base64url"),mint:!0}:{mint:!1}},"resolveStickyKey"),mintCookieHeader:r(e=>{let t=`${p}=${encodeURIComponent(b(e))}; Path=/; Max-Age=${I}; HttpOnly; SameSite=Lax; Secure`;return k&&(t+=`; Domain=${k}`),t},"mintCookieHeader")}}u(createRollout,"createRollout"),r(createRollout,"createRollout");

package/executors/gateway/prod-runtime/routing.d.ts

@@ -1,4 +1,3 @@
 import type { Observability } from './observability';
 import type { ProdGatewayOptions, RouteTable } from './types';
 export declare function createRouteTable(opts: ProdGatewayOptions, obs: Observability): RouteTable;
-//# sourceMappingURL=routing.d.ts.map

package/executors/gateway/prod-runtime/routing.js

@@ -1,40 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createRouteTable = createRouteTable;
-/**
- * The route table — rebuilt atomically from the manifest source (the SAME
- * `buildRouteTable` brain as dev). The `routes` array + `manifestByService` map
- * keep STABLE identities (content-replaced in place) so every other layer can
- * hold the reference and always read the live table.
- */
-const manifest_1 = require("../manifest");
-function createRouteTable(opts, obs) {
-    const routes = [];
-    const manifestByService = new Map();
-    let current = opts.manifests.list();
-    const apply = (next) => {
-        current = next;
-        const built = (0, manifest_1.buildRouteTable)(next);
-        routes.length = 0;
-        routes.push(...built);
-        manifestByService.clear();
-        for (const m of next)
-            manifestByService.set(m.service, m);
-    };
-    const rebuild = (next) => {
-        apply(next);
-        if (opts.healthChecker) { // monitor every reachable upstream: direct manifest URLs + pooled endpoints
-            const urls = new Set();
-            for (const r of routes)
-                if (r.upstream)
-                    urls.add(r.upstream);
-            for (const u of opts.pods?.endpoints?.() ?? [])
-                urls.add(u);
-            opts.healthChecker.track([...urls]);
-        }
-        obs.emit('info', `gateway routes: ${routes.length} on ${current.length} services`, 'gateway-up', { kind: 'gateway-up', routes: routes.map((r) => ({ host: r.host ?? '(default)', service: r.service, internal: !!r.internal })) });
-    };
-    apply(current); // initial build (no emit yet; server.ts fires the initial gateway-up via rebuild)
-    const unwatch = opts.manifests.watch?.((next) => rebuild(next));
-    return { routes, manifestByService, rebuild, manifests: () => current, stop: () => unwatch?.() };
-}
+"use strict";var d=Object.defineProperty;var u=(e,o)=>d(e,"name",{value:o,configurable:!0});var h=Object.defineProperty,r=u((e,o)=>h(e,"name",{value:o,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRouteTable=createRouteTable;const manifest_1=require("../manifest");function createRouteTable(e,o){const n=[],c=new Map;let i=e.manifests.list();const l=r(a=>{i=a;const t=(0,manifest_1.buildRouteTable)(a);n.length=0,n.push(...t),c.clear();for(const s of a)c.set(s.service,s)},"apply"),f=r(a=>{if(l(a),e.healthChecker){const t=new Set;for(const s of n)s.upstream&&t.add(s.upstream);for(const s of e.pods?.endpoints?.()??[])t.add(s);e.healthChecker.track([...t])}o.emit("info",`gateway routes: ${n.length} on ${i.length} services`,"gateway-up",{kind:"gateway-up",routes:n.map(t=>({host:t.host??"(default)",service:t.service,internal:!!t.internal}))})},"rebuild");l(i);const p=e.manifests.watch?.(a=>f(a));return{routes:n,manifestByService:c,rebuild:f,manifests:r(()=>i,"manifests"),stop:r(()=>p?.(),"stop")}}u(createRouteTable,"createRouteTable"),r(createRouteTable,"createRouteTable");

package/executors/gateway/prod-runtime/server.d.ts

@@ -1,3 +1,2 @@
 import type { ProdGatewayHandle, ProdGatewayOptions } from './types';
 export declare function startProdGateway(opts: ProdGatewayOptions): Promise<ProdGatewayHandle>;
-//# sourceMappingURL=server.d.ts.map