@lensmcp/cluster 1.18.3 → 1.18.6

package/executors/gateway/prod-runtime/server.js

@@ -1,79 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.startProdGateway = startProdGateway;
-const observability_1 = require("./observability");
-const routing_1 = require("./routing");
-const rollout_1 = require("./rollout");
-const upstream_1 = require("./upstream");
-const auth_1 = require("./auth");
-const hooks_1 = require("./hooks");
-const cors_1 = require("./cors");
-const handler_1 = require("./handler");
-const upgrade_1 = require("./upgrade");
-const app_1 = require("./app");
-async function startProdGateway(opts) {
-    const ports = opts.ports?.length ? opts.ports : [opts.tls ? 8443 : 8080];
-    // Default authenticator FAILS CLOSED: a jwt route with no authenticator wired is rejected.
-    const authenticate = opts.authenticate ?? ((mode) => {
-        if (mode === 'jwt')
-            throw new Error('jwt route but no authenticator configured');
-    });
-    // ---- option-derived config (resolved once) ----
-    const versionHeader = (opts.versionHeader ?? 'x-lensmcp-version').toLowerCase();
-    const accessLog = !!opts.accessLog;
-    const corsCredentialOrigins = new Set((opts.corsCredentialOrigins ?? []).map((o) => o.toLowerCase()));
-    const keyToProject = new Map(Object.entries(opts.serviceKeys ?? {}).map(([p, k]) => [k, p]));
-    // ---- route table + observability (lazy getRoutes breaks the table↔obs cycle) ----
-    // A holder, so obs can read the routes lazily while `table` stays a const (assigned once,
-    // before any request — obs's getter only runs at request time).
-    const tableRef = {};
-    const obs = (0, observability_1.createObservability)(opts, () => tableRef.current.routes);
-    const table = (0, routing_1.createRouteTable)(opts, obs);
-    tableRef.current = table;
-    const rt = { opts, table, keyToProject, versionHeader, accessLog, corsCredentialOrigins };
-    // ---- layers ----
-    const rollout = (0, rollout_1.createRollout)(opts);
-    const upstream = (0, upstream_1.createUpstream)(opts, obs);
-    const edgeAuth = (0, auth_1.createEdgeAuth)(rt, obs, rollout, authenticate);
-    const hooks = (0, hooks_1.createHooks)(opts.hooks ?? {});
-    const reqState = new WeakMap();
-    const spanByReq = new WeakMap();
-    const ctxByReq = new WeakMap();
-    const cors = (0, cors_1.createCors)(rt, reqState);
-    const handler = (0, handler_1.createHandler)({ rt, obs, cors, auth: edgeAuth, upstream, rollout, hooks, reqState, spanByReq, ctxByReq });
-    const upgrade = (0, upgrade_1.createUpgrade)({ rt, auth: edgeAuth, upstream, hooks });
-    const { buildApp } = (0, app_1.createApp)({ rt, obs, cors, hooks, handler, upgrade, reqState, spanByReq, ctxByReq });
-    const flusher = obs.startFlusher();
-    table.rebuild(table.manifests()); // emit initial gateway-up (+ healthChecker.track)
-    // ---- listeners ----
-    const apps = [];
-    const boundPorts = [];
-    for (const port of ports) {
-        const app = await buildApp();
-        await app.listen({ port, host: '0.0.0.0' });
-        const addr = app.server.address();
-        const bound = typeof addr === 'object' && addr ? addr.port : port;
-        boundPorts.push(bound);
-        console.log(`[gateway] listening on ${opts.tls ? 'https' : 'http'}://0.0.0.0:${bound}`);
-        apps.push(app);
-    }
-    opts.healthChecker?.start(); // begin probing now that the route table (and tracked URLs) is warm
-    let stopped = false;
-    return {
-        ports: boundPorts,
-        routes: () => table.routes,
-        status: obs.buildStatusSnapshot,
-        stop: async () => {
-            if (stopped)
-                return;
-            stopped = true;
-            clearInterval(flusher);
-            table.stop();
-            opts.healthChecker?.stop();
-            opts.rateLimiter?.stop();
-            opts.metrics?.stop();
-            obs.emit('info', 'gateway down', 'gateway-down', { kind: 'gateway-down' });
-            await Promise.all(apps.map((a) => a.close())); // reply-from closes its undici pool on close
-        },
-    };
-}
+"use strict";var B=Object.defineProperty;var l=(e,o)=>B(e,"name",{value:o,configurable:!0});var x=Object.defineProperty,n=l((e,o)=>x(e,"name",{value:o,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.startProdGateway=startProdGateway;const observability_1=require("./observability"),routing_1=require("./routing"),rollout_1=require("./rollout"),upstream_1=require("./upstream"),auth_1=require("./auth"),hooks_1=require("./hooks"),cors_1=require("./cors"),handler_1=require("./handler"),upgrade_1=require("./upgrade"),app_1=require("./app");async function startProdGateway(e){const o=e.ports?.length?e.ports:[e.tls?8443:8080],f=e.authenticate??(t=>{if(t==="jwt")throw new Error("jwt route but no authenticator configured")}),j=(e.versionHeader??"x-lensmcp-version").toLowerCase(),C=!!e.accessLog,P=new Set((e.corsCredentialOrigins??[]).map(t=>t.toLowerCase())),O=new Map(Object.entries(e.serviceKeys??{}).map(([t,i])=>[i,t])),h={},r=(0,observability_1.createObservability)(e,()=>h.current.routes),a=(0,routing_1.createRouteTable)(e,r);h.current=a;const s={opts:e,table:a,keyToProject:O,versionHeader:j,accessLog:C,corsCredentialOrigins:P},d=(0,rollout_1.createRollout)(e),w=(0,upstream_1.createUpstream)(e,r),y=(0,auth_1.createEdgeAuth)(s,r,d,f),u=(0,hooks_1.createHooks)(e.hooks??{}),c=new WeakMap,g=new WeakMap,b=new WeakMap,q=(0,cors_1.createCors)(s,c),R=(0,handler_1.createHandler)({rt:s,obs:r,cors:q,auth:y,upstream:w,rollout:d,hooks:u,reqState:c,spanByReq:g,ctxByReq:b}),L=(0,upgrade_1.createUpgrade)({rt:s,auth:y,upstream:w,hooks:u}),{buildApp:M}=(0,app_1.createApp)({rt:s,obs:r,cors:q,hooks:u,handler:R,upgrade:L,reqState:c,spanByReq:g,ctxByReq:b}),S=r.startFlusher();a.rebuild(a.manifests());const m=[],k=[];for(const t of o){const i=await M();await i.listen({port:t,host:"0.0.0.0"});const p=i.server.address(),_=typeof p=="object"&&p?p.port:t;k.push(_),console.log(`[gateway] listening on ${e.tls?"https":"http"}://0.0.0.0:${_}`),m.push(i)}e.healthChecker?.start();let v=!1;return{ports:k,routes:n(()=>a.routes,"routes"),status:r.buildStatusSnapshot,stop:n(async()=>{v||(v=!0,clearInterval(S),a.stop(),e.healthChecker?.stop(),e.rateLimiter?.stop(),e.metrics?.stop(),r.emit("info","gateway down","gateway-down",{kind:"gateway-down"}),await Promise.all(m.map(t=>t.close())))},"stop")}}l(startProdGateway,"startProdGateway"),n(startProdGateway,"startProdGateway");

package/executors/gateway/prod-runtime/trust.d.ts

@@ -9,4 +9,3 @@ export declare const HOP_BY_HOP: string[];
 export declare const stripTrust: (req: http.IncomingMessage) => void;
 /** Stamp the verified identity onto the forwarded request — tenant from the `tid` CLAIM, never a client header. */
 export declare const stampIdentity: (req: http.IncomingMessage, claims: Record<string, unknown>) => void;
-//# sourceMappingURL=trust.d.ts.map

package/executors/gateway/prod-runtime/trust.js

@@ -1,32 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.stampIdentity = exports.stripTrust = exports.HOP_BY_HOP = exports.TRUST_HEADERS = void 0;
-// Drop any client-supplied copy at ingress so identity can only originate from a verified token.
-exports.TRUST_HEADERS = ['x-internal-token', 'x-api-key-id', 'x-user-id', 'x-tenant-id', 'x-user-roles', 'x-user-permissions'];
-// Also drop client-supplied hop-by-hop control headers: a `Connection: x-internal-token`
-// would otherwise make undici strip the gateway's OWN injected trust headers before the
-// upstream (CVE-2026-33805). The proxy manages its own upstream connection semantics.
-exports.HOP_BY_HOP = ['connection', 'proxy-connection', 'keep-alive'];
-const stripTrust = (req) => {
-    for (const h of exports.TRUST_HEADERS)
-        delete req.headers[h];
-    for (const h of exports.HOP_BY_HOP)
-        delete req.headers[h];
-};
-exports.stripTrust = stripTrust;
-/** Stamp the verified identity onto the forwarded request — tenant from the `tid` CLAIM, never a client header. */
-const stampIdentity = (req, claims) => {
-    // Only stamp SCALAR claims — an object/array sub/tid must never coerce to
-    // "[object Object]" / a CSV tenant header (claim type-confusion).
-    const set = (k, v) => { if ((typeof v === 'string' && v !== '') || typeof v === 'number')
-        req.headers[k] = String(v); };
-    set('x-user-id', claims['sub']);
-    set('x-tenant-id', claims['tid']);
-    const roles = claims['roles'];
-    if (Array.isArray(roles) && roles.length)
-        req.headers['x-user-roles'] = roles.map(String).join(',');
-    const perms = claims['perms'];
-    if (Array.isArray(perms) && perms.length)
-        req.headers['x-user-permissions'] = perms.map(String).join(',');
-};
-exports.stampIdentity = stampIdentity;
+"use strict";var d=Object.defineProperty;var p=(t,e)=>d(t,"name",{value:e,configurable:!0});var x=Object.defineProperty,r=p((t,e)=>x(t,"name",{value:e,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.stampIdentity=exports.stripTrust=exports.HOP_BY_HOP=exports.TRUST_HEADERS=void 0,exports.TRUST_HEADERS=["x-internal-token","x-api-key-id","x-user-id","x-tenant-id","x-user-roles","x-user-permissions"],exports.HOP_BY_HOP=["connection","proxy-connection","keep-alive"];const stripTrust=r(t=>{for(const e of exports.TRUST_HEADERS)delete t.headers[e];for(const e of exports.HOP_BY_HOP)delete t.headers[e]},"stripTrust");exports.stripTrust=stripTrust;const stampIdentity=r((t,e)=>{const i=r((a,s)=>{(typeof s=="string"&&s!==""||typeof s=="number")&&(t.headers[a]=String(s))},"set");i("x-user-id",e.sub),i("x-tenant-id",e.tid);const o=e.roles;Array.isArray(o)&&o.length&&(t.headers["x-user-roles"]=o.map(String).join(","));const n=e.perms;Array.isArray(n)&&n.length&&(t.headers["x-user-permissions"]=n.map(String).join(","))},"stampIdentity");exports.stampIdentity=stampIdentity;

package/executors/gateway/prod-runtime/types.d.ts

@@ -238,4 +238,3 @@ export interface ProdHookContext {
     sendError(status: number, reason: import('../gateway-errors').GatewayErrorReason, detail?: string): void;
     responded(): boolean;
 }
-//# sourceMappingURL=types.d.ts.map

package/executors/gateway/prod-runtime/types.js

@@ -1,2 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0});

package/executors/gateway/prod-runtime/upgrade.d.ts

@@ -18,4 +18,3 @@ export interface UpgradeDeps {
 }
 export type UpgradeListener = (req: http.IncomingMessage, socket: net.Socket, head: Buffer) => void;
 export declare function createUpgrade(deps: UpgradeDeps): UpgradeListener;
-//# sourceMappingURL=upgrade.d.ts.map

package/executors/gateway/prod-runtime/upgrade.js

@@ -1,116 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createUpgrade = createUpgrade;
-const tslib_1 = require("tslib");
-/**
- * Raw WebSocket upgrade proxy (same trust model; net-level pipe). The upgrade
- * request is rebuilt from `req.rawHeaders` verbatim — minus the gateway-owned
- * trust headers + the client's hop-by-hop control — plus the validated caller +
- * target token + verified identity. Reuses the shared auth + upstream layers.
- */
-const net = tslib_1.__importStar(require("node:net"));
-const manifest_1 = require("../manifest");
-const edge_1 = require("./edge");
-const trust_1 = require("./trust");
-function createUpgrade(deps) {
-    const { rt, auth, upstream, hooks } = deps;
-    const run = async (req, socket, head) => {
-        (0, trust_1.stripTrust)(req);
-        const host = (req.headers.host || '').split(':')[0];
-        const cpath = (0, edge_1.canonicalPath)(req.url ?? '/');
-        if (cpath === undefined) {
-            socket.destroy();
-            return;
-        } // reject path-canonicalization attacks
-        const route = (0, manifest_1.matchRoute)(rt.table.routes, host, req.url ?? '/');
-        if (!route) {
-            socket.destroy();
-            return;
-        }
-        const ctx = hooks.any ? hooks.upgradeContext(req, socket, undefined) : undefined;
-        if (ctx)
-            ctx.route = route;
-        const claims = route.internal ? undefined : rt.opts.identify?.(req);
-        let caller;
-        if (route.internal) {
-            const v = auth.internal(req, route, undefined);
-            if (!v.ok) {
-                socket.destroy();
-                return;
-            }
-            caller = v.caller;
-            if (ctx)
-                ctx.caller = caller;
-        }
-        else {
-            // Same fail-closed ABAC + identical attribute bag as the HTTP path (no divergence).
-            const v = auth.public(req, route, cpath, claims, req.socket.remoteAddress ?? '', undefined);
-            if (!v.ok) {
-                socket.destroy();
-                return;
-            }
-            if (ctx)
-                ctx.claims = claims;
-            if (ctx && hooks.has('afterAuth')) {
-                await hooks.run('afterAuth', ctx);
-                if (ctx.responded())
-                    return;
-            }
-        }
-        if (route.prependPrefix) {
-            const u = req.url ?? '/';
-            const pp = route.prependPrefix;
-            if (u !== pp && !u.startsWith(pp + '/'))
-                req.url = pp + u;
-        } // segment-boundary
-        if (ctx && hooks.has('onUpgrade')) {
-            await hooks.run('onUpgrade', ctx);
-            if (ctx.responded())
-                return;
-        }
-        const pinned = (0, edge_1.hdr)(req.headers[rt.versionHeader]);
-        const up = await upstream.resolveUpstream(route, undefined, pinned);
-        if (!up || !('url' in up)) {
-            socket.destroy();
-            return;
-        }
-        const u = new URL(up.url);
-        const upstreamSock = net.connect(Number(u.port) || (u.protocol === 'https:' ? 443 : 80), u.hostname, () => {
-            // rebuild the upgrade request from rawHeaders (verbatim), minus the trust headers we own (incl.
-            // client identity) + the client's hop-by-hop control (so a `Connection: x-internal-token` can't
-            // strip the gateway's injected headers downstream), plus the validated caller + token + identity.
-            const strip = new Set(['x-internal-token', 'x-api-key-id', 'x-api-key', 'x-user-id', 'x-tenant-id', 'x-user-roles', 'x-user-permissions', 'connection', 'proxy-connection', 'keep-alive']);
-            const lines = [`${req.method} ${req.url} HTTP/1.1`, 'Connection: Upgrade']; // gateway-owned, clean upgrade
-            for (let i = 0; i < req.rawHeaders.length; i += 2) {
-                const k = req.rawHeaders[i];
-                if (!strip.has(k.toLowerCase()))
-                    lines.push(`${k}: ${req.rawHeaders[i + 1]}`);
-            }
-            if (caller)
-                lines.push(`x-api-key-id: ${caller}`);
-            const token = rt.opts.serviceKeys?.[route.service];
-            if (token)
-                lines.push(`x-internal-token: ${token}`);
-            if (claims) { // stamp the verified identity (mirrors the HTTP path's stampIdentity)
-                if (claims['sub'])
-                    lines.push(`x-user-id: ${String(claims['sub'])}`);
-                if (claims['tid'])
-                    lines.push(`x-tenant-id: ${String(claims['tid'])}`);
-                const roles = claims['roles'];
-                if (Array.isArray(roles) && roles.length)
-                    lines.push(`x-user-roles: ${roles.map(String).join(',')}`);
-                const perms = claims['perms'];
-                if (Array.isArray(perms) && perms.length)
-                    lines.push(`x-user-permissions: ${perms.map(String).join(',')}`);
-            }
-            upstreamSock.write(lines.join('\r\n') + '\r\n\r\n');
-            if (head?.length)
-                upstreamSock.write(head);
-            socket.pipe(upstreamSock);
-            upstreamSock.pipe(socket);
-        });
-        upstreamSock.on('error', () => socket.destroy());
-        socket.on('error', () => upstreamSock.destroy());
-    };
-    return (req, socket, head) => { void run(req, socket, head); };
-}
+"use strict";var U=Object.defineProperty;var g=(l,i)=>U(l,"name",{value:i,configurable:!0});var S=Object.defineProperty,m=g((l,i)=>S(l,"name",{value:i,configurable:!0}),"m");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createUpgrade=createUpgrade;const tslib_1=require("tslib"),net=tslib_1.__importStar(require("node:net")),manifest_1=require("../manifest"),edge_1=require("./edge"),trust_1=require("./trust");function createUpgrade(l){const{rt:i,auth:v,upstream:$,hooks:d}=l,k=m(async(e,r,h)=>{(0,trust_1.stripTrust)(e);const _=(e.headers.host||"").split(":")[0],w=(0,edge_1.canonicalPath)(e.url??"/");if(w===void 0){r.destroy();return}const s=(0,manifest_1.matchRoute)(i.table.routes,_,e.url??"/");if(!s){r.destroy();return}const t=d.any?d.upgradeContext(e,r,void 0):void 0;t&&(t.route=s);const o=s.internal?void 0:i.opts.identify?.(e);let f;if(s.internal){const a=v.internal(e,s,void 0);if(!a.ok){r.destroy();return}f=a.caller,t&&(t.caller=f)}else{if(!v.public(e,s,w,o,e.socket.remoteAddress??"",void 0).ok){r.destroy();return}if(t&&(t.claims=o),t&&d.has("afterAuth")&&(await d.run("afterAuth",t),t.responded()))return}if(s.prependPrefix){const a=e.url??"/",n=s.prependPrefix;a!==n&&!a.startsWith(n+"/")&&(e.url=n+a)}if(t&&d.has("onUpgrade")&&(await d.run("onUpgrade",t),t.responded()))return;const A=(0,edge_1.hdr)(e.headers[i.versionHeader]),y=await $.resolveUpstream(s,void 0,A);if(!y||!("url"in y)){r.destroy();return}const x=new URL(y.url),p=net.connect(Number(x.port)||(x.protocol==="https:"?443:80),x.hostname,()=>{const a=new Set(["x-internal-token","x-api-key-id","x-api-key","x-user-id","x-tenant-id","x-user-roles","x-user-permissions","connection","proxy-connection","keep-alive"]),n=[`${e.method} ${e.url} HTTP/1.1`,"Connection: Upgrade"];for(let u=0;u<e.rawHeaders.length;u+=2){const c=e.rawHeaders[u];a.has(c.toLowerCase())||n.push(`${c}: ${e.rawHeaders[u+1]}`)}f&&n.push(`x-api-key-id: ${f}`);const b=i.opts.serviceKeys?.[s.service];if(b&&n.push(`x-internal-token: ${b}`),o){o.sub&&n.push(`x-user-id: ${String(o.sub)}`),o.tid&&n.push(`x-tenant-id: ${String(o.tid)}`);const u=o.roles;Array.isArray(u)&&u.length&&n.push(`x-user-roles: ${u.map(String).join(",")}`);const c=o.perms;Array.isArray(c)&&c.length&&n.push(`x-user-permissions: ${c.map(String).join(",")}`)}p.write(n.join(`\r
+`)+`\r
+\r
+`),h?.length&&p.write(h),r.pipe(p),p.pipe(r)});p.on("error",()=>r.destroy()),r.on("error",()=>p.destroy())},"run");return(e,r,h)=>{k(e,r,h)}}g(createUpgrade,"createUpgrade"),m(createUpgrade,"createUpgrade");

package/executors/gateway/prod-runtime/upstream.d.ts

@@ -10,4 +10,3 @@ export interface UpstreamLayer {
     resolveUpstream(route: Route, trace: GwTrace | undefined, pinned?: string): Promise<Upstream | undefined>;
 }
 export declare function createUpstream(opts: ProdGatewayOptions, obs: Observability): UpstreamLayer;
-//# sourceMappingURL=upstream.d.ts.map

package/executors/gateway/prod-runtime/upstream.js

@@ -1,21 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createUpstream = createUpstream;
-function createUpstream(opts, obs) {
-    const resolveUpstream = async (route, trace, pinned) => {
-        if (route.upstream)
-            return { url: route.upstream };
-        const opt = {
-            ...(pinned ? { version: pinned } : {}),
-            ...(opts.healthChecker ? { isHealthy: (u) => opts.healthChecker.isHealthy(u) } : {}),
-        };
-        let up = opts.pods?.pick(route.service, opt);
-        if (!up && opts.pods?.ensureUp) {
-            obs.step(trace, 'ensure-up', { project: route.service });
-            if (await opts.pods.ensureUp(route.service))
-                up = opts.pods.pick(route.service, opt);
-        }
-        return up;
-    };
-    return { resolveUpstream };
-}
+"use strict";var l=Object.defineProperty;var p=(e,t)=>l(e,"name",{value:t,configurable:!0});var u=Object.defineProperty,s=p((e,t)=>u(e,"name",{value:t,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createUpstream=createUpstream;function createUpstream(e,t){return{resolveUpstream:s(async(r,o,c)=>{if(r.upstream)return{url:r.upstream};const i={...c?{version:c}:{},...e.healthChecker?{isHealthy:s(n=>e.healthChecker.isHealthy(n),"isHealthy")}:{}};let a=e.pods?.pick(r.service,i);return!a&&e.pods?.ensureUp&&(t.step(o,"ensure-up",{project:r.service}),await e.pods.ensureUp(r.service)&&(a=e.pods.pick(r.service,i))),a},"resolveUpstream")}}p(createUpstream,"createUpstream"),s(createUpstream,"createUpstream");

package/executors/gateway/providers-prod.d.ts

@@ -43,4 +43,3 @@ export declare function rolloutPodProvider(table: RolloutTable): PodProvider & {
 export declare function endpointsPodProvider(endpoints: Record<string, string[]>): PodProvider & {
     update: (next: Record<string, string[]>) => void;
 };
-//# sourceMappingURL=providers-prod.d.ts.map

package/executors/gateway/providers-prod.js

@@ -1,232 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.staticManifestProvider = staticManifestProvider;
-exports.fileManifestProvider = fileManifestProvider;
-exports.rolloutPodProvider = rolloutPodProvider;
-exports.endpointsPodProvider = endpointsPodProvider;
-/**
- * Production providers — the environment-specific halves of the gateway that
- * the dev side fills with workspace-scan + unix-socket pools. Here:
- *
- *   - manifest source: a JSON file (or a static array), watched + atomically
- *     swapped. A registry-backed provider (Redis key-space / k8s ConfigMaps)
- *     plugs in behind the same `ManifestProvider` interface later.
- *   - pod resolution: `endpointsPodProvider` round-robins per-service upstream
- *     URLs (gateway-side LB). When a manifest carries its own `upstream` (a
- *     k8s Service URL that load-balances pods itself), the core uses that
- *     directly and no PodProvider is needed.
- *
- * Bad input never takes the gateway down: an unparseable manifest file is
- * rejected and the last-good table keeps serving (versioned swap).
- */
-const node_fs_1 = require("node:fs");
-const manifest_1 = require("./manifest");
-const toSpec = (v) => Array.isArray(v) ? { rules: [], cohorts: v } : { rules: v.rules ?? [], cohorts: v.cohorts ?? [] };
-/** A fixed set of manifests (tests, single-shot config). */
-function staticManifestProvider(manifests) {
-    return { list: () => manifests };
-}
-function parseManifests(raw) {
-    let data;
-    try {
-        data = JSON.parse(raw);
-    }
-    catch {
-        return undefined;
-    }
-    // Accept either a bare array or `{ manifests: [...] }`.
-    const arr = Array.isArray(data) ? data : data?.manifests;
-    if (!Array.isArray(arr))
-        return undefined;
-    const ok = arr.filter((m) => !!m && typeof m === 'object' && typeof m.service === 'string' && Array.isArray(m.mounts));
-    // A file that parsed but yielded ZERO valid manifests is treated as bad
-    // (likely a truncated/half-written deploy) — keep last-good rather than
-    // black-hole all traffic.
-    return ok.length > 0 ? ok : undefined;
-}
-/**
- * Watch a manifests JSON file; atomically swap the in-memory set on a valid
- * change, reject and keep last-good on a bad one. `watch` notifies subscribers
- * with the new set. Poll fallback covers editors/atomic-rename + platforms
- * where fs.watch is unreliable.
- */
-function fileManifestProvider(filePath, opts = {}) {
-    const onError = opts.onError ?? (() => undefined);
-    let current = [];
-    let lastMtimeMs = -1;
-    const subs = new Set();
-    const reload = () => {
-        if (!(0, node_fs_1.existsSync)(filePath))
-            return;
-        let mtime;
-        try {
-            mtime = (0, node_fs_1.statSync)(filePath).mtimeMs;
-        }
-        catch {
-            return;
-        }
-        if (mtime === lastMtimeMs)
-            return;
-        let raw;
-        try {
-            raw = (0, node_fs_1.readFileSync)(filePath, 'utf8');
-        }
-        catch (e) {
-            onError(e);
-            return;
-        }
-        const parsed = parseManifests(raw);
-        if (!parsed) {
-            onError(new Error(`[gateway] rejecting invalid manifest file ${filePath} — keeping last-good`));
-            return;
-        }
-        lastMtimeMs = mtime;
-        current = parsed;
-        for (const cb of subs) {
-            try {
-                cb(current);
-            }
-            catch (e) {
-                onError(e);
-            }
-        }
-    };
-    reload(); // initial load (best-effort; empty until the file appears)
-    let watcher;
-    try {
-        watcher = (0, node_fs_1.watch)(filePath, { persistent: false }, () => reload());
-    }
-    catch { /* dir may not exist yet — poll covers it */ }
-    const timer = setInterval(reload, opts.pollMs ?? 1000);
-    timer.unref?.();
-    return {
-        list: () => current,
-        watch: (cb) => { subs.add(cb); return () => subs.delete(cb); },
-        stop: () => { try {
-            watcher?.close();
-        }
-        catch { /* ignore */ } clearInterval(timer); },
-    };
-}
-/**
- * Rollout-aware pod provider: each service is a set of VERSION COHORTS, and
- * `pick` splits traffic across them by weight (smooth weighted round-robin —
- * a 90/10 canary interleaves, never bursts) and round-robins endpoints WITHIN
- * the chosen cohort. `pick(svc, {version})` pins a cohort (sticky canary /
- * debugging). `update` swaps weights/cohorts live — a rollout ramps
- * (10→25→50→100) or rolls back without redeploying the gateway. The returned
- * Upstream carries `version` so the gateway can surface which cohort served.
- */
-function rolloutPodProvider(table) {
-    const svc = new Map();
-    const build = (spec) => ({
-        cohorts: spec.cohorts.map((c) => ({ ...c, urls: c.urls.slice() })),
-        select: (0, manifest_1.smoothWeightedSelector)(spec.cohorts.map((c) => c.weight)),
-        rr: spec.cohorts.map(() => -1),
-        rules: spec.rules ?? [],
-    });
-    const load = (t) => {
-        for (const [s, v] of Object.entries(t))
-            svc.set(s, build(toSpec(v)));
-        for (const s of [...svc.keys()])
-            if (!t[s])
-                svc.delete(s);
-    };
-    load(table);
-    const firstNonEmpty = (st) => st.cohorts.findIndex((c) => c.urls.length > 0);
-    return {
-        pick(service, opts) {
-            const st = svc.get(service);
-            if (!st || st.cohorts.length === 0)
-                return undefined;
-            const isHealthy = opts?.isHealthy;
-            // round-robin the chosen cohort, preferring healthy endpoints; undefined if none pass.
-            const pickUrl = (ci, gate) => {
-                const cohort = st.cohorts[ci];
-                if (!cohort || cohort.urls.length === 0)
-                    return undefined;
-                const n = cohort.urls.length;
-                for (let i = 0; i < n; i++) {
-                    st.rr[ci] = (st.rr[ci] + 1) % n;
-                    const u = cohort.urls[st.rr[ci]];
-                    if (!gate || gate(u))
-                        return u;
-                }
-                return undefined;
-            };
-            const pinnedCi = opts?.version ? st.cohorts.findIndex((c) => c.version === opts.version && c.urls.length > 0) : -1;
-            if (pinnedCi >= 0) {
-                const url = pickUrl(pinnedCi, isHealthy) ?? pickUrl(pinnedCi); // fail-open WITHIN the pinned cohort
-                return url !== undefined ? { url, version: st.cohorts[pinnedCi].version } : undefined;
-            }
-            // not pinned (or unknown version) → weighted selection (unchanged contract)
-            let ci = st.select();
-            if (!st.cohorts[ci] || st.cohorts[ci].urls.length === 0)
-                ci = firstNonEmpty(st);
-            let url = pickUrl(ci, isHealthy);
-            // chosen cohort has no healthy endpoint → try any cohort that does
-            if (url === undefined && isHealthy) {
-                for (let i = 0; i < st.cohorts.length; i++) {
-                    const u = pickUrl(i, isHealthy);
-                    if (u !== undefined) {
-                        ci = i;
-                        url = u;
-                        break;
-                    }
-                }
-            }
-            if (url === undefined)
-                url = pickUrl(ci); // fail-open: everything looks down → still route
-            return url !== undefined ? { url, version: st.cohorts[ci].version } : undefined;
-        },
-        endpoints() {
-            const urls = new Set();
-            for (const st of svc.values())
-                for (const c of st.cohorts)
-                    for (const u of c.urls)
-                        urls.add(u);
-            return [...urls];
-        },
-        // first targeting rule that matches the request's attributes (sticky-by-attribute)
-        resolveVersion(service, attrs) {
-            const st = svc.get(service);
-            return st && st.rules.length ? (0, manifest_1.pickTargetedVersion)(st.rules, attrs) : undefined;
-        },
-        // consistent-hash a stable key to a cohort version (sticky weighted split)
-        bucket(service, key) {
-            const st = svc.get(service);
-            if (!st || st.cohorts.length === 0)
-                return undefined;
-            const cohort = st.cohorts[(0, manifest_1.bucketByWeight)(`${key}:${service}`, st.cohorts.map((c) => c.weight))];
-            return cohort ? { version: cohort.version } : undefined;
-        },
-        ensureUp: async () => true, // prod services are always-on (k8s keeps them up)
-        drop(service, upstream) {
-            const st = svc.get(service);
-            if (st && 'url' in upstream)
-                for (const c of st.cohorts)
-                    c.urls = c.urls.filter((u) => u !== upstream.url);
-        },
-        update: load,
-    };
-}
-/**
- * Flat single-version load balancing — the common case (no rollout in
- * progress). A thin wrapper over `rolloutPodProvider` with one synthetic
- * cohort per service, so the rollout path is the only code path. The synthetic
- * version is STRIPPED from the result: flat LB carries no `version`, so a
- * response only gets `x-lensmcp-version` (and a `rollout` trace step) when a
- * genuine multi-cohort rollout served it.
- */
-function endpointsPodProvider(endpoints) {
-    const toCohorts = (eps) => Object.fromEntries(Object.entries(eps).map(([s, urls]) => [s, [{ version: '_flat', weight: 1, urls }]]));
-    const inner = rolloutPodProvider(toCohorts(endpoints));
-    const unversion = (u) => u && 'url' in u ? { url: u.url } : u;
-    return {
-        ...inner,
-        pick: (service, opts) => unversion(inner.pick(service, opts)),
-        resolveVersion: () => undefined, // flat LB: no targeting rules
-        bucket: () => undefined, // flat LB: single version, nothing to stick to
-        update: (next) => inner.update(toCohorts(next)),
-    };
-}
+"use strict";var b=Object.defineProperty;var p=(s,o)=>b(s,"name",{value:o,configurable:!0});var w=Object.defineProperty,n=p((s,o)=>w(s,"name",{value:o,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.staticManifestProvider=staticManifestProvider,exports.fileManifestProvider=fileManifestProvider,exports.rolloutPodProvider=rolloutPodProvider,exports.endpointsPodProvider=endpointsPodProvider;const node_fs_1=require("node:fs"),manifest_1=require("./manifest"),toSpec=n(s=>Array.isArray(s)?{rules:[],cohorts:s}:{rules:s.rules??[],cohorts:s.cohorts??[]},"toSpec");function staticManifestProvider(s){return{list:n(()=>s,"list")}}p(staticManifestProvider,"staticManifestProvider"),n(staticManifestProvider,"staticManifestProvider");function parseManifests(s){let o;try{o=JSON.parse(s)}catch{return}const a=Array.isArray(o)?o:o?.manifests;if(!Array.isArray(a))return;const f=a.filter(i=>!!i&&typeof i=="object"&&typeof i.service=="string"&&Array.isArray(i.mounts));return f.length>0?f:void 0}p(parseManifests,"parseManifests"),n(parseManifests,"parseManifests");function fileManifestProvider(s,o={}){const a=o.onError??(()=>{});let f=[],i=-1;const t=new Set,e=n(()=>{if(!(0,node_fs_1.existsSync)(s))return;let l;try{l=(0,node_fs_1.statSync)(s).mtimeMs}catch{return}if(l===i)return;let v;try{v=(0,node_fs_1.readFileSync)(s,"utf8")}catch(h){a(h);return}const d=parseManifests(v);if(!d){a(new Error(`[gateway] rejecting invalid manifest file ${s} \u2014 keeping last-good`));return}i=l,f=d;for(const h of t)try{h(f)}catch(c){a(c)}},"reload");e();let r;try{r=(0,node_fs_1.watch)(s,{persistent:!1},()=>e())}catch{}const u=setInterval(e,o.pollMs??1e3);return u.unref?.(),{list:n(()=>f,"list"),watch:n(l=>(t.add(l),()=>t.delete(l)),"watch"),stop:n(()=>{try{r?.close()}catch{}clearInterval(u)},"stop")}}p(fileManifestProvider,"fileManifestProvider"),n(fileManifestProvider,"fileManifestProvider");function rolloutPodProvider(s){const o=new Map,a=n(t=>({cohorts:t.cohorts.map(e=>({...e,urls:e.urls.slice()})),select:(0,manifest_1.smoothWeightedSelector)(t.cohorts.map(e=>e.weight)),rr:t.cohorts.map(()=>-1),rules:t.rules??[]}),"build"),f=n(t=>{for(const[e,r]of Object.entries(t))o.set(e,a(toSpec(r)));for(const e of[...o.keys()])t[e]||o.delete(e)},"load");f(s);const i=n(t=>t.cohorts.findIndex(e=>e.urls.length>0),"firstNonEmpty");return{pick(t,e){const r=o.get(t);if(!r||r.cohorts.length===0)return;const u=e?.isHealthy,l=n((c,g)=>{const y=r.cohorts[c];if(!y||y.urls.length===0)return;const P=y.urls.length;for(let m=0;m<P;m++){r.rr[c]=(r.rr[c]+1)%P;const k=y.urls[r.rr[c]];if(!g||g(k))return k}},"pickUrl"),v=e?.version?r.cohorts.findIndex(c=>c.version===e.version&&c.urls.length>0):-1;if(v>=0){const c=l(v,u)??l(v);return c!==void 0?{url:c,version:r.cohorts[v].version}:void 0}let d=r.select();(!r.cohorts[d]||r.cohorts[d].urls.length===0)&&(d=i(r));let h=l(d,u);if(h===void 0&&u)for(let c=0;c<r.cohorts.length;c++){const g=l(c,u);if(g!==void 0){d=c,h=g;break}}return h===void 0&&(h=l(d)),h!==void 0?{url:h,version:r.cohorts[d].version}:void 0},endpoints(){const t=new Set;for(const e of o.values())for(const r of e.cohorts)for(const u of r.urls)t.add(u);return[...t]},resolveVersion(t,e){const r=o.get(t);return r&&r.rules.length?(0,manifest_1.pickTargetedVersion)(r.rules,e):void 0},bucket(t,e){const r=o.get(t);if(!r||r.cohorts.length===0)return;const u=r.cohorts[(0,manifest_1.bucketByWeight)(`${e}:${t}`,r.cohorts.map(l=>l.weight))];return u?{version:u.version}:void 0},ensureUp:n(async()=>!0,"ensureUp"),drop(t,e){const r=o.get(t);if(r&&"url"in e)for(const u of r.cohorts)u.urls=u.urls.filter(l=>l!==e.url)},update:f}}p(rolloutPodProvider,"rolloutPodProvider"),n(rolloutPodProvider,"rolloutPodProvider");function endpointsPodProvider(s){const o=n(i=>Object.fromEntries(Object.entries(i).map(([t,e])=>[t,[{version:"_flat",weight:1,urls:e}]])),"toCohorts"),a=rolloutPodProvider(o(s)),f=n(i=>i&&"url"in i?{url:i.url}:i,"unversion");return{...a,pick:n((i,t)=>f(a.pick(i,t)),"pick"),resolveVersion:n(()=>{},"resolveVersion"),bucket:n(()=>{},"bucket"),update:n(i=>a.update(o(i)),"update")}}p(endpointsPodProvider,"endpointsPodProvider"),n(endpointsPodProvider,"endpointsPodProvider");

package/executors/gateway/rate-limit.d.ts

@@ -70,4 +70,3 @@ export interface RateLimitRedis {
     eval(script: string, numKeys: number, ...args: (string | number)[]): Promise<unknown>;
 }
 export declare function createRedisRateLimiter(client: RateLimitRedis, opts: RedisRateLimiterOptions): RateLimiter;
-//# sourceMappingURL=rate-limit.d.ts.map

package/executors/gateway/rate-limit.js

@@ -1,45 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createRateLimiter = createRateLimiter;
-exports.createRedisRateLimiter = createRedisRateLimiter;
-function createRateLimiter(opts) {
-    const limit = Math.max(1, opts.limit);
-    const windowMs = Math.max(1, opts.windowMs);
-    const now = opts.now ?? Date.now;
-    const refillPerMs = limit / windowMs;
-    const buckets = new Map();
-    const refilled = (b, t) => Math.min(limit, b.tokens + (t - b.last) * refillPerMs);
-    // Evict buckets that have refilled to full (idle) so the map stays bounded.
-    const sweep = setInterval(() => {
-        const t = now();
-        for (const [k, b] of buckets)
-            if (refilled(b, t) >= limit)
-                buckets.delete(k);
-    }, windowMs);
-    sweep.unref?.();
-    return {
-        check(key) {
-            const t = now();
-            let b = buckets.get(key);
-            if (!b) {
-                b = { tokens: limit, last: t };
-                buckets.set(key, b);
-            }
-            b.tokens = refilled(b, t);
-            b.last = t;
-            if (b.tokens >= 1) {
-                b.tokens -= 1;
-                return { allowed: true, remaining: Math.floor(b.tokens), retryAfterMs: 0 };
-            }
-            return { allowed: false, remaining: 0, retryAfterMs: Math.ceil((1 - b.tokens) / refillPerMs) };
-        },
-        stop() { clearInterval(sweep); },
-    };
-}
-// Atomic token bucket in one round-trip. Stores fractional tokens (Redis keeps the
-// string form) so refill is exact across calls; only the returned remaining/retry
-// are integer-coerced by the Lua→RESP boundary, which is fine.
-const BUCKET_LUA = `
+"use strict";var A=Object.defineProperty;var u=(r,e)=>A(r,"name",{value:e,configurable:!0});var R=Object.defineProperty,a=u((r,e)=>R(r,"name",{value:e,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRateLimiter=createRateLimiter,exports.createRedisRateLimiter=createRedisRateLimiter;function createRateLimiter(r){const e=Math.max(1,r.limit),i=Math.max(1,r.windowMs),n=r.now??Date.now,c=e/i,s=new Map,m=a((l,o)=>Math.min(e,l.tokens+(o-l.last)*c),"refilled"),f=setInterval(()=>{const l=n();for(const[o,t]of s)m(t,l)>=e&&s.delete(o)},i);return f.unref?.(),{check(l){const o=n();let t=s.get(l);return t||(t={tokens:e,last:o},s.set(l,t)),t.tokens=m(t,o),t.last=o,t.tokens>=1?(t.tokens-=1,{allowed:!0,remaining:Math.floor(t.tokens),retryAfterMs:0}):{allowed:!1,remaining:0,retryAfterMs:Math.ceil((1-t.tokens)/c)}},stop(){clearInterval(f)}}}u(createRateLimiter,"createRateLimiter"),a(createRateLimiter,"createRateLimiter");const BUCKET_LUA=`
 local b = redis.call('HMGET', KEYS[1], 't', 's')
 local cap = tonumber(ARGV[1])
 local refill = tonumber(ARGV[2])
@@ -56,36 +15,4 @@ redis.call('HSET', KEYS[1], 't', tokens, 's', now)
 redis.call('PEXPIRE', KEYS[1], ttl)
 local retry = 0
 if ok == 0 then retry = math.ceil((1 - tokens) / refill) end
-return {ok, math.floor(tokens), retry}`;
-const RL_TIMEOUT = Symbol('rl-timeout');
-const RL_FAIL = Symbol('rl-fail');
-function createRedisRateLimiter(client, opts) {
-    const limit = Math.max(1, opts.limit);
-    const windowMs = Math.max(1, opts.windowMs);
-    const prefix = opts.prefix ?? 'lensmcp:gw:rl:';
-    const timeoutMs = Math.max(1, opts.timeoutMs ?? 100);
-    const failOpen = opts.failOpen !== false;
-    const refillPerMs = limit / windowMs;
-    const ttlMs = Math.ceil(windowMs) + 1000; // evict idle buckets shortly after a full refill
-    const onFail = () => failOpen
-        ? { allowed: true, remaining: limit, retryAfterMs: 0 }
-        : { allowed: false, remaining: 0, retryAfterMs: windowMs };
-    return {
-        async check(key) {
-            let timer;
-            // The eval branch is mapped so it can never reject (→ RL_FAIL) — that keeps a
-            // late rejection (after a timeout already won the race) from going unhandled.
-            const evalP = Promise.resolve(client.eval(BUCKET_LUA, 1, `${prefix}${key}`, limit, refillPerMs, ttlMs)).then((v) => v, () => RL_FAIL);
-            const timeoutP = new Promise((res) => { timer = setTimeout(() => res(RL_TIMEOUT), timeoutMs); });
-            const res = await Promise.race([evalP, timeoutP]);
-            clearTimeout(timer);
-            if (res === RL_TIMEOUT || res === RL_FAIL)
-                return onFail();
-            const [ok, remaining, retry] = res;
-            return ok === 1
-                ? { allowed: true, remaining: Number(remaining) || 0, retryAfterMs: 0 }
-                : { allowed: false, remaining: 0, retryAfterMs: Number(retry) || windowMs };
-        },
-        stop() { },
-    };
-}
+return {ok, math.floor(tokens), retry}`,RL_TIMEOUT=Symbol("rl-timeout"),RL_FAIL=Symbol("rl-fail");function createRedisRateLimiter(r,e){const i=Math.max(1,e.limit),n=Math.max(1,e.windowMs),c=e.prefix??"lensmcp:gw:rl:",s=Math.max(1,e.timeoutMs??100),m=e.failOpen!==!1,f=i/n,l=Math.ceil(n)+1e3,o=a(()=>m?{allowed:!0,remaining:i,retryAfterMs:0}:{allowed:!1,remaining:0,retryAfterMs:n},"onFail");return{async check(t){let M;const w=Promise.resolve(r.eval(BUCKET_LUA,1,`${c}${t}`,i,f,l)).then(d=>d,()=>RL_FAIL),h=new Promise(d=>{M=setTimeout(()=>d(RL_TIMEOUT),s)}),k=await Promise.race([w,h]);if(clearTimeout(M),k===RL_TIMEOUT||k===RL_FAIL)return o();const[b,y,p]=k;return b===1?{allowed:!0,remaining:Number(y)||0,retryAfterMs:0}:{allowed:!1,remaining:0,retryAfterMs:Number(p)||n}},stop(){}}}u(createRedisRateLimiter,"createRedisRateLimiter"),a(createRedisRateLimiter,"createRedisRateLimiter");

package/executors/gateway/registry-source.d.ts

@@ -65,4 +65,3 @@ export declare function createRegistryProviders(source: RegistrySource, opts?: {
     start(): Promise<void>;
     stop(): void;
 };
-//# sourceMappingURL=registry-source.d.ts.map