@lensmcp/cluster 1.18.3 → 1.18.6

package/executors/gateway/registry-source.js

@@ -1,131 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.changeChannel = exports.rolloutKey = exports.manifestKey = exports.DEFAULT_REGISTRY_PREFIX = void 0;
-exports.redisRegistrySource = redisRegistrySource;
-exports.createRegistryProviders = createRegistryProviders;
-/**
- * Registry-backed gateway config — true zero-touch discovery. Instead of a
- * mounted file, the manifests + rollout cohorts live in a shared registry
- * (Redis here; k8s ConfigMap/Endpoints can drop in behind `RegistrySource`).
- * A service deploy / the `lensmcp rollout --redis` CD helper writes its keys and
- * publishes a change; the gateway re-reads and live-swaps its route table +
- * cohorts in ~instant — no gateway redeploy, no file mounts.
- *
- * The cluster lib stays dependency-light: `redisRegistrySource` works against a
- * minimal injected `RedisLike` (ioredis satisfies it; the prod entry wires the
- * real client, tests pass a fake). See docs/design/targeted-rollout.md and
- * docs/design/prod-gateway.md (§Distribution).
- */
-const providers_prod_1 = require("./providers-prod");
-exports.DEFAULT_REGISTRY_PREFIX = 'lensmcp:gw';
-const manifestKey = (prefix, service) => `${prefix}:manifest:${service}`;
-exports.manifestKey = manifestKey;
-const rolloutKey = (prefix, service) => `${prefix}:rollout:${service}`;
-exports.rolloutKey = rolloutKey;
-const changeChannel = (prefix) => `${prefix}:changed`;
-exports.changeChannel = changeChannel;
-function parseManifest(s) {
-    try {
-        const m = JSON.parse(s);
-        return m && typeof m.service === 'string' && Array.isArray(m.mounts) ? m : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * Redis-backed source. Per-service keys (so a deploy touches only its own key,
- * no read-modify-write races): `<prefix>:manifest:<svc>` (a RouteManifest) and
- * `<prefix>:rollout:<svc>` (a VersionCohort[] | RolloutSpec). Writers publish
- * `<prefix>:changed` after a SET; the gateway re-reads on the message.
- */
-function redisRegistrySource(client, opts = {}) {
-    const prefix = opts.prefix ?? exports.DEFAULT_REGISTRY_PREFIX;
-    let sub;
-    const rolloutPrefix = `${prefix}:rollout:`;
-    return {
-        async read() {
-            const mKeys = await client.keys(`${prefix}:manifest:*`);
-            const manifests = mKeys.length
-                ? (await client.mget(...mKeys)).filter((v) => !!v).map(parseManifest).filter((m) => !!m)
-                : [];
-            const rKeys = await client.keys(`${rolloutPrefix}*`);
-            const endpoints = {};
-            if (rKeys.length) {
-                const vals = await client.mget(...rKeys);
-                rKeys.forEach((k, i) => {
-                    const v = vals[i];
-                    if (v)
-                        try {
-                            endpoints[k.slice(rolloutPrefix.length)] = JSON.parse(v);
-                        }
-                        catch { /* skip a bad entry, keep the rest */ }
-                });
-            }
-            return { manifests, endpoints };
-        },
-        async watch(onChange) {
-            sub = client.duplicate();
-            await sub.subscribe((0, exports.changeChannel)(prefix));
-            sub.on('message', () => onChange());
-            return async () => { try {
-                await sub?.quit();
-            }
-            catch { /* ignore */ } };
-        },
-        stop() { void sub?.quit().catch(() => undefined); },
-    };
-}
-/**
- * Compose a ManifestProvider + PodProvider over a RegistrySource. Both refresh
- * together on every change (source.watch) and on a poll fallback. Call
- * `start()` (awaits the first read so the route table is warm) before handing
- * the providers to `startProdGateway`.
- */
-function createRegistryProviders(source, opts = {}) {
-    const onError = opts.onError ?? (() => undefined);
-    let current = [];
-    const subs = new Set();
-    const inner = (0, providers_prod_1.rolloutPodProvider)({});
-    let unwatch;
-    let timer;
-    const refresh = async () => {
-        let snap;
-        try {
-            snap = await source.read();
-        }
-        catch (e) {
-            onError(e);
-            return;
-        } // keep last-good on a transient error
-        current = snap.manifests;
-        inner.update(snap.endpoints);
-        for (const cb of subs) {
-            try {
-                cb(current);
-            }
-            catch (e) {
-                onError(e);
-            }
-        }
-    };
-    return {
-        manifests: { list: () => current, watch: (cb) => { subs.add(cb); return () => subs.delete(cb); } },
-        pods: inner,
-        async start() {
-            await refresh();
-            if (source.watch) {
-                try {
-                    unwatch = await source.watch(() => void refresh());
-                }
-                catch (e) {
-                    onError(e);
-                }
-            }
-            timer = setInterval(() => void refresh(), opts.pollMs ?? 5000);
-            timer.unref?.();
-        },
-        stop() { unwatch?.(); if (timer)
-            clearInterval(timer); source.stop?.(); },
-    };
-}
+"use strict";var g=Object.defineProperty;var u=(e,t)=>g(e,"name",{value:t,configurable:!0});var y=Object.defineProperty,s=u((e,t)=>y(e,"name",{value:t,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.changeChannel=exports.rolloutKey=exports.manifestKey=exports.DEFAULT_REGISTRY_PREFIX=void 0,exports.redisRegistrySource=redisRegistrySource,exports.createRegistryProviders=createRegistryProviders;const providers_prod_1=require("./providers-prod");exports.DEFAULT_REGISTRY_PREFIX="lensmcp:gw";const manifestKey=s((e,t)=>`${e}:manifest:${t}`,"manifestKey");exports.manifestKey=manifestKey;const rolloutKey=s((e,t)=>`${e}:rollout:${t}`,"rolloutKey");exports.rolloutKey=rolloutKey;const changeChannel=s(e=>`${e}:changed`,"changeChannel");exports.changeChannel=changeChannel;function parseManifest(e){try{const t=JSON.parse(e);return t&&typeof t.service=="string"&&Array.isArray(t.mounts)?t:void 0}catch{return}}u(parseManifest,"parseManifest"),s(parseManifest,"parseManifest");function redisRegistrySource(e,t={}){const o=t.prefix??exports.DEFAULT_REGISTRY_PREFIX;let a;const i=`${o}:rollout:`;return{async read(){const c=await e.keys(`${o}:manifest:*`),d=c.length?(await e.mget(...c)).filter(r=>!!r).map(parseManifest).filter(r=>!!r):[],n=await e.keys(`${i}*`),l={};if(n.length){const r=await e.mget(...n);n.forEach((p,f)=>{const h=r[f];if(h)try{l[p.slice(i.length)]=JSON.parse(h)}catch{}})}return{manifests:d,endpoints:l}},async watch(c){return a=e.duplicate(),await a.subscribe((0,exports.changeChannel)(o)),a.on("message",()=>c()),async()=>{try{await a?.quit()}catch{}}},stop(){a?.quit().catch(()=>{})}}}u(redisRegistrySource,"redisRegistrySource"),s(redisRegistrySource,"redisRegistrySource");function createRegistryProviders(e,t={}){const o=t.onError??(()=>{});let a=[];const i=new Set,c=(0,providers_prod_1.rolloutPodProvider)({});let d,n;const l=s(async()=>{let r;try{r=await e.read()}catch(p){o(p);return}a=r.manifests,c.update(r.endpoints);for(const p of i)try{p(a)}catch(f){o(f)}},"refresh");return{manifests:{list:s(()=>a,"list"),watch:s(r=>(i.add(r),()=>i.delete(r)),"watch")},pods:c,async start(){if(await l(),e.watch)try{d=await e.watch(()=>{l()})}catch(r){o(r)}n=setInterval(()=>{l()},t.pollMs??5e3),n.unref?.()},stop(){d?.(),n&&clearInterval(n),e.stop?.()}}}u(createRegistryProviders,"createRegistryProviders"),s(createRegistryProviders,"createRegistryProviders");

package/executors/gateway/rollout-ops.d.ts

@@ -51,4 +51,3 @@ export declare function parseRolloutCommand(argv: string[]): {
     op?: RolloutOp;
     status?: string | undefined;
 };
-//# sourceMappingURL=rollout-ops.d.ts.map

package/executors/gateway/rollout-ops.js

@@ -1,167 +1,2 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.applyRolloutOp = applyRolloutOp;
-exports.summarizeRollout = summarizeRollout;
-exports.parseRolloutCommand = parseRolloutCommand;
-const RULE_OPS = new Set(['eq', 'ne', 'in', 'nin', 'prefix', 'suffix', 'contains', 'regex', 'exists', 'gt', 'lt', 'cidr']);
-const clone = (v) => JSON.parse(JSON.stringify(v));
-/** Normalize a service entry to a `{rules,cohorts}` spec; reject a flat url list. */
-function asSpec(service, v) {
-    if (v === undefined)
-        return { rules: [], cohorts: [] };
-    if (Array.isArray(v)) {
-        if (v.length && typeof v[0] === 'string')
-            throw new Error(`service "${service}" is a flat endpoint list; convert it to cohorts first (e.g. add-cohort)`);
-        return { rules: [], cohorts: v };
-    }
-    return { rules: v.rules ?? [], cohorts: v.cohorts ?? [] };
-}
-const findCohort = (spec, version) => spec.cohorts.find((c) => c.version === version);
-function reqWeight(w) {
-    if (!Number.isFinite(w) || w < 0)
-        throw new Error(`weight must be a number ≥ 0 (got ${w})`);
-    return w;
-}
-/** Apply one operation to the rollout table; returns a NEW table. Throws on invalid input. */
-function applyRolloutOp(config, op) {
-    const next = clone(config);
-    const spec = asSpec(op.service, next[op.service]);
-    switch (op.kind) {
-        case 'add-cohort': {
-            if (findCohort(spec, op.version))
-                throw new Error(`cohort "${op.version}" already exists on "${op.service}" — use set-weight`);
-            if (!op.urls.length)
-                throw new Error('add-cohort needs at least one upstream url');
-            spec.cohorts.push({ version: op.version, weight: reqWeight(op.weight), urls: op.urls.slice() });
-            break;
-        }
-        case 'set-weight': {
-            const c = findCohort(spec, op.version);
-            if (!c)
-                throw new Error(`no cohort "${op.version}" on "${op.service}"`);
-            c.weight = reqWeight(op.weight);
-            break;
-        }
-        case 'remove-cohort': {
-            if (!findCohort(spec, op.version))
-                throw new Error(`no cohort "${op.version}" on "${op.service}"`);
-            spec.cohorts = spec.cohorts.filter((c) => c.version !== op.version);
-            break;
-        }
-        case 'promote': {
-            if (!findCohort(spec, op.version))
-                throw new Error(`no cohort "${op.version}" on "${op.service}"`);
-            for (const c of spec.cohorts)
-                c.weight = c.version === op.version ? 100 : 0;
-            break;
-        }
-        case 'abort': {
-            const c = findCohort(spec, op.version);
-            if (!c)
-                throw new Error(`no cohort "${op.version}" on "${op.service}"`);
-            c.weight = 0;
-            break;
-        }
-        case 'add-rule': {
-            validateRule(op.rule);
-            spec.rules = [...(spec.rules ?? []).filter((r) => !op.rule.name || r.name !== op.rule.name), op.rule]; // replace-by-name (idempotent)
-            break;
-        }
-        case 'remove-rule': {
-            const before = (spec.rules ?? []).length;
-            spec.rules = (spec.rules ?? []).filter((r) => r.name !== op.name);
-            if (spec.rules.length === before)
-                throw new Error(`no rule named "${op.name}" on "${op.service}"`);
-            break;
-        }
-    }
-    next[op.service] = spec.rules && spec.rules.length ? { rules: spec.rules, cohorts: spec.cohorts } : spec.cohorts;
-    return next;
-}
-function validateRule(rule) {
-    if (!rule || typeof rule.version !== 'string' || !rule.version)
-        throw new Error('rule needs a non-empty version');
-    if (!rule.when || typeof rule.when !== 'object')
-        throw new Error('rule needs a `when` condition');
-    const walk = (n) => {
-        const node = n;
-        if ('all' in node || 'any' in node || 'not' in node) {
-            for (const k of ['all', 'any'])
-                if (Array.isArray(node[k]))
-                    node[k].forEach(walk);
-            if (node.not)
-                walk(node.not);
-            return;
-        }
-        if (typeof node.attr !== 'string' || !RULE_OPS.has(node.op))
-            throw new Error(`invalid rule condition (attr/op): ${JSON.stringify(node)}`);
-    };
-    walk(rule.when);
-}
-/** Human-readable status for one service (or all). Read-only. */
-function summarizeRollout(config, service) {
-    const names = service ? [service] : Object.keys(config);
-    if (!names.length)
-        return '(no services in rollout config)';
-    const lines = [];
-    for (const s of names) {
-        const entry = config[s];
-        if (entry === undefined) {
-            lines.push(`${s}: (not present)`);
-            continue;
-        }
-        if (Array.isArray(entry) && entry.length && typeof entry[0] === 'string') {
-            lines.push(`${s}: flat LB → ${entry.join(', ')}`);
-            continue;
-        }
-        const spec = asSpec(s, entry);
-        const total = spec.cohorts.reduce((a, c) => a + Math.max(0, c.weight), 0) || 1;
-        lines.push(`${s}:`);
-        for (const c of spec.cohorts)
-            lines.push(`  • ${c.version.padEnd(16)} weight ${String(c.weight).padStart(3)} (${(Math.max(0, c.weight) / total * 100).toFixed(0)}%)  ${c.urls.length} url(s)`);
-        for (const r of spec.rules ?? [])
-            lines.push(`  ▸ rule ${(r.name ?? '(unnamed)').padEnd(16)} → ${r.version}   ${ruleSummary(r.when)}`);
-    }
-    return lines.join('\n');
-}
-function ruleSummary(n) {
-    const node = n;
-    if ('all' in node)
-        return '(' + node.all.map(ruleSummary).join(' AND ') + ')';
-    if ('any' in node)
-        return '(' + node.any.map(ruleSummary).join(' OR ') + ')';
-    if ('not' in node)
-        return 'NOT ' + ruleSummary(node.not);
-    return `${node.attr} ${node.op}${node.value !== undefined ? ' ' + JSON.stringify(node.value) : ''}`;
-}
-/** Parse CLI argv (after the config-file path) into an op, a status request, or throw a usage error. */
-function parseRolloutCommand(argv) {
-    const [cmd, ...a] = argv;
-    const need = (n, usage) => { if (a.length < n)
-        throw new Error(`usage: ${cmd} ${usage}`); };
-    switch (cmd) {
-        case 'status': return { status: a[0] };
-        case 'add-cohort':
-            need(4, '<service> <version> <weight> <url> [url...]');
-            return { op: { kind: 'add-cohort', service: a[0], version: a[1], weight: Number(a[2]), urls: a.slice(3) } };
-        case 'set-weight':
-            need(3, '<service> <version> <weight>');
-            return { op: { kind: 'set-weight', service: a[0], version: a[1], weight: Number(a[2]) } };
-        case 'remove-cohort':
-            need(2, '<service> <version>');
-            return { op: { kind: 'remove-cohort', service: a[0], version: a[1] } };
-        case 'promote':
-            need(2, '<service> <version>');
-            return { op: { kind: 'promote', service: a[0], version: a[1] } };
-        case 'abort':
-            need(2, '<service> <version>');
-            return { op: { kind: 'abort', service: a[0], version: a[1] } };
-        case 'add-rule':
-            need(6, '<service> <name> <attr> <op> <value> <version>');
-            return { op: { kind: 'add-rule', service: a[0], rule: { name: a[1], when: { attr: a[2], op: a[3], value: a[4] }, version: a[5] } } };
-        case 'remove-rule':
-            need(2, '<service> <name>');
-            return { op: { kind: 'remove-rule', service: a[0], name: a[1] } };
-        default: throw new Error(`unknown command "${cmd ?? ''}". commands: status, add-cohort, set-weight, remove-cohort, promote, abort, add-rule, remove-rule`);
-    }
-}
+"use strict";var d=Object.defineProperty;var u=(t,r)=>d(t,"name",{value:r,configurable:!0});var h=Object.defineProperty,s=u((t,r)=>h(t,"name",{value:r,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.applyRolloutOp=applyRolloutOp,exports.summarizeRollout=summarizeRollout,exports.parseRolloutCommand=parseRolloutCommand;const RULE_OPS=new Set(["eq","ne","in","nin","prefix","suffix","contains","regex","exists","gt","lt","cidr"]),clone=s(t=>JSON.parse(JSON.stringify(t)),"clone");function asSpec(t,r){if(r===void 0)return{rules:[],cohorts:[]};if(Array.isArray(r)){if(r.length&&typeof r[0]=="string")throw new Error(`service "${t}" is a flat endpoint list; convert it to cohorts first (e.g. add-cohort)`);return{rules:[],cohorts:r}}return{rules:r.rules??[],cohorts:r.cohorts??[]}}u(asSpec,"asSpec"),s(asSpec,"asSpec");const findCohort=s((t,r)=>t.cohorts.find(o=>o.version===r),"findCohort");function reqWeight(t){if(!Number.isFinite(t)||t<0)throw new Error(`weight must be a number \u2265 0 (got ${t})`);return t}u(reqWeight,"reqWeight"),s(reqWeight,"reqWeight");function applyRolloutOp(t,r){const o=clone(t),e=asSpec(r.service,o[r.service]);switch(r.kind){case"add-cohort":{if(findCohort(e,r.version))throw new Error(`cohort "${r.version}" already exists on "${r.service}" \u2014 use set-weight`);if(!r.urls.length)throw new Error("add-cohort needs at least one upstream url");e.cohorts.push({version:r.version,weight:reqWeight(r.weight),urls:r.urls.slice()});break}case"set-weight":{const n=findCohort(e,r.version);if(!n)throw new Error(`no cohort "${r.version}" on "${r.service}"`);n.weight=reqWeight(r.weight);break}case"remove-cohort":{if(!findCohort(e,r.version))throw new Error(`no cohort "${r.version}" on "${r.service}"`);e.cohorts=e.cohorts.filter(n=>n.version!==r.version);break}case"promote":{if(!findCohort(e,r.version))throw new Error(`no cohort "${r.version}" on "${r.service}"`);for(const n of e.cohorts)n.weight=n.version===r.version?100:0;break}case"abort":{const n=findCohort(e,r.version);if(!n)throw new Error(`no cohort "${r.version}" on "${r.service}"`);n.weight=0;break}case"add-rule":{validateRule(r.rule),e.rules=[...(e.rules??[]).filter(n=>!r.rule.name||n.name!==r.rule.name),r.rule];break}case"remove-rule":{const n=(e.rules??[]).length;if(e.rules=(e.rules??[]).filter(i=>i.name!==r.name),e.rules.length===n)throw new Error(`no rule named "${r.name}" on "${r.service}"`);break}}return o[r.service]=e.rules&&e.rules.length?{rules:e.rules,cohorts:e.cohorts}:e.cohorts,o}u(applyRolloutOp,"applyRolloutOp"),s(applyRolloutOp,"applyRolloutOp");function validateRule(t){if(!t||typeof t.version!="string"||!t.version)throw new Error("rule needs a non-empty version");if(!t.when||typeof t.when!="object")throw new Error("rule needs a `when` condition");const r=s(o=>{const e=o;if("all"in e||"any"in e||"not"in e){for(const n of["all","any"])Array.isArray(e[n])&&e[n].forEach(r);e.not&&r(e.not);return}if(typeof e.attr!="string"||!RULE_OPS.has(e.op))throw new Error(`invalid rule condition (attr/op): ${JSON.stringify(e)}`)},"walk");r(t.when)}u(validateRule,"validateRule"),s(validateRule,"validateRule");function summarizeRollout(t,r){const o=r?[r]:Object.keys(t);if(!o.length)return"(no services in rollout config)";const e=[];for(const n of o){const i=t[n];if(i===void 0){e.push(`${n}: (not present)`);continue}if(Array.isArray(i)&&i.length&&typeof i[0]=="string"){e.push(`${n}: flat LB \u2192 ${i.join(", ")}`);continue}const c=asSpec(n,i),l=c.cohorts.reduce((a,v)=>a+Math.max(0,v.weight),0)||1;e.push(`${n}:`);for(const a of c.cohorts)e.push(`  \u2022 ${a.version.padEnd(16)} weight ${String(a.weight).padStart(3)} (${(Math.max(0,a.weight)/l*100).toFixed(0)}%)  ${a.urls.length} url(s)`);for(const a of c.rules??[])e.push(`  \u25B8 rule ${(a.name??"(unnamed)").padEnd(16)} \u2192 ${a.version}   ${ruleSummary(a.when)}`)}return e.join(`
+`)}u(summarizeRollout,"summarizeRollout"),s(summarizeRollout,"summarizeRollout");function ruleSummary(t){const r=t;return"all"in r?"("+r.all.map(ruleSummary).join(" AND ")+")":"any"in r?"("+r.any.map(ruleSummary).join(" OR ")+")":"not"in r?"NOT "+ruleSummary(r.not):`${r.attr} ${r.op}${r.value!==void 0?" "+JSON.stringify(r.value):""}`}u(ruleSummary,"ruleSummary"),s(ruleSummary,"ruleSummary");function parseRolloutCommand(t){const[r,...o]=t,e=s((n,i)=>{if(o.length<n)throw new Error(`usage: ${r} ${i}`)},"need");switch(r){case"status":return{status:o[0]};case"add-cohort":return e(4,"<service> <version> <weight> <url> [url...]"),{op:{kind:"add-cohort",service:o[0],version:o[1],weight:Number(o[2]),urls:o.slice(3)}};case"set-weight":return e(3,"<service> <version> <weight>"),{op:{kind:"set-weight",service:o[0],version:o[1],weight:Number(o[2])}};case"remove-cohort":return e(2,"<service> <version>"),{op:{kind:"remove-cohort",service:o[0],version:o[1]}};case"promote":return e(2,"<service> <version>"),{op:{kind:"promote",service:o[0],version:o[1]}};case"abort":return e(2,"<service> <version>"),{op:{kind:"abort",service:o[0],version:o[1]}};case"add-rule":return e(6,"<service> <name> <attr> <op> <value> <version>"),{op:{kind:"add-rule",service:o[0],rule:{name:o[1],when:{attr:o[2],op:o[3],value:o[4]},version:o[5]}}};case"remove-rule":return e(2,"<service> <name>"),{op:{kind:"remove-rule",service:o[0],name:o[1]}};default:throw new Error(`unknown command "${r??""}". commands: status, add-cohort, set-weight, remove-cohort, promote, abort, add-rule, remove-rule`)}}u(parseRolloutCommand,"parseRolloutCommand"),s(parseRolloutCommand,"parseRolloutCommand");

package/executors/gateway/runtime/auth.d.ts

@@ -17,4 +17,3 @@ export interface EdgeVerifierPool {
     stop(): void;
 }
 export declare function createEdgeAuth(rt: GatewayRuntime, obs: Observability, verifiers?: EdgeVerifierPool): EdgeAuth;
-//# sourceMappingURL=auth.d.ts.map

package/executors/gateway/runtime/auth.js

@@ -1,64 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createEdgeAuth = createEdgeAuth;
-/**
- * The edge-auth layer (the JWT seam). Two boundaries, ONE source so the HTTP
- * handler and the WS upgrade can't drift:
- *  - `internal(...)`: validate the CALLER's `x-api-key` on an `internal.<host>`
- *    route, stamp `x-api-key-id` (audit) + `__lensmcpCaller`.
- *  - `public(...)`: verify the end-user JWT, enforce per-route rules, inject
- *    trusted identity — mirroring the prod gateway. Only enforced when the
- *    service declares `cluster.auth` (opt-in; un-migrated services stay open).
- * Each returns a verdict; the caller turns a denial into its own rejection
- * (the handler → `finishTrace` + `sendError`; the upgrade → `socket.destroy()`).
- */
-const manifest_1 = require("../manifest");
-const dev_auth_1 = require("./dev-auth");
-function createEdgeAuth(rt, obs, verifiers) {
-    const { traceStep } = obs;
-    const internal = (req, _route, trace) => {
-        // service-to-service: validate the CALLER's api key at the boundary
-        const presented = String(req.headers['x-api-key'] ?? '');
-        const caller = rt.keyToProject.get(presented);
-        if (!caller) {
-            traceStep(trace, 'auth', { mode: 'x-api-key', ok: false });
-            return { ok: false, status: 401, reason: 'unauthorized', detail: 'Invalid or missing x-api-key for internal route.' };
-        }
-        req.headers['x-api-key-id'] = caller; // audit + lens attribution
-        req.__lensmcpCaller = caller;
-        delete req.headers['x-api-key'];
-        traceStep(trace, 'auth', { mode: 'x-api-key', ok: true, caller });
-        return { ok: true, caller };
-    };
-    const publicAuth = (req, route, trace) => {
-        const policy = route.auth;
-        if (policy) {
-            const url0 = (req.url ?? '/').split('?')[0];
-            const method = (req.method ?? 'GET').toUpperCase();
-            const resolved = (0, manifest_1.authRuleFor)(policy, url0, method);
-            if (resolved.mode === 'jwt') {
-                // The verifier for THIS request's host (per-apex IdP resolution in a shared
-                // multi-workspace daemon; the host is the ROUTED host — trusted exactly the
-                // way routing itself trusts it, never taken from the token).
-                const reqHost = String(req.headers.host ?? '').split(':')[0].toLowerCase();
-                const claims = (0, dev_auth_1.verifyDevJwt)(req, verifiers?.for(reqHost));
-                if (!claims) {
-                    traceStep(trace, 'auth', { mode: 'jwt', ok: false });
-                    return { ok: false, status: 401, reason: 'unauthorized', detail: 'Unauthorized: invalid or missing token' };
-                }
-                if (resolved.rule && !(0, manifest_1.evalRule)(resolved.rule, (0, dev_auth_1.devAttrs)(req, claims))) {
-                    traceStep(trace, 'authz', { ok: false });
-                    return { ok: false, status: 403, reason: 'forbidden', detail: 'Forbidden: insufficient permission' };
-                }
-                (0, dev_auth_1.stampIdentity)(req, claims);
-                traceStep(trace, 'auth', { mode: 'jwt', ok: true });
-                return { ok: true, claims };
-            }
-            traceStep(trace, 'auth', { mode: resolved.mode });
-            return { ok: true };
-        }
-        traceStep(trace, 'auth', { mode: 'public', unconfigured: true });
-        return { ok: true };
-    };
-    return { internal, public: publicAuth };
-}
+"use strict";var m=Object.defineProperty;var l=(o,i)=>m(o,"name",{value:i,configurable:!0});var f=Object.defineProperty,n=l((o,i)=>f(o,"name",{value:i,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createEdgeAuth=createEdgeAuth;const manifest_1=require("../manifest"),dev_auth_1=require("./dev-auth");function createEdgeAuth(o,i,h){const{traceStep:r}=i;return{internal:n((e,c,t)=>{const u=String(e.headers["x-api-key"]??""),a=o.keyToProject.get(u);return a?(e.headers["x-api-key-id"]=a,e.__lensmcpCaller=a,delete e.headers["x-api-key"],r(t,"auth",{mode:"x-api-key",ok:!0,caller:a}),{ok:!0,caller:a}):(r(t,"auth",{mode:"x-api-key",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Invalid or missing x-api-key for internal route."})},"internal"),public:n((e,c,t)=>{const u=c.auth;if(u){const a=(e.url??"/").split("?")[0],p=(e.method??"GET").toUpperCase(),s=(0,manifest_1.authRuleFor)(u,a,p);if(s.mode==="jwt"){const k=String(e.headers.host??"").split(":")[0].toLowerCase(),d=(0,dev_auth_1.verifyDevJwt)(e,h?.for(k));return d?s.rule&&!(0,manifest_1.evalRule)(s.rule,(0,dev_auth_1.devAttrs)(e,d))?(r(t,"authz",{ok:!1}),{ok:!1,status:403,reason:"forbidden",detail:"Forbidden: insufficient permission"}):((0,dev_auth_1.stampIdentity)(e,d),r(t,"auth",{mode:"jwt",ok:!0}),{ok:!0,claims:d}):(r(t,"auth",{mode:"jwt",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: invalid or missing token"})}return r(t,"auth",{mode:s.mode}),{ok:!0}}return r(t,"auth",{mode:"public",unconfigured:!0}),{ok:!0}},"publicAuth")}}l(createEdgeAuth,"createEdgeAuth"),n(createEdgeAuth,"createEdgeAuth");

package/executors/gateway/runtime/chooser.d.ts

@@ -11,4 +11,3 @@ import { type WorkspaceEntry } from './workspace-registry';
 export declare function renderChooserPage(entries: WorkspaceEntry[], currentKey: string): string;
 /** Serve the chooser at the dashboard-host root. Reads the registry fresh so live status is current. */
 export declare function serveChooser(res: http.ServerResponse, currentKey: string): void;
-//# sourceMappingURL=chooser.d.ts.map

package/executors/gateway/runtime/chooser.js

@@ -1,42 +1,16 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.renderChooserPage = renderChooserPage;
-exports.serveChooser = serveChooser;
-const workspace_registry_1 = require("./workspace-registry");
-const esc = (s) => s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
-/** Render the chooser HTML from the registry entries (+ which key is running in THIS gateway). */
-function renderChooserPage(entries, currentKey) {
-    const rows = entries
-        .map((e) => ({ ...e, live: e.key === currentKey || (0, workspace_registry_1.isWorkspaceLive)(e) }))
-        .sort((a, b) => Number(b.live) - Number(a.live) || a.key.localeCompare(b.key));
-    const cards = rows.length === 0
-        ? `<p class="empty">No workspaces registered yet. Start a gateway in a workspace (<code>lensmcp gateway start</code>) and it will appear here.</p>`
-        : rows
-            .map((e) => {
-            const here = e.key === currentKey;
-            const badge = here
-                ? `<span class="badge here">running here</span>`
-                : e.live
-                    ? `<span class="badge live">live</span>`
-                    : `<span class="badge off">offline</span>`;
-            // The whole card is the anchor for a live workspace (no nested <a>); a `<div>` when offline.
-            const action = e.live
-                ? `<span class="open">Open dashboard →</span>`
-                : `<span class="hint">start its gateway to open</span>`;
-            const inner = `<div class="card-main">
-      <div class="key">${esc(e.key)} ${badge}</div>
+"use strict";var l=Object.defineProperty;var n=(a,o)=>l(a,"name",{value:o,configurable:!0});var p=Object.defineProperty,t=n((a,o)=>p(a,"name",{value:o,configurable:!0}),"t");Object.defineProperty(exports,"__esModule",{value:!0}),exports.renderChooserPage=renderChooserPage,exports.serveChooser=serveChooser;const workspace_registry_1=require("./workspace-registry"),esc=t(a=>a.replace(/[&<>"']/g,o=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[o]),"esc");function renderChooserPage(a,o){const r=a.map(e=>({...e,live:e.key===o||(0,workspace_registry_1.isWorkspaceLive)(e)})).sort((e,s)=>Number(s.live)-Number(e.live)||e.key.localeCompare(s.key)),c=r.length===0?'<p class="empty">No workspaces registered yet. Start a gateway in a workspace (<code>lensmcp gateway start</code>) and it will appear here.</p>':r.map(e=>{const s=e.key===o?'<span class="badge here">running here</span>':e.live?'<span class="badge live">live</span>':'<span class="badge off">offline</span>',d=e.live?'<span class="open">Open dashboard \u2192</span>':'<span class="hint">start its gateway to open</span>',i=`<div class="card-main">
+      <div class="key">${esc(e.key)} ${s}</div>
       <div class="root">${esc(e.root)}</div>
     </div>
-    <div class="card-action">${action}</div>`;
-            return e.live
-                ? `<a class="card is-live" href="${esc(e.base)}/">\n    ${inner}\n  </a>`
-                : `<div class="card is-off">\n    ${inner}\n  </div>`;
-        })
-            .join('\n');
-    return `<!doctype html>
+    <div class="card-action">${d}</div>`;return e.live?`<a class="card is-live" href="${esc(e.base)}/">
+    ${i}
+  </a>`:`<div class="card is-off">
+    ${i}
+  </div>`}).join(`
+`);return`<!doctype html>
 <html lang="en"><head>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
-<title>LensMCP · workspaces</title>
+<title>LensMCP \xB7 workspaces</title>
 <style>
   :root { color-scheme: dark; }
   * { box-sizing: border-box; }
@@ -68,17 +42,10 @@ function renderChooserPage(entries, currentKey) {
 <body><div class="wrap">
   <header>
     <h1>LensMCP workspaces</h1>
-    <p class="sub">Pick a workspace to open its dashboard. ${rows.filter((r) => r.live).length} live · ${rows.length} known.</p>
+    <p class="sub">Pick a workspace to open its dashboard. ${r.filter(e=>e.live).length} live \xB7 ${r.length} known.</p>
   </header>
   <div class="list">
-${cards}
+${c}
   </div>
   <footer>Served by the gateway on <code>lensmcp.local</code>. This list updates as gateways start and stop.</footer>
-</div></body></html>`;
-}
-/** Serve the chooser at the dashboard-host root. Reads the registry fresh so live status is current. */
-function serveChooser(res, currentKey) {
-    const html = renderChooserPage((0, workspace_registry_1.readWorkspaces)(), currentKey);
-    res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
-    res.end(html);
-}
+</div></body></html>`}n(renderChooserPage,"renderChooserPage"),t(renderChooserPage,"renderChooserPage");function serveChooser(a,o){const r=renderChooserPage((0,workspace_registry_1.readWorkspaces)(),o);a.writeHead(200,{"content-type":"text/html; charset=utf-8","cache-control":"no-store"}),a.end(r)}n(serveChooser,"serveChooser"),t(serveChooser,"serveChooser");

package/executors/gateway/runtime/control.d.ts

@@ -18,4 +18,3 @@ export interface ControlServer {
 /** Start the control listener. The socket is loopback-only (a filesystem socket), so no IP allow-listing
  *  is needed — anything that can open it is already on this machine as this user. */
 export declare function startControlServer(deps: ControlServerDeps): ControlServer;
-//# sourceMappingURL=control.d.ts.map

package/executors/gateway/runtime/control.js

@@ -1,128 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.controlSocketPath = controlSocketPath;
-exports.startControlServer = startControlServer;
-const tslib_1 = require("tslib");
-/**
- * The daemon CONTROL PLANE (planning/multi-workspace-gateway.md P3, model A). A UNIX-socket HTTP listener
- * at `~/.lensmcp/control.sock` — loopback-only by nature (a filesystem socket, no TCP), so a second
- * workspace's `gateway start` (P4) REGISTERS its fragment into the running `:443` daemon instead of
- * fighting for the port. The daemon reconstructs the fragment via `discoverRoutes` on the second
- * workspace's root (so it owns the pool controllers + spawns those devservers itself — model A), merges
- * the routes live, and reaps them on unregister.
- *
- *   POST /register    { wsKey, root, projects }  → discover + register + rebuild
- *   POST /unregister  { wsKey }                  → unregister + reap its services + rebuild
- *   GET  /list                                   → the registered workspaces
- */
-const fs = tslib_1.__importStar(require("node:fs"));
-const http = tslib_1.__importStar(require("node:http"));
-const os = tslib_1.__importStar(require("node:os"));
-const path = tslib_1.__importStar(require("node:path"));
-const discovery_1 = require("./discovery");
-/** `~/.lensmcp/control.sock` — the well-known daemon control socket (override the home via `LENSMCP_HOME`). */
-function controlSocketPath() {
-    const home = process.env['LENSMCP_HOME'] || os.homedir();
-    return path.join(home, '.lensmcp', 'control.sock');
-}
-function readJsonBody(req) {
-    return new Promise((resolve, reject) => {
-        let raw = '';
-        req.on('data', (c) => {
-            raw += c;
-            if (raw.length > 1_000_000)
-                reject(new Error('body too large')); // bound the loopback input
-        });
-        req.on('end', () => {
-            try {
-                resolve(raw ? JSON.parse(raw) : {});
-            }
-            catch (e) {
-                reject(e);
-            }
-        });
-        req.on('error', reject);
-    });
-}
-/** Start the control listener. The socket is loopback-only (a filesystem socket), so no IP allow-listing
- *  is needed — anything that can open it is already on this machine as this user. */
-function startControlServer(deps) {
-    const { rt } = deps;
-    const socketPath = controlSocketPath();
-    fs.mkdirSync(path.dirname(socketPath), { recursive: true });
-    try {
-        fs.unlinkSync(socketPath);
-    }
-    catch { /* no stale socket to clear */ }
-    const send = (res, code, body) => {
-        res.writeHead(code, { 'content-type': 'application/json' });
-        res.end(JSON.stringify(body));
-    };
-    const server = http.createServer((req, res) => {
-        void (async () => {
-            try {
-                const url = (req.url ?? '').split('?')[0];
-                if (req.method === 'GET' && url === '/list') {
-                    return send(res, 200, {
-                        workspaces: rt.registry.keys().map((key) => {
-                            const f = rt.registry.get(key);
-                            return { key, root: f?.root, routes: f?.routes.length ?? 0, services: f?.services.length ?? 0 };
-                        }),
-                    });
-                }
-                // A RICHER status than /list: the daemon's own identity + every registered workspace (flagged if it
-                // OWNS the daemon) + per-service live state (down|starting|up). The IDE plugin + `gateway status --json`
-                // consume this to render the active gateway, its workspaces, and each service's health at a glance.
-                if (req.method === 'GET' && url === '/status') {
-                    return send(res, 200, {
-                        daemon: { pid: process.pid, wsKey: rt.wsKey },
-                        workspaces: rt.registry.keys().map((key) => {
-                            const f = rt.registry.get(key);
-                            return { key, root: f?.root, routes: f?.routes.length ?? 0, services: f?.services.length ?? 0, isDaemon: key === rt.wsKey };
-                        }),
-                        services: rt.registry.allServices().map((s) => ({ project: s.project, wsKey: s.wsKey, host: s.decl.host, state: s.state })),
-                    });
-                }
-                if (req.method === 'POST' && url === '/register') {
-                    const body = (await readJsonBody(req));
-                    if (!body.wsKey || !body.root)
-                        return send(res, 400, { error: 'wsKey and root are required' });
-                    const { routes, services } = (0, discovery_1.discoverRoutes)(body.root, body.projects ?? {}, undefined, body.wsKey);
-                    const fragment = { wsKey: body.wsKey, root: body.root, routes, services };
-                    rt.registry.register(fragment);
-                    await deps.onRegister?.(fragment); // hosts the dashboard + APPENDS its route to the fragment BEFORE the rebuild
-                    rt.rebuildRoutes();
-                    return send(res, 200, { ok: true, wsKey: body.wsKey, routes: routes.length, services: services.length, workspaces: rt.registry.keys() });
-                }
-                if (req.method === 'POST' && url === '/unregister') {
-                    const body = (await readJsonBody(req));
-                    if (!body.wsKey)
-                        return send(res, 400, { error: 'wsKey is required' });
-                    const dropped = rt.registry.unregister(body.wsKey);
-                    if (dropped) {
-                        for (const svc of dropped.services)
-                            deps.killService(svc, 'workspace unregistered');
-                        deps.onUnregister?.(dropped);
-                    }
-                    rt.rebuildRoutes();
-                    return send(res, 200, { ok: true, removed: !!dropped, workspaces: rt.registry.keys() });
-                }
-                send(res, 404, { error: 'not found' });
-            }
-            catch (e) {
-                send(res, 500, { error: e.message });
-            }
-        })();
-    });
-    server.listen(socketPath);
-    return {
-        socketPath,
-        close: () => {
-            server.close();
-            try {
-                fs.unlinkSync(socketPath);
-            }
-            catch { /* already gone */ }
-        },
-    };
-}
+"use strict";var h=Object.defineProperty;var d=(o,r)=>h(o,"name",{value:r,configurable:!0});var p=Object.defineProperty,y=d((o,r)=>p(o,"name",{value:r,configurable:!0}),"y");Object.defineProperty(exports,"__esModule",{value:!0}),exports.controlSocketPath=controlSocketPath,exports.startControlServer=startControlServer;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),http=tslib_1.__importStar(require("node:http")),os=tslib_1.__importStar(require("node:os")),path=tslib_1.__importStar(require("node:path")),discovery_1=require("./discovery");function controlSocketPath(){const o=process.env.LENSMCP_HOME||os.homedir();return path.join(o,".lensmcp","control.sock")}d(controlSocketPath,"controlSocketPath"),y(controlSocketPath,"controlSocketPath");function readJsonBody(o){return new Promise((r,c)=>{let s="";o.on("data",u=>{s+=u,s.length>1e6&&c(new Error("body too large"))}),o.on("end",()=>{try{r(s?JSON.parse(s):{})}catch(u){c(u)}}),o.on("error",c)})}d(readJsonBody,"readJsonBody"),y(readJsonBody,"readJsonBody");function startControlServer(o){const{rt:r}=o,c=controlSocketPath();fs.mkdirSync(path.dirname(c),{recursive:!0});try{fs.unlinkSync(c)}catch{}const s=y((n,i,a)=>{n.writeHead(i,{"content-type":"application/json"}),n.end(JSON.stringify(a))},"send"),u=http.createServer((n,i)=>{(async()=>{try{const a=(n.url??"").split("?")[0];if(n.method==="GET"&&a==="/list")return s(i,200,{workspaces:r.registry.keys().map(e=>{const t=r.registry.get(e);return{key:e,root:t?.root,routes:t?.routes.length??0,services:t?.services.length??0}})});if(n.method==="GET"&&a==="/status")return s(i,200,{daemon:{pid:process.pid,wsKey:r.wsKey},workspaces:r.registry.keys().map(e=>{const t=r.registry.get(e);return{key:e,root:t?.root,routes:t?.routes.length??0,services:t?.services.length??0,isDaemon:e===r.wsKey}}),services:r.registry.allServices().map(e=>({project:e.project,wsKey:e.wsKey,host:e.decl.host,state:e.state}))});if(n.method==="POST"&&a==="/register"){const e=await readJsonBody(n);if(!e.wsKey||!e.root)return s(i,400,{error:"wsKey and root are required"});const{routes:t,services:l}=(0,discovery_1.discoverRoutes)(e.root,e.projects??{},void 0,e.wsKey),g={wsKey:e.wsKey,root:e.root,routes:t,services:l};return r.registry.register(g),await o.onRegister?.(g),r.rebuildRoutes(),s(i,200,{ok:!0,wsKey:e.wsKey,routes:t.length,services:l.length,workspaces:r.registry.keys()})}if(n.method==="POST"&&a==="/unregister"){const e=await readJsonBody(n);if(!e.wsKey)return s(i,400,{error:"wsKey is required"});const t=r.registry.unregister(e.wsKey);if(t){for(const l of t.services)o.killService(l,"workspace unregistered");o.onUnregister?.(t)}return r.rebuildRoutes(),s(i,200,{ok:!0,removed:!!t,workspaces:r.registry.keys()})}s(i,404,{error:"not found"})}catch(a){s(i,500,{error:a.message})}})()});return u.listen(c),{socketPath:c,close:y(()=>{u.close();try{fs.unlinkSync(c)}catch{}},"close")}}d(startControlServer,"startControlServer"),y(startControlServer,"startControlServer");

package/executors/gateway/runtime/dev-auth.d.ts

@@ -13,4 +13,3 @@ export declare function verifyDevJwt(req: http.IncomingMessage, verifier?: JwtVe
 export declare function stampIdentity(req: http.IncomingMessage, claims: Record<string, unknown>): void;
 /** Build the ABAC attribute bag from the verified claims + request envelope. */
 export declare const devAttrs: (req: http.IncomingMessage, claims: Record<string, unknown>) => Attrs;
-//# sourceMappingURL=dev-auth.d.ts.map