@lensmcp/cluster 1.18.3 → 1.18.6

package/executors/gateway/runtime/dev-auth.js

@@ -1,108 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.devAttrs = void 0;
-exports.verifyDevJwt = verifyDevJwt;
-exports.stampIdentity = stampIdentity;
-/**
- * Dev edge auth: verify the end-user token, then stamp the trusted identity headers the services read
- * (via GatewayTrustGuard). It MIRRORS the prod gateway's posture — a real JWKS/RS256 verifier when one is
- * wired (see `../jwks-verify` + the composition in `server.ts`), an HS256 shared-secret path as the legacy
- * fallback. Pure functions (the verifier is injected, so unit tests supply their own JWKS).
- *
- * SECURITY (the invariant this file must hold): a `jwt` route MUST NOT accept a token whose signature the
- * edge cannot verify. When a JWKS verifier is wired it is the SOLE acceptor — every alg goes through it, so
- * an unknown `kid`, a bad signature, `alg:none`, an HS256-confusion token, and an expired token ALL fail
- * closed (rejected). Without a verifier, an asymmetric (RS256/ES*) token cannot be checked (we don't hold
- * the issuer's public keys), so it also fails closed — unless an operator EXPLICITLY opts into the old
- * insecure decode-only path (`LENSMCP_GW_DEV_JWT_INSECURE_DECODE=1`) for local bring-up. The HS256
- * shared-secret path stays for services using that convention (and is itself bypassed once JWKS is wired).
- */
-const node_crypto_1 = require("node:crypto");
-/** The compact JWS from the `Authorization: Bearer …` header, or undefined. */
-function bearerToken(req) {
-    const raw = Array.isArray(req.headers['authorization']) ? req.headers['authorization'][0] : req.headers['authorization'];
-    const auth = String(raw ?? '');
-    return auth.startsWith('Bearer ') ? auth.slice(7) : undefined;
-}
-/**
- * Verify the end-user JWT and return its claims, or undefined.
- *
- * @param verifier when provided (the RS256/JWKS verifier wired by the composition root), it is the ONLY
- *   acceptor — the token is verified against the issuer's published keys by `kid`, so a rogue key / unknown
- *   kid / bad signature / `alg:none` / HS256-confusion / expired token all return undefined (fail closed).
- */
-function verifyDevJwt(req, verifier) {
-    const token = bearerToken(req);
-    if (!token)
-        return undefined;
-    const [h, p, s] = token.split('.');
-    if (!h || !p || !s)
-        return undefined;
-    // Preferred: a real JWKS/RS256 verifier (mirrors the prod gateway's `jwks ? jwks.verify(tok) : hs256`).
-    // When wired it is the SOLE acceptor, so every forgery vector below is closed at once.
-    if (verifier)
-        return verifier.verify(token);
-    // ── No verifier wired (legacy dev) ──────────────────────────────────────────────────────────────────
-    let alg;
-    try {
-        alg = JSON.parse(Buffer.from(h, 'base64url').toString())['alg'];
-    }
-    catch {
-        return undefined;
-    }
-    if (typeof alg === 'string' && alg !== 'HS256') {
-        // An asymmetric IdP (RS256 + JWKS) does NOT use the HS256 dev shared secret. Without the issuer's public
-        // keys we CANNOT verify the signature, so — unlike the old code, which decode-accepted any RS256 token
-        // (a full edge auth bypass: a rogue key or a forged `alg:none` sailed through) — we FAIL CLOSED. Wire a
-        // JWKS verifier (LENSMCP_GW_JWKS_URL, or the auto-derived auth-host JWKS) to accept RS256 tokens.
-        if (process.env['LENSMCP_GW_DEV_JWT_INSECURE_DECODE'] !== '1')
-            return undefined; // fail closed
-        // Explicit, dev-only opt-in to the legacy decode + exp-check (NO signature check) — bring-up escape hatch.
-        try {
-            const rsClaims = JSON.parse(Buffer.from(p, 'base64url').toString());
-            if (typeof rsClaims['exp'] === 'number' && Date.now() / 1000 > rsClaims['exp'])
-                return undefined;
-            return rsClaims;
-        }
-        catch {
-            return undefined;
-        }
-    }
-    // HS256 shared-secret convention (only reachable when NO JWKS verifier is wired).
-    const secret = process.env['AUTH_JWT_SECRET'] ?? 'tetros-dev-secret';
-    const expected = (0, node_crypto_1.createHmac)('sha256', secret).update(`${h}.${p}`).digest('base64url');
-    const a = Buffer.from(s);
-    const b = Buffer.from(expected);
-    if (a.length !== b.length || !(0, node_crypto_1.timingSafeEqual)(a, b))
-        return undefined;
-    try {
-        const claims = JSON.parse(Buffer.from(p, 'base64url').toString());
-        if (typeof claims['exp'] === 'number' && Date.now() / 1000 > claims['exp'])
-            return undefined;
-        return claims;
-    }
-    catch {
-        return undefined;
-    }
-}
-/** Stamp verified identity onto the forwarded request — tenant from the `tid` CLAIM, never a client header. */
-function stampIdentity(req, claims) {
-    const set = (k, v) => { if (v !== undefined && v !== null && v !== '')
-        req.headers[k] = String(v); };
-    set('x-user-id', claims['sub']);
-    set('x-tenant-id', claims['tid']);
-    const roles = claims['roles'];
-    if (Array.isArray(roles) && roles.length)
-        req.headers['x-user-roles'] = roles.map(String).join(',');
-    const perms = claims['perms'];
-    if (Array.isArray(perms) && perms.length)
-        req.headers['x-user-permissions'] = perms.map(String).join(',');
-}
-/** Build the ABAC attribute bag from the verified claims + request envelope. */
-const devAttrs = (req, claims) => ({
-    ...claims,
-    ip: req.socket.remoteAddress ?? '',
-    method: (req.method ?? 'GET').toUpperCase(),
-    path: (req.url ?? '/').split('?')[0],
-});
-exports.devAttrs = devAttrs;
+"use strict";var y=Object.defineProperty;var a=(e,r)=>y(e,"name",{value:r,configurable:!0});var h=Object.defineProperty,u=a((e,r)=>h(e,"name",{value:r,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.devAttrs=void 0,exports.verifyDevJwt=verifyDevJwt,exports.stampIdentity=stampIdentity;const node_crypto_1=require("node:crypto");function bearerToken(e){const r=Array.isArray(e.headers.authorization)?e.headers.authorization[0]:e.headers.authorization,t=String(r??"");return t.startsWith("Bearer ")?t.slice(7):void 0}a(bearerToken,"bearerToken"),u(bearerToken,"bearerToken");function verifyDevJwt(e,r){const t=bearerToken(e);if(!t)return;const[n,s,f]=t.split(".");if(!n||!s||!f)return;if(r)return r.verify(t);let o;try{o=JSON.parse(Buffer.from(n,"base64url").toString()).alg}catch{return}if(typeof o=="string"&&o!=="HS256"){if(process.env.LENSMCP_GW_DEV_JWT_INSECURE_DECODE!=="1")return;try{const i=JSON.parse(Buffer.from(s,"base64url").toString());return typeof i.exp=="number"&&Date.now()/1e3>i.exp?void 0:i}catch{return}}const d=process.env.AUTH_JWT_SECRET??"tetros-dev-secret",l=(0,node_crypto_1.createHmac)("sha256",d).update(`${n}.${s}`).digest("base64url"),p=Buffer.from(f),c=Buffer.from(l);if(!(p.length!==c.length||!(0,node_crypto_1.timingSafeEqual)(p,c)))try{const i=JSON.parse(Buffer.from(s,"base64url").toString());return typeof i.exp=="number"&&Date.now()/1e3>i.exp?void 0:i}catch{return}}a(verifyDevJwt,"verifyDevJwt"),u(verifyDevJwt,"verifyDevJwt");function stampIdentity(e,r){const t=u((f,o)=>{o!=null&&o!==""&&(e.headers[f]=String(o))},"set");t("x-user-id",r.sub),t("x-tenant-id",r.tid);const n=r.roles;Array.isArray(n)&&n.length&&(e.headers["x-user-roles"]=n.map(String).join(","));const s=r.perms;Array.isArray(s)&&s.length&&(e.headers["x-user-permissions"]=s.map(String).join(","))}a(stampIdentity,"stampIdentity"),u(stampIdentity,"stampIdentity");const devAttrs=u((e,r)=>({...r,ip:e.socket.remoteAddress??"",method:(e.method??"GET").toUpperCase(),path:(e.url??"/").split("?")[0]}),"devAttrs");exports.devAttrs=devAttrs;

package/executors/gateway/runtime/discovery.d.ts

@@ -14,4 +14,3 @@ export declare function discoverRoutes(rootDir: string, projects: Record<string,
     routes: Route[];
     services: ServiceCtl[];
 };
-//# sourceMappingURL=discovery.d.ts.map

package/executors/gateway/runtime/discovery.js

@@ -1,123 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.pickSock = pickSock;
-exports.lensPortFromUpstream = lensPortFromUpstream;
-exports.discoverRoutes = discoverRoutes;
-const tslib_1 = require("tslib");
-/**
- * Route discovery + socket-pool round-robin. Pure (fs reads only): reads every
- * project's `cluster` (or legacy `davnx`) declaration and builds the route table.
- */
-const fs = tslib_1.__importStar(require("node:fs"));
-const os = tslib_1.__importStar(require("node:os"));
-const path = tslib_1.__importStar(require("node:path"));
-const manifest_1 = require("../manifest");
-const scope_1 = require("./scope");
-/** Round-robin over the pool's sockets, rescanning the dir when the cache ages out. */
-function pickSock(pool, scanTtlMs = 1500) {
-    const now = Date.now();
-    if (now - pool.scannedAt > scanTtlMs) {
-        try {
-            pool.socks = fs.readdirSync(pool.dir)
-                .filter((f) => /^child-\d+\.sock$/.test(f))
-                .map((f) => path.join(pool.dir, f));
-        }
-        catch {
-            pool.socks = [];
-        }
-        pool.scannedAt = now;
-    }
-    if (pool.socks.length === 0)
-        return undefined;
-    pool.idx = (pool.idx + 1) % pool.socks.length;
-    return pool.socks[pool.idx];
-}
-/** Extract the port from an `upstream` URL like `http://localhost:5173`. */
-function lensPortFromUpstream(upstream) {
-    if (!upstream)
-        return undefined;
-    const m = /:(\d+)/.exec(upstream);
-    return m ? Number(m[1]) : undefined;
-}
-/**
- * Read every project's `cluster` (or legacy `davnx`) declaration and build
- * the route table: host routes first (plus auto `internal.<host>` for pod
- * services), the `default` catch-all last.
- */
-function discoverRoutes(rootDir, projects, sockBaseDir = os.tmpdir(), 
-// The workspace key namespaces the pod sock dir (planning/multi-workspace-gateway.md) — MUST match
-// `main.devserver.ts`'s `SOCK_DIR` derivation so the gateway scans the same dir the devserver writes.
-// Empty → the legacy un-namespaced path (single-workspace / pre-multi-workspace).
-wsKey = '') {
-    const sockDirFor = (service) => wsKey ? path.join(sockBaseDir, wsKey, `${service}-devserver`) : path.join(sockBaseDir, `${service}-devserver`);
-    const routes = [];
-    const services = [];
-    const hosts = []; // every declared host — the default's apex is derived from these
-    let defaultRoute;
-    for (const [name, p] of Object.entries(projects)) {
-        let decl;
-        try {
-            const raw = JSON.parse(fs.readFileSync(path.join(rootDir, p.root, 'project.json'), 'utf8'));
-            decl = raw.cluster ?? raw.davnx;
-        }
-        catch {
-            continue;
-        }
-        if (!decl)
-            continue;
-        let pool;
-        let svc;
-        let target;
-        let lens;
-        if (decl.service) {
-            // `lens` applies to FRONTEND apps only; a pod service is already
-            // instrumented by the serve executor's node-instrumentation graft.
-            if (decl.lens)
-                console.warn(`[gateway] ${name}: cluster.lens is ignored for pod (service) decls — backends are instrumented by serve-hmr.`);
-            pool = { dir: sockDirFor(decl.service), socks: [], idx: -1, scannedAt: 0 };
-            svc = { project: name, decl, root: rootDir, wsKey, pool, state: 'down', lastUsed: Date.now(), inflight: 0, lastScaleAt: 0 };
-            services.push(svc);
-        }
-        else if (decl.lens) {
-            // Lens-mode frontend: the gateway SPAWNS this app's Vite + instrumentation
-            // (deterministically on `port`) and upstreams to it. One LensFrontend per
-            // project is SHARED across its host/default routes (so the spawn fires once).
-            const port = decl.port ?? lensPortFromUpstream(decl.upstream) ?? 5173;
-            target = `http://localhost:${port}`;
-            lens = { project: name, projectRoot: path.join(rootDir, p.root), port };
-        }
-        else {
-            target = decl.upstream ?? (decl.port ? `http://localhost:${decl.port}` : undefined);
-            if (!target) {
-                console.warn(`[gateway] ${name}: no service/upstream/port — skipped.`);
-                continue;
-            }
-        }
-        const base = { project: name, prependPrefix: decl.prependPrefix, target, pool, svc, prefix: decl.path, auth: decl.auth, lens };
-        if (decl.host) {
-            routes.push({ ...base, host: decl.host });
-            hosts.push(decl.host);
-            // internal.<host>: east-west traffic, same pods, NO middleware.
-            if (pool && decl.internalHost !== false) {
-                routes.push({
-                    ...base,
-                    host: typeof decl.internalHost === 'string' ? decl.internalHost : `internal.${decl.host}`,
-                    internal: true,
-                });
-            }
-        }
-        if (decl.default)
-            defaultRoute = { ...base, prefix: undefined };
-    }
-    if (defaultRoute) {
-        // Stamp the apex so a shared multi-workspace gateway routes an unclaimed host to THIS workspace's
-        // default (see matchRoute). Harmless for a single workspace — one default ignores its apex.
-        defaultRoute.apex = (0, scope_1.baseDomainOf)(hosts);
-        routes.push(defaultRoute);
-    }
-    // specificity sort (shared with prod): host+path beats host-only beats
-    // catch-all — so a path-mounted service (api.x/channels) wins over the
-    // host's owner (api.x → api).
-    (0, manifest_1.sortBySpecificity)(routes);
-    return { routes, services };
-}
+"use strict";var S=Object.defineProperty;var p=(e,r)=>S(e,"name",{value:r,configurable:!0});var k=Object.defineProperty,a=p((e,r)=>k(e,"name",{value:r,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0}),exports.pickSock=pickSock,exports.lensPortFromUpstream=lensPortFromUpstream,exports.discoverRoutes=discoverRoutes;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),os=tslib_1.__importStar(require("node:os")),path=tslib_1.__importStar(require("node:path")),manifest_1=require("../manifest"),scope_1=require("./scope");function pickSock(e,r=1500){const i=Date.now();if(i-e.scannedAt>r){try{e.socks=fs.readdirSync(e.dir).filter(s=>/^child-\d+\.sock$/.test(s)).map(s=>path.join(e.dir,s))}catch{e.socks=[]}e.scannedAt=i}if(e.socks.length!==0)return e.idx=(e.idx+1)%e.socks.length,e.socks[e.idx]}p(pickSock,"pickSock"),a(pickSock,"pickSock");function lensPortFromUpstream(e){if(!e)return;const r=/:(\d+)/.exec(e);return r?Number(r[1]):void 0}p(lensPortFromUpstream,"lensPortFromUpstream"),a(lensPortFromUpstream,"lensPortFromUpstream");function discoverRoutes(e,r,i=os.tmpdir(),s=""){const y=a(t=>s?path.join(i,s,`${t}-devserver`):path.join(i,`${t}-devserver`),"sockDirFor"),n=[],v=[],m=[];let l;for(const[t,x]of Object.entries(r)){let o;try{const c=JSON.parse(fs.readFileSync(path.join(e,x.root,"project.json"),"utf8"));o=c.cluster??c.davnx}catch{continue}if(!o)continue;let d,f,u,j;if(o.service)o.lens&&console.warn(`[gateway] ${t}: cluster.lens is ignored for pod (service) decls \u2014 backends are instrumented by serve-hmr.`),d={dir:y(o.service),socks:[],idx:-1,scannedAt:0},f={project:t,decl:o,root:e,wsKey:s,pool:d,state:"down",lastUsed:Date.now(),inflight:0,lastScaleAt:0},v.push(f);else if(o.lens){const c=o.port??lensPortFromUpstream(o.upstream)??5173;u=`http://localhost:${c}`,j={project:t,projectRoot:path.join(e,x.root),port:c}}else if(u=o.upstream??(o.port?`http://localhost:${o.port}`:void 0),!u){console.warn(`[gateway] ${t}: no service/upstream/port \u2014 skipped.`);continue}const h={project:t,prependPrefix:o.prependPrefix,target:u,pool:d,svc:f,prefix:o.path,auth:o.auth,lens:j};o.host&&(n.push({...h,host:o.host}),m.push(o.host),d&&o.internalHost!==!1&&n.push({...h,host:typeof o.internalHost=="string"?o.internalHost:`internal.${o.host}`,internal:!0})),o.default&&(l={...h,prefix:void 0})}return l&&(l.apex=(0,scope_1.baseDomainOf)(m),n.push(l)),(0,manifest_1.sortBySpecificity)(n),{routes:n,services:v}}p(discoverRoutes,"discoverRoutes"),a(discoverRoutes,"discoverRoutes");

package/executors/gateway/runtime/edge.d.ts

@@ -28,4 +28,3 @@ export declare const corsPreflight: (req: http.IncomingMessage, res: http.Server
 /** Allowed-methods lists for the two preflight sites. */
 export declare const PREFLIGHT_METHODS_NOROUTE = "GET,HEAD,OPTIONS";
 export declare const PREFLIGHT_METHODS_ROUTED = "GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS";
-//# sourceMappingURL=edge.d.ts.map

package/executors/gateway/runtime/edge.js

@@ -1,47 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PREFLIGHT_METHODS_ROUTED = exports.PREFLIGHT_METHODS_NOROUTE = exports.corsPreflight = exports.cors = exports.GATEWAY_OWNED_HEADERS = exports.sendError = void 0;
-const gateway_errors_1 = require("../gateway-errors");
-/**
- * Send a gateway-generated edge error as the JSON envelope `{ key, status, traceId, message? }` (NOT
- * `text/plain`) + an `x-request-id` header — the SAME localized contract a service returns, so a browser
- * app renders `t(key)` and surfaces the trace id. Mirrors the prod gateway's `sendError`.
- */
-const sendError = (res, req, status, reason, detail) => {
-    const traceId = (0, gateway_errors_1.ensureRequestId)(req);
-    if (!res.headersSent)
-        res.writeHead(status, { 'content-type': gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE, 'x-request-id': traceId });
-    res.end((0, gateway_errors_1.gatewayErrorBody)(status, reason, traceId, detail));
-};
-exports.sendError = sendError;
-/**
- * The gateway OWNS these headers — strip any client-supplied copy at ingress so identity + trust can
- * only originate from the gateway (mirrors the prod gateway's stripTrust). Applied at the very top of
- * BOTH the HTTP handler and the WS upgrade.
- */
-exports.GATEWAY_OWNED_HEADERS = ['x-internal-token', 'x-api-key-id', 'x-user-id', 'x-tenant-id', 'x-user-roles', 'x-user-permissions'];
-/** Reflect the request Origin back with credentials — the gateway is the edge CORS authority. */
-const cors = (req, res) => {
-    const origin = String(req.headers.origin ?? '*');
-    res.setHeader('access-control-allow-origin', origin);
-    res.setHeader('access-control-allow-credentials', 'true');
-    res.setHeader('vary', 'Origin');
-};
-exports.cors = cors;
-/**
- * Answer a CORS preflight (OPTIONS) at the edge: reflect CORS + 204 with the allowed `methods` and the
- * requested headers echoed back. `methods` differs by caller — the no-route host-root uses the narrow
- * `GET,HEAD,OPTIONS`; a routed path uses the wide verb list.
- */
-const corsPreflight = (req, res, methods) => {
-    (0, exports.cors)(req, res);
-    res.writeHead(204, {
-        'access-control-allow-methods': methods,
-        'access-control-allow-headers': String(req.headers['access-control-request-headers'] ?? '*'),
-    });
-    res.end();
-};
-exports.corsPreflight = corsPreflight;
-/** Allowed-methods lists for the two preflight sites. */
-exports.PREFLIGHT_METHODS_NOROUTE = 'GET,HEAD,OPTIONS';
-exports.PREFLIGHT_METHODS_ROUTED = 'GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS';
+"use strict";var i=Object.defineProperty;var a=(r,e)=>i(r,"name",{value:e,configurable:!0});var c=Object.defineProperty,s=a((r,e)=>c(r,"name",{value:e,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.PREFLIGHT_METHODS_ROUTED=exports.PREFLIGHT_METHODS_NOROUTE=exports.corsPreflight=exports.cors=exports.GATEWAY_OWNED_HEADERS=exports.sendError=void 0;const gateway_errors_1=require("../gateway-errors"),sendError=s((r,e,o,n,E)=>{const t=(0,gateway_errors_1.ensureRequestId)(e);r.headersSent||r.writeHead(o,{"content-type":gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE,"x-request-id":t}),r.end((0,gateway_errors_1.gatewayErrorBody)(o,n,t,E))},"sendError");exports.sendError=sendError,exports.GATEWAY_OWNED_HEADERS=["x-internal-token","x-api-key-id","x-user-id","x-tenant-id","x-user-roles","x-user-permissions"];const cors=s((r,e)=>{const o=String(r.headers.origin??"*");e.setHeader("access-control-allow-origin",o),e.setHeader("access-control-allow-credentials","true"),e.setHeader("vary","Origin")},"cors");exports.cors=cors;const corsPreflight=s((r,e,o)=>{(0,exports.cors)(r,e),e.writeHead(204,{"access-control-allow-methods":o,"access-control-allow-headers":String(r.headers["access-control-request-headers"]??"*")}),e.end()},"corsPreflight");exports.corsPreflight=corsPreflight,exports.PREFLIGHT_METHODS_NOROUTE="GET,HEAD,OPTIONS",exports.PREFLIGHT_METHODS_ROUTED="GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS";

package/executors/gateway/runtime/handler.d.ts

@@ -21,4 +21,3 @@ export interface HandlerDeps {
     hooks: HooksLayer;
 }
 export declare function createHandler(deps: HandlerDeps): http.RequestListener;
-//# sourceMappingURL=handler.d.ts.map

package/executors/gateway/runtime/handler.js

@@ -1,183 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createHandler = createHandler;
-const manifest_1 = require("../manifest");
-const gateway_errors_1 = require("../gateway-errors");
-const discovery_1 = require("./discovery");
-const edge_1 = require("./edge");
-const observability_1 = require("./observability");
-const chooser_1 = require("./chooser");
-function createHandler(deps) {
-    const { rt, obs, auth, proxy, hooks } = deps;
-    const match = (req) => (0, manifest_1.matchRoute)(rt.routes, (req.headers.host || '').split(':')[0], req.url ?? '/');
-    // Host-root infra: when a host only has PATH-mounted services (pure
-    // microservices under api.<domain>/{prefix}), the gateway itself owns the
-    // root — CORS, health aggregation + service discovery, like a real edge.
-    const handleNoRoute = (req, res) => {
-        // gateway-owned endpoints are cross-origin by design (the app calls
-        // api.<domain>/health from app.<domain>) — answer CORS here; routed
-        // paths inherit CORS from the services themselves.
-        (0, edge_1.cors)(req, res);
-        if (req.method === 'OPTIONS') {
-            res.writeHead(204, {
-                'access-control-allow-methods': edge_1.PREFLIGHT_METHODS_NOROUTE,
-                'access-control-allow-headers': String(req.headers['access-control-request-headers'] ?? '*'),
-            });
-            res.end();
-            return;
-        }
-        const host = (req.headers.host || '').split(':')[0];
-        const mounted = rt.routes.filter((r) => r.host && (0, manifest_1.hostMatches)(r.host, host) && r.prefix);
-        const url = (req.url ?? '/').split('?')[0];
-        // The lens dashboard HOST ROOT → the multi-workspace chooser. The dashboard itself mounts at `/<key>`,
-        // so the bare `/` is unrouted and lands here; serve the landing page listing every known workspace.
-        if ((url === '/' || url === '/index.html' || url === '') &&
-            rt.routes.some((r) => r.host && (0, manifest_1.hostMatches)(r.host, host) && r.project === observability_1.LENS_DASHBOARD_PROJECT)) {
-            (0, chooser_1.serveChooser)(res, rt.wsKey);
-            return;
-        }
-        if (mounted.length > 0 && (url === '/health' || url === '/healthz')) {
-            const services = mounted.map((r) => ({
-                project: r.project,
-                prefix: r.prefix,
-                pods: r.pool ? ((0, discovery_1.pickSock)(r.pool, 0), r.pool.socks.length) : undefined,
-                state: r.svc?.state ?? (r.target ? 'up' : 'unknown'),
-            }));
-            const ok = services.every((s) => s.state !== 'down' || true);
-            res.writeHead(ok ? 200 : 503, { 'content-type': 'application/json' });
-            res.end(JSON.stringify({ status: 'ok', host, services }, null, 2));
-            return;
-        }
-        if (mounted.length > 0 && url === '/.well-known/services') {
-            res.writeHead(200, { 'content-type': 'application/json' });
-            res.end(JSON.stringify({ host, services: mounted.map((r) => ({ prefix: r.prefix, project: r.project, internal: !!r.internal })) }, null, 2));
-            return;
-        }
-        (0, edge_1.sendError)(res, req, 404, 'not_found', mounted.length > 0
-            ? `No service mounted at ${url}. Mounted on ${host}: ${[...new Set(mounted.map((r) => r.prefix))].join(', ')} (+ /health, /.well-known/services)`
-            : 'No gateway route for this hostname.');
-    };
-    const runPipeline = async (req, res) => {
-        // 0. HTTP/2 carries the host in the `:authority` pseudo-header, NOT `host` — the
-        // http2 compat layer exposes it as `req.authority` and omits `host` from `req.headers`.
-        // Every downstream step (route match, trace, CORS) reads `req.headers.host`, so
-        // normalize it here before anything else. No-op for HTTP/1.1 (host is already set).
-        if (!req.headers.host) {
-            const authority = req.authority ?? req.headers[':authority'];
-            if (authority)
-                req.headers.host = authority;
-        }
-        // 1. STRIP client-supplied trust headers before anything else: the gateway is
-        // the ONLY party allowed to assert `x-internal-token` (came through me) and
-        // `x-api-key-id` (validated caller identity). Without this, a keyless/TCP route
-        // would leak a spoofed token and any public route would forward a spoofed caller
-        // id to downstream audit. The gateway re-stamps them below where earned.
-        for (const h of edge_1.GATEWAY_OWNED_HEADERS)
-            delete req.headers[h];
-        // 2. Mint a trace id for EVERY request (not just lens-traced ones): forwarded to the
-        // pod (adopted as its traceId) and returned on the response — any request is traceable.
-        (0, gateway_errors_1.ensureRequestId)(req);
-        const trace = obs.beginTrace(req);
-        if (trace) {
-            obs.traceStep(trace, 'received', { host: trace.host, method: trace.method, url: trace.url });
-            req.__lensmcpTrace = trace;
-        }
-        const ctx = hooks.httpContext(req, res, trace);
-        try {
-            // 3. onRequest (sees already-stripped headers; may short-circuit)
-            if (hooks.has('onRequest')) {
-                await hooks.run('onRequest', ctx);
-                if (ctx.responded())
-                    return;
-            }
-            // 4. route match
-            const route = match(req);
-            if (!route) {
-                handleNoRoute(req, res);
-                return;
-            }
-            ctx.route = route;
-            obs.traceStep(trace, 'route-match', {
-                project: route.project,
-                ...(route.prefix ? { prefix: route.prefix } : {}),
-                ...(route.host ? { routeHost: route.host } : {}),
-                ...(route.internal ? { internal: true } : {}),
-            });
-            // 7. CORS preflight on a ROUTED path: answer it HERE, BEFORE edge auth — an OPTIONS preflight
-            // carries no token by spec, so the JWT (or x-api-key) enforcement below would 401 it and the
-            // browser's CORS check fails. The matching real request still goes through auth normally.
-            if (req.method === 'OPTIONS') {
-                (0, edge_1.cors)(req, res);
-                res.writeHead(204, {
-                    'access-control-allow-methods': edge_1.PREFLIGHT_METHODS_ROUTED,
-                    'access-control-allow-headers': String(req.headers['access-control-request-headers'] ?? '*'),
-                });
-                res.end();
-                return;
-            }
-            // 8. CORS on EVERY routed response — including the 401/403/5xx the gateway generates ITSELF
-            // below. Without this a gateway-generated error short-circuits before the upstream (which
-            // carries CORS on success), so the browser sees the error WITHOUT an Access-Control-Allow-Origin
-            // and reports a CORS failure that MASKS the real status. On success the upstream's CORS header
-            // overwrites this one (http-proxy setHeader), so there's no duplicate.
-            (0, edge_1.cors)(req, res);
-            // 9. beforeAuth
-            if (hooks.has('beforeAuth')) {
-                await hooks.run('beforeAuth', ctx);
-                if (ctx.responded())
-                    return;
-            }
-            // 10/11. auth + authz. internal.* validates the caller's api-key; public verifies the end-user
-            // JWT + enforces per-route rules. Custom middleware (afterAuth) runs AFTER core auth, public ONLY.
-            if (route.internal) {
-                const v = auth.internal(req, route, trace);
-                if (!v.ok) {
-                    obs.finishTrace(trace, route.project, v.status);
-                    (0, edge_1.sendError)(res, req, v.status, v.reason, v.detail);
-                    return;
-                }
-                ctx.caller = v.caller;
-            }
-            else {
-                const v = auth.public(req, route, trace);
-                if (!v.ok) {
-                    obs.finishTrace(trace, route.project, v.status);
-                    (0, edge_1.sendError)(res, req, v.status, v.reason, v.detail);
-                    return;
-                }
-                ctx.claims = v.claims;
-                if (hooks.has('afterAuth')) {
-                    await hooks.run('afterAuth', ctx);
-                    if (ctx.responded())
-                        return;
-                }
-            }
-            // 12. inject the target service's key so pods trust the gateway (pool routes, both branches)
-            if (route.pool && rt.serviceKeys[route.project]) {
-                req.headers['x-internal-token'] = rt.serviceKeys[route.project];
-            }
-            // 13. beforeForward (last chance to mutate headers/url)
-            if (hooks.has('beforeForward')) {
-                await hooks.run('beforeForward', ctx);
-                if (ctx.responded())
-                    return;
-            }
-            // 15. onResponse — fire user handlers once the response closes (the built-in
-            // recordEdge/finishTrace live in proxy.forward's own close handler).
-            if (hooks.has('onResponse')) {
-                res.on('close', () => { ctx.status = res.statusCode ?? 0; void hooks.run('onResponse', ctx); });
-            }
-            // 14. forward
-            void proxy.forward(route, req, res);
-        }
-        catch (e) {
-            // A hook (or the pipeline) threw — narrate via onError, then 500 if nobody responded.
-            ctx.error = e;
-            if (hooks.has('onError'))
-                await hooks.run('onError', ctx);
-            if (!ctx.responded())
-                (0, edge_1.sendError)(res, req, 500, 'internal', e.message);
-        }
-    };
-    return (req, res) => { void runPipeline(req, res); };
-}
+"use strict";var E=Object.defineProperty;var d=(l,i)=>E(l,"name",{value:i,configurable:!0});var v=Object.defineProperty,h=d((l,i)=>v(l,"name",{value:i,configurable:!0}),"h");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHandler=createHandler;const manifest_1=require("../manifest"),gateway_errors_1=require("../gateway-errors"),discovery_1=require("./discovery"),edge_1=require("./edge"),observability_1=require("./observability"),chooser_1=require("./chooser");function createHandler(l){const{rt:i,obs:u,auth:p,proxy:f,hooks:a}=l,w=h(e=>(0,manifest_1.matchRoute)(i.routes,(e.headers.host||"").split(":")[0],e.url??"/"),"match"),m=h((e,o)=>{if((0,edge_1.cors)(e,o),e.method==="OPTIONS"){o.writeHead(204,{"access-control-allow-methods":edge_1.PREFLIGHT_METHODS_NOROUTE,"access-control-allow-headers":String(e.headers["access-control-request-headers"]??"*")}),o.end();return}const n=(e.headers.host||"").split(":")[0],s=i.routes.filter(r=>r.host&&(0,manifest_1.hostMatches)(r.host,n)&&r.prefix),t=(e.url??"/").split("?")[0];if((t==="/"||t==="/index.html"||t==="")&&i.routes.some(r=>r.host&&(0,manifest_1.hostMatches)(r.host,n)&&r.project===observability_1.LENS_DASHBOARD_PROJECT)){(0,chooser_1.serveChooser)(o,i.wsKey);return}if(s.length>0&&(t==="/health"||t==="/healthz")){const r=s.map(c=>({project:c.project,prefix:c.prefix,pods:c.pool?((0,discovery_1.pickSock)(c.pool,0),c.pool.socks.length):void 0,state:c.svc?.state??(c.target?"up":"unknown")})),_=r.every(c=>c.state!=="down"||!0);o.writeHead(_?200:503,{"content-type":"application/json"}),o.end(JSON.stringify({status:"ok",host:n,services:r},null,2));return}if(s.length>0&&t==="/.well-known/services"){o.writeHead(200,{"content-type":"application/json"}),o.end(JSON.stringify({host:n,services:s.map(r=>({prefix:r.prefix,project:r.project,internal:!!r.internal}))},null,2));return}(0,edge_1.sendError)(o,e,404,"not_found",s.length>0?`No service mounted at ${t}. Mounted on ${n}: ${[...new Set(s.map(r=>r.prefix))].join(", ")} (+ /health, /.well-known/services)`:"No gateway route for this hostname.")},"handleNoRoute"),y=h(async(e,o)=>{if(!e.headers.host){const t=e.authority??e.headers[":authority"];t&&(e.headers.host=t)}for(const t of edge_1.GATEWAY_OWNED_HEADERS)delete e.headers[t];(0,gateway_errors_1.ensureRequestId)(e);const n=u.beginTrace(e);n&&(u.traceStep(n,"received",{host:n.host,method:n.method,url:n.url}),e.__lensmcpTrace=n);const s=a.httpContext(e,o,n);try{if(a.has("onRequest")&&(await a.run("onRequest",s),s.responded()))return;const t=w(e);if(!t){m(e,o);return}if(s.route=t,u.traceStep(n,"route-match",{project:t.project,...t.prefix?{prefix:t.prefix}:{},...t.host?{routeHost:t.host}:{},...t.internal?{internal:!0}:{}}),e.method==="OPTIONS"){(0,edge_1.cors)(e,o),o.writeHead(204,{"access-control-allow-methods":edge_1.PREFLIGHT_METHODS_ROUTED,"access-control-allow-headers":String(e.headers["access-control-request-headers"]??"*")}),o.end();return}if((0,edge_1.cors)(e,o),a.has("beforeAuth")&&(await a.run("beforeAuth",s),s.responded()))return;if(t.internal){const r=p.internal(e,t,n);if(!r.ok){u.finishTrace(n,t.project,r.status),(0,edge_1.sendError)(o,e,r.status,r.reason,r.detail);return}s.caller=r.caller}else{const r=p.public(e,t,n);if(!r.ok){u.finishTrace(n,t.project,r.status),(0,edge_1.sendError)(o,e,r.status,r.reason,r.detail);return}if(s.claims=r.claims,a.has("afterAuth")&&(await a.run("afterAuth",s),s.responded()))return}if(t.pool&&i.serviceKeys[t.project]&&(e.headers["x-internal-token"]=i.serviceKeys[t.project]),a.has("beforeForward")&&(await a.run("beforeForward",s),s.responded()))return;a.has("onResponse")&&o.on("close",()=>{s.status=o.statusCode??0,a.run("onResponse",s)}),f.forward(t,e,o)}catch(t){s.error=t,a.has("onError")&&await a.run("onError",s),s.responded()||(0,edge_1.sendError)(o,e,500,"internal",t.message)}},"runPipeline");return(e,o)=>{y(e,o)}}d(createHandler,"createHandler"),h(createHandler,"createHandler");

package/executors/gateway/runtime/hooks.d.ts

@@ -20,4 +20,3 @@ export interface HooksLayer {
     upgradeContext(req: http.IncomingMessage, socket: stream.Duplex, trace: GwTrace | undefined): HookContext;
 }
 export declare function createHooks(hooks: GatewayHooks): HooksLayer;
-//# sourceMappingURL=hooks.d.ts.map

package/executors/gateway/runtime/hooks.js

@@ -1,55 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createHooks = createHooks;
-const edge_1 = require("./edge");
-// Terminal phases observe a request whose response is ALREADY complete, so
-// `responded()` is true by definition — they must run every handler regardless.
-// The request-flow phases short-circuit the moment a handler responds.
-const TERMINAL_PHASES = new Set(['onResponse', 'onError']);
-function createHooks(hooks) {
-    const run = async (phase, ctx) => {
-        const list = hooks[phase];
-        if (!list || list.length === 0)
-            return;
-        const terminal = TERMINAL_PHASES.has(phase);
-        for (const h of list) {
-            if (!terminal && ctx.responded())
-                return; // a request-flow hook already responded → stop
-            await h(ctx);
-        }
-    };
-    const has = (phase) => (hooks[phase]?.length ?? 0) > 0;
-    const httpContext = (req, res, trace) => ({
-        req,
-        res,
-        socket: undefined,
-        trace,
-        route: undefined,
-        claims: undefined,
-        caller: undefined,
-        pod: undefined,
-        error: undefined,
-        status: undefined,
-        sendError: (status, reason, detail) => (0, edge_1.sendError)(res, req, status, reason, detail),
-        responded: () => res.writableEnded || res.headersSent,
-    });
-    const upgradeContext = (req, socket, trace) => ({
-        req,
-        res: undefined,
-        socket,
-        trace,
-        route: undefined,
-        claims: undefined,
-        caller: undefined,
-        pod: undefined,
-        error: undefined,
-        status: undefined,
-        // No HTTP response on an upgrade — short-circuiting means destroying the socket.
-        sendError: () => { try {
-            socket.destroy();
-        }
-        catch { /* already gone */ } },
-        responded: () => socket.destroyed,
-    });
-    return { run, has, httpContext, upgradeContext };
-}
+"use strict";var u=Object.defineProperty;var i=(t,e)=>u(t,"name",{value:e,configurable:!0});var a=Object.defineProperty,n=i((t,e)=>a(t,"name",{value:e,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHooks=createHooks;const edge_1=require("./edge"),TERMINAL_PHASES=new Set(["onResponse","onError"]);function createHooks(t){return{run:n(async(e,r)=>{const o=t[e];if(!o||o.length===0)return;const d=TERMINAL_PHASES.has(e);for(const s of o){if(!d&&r.responded())return;await s(r)}},"run"),has:n(e=>(t[e]?.length??0)>0,"has"),httpContext:n((e,r,o)=>({req:e,res:r,socket:void 0,trace:o,route:void 0,claims:void 0,caller:void 0,pod:void 0,error:void 0,status:void 0,sendError:n((d,s,c)=>(0,edge_1.sendError)(r,e,d,s,c),"sendError"),responded:n(()=>r.writableEnded||r.headersSent,"responded")}),"httpContext"),upgradeContext:n((e,r,o)=>({req:e,res:void 0,socket:r,trace:o,route:void 0,claims:void 0,caller:void 0,pod:void 0,error:void 0,status:void 0,sendError:n(()=>{try{r.destroy()}catch{}},"sendError"),responded:n(()=>r.destroyed,"responded")}),"upgradeContext")}}i(createHooks,"createHooks"),n(createHooks,"createHooks");

package/executors/gateway/runtime/lens-children.d.ts

@@ -57,4 +57,3 @@ export interface LensChildren {
 export declare function createLensChildren(rt: GatewayRuntime, obs: Observability, options: GatewayRuntimeOptions, deps?: {
     isPortFree?: (port: number) => Promise<boolean>;
 }): LensChildren;
-//# sourceMappingURL=lens-children.d.ts.map