@lensmcp/cluster 1.18.4 → 1.18.6

package/create-webpack-prod.js

@@ -1,169 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createProdWebpackConfig = createProdWebpackConfig;
-const tslib_1 = require("tslib");
-const app_plugin_1 = require("@nx/webpack/app-plugin");
-const fs = tslib_1.__importStar(require("node:fs"));
-const path = tslib_1.__importStar(require("node:path"));
-const glob_1 = require("glob");
-const webpack_node_externals_1 = tslib_1.__importDefault(require("webpack-node-externals"));
-const build_scope_patterns_1 = require("./build-scope-patterns");
-function createProdWebpackConfig(options) {
-    const { appRoot, outputDir, main, tsConfig, workspaceRoot, assets = [], additionalEntryPoints = [], runtimeDependencies = [], memoryLimit = 8192, generatePackageJson = true, buildLibsFromSource = false, ormConfigPath, migrationsDir = './src/migrations', orgScopes = [], bundlePackages = [], nodeExternalsConfig: userNodeExternalsConfig, webpackConfigPath, } = options;
-    const { allowlistPatterns, scopePrefixes, scopePatterns } = (0, build_scope_patterns_1.buildScopePatterns)(orgScopes);
-    // Build combined allowlist: orgScopes + bundlePackages + user-provided
-    const bundlePatterns = bundlePackages.map((pkg) => new RegExp(`^${pkg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(/|$)`));
-    const combinedAllowlist = [
-        ...allowlistPatterns,
-        ...bundlePatterns,
-        ...(userNodeExternalsConfig?.allowlist || []),
-    ];
-    // Detect ormconfig.ts for the app so we can build it for TypeORM CLI in production
-    let resolvedOrmConfigPath;
-    if (ormConfigPath !== undefined) {
-        resolvedOrmConfigPath = ormConfigPath ? path.join(appRoot, ormConfigPath) : null;
-    }
-    else {
-        const candidate = path.join(appRoot, './src/ormconfig.ts');
-        resolvedOrmConfigPath = fs.existsSync(candidate) ? candidate : null;
-    }
-    const hasOrmconfig = resolvedOrmConfigPath && fs.existsSync(resolvedOrmConfigPath);
-    const webpackConfigs = [];
-    const externalsConfig = [
-        (0, webpack_node_externals_1.default)({
-            allowlist: combinedAllowlist,
-            additionalModuleDirs: userNodeExternalsConfig?.additionalModuleDirs || [],
-            ...(userNodeExternalsConfig?.importType && { importType: userNodeExternalsConfig.importType }),
-        }),
-        ({ request }, callback) => {
-            // Workspace-internal absolute requests are SOURCE regardless of the
-            // bucket layout (apps/, libs/, server/, shared/, web/, …) — bundle them.
-            if (request &&
-                path.isAbsolute(request) &&
-                request.startsWith(workspaceRoot) &&
-                !request.includes('node_modules')) {
-                return callback();
-            }
-            if (request &&
-                (request.startsWith(path.join(workspaceRoot, 'apps')) ||
-                    request.startsWith(path.join(workspaceRoot, 'libs')))) {
-                return callback();
-            }
-            if (request && scopePrefixes.some((prefix) => request.startsWith(prefix))) {
-                return callback();
-            }
-            if (request && scopePatterns.some((pattern) => pattern.test(request))) {
-                return callback();
-            }
-            if (request && bundlePatterns.some((pattern) => pattern.test(request))) {
-                return callback();
-            }
-            if (request && !(request.startsWith('./') || request.startsWith('..'))) {
-                // Bare specifier: only a real node_modules package may stay external —
-                // tsconfig-path aliases (e.g. @org/contracts → workspace source) must bundle.
-                const rootSegment = request.startsWith('@')
-                    ? request.split('/').slice(0, 2).join('/')
-                    : request.split('/')[0];
-                if (!fs.existsSync(path.join(workspaceRoot, 'node_modules', rootSegment))) {
-                    return callback();
-                }
-                return callback(null, `commonjs ${request}`);
-            }
-            return callback();
-        },
-    ];
-    const productionBuildConfig = {
-        externals: externalsConfig,
-        output: {
-            path: outputDir,
-            clean: false,
-        },
-        devtool: 'inline-source-map',
-        mode: 'production',
-        plugins: [
-            new app_plugin_1.NxAppWebpackPlugin({
-                target: 'node22',
-                compiler: 'tsc',
-                main,
-                additionalEntryPoints,
-                externalDependencies: [],
-                mergeExternals: true,
-                memoryLimit,
-                tsConfig,
-                assets,
-                namedChunks: true,
-                optimization: true,
-                outputHashing: 'none',
-                generatePackageJson,
-                runtimeDependencies,
-                buildLibsFromSource,
-                typeCheckOptions: {
-                    async: false,
-                },
-                sourceMap: 'inline-source-map',
-                progress: false,
-            }),
-        ],
-    };
-    webpackConfigs.push(productionBuildConfig);
-    if (hasOrmconfig && resolvedOrmConfigPath) {
-        const migrationsEntryPoints = [];
-        const migrationsGlobPath = path.join(appRoot, migrationsDir, '*.ts');
-        const migrationFiles = (0, glob_1.globSync)(migrationsGlobPath);
-        migrationFiles.forEach((filename) => {
-            const migrationName = path.basename(filename, '.ts');
-            migrationsEntryPoints.push({
-                entryName: `migrations/${migrationName}`,
-                entryPath: filename,
-            });
-        });
-        const ormconfigRelative = './' + path.relative(appRoot, resolvedOrmConfigPath);
-        const ormconfigBuildConfig = {
-            ...productionBuildConfig,
-            output: {
-                ...productionBuildConfig.output,
-                filename: (pathData) => {
-                    if (pathData.runtime === 'main') {
-                        return 'ormconfig.js';
-                    }
-                    return '[name].js';
-                },
-                library: {
-                    type: 'commonjs',
-                },
-                clean: false,
-            },
-            devtool: false,
-            plugins: [
-                new app_plugin_1.NxAppWebpackPlugin({
-                    target: 'node22',
-                    compiler: 'tsc',
-                    main: ormconfigRelative,
-                    externalDependencies: [],
-                    additionalEntryPoints: migrationsEntryPoints,
-                    mergeExternals: true,
-                    tsConfig,
-                    assets: [],
-                    namedChunks: true,
-                    memoryLimit,
-                    optimization: false,
-                    outputHashing: 'none',
-                    generatePackageJson: false,
-                    buildLibsFromSource,
-                    skipTypeChecking: true,
-                    sourceMap: false,
-                    progress: !process.env.CI,
-                }),
-            ],
-        };
-        webpackConfigs.push(ormconfigBuildConfig);
-    }
-    // Apply user webpack overrides if configured
-    if (webpackConfigPath) {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const overrideModule = require(path.resolve(appRoot, webpackConfigPath));
-        const overrideFn = overrideModule.default || overrideModule;
-        return webpackConfigs.map((config) => overrideFn(config));
-    }
-    return webpackConfigs;
-}
+"use strict";var A=Object.defineProperty;var d=(o,n)=>A(o,"name",{value:n,configurable:!0});var F=Object.defineProperty,m=d((o,n)=>F(o,"name",{value:n,configurable:!0}),"m");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createProdWebpackConfig=createProdWebpackConfig;const tslib_1=require("tslib"),app_plugin_1=require("@nx/webpack/app-plugin"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path")),glob_1=require("glob"),webpack_node_externals_1=tslib_1.__importDefault(require("webpack-node-externals")),build_scope_patterns_1=require("./build-scope-patterns");function createProdWebpackConfig(o){const{appRoot:n,outputDir:P,main:_,tsConfig:g,workspaceRoot:r,assets:k=[],additionalEntryPoints:x=[],runtimeDependencies:C=[],memoryLimit:b=8192,generatePackageJson:j=!0,buildLibsFromSource:f=!1,ormConfigPath:c,migrationsDir:W="./src/migrations",orgScopes:w=[],bundlePackages:S=[],nodeExternalsConfig:a,webpackConfigPath:h}=o,{allowlistPatterns:v,scopePrefixes:D,scopePatterns:q}=(0,build_scope_patterns_1.buildScopePatterns)(w),y=S.map(e=>new RegExp(`^${e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}(/|$)`)),E=[...v,...y,...a?.allowlist||[]];let s;if(c!==void 0)s=c?path.join(n,c):null;else{const e=path.join(n,"./src/ormconfig.ts");s=fs.existsSync(e)?e:null}const $=s&&fs.existsSync(s),p=[],u={externals:[(0,webpack_node_externals_1.default)({allowlist:E,additionalModuleDirs:a?.additionalModuleDirs||[],...a?.importType&&{importType:a.importType}}),({request:e},i)=>{if(e&&path.isAbsolute(e)&&e.startsWith(r)&&!e.includes("node_modules")||e&&(e.startsWith(path.join(r,"apps"))||e.startsWith(path.join(r,"libs")))||e&&D.some(t=>e.startsWith(t))||e&&q.some(t=>t.test(e))||e&&y.some(t=>t.test(e)))return i();if(e&&!(e.startsWith("./")||e.startsWith(".."))){const t=e.startsWith("@")?e.split("/").slice(0,2).join("/"):e.split("/")[0];return fs.existsSync(path.join(r,"node_modules",t))?i(null,`commonjs ${e}`):i()}return i()}],output:{path:P,clean:!1},devtool:"inline-source-map",mode:"production",plugins:[new app_plugin_1.NxAppWebpackPlugin({target:"node22",compiler:"tsc",main:_,additionalEntryPoints:x,externalDependencies:[],mergeExternals:!0,memoryLimit:b,tsConfig:g,assets:k,namedChunks:!0,optimization:!0,outputHashing:"none",generatePackageJson:j,runtimeDependencies:C,buildLibsFromSource:f,typeCheckOptions:{async:!1},sourceMap:"inline-source-map",progress:!1})]};if(p.push(u),$&&s){const e=[],i=path.join(n,W,"*.ts");(0,glob_1.globSync)(i).forEach(l=>{const M=path.basename(l,".ts");e.push({entryName:`migrations/${M}`,entryPath:l})});const t="./"+path.relative(n,s),L={...u,output:{...u.output,filename:m(l=>l.runtime==="main"?"ormconfig.js":"[name].js","filename"),library:{type:"commonjs"},clean:!1},devtool:!1,plugins:[new app_plugin_1.NxAppWebpackPlugin({target:"node22",compiler:"tsc",main:t,externalDependencies:[],additionalEntryPoints:e,mergeExternals:!0,tsConfig:g,assets:[],namedChunks:!0,memoryLimit:b,optimization:!1,outputHashing:"none",generatePackageJson:!1,buildLibsFromSource:f,skipTypeChecking:!0,sourceMap:!1,progress:!process.env.CI})]};p.push(L)}if(h){const e=require(path.resolve(n,h)),i=e.default||e;return p.map(t=>i(t))}return p}d(createProdWebpackConfig,"createProdWebpackConfig"),m(createProdWebpackConfig,"createProdWebpackConfig");

package/executors/build/build.impl.js

@@ -1,98 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const tslib_1 = require("tslib");
-const fs = tslib_1.__importStar(require("node:fs"));
-const path = tslib_1.__importStar(require("node:path"));
-const create_webpack_prod_1 = require("../../create-webpack-prod");
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const webpack = require('webpack');
-/**
- * Production webpack build executor for NestJS applications.
- */
-async function* buildExecutor(options, context) {
-    process.env.NODE_ENV = 'production';
-    const projectConfig = context.projectsConfigurations.projects[context.projectName];
-    const workspaceRoot = context.root;
-    const projectRoot = path.join(workspaceRoot, projectConfig.root);
-    const outputPath = options.outputPath
-        ? path.join(workspaceRoot, options.outputPath)
-        : path.join(workspaceRoot, 'dist', projectConfig.root);
-    // Resolve entry/tsconfig relative to project root (absolute paths avoid
-    // NxAppWebpackPlugin's normalizeRelativePaths collision with executor options)
-    const entryFile = options.entryFile || './src/deployments/service/main.ts';
-    const tsConfigFile = options.tsConfigFile || './tsconfig.app.json';
-    const resolvedMain = path.resolve(projectRoot, entryFile);
-    const resolvedTsConfig = path.resolve(projectRoot, tsConfigFile);
-    const configs = (0, create_webpack_prod_1.createProdWebpackConfig)({
-        appName: context.projectName,
-        appRoot: projectRoot,
-        outputDir: outputPath,
-        main: resolvedMain,
-        tsConfig: resolvedTsConfig,
-        assets: options.assets || [],
-        additionalEntryPoints: [
-            ...(options.workers || []).map((w) => ({ entryName: w.name, entryPath: w.entryPath })),
-            ...(options.additionalEntryPoints || []),
-        ],
-        runtimeDependencies: options.runtimeDependencies || [],
-        memoryLimit: options.memoryLimit || 8192,
-        generatePackageJson: options.generatePackageJson !== false,
-        buildLibsFromSource: options.buildLibsFromSource || false,
-        ormConfigPath: options.ormConfigPath,
-        migrationsDir: options.migrationsDir || './src/migrations',
-        workspaceRoot,
-        orgScopes: options.orgScopes || [],
-        bundlePackages: options.bundlePackages || [],
-        nodeExternalsConfig: options.nodeExternalsConfig,
-        webpackConfigPath: options.webpackConfigPath,
-    });
-    const configArray = Array.isArray(configs) ? configs : [configs];
-    for (const config of configArray) {
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        const { watch: _watch, ...normalizedConfig } = config;
-        const compiler = webpack(normalizedConfig);
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        const stats = await new Promise((resolve, reject) => {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            compiler.run((err, stats) => {
-                if (err)
-                    return reject(err);
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                compiler.close((closeErr) => {
-                    if (closeErr)
-                        console.error('[build] webpack close error:', closeErr);
-                });
-                resolve(stats);
-            });
-        });
-        console.info(stats.toString(config.stats || { colors: true, chunks: false }));
-        if (stats.hasErrors()) {
-            yield { success: false };
-            return;
-        }
-    }
-    // Post-process: minify worker outputs (NxAppWebpackPlugin doesn't minify additional entries)
-    const workerEntries = options.workers || [];
-    if (workerEntries.length > 0) {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const { minify } = require('terser');
-        for (const worker of workerEntries) {
-            const filePath = path.join(outputPath, `${worker.name}.js`);
-            if (fs.existsSync(filePath)) {
-                const code = fs.readFileSync(filePath, 'utf-8');
-                const result = await minify(code, {
-                    keep_classnames: true,
-                    sourceMap: { content: 'inline', url: 'inline' },
-                });
-                if (result.code) {
-                    fs.writeFileSync(filePath, result.code);
-                    console.info(`[build] minified ${worker.name}.js`);
-                }
-            }
-        }
-    }
-    yield { success: true, outfile: path.join(outputPath, 'main.js') };
-}
-exports.default = buildExecutor;
-module.exports = buildExecutor;
-module.exports.default = buildExecutor;
+"use strict";var x=Object.defineProperty;var d=(e,o)=>x(e,"name",{value:o,configurable:!0});var _=Object.defineProperty,p=d((e,o)=>_(e,"name",{value:o,configurable:!0}),"p");Object.defineProperty(exports,"__esModule",{value:!0});const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path")),create_webpack_prod_1=require("../../create-webpack-prod"),webpack=require("webpack");async function*buildExecutor(e,o){process.env.NODE_ENV="production";const m=o.projectsConfigurations.projects[o.projectName],n=o.root,a=path.join(n,m.root),c=e.outputPath?path.join(n,e.outputPath):path.join(n,"dist",m.root),y=e.entryFile||"./src/deployments/service/main.ts",P=e.tsConfigFile||"./tsconfig.app.json",k=path.resolve(a,y),h=path.resolve(a,P),u=(0,create_webpack_prod_1.createProdWebpackConfig)({appName:o.projectName,appRoot:a,outputDir:c,main:k,tsConfig:h,assets:e.assets||[],additionalEntryPoints:[...(e.workers||[]).map(r=>({entryName:r.name,entryPath:r.entryPath})),...e.additionalEntryPoints||[]],runtimeDependencies:e.runtimeDependencies||[],memoryLimit:e.memoryLimit||8192,generatePackageJson:e.generatePackageJson!==!1,buildLibsFromSource:e.buildLibsFromSource||!1,ormConfigPath:e.ormConfigPath,migrationsDir:e.migrationsDir||"./src/migrations",workspaceRoot:n,orgScopes:e.orgScopes||[],bundlePackages:e.bundlePackages||[],nodeExternalsConfig:e.nodeExternalsConfig,webpackConfigPath:e.webpackConfigPath}),j=Array.isArray(u)?u:[u];for(const r of j){const{watch:l,...t}=r,s=webpack(t),i=await new Promise((w,C)=>{s.run((b,S)=>{if(b)return C(b);s.close(g=>{g&&console.error("[build] webpack close error:",g)}),w(S)})});if(console.info(i.toString(r.stats||{colors:!0,chunks:!1})),i.hasErrors()){yield{success:!1};return}}const f=e.workers||[];if(f.length>0){const{minify:r}=require("terser");for(const l of f){const t=path.join(c,`${l.name}.js`);if(fs.existsSync(t)){const s=fs.readFileSync(t,"utf-8"),i=await r(s,{keep_classnames:!0,sourceMap:{content:"inline",url:"inline"}});i.code&&(fs.writeFileSync(t,i.code),console.info(`[build] minified ${l.name}.js`))}}}yield{success:!0,outfile:path.join(c,"main.js")}}d(buildExecutor,"buildExecutor"),p(buildExecutor,"buildExecutor"),exports.default=buildExecutor,module.exports=buildExecutor,module.exports.default=buildExecutor;

package/executors/gateway/gateway-errors.js

@@ -1,43 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.GATEWAY_ERROR_CONTENT_TYPE = exports.GATEWAY_ERROR_KEY = void 0;
-exports.ensureRequestId = ensureRequestId;
-exports.gatewayErrorBody = gatewayErrorBody;
-/** Reason → stable, neutral localized key (the consumer translates the `gateway.*` namespace). */
-exports.GATEWAY_ERROR_KEY = {
-    bad_request: 'gateway.badRequest',
-    unauthorized: 'gateway.unauthorized',
-    forbidden: 'gateway.forbidden',
-    not_found: 'gateway.notFound',
-    rate_limited: 'gateway.rateLimited',
-    unavailable: 'gateway.unavailable',
-    internal: 'gateway.internal',
-};
-const headerValue = (v) => typeof v === 'string' && v !== '' ? v : Array.isArray(v) ? v[0] : undefined;
-const mintId = () => Date.now().toString(36) + Math.random().toString(36).slice(2, 12);
-/**
- * Ensure the request carries an `x-request-id` (mint one at the edge if absent) and return it. Because
- * the gateway forwards `req.headers` to the upstream, the pod's request-context adopts THIS id as its
- * `traceId`, and the gateway returns it on the response — one id, end-to-end, for ANY request.
- */
-function ensureRequestId(req) {
-    const existing = headerValue(req.headers['x-request-id']);
-    if (existing)
-        return existing;
-    const rid = mintId();
-    req.headers['x-request-id'] = rid;
-    return rid;
-}
-/**
- * Build the JSON edge-error body `{ key, status, traceId, message? }`. `detail` becomes the dev-facing
- * `message` (e.g. the old plain-text reason), never surfaced to end users.
- */
-function gatewayErrorBody(status, reason, traceId, detail) {
-    return JSON.stringify({
-        key: exports.GATEWAY_ERROR_KEY[reason],
-        status,
-        traceId,
-        ...(detail ? { message: detail } : {}),
-    });
-}
-exports.GATEWAY_ERROR_CONTENT_TYPE = 'application/json; charset=utf-8';
+"use strict";var i=Object.defineProperty;var n=(e,t)=>i(e,"name",{value:t,configurable:!0});var o=Object.defineProperty,r=n((e,t)=>o(e,"name",{value:t,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.GATEWAY_ERROR_CONTENT_TYPE=exports.GATEWAY_ERROR_KEY=void 0,exports.ensureRequestId=ensureRequestId,exports.gatewayErrorBody=gatewayErrorBody,exports.GATEWAY_ERROR_KEY={bad_request:"gateway.badRequest",unauthorized:"gateway.unauthorized",forbidden:"gateway.forbidden",not_found:"gateway.notFound",rate_limited:"gateway.rateLimited",unavailable:"gateway.unavailable",internal:"gateway.internal"};const headerValue=r(e=>typeof e=="string"&&e!==""?e:Array.isArray(e)?e[0]:void 0,"headerValue"),mintId=r(()=>Date.now().toString(36)+Math.random().toString(36).slice(2,12),"mintId");function ensureRequestId(e){const t=headerValue(e.headers["x-request-id"]);if(t)return t;const a=mintId();return e.headers["x-request-id"]=a,a}n(ensureRequestId,"ensureRequestId"),r(ensureRequestId,"ensureRequestId");function gatewayErrorBody(e,t,a,s){return JSON.stringify({key:exports.GATEWAY_ERROR_KEY[t],status:e,traceId:a,...s?{message:s}:{}})}n(gatewayErrorBody,"gatewayErrorBody"),r(gatewayErrorBody,"gatewayErrorBody"),exports.GATEWAY_ERROR_CONTENT_TYPE="application/json; charset=utf-8";

package/executors/gateway/gateway.impl.js

@@ -1,53 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.default = gatewayExecutor;
-const gateway_lib_1 = require("./gateway.lib");
-const server_1 = require("./runtime/server");
-/**
- * `gateway` executor — ONE https front door for the whole workspace,
- * assembled dynamically from every project's `cluster` declaration:
- *
- *   "cluster": { "host": "api.tetros.ai.local", "service": "api", "prependPrefix": "/api" }
- *   "cluster": { "host": "tetros.ai.local", "port": 5173, "default": true }
- *
- * Socket-pool services get production-shaped treatment: the gateway is the
- * load balancer, round-robining each request across the service's child
- * sockets (the pods), with serverless lifecycle (eager/minPods/maxPods/
- * idleKillSec) and an auto `internal.<host>` domain for east-west calls
- * that bypass the middleware (JWT) — a full prod demo on localhost. All of
- * it is published to the LensMCP bus (source `gateway`, category `cluster`).
- *
- * The runtime lives in `gateway.lib.ts` (`startGateway`) so it is testable
- * without signals; this wrapper only adds the executor contract.
- */
-async function gatewayExecutor(options, context) {
-    // LAST-RESORT netting for the long-running daemon (this executor runs for DAYS): a benign socket
-    // errno that escaped every layer's local handlers — e.g. a dependency emitting 'error' on a socket
-    // it forgot to guard — must cost the ONE connection, never the process. Scoped to exactly the
-    // read/write network errnos; anything else preserves crash semantics (print + exit 1, matching
-    // Node's default). Lives HERE, not in startGateway, so tests driving the lib keep real crashes loud.
-    process.on('uncaughtException', (err) => {
-        if ((err.syscall === 'read' || err.syscall === 'write') && server_1.BENIGN_SOCKET_ERRNOS.has(err.code ?? '')) {
-            console.warn(`[gateway] survived a stray socket ${err.syscall} error (${err.code}) — one connection dropped, the daemon lives`);
-            return;
-        }
-        console.error(err);
-        process.exit(1);
-    });
-    let handle;
-    try {
-        handle = await (0, gateway_lib_1.startGateway)(options, context);
-    }
-    catch (e) {
-        console.error(e.message);
-        return { success: false };
-    }
-    return new Promise((resolve) => {
-        const stop = () => void handle.stop().then(() => resolve({ success: true }));
-        process.on('SIGINT', stop);
-        process.on('SIGTERM', stop);
-    });
-}
-module.exports = gatewayExecutor;
-module.exports.default = gatewayExecutor;
-module.exports.startGateway = gateway_lib_1.startGateway;
+"use strict";var u=Object.defineProperty;var s=(r,t)=>u(r,"name",{value:t,configurable:!0});var c=Object.defineProperty,o=s((r,t)=>c(r,"name",{value:t,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.default=gatewayExecutor;const gateway_lib_1=require("./gateway.lib"),server_1=require("./runtime/server");async function gatewayExecutor(r,t){process.on("uncaughtException",e=>{if((e.syscall==="read"||e.syscall==="write")&&server_1.BENIGN_SOCKET_ERRNOS.has(e.code??"")){console.warn(`[gateway] survived a stray socket ${e.syscall} error (${e.code}) \u2014 one connection dropped, the daemon lives`);return}console.error(e),process.exit(1)});let a;try{a=await(0,gateway_lib_1.startGateway)(r,t)}catch(e){return console.error(e.message),{success:!1}}return new Promise(e=>{const n=o(()=>{a.stop().then(()=>e({success:!0}))},"stop");process.on("SIGINT",n),process.on("SIGTERM",n)})}s(gatewayExecutor,"gatewayExecutor"),o(gatewayExecutor,"gatewayExecutor"),module.exports=gatewayExecutor,module.exports.default=gatewayExecutor,module.exports.startGateway=gateway_lib_1.startGateway;

package/executors/gateway/gateway.lib.js

@@ -1,29 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.discoverRoutes = exports.pickSock = exports.readLensScope = exports.deriveMcpHttpPort = exports.baseDomainOf = exports.stampIdentity = exports.verifyDevJwt = exports.startGateway = exports.hostMatches = void 0;
-/**
- * Public facade for the dev gateway runtime.
- *
- * The implementation now lives in `./runtime/*` as composable LAYERS — see
- * `runtime/server.ts` for the composition root (`startGateway`), `runtime/types.ts`
- * for the shared types + the customer **hooks** API, and the sibling modules for
- * each layer (discovery, dev-auth, observability, lifecycle, lens-children, proxy,
- * auth, hooks, handler, upgrade). This barrel preserves the original module's
- * public surface so the executor wrapper (`gateway.impl.ts`) and the existing
- * specs keep importing from one stable path, and additionally exposes the new
- * hooks types so customers can author typed layers on top of the gateway.
- */
-var manifest_1 = require("./manifest"); // back-compat re-export
-Object.defineProperty(exports, "hostMatches", { enumerable: true, get: function () { return manifest_1.hostMatches; } });
-var server_1 = require("./runtime/server");
-Object.defineProperty(exports, "startGateway", { enumerable: true, get: function () { return server_1.startGateway; } });
-var dev_auth_1 = require("./runtime/dev-auth");
-Object.defineProperty(exports, "verifyDevJwt", { enumerable: true, get: function () { return dev_auth_1.verifyDevJwt; } });
-Object.defineProperty(exports, "stampIdentity", { enumerable: true, get: function () { return dev_auth_1.stampIdentity; } });
-var scope_1 = require("./runtime/scope");
-Object.defineProperty(exports, "baseDomainOf", { enumerable: true, get: function () { return scope_1.baseDomainOf; } });
-Object.defineProperty(exports, "deriveMcpHttpPort", { enumerable: true, get: function () { return scope_1.deriveMcpHttpPort; } });
-Object.defineProperty(exports, "readLensScope", { enumerable: true, get: function () { return scope_1.readLensScope; } });
-var discovery_1 = require("./runtime/discovery");
-Object.defineProperty(exports, "pickSock", { enumerable: true, get: function () { return discovery_1.pickSock; } });
-Object.defineProperty(exports, "discoverRoutes", { enumerable: true, get: function () { return discovery_1.discoverRoutes; } });
+"use strict";var i=Object.defineProperty;var n=(t,r)=>i(t,"name",{value:r,configurable:!0});var o=Object.defineProperty,e=n((t,r)=>o(t,"name",{value:r,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.discoverRoutes=exports.pickSock=exports.readLensScope=exports.deriveMcpHttpPort=exports.baseDomainOf=exports.stampIdentity=exports.verifyDevJwt=exports.startGateway=exports.hostMatches=void 0;var manifest_1=require("./manifest");Object.defineProperty(exports,"hostMatches",{enumerable:!0,get:e(function(){return manifest_1.hostMatches},"get")});var server_1=require("./runtime/server");Object.defineProperty(exports,"startGateway",{enumerable:!0,get:e(function(){return server_1.startGateway},"get")});var dev_auth_1=require("./runtime/dev-auth");Object.defineProperty(exports,"verifyDevJwt",{enumerable:!0,get:e(function(){return dev_auth_1.verifyDevJwt},"get")}),Object.defineProperty(exports,"stampIdentity",{enumerable:!0,get:e(function(){return dev_auth_1.stampIdentity},"get")});var scope_1=require("./runtime/scope");Object.defineProperty(exports,"baseDomainOf",{enumerable:!0,get:e(function(){return scope_1.baseDomainOf},"get")}),Object.defineProperty(exports,"deriveMcpHttpPort",{enumerable:!0,get:e(function(){return scope_1.deriveMcpHttpPort},"get")}),Object.defineProperty(exports,"readLensScope",{enumerable:!0,get:e(function(){return scope_1.readLensScope},"get")});var discovery_1=require("./runtime/discovery");Object.defineProperty(exports,"pickSock",{enumerable:!0,get:e(function(){return discovery_1.pickSock},"get")}),Object.defineProperty(exports,"discoverRoutes",{enumerable:!0,get:e(function(){return discovery_1.discoverRoutes},"get")});

package/executors/gateway/health-check.js

@@ -1,66 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createHealthChecker = createHealthChecker;
-function createHealthChecker(opts = {}) {
-    const path = opts.path ?? '/healthz';
-    const intervalMs = opts.intervalMs ?? 5000;
-    const timeoutMs = opts.timeoutMs ?? 2000;
-    const downAt = Math.max(1, opts.unhealthyThreshold ?? 2);
-    const upAt = Math.max(1, opts.healthyThreshold ?? 1);
-    const doFetch = opts.fetchImpl ?? globalThis.fetch;
-    const state = new Map();
-    let timer;
-    const probeUrl = (url) => url.replace(/\/+$/, '') + (path.startsWith('/') ? path : '/' + path);
-    const probe = async (url) => {
-        const st = state.get(url);
-        if (!st)
-            return;
-        let ok = false;
-        const ctl = new AbortController();
-        const t = setTimeout(() => ctl.abort(), timeoutMs);
-        try {
-            const res = await doFetch(probeUrl(url), { method: 'GET', signal: ctl.signal, redirect: 'manual' });
-            ok = res.status < 500; // answered → up (even 404); only 5xx counts as down
-        }
-        catch { /* network error / timeout → unhealthy (ok stays false) */ }
-        finally {
-            clearTimeout(t);
-        }
-        st.lastCheckedAt = Date.now();
-        if (ok) {
-            st.oks += 1;
-            st.fails = 0;
-            if (!st.healthy && st.oks >= upAt) {
-                st.healthy = true;
-                opts.onChange?.(url, true);
-            }
-        }
-        else {
-            st.fails += 1;
-            st.oks = 0;
-            if (st.healthy && st.fails >= downAt) {
-                st.healthy = false;
-                opts.onChange?.(url, false);
-            }
-        }
-    };
-    const probeOnce = () => Promise.allSettled([...state.keys()].map(probe)).then(() => undefined);
-    return {
-        track(urls) {
-            const next = new Set(urls);
-            for (const u of urls)
-                if (!state.has(u))
-                    state.set(u, { healthy: true, fails: 0, oks: 0, lastCheckedAt: null });
-            for (const u of [...state.keys()])
-                if (!next.has(u))
-                    state.delete(u);
-        },
-        isHealthy: (url) => state.get(url)?.healthy ?? true,
-        snapshot: () => [...state.entries()].map(([url, s]) => ({ url, healthy: s.healthy, fails: s.fails, lastCheckedAt: s.lastCheckedAt })),
-        probeOnce,
-        start() { if (timer)
-            return; timer = setInterval(() => void probeOnce(), intervalMs); timer.unref?.(); void probeOnce(); },
-        stop() { if (timer)
-            clearInterval(timer); timer = undefined; },
-    };
-}
+"use strict";var g=Object.defineProperty;var c=(a,h)=>g(a,"name",{value:h,configurable:!0});var C=Object.defineProperty,n=c((a,h)=>C(a,"name",{value:h,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHealthChecker=createHealthChecker;function createHealthChecker(a={}){const h=a.path??"/healthz",f=a.intervalMs??5e3,y=a.timeoutMs??2e3,p=Math.max(1,a.unhealthyThreshold??2),u=Math.max(1,a.healthyThreshold??1),d=a.fetchImpl??globalThis.fetch,l=new Map;let r;const k=n(t=>t.replace(/\/+$/,"")+(h.startsWith("/")?h:"/"+h),"probeUrl"),m=n(async t=>{const e=l.get(t);if(!e)return;let s=!1;const i=new AbortController,b=setTimeout(()=>i.abort(),y);try{s=(await d(k(t),{method:"GET",signal:i.signal,redirect:"manual"})).status<500}catch{}finally{clearTimeout(b)}e.lastCheckedAt=Date.now(),s?(e.oks+=1,e.fails=0,!e.healthy&&e.oks>=u&&(e.healthy=!0,a.onChange?.(t,!0))):(e.fails+=1,e.oks=0,e.healthy&&e.fails>=p&&(e.healthy=!1,a.onChange?.(t,!1)))},"probe"),o=n(()=>Promise.allSettled([...l.keys()].map(m)).then(()=>{}),"probeOnce");return{track(t){const e=new Set(t);for(const s of t)l.has(s)||l.set(s,{healthy:!0,fails:0,oks:0,lastCheckedAt:null});for(const s of[...l.keys()])e.has(s)||l.delete(s)},isHealthy:n(t=>l.get(t)?.healthy??!0,"isHealthy"),snapshot:n(()=>[...l.entries()].map(([t,e])=>({url:t,healthy:e.healthy,fails:e.fails,lastCheckedAt:e.lastCheckedAt})),"snapshot"),probeOnce:o,start(){r||(r=setInterval(()=>{o()},f),r.unref?.(),o())},stop(){r&&clearInterval(r),r=void 0}}}c(createHealthChecker,"createHealthChecker"),n(createHealthChecker,"createHealthChecker");

package/executors/gateway/jwks-verify.js

@@ -1,121 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createJwksVerifier = createJwksVerifier;
-/**
- * RS256/JWKS JWT verifier — the production identity source for the prod
- * gateway's attribute-based routing (`identify`). Fetches the IdP's JWKS,
- * caches public keys by `kid`, and verifies tokens SYNCHRONOUSLY against that
- * cache so it slots into the gateway's per-request `identify(req)` and rule
- * evaluation without making the hot path async.
- *
- * Freshness without blocking the request:
- *   - initial JWKS load is awaited at startup (`refresh()`),
- *   - a periodic refresh keeps keys current (rotation),
- *   - an unknown `kid` triggers a rate-limited background refresh and the
- *     CURRENT request fails closed (undefined) — the token verifies on a later
- *     request once the new key is cached.
- *
- * Security: only the configured algorithms are accepted (default RS256) — `none`
- * and HS* are rejected (alg-confusion guard); `exp`/`nbf` honoured with a small
- * clock tolerance; `iss`/`aud` checked when configured.
- *
- * Scope: RSA families (RS256/384/512). EC (ES*) needs JOSE→DER signature
- * conversion — a documented follow-up; most IdPs default to RS256.
- */
-const node_crypto_1 = require("node:crypto");
-const ALG_TO_HASH = { RS256: 'sha256', RS384: 'sha384', RS512: 'sha512' };
-const b64urlJsonSafe = (s) => JSON.parse(Buffer.from(s, 'base64url').toString('utf8'));
-function createJwksVerifier(opts) {
-    const algorithms = (opts.algorithms ?? ['RS256']).filter((a) => a in ALG_TO_HASH);
-    const cacheMaxAgeMs = opts.cacheMaxAgeMs ?? 600_000;
-    const missRefreshMs = opts.missRefreshMs ?? 30_000;
-    const tol = opts.clockToleranceSec ?? 60;
-    const doFetch = opts.fetchImpl ?? globalThis.fetch;
-    const audiences = opts.audience === undefined ? undefined : (Array.isArray(opts.audience) ? opts.audience : [opts.audience]);
-    let keys = new Map(); // kid → public key
-    let inflight;
-    let lastMissAt = 0;
-    const load = async () => {
-        const res = await doFetch(opts.jwksUrl, { headers: { accept: 'application/json' } });
-        if (!res.ok)
-            throw new Error(`JWKS ${opts.jwksUrl} → HTTP ${res.status}`);
-        const body = (await res.json());
-        const next = new Map();
-        for (const jwk of body.keys ?? []) {
-            if (jwk.kty !== 'RSA' || !jwk.n || !jwk.e)
-                continue;
-            if (jwk.use && jwk.use !== 'sig')
-                continue;
-            try {
-                const key = (0, node_crypto_1.createPublicKey)({ key: jwk, format: 'jwk' });
-                next.set(jwk.kid ?? '__single__', key);
-            }
-            catch { /* skip an unparseable key, keep the rest */ }
-        }
-        if (next.size > 0)
-            keys = next; // never blank out a working set on a bad fetch
-    };
-    const refresh = () => {
-        if (!inflight)
-            inflight = load().finally(() => { inflight = undefined; });
-        return inflight;
-    };
-    const refreshOnMiss = (nowMs) => {
-        if (nowMs - lastMissAt < missRefreshMs)
-            return;
-        lastMissAt = nowMs;
-        void refresh().catch(() => undefined); // background; this request already failed closed
-    };
-    const timer = setInterval(() => void refresh().catch(() => undefined), cacheMaxAgeMs);
-    timer.unref?.();
-    const verify = (token) => {
-        const parts = token.split('.');
-        if (parts.length !== 3)
-            return undefined;
-        let header;
-        try {
-            header = b64urlJsonSafe(parts[0]);
-        }
-        catch {
-            return undefined;
-        }
-        if (!header.alg || !algorithms.includes(header.alg))
-            return undefined; // reject none/HS*/unconfigured
-        const key = keys.get(header.kid ?? '__single__') ?? (keys.size === 1 ? [...keys.values()][0] : undefined);
-        if (!key) {
-            refreshOnMiss(Date.now());
-            return undefined;
-        }
-        let ok;
-        try {
-            ok = (0, node_crypto_1.verify)(ALG_TO_HASH[header.alg], Buffer.from(`${parts[0]}.${parts[1]}`), key, Buffer.from(parts[2], 'base64url'));
-        }
-        catch {
-            return undefined;
-        }
-        if (!ok)
-            return undefined;
-        let payload;
-        try {
-            payload = b64urlJsonSafe(parts[1]);
-        }
-        catch {
-            return undefined;
-        }
-        const now = Date.now() / 1000;
-        if (typeof payload.exp === 'number' && now > payload.exp + tol)
-            return undefined;
-        if (typeof payload.nbf === 'number' && now < payload.nbf - tol)
-            return undefined;
-        if (opts.issuer && payload.iss !== opts.issuer)
-            return undefined;
-        if (audiences) {
-            const aud = payload.aud;
-            const audList = Array.isArray(aud) ? aud : [aud];
-            if (!audList.some((a) => audiences.includes(a)))
-                return undefined;
-        }
-        return payload;
-    };
-    return { verify, refresh, stop: () => clearInterval(timer) };
-}
+"use strict";var J=Object.defineProperty;var h=(e,n)=>J(e,"name",{value:n,configurable:!0});var v=Object.defineProperty,c=h((e,n)=>v(e,"name",{value:n,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createJwksVerifier=createJwksVerifier;const node_crypto_1=require("node:crypto"),ALG_TO_HASH={RS256:"sha256",RS384:"sha384",RS512:"sha512"},b64urlJsonSafe=c(e=>JSON.parse(Buffer.from(e,"base64url").toString("utf8")),"b64urlJsonSafe");function createJwksVerifier(e){const n=(e.algorithms??["RS256"]).filter(r=>r in ALG_TO_HASH),g=e.cacheMaxAgeMs??6e5,k=e.missRefreshMs??3e4,d=e.clockToleranceSec??60,S=e.fetchImpl??globalThis.fetch,p=e.audience===void 0?void 0:Array.isArray(e.audience)?e.audience:[e.audience];let o=new Map,f,w=0;const m=c(async()=>{const r=await S(e.jwksUrl,{headers:{accept:"application/json"}});if(!r.ok)throw new Error(`JWKS ${e.jwksUrl} \u2192 HTTP ${r.status}`);const a=await r.json(),s=new Map;for(const t of a.keys??[])if(!(t.kty!=="RSA"||!t.n||!t.e)&&!(t.use&&t.use!=="sig"))try{const u=(0,node_crypto_1.createPublicKey)({key:t,format:"jwk"});s.set(t.kid??"__single__",u)}catch{}s.size>0&&(o=s)},"load"),l=c(()=>(f||(f=m().finally(()=>{f=void 0})),f),"refresh"),A=c(r=>{r-w<k||(w=r,l().catch(()=>{}))},"refreshOnMiss"),_=setInterval(()=>{l().catch(()=>{})},g);return _.unref?.(),{verify:c(r=>{const a=r.split(".");if(a.length!==3)return;let s;try{s=b64urlJsonSafe(a[0])}catch{return}if(!s.alg||!n.includes(s.alg))return;const t=o.get(s.kid??"__single__")??(o.size===1?[...o.values()][0]:void 0);if(!t){A(Date.now());return}let u;try{u=(0,node_crypto_1.verify)(ALG_TO_HASH[s.alg],Buffer.from(`${a[0]}.${a[1]}`),t,Buffer.from(a[2],"base64url"))}catch{return}if(!u)return;let i;try{i=b64urlJsonSafe(a[1])}catch{return}const b=Date.now()/1e3;if(!(typeof i.exp=="number"&&b>i.exp+d)&&!(typeof i.nbf=="number"&&b<i.nbf-d)&&!(e.issuer&&i.iss!==e.issuer)){if(p){const y=i.aud;if(!(Array.isArray(y)?y:[y]).some(j=>p.includes(j)))return}return i}},"verify"),refresh:l,stop:c(()=>clearInterval(_),"stop")}}h(createJwksVerifier,"createJwksVerifier"),c(createJwksVerifier,"createJwksVerifier");