@lensmcp/cluster 1.18.4 → 1.18.6

package/executors/gateway/prod-gateway.lib.js

@@ -1,22 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.startProdGateway = void 0;
-/**
- * Public facade for the PRODUCTION gateway runtime (Fastify + @fastify/reply-from).
- *
- * The implementation now lives in `./prod-runtime/*` as composable LAYERS,
- * mirroring the dev gateway's `./runtime/*` — see `prod-runtime/server.ts` for the
- * composition root (`startProdGateway`), `prod-runtime/types.ts` for the shared
- * types + the customer **hooks** API, and the sibling modules for each layer
- * (routing, observability, rollout, upstream, auth, cors, trust, handler, upgrade,
- * app, access-log, hooks). This barrel preserves the original module's public
- * surface so the entry (`main.prod-gateway.ts`), the `@lensmcp/cluster` re-export
- * (`gateway.ts`), the e2e suite, and the pentest/perf suites import from one stable
- * path, and additionally exposes the hooks types for customer-authored layers.
- *
- * The same routing brain as dev (shared `matchRoute` / `buildRouteTable` / manifest
- * schema); the HTTP transport differs on purpose (dev: node:http + http-proxy over
- * unix-socket pods; prod: Fastify + reply-from's undici pool for the high-RPS edge).
- */
-var server_1 = require("./prod-runtime/server");
-Object.defineProperty(exports, "startProdGateway", { enumerable: true, get: function () { return server_1.startProdGateway; } });
+"use strict";var s=Object.defineProperty;var o=(r,t)=>s(r,"name",{value:t,configurable:!0});var a=Object.defineProperty,e=o((r,t)=>a(r,"name",{value:t,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.startProdGateway=void 0;var server_1=require("./prod-runtime/server");Object.defineProperty(exports,"startProdGateway",{enumerable:!0,get:e(function(){return server_1.startProdGateway},"get")});

package/executors/gateway/prod-runtime/access-log.js

@@ -1,24 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.logAccess = void 0;
-const logAccess = (request, reply, st) => {
-    const req = request.raw;
-    const status = reply.statusCode ?? 0;
-    const host = (req.headers.host || '').split(':')[0];
-    const path = (req.url || '/').split('?')[0];
-    const ms = Math.round(reply.elapsedTime);
-    try {
-        console.log(JSON.stringify({
-            severity: status >= 500 ? 'ERROR' : status >= 400 ? 'WARNING' : 'INFO',
-            time: new Date().toISOString(),
-            message: `${req.method} ${host}${path} ${status} ${ms}ms`,
-            method: req.method, host, path, status, ms,
-            ...(st ? { service: st.route.service, upstream: st.upLabel } : {}),
-            ...(st?.version ? { version: st.version } : {}),
-            ...(st?.caller ? { caller: st.caller } : {}),
-            ...(req.headers['x-request-id'] ? { requestId: String(req.headers['x-request-id']) } : {}),
-        }));
-    }
-    catch { /* never let logging break the response */ }
-};
-exports.logAccess = logAccess;
+"use strict";var u=Object.defineProperty;var d=(r,s)=>u(r,"name",{value:s,configurable:!0});var n=Object.defineProperty,l=d((r,s)=>n(r,"name",{value:s,configurable:!0}),"l");Object.defineProperty(exports,"__esModule",{value:!0}),exports.logAccess=void 0;const logAccess=l((r,s,e)=>{const t=r.raw,o=s.statusCode??0,a=(t.headers.host||"").split(":")[0],c=(t.url||"/").split("?")[0],i=Math.round(s.elapsedTime);try{console.log(JSON.stringify({severity:o>=500?"ERROR":o>=400?"WARNING":"INFO",time:new Date().toISOString(),message:`${t.method} ${a}${c} ${o} ${i}ms`,method:t.method,host:a,path:c,status:o,ms:i,...e?{service:e.route.service,upstream:e.upLabel}:{},...e?.version?{version:e.version}:{},...e?.caller?{caller:e.caller}:{},...t.headers["x-request-id"]?{requestId:String(t.headers["x-request-id"])}:{}}))}catch{}},"logAccess");exports.logAccess=logAccess;

package/executors/gateway/prod-runtime/app.js

@@ -1,123 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createApp = createApp;
-const tslib_1 = require("tslib");
-/**
- * Builds one Fastify app per port (shared route table + providers). Streams
- * every body straight through (never parses/buffers — this is a proxy), wires
- * reply-from's undici pool, the operational probes (/livez /readyz /statusz
- * /metricsz), and the trust / CORS / edge-finish hooks.
- */
-const node_crypto_1 = require("node:crypto");
-const fastify_1 = tslib_1.__importDefault(require("fastify"));
-const reply_from_1 = tslib_1.__importDefault(require("@fastify/reply-from"));
-const edge_1 = require("./edge");
-const trust_1 = require("./trust");
-const access_log_1 = require("./access-log");
-function createApp(deps) {
-    const { rt, obs, cors, hooks, handler, upgrade, reqState, spanByReq, ctxByReq } = deps;
-    const opts = rt.opts;
-    const buildApp = async () => {
-        const keepAlive = opts.server?.keepAliveTimeout ?? 620_000; // > GCP external ALB 600s backend keep-alive
-        const app = (0, fastify_1.default)({
-            logger: false,
-            keepAliveTimeout: keepAlive,
-            requestTimeout: opts.server?.requestTimeout ?? 0, // 0 = no inbound request timeout (long-lived streaming)
-            ...(opts.server?.connectionTimeout !== undefined ? { connectionTimeout: opts.server.connectionTimeout } : {}),
-            ...(opts.trustProxyIp ? { trustProxy: true } : {}),
-            ...(opts.tls ? { https: { key: opts.tls.key, cert: opts.tls.cert } } : {}),
-        });
-        // headersTimeout must stay above keepAliveTimeout, else Node may close an idle
-        // keep-alive socket mid-request under load. Default: just above keepAlive.
-        app.server.headersTimeout = opts.server?.headersTimeout ?? keepAlive + 10_000;
-        // Stream every body straight through — never parse/buffer (this is a proxy).
-        app.removeAllContentTypeParsers();
-        app.addContentTypeParser('*', (_req, payload, done) => done(null, payload));
-        await app.register(reply_from_1.default, {
-            disableRequestLogging: true,
-            undici: {
-                connections: opts.undici?.connections ?? 256,
-                pipelining: opts.undici?.pipelining ?? 1,
-                keepAliveTimeout: opts.undici?.keepAliveTimeout ?? 60_000,
-                bodyTimeout: opts.undici?.bodyTimeout ?? 0, // 0 = unlimited — never cut long-lived SSE / streaming MCP responses
-                headersTimeout: opts.undici?.headersTimeout ?? 60_000, // upstream must send response headers within 60s
-                ...(opts.undici?.allowH2 ? { allowH2: true } : {}), // multiplex many MCP streams over few h2 conns
-                connect: {
-                    rejectUnauthorized: opts.undici?.rejectUnauthorized ?? false, // local-CA/self-signed by default
-                    ...(opts.undici?.cert ? { cert: opts.undici.cert } : {}), // ── mTLS: present a client cert to upstreams ──
-                    ...(opts.undici?.key ? { key: opts.undici.key } : {}),
-                    ...(opts.undici?.ca ? { ca: opts.undici.ca } : {}), // trust a private CA for the server side
-                },
-            },
-        });
-        // Host-agnostic operational probes (answered before routing).
-        app.get('/livez', (_req, reply) => { reply.type('text/plain').send('ok'); });
-        app.get('/readyz', (_req, reply) => {
-            const ready = rt.table.routes.length > 0;
-            reply.code(ready ? 200 : 503).type('text/plain').send(ready ? 'ready' : 'no routes loaded');
-        });
-        // Per-service health rollup (opt-in; token-guarded). Off by default → 404 (don't leak topology).
-        app.get('/statusz', (request, reply) => {
-            // Fail closed: served ONLY when both enabled AND a token is set. Constant-time token compare.
-            if (!opts.statusEndpoint || !opts.statusToken) {
-                reply.code(404).type('text/plain').send('not found');
-                return;
-            }
-            const tok = request.query?.token ?? (0, edge_1.hdr)(request.raw.headers['x-status-token']) ?? '';
-            const a = Buffer.from(tok), b = Buffer.from(opts.statusToken);
-            if (a.length !== b.length || !(0, node_crypto_1.timingSafeEqual)(a, b)) {
-                reply.code(401).type('text/plain').send('unauthorized');
-                return;
-            }
-            reply.type('application/json').send(JSON.stringify({ generatedAt: Date.now(), services: obs.buildStatusSnapshot(), endpoints: opts.healthChecker?.snapshot() ?? [] }));
-        });
-        // Process self-metrics — same token gate as /statusz.
-        app.get('/metricsz', (request, reply) => {
-            if (!opts.metrics || !opts.statusToken) {
-                reply.code(404).type('text/plain').send('not found');
-                return;
-            }
-            const tok = request.query?.token ?? (0, edge_1.hdr)(request.raw.headers['x-status-token']) ?? '';
-            const a = Buffer.from(tok), b = Buffer.from(opts.statusToken);
-            if (a.length !== b.length || !(0, node_crypto_1.timingSafeEqual)(a, b)) {
-                reply.code(401).type('text/plain').send('unauthorized');
-                return;
-            }
-            reply.type('application/json').send(JSON.stringify(opts.metrics.snapshot()));
-        });
-        app.addHook('onRequest', (request, _reply, done) => { (0, trust_1.stripTrust)(request.raw); done(); });
-        // Edge CORS authority: stamp Access-Control-Allow-Origin on EVERY response that lacks it (gateway-generated),
-        // but NEVER bless a proxied upstream success cross-origin (see cors.applyResponseCors).
-        app.addHook('onSend', (request, reply, payload, done) => { cors.applyResponseCors(request, reply); done(null, payload); });
-        app.addHook('onResponse', (request, reply, done) => {
-            const st = reqState.get(request);
-            if (st) {
-                obs.recordEdge(st.route, Date.now() - st.startedAt, reply.statusCode ?? 0, st.caller, st.version);
-                obs.finish(st.trace, st.route.service, reply.statusCode ?? 0, { upstream: st.upLabel, ...(st.version ? { version: st.version } : {}), ...(st.caller ? { caller: st.caller } : {}) });
-                reqState.delete(request);
-            }
-            const sp = spanByReq.get(request);
-            if (sp) {
-                opts.tracing.end(sp, reply.statusCode ?? 0, { ...(st?.upLabel ? { 'upstream.url': st.upLabel } : {}), ...(st?.version ? { 'lensmcp.version': st.version } : {}) });
-                spanByReq.delete(request);
-            }
-            opts.metrics?.recordRequest(reply.statusCode ?? 0);
-            if (rt.accessLog)
-                (0, access_log_1.logAccess)(request, reply, st);
-            // Customer onResponse (terminal phase — observes the finished response).
-            const ctx = ctxByReq.get(request);
-            if (ctx) {
-                ctx.status = reply.statusCode ?? 0;
-                if (hooks.has('onResponse'))
-                    void hooks.run('onResponse', ctx);
-                ctxByReq.delete(request);
-            }
-            done();
-        });
-        app.all('/', handler);
-        app.all('/*', handler);
-        app.server.on('upgrade', upgrade);
-        return app;
-    };
-    return { buildApp };
-}
+"use strict";var q=Object.defineProperty;var p=(a,u)=>q(a,"name",{value:u,configurable:!0});var _=Object.defineProperty,l=p((a,u)=>_(a,"name",{value:u,configurable:!0}),"l");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createApp=createApp;const tslib_1=require("tslib"),node_crypto_1=require("node:crypto"),fastify_1=tslib_1.__importDefault(require("fastify")),reply_from_1=tslib_1.__importDefault(require("@fastify/reply-from")),edge_1=require("./edge"),trust_1=require("./trust"),access_log_1=require("./access-log");function createApp(a){const{rt:u,obs:c,cors:k,hooks:f,handler:y,upgrade:T,reqState:g,spanByReq:m,ctxByReq:h}=a,e=u.opts;return{buildApp:l(async()=>{const v=e.server?.keepAliveTimeout??62e4,n=(0,fastify_1.default)({logger:!1,keepAliveTimeout:v,requestTimeout:e.server?.requestTimeout??0,...e.server?.connectionTimeout!==void 0?{connectionTimeout:e.server.connectionTimeout}:{},...e.trustProxyIp?{trustProxy:!0}:{},...e.tls?{https:{key:e.tls.key,cert:e.tls.cert}}:{}});return n.server.headersTimeout=e.server?.headersTimeout??v+1e4,n.removeAllContentTypeParsers(),n.addContentTypeParser("*",(s,r,o)=>o(null,r)),await n.register(reply_from_1.default,{disableRequestLogging:!0,undici:{connections:e.undici?.connections??256,pipelining:e.undici?.pipelining??1,keepAliveTimeout:e.undici?.keepAliveTimeout??6e4,bodyTimeout:e.undici?.bodyTimeout??0,headersTimeout:e.undici?.headersTimeout??6e4,...e.undici?.allowH2?{allowH2:!0}:{},connect:{rejectUnauthorized:e.undici?.rejectUnauthorized??!1,...e.undici?.cert?{cert:e.undici.cert}:{},...e.undici?.key?{key:e.undici.key}:{},...e.undici?.ca?{ca:e.undici.ca}:{}}}}),n.get("/livez",(s,r)=>{r.type("text/plain").send("ok")}),n.get("/readyz",(s,r)=>{const o=u.table.routes.length>0;r.code(o?200:503).type("text/plain").send(o?"ready":"no routes loaded")}),n.get("/statusz",(s,r)=>{if(!e.statusEndpoint||!e.statusToken){r.code(404).type("text/plain").send("not found");return}const o=s.query?.token??(0,edge_1.hdr)(s.raw.headers["x-status-token"])??"",t=Buffer.from(o),i=Buffer.from(e.statusToken);if(t.length!==i.length||!(0,node_crypto_1.timingSafeEqual)(t,i)){r.code(401).type("text/plain").send("unauthorized");return}r.type("application/json").send(JSON.stringify({generatedAt:Date.now(),services:c.buildStatusSnapshot(),endpoints:e.healthChecker?.snapshot()??[]}))}),n.get("/metricsz",(s,r)=>{if(!e.metrics||!e.statusToken){r.code(404).type("text/plain").send("not found");return}const o=s.query?.token??(0,edge_1.hdr)(s.raw.headers["x-status-token"])??"",t=Buffer.from(o),i=Buffer.from(e.statusToken);if(t.length!==i.length||!(0,node_crypto_1.timingSafeEqual)(t,i)){r.code(401).type("text/plain").send("unauthorized");return}r.type("application/json").send(JSON.stringify(e.metrics.snapshot()))}),n.addHook("onRequest",(s,r,o)=>{(0,trust_1.stripTrust)(s.raw),o()}),n.addHook("onSend",(s,r,o,t)=>{k.applyResponseCors(s,r),t(null,o)}),n.addHook("onResponse",(s,r,o)=>{const t=g.get(s);t&&(c.recordEdge(t.route,Date.now()-t.startedAt,r.statusCode??0,t.caller,t.version),c.finish(t.trace,t.route.service,r.statusCode??0,{upstream:t.upLabel,...t.version?{version:t.version}:{},...t.caller?{caller:t.caller}:{}}),g.delete(s));const i=m.get(s);i&&(e.tracing.end(i,r.statusCode??0,{...t?.upLabel?{"upstream.url":t.upLabel}:{},...t?.version?{"lensmcp.version":t.version}:{}}),m.delete(s)),e.metrics?.recordRequest(r.statusCode??0),u.accessLog&&(0,access_log_1.logAccess)(s,r,t);const d=h.get(s);d&&(d.status=r.statusCode??0,f.has("onResponse")&&f.run("onResponse",d),h.delete(s)),o()}),n.all("/",y),n.all("/*",y),n.server.on("upgrade",T),n},"buildApp")}}p(createApp,"createApp"),l(createApp,"createApp");

package/executors/gateway/prod-runtime/auth.js

@@ -1,51 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createEdgeAuth = createEdgeAuth;
-const manifest_1 = require("../manifest");
-const trust_1 = require("./trust");
-function createEdgeAuth(rt, obs, rollout, authenticate) {
-    const internal = (req, _route, trace) => {
-        const caller = rt.keyToProject.get(String(req.headers['x-api-key'] ?? ''));
-        if (!caller) {
-            obs.step(trace, 'auth', { mode: 'x-api-key', ok: false });
-            return { ok: false, status: 401, reason: 'unauthorized', detail: 'Invalid or missing x-api-key for internal route.' };
-        }
-        req.headers['x-api-key-id'] = caller;
-        delete req.headers['x-api-key'];
-        obs.step(trace, 'auth', { mode: 'x-api-key', ok: true, caller });
-        return { ok: true, caller };
-    };
-    const publicAuth = (req, route, cpath, claims, fallbackIp, trace) => {
-        const m = rt.table.manifestByService.get(route.service);
-        const resolved = m ? (0, manifest_1.authRuleForPath)(m, cpath, req.method ?? 'GET', false) : { mode: route.auth };
-        if (resolved.mode === 'jwt') {
-            if (rt.opts.identify) {
-                if (!claims) {
-                    obs.step(trace, 'auth', { mode: 'jwt', ok: false });
-                    return { ok: false, status: 401, reason: 'unauthorized', detail: 'Unauthorized: invalid or missing token' };
-                }
-            }
-            else {
-                try {
-                    authenticate('jwt', req);
-                }
-                catch (e) {
-                    obs.step(trace, 'auth', { mode: 'jwt', ok: false });
-                    return { ok: false, status: 401, reason: 'unauthorized', detail: `Unauthorized: ${e.message}` };
-                }
-            }
-            // edge ABAC: a present rule MUST be satisfied by VERIFIED claims. No claims (no verifier) → DENY (fail closed).
-            if (resolved.rule && (!claims || !(0, manifest_1.evalRule)(resolved.rule, rollout.buildAttrs(req, fallbackIp, claims, undefined)))) {
-                obs.step(trace, 'authz', { ok: false });
-                return { ok: false, status: 403, reason: 'forbidden', detail: 'Forbidden: insufficient permission' };
-            }
-            obs.step(trace, 'auth', { mode: 'jwt', ok: true });
-            if (claims)
-                (0, trust_1.stampIdentity)(req, claims);
-            return { ok: true };
-        }
-        obs.step(trace, 'auth', { mode: resolved.mode });
-        return { ok: true };
-    };
-    return { internal, public: publicAuth };
-}
+"use strict";var f=Object.defineProperty;var d=(a,e)=>f(a,"name",{value:e,configurable:!0});var k=Object.defineProperty,n=d((a,e)=>k(a,"name",{value:e,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createEdgeAuth=createEdgeAuth;const manifest_1=require("../manifest"),trust_1=require("./trust");function createEdgeAuth(a,e,h,p){return{internal:n((r,u,i)=>{const t=a.keyToProject.get(String(r.headers["x-api-key"]??""));return t?(r.headers["x-api-key-id"]=t,delete r.headers["x-api-key"],e.step(i,"auth",{mode:"x-api-key",ok:!0,caller:t}),{ok:!0,caller:t}):(e.step(i,"auth",{mode:"x-api-key",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Invalid or missing x-api-key for internal route."})},"internal"),public:n((r,u,i,t,c,o)=>{const l=a.table.manifestByService.get(u.service),s=l?(0,manifest_1.authRuleForPath)(l,i,r.method??"GET",!1):{mode:u.auth};if(s.mode==="jwt"){if(a.opts.identify){if(!t)return e.step(o,"auth",{mode:"jwt",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: invalid or missing token"}}else try{p("jwt",r)}catch(m){return e.step(o,"auth",{mode:"jwt",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:`Unauthorized: ${m.message}`}}return s.rule&&(!t||!(0,manifest_1.evalRule)(s.rule,h.buildAttrs(r,c,t,void 0)))?(e.step(o,"authz",{ok:!1}),{ok:!1,status:403,reason:"forbidden",detail:"Forbidden: insufficient permission"}):(e.step(o,"auth",{mode:"jwt",ok:!0}),t&&(0,trust_1.stampIdentity)(r,t),{ok:!0})}return e.step(o,"auth",{mode:s.mode}),{ok:!0}},"publicAuth")}}d(createEdgeAuth,"createEdgeAuth"),n(createEdgeAuth,"createEdgeAuth");

package/executors/gateway/prod-runtime/cors.js

@@ -1,40 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createCors = createCors;
-function createCors(rt, reqState) {
-    const setCors = (reply, req) => {
-        const origin = req.headers.origin;
-        // Credentialed allowlist: echo the EXACT origin + allow credentials (cookies). NEVER `*` with
-        // credentials (forbidden by the Fetch spec; a cross-site read hole).
-        if (origin && rt.corsCredentialOrigins.has(origin.toLowerCase())) {
-            reply.header('access-control-allow-origin', origin);
-            reply.header('access-control-allow-credentials', 'true');
-            reply.header('vary', 'Origin');
-            return;
-        }
-        // Otherwise — UNAUTHENTICATED gateway responses (404 / health / discovery / preflight):
-        // reflect the Origin for convenience but DO NOT allow credentials.
-        reply.header('access-control-allow-origin', String(origin ?? '*'));
-        reply.header('vary', 'Origin');
-    };
-    const applyResponseCors = (request, reply) => {
-        const origin = request.headers.origin;
-        if (origin && !reply.getHeader('access-control-allow-origin')) {
-            // Credentialed allowlist: EXACT origin + ACAC:true so a credentialed first-party app can read a
-            // cookie-setting routed response AND a gateway-generated 401/403/5xx passes the browser CORS check.
-            if (rt.corsCredentialOrigins.has(origin.toLowerCase())) {
-                reply.header('access-control-allow-origin', origin);
-                reply.header('access-control-allow-credentials', 'true');
-                reply.header('vary', 'Origin');
-            }
-            else if (!reqState.get(request)?.proxied) {
-                // A non-allowlisted origin is reflected ONLY on a gateway-GENERATED reply (error / no-route),
-                // NEVER on a successful PROXIED upstream response — that would be a blanket cross-origin read
-                // of app data (CWE-942). The upstream owns CORS on its own responses.
-                reply.header('access-control-allow-origin', String(origin));
-                reply.header('vary', 'Origin');
-            }
-        }
-    };
-    return { setCors, applyResponseCors };
-}
+"use strict";var c=Object.defineProperty;var t=(s,i)=>c(s,"name",{value:i,configurable:!0});var n=Object.defineProperty,a=t((s,i)=>n(s,"name",{value:i,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createCors=createCors;function createCors(s,i){return{setCors:a((r,o)=>{const e=o.headers.origin;if(e&&s.corsCredentialOrigins.has(e.toLowerCase())){r.header("access-control-allow-origin",e),r.header("access-control-allow-credentials","true"),r.header("vary","Origin");return}r.header("access-control-allow-origin",String(e??"*")),r.header("vary","Origin")},"setCors"),applyResponseCors:a((r,o)=>{const e=r.headers.origin;e&&!o.getHeader("access-control-allow-origin")&&(s.corsCredentialOrigins.has(e.toLowerCase())?(o.header("access-control-allow-origin",e),o.header("access-control-allow-credentials","true"),o.header("vary","Origin")):i.get(r)?.proxied||(o.header("access-control-allow-origin",String(e)),o.header("vary","Origin")))},"applyResponseCors")}}t(createCors,"createCors"),a(createCors,"createCors");

package/executors/gateway/prod-runtime/edge.js

@@ -1,65 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.canonicalPath = exports.ENCODED_STRUCTURE = exports.sendError = exports.hdr = exports.eid = void 0;
-/**
- * Edge primitives for the prod gateway: id/header helpers, the localized JSON
- * error envelope, and the path-canonicalization guard. Pure (no runtime state).
- */
-const node_crypto_1 = require("node:crypto");
-const gateway_errors_1 = require("../gateway-errors");
-const eid = () => Date.now().toString(36) + (0, node_crypto_1.randomBytes)(6).toString('hex');
-exports.eid = eid;
-const hdr = (v) => typeof v === 'string' && v !== '' ? v : Array.isArray(v) ? v[0] : undefined;
-exports.hdr = hdr;
-/**
- * Send a gateway-generated edge error as the JSON envelope `{ key, status, traceId, message? }` (NOT
- * `text/plain`), stamping `x-request-id` so the trace id is on the response. The SAME `{ key, status }`
- * localized contract a service returns, so a browser app renders `t(key)` and surfaces the trace id.
- * `detail` is the dev-facing hint (the old plain-text reason), never shown to end users.
- */
-const sendError = (reply, req, status, reason, detail) => {
-    const traceId = (0, gateway_errors_1.ensureRequestId)(req);
-    return reply
-        .code(status)
-        .header('x-request-id', traceId)
-        .type(gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE)
-        .send((0, gateway_errors_1.gatewayErrorBody)(status, reason, traceId, detail));
-};
-exports.sendError = sendError;
-// Path-canonicalization guard (CWE-288): a reverse proxy and its backend must agree
-// on the request path, or auth gets evaluated against a DIFFERENT path than the one
-// served (AWS API Gateway trailing-slash bypass, IBM API Connect CVE-2025-13915,
-// Kong/Envoy/NGINX normalization mismatch). We REJECT structurally-encoded paths
-// (encoded dot/slash/backslash/null) outright, and return the DECODED path for auth
-// matching so `/%61dmin` is matched as `/admin` — never skipped because it's encoded.
-exports.ENCODED_STRUCTURE = /%2e|%2f|%5c|%00|\\/i; // encoded . / \ NUL, or a raw backslash
-const NEEDS_NORMALIZE = /[%;#\\]/; // percent-encoding, matrix param, fragment, or backslash
-const TRAVERSAL = /(^|\/)\.\.(?=\/|$)/; // a `..` path segment
-/** Canonical path for auth matching, or undefined if the path is unsafe (→ 400 / drop). */
-const canonicalPath = (rawUrl) => {
-    const q = rawUrl.indexOf('?');
-    const p = q === -1 ? rawUrl : rawUrl.slice(0, q);
-    if (p.indexOf('\0') !== -1)
-        return undefined; // raw NUL is never a valid path (mirrors the decoded-NUL reject)
-    // FAST PATH (the overwhelming majority of production traffic): a clean path — no percent-encoding,
-    // matrix params, fragment, or backslash — needs no decoding or normalization (it already equals what
-    // the backend resolves). Only the `..` traversal check remains. Saves a decodeURIComponent + two regex
-    // + a split/map/join on every request.
-    if (!NEEDS_NORMALIZE.test(p))
-        return TRAVERSAL.test(p) ? undefined : (p || '/');
-    // SLOW PATH: structurally-encoded → reject outright; else decode + strip matrix/fragment so
-    // /admin;x=1 and /admin#.css can't skip the /admin policy (CWE-288), and /%61dmin matches /admin.
-    if (exports.ENCODED_STRUCTURE.test(p))
-        return undefined;
-    let decoded;
-    try {
-        decoded = decodeURIComponent(p);
-    }
-    catch {
-        return undefined;
-    } // malformed %xx
-    if (decoded.includes('\0') || TRAVERSAL.test(decoded))
-        return undefined; // NUL or `..` traversal
-    return decoded.split('#')[0].split('/').map((s) => s.split(';')[0]).join('/') || '/';
-};
-exports.canonicalPath = canonicalPath;
+"use strict";var c=Object.defineProperty;var a=(r,t)=>c(r,"name",{value:t,configurable:!0});var i=Object.defineProperty,o=a((r,t)=>i(r,"name",{value:t,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.canonicalPath=exports.ENCODED_STRUCTURE=exports.sendError=exports.hdr=exports.eid=void 0;const node_crypto_1=require("node:crypto"),gateway_errors_1=require("../gateway-errors"),eid=o(()=>Date.now().toString(36)+(0,node_crypto_1.randomBytes)(6).toString("hex"),"eid");exports.eid=eid;const hdr=o(r=>typeof r=="string"&&r!==""?r:Array.isArray(r)?r[0]:void 0,"hdr");exports.hdr=hdr;const sendError=o((r,t,e,n,s)=>{const d=(0,gateway_errors_1.ensureRequestId)(t);return r.code(e).header("x-request-id",d).type(gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE).send((0,gateway_errors_1.gatewayErrorBody)(e,n,d,s))},"sendError");exports.sendError=sendError,exports.ENCODED_STRUCTURE=/%2e|%2f|%5c|%00|\\/i;const NEEDS_NORMALIZE=/[%;#\\]/,TRAVERSAL=/(^|\/)\.\.(?=\/|$)/,canonicalPath=o(r=>{const t=r.indexOf("?"),e=t===-1?r:r.slice(0,t);if(e.indexOf("\0")!==-1)return;if(!NEEDS_NORMALIZE.test(e))return TRAVERSAL.test(e)?void 0:e||"/";if(exports.ENCODED_STRUCTURE.test(e))return;let n;try{n=decodeURIComponent(e)}catch{return}if(!(n.includes("\0")||TRAVERSAL.test(n)))return n.split("#")[0].split("/").map(s=>s.split(";")[0]).join("/")||"/"},"canonicalPath");exports.canonicalPath=canonicalPath;

package/executors/gateway/prod-runtime/handler.js

@@ -1,226 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createHandler = createHandler;
-const manifest_1 = require("../manifest");
-const gateway_errors_1 = require("../gateway-errors");
-const edge_1 = require("./edge");
-function createHandler(deps) {
-    const { rt, obs, cors, auth, upstream, rollout, hooks, reqState, spanByReq, ctxByReq } = deps;
-    // Resolved ONCE: is there any reason to run the per-request version-selection block at all? A plain
-    // route-and-forward gateway (no rollout / cookie / sticky bucketing) skips resolveStickyKey + buildAttrs
-    // entirely. `rolloutOn` further gates the (more expensive) ABAC attribute bag to ABAC-targeted services.
-    const rolloutOn = !!rt.opts.pods?.resolveVersion; // ABAC version targeting
-    const cookieOn = !!rt.opts.cookie; // device-cookie minting
-    const stickyOn = !!rt.opts.pods?.bucket && (cookieOn || !!rt.opts.uidHeader); // sticky weighted bucketing
-    const versionSelectionOn = rolloutOn || cookieOn || stickyOn;
-    const handleNoRoute = (request, reply, host, url) => {
-        const req = request.raw;
-        cors.setCors(reply, req);
-        if (req.method === 'OPTIONS') {
-            reply.code(204)
-                .header('access-control-allow-methods', 'GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS')
-                .header('access-control-allow-headers', String(req.headers['access-control-request-headers'] ?? '*'))
-                .send();
-            return;
-        }
-        const mounted = rt.table.routes.filter((r) => r.host && (0, manifest_1.hostMatches)(r.host, host) && r.prefix);
-        const p = url.split('?')[0];
-        if (mounted.length > 0 && (p === '/health' || p === '/healthz')) {
-            reply.code(200).type('application/json').send(JSON.stringify({ status: 'ok', host, services: mounted.map((r) => ({ service: r.service, prefix: r.prefix })) }));
-            return;
-        }
-        if (p === '/.well-known/lensmcp-routes') {
-            reply.code(200).type('application/json').send(JSON.stringify({ host, routes: rt.table.routes.filter((r) => !r.host || (0, manifest_1.hostMatches)(r.host, host)).map((r) => ({ host: r.host ?? '(default)', service: r.service, prefix: r.prefix, internal: !!r.internal, auth: r.auth })) }));
-            return;
-        }
-        (0, edge_1.sendError)(reply, req, 404, 'not_found', mounted.length > 0 ? `No service mounted at ${url} on ${host}.` : 'No gateway route for this hostname.');
-    };
-    return async (request, reply) => {
-        const req = request.raw;
-        const host = (req.headers.host || '').split(':')[0];
-        const url = req.url ?? '/';
-        const trace = obs.beginTrace(req);
-        // Mint a trace id for EVERY request: forwarded to the upstream (adopted as its traceId) and returned.
-        (0, gateway_errors_1.ensureRequestId)(req);
-        obs.step(trace, 'received', { host, method: req.method, url });
-        // Hook context: built ONLY when hooks are configured (otherwise undefined → zero overhead).
-        const ctx = hooks.any ? hooks.httpContext(req, request, reply, trace) : undefined;
-        if (ctx)
-            ctxByReq.set(request, ctx);
-        if (ctx && hooks.has('onRequest')) {
-            await hooks.run('onRequest', ctx);
-            if (ctx.responded())
-                return reply;
-        }
-        // Reject HTTP/0.9 — a header-less simple request has no Host, defeating host-keyed routing/policy.
-        if (req.httpVersionMajor < 1) {
-            obs.finish(trace, 'gateway', 400);
-            return (0, edge_1.sendError)(reply, req, 400, 'bad_request', 'Bad Request');
-        }
-        // Reject path-canonicalization attacks BEFORE routing/auth (proxy↔backend mismatch).
-        const cpath = (0, edge_1.canonicalPath)(url);
-        if (cpath === undefined) {
-            obs.step(trace, 'bad-path', {});
-            obs.finish(trace, 'gateway', 400);
-            return (0, edge_1.sendError)(reply, req, 400, 'bad_request', 'Bad Request');
-        }
-        // Rate limit (opt-in) BEFORE routing/auth, per real client IP — defense-in-depth.
-        if (rt.opts.rateLimiter) {
-            const d = await rt.opts.rateLimiter.check(rollout.clientIpOf(req, req.socket?.remoteAddress ?? request.ip));
-            if (!d.allowed) {
-                reply.header('retry-after', String(Math.ceil(d.retryAfterMs / 1000)));
-                obs.step(trace, 'rate-limited', {});
-                obs.finish(trace, 'gateway', 429);
-                return (0, edge_1.sendError)(reply, req, 429, 'rate_limited', 'Too Many Requests');
-            }
-        }
-        const route = (0, manifest_1.matchRoute)(rt.table.routes, host, url);
-        if (!route) {
-            handleNoRoute(request, reply, host, url);
-            return reply;
-        }
-        if (ctx)
-            ctx.route = route;
-        obs.step(trace, 'route-match', { project: route.service, ...(route.prefix ? { prefix: route.prefix } : {}), ...(route.internal ? { internal: true } : {}) });
-        // CORS preflight on a ROUTED path: answer it HERE, BEFORE edge auth (preflight carries no token).
-        if (req.method === 'OPTIONS') {
-            cors.setCors(reply, req);
-            reply.code(204)
-                .header('access-control-allow-methods', 'GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS')
-                .header('access-control-allow-headers', String(req.headers['access-control-request-headers'] ?? '*'))
-                .send();
-            return reply;
-        }
-        // OTel SERVER span (opt-in): continues the incoming traceparent. Ended in onResponse on ANY exit path.
-        const span = rt.opts.tracing?.startSpan(req, `gateway ${route.service}`, {
-            'http.request.method': (req.method ?? 'GET'),
-            'url.path': url.split('?')[0],
-            'server.address': host,
-            'lensmcp.service': route.service,
-            ...(route.internal ? { 'lensmcp.internal': true } : {}),
-        });
-        if (span)
-            spanByReq.set(request, span);
-        if (ctx && hooks.has('beforeAuth')) {
-            await hooks.run('beforeAuth', ctx);
-            if (ctx.responded())
-                return reply;
-        }
-        // Verify the end-user JWT ONCE (when a verifier is configured) — reused for edge auth + rollout targeting.
-        const claims = route.internal ? undefined : rt.opts.identify?.(req);
-        let caller;
-        if (route.internal) {
-            const v = auth.internal(req, route, trace);
-            if (!v.ok) {
-                obs.finish(trace, route.service, v.status);
-                return (0, edge_1.sendError)(reply, req, v.status, v.reason, v.detail);
-            }
-            caller = v.caller;
-            if (ctx)
-                ctx.caller = caller;
-        }
-        else {
-            const v = auth.public(req, route, cpath, claims, request.ip, trace);
-            if (!v.ok) {
-                obs.finish(trace, route.service, v.status);
-                return (0, edge_1.sendError)(reply, req, v.status, v.reason, v.detail);
-            }
-            if (ctx)
-                ctx.claims = claims;
-            // afterAuth (customer hooks) — public branch ONLY (mirrors dev; internal east-west has no middleware).
-            if (ctx && hooks.has('afterAuth')) {
-                await hooks.run('afterAuth', ctx);
-                if (ctx.responded())
-                    return reply;
-            }
-        }
-        if (rt.opts.serviceKeys?.[route.service])
-            req.headers['x-internal-token'] = rt.opts.serviceKeys[route.service];
-        if (route.prependPrefix) {
-            const u = req.url ?? '/';
-            const pp = route.prependPrefix;
-            if (u !== pp && !u.startsWith(pp + '/'))
-                req.url = pp + u;
-        } // segment-boundary, not bare startsWith
-        // ── version selection: explicit pin → ABAC rule → sticky-key weighted → SWRR ──
-        // Skipped entirely for a plain route-and-forward gateway (no rollout/cookie/sticky) — the common
-        // hot path avoids resolveStickyKey + buildAttrs. buildAttrs only runs when ABAC targeting is wired.
-        const explicit = (0, edge_1.hdr)(req.headers[rt.versionHeader]);
-        let pinned = explicit;
-        let mintKey; // set → append Set-Cookie on the response
-        if (versionSelectionOn && !route.internal && !explicit) {
-            const sk = rollout.resolveStickyKey(req);
-            if (sk.mint)
-                mintKey = sk.key;
-            const targeted = rolloutOn ? rt.opts.pods.resolveVersion(route.service, rollout.buildAttrs(req, request.ip, claims, sk.key)) : undefined;
-            if (targeted) {
-                pinned = targeted.version;
-                obs.step(trace, 'targeting', { rule: targeted.rule, version: targeted.version });
-            }
-            else if (sk.key) {
-                const b = rt.opts.pods?.bucket?.(route.service, sk.key);
-                if (b) {
-                    pinned = b.version;
-                    obs.step(trace, 'targeting', { mode: 'sticky', version: b.version });
-                }
-            }
-        }
-        const up = await upstream.resolveUpstream(route, trace, pinned);
-        if (!up) {
-            obs.finish(trace, route.service, 503);
-            return (0, edge_1.sendError)(reply, req, 503, 'unavailable', `Service ${route.service} has no available upstream.`);
-        }
-        if (!('url' in up)) {
-            obs.finish(trace, route.service, 502);
-            return (0, edge_1.sendError)(reply, req, 502, 'unavailable', `Service ${route.service}: socket upstreams are not supported by the prod gateway.`);
-        }
-        const originUrl = new URL(up.url).origin;
-        const upLabel = up.url;
-        const st = { route, caller, startedAt: Date.now(), trace, version: up.version, upLabel };
-        reqState.set(request, st);
-        if (ctx)
-            ctx.version = up.version;
-        obs.step(trace, up.version ? 'rollout' : 'upstream', { upstream: upLabel, ...(up.version ? { version: up.version, ...(explicit ? { pinned: true } : {}) } : {}) });
-        // Propagate the gateway span's context downstream (W3C traceparent on the forwarded request).
-        if (span)
-            rt.opts.tracing.inject(span, req.headers);
-        if (ctx && hooks.has('beforeForward')) {
-            await hooks.run('beforeForward', ctx);
-            if (ctx.responded())
-                return reply;
-        }
-        // No source → reply-from forwards the (prefix-rewritten) req.url to `origin`.
-        return reply.from(undefined, {
-            getUpstream: () => originUrl,
-            rewriteHeaders: (headers) => {
-                st.proxied = true; // a real upstream response came back → this body is app data, not a gateway reply
-                headers['x-lensmcp-upstream'] = upLabel;
-                if (!headers['x-request-id'])
-                    headers['x-request-id'] = (0, gateway_errors_1.ensureRequestId)(req); // trace id on success too
-                if (up.version)
-                    headers['x-lensmcp-version'] = up.version; // which rollout cohort served
-                // The gateway owns the edge response: drop the upstream framework leak + brand the hop.
-                delete headers['x-powered-by'];
-                delete headers['connection'];
-                delete headers['keep-alive'];
-                delete headers['proxy-connection']; // hop-by-hop
-                headers['server'] = 'LensMCP';
-                if (mintKey) { // first contact → stamp the device cookie (appended to any upstream Set-Cookie)
-                    const ex = headers['set-cookie'];
-                    const list = Array.isArray(ex) ? ex : ex ? [ex] : [];
-                    headers['set-cookie'] = [...list, rollout.mintCookieHeader(mintKey)];
-                }
-                return headers;
-            },
-            onError: (rep, { error }) => {
-                rt.opts.pods?.drop?.(route.service, up);
-                void error; // don't reflect the raw upstream error (host:port / errno) to the client
-                if (ctx && hooks.has('onError')) {
-                    ctx.error = error;
-                    void hooks.run('onError', ctx);
-                }
-                (0, edge_1.sendError)(rep, req, 502, 'unavailable', `Upstream ${route.service} unavailable.`);
-            },
-        });
-    };
-}
+"use strict";var D=Object.defineProperty;var P=(m,a)=>D(m,"name",{value:a,configurable:!0});var j=Object.defineProperty,v=P((m,a)=>j(m,"name",{value:a,configurable:!0}),"v");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHandler=createHandler;const manifest_1=require("../manifest"),gateway_errors_1=require("../gateway-errors"),edge_1=require("./edge");function createHandler(m){const{rt:a,obs:c,cors:S,auth:O,upstream:_,rollout:w,hooks:l,reqState:N,spanByReq:M,ctxByReq:C}=m,A=!!a.opts.pods?.resolveVersion,H=!!a.opts.cookie,I=!!a.opts.pods?.bucket&&(H||!!a.opts.uidHeader),L=A||H||I,U=v((p,o,r,f)=>{const h=p.raw;if(S.setCors(o,h),h.method==="OPTIONS"){o.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(h.headers["access-control-request-headers"]??"*")).send();return}const i=a.table.routes.filter(n=>n.host&&(0,manifest_1.hostMatches)(n.host,r)&&n.prefix),s=f.split("?")[0];if(i.length>0&&(s==="/health"||s==="/healthz")){o.code(200).type("application/json").send(JSON.stringify({status:"ok",host:r,services:i.map(n=>({service:n.service,prefix:n.prefix}))}));return}if(s==="/.well-known/lensmcp-routes"){o.code(200).type("application/json").send(JSON.stringify({host:r,routes:a.table.routes.filter(n=>!n.host||(0,manifest_1.hostMatches)(n.host,r)).map(n=>({host:n.host??"(default)",service:n.service,prefix:n.prefix,internal:!!n.internal,auth:n.auth}))}));return}(0,edge_1.sendError)(o,h,404,"not_found",i.length>0?`No service mounted at ${f} on ${r}.`:"No gateway route for this hostname.")},"handleNoRoute");return async(p,o)=>{const r=p.raw,f=(r.headers.host||"").split(":")[0],h=r.url??"/",i=c.beginTrace(r);(0,gateway_errors_1.ensureRequestId)(r),c.step(i,"received",{host:f,method:r.method,url:h});const s=l.any?l.httpContext(r,p,o,i):void 0;if(s&&C.set(p,s),s&&l.has("onRequest")&&(await l.run("onRequest",s),s.responded()))return o;if(r.httpVersionMajor<1)return c.finish(i,"gateway",400),(0,edge_1.sendError)(o,r,400,"bad_request","Bad Request");const n=(0,edge_1.canonicalPath)(h);if(n===void 0)return c.step(i,"bad-path",{}),c.finish(i,"gateway",400),(0,edge_1.sendError)(o,r,400,"bad_request","Bad Request");if(a.opts.rateLimiter){const e=await a.opts.rateLimiter.check(w.clientIpOf(r,r.socket?.remoteAddress??p.ip));if(!e.allowed)return o.header("retry-after",String(Math.ceil(e.retryAfterMs/1e3))),c.step(i,"rate-limited",{}),c.finish(i,"gateway",429),(0,edge_1.sendError)(o,r,429,"rate_limited","Too Many Requests")}const t=(0,manifest_1.matchRoute)(a.table.routes,f,h);if(!t)return U(p,o,f,h),o;if(s&&(s.route=t),c.step(i,"route-match",{project:t.service,...t.prefix?{prefix:t.prefix}:{},...t.internal?{internal:!0}:{}}),r.method==="OPTIONS")return S.setCors(o,r),o.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(r.headers["access-control-request-headers"]??"*")).send(),o;const g=a.opts.tracing?.startSpan(r,`gateway ${t.service}`,{"http.request.method":r.method??"GET","url.path":h.split("?")[0],"server.address":f,"lensmcp.service":t.service,...t.internal?{"lensmcp.internal":!0}:{}});if(g&&M.set(p,g),s&&l.has("beforeAuth")&&(await l.run("beforeAuth",s),s.responded()))return o;const b=t.internal?void 0:a.opts.identify?.(r);let E;if(t.internal){const e=O.internal(r,t,i);if(!e.ok)return c.finish(i,t.service,e.status),(0,edge_1.sendError)(o,r,e.status,e.reason,e.detail);E=e.caller,s&&(s.caller=E)}else{const e=O.public(r,t,n,b,p.ip,i);if(!e.ok)return c.finish(i,t.service,e.status),(0,edge_1.sendError)(o,r,e.status,e.reason,e.detail);if(s&&(s.claims=b),s&&l.has("afterAuth")&&(await l.run("afterAuth",s),s.responded()))return o}if(a.opts.serviceKeys?.[t.service]&&(r.headers["x-internal-token"]=a.opts.serviceKeys[t.service]),t.prependPrefix){const e=r.url??"/",d=t.prependPrefix;e!==d&&!e.startsWith(d+"/")&&(r.url=d+e)}const k=(0,edge_1.hdr)(r.headers[a.versionHeader]);let x=k,q;if(L&&!t.internal&&!k){const e=w.resolveStickyKey(r);e.mint&&(q=e.key);const d=A?a.opts.pods.resolveVersion(t.service,w.buildAttrs(r,p.ip,b,e.key)):void 0;if(d)x=d.version,c.step(i,"targeting",{rule:d.rule,version:d.version});else if(e.key){const y=a.opts.pods?.bucket?.(t.service,e.key);y&&(x=y.version,c.step(i,"targeting",{mode:"sticky",version:y.version}))}}const u=await _.resolveUpstream(t,i,x);if(!u)return c.finish(i,t.service,503),(0,edge_1.sendError)(o,r,503,"unavailable",`Service ${t.service} has no available upstream.`);if(!("url"in u))return c.finish(i,t.service,502),(0,edge_1.sendError)(o,r,502,"unavailable",`Service ${t.service}: socket upstreams are not supported by the prod gateway.`);const $=new URL(u.url).origin,T=u.url,R={route:t,caller:E,startedAt:Date.now(),trace:i,version:u.version,upLabel:T};return N.set(p,R),s&&(s.version=u.version),c.step(i,u.version?"rollout":"upstream",{upstream:T,...u.version?{version:u.version,...k?{pinned:!0}:{}}:{}}),g&&a.opts.tracing.inject(g,r.headers),s&&l.has("beforeForward")&&(await l.run("beforeForward",s),s.responded())?o:o.from(void 0,{getUpstream:v(()=>$,"getUpstream"),rewriteHeaders:v(e=>{if(R.proxied=!0,e["x-lensmcp-upstream"]=T,e["x-request-id"]||(e["x-request-id"]=(0,gateway_errors_1.ensureRequestId)(r)),u.version&&(e["x-lensmcp-version"]=u.version),delete e["x-powered-by"],delete e.connection,delete e["keep-alive"],delete e["proxy-connection"],e.server="LensMCP",q){const d=e["set-cookie"],y=Array.isArray(d)?d:d?[d]:[];e["set-cookie"]=[...y,w.mintCookieHeader(q)]}return e},"rewriteHeaders"),onError:v((e,{error:d})=>{a.opts.pods?.drop?.(t.service,u),s&&l.has("onError")&&(s.error=d,l.run("onError",s)),(0,edge_1.sendError)(e,r,502,"unavailable",`Upstream ${t.service} unavailable.`)},"onError")})}}P(createHandler,"createHandler"),v(createHandler,"createHandler");

package/executors/gateway/prod-runtime/hooks.js

@@ -1,42 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createHooks = createHooks;
-const edge_1 = require("./edge");
-const TERMINAL_PHASES = new Set(['onResponse', 'onError']);
-function createHooks(hooks) {
-    const run = async (phase, ctx) => {
-        const list = hooks[phase];
-        if (!list || list.length === 0)
-            return;
-        const terminal = TERMINAL_PHASES.has(phase);
-        for (const h of list) {
-            if (!terminal && ctx.responded())
-                return;
-            await h(ctx);
-        }
-    };
-    const has = (phase) => (hooks[phase]?.length ?? 0) > 0;
-    const any = ['onRequest', 'beforeAuth', 'afterAuth', 'beforeForward', 'onResponse', 'onError', 'onUpgrade'].some((p) => has(p));
-    const httpContext = (req, request, reply, trace) => {
-        let didRespond = false;
-        return {
-            req, request, reply, socket: undefined, trace,
-            route: undefined, caller: undefined, claims: undefined, version: undefined, error: undefined, status: undefined,
-            sendError: (status, reason, detail) => { (0, edge_1.sendError)(reply, req, status, reason, detail); didRespond = true; },
-            responded: () => didRespond || reply.raw.writableEnded,
-        };
-    };
-    const upgradeContext = (req, socket, trace) => {
-        let didRespond = false;
-        return {
-            req, request: undefined, reply: undefined, socket, trace,
-            route: undefined, caller: undefined, claims: undefined, version: undefined, error: undefined, status: undefined,
-            sendError: () => { try {
-                socket.destroy();
-            }
-            catch { /* already gone */ } didRespond = true; },
-            responded: () => didRespond || socket.destroyed,
-        };
-    };
-    return { any, run, has, httpContext, upgradeContext };
-}
+"use strict";var f=Object.defineProperty;var i=(t,d)=>f(t,"name",{value:d,configurable:!0});var l=Object.defineProperty,n=i((t,d)=>l(t,"name",{value:d,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHooks=createHooks;const edge_1=require("./edge"),TERMINAL_PHASES=new Set(["onResponse","onError"]);function createHooks(t){const d=n(async(e,o)=>{const r=t[e];if(!r||r.length===0)return;const s=TERMINAL_PHASES.has(e);for(const a of r){if(!s&&o.responded())return;await a(o)}},"run"),u=n(e=>(t[e]?.length??0)>0,"has");return{any:["onRequest","beforeAuth","afterAuth","beforeForward","onResponse","onError","onUpgrade"].some(e=>u(e)),run:d,has:u,httpContext:n((e,o,r,s)=>{let a=!1;return{req:e,request:o,reply:r,socket:void 0,trace:s,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n((c,v,p)=>{(0,edge_1.sendError)(r,e,c,v,p),a=!0},"sendError"),responded:n(()=>a||r.raw.writableEnded,"responded")}},"httpContext"),upgradeContext:n((e,o,r)=>{let s=!1;return{req:e,request:void 0,reply:void 0,socket:o,trace:r,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n(()=>{try{o.destroy()}catch{}s=!0},"sendError"),responded:n(()=>s||o.destroyed,"responded")}},"upgradeContext")}}i(createHooks,"createHooks"),n(createHooks,"createHooks");