@lensmcp/cluster 1.18.4 → 1.18.7

package/executors/gateway/main.rollout.js

@@ -1,25 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runRollout = runRollout;
-/**
- * `lensmcp rollout` CD helper entry — safe, scriptable edits to the gateway
- * rollout config. Two targets:
- *   - a FILE (default): the watched config / mounted ConfigMap. Atomic write
- *     (tmp + rename) so the gateway watcher never reads a half file.
- *   - a REDIS registry (`--redis <url>`): writes the service's rollout key and
- *     PUBLISHES the change channel, so a registry-backed gateway re-reads live
- *     (zero-touch auto-sync; no file mounts).
- *
- *   node main.rollout.js <config.json> <command> [args]
- *   node main.rollout.js --redis <url> [--prefix <p>] <command> [args]
- *
- * Available from the published @lensmcp/cluster package; `lensmcp rollout …`
- * wraps it. See docs/design/targeted-rollout.md.
- */
-const node_fs_1 = require("node:fs");
-const rollout_ops_1 = require("./rollout-ops");
-const registry_source_1 = require("./registry-source");
-const USAGE = `lensmcp rollout — edit the gateway rollout config (file or Redis registry)
+"use strict";var p=Object.defineProperty;var l=(e,r)=>p(e,"name",{value:r,configurable:!0});var a=Object.defineProperty,i=l((e,r)=>a(e,"name",{value:r,configurable:!0}),"i");Object.defineProperty(exports,"__esModule",{value:!0}),exports.runRollout=runRollout;const node_fs_1=require("node:fs"),rollout_ops_1=require("./rollout-ops"),registry_source_1=require("./registry-source"),USAGE=`lensmcp rollout \u2014 edit the gateway rollout config (file or Redis registry)
 
 Usage: <config.json> <command> [args]
        --redis <url> [--prefix <p>] <command> [args]
@@ -33,98 +12,13 @@ Commands:
   abort       <svc> <version>                            set version weight=0 (rollback)
   add-rule    <svc> <name> <attr> <op> <value> <version> add/replace a targeting rule
   remove-rule <svc> <name>                               remove a targeting rule
-`;
-const out = (s) => process.stdout.write(s.endsWith('\n') ? s : s + '\n');
-const err = (s) => process.stderr.write(s.endsWith('\n') ? s : s + '\n');
-/** Pull `--flag <value>` out of argv, returning its value + the remaining args. */
-function extractFlag(argv, name) {
-    const i = argv.indexOf(name);
-    if (i < 0)
-        return { rest: argv };
-    return { value: argv[i + 1], rest: [...argv.slice(0, i), ...argv.slice(i + 2)] };
-}
-function runFile(argv) {
-    const [file, ...rest] = argv;
-    if (!file || !rest.length) {
-        err(USAGE);
-        return 2;
-    }
-    let config;
-    try {
-        config = JSON.parse((0, node_fs_1.readFileSync)(file, 'utf8'));
-    }
-    catch (e) {
-        err(`cannot read ${file}: ${e.message}`);
-        return 1;
-    }
-    try {
-        const parsed = (0, rollout_ops_1.parseRolloutCommand)(rest);
-        if (!parsed.op) {
-            out((0, rollout_ops_1.summarizeRollout)(config, parsed.status));
-            return 0;
-        }
-        const next = (0, rollout_ops_1.applyRolloutOp)(config, parsed.op);
-        (0, node_fs_1.writeFileSync)(`${file}.tmp`, JSON.stringify(next, null, 2) + '\n');
-        (0, node_fs_1.renameSync)(`${file}.tmp`, file); // atomic — the watcher never sees a partial file
-        out(`✓ ${parsed.op.kind} ${parsed.op.service}\n\n${(0, rollout_ops_1.summarizeRollout)(next, parsed.op.service)}`);
-        return 0;
-    }
-    catch (e) {
-        err(`✗ ${e.message}`);
-        return 1;
-    }
-}
-async function runRedis(url, prefix, argv) {
-    if (!argv.length) {
-        err(USAGE);
-        return 2;
-    }
-    let client;
-    try {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const Redis = require('ioredis');
-        client = new Redis(url);
-    }
-    catch {
-        err('--redis needs the "ioredis" package installed (peer dep of @lensmcp/cluster)');
-        return 1;
-    }
-    try {
-        const { endpoints } = await (0, registry_source_1.redisRegistrySource)(client, { prefix }).read();
-        const parsed = (0, rollout_ops_1.parseRolloutCommand)(argv);
-        if (!parsed.op) {
-            out((0, rollout_ops_1.summarizeRollout)(endpoints, parsed.status));
-            return 0;
-        }
-        const next = (0, rollout_ops_1.applyRolloutOp)(endpoints, parsed.op);
-        const svc = parsed.op.service;
-        const entry = next[svc];
-        if (entry === undefined)
-            await client.del((0, registry_source_1.rolloutKey)(prefix, svc));
-        else
-            await client.set((0, registry_source_1.rolloutKey)(prefix, svc), JSON.stringify(entry));
-        await client.publish((0, registry_source_1.changeChannel)(prefix), svc); // gateway re-reads live
-        out(`✓ ${parsed.op.kind} ${svc} → redis ${prefix} (published)\n\n${(0, rollout_ops_1.summarizeRollout)(next, svc)}`);
-        return 0;
-    }
-    catch (e) {
-        err(`✗ ${e.message}`);
-        return 1;
-    }
-    finally {
-        try {
-            await client.quit();
-        }
-        catch { /* ignore */ }
-    }
-}
-async function runRollout(argv) {
-    const redis = extractFlag(argv, '--redis');
-    const pref = extractFlag(redis.rest, '--prefix');
-    if (redis.value)
-        return runRedis(redis.value, pref.value ?? registry_source_1.DEFAULT_REGISTRY_PREFIX, pref.rest);
-    return runFile(pref.rest);
-}
-// Run only when invoked directly (not when imported, e.g. by the lensmcp CLI).
-if (require.main === module)
-    void runRollout(process.argv.slice(2)).then((code) => process.exit(code));
+`,out=i(e=>process.stdout.write(e.endsWith(`
+`)?e:e+`
+`),"out"),err=i(e=>process.stderr.write(e.endsWith(`
+`)?e:e+`
+`),"err");function extractFlag(e,r){const o=e.indexOf(r);return o<0?{rest:e}:{value:e[o+1],rest:[...e.slice(0,o),...e.slice(o+2)]}}l(extractFlag,"extractFlag"),i(extractFlag,"extractFlag");function runFile(e){const[r,...o]=e;if(!r||!o.length)return err(USAGE),2;let s;try{s=JSON.parse((0,node_fs_1.readFileSync)(r,"utf8"))}catch(t){return err(`cannot read ${r}: ${t.message}`),1}try{const t=(0,rollout_ops_1.parseRolloutCommand)(o);if(!t.op)return out((0,rollout_ops_1.summarizeRollout)(s,t.status)),0;const n=(0,rollout_ops_1.applyRolloutOp)(s,t.op);return(0,node_fs_1.writeFileSync)(`${r}.tmp`,JSON.stringify(n,null,2)+`
+`),(0,node_fs_1.renameSync)(`${r}.tmp`,r),out(`\u2713 ${t.op.kind} ${t.op.service}
+
+${(0,rollout_ops_1.summarizeRollout)(n,t.op.service)}`),0}catch(t){return err(`\u2717 ${t.message}`),1}}l(runFile,"runFile"),i(runFile,"runFile");async function runRedis(e,r,o){if(!o.length)return err(USAGE),2;let s;try{const t=require("ioredis");s=new t(e)}catch{return err('--redis needs the "ioredis" package installed (peer dep of @lensmcp/cluster)'),1}try{const{endpoints:t}=await(0,registry_source_1.redisRegistrySource)(s,{prefix:r}).read(),n=(0,rollout_ops_1.parseRolloutCommand)(o);if(!n.op)return out((0,rollout_ops_1.summarizeRollout)(t,n.status)),0;const c=(0,rollout_ops_1.applyRolloutOp)(t,n.op),u=n.op.service,d=c[u];return d===void 0?await s.del((0,registry_source_1.rolloutKey)(r,u)):await s.set((0,registry_source_1.rolloutKey)(r,u),JSON.stringify(d)),await s.publish((0,registry_source_1.changeChannel)(r),u),out(`\u2713 ${n.op.kind} ${u} \u2192 redis ${r} (published)
+
+${(0,rollout_ops_1.summarizeRollout)(c,u)}`),0}catch(t){return err(`\u2717 ${t.message}`),1}finally{try{await s.quit()}catch{}}}l(runRedis,"runRedis"),i(runRedis,"runRedis");async function runRollout(e){const r=extractFlag(e,"--redis"),o=extractFlag(r.rest,"--prefix");return r.value?runRedis(r.value,o.value??registry_source_1.DEFAULT_REGISTRY_PREFIX,o.rest):runFile(o.rest)}l(runRollout,"runRollout"),i(runRollout,"runRollout"),require.main===module&&runRollout(process.argv.slice(2)).then(e=>process.exit(e));

package/executors/gateway/manifest.js

@@ -1,374 +1 @@
-"use strict";
-/**
- * Route manifests + the provider seams that make the gateway ONE library
- * across dev and prod.
- *
- * The dev gateway and the production gateway share this routing core. A
- * service DESCRIBES itself with a `RouteManifest` (in dev, synthesized from
- * the project.json `cluster` field; in prod, published by the service to a
- * registry / served at `/.well-known/lensmcp-routes`). The gateway builds a
- * flat `Route[]` from the manifests and matches requests against it — the
- * SAME `matchRoute` in both environments, so routing can never drift.
- *
- * What differs between dev and prod is supplied through two interfaces:
- *   - ManifestProvider — WHERE the manifests come from (workspace scan vs
- *     registry watch) and how changes arrive.
- *   - PodProvider — HOW a service name resolves to a concrete upstream
- *     (unix-socket pool with scale-from-zero vs a TCP endpoint).
- *
- * This module is PURE (no IO, no process, no http) so it is exhaustively
- * unit-testable; the providers carry the environment-specific machinery.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.smoothWeightedSelector = smoothWeightedSelector;
-exports.hostMatches = hostMatches;
-exports.matchRoute = matchRoute;
-exports.sortBySpecificity = sortBySpecificity;
-exports.authForPath = authForPath;
-exports.authPathMatches = authPathMatches;
-exports.authRuleFor = authRuleFor;
-exports.authRuleForPath = authRuleForPath;
-exports.buildRouteTable = buildRouteTable;
-exports.manifestFromClusterDecl = manifestFromClusterDecl;
-exports.matchCidr = matchCidr;
-exports.evalRule = evalRule;
-exports.pickTargetedVersion = pickTargetedVersion;
-exports.fnv1a = fnv1a;
-exports.bucketByWeight = bucketByWeight;
-/**
- * Smooth weighted round-robin (nginx-style). Returns a stateful selector that,
- * over time, hands out indices in proportion to `weights` — but INTERLEAVED
- * (90/10 yields the rare cohort roughly every tenth pick, not in a burst at
- * the end). Deterministic given the weights, so rollout splits are testable.
- * A zero/negative total (all cohorts drained) falls back to index 0.
- */
-function smoothWeightedSelector(weights) {
-    const cur = weights.map(() => 0);
-    const total = weights.reduce((s, w) => s + Math.max(0, w), 0);
-    return () => {
-        if (total <= 0 || weights.length === 0)
-            return 0;
-        let best = 0;
-        for (let i = 0; i < weights.length; i++) {
-            cur[i] += Math.max(0, weights[i]);
-            if (cur[i] > cur[best])
-                best = i;
-        }
-        cur[best] -= total;
-        return best;
-    };
-}
-/** Exact hostname or `*.suffix` wildcard (the bare suffix also matches). */
-function hostMatches(pattern, host) {
-    return pattern.startsWith('*.')
-        ? host.endsWith(pattern.slice(1)) || host === pattern.slice(2)
-        : host === pattern;
-}
-/**
- * THE matcher — shared by dev and prod. Generic over the route shape so the
- * dev gateway can pass its pod-rich routes and prod its upstream routes; only
- * `host`/`prefix` are read here.
- *
- * Rules (each one a fixed bug):
- *  - A host CLAIMED by any declaration never falls through to the catch-all
- *    default; its unmatched paths belong to the gateway's own infra.
- *  - An UNCLAIMED host may only reach the host-less `default` route — never a
- *    host route by accident of sort order (unknown host → default or 404).
- *  - An EXACT host match beats a wildcard (`internal.api.x` is served by its
- *    own route, not a co-existing `*.x` app).
- *  - Within the candidates, the most specific path prefix wins (callers sort
- *    routes by specificity: host+path before host before catch-all).
- */
-function matchRoute(routes, host, url) {
-    const claimed = routes.some((r) => r.host && hostMatches(r.host, host));
-    let candidates;
-    if (claimed) {
-        candidates = routes.filter((r) => r.host && hostMatches(r.host, host));
-        if (candidates.some((r) => r.host === host)) {
-            candidates = candidates.filter((r) => r.host === host);
-        }
-    }
-    else {
-        // UNCLAIMED host → the host-less default catch-all(s). ONE default (a single workspace) → today's
-        // behavior, apex ignored. MULTIPLE defaults (a shared multi-workspace gateway that merged several
-        // workspaces' fragments) → route by APEX: the default whose apex the request host belongs to, longest
-        // apex first; a foreign host matching no apex falls to an apex-less GLOBAL default (else nothing → 404).
-        const defaults = routes.filter((r) => !r.host);
-        if (defaults.length <= 1) {
-            candidates = defaults;
-        }
-        else {
-            const apexHit = defaults
-                .filter((r) => r.apex && (host === r.apex || host.endsWith('.' + r.apex)))
-                .sort((a, b) => b.apex.length - a.apex.length);
-            candidates = apexHit.length > 0 ? apexHit : defaults.filter((r) => !r.apex);
-        }
-    }
-    return candidates.find((r) => !r.prefix || url.startsWith(r.prefix));
-}
-/** Specificity sort: host+path beats host-only beats catch-all. Mutates+returns. */
-function sortBySpecificity(routes) {
-    routes.sort((a, b) => ((b.host ? 2 : 0) + (b.prefix ? 1 : 0)) - ((a.host ? 2 : 0) + (a.prefix ? 1 : 0)));
-    return routes;
-}
-/** Resolve the auth mode for a concrete request path against a manifest. */
-function authForPath(manifest, path, internal) {
-    if (internal)
-        return 'internal';
-    const overrides = manifest.auth?.overrides ?? [];
-    for (const o of overrides)
-        if (path.startsWith(o.path))
-            return o.mode;
-    return manifest.auth?.default ?? 'jwt';
-}
-/**
- * Resolve the auth mode + any edge ABAC rule for a concrete (path, method) against an
- * {@link AuthPolicy} — the shared core both gateways use. First override whose `path` is a
- * prefix and whose `methods` include the method wins (callers emit most-specific-first);
- * `permission` is compiled to a `perms contains` condition.
- */
-/**
- * Segment-prefix match where a pattern segment of `*` or `:param` matches ANY one path segment —
- * so a route override like `/engage/tenants/:companyId/campaigns` matches the real request
- * `/engage/tenants/abc-123/campaigns` (and anything deeper). Stricter than `startsWith` (it won't
- * cross a segment boundary), which is also more correct. Lets `@RequirePermission` enforce on
- * tenant-scoped (`:param`) routes, not just static prefixes.
- */
-function authPathMatches(pattern, path) {
-    const ps = pattern.split('/').filter(Boolean);
-    const xs = (path.split('?')[0] ?? '').split('/').filter(Boolean);
-    if (xs.length < ps.length)
-        return false;
-    for (let i = 0; i < ps.length; i++) {
-        const seg = ps[i];
-        if (seg === '*' || seg.startsWith(':'))
-            continue;
-        if (seg !== xs[i])
-            return false;
-    }
-    return true;
-}
-function authRuleFor(policy, path, method) {
-    const m = method.toUpperCase();
-    for (const o of policy?.overrides ?? []) {
-        if (!authPathMatches(o.path, path))
-            continue;
-        if (o.methods && !o.methods.some((x) => x.toUpperCase() === m))
-            continue;
-        const rule = o.rule ?? (o.permission ? { attr: 'perms', op: 'hastoken', value: o.permission } : undefined);
-        // An override that omits `mode` INHERITS the service default — otherwise a
-        // permission-only override would resolve to mode=undefined and the gateway
-        // would skip the jwt branch entirely, silently NOT enforcing the permission.
-        return { mode: o.mode ?? policy?.default ?? 'jwt', ...(rule ? { rule } : {}) };
-    }
-    return { mode: policy?.default ?? 'jwt' };
-}
-/**
- * Resolve the auth mode AND any edge ABAC rule for a concrete (path, method) on a manifest —
- * the permission-aware companion to {@link authForPath}. Internal routes are always `internal`;
- * otherwise delegates to {@link authRuleFor}. The gateway verifies the JWT for `jwt` mode and,
- * when a `rule` is present, requires `evalRule(rule, attrs)` (else 403).
- */
-function authRuleForPath(manifest, path, method, internal) {
-    if (internal)
-        return { mode: 'internal' };
-    return authRuleFor(manifest.auth, path, method);
-}
-/**
- * Build the flat route table from manifests. Each mount becomes a host route;
- * a service flagged `internal` also gets an `internal.<host>` route per mount;
- * a `default` service contributes the host-less catch-all. Sorted by
- * specificity so `matchRoute` picks the most specific.
- */
-function buildRouteTable(manifests) {
-    const routes = [];
-    for (const m of manifests) {
-        const baseAuth = m.auth?.default ?? 'jwt';
-        for (const mount of m.mounts) {
-            const base = {
-                service: m.service,
-                ...(mount.path ? { prefix: mount.path } : {}),
-                ...(m.prependPrefix ? { prependPrefix: m.prependPrefix } : {}),
-                ...(m.upstream ? { upstream: m.upstream } : {}),
-            };
-            routes.push({ ...base, host: mount.host, auth: baseAuth });
-            if (m.internal && m.internalHost !== false) {
-                routes.push({
-                    ...base,
-                    host: typeof m.internalHost === 'string' ? m.internalHost : `internal.${mount.host}`,
-                    internal: true,
-                    auth: 'internal',
-                });
-            }
-        }
-        if (m.default) {
-            routes.push({
-                service: m.service,
-                ...(m.prependPrefix ? { prependPrefix: m.prependPrefix } : {}),
-                ...(m.upstream ? { upstream: m.upstream } : {}),
-                default: true,
-                auth: baseAuth,
-            });
-        }
-    }
-    return sortBySpecificity(routes);
-}
-/** Synthesize a manifest from a dev project.json `cluster` declaration —
- *  the dev ManifestProvider's adapter, and the seed for `lensmcp`-generated
- *  prod manifests (same fields, prod adds version/rateLimits). */
-function manifestFromClusterDecl(project, decl) {
-    const upstream = decl.upstream ?? (decl.port ? `http://localhost:${decl.port}` : undefined);
-    // A service must route SOMEWHERE: either a pod service name or a TCP upstream.
-    if (!decl.service && !upstream)
-        return undefined;
-    return {
-        service: decl.service ?? project,
-        mounts: decl.host ? [{ host: decl.host, ...(decl.path ? { path: decl.path } : {}) }] : [],
-        // pod services get an internal east-west host by default; TCP upstreams don't.
-        internal: !!decl.service,
-        ...(decl.internalHost !== undefined ? { internalHost: decl.internalHost } : {}),
-        ...(decl.default ? { default: true } : {}),
-        ...(decl.prependPrefix ? { prependPrefix: decl.prependPrefix } : {}),
-        ...(decl.auth ? { auth: decl.auth } : {}),
-        ...(upstream ? { upstream } : {}),
-    };
-}
-const isGroup = (n) => 'all' in n || 'any' in n || 'not' in n;
-const reCache = new Map();
-const compileRe = (src) => {
-    if (src.length > 512)
-        return null; // ReDoS guard — bound pattern length
-    if (reCache.has(src))
-        return reCache.get(src);
-    let re;
-    try {
-        re = new RegExp(src);
-    }
-    catch {
-        re = null;
-    }
-    reCache.set(src, re);
-    return re;
-};
-/** IPv4 dotted-quad → uint32, or null if malformed. */
-function ipToInt(ip) {
-    const v4 = ip.startsWith('::ffff:') ? ip.slice(7) : ip; // IPv4-mapped IPv6
-    const parts = v4.split('.');
-    if (parts.length !== 4)
-        return null;
-    let n = 0;
-    for (const p of parts) {
-        const o = Number(p);
-        if (!Number.isInteger(o) || o < 0 || o > 255 || (p.length > 1 && p[0] === '0'))
-            return null;
-        n = n * 256 + o;
-    }
-    return n >>> 0;
-}
-/** `ip ∈ cidr` for IPv4 (handles IPv4-mapped IPv6). False for IPv6/malformed. */
-function matchCidr(ip, cidr) {
-    const slash = cidr.indexOf('/');
-    if (slash < 0)
-        return false;
-    const bits = Number(cidr.slice(slash + 1));
-    if (!Number.isInteger(bits) || bits < 0 || bits > 32)
-        return false;
-    const ipN = ipToInt(ip);
-    const rangeN = ipToInt(cidr.slice(0, slash));
-    if (ipN === null || rangeN === null)
-        return false;
-    if (bits === 0)
-        return true;
-    const mask = (bits === 32 ? 0xffffffff : ~((1 << (32 - bits)) - 1)) >>> 0;
-    return ((ipN & mask) >>> 0) === ((rangeN & mask) >>> 0);
-}
-const str = (v) => (v === null || v === undefined ? '' : String(v));
-const eq = (a, b) => str(a) === str(b);
-/** Evaluate one condition against the attributes. Undefined attribute → false
- *  for every op except `ne` (absent ≠ value → true) and `exists` (→ false). */
-function evalCondition(c, attrs) {
-    const v = attrs[c.attr];
-    const present = v !== undefined && v !== null;
-    switch (c.op) {
-        case 'exists': return present;
-        case 'ne': return !present || !eq(v, c.value);
-    }
-    if (!present)
-        return false;
-    switch (c.op) {
-        case 'eq': return eq(v, c.value);
-        case 'in': return Array.isArray(c.value) && c.value.some((x) => Array.isArray(v) ? v.some((vv) => eq(vv, x)) : eq(v, x));
-        case 'nin': return !(Array.isArray(c.value) && c.value.some((x) => Array.isArray(v) ? v.some((vv) => eq(vv, x)) : eq(v, x)));
-        case 'prefix': return str(v).startsWith(str(c.value));
-        case 'suffix': return str(v).endsWith(str(c.value));
-        case 'contains': return Array.isArray(v) ? v.some((vv) => eq(vv, c.value)) : str(v).includes(str(c.value)); // substring / array element (general op)
-        // EXACT token in a list — a `perms`/scope STRING is delimited, so "superadmin"/"billing,adminx"
-        // must NOT satisfy hastoken:"admin". This is what `permission` compiles to (authz, no substring bypass).
-        case 'hastoken': {
-            const cv = str(c.value);
-            return Array.isArray(v) ? v.some((vv) => eq(vv, c.value)) : str(v).split(/[\s,]+/).filter(Boolean).includes(cv);
-        }
-        case 'regex': {
-            const re = compileRe(str(c.value));
-            return re ? re.test(str(v)) : false;
-        }
-        case 'gt': return Number(v) > Number(c.value);
-        case 'lt': return Number(v) < Number(c.value);
-        case 'cidr': return matchCidr(str(v), str(c.value));
-        default: return false;
-    }
-}
-/** Evaluate a rule node (condition or all/any/not group) against attributes. Pure. */
-function evalRule(node, attrs) {
-    if (!isGroup(node))
-        return evalCondition(node, attrs);
-    // Only MEANINGFUL clauses count — an empty all:[]/any:[]/not:{} must NOT vacuously admit (fail closed),
-    // while a real `not:{cond}`-only rule still grants when its veto passes.
-    const all = Array.isArray(node.all) && node.all.length ? node.all : undefined;
-    const any = Array.isArray(node.any) && node.any.length ? node.any : undefined;
-    const not = node.not && Object.keys(node.not).length ? node.not : undefined;
-    if (not && evalRule(not, attrs))
-        return false; // veto
-    if (all && !all.every((n) => evalRule(n, attrs)))
-        return false;
-    if (any && !any.some((n) => evalRule(n, attrs)))
-        return false;
-    return !!(all || any || not); // grant only if ≥1 meaningful clause was present (and satisfied)
-}
-/** First matching rule's version (top-to-bottom), or undefined. */
-function pickTargetedVersion(rules, attrs) {
-    for (const r of rules) {
-        if (evalRule(r.when, attrs))
-            return { version: r.version, ...(r.name ? { rule: r.name } : {}) };
-    }
-    return undefined;
-}
-/** 32-bit FNV-1a hash → unsigned int. Stable across processes (no seed). */
-function fnv1a(s) {
-    let h = 0x811c9dc5;
-    for (let i = 0; i < s.length; i++) {
-        h ^= s.charCodeAt(i);
-        h = Math.imul(h, 0x01000193);
-    }
-    return h >>> 0;
-}
-/**
- * Consistent-hash a stable key to a cohort INDEX by weight. The hash point uses
- * a FIXED modulus (10000) so it is stable per key regardless of the weights;
- * only the cohort thresholds move when weights change — so ramping a weight
- * moves a key across the boundary AT MOST ONCE (no reshuffle/flapping). Fixed
- * cohort order. All-zero weights → 0.
- */
-function bucketByWeight(key, weights) {
-    const total = weights.reduce((a, w) => a + Math.max(0, w), 0);
-    if (total <= 0 || weights.length === 0)
-        return 0;
-    const point = fnv1a(key) % 10000;
-    let acc = 0;
-    for (let i = 0; i < weights.length; i++) {
-        acc += (Math.max(0, weights[i]) / total) * 10000;
-        if (point < acc)
-            return i;
-    }
-    return weights.length - 1;
-}
+"use strict";var h=Object.defineProperty;var u=(t,e)=>h(t,"name",{value:e,configurable:!0});var f=Object.defineProperty,a=u((t,e)=>f(t,"name",{value:e,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0}),exports.smoothWeightedSelector=smoothWeightedSelector,exports.hostMatches=hostMatches,exports.matchRoute=matchRoute,exports.sortBySpecificity=sortBySpecificity,exports.authForPath=authForPath,exports.authPathMatches=authPathMatches,exports.authRuleFor=authRuleFor,exports.authRuleForPath=authRuleForPath,exports.buildRouteTable=buildRouteTable,exports.manifestFromClusterDecl=manifestFromClusterDecl,exports.matchCidr=matchCidr,exports.evalRule=evalRule,exports.pickTargetedVersion=pickTargetedVersion,exports.fnv1a=fnv1a,exports.bucketByWeight=bucketByWeight;function smoothWeightedSelector(t){const e=t.map(()=>0),r=t.reduce((o,n)=>o+Math.max(0,n),0);return()=>{if(r<=0||t.length===0)return 0;let o=0;for(let n=0;n<t.length;n++)e[n]+=Math.max(0,t[n]),e[n]>e[o]&&(o=n);return e[o]-=r,o}}u(smoothWeightedSelector,"smoothWeightedSelector"),a(smoothWeightedSelector,"smoothWeightedSelector");function hostMatches(t,e){return t.startsWith("*.")?e.endsWith(t.slice(1))||e===t.slice(2):e===t}u(hostMatches,"hostMatches"),a(hostMatches,"hostMatches");function matchRoute(t,e,r){const o=t.some(s=>s.host&&hostMatches(s.host,e));let n;if(o)n=t.filter(s=>s.host&&hostMatches(s.host,e)),n.some(s=>s.host===e)&&(n=n.filter(s=>s.host===e));else{const s=t.filter(i=>!i.host);if(s.length<=1)n=s;else{const i=s.filter(l=>l.apex&&(e===l.apex||e.endsWith("."+l.apex))).sort((l,c)=>c.apex.length-l.apex.length);n=i.length>0?i:s.filter(l=>!l.apex)}}return n.find(s=>!s.prefix||r.startsWith(s.prefix))}u(matchRoute,"matchRoute"),a(matchRoute,"matchRoute");function sortBySpecificity(t){return t.sort((e,r)=>(r.host?2:0)+(r.prefix?1:0)-((e.host?2:0)+(e.prefix?1:0))),t}u(sortBySpecificity,"sortBySpecificity"),a(sortBySpecificity,"sortBySpecificity");function authForPath(t,e,r){if(r)return"internal";const o=t.auth?.overrides??[];for(const n of o)if(e.startsWith(n.path))return n.mode;return t.auth?.default??"jwt"}u(authForPath,"authForPath"),a(authForPath,"authForPath");function authPathMatches(t,e){const r=t.split("/").filter(Boolean),o=(e.split("?")[0]??"").split("/").filter(Boolean);if(o.length<r.length)return!1;for(let n=0;n<r.length;n++){const s=r[n];if(!(s==="*"||s.startsWith(":"))&&s!==o[n])return!1}return!0}u(authPathMatches,"authPathMatches"),a(authPathMatches,"authPathMatches");function authRuleFor(t,e,r){const o=r.toUpperCase();for(const n of t?.overrides??[]){if(!authPathMatches(n.path,e)||n.methods&&!n.methods.some(i=>i.toUpperCase()===o))continue;const s=n.rule??(n.permission?{attr:"perms",op:"hastoken",value:n.permission}:void 0);return{mode:n.mode??t?.default??"jwt",...s?{rule:s}:{}}}return{mode:t?.default??"jwt"}}u(authRuleFor,"authRuleFor"),a(authRuleFor,"authRuleFor");function authRuleForPath(t,e,r,o){return o?{mode:"internal"}:authRuleFor(t.auth,e,r)}u(authRuleForPath,"authRuleForPath"),a(authRuleForPath,"authRuleForPath");function buildRouteTable(t){const e=[];for(const r of t){const o=r.auth?.default??"jwt";for(const n of r.mounts){const s={service:r.service,...n.path?{prefix:n.path}:{},...r.prependPrefix?{prependPrefix:r.prependPrefix}:{},...r.upstream?{upstream:r.upstream}:{}};e.push({...s,host:n.host,auth:o}),r.internal&&r.internalHost!==!1&&e.push({...s,host:typeof r.internalHost=="string"?r.internalHost:`internal.${n.host}`,internal:!0,auth:"internal"})}r.default&&e.push({service:r.service,...r.prependPrefix?{prependPrefix:r.prependPrefix}:{},...r.upstream?{upstream:r.upstream}:{},default:!0,auth:o})}return sortBySpecificity(e)}u(buildRouteTable,"buildRouteTable"),a(buildRouteTable,"buildRouteTable");function manifestFromClusterDecl(t,e){const r=e.upstream??(e.port?`http://localhost:${e.port}`:void 0);if(!(!e.service&&!r))return{service:e.service??t,mounts:e.host?[{host:e.host,...e.path?{path:e.path}:{}}]:[],internal:!!e.service,...e.internalHost!==void 0?{internalHost:e.internalHost}:{},...e.default?{default:!0}:{},...e.prependPrefix?{prependPrefix:e.prependPrefix}:{},...e.auth?{auth:e.auth}:{},...r?{upstream:r}:{}}}u(manifestFromClusterDecl,"manifestFromClusterDecl"),a(manifestFromClusterDecl,"manifestFromClusterDecl");const isGroup=a(t=>"all"in t||"any"in t||"not"in t,"isGroup"),reCache=new Map,compileRe=a(t=>{if(t.length>512)return null;if(reCache.has(t))return reCache.get(t);let e;try{e=new RegExp(t)}catch{e=null}return reCache.set(t,e),e},"compileRe");function ipToInt(t){const e=(t.startsWith("::ffff:")?t.slice(7):t).split(".");if(e.length!==4)return null;let r=0;for(const o of e){const n=Number(o);if(!Number.isInteger(n)||n<0||n>255||o.length>1&&o[0]==="0")return null;r=r*256+n}return r>>>0}u(ipToInt,"ipToInt"),a(ipToInt,"ipToInt");function matchCidr(t,e){const r=e.indexOf("/");if(r<0)return!1;const o=Number(e.slice(r+1));if(!Number.isInteger(o)||o<0||o>32)return!1;const n=ipToInt(t),s=ipToInt(e.slice(0,r));if(n===null||s===null)return!1;if(o===0)return!0;const i=(o===32?4294967295:~((1<<32-o)-1))>>>0;return(n&i)>>>0===(s&i)>>>0}u(matchCidr,"matchCidr"),a(matchCidr,"matchCidr");const str=a(t=>t==null?"":String(t),"str"),eq=a((t,e)=>str(t)===str(e),"eq");function evalCondition(t,e){const r=e[t.attr],o=r!=null;switch(t.op){case"exists":return o;case"ne":return!o||!eq(r,t.value)}if(!o)return!1;switch(t.op){case"eq":return eq(r,t.value);case"in":return Array.isArray(t.value)&&t.value.some(n=>Array.isArray(r)?r.some(s=>eq(s,n)):eq(r,n));case"nin":return!(Array.isArray(t.value)&&t.value.some(n=>Array.isArray(r)?r.some(s=>eq(s,n)):eq(r,n)));case"prefix":return str(r).startsWith(str(t.value));case"suffix":return str(r).endsWith(str(t.value));case"contains":return Array.isArray(r)?r.some(n=>eq(n,t.value)):str(r).includes(str(t.value));case"hastoken":{const n=str(t.value);return Array.isArray(r)?r.some(s=>eq(s,t.value)):str(r).split(/[\s,]+/).filter(Boolean).includes(n)}case"regex":{const n=compileRe(str(t.value));return n?n.test(str(r)):!1}case"gt":return Number(r)>Number(t.value);case"lt":return Number(r)<Number(t.value);case"cidr":return matchCidr(str(r),str(t.value));default:return!1}}u(evalCondition,"evalCondition"),a(evalCondition,"evalCondition");function evalRule(t,e){if(!isGroup(t))return evalCondition(t,e);const r=Array.isArray(t.all)&&t.all.length?t.all:void 0,o=Array.isArray(t.any)&&t.any.length?t.any:void 0,n=t.not&&Object.keys(t.not).length?t.not:void 0;return n&&evalRule(n,e)||r&&!r.every(s=>evalRule(s,e))||o&&!o.some(s=>evalRule(s,e))?!1:!!(r||o||n)}u(evalRule,"evalRule"),a(evalRule,"evalRule");function pickTargetedVersion(t,e){for(const r of t)if(evalRule(r.when,e))return{version:r.version,...r.name?{rule:r.name}:{}}}u(pickTargetedVersion,"pickTargetedVersion"),a(pickTargetedVersion,"pickTargetedVersion");function fnv1a(t){let e=2166136261;for(let r=0;r<t.length;r++)e^=t.charCodeAt(r),e=Math.imul(e,16777619);return e>>>0}u(fnv1a,"fnv1a"),a(fnv1a,"fnv1a");function bucketByWeight(t,e){const r=e.reduce((s,i)=>s+Math.max(0,i),0);if(r<=0||e.length===0)return 0;const o=fnv1a(t)%1e4;let n=0;for(let s=0;s<e.length;s++)if(n+=Math.max(0,e[s])/r*1e4,o<n)return s;return e.length-1}u(bucketByWeight,"bucketByWeight"),a(bucketByWeight,"bucketByWeight");

package/executors/gateway/metrics.js

@@ -1,56 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createProcessMetrics = createProcessMetrics;
-/**
- * Process self-metrics for the production gateway — the signals a load/stress test
- * needs that can ONLY be measured from inside the process: event-loop delay (lag),
- * RSS/heap, CPU time, and request rates. OPT-IN; exposed via the token-gated
- * `/metricsz` endpoint and reusable for production monitoring (Prometheus-style scrape).
- *
- * `snapshot()` returns DELTAS since the previous call (CPU%, requests/sec, and a fresh
- * event-loop-lag histogram), so a poller sampling every N seconds reads interval rates —
- * the natural shape for a load run's time series.
- */
-const node_perf_hooks_1 = require("node:perf_hooks");
-const MB = 1024 * 1024;
-const round = (n, d = 1) => { const f = 10 ** d; return Math.round(n * f) / f; };
-function createProcessMetrics() {
-    const startedAt = Date.now();
-    const loop = (0, node_perf_hooks_1.monitorEventLoopDelay)({ resolution: 10 });
-    loop.enable();
-    let lastCpu = process.cpuUsage();
-    let lastAt = Date.now();
-    let total = 0, s2 = 0, s4 = 0, s5 = 0, lastTotal = 0;
-    const lagMs = (ns) => round(ns / 1e6, 2);
-    return {
-        recordRequest(status) {
-            total += 1;
-            if (status >= 500 || status === 0)
-                s5 += 1;
-            else if (status >= 400)
-                s4 += 1;
-            else if (status >= 200)
-                s2 += 1;
-        },
-        snapshot() {
-            const now = Date.now();
-            const wallMs = Math.max(1, now - lastAt);
-            const cpu = process.cpuUsage(lastCpu); // µs since lastCpu
-            const mem = process.memoryUsage();
-            const cpuMs = (cpu.user + cpu.system) / 1000;
-            const snap = {
-                uptimeSec: Math.round((now - startedAt) / 1000),
-                rssMB: round(mem.rss / MB), heapUsedMB: round(mem.heapUsed / MB), heapTotalMB: round(mem.heapTotal / MB), externalMB: round(mem.external / MB),
-                cpu: { userMs: round(cpu.user / 1000), systemMs: round(cpu.system / 1000), percent: round((cpuMs / wallMs) * 100) },
-                loopLagMs: { mean: lagMs(loop.mean), p50: lagMs(loop.percentile(50)), p90: lagMs(loop.percentile(90)), p99: lagMs(loop.percentile(99)), max: lagMs(loop.max) },
-                requests: { total, sinceLast: total - lastTotal, perSec: Math.round(((total - lastTotal) / wallMs) * 1000), s2xx: s2, s4xx: s4, s5xx: s5 },
-            };
-            lastCpu = process.cpuUsage();
-            lastAt = now;
-            lastTotal = total;
-            loop.reset();
-            return snap;
-        },
-        stop() { loop.disable(); },
-    };
-}
+"use strict";var y=Object.defineProperty;var l=(r,e)=>y(r,"name",{value:e,configurable:!0});var f=Object.defineProperty,p=l((r,e)=>f(r,"name",{value:e,configurable:!0}),"p");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createProcessMetrics=createProcessMetrics;const node_perf_hooks_1=require("node:perf_hooks"),MB=1024*1024,round=p((r,e=1)=>{const t=10**e;return Math.round(r*t)/t},"round");function createProcessMetrics(){const r=Date.now(),e=(0,node_perf_hooks_1.monitorEventLoopDelay)({resolution:10});e.enable();let t=process.cpuUsage(),i=Date.now(),o=0,M=0,d=0,m=0,u=0;const a=p(s=>round(s/1e6,2),"lagMs");return{recordRequest(s){o+=1,s>=500||s===0?m+=1:s>=400?d+=1:s>=200&&(M+=1)},snapshot(){const s=Date.now(),x=Math.max(1,s-i),n=process.cpuUsage(t),c=process.memoryUsage(),h=(n.user+n.system)/1e3,g={uptimeSec:Math.round((s-r)/1e3),rssMB:round(c.rss/MB),heapUsedMB:round(c.heapUsed/MB),heapTotalMB:round(c.heapTotal/MB),externalMB:round(c.external/MB),cpu:{userMs:round(n.user/1e3),systemMs:round(n.system/1e3),percent:round(h/x*100)},loopLagMs:{mean:a(e.mean),p50:a(e.percentile(50)),p90:a(e.percentile(90)),p99:a(e.percentile(99)),max:a(e.max)},requests:{total:o,sinceLast:o-u,perSec:Math.round((o-u)/x*1e3),s2xx:M,s4xx:d,s5xx:m}};return t=process.cpuUsage(),i=s,u=o,e.reset(),g},stop(){e.disable()}}}l(createProcessMetrics,"createProcessMetrics"),p(createProcessMetrics,"createProcessMetrics");

package/executors/gateway/otel-tracing.js

@@ -1,74 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.setupTracing = setupTracing;
-/**
- * OpenTelemetry tracing for the production gateway — OPT-IN, cloud-neutral.
- *
- * Makes the gateway a first-class span in a distributed trace: it continues the
- * incoming W3C `traceparent`, emits one SERVER span per request, and INJECTS its
- * context into the forwarded headers so the downstream service's spans parent to
- * the gateway hop. Spans export over OTLP/HTTP — point `OTEL_EXPORTER_OTLP_ENDPOINT`
- * at Cloud Trace (GCP), the OTel Collector / X-Ray (AWS), Tempo, Jaeger, etc. The
- * SAME image traces on any cloud; only the endpoint env changes.
- *
- * All OpenTelemetry imports live HERE. The gateway lib takes a `GatewayTracer`
- * (type-only) and calls these helpers, so it never pulls OTel unless tracing is
- * wired — and when no endpoint is set, `setupTracing` returns undefined and the
- * hot path does zero span work.
- *
- * No global context manager (`provider.register()` is intentionally NOT called):
- * context is threaded explicitly via extract/inject, keeping the proxy hot path
- * synchronous and free of async-hooks overhead.
- */
-const api_1 = require("@opentelemetry/api");
-const core_1 = require("@opentelemetry/core");
-const sdk_trace_base_1 = require("@opentelemetry/sdk-trace-base");
-const resources_1 = require("@opentelemetry/resources");
-const exporter_trace_otlp_http_1 = require("@opentelemetry/exporter-trace-otlp-http");
-const firstHeader = (h, k) => {
-    const v = h[k.toLowerCase()];
-    return Array.isArray(v) ? v[0] : v;
-};
-const getter = {
-    keys: (carrier) => Object.keys(carrier),
-    get: (carrier, key) => firstHeader(carrier, key),
-};
-const setter = {
-    set: (carrier, key, value) => { carrier[key.toLowerCase()] = value; },
-};
-/** Build the gateway tracer, or undefined when no OTLP endpoint is configured
- *  (default-off → the lib skips all span work, zero hot-path overhead). */
-function setupTracing(opts = {}) {
-    const endpoint = opts.endpoint ?? process.env['OTEL_EXPORTER_OTLP_ENDPOINT'];
-    if (!endpoint)
-        return undefined;
-    const base = endpoint.replace(/\/+$/, '');
-    const url = /\/v1\/traces$/.test(base) ? base : `${base}/v1/traces`;
-    const exporter = new exporter_trace_otlp_http_1.OTLPTraceExporter({ url, ...(opts.headers ? { headers: opts.headers } : {}) });
-    const provider = new sdk_trace_base_1.BasicTracerProvider({
-        resource: (0, resources_1.resourceFromAttributes)({ 'service.name': opts.serviceName ?? process.env['OTEL_SERVICE_NAME'] ?? 'lensmcp-gateway' }),
-        sampler: new sdk_trace_base_1.ParentBasedSampler({ root: new sdk_trace_base_1.TraceIdRatioBasedSampler(opts.sampleRatio ?? 1) }),
-        // OTel 2.0: span processors are constructor config (the mutating `addSpanProcessor` was removed).
-        spanProcessors: [new sdk_trace_base_1.BatchSpanProcessor(exporter)],
-    });
-    const tracer = provider.getTracer('lensmcp-gateway');
-    const propagator = new core_1.W3CTraceContextPropagator();
-    return {
-        startSpan(req, name, attrs) {
-            const parent = propagator.extract(api_1.ROOT_CONTEXT, req.headers, getter);
-            return tracer.startSpan(name, { kind: api_1.SpanKind.SERVER, attributes: attrs }, parent);
-        },
-        inject(span, headers) {
-            propagator.inject(api_1.trace.setSpan(api_1.ROOT_CONTEXT, span), headers, setter);
-        },
-        end(span, statusCode, attrs) {
-            if (attrs)
-                span.setAttributes(attrs);
-            span.setAttribute('http.response.status_code', statusCode);
-            if (statusCode >= 500 || statusCode === 0)
-                span.setStatus({ code: api_1.SpanStatusCode.ERROR });
-            span.end();
-        },
-        shutdown: () => provider.shutdown(),
-    };
-}
+"use strict";var O=Object.defineProperty;var c=(e,r)=>O(e,"name",{value:r,configurable:!0});var T=Object.defineProperty,o=c((e,r)=>T(e,"name",{value:r,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.setupTracing=setupTracing;const api_1=require("@opentelemetry/api"),core_1=require("@opentelemetry/core"),sdk_trace_base_1=require("@opentelemetry/sdk-trace-base"),resources_1=require("@opentelemetry/resources"),exporter_trace_otlp_http_1=require("@opentelemetry/exporter-trace-otlp-http"),firstHeader=o((e,r)=>{const t=e[r.toLowerCase()];return Array.isArray(t)?t[0]:t},"firstHeader"),getter={keys:o(e=>Object.keys(e),"keys"),get:o((e,r)=>firstHeader(e,r),"get")},setter={set:o((e,r,t)=>{e[r.toLowerCase()]=t},"set")};function setupTracing(e={}){const r=e.endpoint??process.env.OTEL_EXPORTER_OTLP_ENDPOINT;if(!r)return;const t=r.replace(/\/+$/,""),u=/\/v1\/traces$/.test(t)?t:`${t}/v1/traces`,d=new exporter_trace_otlp_http_1.OTLPTraceExporter({url:u,...e.headers?{headers:e.headers}:{}}),p=new sdk_trace_base_1.BasicTracerProvider({resource:(0,resources_1.resourceFromAttributes)({"service.name":e.serviceName??process.env.OTEL_SERVICE_NAME??"lensmcp-gateway"}),sampler:new sdk_trace_base_1.ParentBasedSampler({root:new sdk_trace_base_1.TraceIdRatioBasedSampler(e.sampleRatio??1)}),spanProcessors:[new sdk_trace_base_1.BatchSpanProcessor(d)]}),_=p.getTracer("lensmcp-gateway"),i=new core_1.W3CTraceContextPropagator;return{startSpan(s,a,n){const l=i.extract(api_1.ROOT_CONTEXT,s.headers,getter);return _.startSpan(a,{kind:api_1.SpanKind.SERVER,attributes:n},l)},inject(s,a){i.inject(api_1.trace.setSpan(api_1.ROOT_CONTEXT,s),a,setter)},end(s,a,n){n&&s.setAttributes(n),s.setAttribute("http.response.status_code",a),(a>=500||a===0)&&s.setStatus({code:api_1.SpanStatusCode.ERROR}),s.end()},shutdown:o(()=>p.shutdown(),"shutdown")}}c(setupTracing,"setupTracing"),o(setupTracing,"setupTracing");