@lensmcp/cluster 1.18.4 → 1.18.7

package/executors/gateway/prod-runtime/observability.js

@@ -1,125 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createObservability = createObservability;
-const edge_1 = require("./edge");
-function createObservability(opts, getRoutes) {
-    const emit = (severity, title, fingerprint, raw, ctx) => {
-        if (!opts.emit)
-            return; // lens off by default — no work, no allocation beyond the call
-        try {
-            opts.emit({
-                id: (0, edge_1.eid)(), sessionId: 'pending', timestamp: Date.now(),
-                source: 'gateway', category: 'cluster', severity,
-                context: { sessionId: 'pending', ...ctx }, fingerprint, title, raw,
-            });
-        }
-        catch { /* never let the bus break traffic */ }
-    };
-    // ---- traffic edges (host→service[@version]), flushed to the lens periodically ----
-    const edges = new Map();
-    const recordEdge = (route, ms, status, caller, version) => {
-        const host = route.host ?? '(default)';
-        const key = (caller ? caller + '⇒' : '') + host + '→' + route.service + (version ? '@' + version : '');
-        const e = edges.get(key) ?? { host, service: route.service, caller, version, count: 0, totalMs: 0, errors: 0 };
-        e.count += 1;
-        e.totalMs += ms;
-        if (status >= 500 || status === 0)
-            e.errors += 1;
-        edges.set(key, e);
-    };
-    // ---- per-service health rollup (feeds /statusz + the Redis status fan-out) ----
-    // A ring of the last N flush windows, summed at read time → a rolling view that
-    // doesn't flap to "idle" the instant traffic pauses. Derived purely from the edges.
-    const statusWindowCount = Math.max(1, opts.statusWindows ?? 12);
-    const statusWindows = [];
-    const lastSeenAt = new Map();
-    const routeServices = () => [...new Set(getRoutes().map((r) => r.service))];
-    const pushStatusWindow = () => {
-        const w = new Map();
-        for (const e of edges.values()) {
-            const s = w.get(e.service) ?? { requests: 0, errors: 0, totalMs: 0, versions: new Set() };
-            s.requests += e.count;
-            s.errors += e.errors;
-            s.totalMs += e.totalMs;
-            if (e.version)
-                s.versions.add(e.version);
-            w.set(e.service, s);
-        }
-        const now = Date.now();
-        for (const [svc, s] of w)
-            if (s.requests > 0)
-                lastSeenAt.set(svc, now);
-        statusWindows.push(w);
-        while (statusWindows.length > statusWindowCount)
-            statusWindows.shift();
-    };
-    const buildStatusSnapshot = () => {
-        const agg = new Map();
-        for (const w of statusWindows)
-            for (const [svc, s] of w) {
-                const a = agg.get(svc) ?? { requests: 0, errors: 0, totalMs: 0, versions: new Set() };
-                a.requests += s.requests;
-                a.errors += s.errors;
-                a.totalMs += s.totalMs;
-                for (const v of s.versions)
-                    a.versions.add(v);
-                agg.set(svc, a);
-            }
-        const routes = getRoutes();
-        return routeServices().map((svc) => {
-            const a = agg.get(svc) ?? { requests: 0, errors: 0, totalMs: 0, versions: new Set() };
-            const hosts = [...new Set(routes.filter((r) => r.service === svc).map((r) => r.host ?? '(default)'))];
-            const er = a.requests ? a.errors / a.requests : 0;
-            let status = a.requests === 0 ? 'idle' : er >= 0.5 ? 'down' : er >= 0.05 ? 'degraded' : 'healthy';
-            // active liveness: if every known upstream for this service is failing probes, it's down (even with no traffic)
-            if (opts.healthChecker) {
-                const svcUrls = routes.filter((r) => r.service === svc && r.upstream).map((r) => r.upstream);
-                if (svcUrls.length && svcUrls.every((u) => !opts.healthChecker.isHealthy(u)))
-                    status = 'down';
-            }
-            return { service: svc, hosts, status, requests: a.requests, errorRate: +er.toFixed(4), avgMs: a.requests ? Math.round(a.totalMs / a.requests) : 0, versions: [...a.versions], lastSeen: lastSeenAt.get(svc) ?? null };
-        });
-    };
-    const startFlusher = () => {
-        const t = setInterval(() => {
-            pushStatusWindow(); // always: roll the health window (independent of the lens)
-            if (opts.onStatus) {
-                try {
-                    opts.onStatus(buildStatusSnapshot());
-                }
-                catch { /* never let a status sink break traffic */ }
-            }
-            if (opts.emit) {
-                for (const e of edges.values()) {
-                    emit(e.errors ? 'warning' : 'info', `traffic ${e.host} → ${e.service}${e.version ? '@' + e.version : ''}: ${e.count} req`, `gateway-traffic:${e.host}->${e.service}${e.version ? '@' + e.version : ''}`, { kind: 'gateway-traffic', host: e.host, project: e.service, caller: e.caller, version: e.version, count: e.count, avgMs: Math.round(e.totalMs / e.count), errors: e.errors });
-                }
-            }
-            edges.clear();
-        }, opts.trafficFlushMs ?? 5000);
-        t.unref?.();
-        return t;
-    };
-    // ---- per-request flow trace (only for flow-header-carrying requests) ----
-    const beginTrace = (req) => {
-        if (!opts.emit)
-            return undefined; // no lens → no trace overhead
-        const flowId = (0, edge_1.hdr)(req.headers['x-lensmcp-flow-id']);
-        let requestId = (0, edge_1.hdr)(req.headers['x-request-id']);
-        if (!flowId && !requestId && !(0, edge_1.hdr)(req.headers['traceparent']))
-            return undefined;
-        if (!requestId) {
-            requestId = (0, edge_1.eid)();
-            req.headers['x-request-id'] = requestId;
-        }
-        return { startedAt: Date.now(), method: (req.method ?? 'GET').toUpperCase(), host: (req.headers.host || '').split(':')[0], url: req.url ?? '/', steps: [], ...(flowId ? { flowId } : {}), ...(requestId ? { requestId } : {}) };
-    };
-    const step = (t, name, info) => { if (t)
-        t.steps.push({ step: name, atMs: Date.now() - t.startedAt, ...info }); };
-    const finish = (t, service, status, extra) => {
-        if (!t || t.done)
-            return;
-        t.done = true;
-        emit(status >= 500 ? 'error' : 'info', `gateway ${t.method} ${t.host}${t.url} → ${status} (${Date.now() - t.startedAt}ms)`, `gateway-request:${service}`, { kind: 'gateway-request', project: service, host: t.host, method: t.method, url: t.url, status, durationMs: Date.now() - t.startedAt, startedAt: t.startedAt, steps: t.steps, ...extra }, { ...(t.flowId ? { flowId: t.flowId } : {}), ...(t.requestId ? { requestId: t.requestId } : {}) });
-    };
-    return { emit, beginTrace, step, finish, recordEdge, buildStatusSnapshot, startFlusher };
-}
+"use strict";var b=Object.defineProperty;var p=(o,d)=>b(o,"name",{value:d,configurable:!0});var y=Object.defineProperty,c=p((o,d)=>y(o,"name",{value:d,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createObservability=createObservability;const redact_1=require("@lensmcp/core/redact"),edge_1=require("./edge");function createObservability(o,d){const v=c((e,t,s,r,a)=>{if(o.emit)try{o.emit({id:(0,edge_1.eid)(),sessionId:"pending",timestamp:Date.now(),source:"gateway",category:"cluster",severity:e,context:(0,redact_1.redactDeep)({sessionId:"pending",...a}),fingerprint:s,title:(0,redact_1.safeTitle)(t),raw:r&&(0,redact_1.redactDeep)(r)})}catch{}},"emit"),h=new Map,q=c((e,t,s,r,a)=>{const n=e.host??"(default)",u=(r?r+"\u21D2":"")+n+"\u2192"+e.service+(a?"@"+a:""),i=h.get(u)??{host:n,service:e.service,caller:r,version:a,count:0,totalMs:0,errors:0};i.count+=1,i.totalMs+=t,(s>=500||s===0)&&(i.errors+=1),h.set(u,i)},"recordEdge"),m=Math.max(1,o.statusWindows??12),f=[],w=new Map,M=c(()=>[...new Set(d().map(e=>e.service))],"routeServices"),S=c(()=>{const e=new Map;for(const s of h.values()){const r=e.get(s.service)??{requests:0,errors:0,totalMs:0,versions:new Set};r.requests+=s.count,r.errors+=s.errors,r.totalMs+=s.totalMs,s.version&&r.versions.add(s.version),e.set(s.service,r)}const t=Date.now();for(const[s,r]of e)r.requests>0&&w.set(s,t);for(f.push(e);f.length>m;)f.shift()},"pushStatusWindow"),g=c(()=>{const e=new Map;for(const s of f)for(const[r,a]of s){const n=e.get(r)??{requests:0,errors:0,totalMs:0,versions:new Set};n.requests+=a.requests,n.errors+=a.errors,n.totalMs+=a.totalMs;for(const u of a.versions)n.versions.add(u);e.set(r,n)}const t=d();return M().map(s=>{const r=e.get(s)??{requests:0,errors:0,totalMs:0,versions:new Set},a=[...new Set(t.filter(i=>i.service===s).map(i=>i.host??"(default)"))],n=r.requests?r.errors/r.requests:0;let u=r.requests===0?"idle":n>=.5?"down":n>=.05?"degraded":"healthy";if(o.healthChecker){const i=t.filter(l=>l.service===s&&l.upstream).map(l=>l.upstream);i.length&&i.every(l=>!o.healthChecker.isHealthy(l))&&(u="down")}return{service:s,hosts:a,status:u,requests:r.requests,errorRate:+n.toFixed(4),avgMs:r.requests?Math.round(r.totalMs/r.requests):0,versions:[...r.versions],lastSeen:w.get(s)??null}})},"buildStatusSnapshot");return{emit:v,beginTrace:c(e=>{if(!o.emit)return;const t=(0,edge_1.hdr)(e.headers["x-lensmcp-flow-id"]);let s=(0,edge_1.hdr)(e.headers["x-request-id"]);if(!(!t&&!s&&!(0,edge_1.hdr)(e.headers.traceparent)))return s||(s=(0,edge_1.eid)(),e.headers["x-request-id"]=s),{startedAt:Date.now(),method:(e.method??"GET").toUpperCase(),host:(e.headers.host||"").split(":")[0],url:e.url??"/",steps:[],...t?{flowId:t}:{},...s?{requestId:s}:{}}},"beginTrace"),step:c((e,t,s)=>{e&&e.steps.push({step:t,atMs:Date.now()-e.startedAt,...s})},"step"),finish:c((e,t,s,r)=>{!e||e.done||(e.done=!0,v(s>=500?"error":"info",`gateway ${e.method} ${e.host}${e.url} \u2192 ${s} (${Date.now()-e.startedAt}ms)`,`gateway-request:${t}`,{kind:"gateway-request",project:t,host:e.host,method:e.method,url:e.url,status:s,durationMs:Date.now()-e.startedAt,startedAt:e.startedAt,steps:e.steps,...r},{...e.flowId?{flowId:e.flowId}:{},...e.requestId?{requestId:e.requestId}:{}}))},"finish"),recordEdge:q,buildStatusSnapshot:g,startFlusher:c(()=>{const e=setInterval(()=>{if(S(),o.onStatus)try{o.onStatus(g())}catch{}if(o.emit)for(const t of h.values())v(t.errors?"warning":"info",`traffic ${t.host} \u2192 ${t.service}${t.version?"@"+t.version:""}: ${t.count} req`,`gateway-traffic:${t.host}->${t.service}${t.version?"@"+t.version:""}`,{kind:"gateway-traffic",host:t.host,project:t.service,caller:t.caller,version:t.version,count:t.count,avgMs:Math.round(t.totalMs/t.count),errors:t.errors});h.clear()},o.trafficFlushMs??5e3);return e.unref?.(),e},"startFlusher")}}p(createObservability,"createObservability"),c(createObservability,"createObservability");

package/executors/gateway/prod-runtime/rollout.js

@@ -1,103 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createRollout = createRollout;
-/**
- * Targeted-rollout support: authoritative client-IP resolution (trusted
- * front-proxy header, anti-spoof), the sticky device key (signed cookie → uid
- * header → minted), and the flat ABAC attribute bag shared by the HTTP + WS
- * paths so a rule sees an identical bag on both.
- */
-const node_crypto_1 = require("node:crypto");
-const manifest_1 = require("../manifest");
-const edge_1 = require("./edge");
-function createRollout(opts) {
-    const clientIpHeader = opts.clientIpHeader?.toLowerCase();
-    // `clientIpHeader` is only trusted from a known front proxy. Default: loopback only
-    // (a co-located cloudflared/sidecar) — an off-proxy attacker hitting the origin directly
-    // cannot spoof the `ip` ABAC attribute.
-    const trustedProxies = opts.clientIpTrustedProxies ?? [];
-    const peerTrusted = (peer) => {
-        if (!peer)
-            return false;
-        const ip = peer.startsWith('::ffff:') ? peer.slice(7) : peer;
-        if (trustedProxies.length === 0)
-            return ip === '127.0.0.1' || peer === '::1';
-        return trustedProxies.some((c) => (0, manifest_1.matchCidr)(ip, c));
-    };
-    const clientIpOf = (req, fallback) => {
-        if (clientIpHeader && peerTrusted(req.socket?.remoteAddress ?? undefined)) {
-            const h = (0, edge_1.hdr)(req.headers[clientIpHeader]);
-            if (h)
-                return h;
-        }
-        return fallback;
-    };
-    const attrHeaders = (opts.attributeHeaders ?? []).map((h) => h.toLowerCase());
-    const uidHeader = opts.uidHeader?.toLowerCase();
-    const cookieOn = !!opts.cookie;
-    const cookieName = opts.cookie?.name ?? 'lensmcp_did';
-    const cookieSecret = opts.cookie?.secret;
-    const cookieDomain = opts.cookie?.domain;
-    const cookieMaxAge = opts.cookie?.maxAge ?? 31_536_000; // 1y
-    if (cookieOn && !cookieSecret)
-        console.warn('[gateway] device cookie has no secret — values are UNSIGNED (set cookie.secret to prevent bucket-grinding).');
-    const signId = (id) => (0, node_crypto_1.createHmac)('sha256', cookieSecret).update(id).digest('base64url');
-    const signedCookie = (id) => (cookieSecret ? `${id}.${signId(id)}` : id);
-    const verifyCookie = (val) => {
-        if (!cookieSecret)
-            return val || undefined; // unsigned mode
-        const i = val.lastIndexOf('.');
-        if (i < 0)
-            return undefined;
-        const id = val.slice(0, i);
-        const a = Buffer.from(val.slice(i + 1)), b = Buffer.from(signId(id));
-        return a.length === b.length && (0, node_crypto_1.timingSafeEqual)(a, b) ? id : undefined;
-    };
-    const parseCookie = (header, name) => {
-        if (!header)
-            return undefined;
-        for (const part of header.split(';')) {
-            const eq = part.indexOf('=');
-            if (eq > 0 && part.slice(0, eq).trim() === name)
-                return decodeURIComponent(part.slice(eq + 1).trim());
-        }
-        return undefined;
-    };
-    const mintCookieHeader = (id) => {
-        let c = `${cookieName}=${encodeURIComponent(signedCookie(id))}; Path=/; Max-Age=${cookieMaxAge}; HttpOnly; SameSite=Lax; Secure`;
-        if (cookieDomain)
-            c += `; Domain=${cookieDomain}`;
-        return c;
-    };
-    const resolveStickyKey = (req) => {
-        if (cookieOn) {
-            const c = parseCookie(req.headers.cookie, cookieName);
-            const id = c ? verifyCookie(c) : undefined;
-            if (id)
-                return { key: id, mint: false };
-        }
-        if (uidHeader) {
-            const u = (0, edge_1.hdr)(req.headers[uidHeader]);
-            if (u)
-                return { key: u, mint: false };
-        }
-        if (cookieOn)
-            return { key: 'd_' + (0, node_crypto_1.randomBytes)(12).toString('base64url'), mint: true };
-        return { mint: false };
-    };
-    const buildAttrs = (req, fallbackIp, principal, key) => {
-        const a = { ...(principal ?? {}) };
-        a['ip'] = clientIpOf(req, fallbackIp);
-        a['method'] = (req.method ?? 'GET').toUpperCase();
-        a['path'] = (req.url ?? '/').split('?')[0];
-        if (key)
-            a['device'] = key;
-        for (const h of attrHeaders) {
-            const v = (0, edge_1.hdr)(req.headers[h]);
-            if (v !== undefined)
-                a['header.' + h] = v;
-        }
-        return a;
-    };
-    return { clientIpOf, buildAttrs, resolveStickyKey, mintCookieHeader };
-}
+"use strict";var H=Object.defineProperty;var u=(i,c)=>H(i,"name",{value:c,configurable:!0});var S=Object.defineProperty,r=u((i,c)=>S(i,"name",{value:c,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRollout=createRollout;const node_crypto_1=require("node:crypto"),manifest_1=require("../manifest"),edge_1=require("./edge");function createRollout(i){const c=i.clientIpHeader?.toLowerCase(),l=i.clientIpTrustedProxies??[],y=r(e=>{if(!e)return!1;const t=e.startsWith("::ffff:")?e.slice(7):e;return l.length===0?t==="127.0.0.1"||e==="::1":l.some(o=>(0,manifest_1.matchCidr)(t,o))},"peerTrusted"),f=r((e,t)=>{if(c&&y(e.socket?.remoteAddress??void 0)){const o=(0,edge_1.hdr)(e.headers[c]);if(o)return o}return t},"clientIpOf"),C=(i.attributeHeaders??[]).map(e=>e.toLowerCase()),m=i.uidHeader?.toLowerCase(),d=!!i.cookie,p=i.cookie?.name??"lensmcp_did",a=i.cookie?.secret,k=i.cookie?.domain,I=i.cookie?.maxAge??31536e3;d&&!a&&console.warn("[gateway] device cookie has no secret \u2014 values are UNSIGNED (set cookie.secret to prevent bucket-grinding).");const h=r(e=>(0,node_crypto_1.createHmac)("sha256",a).update(e).digest("base64url"),"signId"),b=r(e=>a?`${e}.${h(e)}`:e,"signedCookie"),x=r(e=>{if(!a)return e||void 0;const t=e.lastIndexOf(".");if(t<0)return;const o=e.slice(0,t),n=Buffer.from(e.slice(t+1)),s=Buffer.from(h(o));return n.length===s.length&&(0,node_crypto_1.timingSafeEqual)(n,s)?o:void 0},"verifyCookie"),_=r((e,t)=>{if(e)for(const o of e.split(";")){const n=o.indexOf("=");if(n>0&&o.slice(0,n).trim()===t)return decodeURIComponent(o.slice(n+1).trim())}},"parseCookie");return{clientIpOf:f,buildAttrs:r((e,t,o,n)=>{const s={...o??{}};s.ip=f(e,t),s.method=(e.method??"GET").toUpperCase(),s.path=(e.url??"/").split("?")[0],n&&(s.device=n);for(const g of C){const v=(0,edge_1.hdr)(e.headers[g]);v!==void 0&&(s["header."+g]=v)}return s},"buildAttrs"),resolveStickyKey:r(e=>{if(d){const t=_(e.headers.cookie,p),o=t?x(t):void 0;if(o)return{key:o,mint:!1}}if(m){const t=(0,edge_1.hdr)(e.headers[m]);if(t)return{key:t,mint:!1}}return d?{key:"d_"+(0,node_crypto_1.randomBytes)(12).toString("base64url"),mint:!0}:{mint:!1}},"resolveStickyKey"),mintCookieHeader:r(e=>{let t=`${p}=${encodeURIComponent(b(e))}; Path=/; Max-Age=${I}; HttpOnly; SameSite=Lax; Secure`;return k&&(t+=`; Domain=${k}`),t},"mintCookieHeader")}}u(createRollout,"createRollout"),r(createRollout,"createRollout");

package/executors/gateway/prod-runtime/routing.js

@@ -1,40 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createRouteTable = createRouteTable;
-/**
- * The route table — rebuilt atomically from the manifest source (the SAME
- * `buildRouteTable` brain as dev). The `routes` array + `manifestByService` map
- * keep STABLE identities (content-replaced in place) so every other layer can
- * hold the reference and always read the live table.
- */
-const manifest_1 = require("../manifest");
-function createRouteTable(opts, obs) {
-    const routes = [];
-    const manifestByService = new Map();
-    let current = opts.manifests.list();
-    const apply = (next) => {
-        current = next;
-        const built = (0, manifest_1.buildRouteTable)(next);
-        routes.length = 0;
-        routes.push(...built);
-        manifestByService.clear();
-        for (const m of next)
-            manifestByService.set(m.service, m);
-    };
-    const rebuild = (next) => {
-        apply(next);
-        if (opts.healthChecker) { // monitor every reachable upstream: direct manifest URLs + pooled endpoints
-            const urls = new Set();
-            for (const r of routes)
-                if (r.upstream)
-                    urls.add(r.upstream);
-            for (const u of opts.pods?.endpoints?.() ?? [])
-                urls.add(u);
-            opts.healthChecker.track([...urls]);
-        }
-        obs.emit('info', `gateway routes: ${routes.length} on ${current.length} services`, 'gateway-up', { kind: 'gateway-up', routes: routes.map((r) => ({ host: r.host ?? '(default)', service: r.service, internal: !!r.internal })) });
-    };
-    apply(current); // initial build (no emit yet; server.ts fires the initial gateway-up via rebuild)
-    const unwatch = opts.manifests.watch?.((next) => rebuild(next));
-    return { routes, manifestByService, rebuild, manifests: () => current, stop: () => unwatch?.() };
-}
+"use strict";var d=Object.defineProperty;var u=(e,o)=>d(e,"name",{value:o,configurable:!0});var h=Object.defineProperty,r=u((e,o)=>h(e,"name",{value:o,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRouteTable=createRouteTable;const manifest_1=require("../manifest");function createRouteTable(e,o){const n=[],c=new Map;let i=e.manifests.list();const l=r(a=>{i=a;const t=(0,manifest_1.buildRouteTable)(a);n.length=0,n.push(...t),c.clear();for(const s of a)c.set(s.service,s)},"apply"),f=r(a=>{if(l(a),e.healthChecker){const t=new Set;for(const s of n)s.upstream&&t.add(s.upstream);for(const s of e.pods?.endpoints?.()??[])t.add(s);e.healthChecker.track([...t])}o.emit("info",`gateway routes: ${n.length} on ${i.length} services`,"gateway-up",{kind:"gateway-up",routes:n.map(t=>({host:t.host??"(default)",service:t.service,internal:!!t.internal}))})},"rebuild");l(i);const p=e.manifests.watch?.(a=>f(a));return{routes:n,manifestByService:c,rebuild:f,manifests:r(()=>i,"manifests"),stop:r(()=>p?.(),"stop")}}u(createRouteTable,"createRouteTable"),r(createRouteTable,"createRouteTable");

package/executors/gateway/prod-runtime/server.js

@@ -1,79 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.startProdGateway = startProdGateway;
-const observability_1 = require("./observability");
-const routing_1 = require("./routing");
-const rollout_1 = require("./rollout");
-const upstream_1 = require("./upstream");
-const auth_1 = require("./auth");
-const hooks_1 = require("./hooks");
-const cors_1 = require("./cors");
-const handler_1 = require("./handler");
-const upgrade_1 = require("./upgrade");
-const app_1 = require("./app");
-async function startProdGateway(opts) {
-    const ports = opts.ports?.length ? opts.ports : [opts.tls ? 8443 : 8080];
-    // Default authenticator FAILS CLOSED: a jwt route with no authenticator wired is rejected.
-    const authenticate = opts.authenticate ?? ((mode) => {
-        if (mode === 'jwt')
-            throw new Error('jwt route but no authenticator configured');
-    });
-    // ---- option-derived config (resolved once) ----
-    const versionHeader = (opts.versionHeader ?? 'x-lensmcp-version').toLowerCase();
-    const accessLog = !!opts.accessLog;
-    const corsCredentialOrigins = new Set((opts.corsCredentialOrigins ?? []).map((o) => o.toLowerCase()));
-    const keyToProject = new Map(Object.entries(opts.serviceKeys ?? {}).map(([p, k]) => [k, p]));
-    // ---- route table + observability (lazy getRoutes breaks the table↔obs cycle) ----
-    // A holder, so obs can read the routes lazily while `table` stays a const (assigned once,
-    // before any request — obs's getter only runs at request time).
-    const tableRef = {};
-    const obs = (0, observability_1.createObservability)(opts, () => tableRef.current.routes);
-    const table = (0, routing_1.createRouteTable)(opts, obs);
-    tableRef.current = table;
-    const rt = { opts, table, keyToProject, versionHeader, accessLog, corsCredentialOrigins };
-    // ---- layers ----
-    const rollout = (0, rollout_1.createRollout)(opts);
-    const upstream = (0, upstream_1.createUpstream)(opts, obs);
-    const edgeAuth = (0, auth_1.createEdgeAuth)(rt, obs, rollout, authenticate);
-    const hooks = (0, hooks_1.createHooks)(opts.hooks ?? {});
-    const reqState = new WeakMap();
-    const spanByReq = new WeakMap();
-    const ctxByReq = new WeakMap();
-    const cors = (0, cors_1.createCors)(rt, reqState);
-    const handler = (0, handler_1.createHandler)({ rt, obs, cors, auth: edgeAuth, upstream, rollout, hooks, reqState, spanByReq, ctxByReq });
-    const upgrade = (0, upgrade_1.createUpgrade)({ rt, auth: edgeAuth, upstream, hooks });
-    const { buildApp } = (0, app_1.createApp)({ rt, obs, cors, hooks, handler, upgrade, reqState, spanByReq, ctxByReq });
-    const flusher = obs.startFlusher();
-    table.rebuild(table.manifests()); // emit initial gateway-up (+ healthChecker.track)
-    // ---- listeners ----
-    const apps = [];
-    const boundPorts = [];
-    for (const port of ports) {
-        const app = await buildApp();
-        await app.listen({ port, host: '0.0.0.0' });
-        const addr = app.server.address();
-        const bound = typeof addr === 'object' && addr ? addr.port : port;
-        boundPorts.push(bound);
-        console.log(`[gateway] listening on ${opts.tls ? 'https' : 'http'}://0.0.0.0:${bound}`);
-        apps.push(app);
-    }
-    opts.healthChecker?.start(); // begin probing now that the route table (and tracked URLs) is warm
-    let stopped = false;
-    return {
-        ports: boundPorts,
-        routes: () => table.routes,
-        status: obs.buildStatusSnapshot,
-        stop: async () => {
-            if (stopped)
-                return;
-            stopped = true;
-            clearInterval(flusher);
-            table.stop();
-            opts.healthChecker?.stop();
-            opts.rateLimiter?.stop();
-            opts.metrics?.stop();
-            obs.emit('info', 'gateway down', 'gateway-down', { kind: 'gateway-down' });
-            await Promise.all(apps.map((a) => a.close())); // reply-from closes its undici pool on close
-        },
-    };
-}
+"use strict";var B=Object.defineProperty;var l=(e,o)=>B(e,"name",{value:o,configurable:!0});var x=Object.defineProperty,n=l((e,o)=>x(e,"name",{value:o,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.startProdGateway=startProdGateway;const observability_1=require("./observability"),routing_1=require("./routing"),rollout_1=require("./rollout"),upstream_1=require("./upstream"),auth_1=require("./auth"),hooks_1=require("./hooks"),cors_1=require("./cors"),handler_1=require("./handler"),upgrade_1=require("./upgrade"),app_1=require("./app");async function startProdGateway(e){const o=e.ports?.length?e.ports:[e.tls?8443:8080],f=e.authenticate??(t=>{if(t==="jwt")throw new Error("jwt route but no authenticator configured")}),j=(e.versionHeader??"x-lensmcp-version").toLowerCase(),C=!!e.accessLog,P=new Set((e.corsCredentialOrigins??[]).map(t=>t.toLowerCase())),O=new Map(Object.entries(e.serviceKeys??{}).map(([t,i])=>[i,t])),h={},r=(0,observability_1.createObservability)(e,()=>h.current.routes),a=(0,routing_1.createRouteTable)(e,r);h.current=a;const s={opts:e,table:a,keyToProject:O,versionHeader:j,accessLog:C,corsCredentialOrigins:P},d=(0,rollout_1.createRollout)(e),w=(0,upstream_1.createUpstream)(e,r),y=(0,auth_1.createEdgeAuth)(s,r,d,f),u=(0,hooks_1.createHooks)(e.hooks??{}),c=new WeakMap,g=new WeakMap,b=new WeakMap,q=(0,cors_1.createCors)(s,c),R=(0,handler_1.createHandler)({rt:s,obs:r,cors:q,auth:y,upstream:w,rollout:d,hooks:u,reqState:c,spanByReq:g,ctxByReq:b}),L=(0,upgrade_1.createUpgrade)({rt:s,auth:y,upstream:w,hooks:u}),{buildApp:M}=(0,app_1.createApp)({rt:s,obs:r,cors:q,hooks:u,handler:R,upgrade:L,reqState:c,spanByReq:g,ctxByReq:b}),S=r.startFlusher();a.rebuild(a.manifests());const m=[],k=[];for(const t of o){const i=await M();await i.listen({port:t,host:"0.0.0.0"});const p=i.server.address(),_=typeof p=="object"&&p?p.port:t;k.push(_),console.log(`[gateway] listening on ${e.tls?"https":"http"}://0.0.0.0:${_}`),m.push(i)}e.healthChecker?.start();let v=!1;return{ports:k,routes:n(()=>a.routes,"routes"),status:r.buildStatusSnapshot,stop:n(async()=>{v||(v=!0,clearInterval(S),a.stop(),e.healthChecker?.stop(),e.rateLimiter?.stop(),e.metrics?.stop(),r.emit("info","gateway down","gateway-down",{kind:"gateway-down"}),await Promise.all(m.map(t=>t.close())))},"stop")}}l(startProdGateway,"startProdGateway"),n(startProdGateway,"startProdGateway");

package/executors/gateway/prod-runtime/trust.js

@@ -1,32 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.stampIdentity = exports.stripTrust = exports.HOP_BY_HOP = exports.TRUST_HEADERS = void 0;
-// Drop any client-supplied copy at ingress so identity can only originate from a verified token.
-exports.TRUST_HEADERS = ['x-internal-token', 'x-api-key-id', 'x-user-id', 'x-tenant-id', 'x-user-roles', 'x-user-permissions'];
-// Also drop client-supplied hop-by-hop control headers: a `Connection: x-internal-token`
-// would otherwise make undici strip the gateway's OWN injected trust headers before the
-// upstream (CVE-2026-33805). The proxy manages its own upstream connection semantics.
-exports.HOP_BY_HOP = ['connection', 'proxy-connection', 'keep-alive'];
-const stripTrust = (req) => {
-    for (const h of exports.TRUST_HEADERS)
-        delete req.headers[h];
-    for (const h of exports.HOP_BY_HOP)
-        delete req.headers[h];
-};
-exports.stripTrust = stripTrust;
-/** Stamp the verified identity onto the forwarded request — tenant from the `tid` CLAIM, never a client header. */
-const stampIdentity = (req, claims) => {
-    // Only stamp SCALAR claims — an object/array sub/tid must never coerce to
-    // "[object Object]" / a CSV tenant header (claim type-confusion).
-    const set = (k, v) => { if ((typeof v === 'string' && v !== '') || typeof v === 'number')
-        req.headers[k] = String(v); };
-    set('x-user-id', claims['sub']);
-    set('x-tenant-id', claims['tid']);
-    const roles = claims['roles'];
-    if (Array.isArray(roles) && roles.length)
-        req.headers['x-user-roles'] = roles.map(String).join(',');
-    const perms = claims['perms'];
-    if (Array.isArray(perms) && perms.length)
-        req.headers['x-user-permissions'] = perms.map(String).join(',');
-};
-exports.stampIdentity = stampIdentity;
+"use strict";var d=Object.defineProperty;var p=(t,e)=>d(t,"name",{value:e,configurable:!0});var x=Object.defineProperty,r=p((t,e)=>x(t,"name",{value:e,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.stampIdentity=exports.stripTrust=exports.HOP_BY_HOP=exports.TRUST_HEADERS=void 0,exports.TRUST_HEADERS=["x-internal-token","x-api-key-id","x-user-id","x-tenant-id","x-user-roles","x-user-permissions"],exports.HOP_BY_HOP=["connection","proxy-connection","keep-alive"];const stripTrust=r(t=>{for(const e of exports.TRUST_HEADERS)delete t.headers[e];for(const e of exports.HOP_BY_HOP)delete t.headers[e]},"stripTrust");exports.stripTrust=stripTrust;const stampIdentity=r((t,e)=>{const i=r((a,s)=>{(typeof s=="string"&&s!==""||typeof s=="number")&&(t.headers[a]=String(s))},"set");i("x-user-id",e.sub),i("x-tenant-id",e.tid);const o=e.roles;Array.isArray(o)&&o.length&&(t.headers["x-user-roles"]=o.map(String).join(","));const n=e.perms;Array.isArray(n)&&n.length&&(t.headers["x-user-permissions"]=n.map(String).join(","))},"stampIdentity");exports.stampIdentity=stampIdentity;

package/executors/gateway/prod-runtime/types.js

@@ -1,2 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0});

package/executors/gateway/prod-runtime/upgrade.js

@@ -1,116 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createUpgrade = createUpgrade;
-const tslib_1 = require("tslib");
-/**
- * Raw WebSocket upgrade proxy (same trust model; net-level pipe). The upgrade
- * request is rebuilt from `req.rawHeaders` verbatim — minus the gateway-owned
- * trust headers + the client's hop-by-hop control — plus the validated caller +
- * target token + verified identity. Reuses the shared auth + upstream layers.
- */
-const net = tslib_1.__importStar(require("node:net"));
-const manifest_1 = require("../manifest");
-const edge_1 = require("./edge");
-const trust_1 = require("./trust");
-function createUpgrade(deps) {
-    const { rt, auth, upstream, hooks } = deps;
-    const run = async (req, socket, head) => {
-        (0, trust_1.stripTrust)(req);
-        const host = (req.headers.host || '').split(':')[0];
-        const cpath = (0, edge_1.canonicalPath)(req.url ?? '/');
-        if (cpath === undefined) {
-            socket.destroy();
-            return;
-        } // reject path-canonicalization attacks
-        const route = (0, manifest_1.matchRoute)(rt.table.routes, host, req.url ?? '/');
-        if (!route) {
-            socket.destroy();
-            return;
-        }
-        const ctx = hooks.any ? hooks.upgradeContext(req, socket, undefined) : undefined;
-        if (ctx)
-            ctx.route = route;
-        const claims = route.internal ? undefined : rt.opts.identify?.(req);
-        let caller;
-        if (route.internal) {
-            const v = auth.internal(req, route, undefined);
-            if (!v.ok) {
-                socket.destroy();
-                return;
-            }
-            caller = v.caller;
-            if (ctx)
-                ctx.caller = caller;
-        }
-        else {
-            // Same fail-closed ABAC + identical attribute bag as the HTTP path (no divergence).
-            const v = auth.public(req, route, cpath, claims, req.socket.remoteAddress ?? '', undefined);
-            if (!v.ok) {
-                socket.destroy();
-                return;
-            }
-            if (ctx)
-                ctx.claims = claims;
-            if (ctx && hooks.has('afterAuth')) {
-                await hooks.run('afterAuth', ctx);
-                if (ctx.responded())
-                    return;
-            }
-        }
-        if (route.prependPrefix) {
-            const u = req.url ?? '/';
-            const pp = route.prependPrefix;
-            if (u !== pp && !u.startsWith(pp + '/'))
-                req.url = pp + u;
-        } // segment-boundary
-        if (ctx && hooks.has('onUpgrade')) {
-            await hooks.run('onUpgrade', ctx);
-            if (ctx.responded())
-                return;
-        }
-        const pinned = (0, edge_1.hdr)(req.headers[rt.versionHeader]);
-        const up = await upstream.resolveUpstream(route, undefined, pinned);
-        if (!up || !('url' in up)) {
-            socket.destroy();
-            return;
-        }
-        const u = new URL(up.url);
-        const upstreamSock = net.connect(Number(u.port) || (u.protocol === 'https:' ? 443 : 80), u.hostname, () => {
-            // rebuild the upgrade request from rawHeaders (verbatim), minus the trust headers we own (incl.
-            // client identity) + the client's hop-by-hop control (so a `Connection: x-internal-token` can't
-            // strip the gateway's injected headers downstream), plus the validated caller + token + identity.
-            const strip = new Set(['x-internal-token', 'x-api-key-id', 'x-api-key', 'x-user-id', 'x-tenant-id', 'x-user-roles', 'x-user-permissions', 'connection', 'proxy-connection', 'keep-alive']);
-            const lines = [`${req.method} ${req.url} HTTP/1.1`, 'Connection: Upgrade']; // gateway-owned, clean upgrade
-            for (let i = 0; i < req.rawHeaders.length; i += 2) {
-                const k = req.rawHeaders[i];
-                if (!strip.has(k.toLowerCase()))
-                    lines.push(`${k}: ${req.rawHeaders[i + 1]}`);
-            }
-            if (caller)
-                lines.push(`x-api-key-id: ${caller}`);
-            const token = rt.opts.serviceKeys?.[route.service];
-            if (token)
-                lines.push(`x-internal-token: ${token}`);
-            if (claims) { // stamp the verified identity (mirrors the HTTP path's stampIdentity)
-                if (claims['sub'])
-                    lines.push(`x-user-id: ${String(claims['sub'])}`);
-                if (claims['tid'])
-                    lines.push(`x-tenant-id: ${String(claims['tid'])}`);
-                const roles = claims['roles'];
-                if (Array.isArray(roles) && roles.length)
-                    lines.push(`x-user-roles: ${roles.map(String).join(',')}`);
-                const perms = claims['perms'];
-                if (Array.isArray(perms) && perms.length)
-                    lines.push(`x-user-permissions: ${perms.map(String).join(',')}`);
-            }
-            upstreamSock.write(lines.join('\r\n') + '\r\n\r\n');
-            if (head?.length)
-                upstreamSock.write(head);
-            socket.pipe(upstreamSock);
-            upstreamSock.pipe(socket);
-        });
-        upstreamSock.on('error', () => socket.destroy());
-        socket.on('error', () => upstreamSock.destroy());
-    };
-    return (req, socket, head) => { void run(req, socket, head); };
-}
+"use strict";var U=Object.defineProperty;var g=(l,i)=>U(l,"name",{value:i,configurable:!0});var S=Object.defineProperty,m=g((l,i)=>S(l,"name",{value:i,configurable:!0}),"m");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createUpgrade=createUpgrade;const tslib_1=require("tslib"),net=tslib_1.__importStar(require("node:net")),manifest_1=require("../manifest"),edge_1=require("./edge"),trust_1=require("./trust");function createUpgrade(l){const{rt:i,auth:v,upstream:$,hooks:d}=l,k=m(async(e,r,h)=>{(0,trust_1.stripTrust)(e);const _=(e.headers.host||"").split(":")[0],w=(0,edge_1.canonicalPath)(e.url??"/");if(w===void 0){r.destroy();return}const s=(0,manifest_1.matchRoute)(i.table.routes,_,e.url??"/");if(!s){r.destroy();return}const t=d.any?d.upgradeContext(e,r,void 0):void 0;t&&(t.route=s);const o=s.internal?void 0:i.opts.identify?.(e);let f;if(s.internal){const a=v.internal(e,s,void 0);if(!a.ok){r.destroy();return}f=a.caller,t&&(t.caller=f)}else{if(!v.public(e,s,w,o,e.socket.remoteAddress??"",void 0).ok){r.destroy();return}if(t&&(t.claims=o),t&&d.has("afterAuth")&&(await d.run("afterAuth",t),t.responded()))return}if(s.prependPrefix){const a=e.url??"/",n=s.prependPrefix;a!==n&&!a.startsWith(n+"/")&&(e.url=n+a)}if(t&&d.has("onUpgrade")&&(await d.run("onUpgrade",t),t.responded()))return;const A=(0,edge_1.hdr)(e.headers[i.versionHeader]),y=await $.resolveUpstream(s,void 0,A);if(!y||!("url"in y)){r.destroy();return}const x=new URL(y.url),p=net.connect(Number(x.port)||(x.protocol==="https:"?443:80),x.hostname,()=>{const a=new Set(["x-internal-token","x-api-key-id","x-api-key","x-user-id","x-tenant-id","x-user-roles","x-user-permissions","connection","proxy-connection","keep-alive"]),n=[`${e.method} ${e.url} HTTP/1.1`,"Connection: Upgrade"];for(let u=0;u<e.rawHeaders.length;u+=2){const c=e.rawHeaders[u];a.has(c.toLowerCase())||n.push(`${c}: ${e.rawHeaders[u+1]}`)}f&&n.push(`x-api-key-id: ${f}`);const b=i.opts.serviceKeys?.[s.service];if(b&&n.push(`x-internal-token: ${b}`),o){o.sub&&n.push(`x-user-id: ${String(o.sub)}`),o.tid&&n.push(`x-tenant-id: ${String(o.tid)}`);const u=o.roles;Array.isArray(u)&&u.length&&n.push(`x-user-roles: ${u.map(String).join(",")}`);const c=o.perms;Array.isArray(c)&&c.length&&n.push(`x-user-permissions: ${c.map(String).join(",")}`)}p.write(n.join(`\r
+`)+`\r
+\r
+`),h?.length&&p.write(h),r.pipe(p),p.pipe(r)});p.on("error",()=>r.destroy()),r.on("error",()=>p.destroy())},"run");return(e,r,h)=>{k(e,r,h)}}g(createUpgrade,"createUpgrade"),m(createUpgrade,"createUpgrade");

package/executors/gateway/prod-runtime/upstream.js

@@ -1,21 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createUpstream = createUpstream;
-function createUpstream(opts, obs) {
-    const resolveUpstream = async (route, trace, pinned) => {
-        if (route.upstream)
-            return { url: route.upstream };
-        const opt = {
-            ...(pinned ? { version: pinned } : {}),
-            ...(opts.healthChecker ? { isHealthy: (u) => opts.healthChecker.isHealthy(u) } : {}),
-        };
-        let up = opts.pods?.pick(route.service, opt);
-        if (!up && opts.pods?.ensureUp) {
-            obs.step(trace, 'ensure-up', { project: route.service });
-            if (await opts.pods.ensureUp(route.service))
-                up = opts.pods.pick(route.service, opt);
-        }
-        return up;
-    };
-    return { resolveUpstream };
-}
+"use strict";var l=Object.defineProperty;var p=(e,t)=>l(e,"name",{value:t,configurable:!0});var u=Object.defineProperty,s=p((e,t)=>u(e,"name",{value:t,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createUpstream=createUpstream;function createUpstream(e,t){return{resolveUpstream:s(async(r,o,c)=>{if(r.upstream)return{url:r.upstream};const i={...c?{version:c}:{},...e.healthChecker?{isHealthy:s(n=>e.healthChecker.isHealthy(n),"isHealthy")}:{}};let a=e.pods?.pick(r.service,i);return!a&&e.pods?.ensureUp&&(t.step(o,"ensure-up",{project:r.service}),await e.pods.ensureUp(r.service)&&(a=e.pods.pick(r.service,i))),a},"resolveUpstream")}}p(createUpstream,"createUpstream"),s(createUpstream,"createUpstream");