@lensmcp/cluster 1.18.4 → 1.18.7

package/executors/gateway/runtime/auth.js

@@ -1,64 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createEdgeAuth = createEdgeAuth;
-/**
- * The edge-auth layer (the JWT seam). Two boundaries, ONE source so the HTTP
- * handler and the WS upgrade can't drift:
- *  - `internal(...)`: validate the CALLER's `x-api-key` on an `internal.<host>`
- *    route, stamp `x-api-key-id` (audit) + `__lensmcpCaller`.
- *  - `public(...)`: verify the end-user JWT, enforce per-route rules, inject
- *    trusted identity — mirroring the prod gateway. Only enforced when the
- *    service declares `cluster.auth` (opt-in; un-migrated services stay open).
- * Each returns a verdict; the caller turns a denial into its own rejection
- * (the handler → `finishTrace` + `sendError`; the upgrade → `socket.destroy()`).
- */
-const manifest_1 = require("../manifest");
-const dev_auth_1 = require("./dev-auth");
-function createEdgeAuth(rt, obs, verifiers) {
-    const { traceStep } = obs;
-    const internal = (req, _route, trace) => {
-        // service-to-service: validate the CALLER's api key at the boundary
-        const presented = String(req.headers['x-api-key'] ?? '');
-        const caller = rt.keyToProject.get(presented);
-        if (!caller) {
-            traceStep(trace, 'auth', { mode: 'x-api-key', ok: false });
-            return { ok: false, status: 401, reason: 'unauthorized', detail: 'Invalid or missing x-api-key for internal route.' };
-        }
-        req.headers['x-api-key-id'] = caller; // audit + lens attribution
-        req.__lensmcpCaller = caller;
-        delete req.headers['x-api-key'];
-        traceStep(trace, 'auth', { mode: 'x-api-key', ok: true, caller });
-        return { ok: true, caller };
-    };
-    const publicAuth = (req, route, trace) => {
-        const policy = route.auth;
-        if (policy) {
-            const url0 = (req.url ?? '/').split('?')[0];
-            const method = (req.method ?? 'GET').toUpperCase();
-            const resolved = (0, manifest_1.authRuleFor)(policy, url0, method);
-            if (resolved.mode === 'jwt') {
-                // The verifier for THIS request's host (per-apex IdP resolution in a shared
-                // multi-workspace daemon; the host is the ROUTED host — trusted exactly the
-                // way routing itself trusts it, never taken from the token).
-                const reqHost = String(req.headers.host ?? '').split(':')[0].toLowerCase();
-                const claims = (0, dev_auth_1.verifyDevJwt)(req, verifiers?.for(reqHost));
-                if (!claims) {
-                    traceStep(trace, 'auth', { mode: 'jwt', ok: false });
-                    return { ok: false, status: 401, reason: 'unauthorized', detail: 'Unauthorized: invalid or missing token' };
-                }
-                if (resolved.rule && !(0, manifest_1.evalRule)(resolved.rule, (0, dev_auth_1.devAttrs)(req, claims))) {
-                    traceStep(trace, 'authz', { ok: false });
-                    return { ok: false, status: 403, reason: 'forbidden', detail: 'Forbidden: insufficient permission' };
-                }
-                (0, dev_auth_1.stampIdentity)(req, claims);
-                traceStep(trace, 'auth', { mode: 'jwt', ok: true });
-                return { ok: true, claims };
-            }
-            traceStep(trace, 'auth', { mode: resolved.mode });
-            return { ok: true };
-        }
-        traceStep(trace, 'auth', { mode: 'public', unconfigured: true });
-        return { ok: true };
-    };
-    return { internal, public: publicAuth };
-}
+"use strict";var m=Object.defineProperty;var l=(o,i)=>m(o,"name",{value:i,configurable:!0});var f=Object.defineProperty,n=l((o,i)=>f(o,"name",{value:i,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createEdgeAuth=createEdgeAuth;const manifest_1=require("../manifest"),dev_auth_1=require("./dev-auth");function createEdgeAuth(o,i,h){const{traceStep:r}=i;return{internal:n((e,c,t)=>{const u=String(e.headers["x-api-key"]??""),a=o.keyToProject.get(u);return a?(e.headers["x-api-key-id"]=a,e.__lensmcpCaller=a,delete e.headers["x-api-key"],r(t,"auth",{mode:"x-api-key",ok:!0,caller:a}),{ok:!0,caller:a}):(r(t,"auth",{mode:"x-api-key",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Invalid or missing x-api-key for internal route."})},"internal"),public:n((e,c,t)=>{const u=c.auth;if(u){const a=(e.url??"/").split("?")[0],p=(e.method??"GET").toUpperCase(),s=(0,manifest_1.authRuleFor)(u,a,p);if(s.mode==="jwt"){const k=String(e.headers.host??"").split(":")[0].toLowerCase(),d=(0,dev_auth_1.verifyDevJwt)(e,h?.for(k));return d?s.rule&&!(0,manifest_1.evalRule)(s.rule,(0,dev_auth_1.devAttrs)(e,d))?(r(t,"authz",{ok:!1}),{ok:!1,status:403,reason:"forbidden",detail:"Forbidden: insufficient permission"}):((0,dev_auth_1.stampIdentity)(e,d),r(t,"auth",{mode:"jwt",ok:!0}),{ok:!0,claims:d}):(r(t,"auth",{mode:"jwt",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: invalid or missing token"})}return r(t,"auth",{mode:s.mode}),{ok:!0}}return r(t,"auth",{mode:"public",unconfigured:!0}),{ok:!0}},"publicAuth")}}l(createEdgeAuth,"createEdgeAuth"),n(createEdgeAuth,"createEdgeAuth");

package/executors/gateway/runtime/chooser.js

@@ -1,42 +1,16 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.renderChooserPage = renderChooserPage;
-exports.serveChooser = serveChooser;
-const workspace_registry_1 = require("./workspace-registry");
-const esc = (s) => s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
-/** Render the chooser HTML from the registry entries (+ which key is running in THIS gateway). */
-function renderChooserPage(entries, currentKey) {
-    const rows = entries
-        .map((e) => ({ ...e, live: e.key === currentKey || (0, workspace_registry_1.isWorkspaceLive)(e) }))
-        .sort((a, b) => Number(b.live) - Number(a.live) || a.key.localeCompare(b.key));
-    const cards = rows.length === 0
-        ? `<p class="empty">No workspaces registered yet. Start a gateway in a workspace (<code>lensmcp gateway start</code>) and it will appear here.</p>`
-        : rows
-            .map((e) => {
-            const here = e.key === currentKey;
-            const badge = here
-                ? `<span class="badge here">running here</span>`
-                : e.live
-                    ? `<span class="badge live">live</span>`
-                    : `<span class="badge off">offline</span>`;
-            // The whole card is the anchor for a live workspace (no nested <a>); a `<div>` when offline.
-            const action = e.live
-                ? `<span class="open">Open dashboard →</span>`
-                : `<span class="hint">start its gateway to open</span>`;
-            const inner = `<div class="card-main">
-      <div class="key">${esc(e.key)} ${badge}</div>
+"use strict";var l=Object.defineProperty;var n=(a,o)=>l(a,"name",{value:o,configurable:!0});var p=Object.defineProperty,t=n((a,o)=>p(a,"name",{value:o,configurable:!0}),"t");Object.defineProperty(exports,"__esModule",{value:!0}),exports.renderChooserPage=renderChooserPage,exports.serveChooser=serveChooser;const workspace_registry_1=require("./workspace-registry"),esc=t(a=>a.replace(/[&<>"']/g,o=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[o]),"esc");function renderChooserPage(a,o){const r=a.map(e=>({...e,live:e.key===o||(0,workspace_registry_1.isWorkspaceLive)(e)})).sort((e,s)=>Number(s.live)-Number(e.live)||e.key.localeCompare(s.key)),c=r.length===0?'<p class="empty">No workspaces registered yet. Start a gateway in a workspace (<code>lensmcp gateway start</code>) and it will appear here.</p>':r.map(e=>{const s=e.key===o?'<span class="badge here">running here</span>':e.live?'<span class="badge live">live</span>':'<span class="badge off">offline</span>',d=e.live?'<span class="open">Open dashboard \u2192</span>':'<span class="hint">start its gateway to open</span>',i=`<div class="card-main">
+      <div class="key">${esc(e.key)} ${s}</div>
       <div class="root">${esc(e.root)}</div>
     </div>
-    <div class="card-action">${action}</div>`;
-            return e.live
-                ? `<a class="card is-live" href="${esc(e.base)}/">\n    ${inner}\n  </a>`
-                : `<div class="card is-off">\n    ${inner}\n  </div>`;
-        })
-            .join('\n');
-    return `<!doctype html>
+    <div class="card-action">${d}</div>`;return e.live?`<a class="card is-live" href="${esc(e.base)}/">
+    ${i}
+  </a>`:`<div class="card is-off">
+    ${i}
+  </div>`}).join(`
+`);return`<!doctype html>
 <html lang="en"><head>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
-<title>LensMCP · workspaces</title>
+<title>LensMCP \xB7 workspaces</title>
 <style>
   :root { color-scheme: dark; }
   * { box-sizing: border-box; }
@@ -68,17 +42,10 @@ function renderChooserPage(entries, currentKey) {
 <body><div class="wrap">
   <header>
     <h1>LensMCP workspaces</h1>
-    <p class="sub">Pick a workspace to open its dashboard. ${rows.filter((r) => r.live).length} live · ${rows.length} known.</p>
+    <p class="sub">Pick a workspace to open its dashboard. ${r.filter(e=>e.live).length} live \xB7 ${r.length} known.</p>
   </header>
   <div class="list">
-${cards}
+${c}
   </div>
   <footer>Served by the gateway on <code>lensmcp.local</code>. This list updates as gateways start and stop.</footer>
-</div></body></html>`;
-}
-/** Serve the chooser at the dashboard-host root. Reads the registry fresh so live status is current. */
-function serveChooser(res, currentKey) {
-    const html = renderChooserPage((0, workspace_registry_1.readWorkspaces)(), currentKey);
-    res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
-    res.end(html);
-}
+</div></body></html>`}n(renderChooserPage,"renderChooserPage"),t(renderChooserPage,"renderChooserPage");function serveChooser(a,o){const r=renderChooserPage((0,workspace_registry_1.readWorkspaces)(),o);a.writeHead(200,{"content-type":"text/html; charset=utf-8","cache-control":"no-store"}),a.end(r)}n(serveChooser,"serveChooser"),t(serveChooser,"serveChooser");

package/executors/gateway/runtime/control.js

@@ -1,128 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.controlSocketPath = controlSocketPath;
-exports.startControlServer = startControlServer;
-const tslib_1 = require("tslib");
-/**
- * The daemon CONTROL PLANE (planning/multi-workspace-gateway.md P3, model A). A UNIX-socket HTTP listener
- * at `~/.lensmcp/control.sock` — loopback-only by nature (a filesystem socket, no TCP), so a second
- * workspace's `gateway start` (P4) REGISTERS its fragment into the running `:443` daemon instead of
- * fighting for the port. The daemon reconstructs the fragment via `discoverRoutes` on the second
- * workspace's root (so it owns the pool controllers + spawns those devservers itself — model A), merges
- * the routes live, and reaps them on unregister.
- *
- *   POST /register    { wsKey, root, projects }  → discover + register + rebuild
- *   POST /unregister  { wsKey }                  → unregister + reap its services + rebuild
- *   GET  /list                                   → the registered workspaces
- */
-const fs = tslib_1.__importStar(require("node:fs"));
-const http = tslib_1.__importStar(require("node:http"));
-const os = tslib_1.__importStar(require("node:os"));
-const path = tslib_1.__importStar(require("node:path"));
-const discovery_1 = require("./discovery");
-/** `~/.lensmcp/control.sock` — the well-known daemon control socket (override the home via `LENSMCP_HOME`). */
-function controlSocketPath() {
-    const home = process.env['LENSMCP_HOME'] || os.homedir();
-    return path.join(home, '.lensmcp', 'control.sock');
-}
-function readJsonBody(req) {
-    return new Promise((resolve, reject) => {
-        let raw = '';
-        req.on('data', (c) => {
-            raw += c;
-            if (raw.length > 1_000_000)
-                reject(new Error('body too large')); // bound the loopback input
-        });
-        req.on('end', () => {
-            try {
-                resolve(raw ? JSON.parse(raw) : {});
-            }
-            catch (e) {
-                reject(e);
-            }
-        });
-        req.on('error', reject);
-    });
-}
-/** Start the control listener. The socket is loopback-only (a filesystem socket), so no IP allow-listing
- *  is needed — anything that can open it is already on this machine as this user. */
-function startControlServer(deps) {
-    const { rt } = deps;
-    const socketPath = controlSocketPath();
-    fs.mkdirSync(path.dirname(socketPath), { recursive: true });
-    try {
-        fs.unlinkSync(socketPath);
-    }
-    catch { /* no stale socket to clear */ }
-    const send = (res, code, body) => {
-        res.writeHead(code, { 'content-type': 'application/json' });
-        res.end(JSON.stringify(body));
-    };
-    const server = http.createServer((req, res) => {
-        void (async () => {
-            try {
-                const url = (req.url ?? '').split('?')[0];
-                if (req.method === 'GET' && url === '/list') {
-                    return send(res, 200, {
-                        workspaces: rt.registry.keys().map((key) => {
-                            const f = rt.registry.get(key);
-                            return { key, root: f?.root, routes: f?.routes.length ?? 0, services: f?.services.length ?? 0 };
-                        }),
-                    });
-                }
-                // A RICHER status than /list: the daemon's own identity + every registered workspace (flagged if it
-                // OWNS the daemon) + per-service live state (down|starting|up). The IDE plugin + `gateway status --json`
-                // consume this to render the active gateway, its workspaces, and each service's health at a glance.
-                if (req.method === 'GET' && url === '/status') {
-                    return send(res, 200, {
-                        daemon: { pid: process.pid, wsKey: rt.wsKey },
-                        workspaces: rt.registry.keys().map((key) => {
-                            const f = rt.registry.get(key);
-                            return { key, root: f?.root, routes: f?.routes.length ?? 0, services: f?.services.length ?? 0, isDaemon: key === rt.wsKey };
-                        }),
-                        services: rt.registry.allServices().map((s) => ({ project: s.project, wsKey: s.wsKey, host: s.decl.host, state: s.state })),
-                    });
-                }
-                if (req.method === 'POST' && url === '/register') {
-                    const body = (await readJsonBody(req));
-                    if (!body.wsKey || !body.root)
-                        return send(res, 400, { error: 'wsKey and root are required' });
-                    const { routes, services } = (0, discovery_1.discoverRoutes)(body.root, body.projects ?? {}, undefined, body.wsKey);
-                    const fragment = { wsKey: body.wsKey, root: body.root, routes, services };
-                    rt.registry.register(fragment);
-                    await deps.onRegister?.(fragment); // hosts the dashboard + APPENDS its route to the fragment BEFORE the rebuild
-                    rt.rebuildRoutes();
-                    return send(res, 200, { ok: true, wsKey: body.wsKey, routes: routes.length, services: services.length, workspaces: rt.registry.keys() });
-                }
-                if (req.method === 'POST' && url === '/unregister') {
-                    const body = (await readJsonBody(req));
-                    if (!body.wsKey)
-                        return send(res, 400, { error: 'wsKey is required' });
-                    const dropped = rt.registry.unregister(body.wsKey);
-                    if (dropped) {
-                        for (const svc of dropped.services)
-                            deps.killService(svc, 'workspace unregistered');
-                        deps.onUnregister?.(dropped);
-                    }
-                    rt.rebuildRoutes();
-                    return send(res, 200, { ok: true, removed: !!dropped, workspaces: rt.registry.keys() });
-                }
-                send(res, 404, { error: 'not found' });
-            }
-            catch (e) {
-                send(res, 500, { error: e.message });
-            }
-        })();
-    });
-    server.listen(socketPath);
-    return {
-        socketPath,
-        close: () => {
-            server.close();
-            try {
-                fs.unlinkSync(socketPath);
-            }
-            catch { /* already gone */ }
-        },
-    };
-}
+"use strict";var h=Object.defineProperty;var d=(o,r)=>h(o,"name",{value:r,configurable:!0});var p=Object.defineProperty,y=d((o,r)=>p(o,"name",{value:r,configurable:!0}),"y");Object.defineProperty(exports,"__esModule",{value:!0}),exports.controlSocketPath=controlSocketPath,exports.startControlServer=startControlServer;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),http=tslib_1.__importStar(require("node:http")),os=tslib_1.__importStar(require("node:os")),path=tslib_1.__importStar(require("node:path")),discovery_1=require("./discovery");function controlSocketPath(){const o=process.env.LENSMCP_HOME||os.homedir();return path.join(o,".lensmcp","control.sock")}d(controlSocketPath,"controlSocketPath"),y(controlSocketPath,"controlSocketPath");function readJsonBody(o){return new Promise((r,c)=>{let s="";o.on("data",u=>{s+=u,s.length>1e6&&c(new Error("body too large"))}),o.on("end",()=>{try{r(s?JSON.parse(s):{})}catch(u){c(u)}}),o.on("error",c)})}d(readJsonBody,"readJsonBody"),y(readJsonBody,"readJsonBody");function startControlServer(o){const{rt:r}=o,c=controlSocketPath();fs.mkdirSync(path.dirname(c),{recursive:!0});try{fs.unlinkSync(c)}catch{}const s=y((n,i,a)=>{n.writeHead(i,{"content-type":"application/json"}),n.end(JSON.stringify(a))},"send"),u=http.createServer((n,i)=>{(async()=>{try{const a=(n.url??"").split("?")[0];if(n.method==="GET"&&a==="/list")return s(i,200,{workspaces:r.registry.keys().map(e=>{const t=r.registry.get(e);return{key:e,root:t?.root,routes:t?.routes.length??0,services:t?.services.length??0}})});if(n.method==="GET"&&a==="/status")return s(i,200,{daemon:{pid:process.pid,wsKey:r.wsKey},workspaces:r.registry.keys().map(e=>{const t=r.registry.get(e);return{key:e,root:t?.root,routes:t?.routes.length??0,services:t?.services.length??0,isDaemon:e===r.wsKey}}),services:r.registry.allServices().map(e=>({project:e.project,wsKey:e.wsKey,host:e.decl.host,state:e.state}))});if(n.method==="POST"&&a==="/register"){const e=await readJsonBody(n);if(!e.wsKey||!e.root)return s(i,400,{error:"wsKey and root are required"});const{routes:t,services:l}=(0,discovery_1.discoverRoutes)(e.root,e.projects??{},void 0,e.wsKey),g={wsKey:e.wsKey,root:e.root,routes:t,services:l};return r.registry.register(g),await o.onRegister?.(g),r.rebuildRoutes(),s(i,200,{ok:!0,wsKey:e.wsKey,routes:t.length,services:l.length,workspaces:r.registry.keys()})}if(n.method==="POST"&&a==="/unregister"){const e=await readJsonBody(n);if(!e.wsKey)return s(i,400,{error:"wsKey is required"});const t=r.registry.unregister(e.wsKey);if(t){for(const l of t.services)o.killService(l,"workspace unregistered");o.onUnregister?.(t)}return r.rebuildRoutes(),s(i,200,{ok:!0,removed:!!t,workspaces:r.registry.keys()})}s(i,404,{error:"not found"})}catch(a){s(i,500,{error:a.message})}})()});return u.listen(c),{socketPath:c,close:y(()=>{u.close();try{fs.unlinkSync(c)}catch{}},"close")}}d(startControlServer,"startControlServer"),y(startControlServer,"startControlServer");

package/executors/gateway/runtime/dev-auth.js

@@ -1,108 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.devAttrs = void 0;
-exports.verifyDevJwt = verifyDevJwt;
-exports.stampIdentity = stampIdentity;
-/**
- * Dev edge auth: verify the end-user token, then stamp the trusted identity headers the services read
- * (via GatewayTrustGuard). It MIRRORS the prod gateway's posture — a real JWKS/RS256 verifier when one is
- * wired (see `../jwks-verify` + the composition in `server.ts`), an HS256 shared-secret path as the legacy
- * fallback. Pure functions (the verifier is injected, so unit tests supply their own JWKS).
- *
- * SECURITY (the invariant this file must hold): a `jwt` route MUST NOT accept a token whose signature the
- * edge cannot verify. When a JWKS verifier is wired it is the SOLE acceptor — every alg goes through it, so
- * an unknown `kid`, a bad signature, `alg:none`, an HS256-confusion token, and an expired token ALL fail
- * closed (rejected). Without a verifier, an asymmetric (RS256/ES*) token cannot be checked (we don't hold
- * the issuer's public keys), so it also fails closed — unless an operator EXPLICITLY opts into the old
- * insecure decode-only path (`LENSMCP_GW_DEV_JWT_INSECURE_DECODE=1`) for local bring-up. The HS256
- * shared-secret path stays for services using that convention (and is itself bypassed once JWKS is wired).
- */
-const node_crypto_1 = require("node:crypto");
-/** The compact JWS from the `Authorization: Bearer …` header, or undefined. */
-function bearerToken(req) {
-    const raw = Array.isArray(req.headers['authorization']) ? req.headers['authorization'][0] : req.headers['authorization'];
-    const auth = String(raw ?? '');
-    return auth.startsWith('Bearer ') ? auth.slice(7) : undefined;
-}
-/**
- * Verify the end-user JWT and return its claims, or undefined.
- *
- * @param verifier when provided (the RS256/JWKS verifier wired by the composition root), it is the ONLY
- *   acceptor — the token is verified against the issuer's published keys by `kid`, so a rogue key / unknown
- *   kid / bad signature / `alg:none` / HS256-confusion / expired token all return undefined (fail closed).
- */
-function verifyDevJwt(req, verifier) {
-    const token = bearerToken(req);
-    if (!token)
-        return undefined;
-    const [h, p, s] = token.split('.');
-    if (!h || !p || !s)
-        return undefined;
-    // Preferred: a real JWKS/RS256 verifier (mirrors the prod gateway's `jwks ? jwks.verify(tok) : hs256`).
-    // When wired it is the SOLE acceptor, so every forgery vector below is closed at once.
-    if (verifier)
-        return verifier.verify(token);
-    // ── No verifier wired (legacy dev) ──────────────────────────────────────────────────────────────────
-    let alg;
-    try {
-        alg = JSON.parse(Buffer.from(h, 'base64url').toString())['alg'];
-    }
-    catch {
-        return undefined;
-    }
-    if (typeof alg === 'string' && alg !== 'HS256') {
-        // An asymmetric IdP (RS256 + JWKS) does NOT use the HS256 dev shared secret. Without the issuer's public
-        // keys we CANNOT verify the signature, so — unlike the old code, which decode-accepted any RS256 token
-        // (a full edge auth bypass: a rogue key or a forged `alg:none` sailed through) — we FAIL CLOSED. Wire a
-        // JWKS verifier (LENSMCP_GW_JWKS_URL, or the auto-derived auth-host JWKS) to accept RS256 tokens.
-        if (process.env['LENSMCP_GW_DEV_JWT_INSECURE_DECODE'] !== '1')
-            return undefined; // fail closed
-        // Explicit, dev-only opt-in to the legacy decode + exp-check (NO signature check) — bring-up escape hatch.
-        try {
-            const rsClaims = JSON.parse(Buffer.from(p, 'base64url').toString());
-            if (typeof rsClaims['exp'] === 'number' && Date.now() / 1000 > rsClaims['exp'])
-                return undefined;
-            return rsClaims;
-        }
-        catch {
-            return undefined;
-        }
-    }
-    // HS256 shared-secret convention (only reachable when NO JWKS verifier is wired).
-    const secret = process.env['AUTH_JWT_SECRET'] ?? 'tetros-dev-secret';
-    const expected = (0, node_crypto_1.createHmac)('sha256', secret).update(`${h}.${p}`).digest('base64url');
-    const a = Buffer.from(s);
-    const b = Buffer.from(expected);
-    if (a.length !== b.length || !(0, node_crypto_1.timingSafeEqual)(a, b))
-        return undefined;
-    try {
-        const claims = JSON.parse(Buffer.from(p, 'base64url').toString());
-        if (typeof claims['exp'] === 'number' && Date.now() / 1000 > claims['exp'])
-            return undefined;
-        return claims;
-    }
-    catch {
-        return undefined;
-    }
-}
-/** Stamp verified identity onto the forwarded request — tenant from the `tid` CLAIM, never a client header. */
-function stampIdentity(req, claims) {
-    const set = (k, v) => { if (v !== undefined && v !== null && v !== '')
-        req.headers[k] = String(v); };
-    set('x-user-id', claims['sub']);
-    set('x-tenant-id', claims['tid']);
-    const roles = claims['roles'];
-    if (Array.isArray(roles) && roles.length)
-        req.headers['x-user-roles'] = roles.map(String).join(',');
-    const perms = claims['perms'];
-    if (Array.isArray(perms) && perms.length)
-        req.headers['x-user-permissions'] = perms.map(String).join(',');
-}
-/** Build the ABAC attribute bag from the verified claims + request envelope. */
-const devAttrs = (req, claims) => ({
-    ...claims,
-    ip: req.socket.remoteAddress ?? '',
-    method: (req.method ?? 'GET').toUpperCase(),
-    path: (req.url ?? '/').split('?')[0],
-});
-exports.devAttrs = devAttrs;
+"use strict";var y=Object.defineProperty;var a=(e,r)=>y(e,"name",{value:r,configurable:!0});var h=Object.defineProperty,u=a((e,r)=>h(e,"name",{value:r,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.devAttrs=void 0,exports.verifyDevJwt=verifyDevJwt,exports.stampIdentity=stampIdentity;const node_crypto_1=require("node:crypto");function bearerToken(e){const r=Array.isArray(e.headers.authorization)?e.headers.authorization[0]:e.headers.authorization,t=String(r??"");return t.startsWith("Bearer ")?t.slice(7):void 0}a(bearerToken,"bearerToken"),u(bearerToken,"bearerToken");function verifyDevJwt(e,r){const t=bearerToken(e);if(!t)return;const[n,s,f]=t.split(".");if(!n||!s||!f)return;if(r)return r.verify(t);let o;try{o=JSON.parse(Buffer.from(n,"base64url").toString()).alg}catch{return}if(typeof o=="string"&&o!=="HS256"){if(process.env.LENSMCP_GW_DEV_JWT_INSECURE_DECODE!=="1")return;try{const i=JSON.parse(Buffer.from(s,"base64url").toString());return typeof i.exp=="number"&&Date.now()/1e3>i.exp?void 0:i}catch{return}}const d=process.env.AUTH_JWT_SECRET??"tetros-dev-secret",l=(0,node_crypto_1.createHmac)("sha256",d).update(`${n}.${s}`).digest("base64url"),p=Buffer.from(f),c=Buffer.from(l);if(!(p.length!==c.length||!(0,node_crypto_1.timingSafeEqual)(p,c)))try{const i=JSON.parse(Buffer.from(s,"base64url").toString());return typeof i.exp=="number"&&Date.now()/1e3>i.exp?void 0:i}catch{return}}a(verifyDevJwt,"verifyDevJwt"),u(verifyDevJwt,"verifyDevJwt");function stampIdentity(e,r){const t=u((f,o)=>{o!=null&&o!==""&&(e.headers[f]=String(o))},"set");t("x-user-id",r.sub),t("x-tenant-id",r.tid);const n=r.roles;Array.isArray(n)&&n.length&&(e.headers["x-user-roles"]=n.map(String).join(","));const s=r.perms;Array.isArray(s)&&s.length&&(e.headers["x-user-permissions"]=s.map(String).join(","))}a(stampIdentity,"stampIdentity"),u(stampIdentity,"stampIdentity");const devAttrs=u((e,r)=>({...r,ip:e.socket.remoteAddress??"",method:(e.method??"GET").toUpperCase(),path:(e.url??"/").split("?")[0]}),"devAttrs");exports.devAttrs=devAttrs;

package/executors/gateway/runtime/discovery.js

@@ -1,123 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.pickSock = pickSock;
-exports.lensPortFromUpstream = lensPortFromUpstream;
-exports.discoverRoutes = discoverRoutes;
-const tslib_1 = require("tslib");
-/**
- * Route discovery + socket-pool round-robin. Pure (fs reads only): reads every
- * project's `cluster` (or legacy `davnx`) declaration and builds the route table.
- */
-const fs = tslib_1.__importStar(require("node:fs"));
-const os = tslib_1.__importStar(require("node:os"));
-const path = tslib_1.__importStar(require("node:path"));
-const manifest_1 = require("../manifest");
-const scope_1 = require("./scope");
-/** Round-robin over the pool's sockets, rescanning the dir when the cache ages out. */
-function pickSock(pool, scanTtlMs = 1500) {
-    const now = Date.now();
-    if (now - pool.scannedAt > scanTtlMs) {
-        try {
-            pool.socks = fs.readdirSync(pool.dir)
-                .filter((f) => /^child-\d+\.sock$/.test(f))
-                .map((f) => path.join(pool.dir, f));
-        }
-        catch {
-            pool.socks = [];
-        }
-        pool.scannedAt = now;
-    }
-    if (pool.socks.length === 0)
-        return undefined;
-    pool.idx = (pool.idx + 1) % pool.socks.length;
-    return pool.socks[pool.idx];
-}
-/** Extract the port from an `upstream` URL like `http://localhost:5173`. */
-function lensPortFromUpstream(upstream) {
-    if (!upstream)
-        return undefined;
-    const m = /:(\d+)/.exec(upstream);
-    return m ? Number(m[1]) : undefined;
-}
-/**
- * Read every project's `cluster` (or legacy `davnx`) declaration and build
- * the route table: host routes first (plus auto `internal.<host>` for pod
- * services), the `default` catch-all last.
- */
-function discoverRoutes(rootDir, projects, sockBaseDir = os.tmpdir(), 
-// The workspace key namespaces the pod sock dir (planning/multi-workspace-gateway.md) — MUST match
-// `main.devserver.ts`'s `SOCK_DIR` derivation so the gateway scans the same dir the devserver writes.
-// Empty → the legacy un-namespaced path (single-workspace / pre-multi-workspace).
-wsKey = '') {
-    const sockDirFor = (service) => wsKey ? path.join(sockBaseDir, wsKey, `${service}-devserver`) : path.join(sockBaseDir, `${service}-devserver`);
-    const routes = [];
-    const services = [];
-    const hosts = []; // every declared host — the default's apex is derived from these
-    let defaultRoute;
-    for (const [name, p] of Object.entries(projects)) {
-        let decl;
-        try {
-            const raw = JSON.parse(fs.readFileSync(path.join(rootDir, p.root, 'project.json'), 'utf8'));
-            decl = raw.cluster ?? raw.davnx;
-        }
-        catch {
-            continue;
-        }
-        if (!decl)
-            continue;
-        let pool;
-        let svc;
-        let target;
-        let lens;
-        if (decl.service) {
-            // `lens` applies to FRONTEND apps only; a pod service is already
-            // instrumented by the serve executor's node-instrumentation graft.
-            if (decl.lens)
-                console.warn(`[gateway] ${name}: cluster.lens is ignored for pod (service) decls — backends are instrumented by serve-hmr.`);
-            pool = { dir: sockDirFor(decl.service), socks: [], idx: -1, scannedAt: 0 };
-            svc = { project: name, decl, root: rootDir, wsKey, pool, state: 'down', lastUsed: Date.now(), inflight: 0, lastScaleAt: 0 };
-            services.push(svc);
-        }
-        else if (decl.lens) {
-            // Lens-mode frontend: the gateway SPAWNS this app's Vite + instrumentation
-            // (deterministically on `port`) and upstreams to it. One LensFrontend per
-            // project is SHARED across its host/default routes (so the spawn fires once).
-            const port = decl.port ?? lensPortFromUpstream(decl.upstream) ?? 5173;
-            target = `http://localhost:${port}`;
-            lens = { project: name, projectRoot: path.join(rootDir, p.root), port };
-        }
-        else {
-            target = decl.upstream ?? (decl.port ? `http://localhost:${decl.port}` : undefined);
-            if (!target) {
-                console.warn(`[gateway] ${name}: no service/upstream/port — skipped.`);
-                continue;
-            }
-        }
-        const base = { project: name, prependPrefix: decl.prependPrefix, target, pool, svc, prefix: decl.path, auth: decl.auth, lens };
-        if (decl.host) {
-            routes.push({ ...base, host: decl.host });
-            hosts.push(decl.host);
-            // internal.<host>: east-west traffic, same pods, NO middleware.
-            if (pool && decl.internalHost !== false) {
-                routes.push({
-                    ...base,
-                    host: typeof decl.internalHost === 'string' ? decl.internalHost : `internal.${decl.host}`,
-                    internal: true,
-                });
-            }
-        }
-        if (decl.default)
-            defaultRoute = { ...base, prefix: undefined };
-    }
-    if (defaultRoute) {
-        // Stamp the apex so a shared multi-workspace gateway routes an unclaimed host to THIS workspace's
-        // default (see matchRoute). Harmless for a single workspace — one default ignores its apex.
-        defaultRoute.apex = (0, scope_1.baseDomainOf)(hosts);
-        routes.push(defaultRoute);
-    }
-    // specificity sort (shared with prod): host+path beats host-only beats
-    // catch-all — so a path-mounted service (api.x/channels) wins over the
-    // host's owner (api.x → api).
-    (0, manifest_1.sortBySpecificity)(routes);
-    return { routes, services };
-}
+"use strict";var S=Object.defineProperty;var p=(e,r)=>S(e,"name",{value:r,configurable:!0});var k=Object.defineProperty,a=p((e,r)=>k(e,"name",{value:r,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0}),exports.pickSock=pickSock,exports.lensPortFromUpstream=lensPortFromUpstream,exports.discoverRoutes=discoverRoutes;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),os=tslib_1.__importStar(require("node:os")),path=tslib_1.__importStar(require("node:path")),manifest_1=require("../manifest"),scope_1=require("./scope");function pickSock(e,r=1500){const i=Date.now();if(i-e.scannedAt>r){try{e.socks=fs.readdirSync(e.dir).filter(s=>/^child-\d+\.sock$/.test(s)).map(s=>path.join(e.dir,s))}catch{e.socks=[]}e.scannedAt=i}if(e.socks.length!==0)return e.idx=(e.idx+1)%e.socks.length,e.socks[e.idx]}p(pickSock,"pickSock"),a(pickSock,"pickSock");function lensPortFromUpstream(e){if(!e)return;const r=/:(\d+)/.exec(e);return r?Number(r[1]):void 0}p(lensPortFromUpstream,"lensPortFromUpstream"),a(lensPortFromUpstream,"lensPortFromUpstream");function discoverRoutes(e,r,i=os.tmpdir(),s=""){const y=a(t=>s?path.join(i,s,`${t}-devserver`):path.join(i,`${t}-devserver`),"sockDirFor"),n=[],v=[],m=[];let l;for(const[t,x]of Object.entries(r)){let o;try{const c=JSON.parse(fs.readFileSync(path.join(e,x.root,"project.json"),"utf8"));o=c.cluster??c.davnx}catch{continue}if(!o)continue;let d,f,u,j;if(o.service)o.lens&&console.warn(`[gateway] ${t}: cluster.lens is ignored for pod (service) decls \u2014 backends are instrumented by serve-hmr.`),d={dir:y(o.service),socks:[],idx:-1,scannedAt:0},f={project:t,decl:o,root:e,wsKey:s,pool:d,state:"down",lastUsed:Date.now(),inflight:0,lastScaleAt:0},v.push(f);else if(o.lens){const c=o.port??lensPortFromUpstream(o.upstream)??5173;u=`http://localhost:${c}`,j={project:t,projectRoot:path.join(e,x.root),port:c}}else if(u=o.upstream??(o.port?`http://localhost:${o.port}`:void 0),!u){console.warn(`[gateway] ${t}: no service/upstream/port \u2014 skipped.`);continue}const h={project:t,prependPrefix:o.prependPrefix,target:u,pool:d,svc:f,prefix:o.path,auth:o.auth,lens:j};o.host&&(n.push({...h,host:o.host}),m.push(o.host),d&&o.internalHost!==!1&&n.push({...h,host:typeof o.internalHost=="string"?o.internalHost:`internal.${o.host}`,internal:!0})),o.default&&(l={...h,prefix:void 0})}return l&&(l.apex=(0,scope_1.baseDomainOf)(m),n.push(l)),(0,manifest_1.sortBySpecificity)(n),{routes:n,services:v}}p(discoverRoutes,"discoverRoutes"),a(discoverRoutes,"discoverRoutes");

package/executors/gateway/runtime/edge.js

@@ -1,47 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PREFLIGHT_METHODS_ROUTED = exports.PREFLIGHT_METHODS_NOROUTE = exports.corsPreflight = exports.cors = exports.GATEWAY_OWNED_HEADERS = exports.sendError = void 0;
-const gateway_errors_1 = require("../gateway-errors");
-/**
- * Send a gateway-generated edge error as the JSON envelope `{ key, status, traceId, message? }` (NOT
- * `text/plain`) + an `x-request-id` header — the SAME localized contract a service returns, so a browser
- * app renders `t(key)` and surfaces the trace id. Mirrors the prod gateway's `sendError`.
- */
-const sendError = (res, req, status, reason, detail) => {
-    const traceId = (0, gateway_errors_1.ensureRequestId)(req);
-    if (!res.headersSent)
-        res.writeHead(status, { 'content-type': gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE, 'x-request-id': traceId });
-    res.end((0, gateway_errors_1.gatewayErrorBody)(status, reason, traceId, detail));
-};
-exports.sendError = sendError;
-/**
- * The gateway OWNS these headers — strip any client-supplied copy at ingress so identity + trust can
- * only originate from the gateway (mirrors the prod gateway's stripTrust). Applied at the very top of
- * BOTH the HTTP handler and the WS upgrade.
- */
-exports.GATEWAY_OWNED_HEADERS = ['x-internal-token', 'x-api-key-id', 'x-user-id', 'x-tenant-id', 'x-user-roles', 'x-user-permissions'];
-/** Reflect the request Origin back with credentials — the gateway is the edge CORS authority. */
-const cors = (req, res) => {
-    const origin = String(req.headers.origin ?? '*');
-    res.setHeader('access-control-allow-origin', origin);
-    res.setHeader('access-control-allow-credentials', 'true');
-    res.setHeader('vary', 'Origin');
-};
-exports.cors = cors;
-/**
- * Answer a CORS preflight (OPTIONS) at the edge: reflect CORS + 204 with the allowed `methods` and the
- * requested headers echoed back. `methods` differs by caller — the no-route host-root uses the narrow
- * `GET,HEAD,OPTIONS`; a routed path uses the wide verb list.
- */
-const corsPreflight = (req, res, methods) => {
-    (0, exports.cors)(req, res);
-    res.writeHead(204, {
-        'access-control-allow-methods': methods,
-        'access-control-allow-headers': String(req.headers['access-control-request-headers'] ?? '*'),
-    });
-    res.end();
-};
-exports.corsPreflight = corsPreflight;
-/** Allowed-methods lists for the two preflight sites. */
-exports.PREFLIGHT_METHODS_NOROUTE = 'GET,HEAD,OPTIONS';
-exports.PREFLIGHT_METHODS_ROUTED = 'GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS';
+"use strict";var i=Object.defineProperty;var a=(r,e)=>i(r,"name",{value:e,configurable:!0});var c=Object.defineProperty,s=a((r,e)=>c(r,"name",{value:e,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.PREFLIGHT_METHODS_ROUTED=exports.PREFLIGHT_METHODS_NOROUTE=exports.corsPreflight=exports.cors=exports.GATEWAY_OWNED_HEADERS=exports.sendError=void 0;const gateway_errors_1=require("../gateway-errors"),sendError=s((r,e,o,n,E)=>{const t=(0,gateway_errors_1.ensureRequestId)(e);r.headersSent||r.writeHead(o,{"content-type":gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE,"x-request-id":t}),r.end((0,gateway_errors_1.gatewayErrorBody)(o,n,t,E))},"sendError");exports.sendError=sendError,exports.GATEWAY_OWNED_HEADERS=["x-internal-token","x-api-key-id","x-user-id","x-tenant-id","x-user-roles","x-user-permissions"];const cors=s((r,e)=>{const o=String(r.headers.origin??"*");e.setHeader("access-control-allow-origin",o),e.setHeader("access-control-allow-credentials","true"),e.setHeader("vary","Origin")},"cors");exports.cors=cors;const corsPreflight=s((r,e,o)=>{(0,exports.cors)(r,e),e.writeHead(204,{"access-control-allow-methods":o,"access-control-allow-headers":String(r.headers["access-control-request-headers"]??"*")}),e.end()},"corsPreflight");exports.corsPreflight=corsPreflight,exports.PREFLIGHT_METHODS_NOROUTE="GET,HEAD,OPTIONS",exports.PREFLIGHT_METHODS_ROUTED="GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS";