@lensmcp/cluster 1.20.0 → 1.20.1

package/basic-ssl.js

@@ -1 +1 @@
-"use strict";var C=Object.defineProperty;var o=(e,r)=>C(e,"name",{value:r,configurable:!0});var f=Object.defineProperty,c=o((e,r)=>f(e,"name",{value:r,configurable:!0}),"c"),p=Object.defineProperty,a=c((e,r)=>p(e,"name",{value:r,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0}),exports.CA_CERT_FILE=void 0,exports.caDir=caDir,exports.caCertPath=caCertPath,exports.getCertificateSync=getCertificateSync,exports.ensureCaSync=ensureCaSync;const tslib_1=require("tslib"),crypto=tslib_1.__importStar(require("node:crypto")),fs=tslib_1.__importStar(require("node:fs")),os=tslib_1.__importStar(require("node:os")),path=tslib_1.__importStar(require("node:path")),LEAF_MAX_AGE_MS=600*60*60*1e3,CA_TTL_DAYS=3650,CA_MIN_REMAINING_MS=720*60*60*1e3;exports.CA_CERT_FILE="lensmcp-local-ca.crt";const LEGACY_CA_CERT_FILE="davnx-local-ca.crt",CA_KEY_FILE="_ca-key.pem";function caDir(){const e=process.env.LENSMCP_HOME||os.homedir();return path.join(e,".lensmcp","ca")}o(caDir,"caDir"),c(caDir,"caDir"),a(caDir,"caDir");function caCertPath(){return path.join(caDir(),exports.CA_CERT_FILE)}o(caCertPath,"caCertPath"),c(caCertPath,"caCertPath"),a(caCertPath,"caCertPath");function getCertificateSync(e,r="lensmcp.dev",t=[]){const n=require("node-forge");fs.mkdirSync(e,{recursive:!0});const m=loadOrCreateCa(n,e),s=n.pki.certificateToPem(m.cert),i=crypto.createHash("sha256").update([r,...[...t].sort()].join("|")).digest("hex").slice(0,12),u=path.join(e,`_leaf-${i}.pem`);try{const l=fs.statSync(u);if(Date.now()-l.ctimeMs<LEAF_MAX_AGE_MS){const d=fs.readFileSync(u,"utf8");if(d.includes(s))return d}}catch{}const y=createLeafCertificate(n,m,r,t);fs.writeFileSync(u,y);for(const l of fs.readdirSync(e))if(/^_leaf-.*\.pem$/.test(l)&&l!==`_leaf-${i}.pem`||/^_cert.*\.pem$/.test(l)||/-dev\.crt$/.test(l)||l===LEGACY_CA_CERT_FILE)try{fs.unlinkSync(path.join(e,l))}catch{}return y}o(getCertificateSync,"getCertificateSync"),c(getCertificateSync,"getCertificateSync"),a(getCertificateSync,"getCertificateSync");function ensureCaSync(e){const r=require("node-forge");return loadOrCreateCa(r,e),caCertPath()}o(ensureCaSync,"ensureCaSync"),c(ensureCaSync,"ensureCaSync"),a(ensureCaSync,"ensureCaSync");function readCaPair(e,r){try{const t=r.pki.certificateFromPem(fs.readFileSync(path.join(e,exports.CA_CERT_FILE),"utf8")),n=r.pki.privateKeyFromPem(fs.readFileSync(path.join(e,CA_KEY_FILE),"utf8"));if(t.validity.notAfter.getTime()-Date.now()>CA_MIN_REMAINING_MS)return{cert:t,key:n}}catch{}}o(readCaPair,"readCaPair"),c(readCaPair,"readCaPair"),a(readCaPair,"readCaPair");function loadOrCreateCa(e,r){const t=caDir();fs.mkdirSync(t,{recursive:!0});const n=readCaPair(t,e);if(n)return n;for(const i of[CA_KEY_FILE,exports.CA_CERT_FILE])try{fs.unlinkSync(path.join(t,i))}catch{}const m=r&&r!==t?readCaPair(r,e):void 0,s=m??mintCa(e);try{fs.writeFileSync(path.join(t,CA_KEY_FILE),e.pki.privateKeyToPem(s.key),{mode:384,flag:"wx"})}catch(i){if(i.code!=="EEXIST")throw i;const u=spinReadCaPair(t,e);if(u)return u;throw new Error(`machine dev CA at ${t} is claimed but unreadable \u2014 remove the directory and retry`,{cause:i})}return fs.writeFileSync(path.join(t,exports.CA_CERT_FILE),e.pki.certificateToPem(s.cert)),m&&console.log(`[ssl] promoted the existing workspace dev CA to the machine store (${t}) \u2014 keychain trust carries over.`),s}o(loadOrCreateCa,"loadOrCreateCa"),c(loadOrCreateCa,"loadOrCreateCa"),a(loadOrCreateCa,"loadOrCreateCa");function spinReadCaPair(e,r){const t=Date.now()+2e3;for(;;){const n=readCaPair(e,r);if(n||Date.now()>=t)return n;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,25)}}o(spinReadCaPair,"spinReadCaPair"),c(spinReadCaPair,"spinReadCaPair"),a(spinReadCaPair,"spinReadCaPair");function mintCa(e){const r=e.pki.rsa.generateKeyPair(2048),t=e.pki.createCertificate();t.publicKey=r.publicKey,t.serialNumber=`00${Date.now().toString(16)}`,t.validity.notBefore=new Date(Date.now()-1440*60*1e3),t.validity.notAfter=new Date,t.validity.notAfter.setDate(t.validity.notAfter.getDate()+CA_TTL_DAYS);const n=[{name:"commonName",value:"lensmcp local dev CA"},{name:"organizationName",value:"lensmcp"},{shortName:"OU",value:"dev"}];return t.setSubject(n),t.setIssuer(n),t.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,cRLSign:!0,critical:!0},{name:"subjectKeyIdentifier"}]),t.sign(r.privateKey,e.md.sha256.create()),{cert:t,key:r.privateKey}}o(mintCa,"mintCa"),c(mintCa,"mintCa"),a(mintCa,"mintCa");function createLeafCertificate(e,r,t,n,m=30){const s=e.pki.rsa.generateKeyPair(2048),i=e.pki.createCertificate();i.publicKey=s.publicKey,i.serialNumber=`00${Date.now().toString(16)}`,i.validity.notBefore=new Date(Date.now()-1440*60*1e3),i.validity.notAfter=new Date,i.validity.notAfter.setDate(i.validity.notAfter.getDate()+m),i.setSubject([{name:"commonName",value:t},{name:"organizationName",value:"lensmcp"},{shortName:"OU",value:"dev"}]),i.setIssuer(r.cert.subject.attributes);const u=[{type:2,value:"localhost"},{type:2,value:"*.localhost"},{type:7,ip:"127.0.0.1"},{type:7,ip:"::1"},...[...new Set(n)].filter(y=>y&&y!=="localhost").map(y=>({type:2,value:y}))];return i.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0,critical:!0},{name:"extKeyUsage",serverAuth:!0,clientAuth:!0},{name:"subjectAltName",altNames:u},{name:"subjectKeyIdentifier"}]),i.sign(r.key,e.md.sha256.create()),e.pki.privateKeyToPem(s.privateKey)+e.pki.certificateToPem(i)+e.pki.certificateToPem(r.cert)}o(createLeafCertificate,"createLeafCertificate"),c(createLeafCertificate,"createLeafCertificate"),a(createLeafCertificate,"createLeafCertificate");
+"use strict";var f=Object.defineProperty;var c=(e,r)=>f(e,"name",{value:r,configurable:!0});var p=Object.defineProperty,a=c((e,r)=>p(e,"name",{value:r,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0}),exports.CA_CERT_FILE=void 0,exports.caDir=caDir,exports.caCertPath=caCertPath,exports.getCertificateSync=getCertificateSync,exports.ensureCaSync=ensureCaSync;const tslib_1=require("tslib"),crypto=tslib_1.__importStar(require("node:crypto")),fs=tslib_1.__importStar(require("node:fs")),os=tslib_1.__importStar(require("node:os")),path=tslib_1.__importStar(require("node:path")),LEAF_MAX_AGE_MS=600*60*60*1e3,CA_TTL_DAYS=3650,CA_MIN_REMAINING_MS=720*60*60*1e3;exports.CA_CERT_FILE="lensmcp-local-ca.crt";const LEGACY_CA_CERT_FILE="davnx-local-ca.crt",CA_KEY_FILE="_ca-key.pem";function caDir(){const e=process.env.LENSMCP_HOME||os.homedir();return path.join(e,".lensmcp","ca")}c(caDir,"caDir"),a(caDir,"caDir");function caCertPath(){return path.join(caDir(),exports.CA_CERT_FILE)}c(caCertPath,"caCertPath"),a(caCertPath,"caCertPath");function getCertificateSync(e,r="lensmcp.dev",t=[]){const n=require("node-forge");fs.mkdirSync(e,{recursive:!0});const l=loadOrCreateCa(n,e),o=n.pki.certificateToPem(l.cert),i=crypto.createHash("sha256").update([r,...[...t].sort()].join("|")).digest("hex").slice(0,12),s=path.join(e,`_leaf-${i}.pem`);try{const u=fs.statSync(s);if(Date.now()-u.ctimeMs<LEAF_MAX_AGE_MS){const m=fs.readFileSync(s,"utf8");if(m.includes(o))return m}}catch{}const y=createLeafCertificate(n,l,r,t);fs.writeFileSync(s,y);for(const u of fs.readdirSync(e))if(/^_leaf-.*\.pem$/.test(u)&&u!==`_leaf-${i}.pem`||/^_cert.*\.pem$/.test(u)||/-dev\.crt$/.test(u)||u===LEGACY_CA_CERT_FILE)try{fs.unlinkSync(path.join(e,u))}catch{}return y}c(getCertificateSync,"getCertificateSync"),a(getCertificateSync,"getCertificateSync");function ensureCaSync(e){const r=require("node-forge");return loadOrCreateCa(r,e),caCertPath()}c(ensureCaSync,"ensureCaSync"),a(ensureCaSync,"ensureCaSync");function readCaPair(e,r){try{const t=r.pki.certificateFromPem(fs.readFileSync(path.join(e,exports.CA_CERT_FILE),"utf8")),n=r.pki.privateKeyFromPem(fs.readFileSync(path.join(e,CA_KEY_FILE),"utf8"));if(t.validity.notAfter.getTime()-Date.now()>CA_MIN_REMAINING_MS)return{cert:t,key:n}}catch{}}c(readCaPair,"readCaPair"),a(readCaPair,"readCaPair");function loadOrCreateCa(e,r){const t=caDir();fs.mkdirSync(t,{recursive:!0});const n=readCaPair(t,e);if(n)return n;for(const i of[CA_KEY_FILE,exports.CA_CERT_FILE])try{fs.unlinkSync(path.join(t,i))}catch{}const l=r&&r!==t?readCaPair(r,e):void 0,o=l??mintCa(e);try{fs.writeFileSync(path.join(t,CA_KEY_FILE),e.pki.privateKeyToPem(o.key),{mode:384,flag:"wx"})}catch(i){if(i.code!=="EEXIST")throw i;const s=spinReadCaPair(t,e);if(s)return s;throw new Error(`machine dev CA at ${t} is claimed but unreadable \u2014 remove the directory and retry`,{cause:i})}return fs.writeFileSync(path.join(t,exports.CA_CERT_FILE),e.pki.certificateToPem(o.cert)),l&&console.log(`[ssl] promoted the existing workspace dev CA to the machine store (${t}) \u2014 keychain trust carries over.`),o}c(loadOrCreateCa,"loadOrCreateCa"),a(loadOrCreateCa,"loadOrCreateCa");function spinReadCaPair(e,r){const t=Date.now()+2e3;for(;;){const n=readCaPair(e,r);if(n||Date.now()>=t)return n;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,25)}}c(spinReadCaPair,"spinReadCaPair"),a(spinReadCaPair,"spinReadCaPair");function mintCa(e){const r=e.pki.rsa.generateKeyPair(2048),t=e.pki.createCertificate();t.publicKey=r.publicKey,t.serialNumber=`00${Date.now().toString(16)}`,t.validity.notBefore=new Date(Date.now()-1440*60*1e3),t.validity.notAfter=new Date,t.validity.notAfter.setDate(t.validity.notAfter.getDate()+CA_TTL_DAYS);const n=[{name:"commonName",value:"lensmcp local dev CA"},{name:"organizationName",value:"lensmcp"},{shortName:"OU",value:"dev"}];return t.setSubject(n),t.setIssuer(n),t.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,cRLSign:!0,critical:!0},{name:"subjectKeyIdentifier"}]),t.sign(r.privateKey,e.md.sha256.create()),{cert:t,key:r.privateKey}}c(mintCa,"mintCa"),a(mintCa,"mintCa");function createLeafCertificate(e,r,t,n,l=30){const o=e.pki.rsa.generateKeyPair(2048),i=e.pki.createCertificate();i.publicKey=o.publicKey,i.serialNumber=`00${Date.now().toString(16)}`,i.validity.notBefore=new Date(Date.now()-1440*60*1e3),i.validity.notAfter=new Date,i.validity.notAfter.setDate(i.validity.notAfter.getDate()+l),i.setSubject([{name:"commonName",value:t},{name:"organizationName",value:"lensmcp"},{shortName:"OU",value:"dev"}]),i.setIssuer(r.cert.subject.attributes);const s=[{type:2,value:"localhost"},{type:2,value:"*.localhost"},{type:7,ip:"127.0.0.1"},{type:7,ip:"::1"},...[...new Set(n)].filter(y=>y&&y!=="localhost").map(y=>({type:2,value:y}))];return i.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0,critical:!0},{name:"extKeyUsage",serverAuth:!0,clientAuth:!0},{name:"subjectAltName",altNames:s},{name:"subjectKeyIdentifier"}]),i.sign(r.key,e.md.sha256.create()),e.pki.privateKeyToPem(o.privateKey)+e.pki.certificateToPem(i)+e.pki.certificateToPem(r.cert)}c(createLeafCertificate,"createLeafCertificate"),a(createLeafCertificate,"createLeafCertificate");

package/build-scope-patterns.js

@@ -1 +1 @@
-"use strict";var $=Object.defineProperty;var f=(s,e)=>$(s,"name",{value:e,configurable:!0});var l=Object.defineProperty,i=f((s,e)=>l(s,"name",{value:e,configurable:!0}),"i"),a=Object.defineProperty,u=i((s,e)=>a(s,"name",{value:e,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.buildScopePatterns=buildScopePatterns;function buildScopePatterns(s){const e=[],c=[],p=[];for(const t of s){if(!t)continue;const o=t.match(/^\/(.+)\/([gimsuy]*)$/);if(o){const n=o[2].replace("g",""),r=new RegExp(o[1],n);e.push(r),p.push(r)}else if(t.includes("/")){const n=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");e.push(new RegExp(`^${n}`)),c.push(t)}else if(t.startsWith("@")){const n=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");e.push(new RegExp(`^${n}/`)),c.push(t.endsWith("/")?t:`${t}/`)}else{const n=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),r=new RegExp(`^${n}(/|$)`);e.push(r),p.push(r)}}return{allowlistPatterns:e,scopePrefixes:c,scopePatterns:p}}f(buildScopePatterns,"buildScopePatterns"),i(buildScopePatterns,"buildScopePatterns"),u(buildScopePatterns,"buildScopePatterns");
+"use strict";var l=Object.defineProperty;var i=(n,s)=>l(n,"name",{value:s,configurable:!0});var a=Object.defineProperty,u=i((n,s)=>a(n,"name",{value:s,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.buildScopePatterns=buildScopePatterns;function buildScopePatterns(n){const s=[],p=[],r=[];for(const e of n){if(!e)continue;const o=e.match(/^\/(.+)\/([gimsuy]*)$/);if(o){const t=o[2].replace("g",""),c=new RegExp(o[1],t);s.push(c),r.push(c)}else if(e.includes("/")){const t=e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");s.push(new RegExp(`^${t}`)),p.push(e)}else if(e.startsWith("@")){const t=e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");s.push(new RegExp(`^${t}/`)),p.push(e.endsWith("/")?e:`${e}/`)}else{const t=e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),c=new RegExp(`^${t}(/|$)`);s.push(c),r.push(c)}}return{allowlistPatterns:s,scopePrefixes:p,scopePatterns:r}}i(buildScopePatterns,"buildScopePatterns"),u(buildScopePatterns,"buildScopePatterns");

package/create-webpack-dev.js

@@ -1 +1 @@
-"use strict";var M=Object.defineProperty;var d=(o,t)=>M(o,"name",{value:t,configurable:!0});var x=Object.defineProperty,u=d((o,t)=>x(o,"name",{value:t,configurable:!0}),"u"),T=Object.defineProperty,l=u((o,t)=>T(o,"name",{value:t,configurable:!0}),"l");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createDevWebpackConfig=createDevWebpackConfig;const tslib_1=require("tslib"),app_plugin_1=require("@nx/webpack/app-plugin"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path")),webpack_node_externals_1=tslib_1.__importDefault(require("webpack-node-externals")),build_scope_patterns_1=require("./build-scope-patterns"),tsgo_check_plugin_1=require("./tsgo-check-plugin"),webpack=require("webpack");class DevServerReloadPlugin{static{d(this,"DevServerReloadPlugin")}static{u(this,"DevServerReloadPlugin")}static{l(this,"DevServerReloadPlugin")}constructor(t,s=!1){this.secure=s,this.url=`${s?"https":"http"}://localhost:${t}/webpack/reload`}notify(){return new Promise((t,s)=>{const i=(this.secure?require("node:https"):require("node:http")).request(this.url,{method:"POST",headers:{"content-type":"application/json"},rejectUnauthorized:!1},a=>{a.resume(),a.on("end",t)});i.on("error",s),i.end("{}")})}apply(t){t.hooks.done.tap("DevServerReloadPlugin",async s=>{try{if(s.hasErrors())return;await this.notify(),console.log("[DevServerReloadPlugin] notified devserver to reload")}catch{console.log("[DevServerReloadPlugin] devserver not running yet")}})}}function createDevWebpackConfig(o){const{appRoot:t,outputDir:s,main:i,tsConfig:a,workspaceRoot:r,assets:_=[],port:P,memoryLimit:k=8192,buildLibsFromSource:S=!0,orgScopes:w=[],bundlePackages:C=[],additionalEntryPoints:y=[],nodeExternalsConfig:p,webpackConfigPath:h}=o,{allowlistPatterns:E,scopePrefixes:N,scopePatterns:D}=(0,build_scope_patterns_1.buildScopePatterns)(w),m=process.env.LENSMCP_TYPECHECK,g=m==="tsgo"?(0,tsgo_check_plugin_1.resolveTsgoBin)(r,process.env.LENSMCP_TSGO_BIN):null;if(m==="tsgo"&&!g){const e=`${tsgo_check_plugin_1.TSGO_MISSING_CAUSE}. Fell back to fork-ts-checker, which reports to the console only \u2014 so typecheck:// has no producer for this project until it is fixed`;console.warn(`[serve] ${o.appName}: LENSMCP_TYPECHECK=tsgo but ${e}.`),(0,tsgo_check_plugin_1.reportTsgoUnavailable)({appName:o.appName,tsConfig:a,workspaceRoot:r,detail:e})}const v=!!g,f=C.map(e=>new RegExp(`^${e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}(/|$)`)),q=[/webpack\/hot\/poll\?100/,...E,...f,...p?.allowlist||[]],b={output:{path:s,...process.env.NODE_ENV!=="production"&&{devtoolModuleFilenameTemplate:"[absolute-resource-path]"},clean:!0},externals:[(0,webpack_node_externals_1.default)({allowlist:q,additionalModuleDirs:p?.additionalModuleDirs||[],...p?.importType&&{importType:p.importType}}),({request:e},c)=>{if(e&&path.isAbsolute(e)&&e.startsWith(r)&&!e.includes("node_modules")||e&&(e.startsWith(path.join(r,"apps"))||e.startsWith(path.join(r,"libs")))||e&&N.some(n=>e.startsWith(n))||e&&D.some(n=>n.test(e))||e&&f.some(n=>n.test(e)))return c();if(e&&!(e.startsWith("./")||e.startsWith(".."))){const n=e.startsWith("@")?e.split("/").slice(0,2).join("/"):e.split("/")[0];return fs.existsSync(path.join(r,"node_modules",n))?c(null,`commonjs ${e}`):c()}return c()}],mode:"development",devtool:"eval-cheap-module-source-map",plugins:[new webpack.HotModuleReplacementPlugin,new app_plugin_1.NxAppWebpackPlugin({target:"node22",compiler:"tsc",main:i,additionalEntryPoints:y,verbose:!0,sourceMap:"eval-cheap-module-source-map",mergeExternals:!0,externalDependencies:[],memoryLimit:k,tsConfig:a,assets:_,optimization:!1,progress:!1,outputHashing:"none",generatePackageJson:!1,watchDependencies:!0,typeCheckOptions:process.env.LENSMCP_TYPECHECK==="off"||v?!1:{async:!0},buildLibsFromSource:S}),new DevServerReloadPlugin(P,o.httpsReload===!0),...v?[new tsgo_check_plugin_1.TsgoCheckPlugin({appName:o.appName,tsConfig:a,workspaceRoot:r,...process.env.LENSMCP_TSGO_BIN?{binPath:process.env.LENSMCP_TSGO_BIN}:{}})]:[]],snapshot:{managedPaths:[/^(.+?[\\/])?node_modules[\\/]/]},watch:!0,watchOptions:{ignored:["**/*.env.template","**/config.template.json","**/*.md","**/dist/**","**/migrations/**"]},cache:{type:"filesystem"}};if(h){const e=require(path.resolve(t,h));return(e.default||e)(b)}return b}d(createDevWebpackConfig,"createDevWebpackConfig"),u(createDevWebpackConfig,"createDevWebpackConfig"),l(createDevWebpackConfig,"createDevWebpackConfig");
+"use strict";var x=Object.defineProperty;var u=(o,t)=>x(o,"name",{value:t,configurable:!0});var T=Object.defineProperty,l=u((o,t)=>T(o,"name",{value:t,configurable:!0}),"l");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createDevWebpackConfig=createDevWebpackConfig;const tslib_1=require("tslib"),app_plugin_1=require("@nx/webpack/app-plugin"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path")),webpack_node_externals_1=tslib_1.__importDefault(require("webpack-node-externals")),build_scope_patterns_1=require("./build-scope-patterns"),tsgo_check_plugin_1=require("./tsgo-check-plugin"),webpack=require("webpack");class DevServerReloadPlugin{static{u(this,"DevServerReloadPlugin")}static{l(this,"DevServerReloadPlugin")}constructor(t,s=!1){this.secure=s,this.url=`${s?"https":"http"}://localhost:${t}/webpack/reload`}notify(){return new Promise((t,s)=>{const i=(this.secure?require("node:https"):require("node:http")).request(this.url,{method:"POST",headers:{"content-type":"application/json"},rejectUnauthorized:!1},a=>{a.resume(),a.on("end",t)});i.on("error",s),i.end("{}")})}apply(t){t.hooks.done.tap("DevServerReloadPlugin",async s=>{try{if(s.hasErrors())return;await this.notify(),console.log("[DevServerReloadPlugin] notified devserver to reload")}catch{console.log("[DevServerReloadPlugin] devserver not running yet")}})}}function createDevWebpackConfig(o){const{appRoot:t,outputDir:s,main:i,tsConfig:a,workspaceRoot:r,assets:f=[],port:b,memoryLimit:P=8192,buildLibsFromSource:k=!0,orgScopes:w=[],bundlePackages:S=[],additionalEntryPoints:C=[],nodeExternalsConfig:p,webpackConfigPath:d}=o,{allowlistPatterns:y,scopePrefixes:E,scopePatterns:N}=(0,build_scope_patterns_1.buildScopePatterns)(w),h=process.env.LENSMCP_TYPECHECK,m=h==="tsgo"?(0,tsgo_check_plugin_1.resolveTsgoBin)(r,process.env.LENSMCP_TSGO_BIN):null;if(h==="tsgo"&&!m){const e=`${tsgo_check_plugin_1.TSGO_MISSING_CAUSE}. Fell back to fork-ts-checker, which reports to the console only \u2014 so typecheck:// has no producer for this project until it is fixed`;console.warn(`[serve] ${o.appName}: LENSMCP_TYPECHECK=tsgo but ${e}.`),(0,tsgo_check_plugin_1.reportTsgoUnavailable)({appName:o.appName,tsConfig:a,workspaceRoot:r,detail:e})}const g=!!m,v=S.map(e=>new RegExp(`^${e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}(/|$)`)),D=[/webpack\/hot\/poll\?100/,...y,...v,...p?.allowlist||[]],_={output:{path:s,...process.env.NODE_ENV!=="production"&&{devtoolModuleFilenameTemplate:"[absolute-resource-path]"},clean:!0},externals:[(0,webpack_node_externals_1.default)({allowlist:D,additionalModuleDirs:p?.additionalModuleDirs||[],...p?.importType&&{importType:p.importType}}),({request:e},c)=>{if(e&&path.isAbsolute(e)&&e.startsWith(r)&&!e.includes("node_modules")||e&&(e.startsWith(path.join(r,"apps"))||e.startsWith(path.join(r,"libs")))||e&&E.some(n=>e.startsWith(n))||e&&N.some(n=>n.test(e))||e&&v.some(n=>n.test(e)))return c();if(e&&!(e.startsWith("./")||e.startsWith(".."))){const n=e.startsWith("@")?e.split("/").slice(0,2).join("/"):e.split("/")[0];return fs.existsSync(path.join(r,"node_modules",n))?c(null,`commonjs ${e}`):c()}return c()}],mode:"development",devtool:"eval-cheap-module-source-map",plugins:[new webpack.HotModuleReplacementPlugin,new app_plugin_1.NxAppWebpackPlugin({target:"node22",compiler:"tsc",main:i,additionalEntryPoints:C,verbose:!0,sourceMap:"eval-cheap-module-source-map",mergeExternals:!0,externalDependencies:[],memoryLimit:P,tsConfig:a,assets:f,optimization:!1,progress:!1,outputHashing:"none",generatePackageJson:!1,watchDependencies:!0,typeCheckOptions:process.env.LENSMCP_TYPECHECK==="off"||g?!1:{async:!0},buildLibsFromSource:k}),new DevServerReloadPlugin(b,o.httpsReload===!0),...g?[new tsgo_check_plugin_1.TsgoCheckPlugin({appName:o.appName,tsConfig:a,workspaceRoot:r,...process.env.LENSMCP_TSGO_BIN?{binPath:process.env.LENSMCP_TSGO_BIN}:{}})]:[]],snapshot:{managedPaths:[/^(.+?[\\/])?node_modules[\\/]/]},watch:!0,watchOptions:{ignored:["**/*.env.template","**/config.template.json","**/*.md","**/dist/**","**/migrations/**"]},cache:{type:"filesystem"}};if(d){const e=require(path.resolve(t,d));return(e.default||e)(_)}return _}u(createDevWebpackConfig,"createDevWebpackConfig"),l(createDevWebpackConfig,"createDevWebpackConfig");

package/create-webpack-prod.js

@@ -1 +1 @@
-"use strict";var T=Object.defineProperty;var g=(o,t)=>T(o,"name",{value:t,configurable:!0});var A=Object.defineProperty,d=g((o,t)=>A(o,"name",{value:t,configurable:!0}),"d"),F=Object.defineProperty,m=d((o,t)=>F(o,"name",{value:t,configurable:!0}),"m");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createProdWebpackConfig=createProdWebpackConfig;const tslib_1=require("tslib"),app_plugin_1=require("@nx/webpack/app-plugin"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path")),glob_1=require("glob"),webpack_node_externals_1=tslib_1.__importDefault(require("webpack-node-externals")),build_scope_patterns_1=require("./build-scope-patterns");function createProdWebpackConfig(o){const{appRoot:t,outputDir:k,main:_,tsConfig:b,workspaceRoot:r,assets:x=[],additionalEntryPoints:C=[],runtimeDependencies:j=[],memoryLimit:f=8192,generatePackageJson:W=!0,buildLibsFromSource:h=!1,ormConfigPath:c,migrationsDir:v="./src/migrations",orgScopes:w=[],bundlePackages:S=[],nodeExternalsConfig:a,webpackConfigPath:y}=o,{allowlistPatterns:q,scopePrefixes:D,scopePatterns:E}=(0,build_scope_patterns_1.buildScopePatterns)(w),P=S.map(e=>new RegExp(`^${e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}(/|$)`)),L=[...q,...P,...a?.allowlist||[]];let s;if(c!==void 0)s=c?path.join(t,c):null;else{const e=path.join(t,"./src/ormconfig.ts");s=fs.existsSync(e)?e:null}const $=s&&fs.existsSync(s),p=[],u={externals:[(0,webpack_node_externals_1.default)({allowlist:L,additionalModuleDirs:a?.additionalModuleDirs||[],...a?.importType&&{importType:a.importType}}),({request:e},i)=>{if(e&&path.isAbsolute(e)&&e.startsWith(r)&&!e.includes("node_modules")||e&&(e.startsWith(path.join(r,"apps"))||e.startsWith(path.join(r,"libs")))||e&&D.some(n=>e.startsWith(n))||e&&E.some(n=>n.test(e))||e&&P.some(n=>n.test(e)))return i();if(e&&!(e.startsWith("./")||e.startsWith(".."))){const n=e.startsWith("@")?e.split("/").slice(0,2).join("/"):e.split("/")[0];return fs.existsSync(path.join(r,"node_modules",n))?i(null,`commonjs ${e}`):i()}return i()}],output:{path:k,clean:!1},devtool:"inline-source-map",mode:"production",plugins:[new app_plugin_1.NxAppWebpackPlugin({target:"node22",compiler:"tsc",main:_,additionalEntryPoints:C,externalDependencies:[],mergeExternals:!0,memoryLimit:f,tsConfig:b,assets:x,namedChunks:!0,optimization:!0,outputHashing:"none",generatePackageJson:W,runtimeDependencies:j,buildLibsFromSource:h,typeCheckOptions:{async:!1},sourceMap:"inline-source-map",progress:!1})]};if(p.push(u),$&&s){const e=[],i=path.join(t,v,"*.ts");(0,glob_1.globSync)(i).forEach(l=>{const O=path.basename(l,".ts");e.push({entryName:`migrations/${O}`,entryPath:l})});const n="./"+path.relative(t,s),M={...u,output:{...u.output,filename:m(l=>l.runtime==="main"?"ormconfig.js":"[name].js","filename"),library:{type:"commonjs"},clean:!1},devtool:!1,plugins:[new app_plugin_1.NxAppWebpackPlugin({target:"node22",compiler:"tsc",main:n,externalDependencies:[],additionalEntryPoints:e,mergeExternals:!0,tsConfig:b,assets:[],namedChunks:!0,memoryLimit:f,optimization:!1,outputHashing:"none",generatePackageJson:!1,buildLibsFromSource:h,skipTypeChecking:!0,sourceMap:!1,progress:!process.env.CI})]};p.push(M)}if(y){const e=require(path.resolve(t,y)),i=e.default||e;return p.map(n=>i(n))}return p}g(createProdWebpackConfig,"createProdWebpackConfig"),d(createProdWebpackConfig,"createProdWebpackConfig"),m(createProdWebpackConfig,"createProdWebpackConfig");
+"use strict";var A=Object.defineProperty;var d=(o,n)=>A(o,"name",{value:n,configurable:!0});var F=Object.defineProperty,m=d((o,n)=>F(o,"name",{value:n,configurable:!0}),"m");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createProdWebpackConfig=createProdWebpackConfig;const tslib_1=require("tslib"),app_plugin_1=require("@nx/webpack/app-plugin"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path")),glob_1=require("glob"),webpack_node_externals_1=tslib_1.__importDefault(require("webpack-node-externals")),build_scope_patterns_1=require("./build-scope-patterns");function createProdWebpackConfig(o){const{appRoot:n,outputDir:P,main:_,tsConfig:g,workspaceRoot:r,assets:k=[],additionalEntryPoints:x=[],runtimeDependencies:C=[],memoryLimit:b=8192,generatePackageJson:j=!0,buildLibsFromSource:f=!1,ormConfigPath:c,migrationsDir:W="./src/migrations",orgScopes:w=[],bundlePackages:S=[],nodeExternalsConfig:a,webpackConfigPath:h}=o,{allowlistPatterns:v,scopePrefixes:D,scopePatterns:q}=(0,build_scope_patterns_1.buildScopePatterns)(w),y=S.map(e=>new RegExp(`^${e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}(/|$)`)),E=[...v,...y,...a?.allowlist||[]];let s;if(c!==void 0)s=c?path.join(n,c):null;else{const e=path.join(n,"./src/ormconfig.ts");s=fs.existsSync(e)?e:null}const $=s&&fs.existsSync(s),p=[],u={externals:[(0,webpack_node_externals_1.default)({allowlist:E,additionalModuleDirs:a?.additionalModuleDirs||[],...a?.importType&&{importType:a.importType}}),({request:e},i)=>{if(e&&path.isAbsolute(e)&&e.startsWith(r)&&!e.includes("node_modules")||e&&(e.startsWith(path.join(r,"apps"))||e.startsWith(path.join(r,"libs")))||e&&D.some(t=>e.startsWith(t))||e&&q.some(t=>t.test(e))||e&&y.some(t=>t.test(e)))return i();if(e&&!(e.startsWith("./")||e.startsWith(".."))){const t=e.startsWith("@")?e.split("/").slice(0,2).join("/"):e.split("/")[0];return fs.existsSync(path.join(r,"node_modules",t))?i(null,`commonjs ${e}`):i()}return i()}],output:{path:P,clean:!1},devtool:"inline-source-map",mode:"production",plugins:[new app_plugin_1.NxAppWebpackPlugin({target:"node22",compiler:"tsc",main:_,additionalEntryPoints:x,externalDependencies:[],mergeExternals:!0,memoryLimit:b,tsConfig:g,assets:k,namedChunks:!0,optimization:!0,outputHashing:"none",generatePackageJson:j,runtimeDependencies:C,buildLibsFromSource:f,typeCheckOptions:{async:!1},sourceMap:"inline-source-map",progress:!1})]};if(p.push(u),$&&s){const e=[],i=path.join(n,W,"*.ts");(0,glob_1.globSync)(i).forEach(l=>{const M=path.basename(l,".ts");e.push({entryName:`migrations/${M}`,entryPath:l})});const t="./"+path.relative(n,s),L={...u,output:{...u.output,filename:m(l=>l.runtime==="main"?"ormconfig.js":"[name].js","filename"),library:{type:"commonjs"},clean:!1},devtool:!1,plugins:[new app_plugin_1.NxAppWebpackPlugin({target:"node22",compiler:"tsc",main:t,externalDependencies:[],additionalEntryPoints:e,mergeExternals:!0,tsConfig:g,assets:[],namedChunks:!0,memoryLimit:b,optimization:!1,outputHashing:"none",generatePackageJson:!1,buildLibsFromSource:f,skipTypeChecking:!0,sourceMap:!1,progress:!process.env.CI})]};p.push(L)}if(h){const e=require(path.resolve(n,h)),i=e.default||e;return p.map(t=>i(t))}return p}d(createProdWebpackConfig,"createProdWebpackConfig"),m(createProdWebpackConfig,"createProdWebpackConfig");

package/executors/build/build.impl.js

@@ -1 +1 @@
-"use strict";var S=Object.defineProperty;var m=(e,o)=>S(e,"name",{value:o,configurable:!0});var x=Object.defineProperty,d=m((e,o)=>x(e,"name",{value:o,configurable:!0}),"d"),_=Object.defineProperty,p=d((e,o)=>_(e,"name",{value:o,configurable:!0}),"p");Object.defineProperty(exports,"__esModule",{value:!0});const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path")),create_webpack_prod_1=require("../../create-webpack-prod"),webpack=require("webpack");async function*buildExecutor(e,o){process.env.NODE_ENV="production";const f=o.projectsConfigurations.projects[o.projectName],n=o.root,a=path.join(n,f.root),c=e.outputPath?path.join(n,e.outputPath):path.join(n,"dist",f.root),P=e.entryFile||"./src/deployments/service/main.ts",k=e.tsConfigFile||"./tsconfig.app.json",j=path.resolve(a,P),h=path.resolve(a,k),u=(0,create_webpack_prod_1.createProdWebpackConfig)({appName:o.projectName,appRoot:a,outputDir:c,main:j,tsConfig:h,assets:e.assets||[],additionalEntryPoints:[...(e.workers||[]).map(r=>({entryName:r.name,entryPath:r.entryPath})),...e.additionalEntryPoints||[]],runtimeDependencies:e.runtimeDependencies||[],memoryLimit:e.memoryLimit||8192,generatePackageJson:e.generatePackageJson!==!1,buildLibsFromSource:e.buildLibsFromSource||!1,ormConfigPath:e.ormConfigPath,migrationsDir:e.migrationsDir||"./src/migrations",workspaceRoot:n,orgScopes:e.orgScopes||[],bundlePackages:e.bundlePackages||[],nodeExternalsConfig:e.nodeExternalsConfig,webpackConfigPath:e.webpackConfigPath}),w=Array.isArray(u)?u:[u];for(const r of w){const{watch:l,...t}=r,s=webpack(t),i=await new Promise((v,C)=>{s.run((g,E)=>{if(g)return C(g);s.close(y=>{y&&console.error("[build] webpack close error:",y)}),v(E)})});if(console.info(i.toString(r.stats||{colors:!0,chunks:!1})),i.hasErrors()){yield{success:!1};return}}const b=e.workers||[];if(b.length>0){const{minify:r}=require("terser");for(const l of b){const t=path.join(c,`${l.name}.js`);if(fs.existsSync(t)){const s=fs.readFileSync(t,"utf-8"),i=await r(s,{keep_classnames:!0,sourceMap:{content:"inline",url:"inline"}});i.code&&(fs.writeFileSync(t,i.code),console.info(`[build] minified ${l.name}.js`))}}}yield{success:!0,outfile:path.join(c,"main.js")}}m(buildExecutor,"buildExecutor"),d(buildExecutor,"buildExecutor"),p(buildExecutor,"buildExecutor"),exports.default=buildExecutor,module.exports=buildExecutor,module.exports.default=buildExecutor;
+"use strict";var x=Object.defineProperty;var d=(e,o)=>x(e,"name",{value:o,configurable:!0});var _=Object.defineProperty,p=d((e,o)=>_(e,"name",{value:o,configurable:!0}),"p");Object.defineProperty(exports,"__esModule",{value:!0});const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path")),create_webpack_prod_1=require("../../create-webpack-prod"),webpack=require("webpack");async function*buildExecutor(e,o){process.env.NODE_ENV="production";const m=o.projectsConfigurations.projects[o.projectName],n=o.root,a=path.join(n,m.root),c=e.outputPath?path.join(n,e.outputPath):path.join(n,"dist",m.root),y=e.entryFile||"./src/deployments/service/main.ts",P=e.tsConfigFile||"./tsconfig.app.json",k=path.resolve(a,y),h=path.resolve(a,P),u=(0,create_webpack_prod_1.createProdWebpackConfig)({appName:o.projectName,appRoot:a,outputDir:c,main:k,tsConfig:h,assets:e.assets||[],additionalEntryPoints:[...(e.workers||[]).map(r=>({entryName:r.name,entryPath:r.entryPath})),...e.additionalEntryPoints||[]],runtimeDependencies:e.runtimeDependencies||[],memoryLimit:e.memoryLimit||8192,generatePackageJson:e.generatePackageJson!==!1,buildLibsFromSource:e.buildLibsFromSource||!1,ormConfigPath:e.ormConfigPath,migrationsDir:e.migrationsDir||"./src/migrations",workspaceRoot:n,orgScopes:e.orgScopes||[],bundlePackages:e.bundlePackages||[],nodeExternalsConfig:e.nodeExternalsConfig,webpackConfigPath:e.webpackConfigPath}),j=Array.isArray(u)?u:[u];for(const r of j){const{watch:l,...t}=r,s=webpack(t),i=await new Promise((w,C)=>{s.run((b,S)=>{if(b)return C(b);s.close(g=>{g&&console.error("[build] webpack close error:",g)}),w(S)})});if(console.info(i.toString(r.stats||{colors:!0,chunks:!1})),i.hasErrors()){yield{success:!1};return}}const f=e.workers||[];if(f.length>0){const{minify:r}=require("terser");for(const l of f){const t=path.join(c,`${l.name}.js`);if(fs.existsSync(t)){const s=fs.readFileSync(t,"utf-8"),i=await r(s,{keep_classnames:!0,sourceMap:{content:"inline",url:"inline"}});i.code&&(fs.writeFileSync(t,i.code),console.info(`[build] minified ${l.name}.js`))}}}yield{success:!0,outfile:path.join(c,"main.js")}}d(buildExecutor,"buildExecutor"),p(buildExecutor,"buildExecutor"),exports.default=buildExecutor,module.exports=buildExecutor,module.exports.default=buildExecutor;

package/executors/gateway/gateway-errors.js

@@ -1 +1 @@
-"use strict";var y=Object.defineProperty;var o=(e,t)=>y(e,"name",{value:t,configurable:!0});var d=Object.defineProperty,n=o((e,t)=>d(e,"name",{value:t,configurable:!0}),"n"),s=Object.defineProperty,r=n((e,t)=>s(e,"name",{value:t,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.GATEWAY_ERROR_CONTENT_TYPE=exports.GATEWAY_ERROR_KEY=void 0,exports.ensureRequestId=ensureRequestId,exports.gatewayErrorBody=gatewayErrorBody,exports.GATEWAY_ERROR_KEY={bad_request:"gateway.badRequest",unauthorized:"gateway.unauthorized",forbidden:"gateway.forbidden",not_found:"gateway.notFound",rate_limited:"gateway.rateLimited",starting:"gateway.starting",unavailable:"gateway.unavailable",internal:"gateway.internal"};const headerValue=r(e=>typeof e=="string"&&e!==""?e:Array.isArray(e)?e[0]:void 0,"headerValue"),mintId=r(()=>Date.now().toString(36)+Math.random().toString(36).slice(2,12),"mintId");function ensureRequestId(e){const t=headerValue(e.headers["x-request-id"]);if(t)return t;const a=mintId();return e.headers["x-request-id"]=a,a}o(ensureRequestId,"ensureRequestId"),n(ensureRequestId,"ensureRequestId"),r(ensureRequestId,"ensureRequestId");function gatewayErrorBody(e,t,a,i,u){return JSON.stringify({...u??{},key:exports.GATEWAY_ERROR_KEY[t],status:e,traceId:a,...i?{message:i}:{}})}o(gatewayErrorBody,"gatewayErrorBody"),n(gatewayErrorBody,"gatewayErrorBody"),r(gatewayErrorBody,"gatewayErrorBody"),exports.GATEWAY_ERROR_CONTENT_TYPE="application/json; charset=utf-8";
+"use strict";var d=Object.defineProperty;var n=(e,t)=>d(e,"name",{value:t,configurable:!0});var s=Object.defineProperty,r=n((e,t)=>s(e,"name",{value:t,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.GATEWAY_ERROR_CONTENT_TYPE=exports.GATEWAY_ERROR_KEY=void 0,exports.ensureRequestId=ensureRequestId,exports.gatewayErrorBody=gatewayErrorBody,exports.GATEWAY_ERROR_KEY={bad_request:"gateway.badRequest",unauthorized:"gateway.unauthorized",forbidden:"gateway.forbidden",not_found:"gateway.notFound",rate_limited:"gateway.rateLimited",starting:"gateway.starting",unavailable:"gateway.unavailable",internal:"gateway.internal"};const headerValue=r(e=>typeof e=="string"&&e!==""?e:Array.isArray(e)?e[0]:void 0,"headerValue"),mintId=r(()=>Date.now().toString(36)+Math.random().toString(36).slice(2,12),"mintId");function ensureRequestId(e){const t=headerValue(e.headers["x-request-id"]);if(t)return t;const a=mintId();return e.headers["x-request-id"]=a,a}n(ensureRequestId,"ensureRequestId"),r(ensureRequestId,"ensureRequestId");function gatewayErrorBody(e,t,a,o,i){return JSON.stringify({...i??{},key:exports.GATEWAY_ERROR_KEY[t],status:e,traceId:a,...o?{message:o}:{}})}n(gatewayErrorBody,"gatewayErrorBody"),r(gatewayErrorBody,"gatewayErrorBody"),exports.GATEWAY_ERROR_CONTENT_TYPE="application/json; charset=utf-8";

package/executors/gateway/gateway.impl.js

@@ -1 +1 @@
-"use strict";var y=Object.defineProperty;var c=(t,r)=>y(t,"name",{value:r,configurable:!0});var p=Object.defineProperty,a=c((t,r)=>p(t,"name",{value:r,configurable:!0}),"a"),u=Object.defineProperty,o=a((t,r)=>u(t,"name",{value:r,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.default=gatewayExecutor;const devkit_1=require("@nx/devkit"),gateway_lib_1=require("./gateway.lib"),server_1=require("./runtime/server");async function gatewayExecutor(t,r){process.on("uncaughtException",e=>{if((e.syscall==="read"||e.syscall==="write")&&server_1.BENIGN_SOCKET_ERRNOS.has(e.code??"")){console.warn(`[gateway] survived a stray socket ${e.syscall} error (${e.code}) \u2014 one connection dropped, the daemon lives`);return}console.error(e),process.exit(1)});let n;try{let e;try{const s=await(0,devkit_1.createProjectGraphAsync)();e=Object.fromEntries(Object.entries(s.dependencies).map(([i,l])=>[i,l.map(d=>d.target)]))}catch{}n=await(0,gateway_lib_1.startGateway)(t,{...r,...e?{projectDependencies:e}:{}})}catch(e){return console.error(e.message),{success:!1}}return new Promise(e=>{const s=o(()=>{n.stop().then(()=>e({success:!0}))},"stop");process.on("SIGINT",s),process.on("SIGTERM",s)})}c(gatewayExecutor,"gatewayExecutor"),a(gatewayExecutor,"gatewayExecutor"),o(gatewayExecutor,"gatewayExecutor"),module.exports=gatewayExecutor,module.exports.default=gatewayExecutor,module.exports.startGateway=gateway_lib_1.startGateway;
+"use strict";var p=Object.defineProperty;var a=(t,r)=>p(t,"name",{value:r,configurable:!0});var u=Object.defineProperty,o=a((t,r)=>u(t,"name",{value:r,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.default=gatewayExecutor;const devkit_1=require("@nx/devkit"),gateway_lib_1=require("./gateway.lib"),server_1=require("./runtime/server");async function gatewayExecutor(t,r){process.on("uncaughtException",e=>{if((e.syscall==="read"||e.syscall==="write")&&server_1.BENIGN_SOCKET_ERRNOS.has(e.code??"")){console.warn(`[gateway] survived a stray socket ${e.syscall} error (${e.code}) \u2014 one connection dropped, the daemon lives`);return}console.error(e),process.exit(1)});let c;try{let e;try{const s=await(0,devkit_1.createProjectGraphAsync)();e=Object.fromEntries(Object.entries(s.dependencies).map(([n,i])=>[n,i.map(l=>l.target)]))}catch{}c=await(0,gateway_lib_1.startGateway)(t,{...r,...e?{projectDependencies:e}:{}})}catch(e){return console.error(e.message),{success:!1}}return new Promise(e=>{const s=o(()=>{c.stop().then(()=>e({success:!0}))},"stop");process.on("SIGINT",s),process.on("SIGTERM",s)})}a(gatewayExecutor,"gatewayExecutor"),o(gatewayExecutor,"gatewayExecutor"),module.exports=gatewayExecutor,module.exports.default=gatewayExecutor,module.exports.startGateway=gateway_lib_1.startGateway;

package/executors/gateway/gateway.lib.js

@@ -1 +1 @@
-"use strict";var c=Object.defineProperty;var i=(t,r)=>c(t,"name",{value:r,configurable:!0});var s=Object.defineProperty,n=i((t,r)=>s(t,"name",{value:r,configurable:!0}),"n"),o=Object.defineProperty,e=n((t,r)=>o(t,"name",{value:r,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.projectSourceRoots=exports.discoverRoutes=exports.pickSock=exports.readLensScope=exports.deriveMcpHttpPort=exports.baseDomainOf=exports.stampIdentity=exports.verifyDevJwt=exports.startGateway=exports.hostMatches=void 0;var manifest_1=require("./manifest");Object.defineProperty(exports,"hostMatches",{enumerable:!0,get:e(function(){return manifest_1.hostMatches},"get")});var server_1=require("./runtime/server");Object.defineProperty(exports,"startGateway",{enumerable:!0,get:e(function(){return server_1.startGateway},"get")});var dev_auth_1=require("./runtime/dev-auth");Object.defineProperty(exports,"verifyDevJwt",{enumerable:!0,get:e(function(){return dev_auth_1.verifyDevJwt},"get")}),Object.defineProperty(exports,"stampIdentity",{enumerable:!0,get:e(function(){return dev_auth_1.stampIdentity},"get")});var scope_1=require("./runtime/scope");Object.defineProperty(exports,"baseDomainOf",{enumerable:!0,get:e(function(){return scope_1.baseDomainOf},"get")}),Object.defineProperty(exports,"deriveMcpHttpPort",{enumerable:!0,get:e(function(){return scope_1.deriveMcpHttpPort},"get")}),Object.defineProperty(exports,"readLensScope",{enumerable:!0,get:e(function(){return scope_1.readLensScope},"get")});var discovery_1=require("./runtime/discovery");Object.defineProperty(exports,"pickSock",{enumerable:!0,get:e(function(){return discovery_1.pickSock},"get")}),Object.defineProperty(exports,"discoverRoutes",{enumerable:!0,get:e(function(){return discovery_1.discoverRoutes},"get")}),Object.defineProperty(exports,"projectSourceRoots",{enumerable:!0,get:e(function(){return discovery_1.projectSourceRoots},"get")});
+"use strict";var s=Object.defineProperty;var n=(t,r)=>s(t,"name",{value:r,configurable:!0});var o=Object.defineProperty,e=n((t,r)=>o(t,"name",{value:r,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.projectSourceRoots=exports.discoverRoutes=exports.pickSock=exports.readLensScope=exports.deriveMcpHttpPort=exports.baseDomainOf=exports.stampIdentity=exports.verifyDevJwt=exports.startGateway=exports.hostMatches=void 0;var manifest_1=require("./manifest");Object.defineProperty(exports,"hostMatches",{enumerable:!0,get:e(function(){return manifest_1.hostMatches},"get")});var server_1=require("./runtime/server");Object.defineProperty(exports,"startGateway",{enumerable:!0,get:e(function(){return server_1.startGateway},"get")});var dev_auth_1=require("./runtime/dev-auth");Object.defineProperty(exports,"verifyDevJwt",{enumerable:!0,get:e(function(){return dev_auth_1.verifyDevJwt},"get")}),Object.defineProperty(exports,"stampIdentity",{enumerable:!0,get:e(function(){return dev_auth_1.stampIdentity},"get")});var scope_1=require("./runtime/scope");Object.defineProperty(exports,"baseDomainOf",{enumerable:!0,get:e(function(){return scope_1.baseDomainOf},"get")}),Object.defineProperty(exports,"deriveMcpHttpPort",{enumerable:!0,get:e(function(){return scope_1.deriveMcpHttpPort},"get")}),Object.defineProperty(exports,"readLensScope",{enumerable:!0,get:e(function(){return scope_1.readLensScope},"get")});var discovery_1=require("./runtime/discovery");Object.defineProperty(exports,"pickSock",{enumerable:!0,get:e(function(){return discovery_1.pickSock},"get")}),Object.defineProperty(exports,"discoverRoutes",{enumerable:!0,get:e(function(){return discovery_1.discoverRoutes},"get")}),Object.defineProperty(exports,"projectSourceRoots",{enumerable:!0,get:e(function(){return discovery_1.projectSourceRoots},"get")});

package/executors/gateway/health-check.js

@@ -1 +1 @@
-"use strict";var H=Object.defineProperty;var i=(t,l)=>H(t,"name",{value:l,configurable:!0});var g=Object.defineProperty,c=i((t,l)=>g(t,"name",{value:l,configurable:!0}),"c"),C=Object.defineProperty,n=c((t,l)=>C(t,"name",{value:l,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHealthChecker=createHealthChecker;function createHealthChecker(t={}){const l=t.path??"/healthz",y=t.intervalMs??5e3,u=t.timeoutMs??2e3,p=Math.max(1,t.unhealthyThreshold??2),d=Math.max(1,t.healthyThreshold??1),k=t.fetchImpl??globalThis.fetch,s=new Map;let r;const m=n(a=>a.replace(/\/+$/,"")+(l.startsWith("/")?l:"/"+l),"probeUrl"),b=n(async a=>{const e=s.get(a);if(!e)return;let h=!1;const f=new AbortController,v=setTimeout(()=>f.abort(),u);try{h=(await k(m(a),{method:"GET",signal:f.signal,redirect:"manual"})).status<500}catch{}finally{clearTimeout(v)}e.lastCheckedAt=Date.now(),h?(e.oks+=1,e.fails=0,!e.healthy&&e.oks>=d&&(e.healthy=!0,t.onChange?.(a,!0))):(e.fails+=1,e.oks=0,e.healthy&&e.fails>=p&&(e.healthy=!1,t.onChange?.(a,!1)))},"probe"),o=n(()=>Promise.allSettled([...s.keys()].map(b)).then(()=>{}),"probeOnce");return{track(a){const e=new Set(a);for(const h of a)s.has(h)||s.set(h,{healthy:!0,fails:0,oks:0,lastCheckedAt:null});for(const h of[...s.keys()])e.has(h)||s.delete(h)},isHealthy:n(a=>s.get(a)?.healthy??!0,"isHealthy"),snapshot:n(()=>[...s.entries()].map(([a,e])=>({url:a,healthy:e.healthy,fails:e.fails,lastCheckedAt:e.lastCheckedAt})),"snapshot"),probeOnce:o,start(){r||(r=setInterval(()=>{o()},y),r.unref?.(),o())},stop(){r&&clearInterval(r),r=void 0}}}i(createHealthChecker,"createHealthChecker"),c(createHealthChecker,"createHealthChecker"),n(createHealthChecker,"createHealthChecker");
+"use strict";var g=Object.defineProperty;var c=(a,h)=>g(a,"name",{value:h,configurable:!0});var C=Object.defineProperty,n=c((a,h)=>C(a,"name",{value:h,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHealthChecker=createHealthChecker;function createHealthChecker(a={}){const h=a.path??"/healthz",f=a.intervalMs??5e3,y=a.timeoutMs??2e3,p=Math.max(1,a.unhealthyThreshold??2),u=Math.max(1,a.healthyThreshold??1),d=a.fetchImpl??globalThis.fetch,l=new Map;let r;const k=n(t=>t.replace(/\/+$/,"")+(h.startsWith("/")?h:"/"+h),"probeUrl"),m=n(async t=>{const e=l.get(t);if(!e)return;let s=!1;const i=new AbortController,b=setTimeout(()=>i.abort(),y);try{s=(await d(k(t),{method:"GET",signal:i.signal,redirect:"manual"})).status<500}catch{}finally{clearTimeout(b)}e.lastCheckedAt=Date.now(),s?(e.oks+=1,e.fails=0,!e.healthy&&e.oks>=u&&(e.healthy=!0,a.onChange?.(t,!0))):(e.fails+=1,e.oks=0,e.healthy&&e.fails>=p&&(e.healthy=!1,a.onChange?.(t,!1)))},"probe"),o=n(()=>Promise.allSettled([...l.keys()].map(m)).then(()=>{}),"probeOnce");return{track(t){const e=new Set(t);for(const s of t)l.has(s)||l.set(s,{healthy:!0,fails:0,oks:0,lastCheckedAt:null});for(const s of[...l.keys()])e.has(s)||l.delete(s)},isHealthy:n(t=>l.get(t)?.healthy??!0,"isHealthy"),snapshot:n(()=>[...l.entries()].map(([t,e])=>({url:t,healthy:e.healthy,fails:e.fails,lastCheckedAt:e.lastCheckedAt})),"snapshot"),probeOnce:o,start(){r||(r=setInterval(()=>{o()},f),r.unref?.(),o())},stop(){r&&clearInterval(r),r=void 0}}}c(createHealthChecker,"createHealthChecker"),n(createHealthChecker,"createHealthChecker");

package/executors/gateway/jwks-verify.js

@@ -1 +1 @@
-"use strict";var O=Object.defineProperty;var d=(e,i)=>O(e,"name",{value:i,configurable:!0});var J=Object.defineProperty,h=d((e,i)=>J(e,"name",{value:i,configurable:!0}),"h"),v=Object.defineProperty,c=h((e,i)=>v(e,"name",{value:i,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createJwksVerifier=createJwksVerifier;const node_crypto_1=require("node:crypto"),ALG_TO_HASH={RS256:"sha256",RS384:"sha384",RS512:"sha512"},b64urlJsonSafe=c(e=>JSON.parse(Buffer.from(e,"base64url").toString("utf8")),"b64urlJsonSafe");function createJwksVerifier(e){const i=(e.algorithms??["RS256"]).filter(r=>r in ALG_TO_HASH),_=e.cacheMaxAgeMs??6e5,m=e.missRefreshMs??3e4,p=e.clockToleranceSec??60,S=e.fetchImpl??globalThis.fetch,b=e.audience===void 0?void 0:Array.isArray(e.audience)?e.audience:[e.audience];let o=new Map,f,w=0;const A=c(async()=>{const r=await S(e.jwksUrl,{headers:{accept:"application/json"}});if(!r.ok)throw new Error(`JWKS ${e.jwksUrl} \u2192 HTTP ${r.status}`);const a=await r.json(),s=new Map;for(const t of a.keys??[])if(!(t.kty!=="RSA"||!t.n||!t.e)&&!(t.use&&t.use!=="sig"))try{const u=(0,node_crypto_1.createPublicKey)({key:t,format:"jwk"});s.set(t.kid??"__single__",u)}catch{}s.size>0&&(o=s)},"load"),l=c(()=>(f||(f=A().finally(()=>{f=void 0})),f),"refresh"),j=c(r=>{r-w<m||(w=r,l().catch(()=>{}))},"refreshOnMiss"),g=setInterval(()=>{l().catch(()=>{})},_);return g.unref?.(),{verify:c(r=>{const a=r.split(".");if(a.length!==3)return;let s;try{s=b64urlJsonSafe(a[0])}catch{return}if(!s.alg||!i.includes(s.alg))return;const t=o.get(s.kid??"__single__")??(o.size===1?[...o.values()][0]:void 0);if(!t){j(Date.now());return}let u;try{u=(0,node_crypto_1.verify)(ALG_TO_HASH[s.alg],Buffer.from(`${a[0]}.${a[1]}`),t,Buffer.from(a[2],"base64url"))}catch{return}if(!u)return;let n;try{n=b64urlJsonSafe(a[1])}catch{return}const k=Date.now()/1e3;if(!(typeof n.exp=="number"&&k>n.exp+p)&&!(typeof n.nbf=="number"&&k<n.nbf-p)&&!(e.issuer&&n.iss!==e.issuer)){if(b){const y=n.aud;if(!(Array.isArray(y)?y:[y]).some(M=>b.includes(M)))return}return n}},"verify"),refresh:l,stop:c(()=>clearInterval(g),"stop")}}d(createJwksVerifier,"createJwksVerifier"),h(createJwksVerifier,"createJwksVerifier"),c(createJwksVerifier,"createJwksVerifier");
+"use strict";var J=Object.defineProperty;var h=(e,n)=>J(e,"name",{value:n,configurable:!0});var v=Object.defineProperty,c=h((e,n)=>v(e,"name",{value:n,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createJwksVerifier=createJwksVerifier;const node_crypto_1=require("node:crypto"),ALG_TO_HASH={RS256:"sha256",RS384:"sha384",RS512:"sha512"},b64urlJsonSafe=c(e=>JSON.parse(Buffer.from(e,"base64url").toString("utf8")),"b64urlJsonSafe");function createJwksVerifier(e){const n=(e.algorithms??["RS256"]).filter(r=>r in ALG_TO_HASH),g=e.cacheMaxAgeMs??6e5,k=e.missRefreshMs??3e4,d=e.clockToleranceSec??60,S=e.fetchImpl??globalThis.fetch,p=e.audience===void 0?void 0:Array.isArray(e.audience)?e.audience:[e.audience];let o=new Map,f,w=0;const m=c(async()=>{const r=await S(e.jwksUrl,{headers:{accept:"application/json"}});if(!r.ok)throw new Error(`JWKS ${e.jwksUrl} \u2192 HTTP ${r.status}`);const a=await r.json(),s=new Map;for(const t of a.keys??[])if(!(t.kty!=="RSA"||!t.n||!t.e)&&!(t.use&&t.use!=="sig"))try{const u=(0,node_crypto_1.createPublicKey)({key:t,format:"jwk"});s.set(t.kid??"__single__",u)}catch{}s.size>0&&(o=s)},"load"),l=c(()=>(f||(f=m().finally(()=>{f=void 0})),f),"refresh"),A=c(r=>{r-w<k||(w=r,l().catch(()=>{}))},"refreshOnMiss"),_=setInterval(()=>{l().catch(()=>{})},g);return _.unref?.(),{verify:c(r=>{const a=r.split(".");if(a.length!==3)return;let s;try{s=b64urlJsonSafe(a[0])}catch{return}if(!s.alg||!n.includes(s.alg))return;const t=o.get(s.kid??"__single__")??(o.size===1?[...o.values()][0]:void 0);if(!t){A(Date.now());return}let u;try{u=(0,node_crypto_1.verify)(ALG_TO_HASH[s.alg],Buffer.from(`${a[0]}.${a[1]}`),t,Buffer.from(a[2],"base64url"))}catch{return}if(!u)return;let i;try{i=b64urlJsonSafe(a[1])}catch{return}const b=Date.now()/1e3;if(!(typeof i.exp=="number"&&b>i.exp+d)&&!(typeof i.nbf=="number"&&b<i.nbf-d)&&!(e.issuer&&i.iss!==e.issuer)){if(p){const y=i.aud;if(!(Array.isArray(y)?y:[y]).some(j=>p.includes(j)))return}return i}},"verify"),refresh:l,stop:c(()=>clearInterval(_),"stop")}}h(createJwksVerifier,"createJwksVerifier"),c(createJwksVerifier,"createJwksVerifier");

package/executors/gateway/main.prod-gateway.js

@@ -1,2 +1,2 @@
-"use strict";var ee=Object.defineProperty;var N=(e,o)=>ee(e,"name",{value:o,configurable:!0});var Q=Object.defineProperty,L=N((e,o)=>Q(e,"name",{value:o,configurable:!0}),"L"),X=Object.defineProperty,a=L((e,o)=>X(e,"name",{value:o,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0});const tslib_1=require("tslib"),node_fs_1=require("node:fs"),node_crypto_1=require("node:crypto"),node_path_1=require("node:path"),node_os_1=require("node:os"),node_cluster_1=tslib_1.__importDefault(require("node:cluster")),prod_gateway_lib_1=require("./prod-gateway.lib"),jwks_verify_1=require("./jwks-verify"),otel_tracing_1=require("./otel-tracing"),health_check_1=require("./health-check"),rate_limit_1=require("./rate-limit"),metrics_1=require("./metrics"),registry_source_1=require("./registry-source"),providers_prod_1=require("./providers-prod");function readJson(e,o){if(!e)return o;try{return JSON.parse((0,node_fs_1.readFileSync)(e,"utf8"))}catch(n){return console.error(`[gateway] could not read ${e}:`,n.message),o}}N(readJson,"readJson"),L(readJson,"readJson"),a(readJson,"readJson");function isCohortShape(e){const o=Object.values(e)[0];return Array.isArray(o)&&o.length>0&&typeof o[0]=="object"&&o[0]!==null&&"urls"in o[0]}N(isCohortShape,"isCohortShape"),L(isCohortShape,"isCohortShape"),a(isCohortShape,"isCohortShape");function watchJsonFile(e,o,n=1e3){let E=-1;const c=setInterval(a(()=>{if(!(0,node_fs_1.existsSync)(e))return;let u;try{u=(0,node_fs_1.statSync)(e).mtimeMs}catch{return}if(u===E)return;let C;try{C=JSON.parse((0,node_fs_1.readFileSync)(e,"utf8"))}catch(l){console.error("[gateway] endpoints reload:",l.message);return}E=u,o(C)},"tick"),n);return c.unref?.(),()=>clearInterval(c)}N(watchJsonFile,"watchJsonFile"),L(watchJsonFile,"watchJsonFile"),a(watchJsonFile,"watchJsonFile");async function main(){const e=process.env,o=(e.LENSMCP_GW_PORTS??e.PORT??"").split(",").map(t=>Number(t.trim())).filter(Boolean);process.on("uncaughtException",t=>console.error("[gateway] uncaughtException:",t)),process.on("unhandledRejection",t=>console.error("[gateway] unhandledRejection:",t));const n=e.LENSMCP_GW_REDIS_URL;let E,c,u,C,l;if(n){const t=require("ioredis"),r=new t(n);l=r;const _=(0,registry_source_1.createRegistryProviders)((0,registry_source_1.redisRegistrySource)(r,e.LENSMCP_GW_REDIS_PREFIX?{prefix:e.LENSMCP_GW_REDIS_PREFIX}:{}),{onError:a(s=>console.error("[gateway] registry:",s instanceof Error?s.message:s),"onError")});await _.start(),E=_.manifests,c=_.pods,C=_,console.log(`[gateway] registry: Redis-backed, live (${E.list().length} service(s))`)}else{const t=e.LENSMCP_GW_MANIFESTS;t?E=(0,providers_prod_1.fileManifestProvider)(t,{onError:a(s=>console.error("[gateway] manifest:",s instanceof Error?s.message:s),"onError")}):(console.warn("[gateway] no LENSMCP_GW_MANIFESTS / LENSMCP_GW_REDIS_URL \u2014 starting with an EMPTY route table (all requests 404 until manifests arrive)."),E=(0,providers_prod_1.staticManifestProvider)([]));const r=e.LENSMCP_GW_ENDPOINTS,_=readJson(r,{});if(Object.keys(_).length){const s=isCohortShape(_);c=s?(0,providers_prod_1.rolloutPodProvider)(_):(0,providers_prod_1.endpointsPodProvider)(_),console.log(`[gateway] endpoints: ${s?"ROLLOUT (weighted cohorts)":"flat"} \u2014 ${Object.keys(_).length} service(s)`),r&&(u=watchJsonFile(r,S=>{try{c?.update?.(S),console.log("[gateway] endpoints reloaded")}catch(I){console.error("[gateway] endpoints reload failed:",I.message)}}))}}const j=readJson(e.LENSMCP_GW_KEYS,{}),O=e.LENSMCP_GW_TLS_KEY&&e.LENSMCP_GW_TLS_CERT?{key:(0,node_fs_1.readFileSync)(e.LENSMCP_GW_TLS_KEY),cert:(0,node_fs_1.readFileSync)(e.LENSMCP_GW_TLS_CERT)}:void 0,x=e.LENSMCP_GW_JWT_PRESENCE_ONLY==="1",A=e.LENSMCP_GW_JWKS_URL,d=e.LENSMCP_GW_JWT_SECRET,M=A?(0,jwks_verify_1.createJwksVerifier)({jwksUrl:A,...e.LENSMCP_GW_JWT_ISS?{issuer:e.LENSMCP_GW_JWT_ISS}:{},...e.LENSMCP_GW_JWT_AUD?{audience:e.LENSMCP_GW_JWT_AUD.split(",").map(t=>t.trim())}:{}}):void 0,B=a(t=>{if(!d)return;const r=t.split(".");if(r.length===3)try{const _=(0,node_crypto_1.createHmac)("sha256",d).update(r[0]+"."+r[1]).digest("base64url"),s=Buffer.from(r[2]),S=Buffer.from(_);if(s.length!==S.length||!(0,node_crypto_1.timingSafeEqual)(s,S))return;const I=JSON.parse(Buffer.from(r[1],"base64url").toString());return typeof I.exp=="number"&&Date.now()/1e3>I.exp?void 0:I}catch{return}},"hs256"),b=a(t=>{const r=String(t.headers.authorization??"");if(!r.startsWith("Bearer "))return;const _=r.slice(7);return M?M.verify(_):B(_)},"bearerClaims"),v=M||d?b:void 0,V=a((t,r)=>{if(t==="jwt"){if(M||d){if(!b(r))throw new Error("invalid or missing token");return}if(!x)throw new Error("jwt route but no verifier configured (set LENSMCP_GW_JWKS_URL or LENSMCP_GW_JWT_SECRET)");if(!String(r.headers.authorization??"").startsWith("Bearer "))throw new Error("missing bearer token")}},"authenticate"),D=(e.LENSMCP_GW_ATTR_HEADERS??"").split(",").map(t=>t.trim()).filter(Boolean),U=e.LENSMCP_GW_TRUST_PROXY==="1",k=e.LENSMCP_GW_UID_HEADER,H=e.LENSMCP_GW_COOKIE_SECRET||e.LENSMCP_GW_COOKIE_NAME||e.LENSMCP_GW_COOKIE_DOMAIN?{...e.LENSMCP_GW_COOKIE_NAME?{name:e.LENSMCP_GW_COOKIE_NAME}:{},...e.LENSMCP_GW_COOKIE_SECRET?{secret:e.LENSMCP_GW_COOKIE_SECRET}:{},...e.LENSMCP_GW_COOKIE_DOMAIN?{domain:e.LENSMCP_GW_COOKIE_DOMAIN}:{},...e.LENSMCP_GW_COOKIE_MAXAGE?{maxAge:Number(e.LENSMCP_GW_COOKIE_MAXAGE)}:{}}:void 0,m=e.LENSMCP_EVENT_FILE;let $=!1;const R=m?t=>{try{$||((0,node_fs_1.mkdirSync)((0,node_path_1.dirname)(m),{recursive:!0}),$=!0),(0,node_fs_1.appendFileSync)(m,JSON.stringify(t)+`
-`)}catch{}}:void 0;if(M)try{await M.refresh(),console.log("[gateway] JWKS loaded")}catch(t){console.error("[gateway] initial JWKS load failed (will retry in background):",t.message)}const Y=e.LENSMCP_GW_ACCESS_LOG==="1",F=e.LENSMCP_GW_CLIENT_IP_HEADER,K=(e.LENSMCP_GW_CLIENT_IP_TRUSTED_PROXIES??"").split(",").map(t=>t.trim()).filter(Boolean),i={};if(e.LENSMCP_GW_UPSTREAM_TLS_VERIFY==="1"&&(i.rejectUnauthorized=!0),e.LENSMCP_GW_UPSTREAM_H2==="1"&&(i.allowH2=!0),e.LENSMCP_GW_UNDICI_CONNECTIONS&&(i.connections=Number(e.LENSMCP_GW_UNDICI_CONNECTIONS)),e.LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS&&(i.bodyTimeout=Number(e.LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS)),e.LENSMCP_GW_UNDICI_PIPELINING&&(i.pipelining=Number(e.LENSMCP_GW_UNDICI_PIPELINING)),e.LENSMCP_GW_UNDICI_HEADERS_TIMEOUT_MS&&(i.headersTimeout=Number(e.LENSMCP_GW_UNDICI_HEADERS_TIMEOUT_MS)),e.LENSMCP_GW_UNDICI_KEEPALIVE_MS&&(i.keepAliveTimeout=Number(e.LENSMCP_GW_UNDICI_KEEPALIVE_MS)),e.LENSMCP_GW_MTLS_FROM_REDIS==="1"&&l){const t=e.LENSMCP_GW_REDIS_PREFIX??"lensmcp:gw",[r,_,s]=await l.mget(`${t}:mtls:cert`,`${t}:mtls:key`,`${t}:mtls:ca`);r&&(i.cert=r),_&&(i.key=_),s&&(i.ca=s),(r||_)&&console.log("[gateway] mTLS materials loaded from Redis")}else e.LENSMCP_GW_MTLS_CERT&&(i.cert=(0,node_fs_1.readFileSync)(e.LENSMCP_GW_MTLS_CERT)),e.LENSMCP_GW_MTLS_KEY&&(i.key=(0,node_fs_1.readFileSync)(e.LENSMCP_GW_MTLS_KEY)),e.LENSMCP_GW_MTLS_CA&&(i.ca=(0,node_fs_1.readFileSync)(e.LENSMCP_GW_MTLS_CA));i.cert&&i.key&&(e.LENSMCP_GW_UPSTREAM_H2!=="0"&&(i.allowH2=!0),console.log(`[gateway] mTLS to upstreams ON over ${i.allowH2?"h2":"h1.1"} (server validation ${i.rejectUnauthorized?"enabled":"OFF"})`));const W={};e.LENSMCP_GW_KEEPALIVE_MS&&(W.keepAliveTimeout=Number(e.LENSMCP_GW_KEEPALIVE_MS)),e.LENSMCP_GW_REQUEST_TIMEOUT_MS&&(W.requestTimeout=Number(e.LENSMCP_GW_REQUEST_TIMEOUT_MS));const G=(0,otel_tracing_1.setupTracing)({...e.OTEL_SERVICE_NAME?{serviceName:e.OTEL_SERVICE_NAME}:{},...e.LENSMCP_GW_OTEL_SAMPLE?{sampleRatio:Number(e.LENSMCP_GW_OTEL_SAMPLE)}:{}});G&&console.log(`[gateway] OTLP tracing on \u2192 ${e.OTEL_EXPORTER_OTLP_ENDPOINT}`);const g=e.LENSMCP_GW_STATUS==="1",T=e.LENSMCP_GW_STATUS_TOKEN,J=(0,node_os_1.hostname)(),z=Math.max(3,Math.ceil(Number(e.LENSMCP_GW_TRAFFIC_FLUSH_MS??5e3)/1e3*3)),q=l,f=g&&q?t=>{for(const r of t)q.set(`status:${r.service}:${J}`,JSON.stringify({...r,instance:J,at:Date.now()}),"EX",z).catch(()=>{})}:void 0;g&&!T&&console.warn("[gateway] LENSMCP_GW_STATUS=1 but no LENSMCP_GW_STATUS_TOKEN \u2014 /statusz stays DISABLED (404) until a token is set (fail-closed). The Redis status:* fan-out still runs."),g&&console.log(`[gateway] status on \u2014 /statusz${T?"":" (endpoint disabled: no token)"}${f?" + Redis status:* fan-out":""}`);const y=e.LENSMCP_GW_HEALTH_CHECK==="1"?(0,health_check_1.createHealthChecker)({...e.LENSMCP_GW_HEALTH_PATH?{path:e.LENSMCP_GW_HEALTH_PATH}:{},...e.LENSMCP_GW_HEALTH_INTERVAL_MS?{intervalMs:Number(e.LENSMCP_GW_HEALTH_INTERVAL_MS)}:{},...e.LENSMCP_GW_HEALTH_TIMEOUT_MS?{timeoutMs:Number(e.LENSMCP_GW_HEALTH_TIMEOUT_MS)}:{}}):void 0;y&&console.log(`[gateway] active health-checking on (path ${e.LENSMCP_GW_HEALTH_PATH??"/healthz"})`);let P,p;if(e.LENSMCP_GW_RATE_LIMIT){const t=Number(e.LENSMCP_GW_RATE_LIMIT),r=Number(e.LENSMCP_GW_RATE_WINDOW_MS??6e4);if(e.LENSMCP_GW_RATE_LIMIT_REDIS==="1"||e.LENSMCP_GW_RATE_LIMIT_REDIS_URL){const _=e.LENSMCP_GW_RATE_LIMIT_REDIS_URL;let s;if(_){const S=require("ioredis");p=new S(_),s=p}else l&&(s=l);if(s){const S=e.LENSMCP_GW_RATE_LIMIT_FAIL_CLOSED==="1";P=(0,rate_limit_1.createRedisRateLimiter)(s,{limit:t,windowMs:r,...e.LENSMCP_GW_RATE_LIMIT_TIMEOUT_MS?{timeoutMs:Number(e.LENSMCP_GW_RATE_LIMIT_TIMEOUT_MS)}:{},...S?{failOpen:!1}:{}}),console.log(`[gateway] rate limit on \u2014 ${t} req / ${r}ms GLOBAL (Redis: ${_?"dedicated":"shared registry"}, fail-${S?"closed":"open"}) per client IP`)}else console.warn("[gateway] LENSMCP_GW_RATE_LIMIT_REDIS set but no Redis configured (set LENSMCP_GW_REDIS_URL or LENSMCP_GW_RATE_LIMIT_REDIS_URL) \u2014 falling back to PER-INSTANCE in-memory limiting.")}P||(P=(0,rate_limit_1.createRateLimiter)({limit:t,windowMs:r}),console.log(`[gateway] rate limit on \u2014 ${t} req / ${r}ms per client IP (in-memory, per-instance)`))}const h=e.LENSMCP_GW_METRICS==="1"?(0,metrics_1.createProcessMetrics)():void 0;h&&console.log(`[gateway] process metrics on \u2014 /metricsz${T?" (token-gated)":" (DISABLED: needs LENSMCP_GW_STATUS_TOKEN)"}`);const w=await(0,prod_gateway_lib_1.startProdGateway)({...o.length?{ports:o}:{},manifests:E,...c?{pods:c}:{},serviceKeys:j,authenticate:V,...O?{tls:O}:{},...R?{emit:R}:{},...v?{identify:v}:{},...D.length?{attributeHeaders:D}:{},...U?{trustProxyIp:U}:{},...H?{cookie:H}:{},...k?{uidHeader:k}:{},...Y?{accessLog:!0}:{},...F?{clientIpHeader:F}:{},...K.length?{clientIpTrustedProxies:K}:{},...G?{tracing:G}:{},...g?{statusEndpoint:!0}:{},...T?{statusToken:T}:{},...f?{onStatus:f}:{},...y?{healthChecker:y}:{},...P?{rateLimiter:P}:{},...h?{metrics:h}:{},...e.LENSMCP_GW_TRAFFIC_FLUSH_MS?{trafficFlushMs:Number(e.LENSMCP_GW_TRAFFIC_FLUSH_MS)}:{},...Object.keys(i).length?{undici:i}:{},...Object.keys(W).length?{server:W}:{}});console.log(`[gateway] production gateway up on ${w.ports.join(", ")} (${w.routes().length} routes${R?", lens ON":""})`);const Z=a(async t=>{console.log(`[gateway] ${t} \u2014 draining\u2026`);try{E.stop?.()}catch{}try{u?.()}catch{}try{C?.stop()}catch{}try{await p?.quit()}catch{}try{M?.stop()}catch{}await w.stop();try{await G?.shutdown()}catch{}process.exit(0)},"shutdown");for(const t of["SIGTERM","SIGINT"])process.on(t,()=>{Z(t)})}N(main,"main"),L(main,"main"),a(main,"main");function workerCount(){const e=(process.env.LENSMCP_GW_WORKERS??"1").trim().toLowerCase();if(e==="auto"||e==="max"||e==="0")return Math.max(1,(0,node_os_1.cpus)().length);const o=Math.floor(Number(e));return Number.isFinite(o)&&o>0?o:1}N(workerCount,"workerCount"),L(workerCount,"workerCount"),a(workerCount,"workerCount");const WORKERS=workerCount();if(WORKERS>1&&node_cluster_1.default.isPrimary){console.log(`[gateway] primary ${process.pid}: forking ${WORKERS} workers (one per core)\u2026`),process.env.LENSMCP_GW_RATE_LIMIT&&!(process.env.LENSMCP_GW_RATE_LIMIT_REDIS==="1"||process.env.LENSMCP_GW_RATE_LIMIT_REDIS_URL)&&console.warn(`[gateway] WARNING: in-memory rate limiter + ${WORKERS} workers \u2192 the limit is enforced PER WORKER (effective \u2248 ${WORKERS}\xD7 ${process.env.LENSMCP_GW_RATE_LIMIT}/window). Set LENSMCP_GW_RATE_LIMIT_REDIS=1 for one shared global budget, or divide LENSMCP_GW_RATE_LIMIT by ${WORKERS}.`);let e=!1;for(let n=0;n<WORKERS;n++)node_cluster_1.default.fork();node_cluster_1.default.on("exit",(n,E,c)=>{e||(console.warn(`[gateway] worker ${n.process.pid} exited (code=${E} sig=${c??""}) \u2014 respawning.`),node_cluster_1.default.fork())});const o=a(n=>{if(!e){e=!0,console.log(`[gateway] primary: ${n} \u2014 stopping ${Object.keys(node_cluster_1.default.workers??{}).length} workers\u2026`);for(const E of Object.values(node_cluster_1.default.workers??{}))try{E?.kill(n)}catch{}setTimeout(()=>process.exit(0),12e3).unref()}},"stopAll");process.on("SIGTERM",()=>o("SIGTERM")),process.on("SIGINT",()=>o("SIGINT"))}else main();
+"use strict";var Q=Object.defineProperty;var L=(e,o)=>Q(e,"name",{value:o,configurable:!0});var X=Object.defineProperty,a=L((e,o)=>X(e,"name",{value:o,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0});const tslib_1=require("tslib"),node_fs_1=require("node:fs"),node_crypto_1=require("node:crypto"),node_path_1=require("node:path"),node_os_1=require("node:os"),node_cluster_1=tslib_1.__importDefault(require("node:cluster")),prod_gateway_lib_1=require("./prod-gateway.lib"),jwks_verify_1=require("./jwks-verify"),otel_tracing_1=require("./otel-tracing"),health_check_1=require("./health-check"),rate_limit_1=require("./rate-limit"),metrics_1=require("./metrics"),registry_source_1=require("./registry-source"),providers_prod_1=require("./providers-prod");function readJson(e,o){if(!e)return o;try{return JSON.parse((0,node_fs_1.readFileSync)(e,"utf8"))}catch(n){return console.error(`[gateway] could not read ${e}:`,n.message),o}}L(readJson,"readJson"),a(readJson,"readJson");function isCohortShape(e){const o=Object.values(e)[0];return Array.isArray(o)&&o.length>0&&typeof o[0]=="object"&&o[0]!==null&&"urls"in o[0]}L(isCohortShape,"isCohortShape"),a(isCohortShape,"isCohortShape");function watchJsonFile(e,o,n=1e3){let E=-1;const c=setInterval(a(()=>{if(!(0,node_fs_1.existsSync)(e))return;let N;try{N=(0,node_fs_1.statSync)(e).mtimeMs}catch{return}if(N===E)return;let u;try{u=JSON.parse((0,node_fs_1.readFileSync)(e,"utf8"))}catch(l){console.error("[gateway] endpoints reload:",l.message);return}E=N,o(u)},"tick"),n);return c.unref?.(),()=>clearInterval(c)}L(watchJsonFile,"watchJsonFile"),a(watchJsonFile,"watchJsonFile");async function main(){const e=process.env,o=(e.LENSMCP_GW_PORTS??e.PORT??"").split(",").map(t=>Number(t.trim())).filter(Boolean);process.on("uncaughtException",t=>console.error("[gateway] uncaughtException:",t)),process.on("unhandledRejection",t=>console.error("[gateway] unhandledRejection:",t));const n=e.LENSMCP_GW_REDIS_URL;let E,c,N,u,l;if(n){const t=require("ioredis"),r=new t(n);l=r;const _=(0,registry_source_1.createRegistryProviders)((0,registry_source_1.redisRegistrySource)(r,e.LENSMCP_GW_REDIS_PREFIX?{prefix:e.LENSMCP_GW_REDIS_PREFIX}:{}),{onError:a(s=>console.error("[gateway] registry:",s instanceof Error?s.message:s),"onError")});await _.start(),E=_.manifests,c=_.pods,u=_,console.log(`[gateway] registry: Redis-backed, live (${E.list().length} service(s))`)}else{const t=e.LENSMCP_GW_MANIFESTS;t?E=(0,providers_prod_1.fileManifestProvider)(t,{onError:a(s=>console.error("[gateway] manifest:",s instanceof Error?s.message:s),"onError")}):(console.warn("[gateway] no LENSMCP_GW_MANIFESTS / LENSMCP_GW_REDIS_URL \u2014 starting with an EMPTY route table (all requests 404 until manifests arrive)."),E=(0,providers_prod_1.staticManifestProvider)([]));const r=e.LENSMCP_GW_ENDPOINTS,_=readJson(r,{});if(Object.keys(_).length){const s=isCohortShape(_);c=s?(0,providers_prod_1.rolloutPodProvider)(_):(0,providers_prod_1.endpointsPodProvider)(_),console.log(`[gateway] endpoints: ${s?"ROLLOUT (weighted cohorts)":"flat"} \u2014 ${Object.keys(_).length} service(s)`),r&&(N=watchJsonFile(r,S=>{try{c?.update?.(S),console.log("[gateway] endpoints reloaded")}catch(P){console.error("[gateway] endpoints reload failed:",P.message)}}))}}const J=readJson(e.LENSMCP_GW_KEYS,{}),w=e.LENSMCP_GW_TLS_KEY&&e.LENSMCP_GW_TLS_CERT?{key:(0,node_fs_1.readFileSync)(e.LENSMCP_GW_TLS_KEY),cert:(0,node_fs_1.readFileSync)(e.LENSMCP_GW_TLS_CERT)}:void 0,j=e.LENSMCP_GW_JWT_PRESENCE_ONLY==="1",O=e.LENSMCP_GW_JWKS_URL,I=e.LENSMCP_GW_JWT_SECRET,M=O?(0,jwks_verify_1.createJwksVerifier)({jwksUrl:O,...e.LENSMCP_GW_JWT_ISS?{issuer:e.LENSMCP_GW_JWT_ISS}:{},...e.LENSMCP_GW_JWT_AUD?{audience:e.LENSMCP_GW_JWT_AUD.split(",").map(t=>t.trim())}:{}}):void 0,x=a(t=>{if(!I)return;const r=t.split(".");if(r.length===3)try{const _=(0,node_crypto_1.createHmac)("sha256",I).update(r[0]+"."+r[1]).digest("base64url"),s=Buffer.from(r[2]),S=Buffer.from(_);if(s.length!==S.length||!(0,node_crypto_1.timingSafeEqual)(s,S))return;const P=JSON.parse(Buffer.from(r[1],"base64url").toString());return typeof P.exp=="number"&&Date.now()/1e3>P.exp?void 0:P}catch{return}},"hs256"),A=a(t=>{const r=String(t.headers.authorization??"");if(!r.startsWith("Bearer "))return;const _=r.slice(7);return M?M.verify(_):x(_)},"bearerClaims"),b=M||I?A:void 0,B=a((t,r)=>{if(t==="jwt"){if(M||I){if(!A(r))throw new Error("invalid or missing token");return}if(!j)throw new Error("jwt route but no verifier configured (set LENSMCP_GW_JWKS_URL or LENSMCP_GW_JWT_SECRET)");if(!String(r.headers.authorization??"").startsWith("Bearer "))throw new Error("missing bearer token")}},"authenticate"),v=(e.LENSMCP_GW_ATTR_HEADERS??"").split(",").map(t=>t.trim()).filter(Boolean),D=e.LENSMCP_GW_TRUST_PROXY==="1",U=e.LENSMCP_GW_UID_HEADER,k=e.LENSMCP_GW_COOKIE_SECRET||e.LENSMCP_GW_COOKIE_NAME||e.LENSMCP_GW_COOKIE_DOMAIN?{...e.LENSMCP_GW_COOKIE_NAME?{name:e.LENSMCP_GW_COOKIE_NAME}:{},...e.LENSMCP_GW_COOKIE_SECRET?{secret:e.LENSMCP_GW_COOKIE_SECRET}:{},...e.LENSMCP_GW_COOKIE_DOMAIN?{domain:e.LENSMCP_GW_COOKIE_DOMAIN}:{},...e.LENSMCP_GW_COOKIE_MAXAGE?{maxAge:Number(e.LENSMCP_GW_COOKIE_MAXAGE)}:{}}:void 0,g=e.LENSMCP_EVENT_FILE;let H=!1;const m=g?t=>{try{H||((0,node_fs_1.mkdirSync)((0,node_path_1.dirname)(g),{recursive:!0}),H=!0),(0,node_fs_1.appendFileSync)(g,JSON.stringify(t)+`
+`)}catch{}}:void 0;if(M)try{await M.refresh(),console.log("[gateway] JWKS loaded")}catch(t){console.error("[gateway] initial JWKS load failed (will retry in background):",t.message)}const V=e.LENSMCP_GW_ACCESS_LOG==="1",$=e.LENSMCP_GW_CLIENT_IP_HEADER,F=(e.LENSMCP_GW_CLIENT_IP_TRUSTED_PROXIES??"").split(",").map(t=>t.trim()).filter(Boolean),i={};if(e.LENSMCP_GW_UPSTREAM_TLS_VERIFY==="1"&&(i.rejectUnauthorized=!0),e.LENSMCP_GW_UPSTREAM_H2==="1"&&(i.allowH2=!0),e.LENSMCP_GW_UNDICI_CONNECTIONS&&(i.connections=Number(e.LENSMCP_GW_UNDICI_CONNECTIONS)),e.LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS&&(i.bodyTimeout=Number(e.LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS)),e.LENSMCP_GW_UNDICI_PIPELINING&&(i.pipelining=Number(e.LENSMCP_GW_UNDICI_PIPELINING)),e.LENSMCP_GW_UNDICI_HEADERS_TIMEOUT_MS&&(i.headersTimeout=Number(e.LENSMCP_GW_UNDICI_HEADERS_TIMEOUT_MS)),e.LENSMCP_GW_UNDICI_KEEPALIVE_MS&&(i.keepAliveTimeout=Number(e.LENSMCP_GW_UNDICI_KEEPALIVE_MS)),e.LENSMCP_GW_MTLS_FROM_REDIS==="1"&&l){const t=e.LENSMCP_GW_REDIS_PREFIX??"lensmcp:gw",[r,_,s]=await l.mget(`${t}:mtls:cert`,`${t}:mtls:key`,`${t}:mtls:ca`);r&&(i.cert=r),_&&(i.key=_),s&&(i.ca=s),(r||_)&&console.log("[gateway] mTLS materials loaded from Redis")}else e.LENSMCP_GW_MTLS_CERT&&(i.cert=(0,node_fs_1.readFileSync)(e.LENSMCP_GW_MTLS_CERT)),e.LENSMCP_GW_MTLS_KEY&&(i.key=(0,node_fs_1.readFileSync)(e.LENSMCP_GW_MTLS_KEY)),e.LENSMCP_GW_MTLS_CA&&(i.ca=(0,node_fs_1.readFileSync)(e.LENSMCP_GW_MTLS_CA));i.cert&&i.key&&(e.LENSMCP_GW_UPSTREAM_H2!=="0"&&(i.allowH2=!0),console.log(`[gateway] mTLS to upstreams ON over ${i.allowH2?"h2":"h1.1"} (server validation ${i.rejectUnauthorized?"enabled":"OFF"})`));const d={};e.LENSMCP_GW_KEEPALIVE_MS&&(d.keepAliveTimeout=Number(e.LENSMCP_GW_KEEPALIVE_MS)),e.LENSMCP_GW_REQUEST_TIMEOUT_MS&&(d.requestTimeout=Number(e.LENSMCP_GW_REQUEST_TIMEOUT_MS));const W=(0,otel_tracing_1.setupTracing)({...e.OTEL_SERVICE_NAME?{serviceName:e.OTEL_SERVICE_NAME}:{},...e.LENSMCP_GW_OTEL_SAMPLE?{sampleRatio:Number(e.LENSMCP_GW_OTEL_SAMPLE)}:{}});W&&console.log(`[gateway] OTLP tracing on \u2192 ${e.OTEL_EXPORTER_OTLP_ENDPOINT}`);const G=e.LENSMCP_GW_STATUS==="1",C=e.LENSMCP_GW_STATUS_TOKEN,K=(0,node_os_1.hostname)(),Y=Math.max(3,Math.ceil(Number(e.LENSMCP_GW_TRAFFIC_FLUSH_MS??5e3)/1e3*3)),q=l,R=G&&q?t=>{for(const r of t)q.set(`status:${r.service}:${K}`,JSON.stringify({...r,instance:K,at:Date.now()}),"EX",Y).catch(()=>{})}:void 0;G&&!C&&console.warn("[gateway] LENSMCP_GW_STATUS=1 but no LENSMCP_GW_STATUS_TOKEN \u2014 /statusz stays DISABLED (404) until a token is set (fail-closed). The Redis status:* fan-out still runs."),G&&console.log(`[gateway] status on \u2014 /statusz${C?"":" (endpoint disabled: no token)"}${R?" + Redis status:* fan-out":""}`);const f=e.LENSMCP_GW_HEALTH_CHECK==="1"?(0,health_check_1.createHealthChecker)({...e.LENSMCP_GW_HEALTH_PATH?{path:e.LENSMCP_GW_HEALTH_PATH}:{},...e.LENSMCP_GW_HEALTH_INTERVAL_MS?{intervalMs:Number(e.LENSMCP_GW_HEALTH_INTERVAL_MS)}:{},...e.LENSMCP_GW_HEALTH_TIMEOUT_MS?{timeoutMs:Number(e.LENSMCP_GW_HEALTH_TIMEOUT_MS)}:{}}):void 0;f&&console.log(`[gateway] active health-checking on (path ${e.LENSMCP_GW_HEALTH_PATH??"/healthz"})`);let T,y;if(e.LENSMCP_GW_RATE_LIMIT){const t=Number(e.LENSMCP_GW_RATE_LIMIT),r=Number(e.LENSMCP_GW_RATE_WINDOW_MS??6e4);if(e.LENSMCP_GW_RATE_LIMIT_REDIS==="1"||e.LENSMCP_GW_RATE_LIMIT_REDIS_URL){const _=e.LENSMCP_GW_RATE_LIMIT_REDIS_URL;let s;if(_){const S=require("ioredis");y=new S(_),s=y}else l&&(s=l);if(s){const S=e.LENSMCP_GW_RATE_LIMIT_FAIL_CLOSED==="1";T=(0,rate_limit_1.createRedisRateLimiter)(s,{limit:t,windowMs:r,...e.LENSMCP_GW_RATE_LIMIT_TIMEOUT_MS?{timeoutMs:Number(e.LENSMCP_GW_RATE_LIMIT_TIMEOUT_MS)}:{},...S?{failOpen:!1}:{}}),console.log(`[gateway] rate limit on \u2014 ${t} req / ${r}ms GLOBAL (Redis: ${_?"dedicated":"shared registry"}, fail-${S?"closed":"open"}) per client IP`)}else console.warn("[gateway] LENSMCP_GW_RATE_LIMIT_REDIS set but no Redis configured (set LENSMCP_GW_REDIS_URL or LENSMCP_GW_RATE_LIMIT_REDIS_URL) \u2014 falling back to PER-INSTANCE in-memory limiting.")}T||(T=(0,rate_limit_1.createRateLimiter)({limit:t,windowMs:r}),console.log(`[gateway] rate limit on \u2014 ${t} req / ${r}ms per client IP (in-memory, per-instance)`))}const p=e.LENSMCP_GW_METRICS==="1"?(0,metrics_1.createProcessMetrics)():void 0;p&&console.log(`[gateway] process metrics on \u2014 /metricsz${C?" (token-gated)":" (DISABLED: needs LENSMCP_GW_STATUS_TOKEN)"}`);const h=await(0,prod_gateway_lib_1.startProdGateway)({...o.length?{ports:o}:{},manifests:E,...c?{pods:c}:{},serviceKeys:J,authenticate:B,...w?{tls:w}:{},...m?{emit:m}:{},...b?{identify:b}:{},...v.length?{attributeHeaders:v}:{},...D?{trustProxyIp:D}:{},...k?{cookie:k}:{},...U?{uidHeader:U}:{},...V?{accessLog:!0}:{},...$?{clientIpHeader:$}:{},...F.length?{clientIpTrustedProxies:F}:{},...W?{tracing:W}:{},...G?{statusEndpoint:!0}:{},...C?{statusToken:C}:{},...R?{onStatus:R}:{},...f?{healthChecker:f}:{},...T?{rateLimiter:T}:{},...p?{metrics:p}:{},...e.LENSMCP_GW_TRAFFIC_FLUSH_MS?{trafficFlushMs:Number(e.LENSMCP_GW_TRAFFIC_FLUSH_MS)}:{},...Object.keys(i).length?{undici:i}:{},...Object.keys(d).length?{server:d}:{}});console.log(`[gateway] production gateway up on ${h.ports.join(", ")} (${h.routes().length} routes${m?", lens ON":""})`);const z=a(async t=>{console.log(`[gateway] ${t} \u2014 draining\u2026`);try{E.stop?.()}catch{}try{N?.()}catch{}try{u?.stop()}catch{}try{await y?.quit()}catch{}try{M?.stop()}catch{}await h.stop();try{await W?.shutdown()}catch{}process.exit(0)},"shutdown");for(const t of["SIGTERM","SIGINT"])process.on(t,()=>{z(t)})}L(main,"main"),a(main,"main");function workerCount(){const e=(process.env.LENSMCP_GW_WORKERS??"1").trim().toLowerCase();if(e==="auto"||e==="max"||e==="0")return Math.max(1,(0,node_os_1.cpus)().length);const o=Math.floor(Number(e));return Number.isFinite(o)&&o>0?o:1}L(workerCount,"workerCount"),a(workerCount,"workerCount");const WORKERS=workerCount();if(WORKERS>1&&node_cluster_1.default.isPrimary){console.log(`[gateway] primary ${process.pid}: forking ${WORKERS} workers (one per core)\u2026`),process.env.LENSMCP_GW_RATE_LIMIT&&!(process.env.LENSMCP_GW_RATE_LIMIT_REDIS==="1"||process.env.LENSMCP_GW_RATE_LIMIT_REDIS_URL)&&console.warn(`[gateway] WARNING: in-memory rate limiter + ${WORKERS} workers \u2192 the limit is enforced PER WORKER (effective \u2248 ${WORKERS}\xD7 ${process.env.LENSMCP_GW_RATE_LIMIT}/window). Set LENSMCP_GW_RATE_LIMIT_REDIS=1 for one shared global budget, or divide LENSMCP_GW_RATE_LIMIT by ${WORKERS}.`);let e=!1;for(let n=0;n<WORKERS;n++)node_cluster_1.default.fork();node_cluster_1.default.on("exit",(n,E,c)=>{e||(console.warn(`[gateway] worker ${n.process.pid} exited (code=${E} sig=${c??""}) \u2014 respawning.`),node_cluster_1.default.fork())});const o=a(n=>{if(!e){e=!0,console.log(`[gateway] primary: ${n} \u2014 stopping ${Object.keys(node_cluster_1.default.workers??{}).length} workers\u2026`);for(const E of Object.values(node_cluster_1.default.workers??{}))try{E?.kill(n)}catch{}setTimeout(()=>process.exit(0),12e3).unref()}},"stopAll");process.on("SIGTERM",()=>o("SIGTERM")),process.on("SIGINT",()=>o("SIGINT"))}else main();

package/executors/gateway/main.rollout.js

@@ -1,4 +1,4 @@
-"use strict";var v=Object.defineProperty;var c=(e,r)=>v(e,"name",{value:r,configurable:!0});var p=Object.defineProperty,l=c((e,r)=>p(e,"name",{value:r,configurable:!0}),"l"),a=Object.defineProperty,i=l((e,r)=>a(e,"name",{value:r,configurable:!0}),"i");Object.defineProperty(exports,"__esModule",{value:!0}),exports.runRollout=runRollout;const node_fs_1=require("node:fs"),rollout_ops_1=require("./rollout-ops"),registry_source_1=require("./registry-source"),USAGE=`lensmcp rollout \u2014 edit the gateway rollout config (file or Redis registry)
+"use strict";var p=Object.defineProperty;var l=(e,r)=>p(e,"name",{value:r,configurable:!0});var a=Object.defineProperty,i=l((e,r)=>a(e,"name",{value:r,configurable:!0}),"i");Object.defineProperty(exports,"__esModule",{value:!0}),exports.runRollout=runRollout;const node_fs_1=require("node:fs"),rollout_ops_1=require("./rollout-ops"),registry_source_1=require("./registry-source"),USAGE=`lensmcp rollout \u2014 edit the gateway rollout config (file or Redis registry)
 
 Usage: <config.json> <command> [args]
        --redis <url> [--prefix <p>] <command> [args]
@@ -16,9 +16,9 @@ Commands:
 `)?e:e+`
 `),"out"),err=i(e=>process.stderr.write(e.endsWith(`
 `)?e:e+`
-`),"err");function extractFlag(e,r){const o=e.indexOf(r);return o<0?{rest:e}:{value:e[o+1],rest:[...e.slice(0,o),...e.slice(o+2)]}}c(extractFlag,"extractFlag"),l(extractFlag,"extractFlag"),i(extractFlag,"extractFlag");function runFile(e){const[r,...o]=e;if(!r||!o.length)return err(USAGE),2;let s;try{s=JSON.parse((0,node_fs_1.readFileSync)(r,"utf8"))}catch(t){return err(`cannot read ${r}: ${t.message}`),1}try{const t=(0,rollout_ops_1.parseRolloutCommand)(o);if(!t.op)return out((0,rollout_ops_1.summarizeRollout)(s,t.status)),0;const n=(0,rollout_ops_1.applyRolloutOp)(s,t.op);return(0,node_fs_1.writeFileSync)(`${r}.tmp`,JSON.stringify(n,null,2)+`
+`),"err");function extractFlag(e,r){const o=e.indexOf(r);return o<0?{rest:e}:{value:e[o+1],rest:[...e.slice(0,o),...e.slice(o+2)]}}l(extractFlag,"extractFlag"),i(extractFlag,"extractFlag");function runFile(e){const[r,...o]=e;if(!r||!o.length)return err(USAGE),2;let s;try{s=JSON.parse((0,node_fs_1.readFileSync)(r,"utf8"))}catch(t){return err(`cannot read ${r}: ${t.message}`),1}try{const t=(0,rollout_ops_1.parseRolloutCommand)(o);if(!t.op)return out((0,rollout_ops_1.summarizeRollout)(s,t.status)),0;const n=(0,rollout_ops_1.applyRolloutOp)(s,t.op);return(0,node_fs_1.writeFileSync)(`${r}.tmp`,JSON.stringify(n,null,2)+`
 `),(0,node_fs_1.renameSync)(`${r}.tmp`,r),out(`\u2713 ${t.op.kind} ${t.op.service}
 
-${(0,rollout_ops_1.summarizeRollout)(n,t.op.service)}`),0}catch(t){return err(`\u2717 ${t.message}`),1}}c(runFile,"runFile"),l(runFile,"runFile"),i(runFile,"runFile");async function runRedis(e,r,o){if(!o.length)return err(USAGE),2;let s;try{const t=require("ioredis");s=new t(e)}catch{return err('--redis needs the "ioredis" package installed (peer dep of @lensmcp/cluster)'),1}try{const{endpoints:t}=await(0,registry_source_1.redisRegistrySource)(s,{prefix:r}).read(),n=(0,rollout_ops_1.parseRolloutCommand)(o);if(!n.op)return out((0,rollout_ops_1.summarizeRollout)(t,n.status)),0;const d=(0,rollout_ops_1.applyRolloutOp)(t,n.op),u=n.op.service,m=d[u];return m===void 0?await s.del((0,registry_source_1.rolloutKey)(r,u)):await s.set((0,registry_source_1.rolloutKey)(r,u),JSON.stringify(m)),await s.publish((0,registry_source_1.changeChannel)(r),u),out(`\u2713 ${n.op.kind} ${u} \u2192 redis ${r} (published)
+${(0,rollout_ops_1.summarizeRollout)(n,t.op.service)}`),0}catch(t){return err(`\u2717 ${t.message}`),1}}l(runFile,"runFile"),i(runFile,"runFile");async function runRedis(e,r,o){if(!o.length)return err(USAGE),2;let s;try{const t=require("ioredis");s=new t(e)}catch{return err('--redis needs the "ioredis" package installed (peer dep of @lensmcp/cluster)'),1}try{const{endpoints:t}=await(0,registry_source_1.redisRegistrySource)(s,{prefix:r}).read(),n=(0,rollout_ops_1.parseRolloutCommand)(o);if(!n.op)return out((0,rollout_ops_1.summarizeRollout)(t,n.status)),0;const c=(0,rollout_ops_1.applyRolloutOp)(t,n.op),u=n.op.service,d=c[u];return d===void 0?await s.del((0,registry_source_1.rolloutKey)(r,u)):await s.set((0,registry_source_1.rolloutKey)(r,u),JSON.stringify(d)),await s.publish((0,registry_source_1.changeChannel)(r),u),out(`\u2713 ${n.op.kind} ${u} \u2192 redis ${r} (published)
 
-${(0,rollout_ops_1.summarizeRollout)(d,u)}`),0}catch(t){return err(`\u2717 ${t.message}`),1}finally{try{await s.quit()}catch{}}}c(runRedis,"runRedis"),l(runRedis,"runRedis"),i(runRedis,"runRedis");async function runRollout(e){const r=extractFlag(e,"--redis"),o=extractFlag(r.rest,"--prefix");return r.value?runRedis(r.value,o.value??registry_source_1.DEFAULT_REGISTRY_PREFIX,o.rest):runFile(o.rest)}c(runRollout,"runRollout"),l(runRollout,"runRollout"),i(runRollout,"runRollout"),require.main===module&&runRollout(process.argv.slice(2)).then(e=>process.exit(e));
+${(0,rollout_ops_1.summarizeRollout)(c,u)}`),0}catch(t){return err(`\u2717 ${t.message}`),1}finally{try{await s.quit()}catch{}}}l(runRedis,"runRedis"),i(runRedis,"runRedis");async function runRollout(e){const r=extractFlag(e,"--redis"),o=extractFlag(r.rest,"--prefix");return r.value?runRedis(r.value,o.value??registry_source_1.DEFAULT_REGISTRY_PREFIX,o.rest):runFile(o.rest)}l(runRollout,"runRollout"),i(runRollout,"runRollout"),require.main===module&&runRollout(process.argv.slice(2)).then(e=>process.exit(e));

package/executors/gateway/manifest.js

@@ -1 +1 @@
-"use strict";var m=Object.defineProperty;var i=(e,t)=>m(e,"name",{value:t,configurable:!0});var h=Object.defineProperty,u=i((e,t)=>h(e,"name",{value:t,configurable:!0}),"u"),f=Object.defineProperty,a=u((e,t)=>f(e,"name",{value:t,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0}),exports.smoothWeightedSelector=smoothWeightedSelector,exports.hostMatches=hostMatches,exports.matchRoute=matchRoute,exports.sortBySpecificity=sortBySpecificity,exports.authForPath=authForPath,exports.authPathMatches=authPathMatches,exports.authRuleFor=authRuleFor,exports.authRuleForPath=authRuleForPath,exports.buildRouteTable=buildRouteTable,exports.manifestFromClusterDecl=manifestFromClusterDecl,exports.matchCidr=matchCidr,exports.evalRule=evalRule,exports.pickTargetedVersion=pickTargetedVersion,exports.fnv1a=fnv1a,exports.bucketByWeight=bucketByWeight;function smoothWeightedSelector(e){const t=e.map(()=>0),r=e.reduce((s,n)=>s+Math.max(0,n),0);return()=>{if(r<=0||e.length===0)return 0;let s=0;for(let n=0;n<e.length;n++)t[n]+=Math.max(0,e[n]),t[n]>t[s]&&(s=n);return t[s]-=r,s}}i(smoothWeightedSelector,"smoothWeightedSelector"),u(smoothWeightedSelector,"smoothWeightedSelector"),a(smoothWeightedSelector,"smoothWeightedSelector");function hostMatches(e,t){return e.startsWith("*.")?t.endsWith(e.slice(1))||t===e.slice(2):t===e}i(hostMatches,"hostMatches"),u(hostMatches,"hostMatches"),a(hostMatches,"hostMatches");function matchRoute(e,t,r){const s=e.some(o=>o.host&&hostMatches(o.host,t));let n;if(s)n=e.filter(o=>o.host&&hostMatches(o.host,t)),n.some(o=>o.host===t)&&(n=n.filter(o=>o.host===t));else{const o=e.filter(l=>!l.host);if(o.length<=1)n=o;else{const l=o.filter(c=>c.apex&&(t===c.apex||t.endsWith("."+c.apex))).sort((c,p)=>p.apex.length-c.apex.length);n=l.length>0?l:o.filter(c=>!c.apex)}}return n.find(o=>!o.prefix||r.startsWith(o.prefix))}i(matchRoute,"matchRoute"),u(matchRoute,"matchRoute"),a(matchRoute,"matchRoute");function sortBySpecificity(e){return e.sort((t,r)=>(r.host?2:0)+(r.prefix?1:0)-((t.host?2:0)+(t.prefix?1:0))),e}i(sortBySpecificity,"sortBySpecificity"),u(sortBySpecificity,"sortBySpecificity"),a(sortBySpecificity,"sortBySpecificity");function authForPath(e,t,r){if(r)return"internal";const s=e.auth?.overrides??[];for(const n of s)if(t.startsWith(n.path))return n.mode;return e.auth?.default??"jwt"}i(authForPath,"authForPath"),u(authForPath,"authForPath"),a(authForPath,"authForPath");function authPathMatches(e,t){const r=e.split("/").filter(Boolean),s=(t.split("?")[0]??"").split("/").filter(Boolean);if(s.length<r.length)return!1;for(let n=0;n<r.length;n++){const o=r[n];if(!(o==="*"||o.startsWith(":"))&&o!==s[n])return!1}return!0}i(authPathMatches,"authPathMatches"),u(authPathMatches,"authPathMatches"),a(authPathMatches,"authPathMatches");function authRuleFor(e,t,r){const s=r.toUpperCase();for(const n of e?.overrides??[]){if(!authPathMatches(n.path,t)||n.methods&&!n.methods.some(l=>l.toUpperCase()===s))continue;const o=n.rule??(n.permission?{attr:"perms",op:"hastoken",value:n.permission}:void 0);return{mode:n.mode??e?.default??"jwt",...o?{rule:o}:{}}}return{mode:e?.default??"jwt"}}i(authRuleFor,"authRuleFor"),u(authRuleFor,"authRuleFor"),a(authRuleFor,"authRuleFor");function authRuleForPath(e,t,r,s){return s?{mode:"internal"}:authRuleFor(e.auth,t,r)}i(authRuleForPath,"authRuleForPath"),u(authRuleForPath,"authRuleForPath"),a(authRuleForPath,"authRuleForPath");function buildRouteTable(e){const t=[];for(const r of e){const s=r.auth?.default??"jwt";for(const n of r.mounts){const o={service:r.service,...n.path?{prefix:n.path}:{},...r.prependPrefix?{prependPrefix:r.prependPrefix}:{},...r.upstream?{upstream:r.upstream}:{}};t.push({...o,host:n.host,auth:s}),r.internal&&r.internalHost!==!1&&t.push({...o,host:typeof r.internalHost=="string"?r.internalHost:`internal.${n.host}`,internal:!0,auth:"internal"})}r.default&&t.push({service:r.service,...r.prependPrefix?{prependPrefix:r.prependPrefix}:{},...r.upstream?{upstream:r.upstream}:{},default:!0,auth:s})}return sortBySpecificity(t)}i(buildRouteTable,"buildRouteTable"),u(buildRouteTable,"buildRouteTable"),a(buildRouteTable,"buildRouteTable");function manifestFromClusterDecl(e,t){const r=t.upstream??(t.port?`http://localhost:${t.port}`:void 0);if(!(!t.service&&!r))return{service:t.service??e,mounts:t.host?[{host:t.host,...t.path?{path:t.path}:{}}]:[],internal:!!t.service,...t.internalHost!==void 0?{internalHost:t.internalHost}:{},...t.default?{default:!0}:{},...t.prependPrefix?{prependPrefix:t.prependPrefix}:{},...t.auth?{auth:t.auth}:{},...r?{upstream:r}:{}}}i(manifestFromClusterDecl,"manifestFromClusterDecl"),u(manifestFromClusterDecl,"manifestFromClusterDecl"),a(manifestFromClusterDecl,"manifestFromClusterDecl");const isGroup=a(e=>"all"in e||"any"in e||"not"in e,"isGroup"),reCache=new Map,compileRe=a(e=>{if(e.length>512)return null;if(reCache.has(e))return reCache.get(e);let t;try{t=new RegExp(e)}catch{t=null}return reCache.set(e,t),t},"compileRe");function ipToInt(e){const t=(e.startsWith("::ffff:")?e.slice(7):e).split(".");if(t.length!==4)return null;let r=0;for(const s of t){const n=Number(s);if(!Number.isInteger(n)||n<0||n>255||s.length>1&&s[0]==="0")return null;r=r*256+n}return r>>>0}i(ipToInt,"ipToInt"),u(ipToInt,"ipToInt"),a(ipToInt,"ipToInt");function matchCidr(e,t){const r=t.indexOf("/");if(r<0)return!1;const s=Number(t.slice(r+1));if(!Number.isInteger(s)||s<0||s>32)return!1;const n=ipToInt(e),o=ipToInt(t.slice(0,r));if(n===null||o===null)return!1;if(s===0)return!0;const l=(s===32?4294967295:~((1<<32-s)-1))>>>0;return(n&l)>>>0===(o&l)>>>0}i(matchCidr,"matchCidr"),u(matchCidr,"matchCidr"),a(matchCidr,"matchCidr");const str=a(e=>e==null?"":String(e),"str"),eq=a((e,t)=>str(e)===str(t),"eq");function evalCondition(e,t){const r=t[e.attr],s=r!=null;switch(e.op){case"exists":return s;case"ne":return!s||!eq(r,e.value)}if(!s)return!1;switch(e.op){case"eq":return eq(r,e.value);case"in":return Array.isArray(e.value)&&e.value.some(n=>Array.isArray(r)?r.some(o=>eq(o,n)):eq(r,n));case"nin":return!(Array.isArray(e.value)&&e.value.some(n=>Array.isArray(r)?r.some(o=>eq(o,n)):eq(r,n)));case"prefix":return str(r).startsWith(str(e.value));case"suffix":return str(r).endsWith(str(e.value));case"contains":return Array.isArray(r)?r.some(n=>eq(n,e.value)):str(r).includes(str(e.value));case"hastoken":{const n=str(e.value);return Array.isArray(r)?r.some(o=>eq(o,e.value)):str(r).split(/[\s,]+/).filter(Boolean).includes(n)}case"regex":{const n=compileRe(str(e.value));return n?n.test(str(r)):!1}case"gt":return Number(r)>Number(e.value);case"lt":return Number(r)<Number(e.value);case"cidr":return matchCidr(str(r),str(e.value));default:return!1}}i(evalCondition,"evalCondition"),u(evalCondition,"evalCondition"),a(evalCondition,"evalCondition");function evalRule(e,t){if(!isGroup(e))return evalCondition(e,t);const r=Array.isArray(e.all)&&e.all.length?e.all:void 0,s=Array.isArray(e.any)&&e.any.length?e.any:void 0,n=e.not&&Object.keys(e.not).length?e.not:void 0;return n&&evalRule(n,t)||r&&!r.every(o=>evalRule(o,t))||s&&!s.some(o=>evalRule(o,t))?!1:!!(r||s||n)}i(evalRule,"evalRule"),u(evalRule,"evalRule"),a(evalRule,"evalRule");function pickTargetedVersion(e,t){for(const r of e)if(evalRule(r.when,t))return{version:r.version,...r.name?{rule:r.name}:{}}}i(pickTargetedVersion,"pickTargetedVersion"),u(pickTargetedVersion,"pickTargetedVersion"),a(pickTargetedVersion,"pickTargetedVersion");function fnv1a(e){let t=2166136261;for(let r=0;r<e.length;r++)t^=e.charCodeAt(r),t=Math.imul(t,16777619);return t>>>0}i(fnv1a,"fnv1a"),u(fnv1a,"fnv1a"),a(fnv1a,"fnv1a");function bucketByWeight(e,t){const r=t.reduce((o,l)=>o+Math.max(0,l),0);if(r<=0||t.length===0)return 0;const s=fnv1a(e)%1e4;let n=0;for(let o=0;o<t.length;o++)if(n+=Math.max(0,t[o])/r*1e4,s<n)return o;return t.length-1}i(bucketByWeight,"bucketByWeight"),u(bucketByWeight,"bucketByWeight"),a(bucketByWeight,"bucketByWeight");
+"use strict";var h=Object.defineProperty;var u=(t,e)=>h(t,"name",{value:e,configurable:!0});var f=Object.defineProperty,a=u((t,e)=>f(t,"name",{value:e,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0}),exports.smoothWeightedSelector=smoothWeightedSelector,exports.hostMatches=hostMatches,exports.matchRoute=matchRoute,exports.sortBySpecificity=sortBySpecificity,exports.authForPath=authForPath,exports.authPathMatches=authPathMatches,exports.authRuleFor=authRuleFor,exports.authRuleForPath=authRuleForPath,exports.buildRouteTable=buildRouteTable,exports.manifestFromClusterDecl=manifestFromClusterDecl,exports.matchCidr=matchCidr,exports.evalRule=evalRule,exports.pickTargetedVersion=pickTargetedVersion,exports.fnv1a=fnv1a,exports.bucketByWeight=bucketByWeight;function smoothWeightedSelector(t){const e=t.map(()=>0),r=t.reduce((o,n)=>o+Math.max(0,n),0);return()=>{if(r<=0||t.length===0)return 0;let o=0;for(let n=0;n<t.length;n++)e[n]+=Math.max(0,t[n]),e[n]>e[o]&&(o=n);return e[o]-=r,o}}u(smoothWeightedSelector,"smoothWeightedSelector"),a(smoothWeightedSelector,"smoothWeightedSelector");function hostMatches(t,e){return t.startsWith("*.")?e.endsWith(t.slice(1))||e===t.slice(2):e===t}u(hostMatches,"hostMatches"),a(hostMatches,"hostMatches");function matchRoute(t,e,r){const o=t.some(s=>s.host&&hostMatches(s.host,e));let n;if(o)n=t.filter(s=>s.host&&hostMatches(s.host,e)),n.some(s=>s.host===e)&&(n=n.filter(s=>s.host===e));else{const s=t.filter(i=>!i.host);if(s.length<=1)n=s;else{const i=s.filter(l=>l.apex&&(e===l.apex||e.endsWith("."+l.apex))).sort((l,c)=>c.apex.length-l.apex.length);n=i.length>0?i:s.filter(l=>!l.apex)}}return n.find(s=>!s.prefix||r.startsWith(s.prefix))}u(matchRoute,"matchRoute"),a(matchRoute,"matchRoute");function sortBySpecificity(t){return t.sort((e,r)=>(r.host?2:0)+(r.prefix?1:0)-((e.host?2:0)+(e.prefix?1:0))),t}u(sortBySpecificity,"sortBySpecificity"),a(sortBySpecificity,"sortBySpecificity");function authForPath(t,e,r){if(r)return"internal";const o=t.auth?.overrides??[];for(const n of o)if(e.startsWith(n.path))return n.mode;return t.auth?.default??"jwt"}u(authForPath,"authForPath"),a(authForPath,"authForPath");function authPathMatches(t,e){const r=t.split("/").filter(Boolean),o=(e.split("?")[0]??"").split("/").filter(Boolean);if(o.length<r.length)return!1;for(let n=0;n<r.length;n++){const s=r[n];if(!(s==="*"||s.startsWith(":"))&&s!==o[n])return!1}return!0}u(authPathMatches,"authPathMatches"),a(authPathMatches,"authPathMatches");function authRuleFor(t,e,r){const o=r.toUpperCase();for(const n of t?.overrides??[]){if(!authPathMatches(n.path,e)||n.methods&&!n.methods.some(i=>i.toUpperCase()===o))continue;const s=n.rule??(n.permission?{attr:"perms",op:"hastoken",value:n.permission}:void 0);return{mode:n.mode??t?.default??"jwt",...s?{rule:s}:{}}}return{mode:t?.default??"jwt"}}u(authRuleFor,"authRuleFor"),a(authRuleFor,"authRuleFor");function authRuleForPath(t,e,r,o){return o?{mode:"internal"}:authRuleFor(t.auth,e,r)}u(authRuleForPath,"authRuleForPath"),a(authRuleForPath,"authRuleForPath");function buildRouteTable(t){const e=[];for(const r of t){const o=r.auth?.default??"jwt";for(const n of r.mounts){const s={service:r.service,...n.path?{prefix:n.path}:{},...r.prependPrefix?{prependPrefix:r.prependPrefix}:{},...r.upstream?{upstream:r.upstream}:{}};e.push({...s,host:n.host,auth:o}),r.internal&&r.internalHost!==!1&&e.push({...s,host:typeof r.internalHost=="string"?r.internalHost:`internal.${n.host}`,internal:!0,auth:"internal"})}r.default&&e.push({service:r.service,...r.prependPrefix?{prependPrefix:r.prependPrefix}:{},...r.upstream?{upstream:r.upstream}:{},default:!0,auth:o})}return sortBySpecificity(e)}u(buildRouteTable,"buildRouteTable"),a(buildRouteTable,"buildRouteTable");function manifestFromClusterDecl(t,e){const r=e.upstream??(e.port?`http://localhost:${e.port}`:void 0);if(!(!e.service&&!r))return{service:e.service??t,mounts:e.host?[{host:e.host,...e.path?{path:e.path}:{}}]:[],internal:!!e.service,...e.internalHost!==void 0?{internalHost:e.internalHost}:{},...e.default?{default:!0}:{},...e.prependPrefix?{prependPrefix:e.prependPrefix}:{},...e.auth?{auth:e.auth}:{},...r?{upstream:r}:{}}}u(manifestFromClusterDecl,"manifestFromClusterDecl"),a(manifestFromClusterDecl,"manifestFromClusterDecl");const isGroup=a(t=>"all"in t||"any"in t||"not"in t,"isGroup"),reCache=new Map,compileRe=a(t=>{if(t.length>512)return null;if(reCache.has(t))return reCache.get(t);let e;try{e=new RegExp(t)}catch{e=null}return reCache.set(t,e),e},"compileRe");function ipToInt(t){const e=(t.startsWith("::ffff:")?t.slice(7):t).split(".");if(e.length!==4)return null;let r=0;for(const o of e){const n=Number(o);if(!Number.isInteger(n)||n<0||n>255||o.length>1&&o[0]==="0")return null;r=r*256+n}return r>>>0}u(ipToInt,"ipToInt"),a(ipToInt,"ipToInt");function matchCidr(t,e){const r=e.indexOf("/");if(r<0)return!1;const o=Number(e.slice(r+1));if(!Number.isInteger(o)||o<0||o>32)return!1;const n=ipToInt(t),s=ipToInt(e.slice(0,r));if(n===null||s===null)return!1;if(o===0)return!0;const i=(o===32?4294967295:~((1<<32-o)-1))>>>0;return(n&i)>>>0===(s&i)>>>0}u(matchCidr,"matchCidr"),a(matchCidr,"matchCidr");const str=a(t=>t==null?"":String(t),"str"),eq=a((t,e)=>str(t)===str(e),"eq");function evalCondition(t,e){const r=e[t.attr],o=r!=null;switch(t.op){case"exists":return o;case"ne":return!o||!eq(r,t.value)}if(!o)return!1;switch(t.op){case"eq":return eq(r,t.value);case"in":return Array.isArray(t.value)&&t.value.some(n=>Array.isArray(r)?r.some(s=>eq(s,n)):eq(r,n));case"nin":return!(Array.isArray(t.value)&&t.value.some(n=>Array.isArray(r)?r.some(s=>eq(s,n)):eq(r,n)));case"prefix":return str(r).startsWith(str(t.value));case"suffix":return str(r).endsWith(str(t.value));case"contains":return Array.isArray(r)?r.some(n=>eq(n,t.value)):str(r).includes(str(t.value));case"hastoken":{const n=str(t.value);return Array.isArray(r)?r.some(s=>eq(s,t.value)):str(r).split(/[\s,]+/).filter(Boolean).includes(n)}case"regex":{const n=compileRe(str(t.value));return n?n.test(str(r)):!1}case"gt":return Number(r)>Number(t.value);case"lt":return Number(r)<Number(t.value);case"cidr":return matchCidr(str(r),str(t.value));default:return!1}}u(evalCondition,"evalCondition"),a(evalCondition,"evalCondition");function evalRule(t,e){if(!isGroup(t))return evalCondition(t,e);const r=Array.isArray(t.all)&&t.all.length?t.all:void 0,o=Array.isArray(t.any)&&t.any.length?t.any:void 0,n=t.not&&Object.keys(t.not).length?t.not:void 0;return n&&evalRule(n,e)||r&&!r.every(s=>evalRule(s,e))||o&&!o.some(s=>evalRule(s,e))?!1:!!(r||o||n)}u(evalRule,"evalRule"),a(evalRule,"evalRule");function pickTargetedVersion(t,e){for(const r of t)if(evalRule(r.when,e))return{version:r.version,...r.name?{rule:r.name}:{}}}u(pickTargetedVersion,"pickTargetedVersion"),a(pickTargetedVersion,"pickTargetedVersion");function fnv1a(t){let e=2166136261;for(let r=0;r<t.length;r++)e^=t.charCodeAt(r),e=Math.imul(e,16777619);return e>>>0}u(fnv1a,"fnv1a"),a(fnv1a,"fnv1a");function bucketByWeight(t,e){const r=e.reduce((s,i)=>s+Math.max(0,i),0);if(r<=0||e.length===0)return 0;const o=fnv1a(t)%1e4;let n=0;for(let s=0;s<e.length;s++)if(n+=Math.max(0,e[s])/r*1e4,o<n)return s;return e.length-1}u(bucketByWeight,"bucketByWeight"),a(bucketByWeight,"bucketByWeight");

package/executors/gateway/metrics.js

@@ -1 +1 @@
-"use strict";var v=Object.defineProperty;var i=(r,e)=>v(r,"name",{value:e,configurable:!0});var y=Object.defineProperty,l=i((r,e)=>y(r,"name",{value:e,configurable:!0}),"l"),f=Object.defineProperty,p=l((r,e)=>f(r,"name",{value:e,configurable:!0}),"p");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createProcessMetrics=createProcessMetrics;const node_perf_hooks_1=require("node:perf_hooks"),MB=1024*1024,round=p((r,e=1)=>{const t=10**e;return Math.round(r*t)/t},"round");function createProcessMetrics(){const r=Date.now(),e=(0,node_perf_hooks_1.monitorEventLoopDelay)({resolution:10});e.enable();let t=process.cpuUsage(),M=Date.now(),o=0,d=0,m=0,x=0,u=0;const a=p(s=>round(s/1e6,2),"lagMs");return{recordRequest(s){o+=1,s>=500||s===0?x+=1:s>=400?m+=1:s>=200&&(d+=1)},snapshot(){const s=Date.now(),h=Math.max(1,s-M),n=process.cpuUsage(t),c=process.memoryUsage(),g=(n.user+n.system)/1e3,b={uptimeSec:Math.round((s-r)/1e3),rssMB:round(c.rss/MB),heapUsedMB:round(c.heapUsed/MB),heapTotalMB:round(c.heapTotal/MB),externalMB:round(c.external/MB),cpu:{userMs:round(n.user/1e3),systemMs:round(n.system/1e3),percent:round(g/h*100)},loopLagMs:{mean:a(e.mean),p50:a(e.percentile(50)),p90:a(e.percentile(90)),p99:a(e.percentile(99)),max:a(e.max)},requests:{total:o,sinceLast:o-u,perSec:Math.round((o-u)/h*1e3),s2xx:d,s4xx:m,s5xx:x}};return t=process.cpuUsage(),M=s,u=o,e.reset(),b},stop(){e.disable()}}}i(createProcessMetrics,"createProcessMetrics"),l(createProcessMetrics,"createProcessMetrics"),p(createProcessMetrics,"createProcessMetrics");
+"use strict";var y=Object.defineProperty;var l=(r,e)=>y(r,"name",{value:e,configurable:!0});var f=Object.defineProperty,p=l((r,e)=>f(r,"name",{value:e,configurable:!0}),"p");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createProcessMetrics=createProcessMetrics;const node_perf_hooks_1=require("node:perf_hooks"),MB=1024*1024,round=p((r,e=1)=>{const t=10**e;return Math.round(r*t)/t},"round");function createProcessMetrics(){const r=Date.now(),e=(0,node_perf_hooks_1.monitorEventLoopDelay)({resolution:10});e.enable();let t=process.cpuUsage(),i=Date.now(),o=0,M=0,d=0,m=0,u=0;const a=p(s=>round(s/1e6,2),"lagMs");return{recordRequest(s){o+=1,s>=500||s===0?m+=1:s>=400?d+=1:s>=200&&(M+=1)},snapshot(){const s=Date.now(),x=Math.max(1,s-i),n=process.cpuUsage(t),c=process.memoryUsage(),h=(n.user+n.system)/1e3,g={uptimeSec:Math.round((s-r)/1e3),rssMB:round(c.rss/MB),heapUsedMB:round(c.heapUsed/MB),heapTotalMB:round(c.heapTotal/MB),externalMB:round(c.external/MB),cpu:{userMs:round(n.user/1e3),systemMs:round(n.system/1e3),percent:round(h/x*100)},loopLagMs:{mean:a(e.mean),p50:a(e.percentile(50)),p90:a(e.percentile(90)),p99:a(e.percentile(99)),max:a(e.max)},requests:{total:o,sinceLast:o-u,perSec:Math.round((o-u)/x*1e3),s2xx:M,s4xx:d,s5xx:m}};return t=process.cpuUsage(),i=s,u=o,e.reset(),g},stop(){e.disable()}}}l(createProcessMetrics,"createProcessMetrics"),p(createProcessMetrics,"createProcessMetrics");

package/executors/gateway/otel-tracing.js

@@ -1 +1 @@
-"use strict";var y=Object.defineProperty;var p=(e,r)=>y(e,"name",{value:r,configurable:!0});var O=Object.defineProperty,c=p((e,r)=>O(e,"name",{value:r,configurable:!0}),"c"),T=Object.defineProperty,o=c((e,r)=>T(e,"name",{value:r,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.setupTracing=setupTracing;const api_1=require("@opentelemetry/api"),core_1=require("@opentelemetry/core"),sdk_trace_base_1=require("@opentelemetry/sdk-trace-base"),resources_1=require("@opentelemetry/resources"),exporter_trace_otlp_http_1=require("@opentelemetry/exporter-trace-otlp-http"),firstHeader=o((e,r)=>{const t=e[r.toLowerCase()];return Array.isArray(t)?t[0]:t},"firstHeader"),getter={keys:o(e=>Object.keys(e),"keys"),get:o((e,r)=>firstHeader(e,r),"get")},setter={set:o((e,r,t)=>{e[r.toLowerCase()]=t},"set")};function setupTracing(e={}){const r=e.endpoint??process.env.OTEL_EXPORTER_OTLP_ENDPOINT;if(!r)return;const t=r.replace(/\/+$/,""),d=/\/v1\/traces$/.test(t)?t:`${t}/v1/traces`,l=new exporter_trace_otlp_http_1.OTLPTraceExporter({url:d,...e.headers?{headers:e.headers}:{}}),i=new sdk_trace_base_1.BasicTracerProvider({resource:(0,resources_1.resourceFromAttributes)({"service.name":e.serviceName??process.env.OTEL_SERVICE_NAME??"lensmcp-gateway"}),sampler:new sdk_trace_base_1.ParentBasedSampler({root:new sdk_trace_base_1.TraceIdRatioBasedSampler(e.sampleRatio??1)}),spanProcessors:[new sdk_trace_base_1.BatchSpanProcessor(l)]}),_=i.getTracer("lensmcp-gateway"),u=new core_1.W3CTraceContextPropagator;return{startSpan(s,a,n){const m=u.extract(api_1.ROOT_CONTEXT,s.headers,getter);return _.startSpan(a,{kind:api_1.SpanKind.SERVER,attributes:n},m)},inject(s,a){u.inject(api_1.trace.setSpan(api_1.ROOT_CONTEXT,s),a,setter)},end(s,a,n){n&&s.setAttributes(n),s.setAttribute("http.response.status_code",a),(a>=500||a===0)&&s.setStatus({code:api_1.SpanStatusCode.ERROR}),s.end()},shutdown:o(()=>i.shutdown(),"shutdown")}}p(setupTracing,"setupTracing"),c(setupTracing,"setupTracing"),o(setupTracing,"setupTracing");
+"use strict";var O=Object.defineProperty;var c=(e,r)=>O(e,"name",{value:r,configurable:!0});var T=Object.defineProperty,o=c((e,r)=>T(e,"name",{value:r,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.setupTracing=setupTracing;const api_1=require("@opentelemetry/api"),core_1=require("@opentelemetry/core"),sdk_trace_base_1=require("@opentelemetry/sdk-trace-base"),resources_1=require("@opentelemetry/resources"),exporter_trace_otlp_http_1=require("@opentelemetry/exporter-trace-otlp-http"),firstHeader=o((e,r)=>{const t=e[r.toLowerCase()];return Array.isArray(t)?t[0]:t},"firstHeader"),getter={keys:o(e=>Object.keys(e),"keys"),get:o((e,r)=>firstHeader(e,r),"get")},setter={set:o((e,r,t)=>{e[r.toLowerCase()]=t},"set")};function setupTracing(e={}){const r=e.endpoint??process.env.OTEL_EXPORTER_OTLP_ENDPOINT;if(!r)return;const t=r.replace(/\/+$/,""),u=/\/v1\/traces$/.test(t)?t:`${t}/v1/traces`,d=new exporter_trace_otlp_http_1.OTLPTraceExporter({url:u,...e.headers?{headers:e.headers}:{}}),p=new sdk_trace_base_1.BasicTracerProvider({resource:(0,resources_1.resourceFromAttributes)({"service.name":e.serviceName??process.env.OTEL_SERVICE_NAME??"lensmcp-gateway"}),sampler:new sdk_trace_base_1.ParentBasedSampler({root:new sdk_trace_base_1.TraceIdRatioBasedSampler(e.sampleRatio??1)}),spanProcessors:[new sdk_trace_base_1.BatchSpanProcessor(d)]}),_=p.getTracer("lensmcp-gateway"),i=new core_1.W3CTraceContextPropagator;return{startSpan(s,a,n){const l=i.extract(api_1.ROOT_CONTEXT,s.headers,getter);return _.startSpan(a,{kind:api_1.SpanKind.SERVER,attributes:n},l)},inject(s,a){i.inject(api_1.trace.setSpan(api_1.ROOT_CONTEXT,s),a,setter)},end(s,a,n){n&&s.setAttributes(n),s.setAttribute("http.response.status_code",a),(a>=500||a===0)&&s.setStatus({code:api_1.SpanStatusCode.ERROR}),s.end()},shutdown:o(()=>p.shutdown(),"shutdown")}}c(setupTracing,"setupTracing"),o(setupTracing,"setupTracing");

package/executors/gateway/prod-gateway.lib.js

@@ -1 +1 @@
-"use strict";var u=Object.defineProperty;var n=(r,t)=>u(r,"name",{value:t,configurable:!0});var s=Object.defineProperty,o=n((r,t)=>s(r,"name",{value:t,configurable:!0}),"o"),a=Object.defineProperty,e=o((r,t)=>a(r,"name",{value:t,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.startProdGateway=void 0;var server_1=require("./prod-runtime/server");Object.defineProperty(exports,"startProdGateway",{enumerable:!0,get:e(function(){return server_1.startProdGateway},"get")});
+"use strict";var s=Object.defineProperty;var o=(r,t)=>s(r,"name",{value:t,configurable:!0});var a=Object.defineProperty,e=o((r,t)=>a(r,"name",{value:t,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.startProdGateway=void 0;var server_1=require("./prod-runtime/server");Object.defineProperty(exports,"startProdGateway",{enumerable:!0,get:e(function(){return server_1.startProdGateway},"get")});

package/executors/gateway/prod-runtime/access-log.js

@@ -1 +1 @@
-"use strict";var p=Object.defineProperty;var v=(s,e)=>p(s,"name",{value:e,configurable:!0});var u=Object.defineProperty,d=v((s,e)=>u(s,"name",{value:e,configurable:!0}),"d"),n=Object.defineProperty,l=d((s,e)=>n(s,"name",{value:e,configurable:!0}),"l");Object.defineProperty(exports,"__esModule",{value:!0}),exports.logAccess=void 0;const logAccess=l((s,e,t)=>{const r=s.raw,o=e.statusCode??0,a=(r.headers.host||"").split(":")[0],c=(r.url||"/").split("?")[0],i=Math.round(e.elapsedTime);try{console.log(JSON.stringify({severity:o>=500?"ERROR":o>=400?"WARNING":"INFO",time:new Date().toISOString(),message:`${r.method} ${a}${c} ${o} ${i}ms`,method:r.method,host:a,path:c,status:o,ms:i,...t?{service:t.route.service,upstream:t.upLabel}:{},...t?.version?{version:t.version}:{},...t?.caller?{caller:t.caller}:{},...r.headers["x-request-id"]?{requestId:String(r.headers["x-request-id"])}:{}}))}catch{}},"logAccess");exports.logAccess=logAccess;
+"use strict";var u=Object.defineProperty;var d=(r,s)=>u(r,"name",{value:s,configurable:!0});var n=Object.defineProperty,l=d((r,s)=>n(r,"name",{value:s,configurable:!0}),"l");Object.defineProperty(exports,"__esModule",{value:!0}),exports.logAccess=void 0;const logAccess=l((r,s,e)=>{const t=r.raw,o=s.statusCode??0,a=(t.headers.host||"").split(":")[0],c=(t.url||"/").split("?")[0],i=Math.round(s.elapsedTime);try{console.log(JSON.stringify({severity:o>=500?"ERROR":o>=400?"WARNING":"INFO",time:new Date().toISOString(),message:`${t.method} ${a}${c} ${o} ${i}ms`,method:t.method,host:a,path:c,status:o,ms:i,...e?{service:e.route.service,upstream:e.upLabel}:{},...e?.version?{version:e.version}:{},...e?.caller?{caller:e.caller}:{},...t.headers["x-request-id"]?{requestId:String(t.headers["x-request-id"])}:{}}))}catch{}},"logAccess");exports.logAccess=logAccess;

package/executors/gateway/prod-runtime/app.js

@@ -1 +1 @@
-"use strict";var A=Object.defineProperty;var f=(a,i)=>A(a,"name",{value:i,configurable:!0});var q=Object.defineProperty,p=f((a,i)=>q(a,"name",{value:i,configurable:!0}),"p"),_=Object.defineProperty,l=p((a,i)=>_(a,"name",{value:i,configurable:!0}),"l");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createApp=createApp;const tslib_1=require("tslib"),node_crypto_1=require("node:crypto"),fastify_1=tslib_1.__importDefault(require("fastify")),reply_from_1=tslib_1.__importDefault(require("@fastify/reply-from")),edge_1=require("./edge"),trust_1=require("./trust"),access_log_1=require("./access-log");function createApp(a){const{rt:i,obs:c,cors:T,hooks:y,handler:g,upgrade:b,reqState:m,spanByReq:v,ctxByReq:h}=a,e=i.opts;return{buildApp:l(async()=>{const k=e.server?.keepAliveTimeout??62e4,n=(0,fastify_1.default)({logger:!1,keepAliveTimeout:k,requestTimeout:e.server?.requestTimeout??0,...e.server?.connectionTimeout!==void 0?{connectionTimeout:e.server.connectionTimeout}:{},...e.trustProxyIp?{trustProxy:!0}:{},...e.tls?{https:{key:e.tls.key,cert:e.tls.cert}}:{}});return n.server.headersTimeout=e.server?.headersTimeout??k+1e4,n.removeAllContentTypeParsers(),n.addContentTypeParser("*",(o,r,s)=>s(null,r)),await n.register(reply_from_1.default,{disableRequestLogging:!0,undici:{connections:e.undici?.connections??256,pipelining:e.undici?.pipelining??1,keepAliveTimeout:e.undici?.keepAliveTimeout??6e4,bodyTimeout:e.undici?.bodyTimeout??0,headersTimeout:e.undici?.headersTimeout??6e4,...e.undici?.allowH2?{allowH2:!0}:{},connect:{rejectUnauthorized:e.undici?.rejectUnauthorized??!1,...e.undici?.cert?{cert:e.undici.cert}:{},...e.undici?.key?{key:e.undici.key}:{},...e.undici?.ca?{ca:e.undici.ca}:{}}}}),n.get("/livez",(o,r)=>{r.type("text/plain").send("ok")}),n.get("/readyz",(o,r)=>{const s=i.table.routes.length>0;r.code(s?200:503).type("text/plain").send(s?"ready":"no routes loaded")}),n.get("/statusz",(o,r)=>{if(!e.statusEndpoint||!e.statusToken){r.code(404).type("text/plain").send("not found");return}const s=o.query?.token??(0,edge_1.hdr)(o.raw.headers["x-status-token"])??"",t=Buffer.from(s),u=Buffer.from(e.statusToken);if(t.length!==u.length||!(0,node_crypto_1.timingSafeEqual)(t,u)){r.code(401).type("text/plain").send("unauthorized");return}r.type("application/json").send(JSON.stringify({generatedAt:Date.now(),services:c.buildStatusSnapshot(),endpoints:e.healthChecker?.snapshot()??[]}))}),n.get("/metricsz",(o,r)=>{if(!e.metrics||!e.statusToken){r.code(404).type("text/plain").send("not found");return}const s=o.query?.token??(0,edge_1.hdr)(o.raw.headers["x-status-token"])??"",t=Buffer.from(s),u=Buffer.from(e.statusToken);if(t.length!==u.length||!(0,node_crypto_1.timingSafeEqual)(t,u)){r.code(401).type("text/plain").send("unauthorized");return}r.type("application/json").send(JSON.stringify(e.metrics.snapshot()))}),n.addHook("onRequest",(o,r,s)=>{(0,trust_1.stripTrust)(o.raw),s()}),n.addHook("onSend",(o,r,s,t)=>{T.applyResponseCors(o,r),t(null,s)}),n.addHook("onResponse",(o,r,s)=>{const t=m.get(o);t&&(c.recordEdge(t.route,Date.now()-t.startedAt,r.statusCode??0,t.caller,t.version),c.finish(t.trace,t.route.service,r.statusCode??0,{upstream:t.upLabel,...t.version?{version:t.version}:{},...t.caller?{caller:t.caller}:{}}),m.delete(o));const u=v.get(o);u&&(e.tracing.end(u,r.statusCode??0,{...t?.upLabel?{"upstream.url":t.upLabel}:{},...t?.version?{"lensmcp.version":t.version}:{}}),v.delete(o)),e.metrics?.recordRequest(r.statusCode??0),i.accessLog&&(0,access_log_1.logAccess)(o,r,t);const d=h.get(o);d&&(d.status=r.statusCode??0,y.has("onResponse")&&y.run("onResponse",d),h.delete(o)),s()}),n.all("/",g),n.all("/*",g),n.server.on("upgrade",b),n},"buildApp")}}f(createApp,"createApp"),p(createApp,"createApp"),l(createApp,"createApp");
+"use strict";var q=Object.defineProperty;var p=(a,u)=>q(a,"name",{value:u,configurable:!0});var _=Object.defineProperty,l=p((a,u)=>_(a,"name",{value:u,configurable:!0}),"l");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createApp=createApp;const tslib_1=require("tslib"),node_crypto_1=require("node:crypto"),fastify_1=tslib_1.__importDefault(require("fastify")),reply_from_1=tslib_1.__importDefault(require("@fastify/reply-from")),edge_1=require("./edge"),trust_1=require("./trust"),access_log_1=require("./access-log");function createApp(a){const{rt:u,obs:c,cors:k,hooks:f,handler:y,upgrade:T,reqState:g,spanByReq:m,ctxByReq:h}=a,e=u.opts;return{buildApp:l(async()=>{const v=e.server?.keepAliveTimeout??62e4,n=(0,fastify_1.default)({logger:!1,keepAliveTimeout:v,requestTimeout:e.server?.requestTimeout??0,...e.server?.connectionTimeout!==void 0?{connectionTimeout:e.server.connectionTimeout}:{},...e.trustProxyIp?{trustProxy:!0}:{},...e.tls?{https:{key:e.tls.key,cert:e.tls.cert}}:{}});return n.server.headersTimeout=e.server?.headersTimeout??v+1e4,n.removeAllContentTypeParsers(),n.addContentTypeParser("*",(s,r,o)=>o(null,r)),await n.register(reply_from_1.default,{disableRequestLogging:!0,undici:{connections:e.undici?.connections??256,pipelining:e.undici?.pipelining??1,keepAliveTimeout:e.undici?.keepAliveTimeout??6e4,bodyTimeout:e.undici?.bodyTimeout??0,headersTimeout:e.undici?.headersTimeout??6e4,...e.undici?.allowH2?{allowH2:!0}:{},connect:{rejectUnauthorized:e.undici?.rejectUnauthorized??!1,...e.undici?.cert?{cert:e.undici.cert}:{},...e.undici?.key?{key:e.undici.key}:{},...e.undici?.ca?{ca:e.undici.ca}:{}}}}),n.get("/livez",(s,r)=>{r.type("text/plain").send("ok")}),n.get("/readyz",(s,r)=>{const o=u.table.routes.length>0;r.code(o?200:503).type("text/plain").send(o?"ready":"no routes loaded")}),n.get("/statusz",(s,r)=>{if(!e.statusEndpoint||!e.statusToken){r.code(404).type("text/plain").send("not found");return}const o=s.query?.token??(0,edge_1.hdr)(s.raw.headers["x-status-token"])??"",t=Buffer.from(o),i=Buffer.from(e.statusToken);if(t.length!==i.length||!(0,node_crypto_1.timingSafeEqual)(t,i)){r.code(401).type("text/plain").send("unauthorized");return}r.type("application/json").send(JSON.stringify({generatedAt:Date.now(),services:c.buildStatusSnapshot(),endpoints:e.healthChecker?.snapshot()??[]}))}),n.get("/metricsz",(s,r)=>{if(!e.metrics||!e.statusToken){r.code(404).type("text/plain").send("not found");return}const o=s.query?.token??(0,edge_1.hdr)(s.raw.headers["x-status-token"])??"",t=Buffer.from(o),i=Buffer.from(e.statusToken);if(t.length!==i.length||!(0,node_crypto_1.timingSafeEqual)(t,i)){r.code(401).type("text/plain").send("unauthorized");return}r.type("application/json").send(JSON.stringify(e.metrics.snapshot()))}),n.addHook("onRequest",(s,r,o)=>{(0,trust_1.stripTrust)(s.raw),o()}),n.addHook("onSend",(s,r,o,t)=>{k.applyResponseCors(s,r),t(null,o)}),n.addHook("onResponse",(s,r,o)=>{const t=g.get(s);t&&(c.recordEdge(t.route,Date.now()-t.startedAt,r.statusCode??0,t.caller,t.version),c.finish(t.trace,t.route.service,r.statusCode??0,{upstream:t.upLabel,...t.version?{version:t.version}:{},...t.caller?{caller:t.caller}:{}}),g.delete(s));const i=m.get(s);i&&(e.tracing.end(i,r.statusCode??0,{...t?.upLabel?{"upstream.url":t.upLabel}:{},...t?.version?{"lensmcp.version":t.version}:{}}),m.delete(s)),e.metrics?.recordRequest(r.statusCode??0),u.accessLog&&(0,access_log_1.logAccess)(s,r,t);const d=h.get(s);d&&(d.status=r.statusCode??0,f.has("onResponse")&&f.run("onResponse",d),h.delete(s)),o()}),n.all("/",y),n.all("/*",y),n.server.on("upgrade",T),n},"buildApp")}}p(createApp,"createApp"),l(createApp,"createApp");

package/executors/gateway/prod-runtime/auth.js

@@ -1 +1 @@
-"use strict";var g=Object.defineProperty;var l=(r,e)=>g(r,"name",{value:e,configurable:!0});var f=Object.defineProperty,d=l((r,e)=>f(r,"name",{value:e,configurable:!0}),"d"),k=Object.defineProperty,n=d((r,e)=>k(r,"name",{value:e,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createEdgeAuth=createEdgeAuth;const manifest_1=require("../manifest"),trust_1=require("./trust");function createEdgeAuth(r,e,c,p){return{internal:n((a,s,o)=>{const t=r.keyToProject.get(String(a.headers["x-api-key"]??""));return t?(a.headers["x-api-key-id"]=t,delete a.headers["x-api-key"],e.step(o,"auth",{mode:"x-api-key",ok:!0,caller:t}),{ok:!0,caller:t}):(e.step(o,"auth",{mode:"x-api-key",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Invalid or missing x-api-key for internal route."})},"internal"),public:n((a,s,o,t,m,i)=>{const h=r.table.manifestByService.get(s.service),u=h?(0,manifest_1.authRuleForPath)(h,o,a.method??"GET",!1):{mode:s.auth};if(u.mode==="jwt"){if(r.opts.identify){if(!t)return e.step(i,"auth",{mode:"jwt",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: invalid or missing token"}}else try{p("jwt",a)}catch(y){return e.step(i,"auth",{mode:"jwt",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:`Unauthorized: ${y.message}`}}return u.rule&&(!t||!(0,manifest_1.evalRule)(u.rule,c.buildAttrs(a,m,t,void 0)))?(e.step(i,"authz",{ok:!1}),{ok:!1,status:403,reason:"forbidden",detail:"Forbidden: insufficient permission"}):(e.step(i,"auth",{mode:"jwt",ok:!0}),t&&(0,trust_1.stampIdentity)(a,t),{ok:!0})}return e.step(i,"auth",{mode:u.mode}),{ok:!0}},"publicAuth")}}l(createEdgeAuth,"createEdgeAuth"),d(createEdgeAuth,"createEdgeAuth"),n(createEdgeAuth,"createEdgeAuth");
+"use strict";var f=Object.defineProperty;var d=(a,e)=>f(a,"name",{value:e,configurable:!0});var k=Object.defineProperty,n=d((a,e)=>k(a,"name",{value:e,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createEdgeAuth=createEdgeAuth;const manifest_1=require("../manifest"),trust_1=require("./trust");function createEdgeAuth(a,e,h,p){return{internal:n((r,u,i)=>{const t=a.keyToProject.get(String(r.headers["x-api-key"]??""));return t?(r.headers["x-api-key-id"]=t,delete r.headers["x-api-key"],e.step(i,"auth",{mode:"x-api-key",ok:!0,caller:t}),{ok:!0,caller:t}):(e.step(i,"auth",{mode:"x-api-key",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Invalid or missing x-api-key for internal route."})},"internal"),public:n((r,u,i,t,c,o)=>{const l=a.table.manifestByService.get(u.service),s=l?(0,manifest_1.authRuleForPath)(l,i,r.method??"GET",!1):{mode:u.auth};if(s.mode==="jwt"){if(a.opts.identify){if(!t)return e.step(o,"auth",{mode:"jwt",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: invalid or missing token"}}else try{p("jwt",r)}catch(m){return e.step(o,"auth",{mode:"jwt",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:`Unauthorized: ${m.message}`}}return s.rule&&(!t||!(0,manifest_1.evalRule)(s.rule,h.buildAttrs(r,c,t,void 0)))?(e.step(o,"authz",{ok:!1}),{ok:!1,status:403,reason:"forbidden",detail:"Forbidden: insufficient permission"}):(e.step(o,"auth",{mode:"jwt",ok:!0}),t&&(0,trust_1.stampIdentity)(r,t),{ok:!0})}return e.step(o,"auth",{mode:s.mode}),{ok:!0}},"publicAuth")}}d(createEdgeAuth,"createEdgeAuth"),n(createEdgeAuth,"createEdgeAuth");

package/executors/gateway/prod-runtime/cors.js

@@ -1 +1 @@
-"use strict";var d=Object.defineProperty;var l=(r,i)=>d(r,"name",{value:i,configurable:!0});var c=Object.defineProperty,t=l((r,i)=>c(r,"name",{value:i,configurable:!0}),"t"),n=Object.defineProperty,a=t((r,i)=>n(r,"name",{value:i,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createCors=createCors;function createCors(r,i){return{setCors:a((o,s)=>{const e=s.headers.origin;if(e&&r.corsCredentialOrigins.has(e.toLowerCase())){o.header("access-control-allow-origin",e),o.header("access-control-allow-credentials","true"),o.header("vary","Origin");return}o.header("access-control-allow-origin",String(e??"*")),o.header("vary","Origin")},"setCors"),applyResponseCors:a((o,s)=>{const e=o.headers.origin;e&&!s.getHeader("access-control-allow-origin")&&(r.corsCredentialOrigins.has(e.toLowerCase())?(s.header("access-control-allow-origin",e),s.header("access-control-allow-credentials","true"),s.header("vary","Origin")):i.get(o)?.proxied||(s.header("access-control-allow-origin",String(e)),s.header("vary","Origin")))},"applyResponseCors")}}l(createCors,"createCors"),t(createCors,"createCors"),a(createCors,"createCors");
+"use strict";var c=Object.defineProperty;var t=(s,i)=>c(s,"name",{value:i,configurable:!0});var n=Object.defineProperty,a=t((s,i)=>n(s,"name",{value:i,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createCors=createCors;function createCors(s,i){return{setCors:a((r,o)=>{const e=o.headers.origin;if(e&&s.corsCredentialOrigins.has(e.toLowerCase())){r.header("access-control-allow-origin",e),r.header("access-control-allow-credentials","true"),r.header("vary","Origin");return}r.header("access-control-allow-origin",String(e??"*")),r.header("vary","Origin")},"setCors"),applyResponseCors:a((r,o)=>{const e=r.headers.origin;e&&!o.getHeader("access-control-allow-origin")&&(s.corsCredentialOrigins.has(e.toLowerCase())?(o.header("access-control-allow-origin",e),o.header("access-control-allow-credentials","true"),o.header("vary","Origin")):i.get(r)?.proxied||(o.header("access-control-allow-origin",String(e)),o.header("vary","Origin")))},"applyResponseCors")}}t(createCors,"createCors"),a(createCors,"createCors");

package/executors/gateway/prod-runtime/edge.js

@@ -1 +1 @@
-"use strict";var E=Object.defineProperty;var p=(e,r)=>E(e,"name",{value:r,configurable:!0});var c=Object.defineProperty,a=p((e,r)=>c(e,"name",{value:r,configurable:!0}),"a"),i=Object.defineProperty,o=a((e,r)=>i(e,"name",{value:r,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.canonicalPath=exports.ENCODED_STRUCTURE=exports.sendError=exports.hdr=exports.eid=void 0;const node_crypto_1=require("node:crypto"),gateway_errors_1=require("../gateway-errors"),eid=o(()=>Date.now().toString(36)+(0,node_crypto_1.randomBytes)(6).toString("hex"),"eid");exports.eid=eid;const hdr=o(e=>typeof e=="string"&&e!==""?e:Array.isArray(e)?e[0]:void 0,"hdr");exports.hdr=hdr;const sendError=o((e,r,t,n,s)=>{const d=(0,gateway_errors_1.ensureRequestId)(r);return e.code(t).header("x-request-id",d).type(gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE).send((0,gateway_errors_1.gatewayErrorBody)(t,n,d,s))},"sendError");exports.sendError=sendError,exports.ENCODED_STRUCTURE=/%2e|%2f|%5c|%00|\\/i;const NEEDS_NORMALIZE=/[%;#\\]/,TRAVERSAL=/(^|\/)\.\.(?=\/|$)/,canonicalPath=o(e=>{const r=e.indexOf("?"),t=r===-1?e:e.slice(0,r);if(t.indexOf("\0")!==-1)return;if(!NEEDS_NORMALIZE.test(t))return TRAVERSAL.test(t)?void 0:t||"/";if(exports.ENCODED_STRUCTURE.test(t))return;let n;try{n=decodeURIComponent(t)}catch{return}if(!(n.includes("\0")||TRAVERSAL.test(n)))return n.split("#")[0].split("/").map(s=>s.split(";")[0]).join("/")||"/"},"canonicalPath");exports.canonicalPath=canonicalPath;
+"use strict";var c=Object.defineProperty;var a=(r,t)=>c(r,"name",{value:t,configurable:!0});var i=Object.defineProperty,o=a((r,t)=>i(r,"name",{value:t,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.canonicalPath=exports.ENCODED_STRUCTURE=exports.sendError=exports.hdr=exports.eid=void 0;const node_crypto_1=require("node:crypto"),gateway_errors_1=require("../gateway-errors"),eid=o(()=>Date.now().toString(36)+(0,node_crypto_1.randomBytes)(6).toString("hex"),"eid");exports.eid=eid;const hdr=o(r=>typeof r=="string"&&r!==""?r:Array.isArray(r)?r[0]:void 0,"hdr");exports.hdr=hdr;const sendError=o((r,t,e,n,s)=>{const d=(0,gateway_errors_1.ensureRequestId)(t);return r.code(e).header("x-request-id",d).type(gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE).send((0,gateway_errors_1.gatewayErrorBody)(e,n,d,s))},"sendError");exports.sendError=sendError,exports.ENCODED_STRUCTURE=/%2e|%2f|%5c|%00|\\/i;const NEEDS_NORMALIZE=/[%;#\\]/,TRAVERSAL=/(^|\/)\.\.(?=\/|$)/,canonicalPath=o(r=>{const t=r.indexOf("?"),e=t===-1?r:r.slice(0,t);if(e.indexOf("\0")!==-1)return;if(!NEEDS_NORMALIZE.test(e))return TRAVERSAL.test(e)?void 0:e||"/";if(exports.ENCODED_STRUCTURE.test(e))return;let n;try{n=decodeURIComponent(e)}catch{return}if(!(n.includes("\0")||TRAVERSAL.test(n)))return n.split("#")[0].split("/").map(s=>s.split(";")[0]).join("/")||"/"},"canonicalPath");exports.canonicalPath=canonicalPath;

package/executors/gateway/prod-runtime/handler.js

@@ -1 +1 @@
-"use strict";var G=Object.defineProperty;var O=(f,a)=>G(f,"name",{value:a,configurable:!0});var D=Object.defineProperty,P=O((f,a)=>D(f,"name",{value:a,configurable:!0}),"P"),j=Object.defineProperty,v=P((f,a)=>j(f,"name",{value:a,configurable:!0}),"v");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHandler=createHandler;const manifest_1=require("../manifest"),gateway_errors_1=require("../gateway-errors"),edge_1=require("./edge");function createHandler(f){const{rt:a,obs:c,cors:S,auth:A,upstream:N,rollout:w,hooks:l,reqState:M,spanByReq:C,ctxByReq:I}=f,H=!!a.opts.pods?.resolveVersion,R=!!a.opts.cookie,L=!!a.opts.pods?.bucket&&(R||!!a.opts.uidHeader),U=H||R||L,$=v((p,o,r,m)=>{const h=p.raw;if(S.setCors(o,h),h.method==="OPTIONS"){o.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(h.headers["access-control-request-headers"]??"*")).send();return}const i=a.table.routes.filter(n=>n.host&&(0,manifest_1.hostMatches)(n.host,r)&&n.prefix),s=m.split("?")[0];if(i.length>0&&(s==="/health"||s==="/healthz")){o.code(200).type("application/json").send(JSON.stringify({status:"ok",host:r,services:i.map(n=>({service:n.service,prefix:n.prefix}))}));return}if(s==="/.well-known/lensmcp-routes"){o.code(200).type("application/json").send(JSON.stringify({host:r,routes:a.table.routes.filter(n=>!n.host||(0,manifest_1.hostMatches)(n.host,r)).map(n=>({host:n.host??"(default)",service:n.service,prefix:n.prefix,internal:!!n.internal,auth:n.auth}))}));return}(0,edge_1.sendError)(o,h,404,"not_found",i.length>0?`No service mounted at ${m} on ${r}.`:"No gateway route for this hostname.")},"handleNoRoute");return async(p,o)=>{const r=p.raw,m=(r.headers.host||"").split(":")[0],h=r.url??"/",i=c.beginTrace(r);(0,gateway_errors_1.ensureRequestId)(r),c.step(i,"received",{host:m,method:r.method,url:h});const s=l.any?l.httpContext(r,p,o,i):void 0;if(s&&I.set(p,s),s&&l.has("onRequest")&&(await l.run("onRequest",s),s.responded()))return o;if(r.httpVersionMajor<1)return c.finish(i,"gateway",400),(0,edge_1.sendError)(o,r,400,"bad_request","Bad Request");const n=(0,edge_1.canonicalPath)(h);if(n===void 0)return c.step(i,"bad-path",{}),c.finish(i,"gateway",400),(0,edge_1.sendError)(o,r,400,"bad_request","Bad Request");if(a.opts.rateLimiter){const e=await a.opts.rateLimiter.check(w.clientIpOf(r,r.socket?.remoteAddress??p.ip));if(!e.allowed)return o.header("retry-after",String(Math.ceil(e.retryAfterMs/1e3))),c.step(i,"rate-limited",{}),c.finish(i,"gateway",429),(0,edge_1.sendError)(o,r,429,"rate_limited","Too Many Requests")}const t=(0,manifest_1.matchRoute)(a.table.routes,m,h);if(!t)return $(p,o,m,h),o;if(s&&(s.route=t),c.step(i,"route-match",{project:t.service,...t.prefix?{prefix:t.prefix}:{},...t.internal?{internal:!0}:{}}),r.method==="OPTIONS")return S.setCors(o,r),o.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(r.headers["access-control-request-headers"]??"*")).send(),o;const b=a.opts.tracing?.startSpan(r,`gateway ${t.service}`,{"http.request.method":r.method??"GET","url.path":h.split("?")[0],"server.address":m,"lensmcp.service":t.service,...t.internal?{"lensmcp.internal":!0}:{}});if(b&&C.set(p,b),s&&l.has("beforeAuth")&&(await l.run("beforeAuth",s),s.responded()))return o;const g=t.internal?void 0:a.opts.identify?.(r);let E;if(t.internal){const e=A.internal(r,t,i);if(!e.ok)return c.finish(i,t.service,e.status),(0,edge_1.sendError)(o,r,e.status,e.reason,e.detail);E=e.caller,s&&(s.caller=E)}else{const e=A.public(r,t,n,g,p.ip,i);if(!e.ok)return c.finish(i,t.service,e.status),(0,edge_1.sendError)(o,r,e.status,e.reason,e.detail);if(s&&(s.claims=g),s&&l.has("afterAuth")&&(await l.run("afterAuth",s),s.responded()))return o}if(a.opts.serviceKeys?.[t.service]&&(r.headers["x-internal-token"]=a.opts.serviceKeys[t.service]),t.prependPrefix){const e=r.url??"/",d=t.prependPrefix;e!==d&&!e.startsWith(d+"/")&&(r.url=d+e)}const k=(0,edge_1.hdr)(r.headers[a.versionHeader]);let x=k,q;if(U&&!t.internal&&!k){const e=w.resolveStickyKey(r);e.mint&&(q=e.key);const d=H?a.opts.pods.resolveVersion(t.service,w.buildAttrs(r,p.ip,g,e.key)):void 0;if(d)x=d.version,c.step(i,"targeting",{rule:d.rule,version:d.version});else if(e.key){const y=a.opts.pods?.bucket?.(t.service,e.key);y&&(x=y.version,c.step(i,"targeting",{mode:"sticky",version:y.version}))}}const u=await N.resolveUpstream(t,i,x);if(!u)return c.finish(i,t.service,503),(0,edge_1.sendError)(o,r,503,"unavailable",`Service ${t.service} has no available upstream.`);if(!("url"in u))return c.finish(i,t.service,502),(0,edge_1.sendError)(o,r,502,"unavailable",`Service ${t.service}: socket upstreams are not supported by the prod gateway.`);const B=new URL(u.url).origin,T=u.url,_={route:t,caller:E,startedAt:Date.now(),trace:i,version:u.version,upLabel:T};return M.set(p,_),s&&(s.version=u.version),c.step(i,u.version?"rollout":"upstream",{upstream:T,...u.version?{version:u.version,...k?{pinned:!0}:{}}:{}}),b&&a.opts.tracing.inject(b,r.headers),s&&l.has("beforeForward")&&(await l.run("beforeForward",s),s.responded())?o:o.from(void 0,{getUpstream:v(()=>B,"getUpstream"),rewriteHeaders:v(e=>{if(_.proxied=!0,e["x-lensmcp-upstream"]=T,e["x-request-id"]||(e["x-request-id"]=(0,gateway_errors_1.ensureRequestId)(r)),u.version&&(e["x-lensmcp-version"]=u.version),delete e["x-powered-by"],delete e.connection,delete e["keep-alive"],delete e["proxy-connection"],e.server="LensMCP",q){const d=e["set-cookie"],y=Array.isArray(d)?d:d?[d]:[];e["set-cookie"]=[...y,w.mintCookieHeader(q)]}return e},"rewriteHeaders"),onError:v((e,{error:d})=>{a.opts.pods?.drop?.(t.service,u),s&&l.has("onError")&&(s.error=d,l.run("onError",s)),(0,edge_1.sendError)(e,r,502,"unavailable",`Upstream ${t.service} unavailable.`)},"onError")})}}O(createHandler,"createHandler"),P(createHandler,"createHandler"),v(createHandler,"createHandler");
+"use strict";var D=Object.defineProperty;var P=(m,a)=>D(m,"name",{value:a,configurable:!0});var j=Object.defineProperty,v=P((m,a)=>j(m,"name",{value:a,configurable:!0}),"v");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHandler=createHandler;const manifest_1=require("../manifest"),gateway_errors_1=require("../gateway-errors"),edge_1=require("./edge");function createHandler(m){const{rt:a,obs:c,cors:S,auth:O,upstream:_,rollout:w,hooks:l,reqState:N,spanByReq:M,ctxByReq:C}=m,A=!!a.opts.pods?.resolveVersion,H=!!a.opts.cookie,I=!!a.opts.pods?.bucket&&(H||!!a.opts.uidHeader),L=A||H||I,U=v((p,o,r,f)=>{const h=p.raw;if(S.setCors(o,h),h.method==="OPTIONS"){o.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(h.headers["access-control-request-headers"]??"*")).send();return}const i=a.table.routes.filter(n=>n.host&&(0,manifest_1.hostMatches)(n.host,r)&&n.prefix),s=f.split("?")[0];if(i.length>0&&(s==="/health"||s==="/healthz")){o.code(200).type("application/json").send(JSON.stringify({status:"ok",host:r,services:i.map(n=>({service:n.service,prefix:n.prefix}))}));return}if(s==="/.well-known/lensmcp-routes"){o.code(200).type("application/json").send(JSON.stringify({host:r,routes:a.table.routes.filter(n=>!n.host||(0,manifest_1.hostMatches)(n.host,r)).map(n=>({host:n.host??"(default)",service:n.service,prefix:n.prefix,internal:!!n.internal,auth:n.auth}))}));return}(0,edge_1.sendError)(o,h,404,"not_found",i.length>0?`No service mounted at ${f} on ${r}.`:"No gateway route for this hostname.")},"handleNoRoute");return async(p,o)=>{const r=p.raw,f=(r.headers.host||"").split(":")[0],h=r.url??"/",i=c.beginTrace(r);(0,gateway_errors_1.ensureRequestId)(r),c.step(i,"received",{host:f,method:r.method,url:h});const s=l.any?l.httpContext(r,p,o,i):void 0;if(s&&C.set(p,s),s&&l.has("onRequest")&&(await l.run("onRequest",s),s.responded()))return o;if(r.httpVersionMajor<1)return c.finish(i,"gateway",400),(0,edge_1.sendError)(o,r,400,"bad_request","Bad Request");const n=(0,edge_1.canonicalPath)(h);if(n===void 0)return c.step(i,"bad-path",{}),c.finish(i,"gateway",400),(0,edge_1.sendError)(o,r,400,"bad_request","Bad Request");if(a.opts.rateLimiter){const e=await a.opts.rateLimiter.check(w.clientIpOf(r,r.socket?.remoteAddress??p.ip));if(!e.allowed)return o.header("retry-after",String(Math.ceil(e.retryAfterMs/1e3))),c.step(i,"rate-limited",{}),c.finish(i,"gateway",429),(0,edge_1.sendError)(o,r,429,"rate_limited","Too Many Requests")}const t=(0,manifest_1.matchRoute)(a.table.routes,f,h);if(!t)return U(p,o,f,h),o;if(s&&(s.route=t),c.step(i,"route-match",{project:t.service,...t.prefix?{prefix:t.prefix}:{},...t.internal?{internal:!0}:{}}),r.method==="OPTIONS")return S.setCors(o,r),o.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(r.headers["access-control-request-headers"]??"*")).send(),o;const g=a.opts.tracing?.startSpan(r,`gateway ${t.service}`,{"http.request.method":r.method??"GET","url.path":h.split("?")[0],"server.address":f,"lensmcp.service":t.service,...t.internal?{"lensmcp.internal":!0}:{}});if(g&&M.set(p,g),s&&l.has("beforeAuth")&&(await l.run("beforeAuth",s),s.responded()))return o;const b=t.internal?void 0:a.opts.identify?.(r);let E;if(t.internal){const e=O.internal(r,t,i);if(!e.ok)return c.finish(i,t.service,e.status),(0,edge_1.sendError)(o,r,e.status,e.reason,e.detail);E=e.caller,s&&(s.caller=E)}else{const e=O.public(r,t,n,b,p.ip,i);if(!e.ok)return c.finish(i,t.service,e.status),(0,edge_1.sendError)(o,r,e.status,e.reason,e.detail);if(s&&(s.claims=b),s&&l.has("afterAuth")&&(await l.run("afterAuth",s),s.responded()))return o}if(a.opts.serviceKeys?.[t.service]&&(r.headers["x-internal-token"]=a.opts.serviceKeys[t.service]),t.prependPrefix){const e=r.url??"/",d=t.prependPrefix;e!==d&&!e.startsWith(d+"/")&&(r.url=d+e)}const k=(0,edge_1.hdr)(r.headers[a.versionHeader]);let x=k,q;if(L&&!t.internal&&!k){const e=w.resolveStickyKey(r);e.mint&&(q=e.key);const d=A?a.opts.pods.resolveVersion(t.service,w.buildAttrs(r,p.ip,b,e.key)):void 0;if(d)x=d.version,c.step(i,"targeting",{rule:d.rule,version:d.version});else if(e.key){const y=a.opts.pods?.bucket?.(t.service,e.key);y&&(x=y.version,c.step(i,"targeting",{mode:"sticky",version:y.version}))}}const u=await _.resolveUpstream(t,i,x);if(!u)return c.finish(i,t.service,503),(0,edge_1.sendError)(o,r,503,"unavailable",`Service ${t.service} has no available upstream.`);if(!("url"in u))return c.finish(i,t.service,502),(0,edge_1.sendError)(o,r,502,"unavailable",`Service ${t.service}: socket upstreams are not supported by the prod gateway.`);const $=new URL(u.url).origin,T=u.url,R={route:t,caller:E,startedAt:Date.now(),trace:i,version:u.version,upLabel:T};return N.set(p,R),s&&(s.version=u.version),c.step(i,u.version?"rollout":"upstream",{upstream:T,...u.version?{version:u.version,...k?{pinned:!0}:{}}:{}}),g&&a.opts.tracing.inject(g,r.headers),s&&l.has("beforeForward")&&(await l.run("beforeForward",s),s.responded())?o:o.from(void 0,{getUpstream:v(()=>$,"getUpstream"),rewriteHeaders:v(e=>{if(R.proxied=!0,e["x-lensmcp-upstream"]=T,e["x-request-id"]||(e["x-request-id"]=(0,gateway_errors_1.ensureRequestId)(r)),u.version&&(e["x-lensmcp-version"]=u.version),delete e["x-powered-by"],delete e.connection,delete e["keep-alive"],delete e["proxy-connection"],e.server="LensMCP",q){const d=e["set-cookie"],y=Array.isArray(d)?d:d?[d]:[];e["set-cookie"]=[...y,w.mintCookieHeader(q)]}return e},"rewriteHeaders"),onError:v((e,{error:d})=>{a.opts.pods?.drop?.(t.service,u),s&&l.has("onError")&&(s.error=d,l.run("onError",s)),(0,edge_1.sendError)(e,r,502,"unavailable",`Upstream ${t.service} unavailable.`)},"onError")})}}P(createHandler,"createHandler"),v(createHandler,"createHandler");

package/executors/gateway/prod-runtime/hooks.js

@@ -1 +1 @@
-"use strict";var y=Object.defineProperty;var u=(o,s)=>y(o,"name",{value:s,configurable:!0});var f=Object.defineProperty,i=u((o,s)=>f(o,"name",{value:s,configurable:!0}),"i"),l=Object.defineProperty,n=i((o,s)=>l(o,"name",{value:s,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHooks=createHooks;const edge_1=require("./edge"),TERMINAL_PHASES=new Set(["onResponse","onError"]);function createHooks(o){const s=n(async(e,t)=>{const r=o[e];if(!r||r.length===0)return;const d=TERMINAL_PHASES.has(e);for(const a of r){if(!d&&t.responded())return;await a(t)}},"run"),c=n(e=>(o[e]?.length??0)>0,"has");return{any:["onRequest","beforeAuth","afterAuth","beforeForward","onResponse","onError","onUpgrade"].some(e=>c(e)),run:s,has:c,httpContext:n((e,t,r,d)=>{let a=!1;return{req:e,request:t,reply:r,socket:void 0,trace:d,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n((v,p,h)=>{(0,edge_1.sendError)(r,e,v,p,h),a=!0},"sendError"),responded:n(()=>a||r.raw.writableEnded,"responded")}},"httpContext"),upgradeContext:n((e,t,r)=>{let d=!1;return{req:e,request:void 0,reply:void 0,socket:t,trace:r,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n(()=>{try{t.destroy()}catch{}d=!0},"sendError"),responded:n(()=>d||t.destroyed,"responded")}},"upgradeContext")}}u(createHooks,"createHooks"),i(createHooks,"createHooks"),n(createHooks,"createHooks");
+"use strict";var f=Object.defineProperty;var i=(t,d)=>f(t,"name",{value:d,configurable:!0});var l=Object.defineProperty,n=i((t,d)=>l(t,"name",{value:d,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHooks=createHooks;const edge_1=require("./edge"),TERMINAL_PHASES=new Set(["onResponse","onError"]);function createHooks(t){const d=n(async(e,o)=>{const r=t[e];if(!r||r.length===0)return;const s=TERMINAL_PHASES.has(e);for(const a of r){if(!s&&o.responded())return;await a(o)}},"run"),u=n(e=>(t[e]?.length??0)>0,"has");return{any:["onRequest","beforeAuth","afterAuth","beforeForward","onResponse","onError","onUpgrade"].some(e=>u(e)),run:d,has:u,httpContext:n((e,o,r,s)=>{let a=!1;return{req:e,request:o,reply:r,socket:void 0,trace:s,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n((c,v,p)=>{(0,edge_1.sendError)(r,e,c,v,p),a=!0},"sendError"),responded:n(()=>a||r.raw.writableEnded,"responded")}},"httpContext"),upgradeContext:n((e,o,r)=>{let s=!1;return{req:e,request:void 0,reply:void 0,socket:o,trace:r,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n(()=>{try{o.destroy()}catch{}s=!0},"sendError"),responded:n(()=>s||o.destroyed,"responded")}},"upgradeContext")}}i(createHooks,"createHooks"),n(createHooks,"createHooks");

package/executors/gateway/prod-runtime/observability.js

@@ -1 +1 @@
-"use strict";var I=Object.defineProperty;var w=(o,u)=>I(o,"name",{value:u,configurable:!0});var b=Object.defineProperty,p=w((o,u)=>b(o,"name",{value:u,configurable:!0}),"p"),y=Object.defineProperty,c=p((o,u)=>y(o,"name",{value:u,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createObservability=createObservability;const redact_1=require("@lensmcp/core/redact"),edge_1=require("./edge");function createObservability(o,u){const v=c((e,t,s,r,a)=>{if(o.emit)try{o.emit({id:(0,edge_1.eid)(),sessionId:"pending",timestamp:Date.now(),source:"gateway",category:"cluster",severity:e,context:(0,redact_1.redactDeep)({sessionId:"pending",...a}),fingerprint:s,title:(0,redact_1.safeTitle)(t),raw:r&&(0,redact_1.redactDeep)(r)})}catch{}},"emit"),h=new Map,q=c((e,t,s,r,a)=>{const n=e.host??"(default)",d=(r?r+"\u21D2":"")+n+"\u2192"+e.service+(a?"@"+a:""),i=h.get(d)??{host:n,service:e.service,caller:r,version:a,count:0,totalMs:0,errors:0};i.count+=1,i.totalMs+=t,(s>=500||s===0)&&(i.errors+=1),h.set(d,i)},"recordEdge"),M=Math.max(1,o.statusWindows??12),f=[],g=new Map,S=c(()=>[...new Set(u().map(e=>e.service))],"routeServices"),$=c(()=>{const e=new Map;for(const s of h.values()){const r=e.get(s.service)??{requests:0,errors:0,totalMs:0,versions:new Set};r.requests+=s.count,r.errors+=s.errors,r.totalMs+=s.totalMs,s.version&&r.versions.add(s.version),e.set(s.service,r)}const t=Date.now();for(const[s,r]of e)r.requests>0&&g.set(s,t);for(f.push(e);f.length>M;)f.shift()},"pushStatusWindow"),m=c(()=>{const e=new Map;for(const s of f)for(const[r,a]of s){const n=e.get(r)??{requests:0,errors:0,totalMs:0,versions:new Set};n.requests+=a.requests,n.errors+=a.errors,n.totalMs+=a.totalMs;for(const d of a.versions)n.versions.add(d);e.set(r,n)}const t=u();return S().map(s=>{const r=e.get(s)??{requests:0,errors:0,totalMs:0,versions:new Set},a=[...new Set(t.filter(i=>i.service===s).map(i=>i.host??"(default)"))],n=r.requests?r.errors/r.requests:0;let d=r.requests===0?"idle":n>=.5?"down":n>=.05?"degraded":"healthy";if(o.healthChecker){const i=t.filter(l=>l.service===s&&l.upstream).map(l=>l.upstream);i.length&&i.every(l=>!o.healthChecker.isHealthy(l))&&(d="down")}return{service:s,hosts:a,status:d,requests:r.requests,errorRate:+n.toFixed(4),avgMs:r.requests?Math.round(r.totalMs/r.requests):0,versions:[...r.versions],lastSeen:g.get(s)??null}})},"buildStatusSnapshot");return{emit:v,beginTrace:c(e=>{if(!o.emit)return;const t=(0,edge_1.hdr)(e.headers["x-lensmcp-flow-id"]);let s=(0,edge_1.hdr)(e.headers["x-request-id"]);if(!(!t&&!s&&!(0,edge_1.hdr)(e.headers.traceparent)))return s||(s=(0,edge_1.eid)(),e.headers["x-request-id"]=s),{startedAt:Date.now(),method:(e.method??"GET").toUpperCase(),host:(e.headers.host||"").split(":")[0],url:e.url??"/",steps:[],...t?{flowId:t}:{},...s?{requestId:s}:{}}},"beginTrace"),step:c((e,t,s)=>{e&&e.steps.push({step:t,atMs:Date.now()-e.startedAt,...s})},"step"),finish:c((e,t,s,r)=>{!e||e.done||(e.done=!0,v(s>=500?"error":"info",`gateway ${e.method} ${e.host}${e.url} \u2192 ${s} (${Date.now()-e.startedAt}ms)`,`gateway-request:${t}`,{kind:"gateway-request",project:t,host:e.host,method:e.method,url:e.url,status:s,durationMs:Date.now()-e.startedAt,startedAt:e.startedAt,steps:e.steps,...r},{...e.flowId?{flowId:e.flowId}:{},...e.requestId?{requestId:e.requestId}:{}}))},"finish"),recordEdge:q,buildStatusSnapshot:m,startFlusher:c(()=>{const e=setInterval(()=>{if($(),o.onStatus)try{o.onStatus(m())}catch{}if(o.emit)for(const t of h.values())v(t.errors?"warning":"info",`traffic ${t.host} \u2192 ${t.service}${t.version?"@"+t.version:""}: ${t.count} req`,`gateway-traffic:${t.host}->${t.service}${t.version?"@"+t.version:""}`,{kind:"gateway-traffic",host:t.host,project:t.service,caller:t.caller,version:t.version,count:t.count,avgMs:Math.round(t.totalMs/t.count),errors:t.errors});h.clear()},o.trafficFlushMs??5e3);return e.unref?.(),e},"startFlusher")}}w(createObservability,"createObservability"),p(createObservability,"createObservability"),c(createObservability,"createObservability");
+"use strict";var b=Object.defineProperty;var p=(o,d)=>b(o,"name",{value:d,configurable:!0});var y=Object.defineProperty,c=p((o,d)=>y(o,"name",{value:d,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createObservability=createObservability;const redact_1=require("@lensmcp/core/redact"),edge_1=require("./edge");function createObservability(o,d){const v=c((e,t,s,r,a)=>{if(o.emit)try{o.emit({id:(0,edge_1.eid)(),sessionId:"pending",timestamp:Date.now(),source:"gateway",category:"cluster",severity:e,context:(0,redact_1.redactDeep)({sessionId:"pending",...a}),fingerprint:s,title:(0,redact_1.safeTitle)(t),raw:r&&(0,redact_1.redactDeep)(r)})}catch{}},"emit"),h=new Map,q=c((e,t,s,r,a)=>{const n=e.host??"(default)",u=(r?r+"\u21D2":"")+n+"\u2192"+e.service+(a?"@"+a:""),i=h.get(u)??{host:n,service:e.service,caller:r,version:a,count:0,totalMs:0,errors:0};i.count+=1,i.totalMs+=t,(s>=500||s===0)&&(i.errors+=1),h.set(u,i)},"recordEdge"),m=Math.max(1,o.statusWindows??12),f=[],w=new Map,M=c(()=>[...new Set(d().map(e=>e.service))],"routeServices"),S=c(()=>{const e=new Map;for(const s of h.values()){const r=e.get(s.service)??{requests:0,errors:0,totalMs:0,versions:new Set};r.requests+=s.count,r.errors+=s.errors,r.totalMs+=s.totalMs,s.version&&r.versions.add(s.version),e.set(s.service,r)}const t=Date.now();for(const[s,r]of e)r.requests>0&&w.set(s,t);for(f.push(e);f.length>m;)f.shift()},"pushStatusWindow"),g=c(()=>{const e=new Map;for(const s of f)for(const[r,a]of s){const n=e.get(r)??{requests:0,errors:0,totalMs:0,versions:new Set};n.requests+=a.requests,n.errors+=a.errors,n.totalMs+=a.totalMs;for(const u of a.versions)n.versions.add(u);e.set(r,n)}const t=d();return M().map(s=>{const r=e.get(s)??{requests:0,errors:0,totalMs:0,versions:new Set},a=[...new Set(t.filter(i=>i.service===s).map(i=>i.host??"(default)"))],n=r.requests?r.errors/r.requests:0;let u=r.requests===0?"idle":n>=.5?"down":n>=.05?"degraded":"healthy";if(o.healthChecker){const i=t.filter(l=>l.service===s&&l.upstream).map(l=>l.upstream);i.length&&i.every(l=>!o.healthChecker.isHealthy(l))&&(u="down")}return{service:s,hosts:a,status:u,requests:r.requests,errorRate:+n.toFixed(4),avgMs:r.requests?Math.round(r.totalMs/r.requests):0,versions:[...r.versions],lastSeen:w.get(s)??null}})},"buildStatusSnapshot");return{emit:v,beginTrace:c(e=>{if(!o.emit)return;const t=(0,edge_1.hdr)(e.headers["x-lensmcp-flow-id"]);let s=(0,edge_1.hdr)(e.headers["x-request-id"]);if(!(!t&&!s&&!(0,edge_1.hdr)(e.headers.traceparent)))return s||(s=(0,edge_1.eid)(),e.headers["x-request-id"]=s),{startedAt:Date.now(),method:(e.method??"GET").toUpperCase(),host:(e.headers.host||"").split(":")[0],url:e.url??"/",steps:[],...t?{flowId:t}:{},...s?{requestId:s}:{}}},"beginTrace"),step:c((e,t,s)=>{e&&e.steps.push({step:t,atMs:Date.now()-e.startedAt,...s})},"step"),finish:c((e,t,s,r)=>{!e||e.done||(e.done=!0,v(s>=500?"error":"info",`gateway ${e.method} ${e.host}${e.url} \u2192 ${s} (${Date.now()-e.startedAt}ms)`,`gateway-request:${t}`,{kind:"gateway-request",project:t,host:e.host,method:e.method,url:e.url,status:s,durationMs:Date.now()-e.startedAt,startedAt:e.startedAt,steps:e.steps,...r},{...e.flowId?{flowId:e.flowId}:{},...e.requestId?{requestId:e.requestId}:{}}))},"finish"),recordEdge:q,buildStatusSnapshot:g,startFlusher:c(()=>{const e=setInterval(()=>{if(S(),o.onStatus)try{o.onStatus(g())}catch{}if(o.emit)for(const t of h.values())v(t.errors?"warning":"info",`traffic ${t.host} \u2192 ${t.service}${t.version?"@"+t.version:""}: ${t.count} req`,`gateway-traffic:${t.host}->${t.service}${t.version?"@"+t.version:""}`,{kind:"gateway-traffic",host:t.host,project:t.service,caller:t.caller,version:t.version,count:t.count,avgMs:Math.round(t.totalMs/t.count),errors:t.errors});h.clear()},o.trafficFlushMs??5e3);return e.unref?.(),e},"startFlusher")}}p(createObservability,"createObservability"),c(createObservability,"createObservability");

package/executors/gateway/prod-runtime/rollout.js

@@ -1 +1 @@
-"use strict";var R=Object.defineProperty;var l=(i,c)=>R(i,"name",{value:c,configurable:!0});var H=Object.defineProperty,u=l((i,c)=>H(i,"name",{value:c,configurable:!0}),"u"),S=Object.defineProperty,r=u((i,c)=>S(i,"name",{value:c,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRollout=createRollout;const node_crypto_1=require("node:crypto"),manifest_1=require("../manifest"),edge_1=require("./edge");function createRollout(i){const c=i.clientIpHeader?.toLowerCase(),f=i.clientIpTrustedProxies??[],C=r(e=>{if(!e)return!1;const t=e.startsWith("::ffff:")?e.slice(7):e;return f.length===0?t==="127.0.0.1"||e==="::1":f.some(o=>(0,manifest_1.matchCidr)(t,o))},"peerTrusted"),m=r((e,t)=>{if(c&&C(e.socket?.remoteAddress??void 0)){const o=(0,edge_1.hdr)(e.headers[c]);if(o)return o}return t},"clientIpOf"),b=(i.attributeHeaders??[]).map(e=>e.toLowerCase()),p=i.uidHeader?.toLowerCase(),d=!!i.cookie,k=i.cookie?.name??"lensmcp_did",a=i.cookie?.secret,h=i.cookie?.domain,I=i.cookie?.maxAge??31536e3;d&&!a&&console.warn("[gateway] device cookie has no secret \u2014 values are UNSIGNED (set cookie.secret to prevent bucket-grinding).");const v=r(e=>(0,node_crypto_1.createHmac)("sha256",a).update(e).digest("base64url"),"signId"),x=r(e=>a?`${e}.${v(e)}`:e,"signedCookie"),_=r(e=>{if(!a)return e||void 0;const t=e.lastIndexOf(".");if(t<0)return;const o=e.slice(0,t),n=Buffer.from(e.slice(t+1)),s=Buffer.from(v(o));return n.length===s.length&&(0,node_crypto_1.timingSafeEqual)(n,s)?o:void 0},"verifyCookie"),O=r((e,t)=>{if(e)for(const o of e.split(";")){const n=o.indexOf("=");if(n>0&&o.slice(0,n).trim()===t)return decodeURIComponent(o.slice(n+1).trim())}},"parseCookie");return{clientIpOf:m,buildAttrs:r((e,t,o,n)=>{const s={...o??{}};s.ip=m(e,t),s.method=(e.method??"GET").toUpperCase(),s.path=(e.url??"/").split("?")[0],n&&(s.device=n);for(const g of b){const y=(0,edge_1.hdr)(e.headers[g]);y!==void 0&&(s["header."+g]=y)}return s},"buildAttrs"),resolveStickyKey:r(e=>{if(d){const t=O(e.headers.cookie,k),o=t?_(t):void 0;if(o)return{key:o,mint:!1}}if(p){const t=(0,edge_1.hdr)(e.headers[p]);if(t)return{key:t,mint:!1}}return d?{key:"d_"+(0,node_crypto_1.randomBytes)(12).toString("base64url"),mint:!0}:{mint:!1}},"resolveStickyKey"),mintCookieHeader:r(e=>{let t=`${k}=${encodeURIComponent(x(e))}; Path=/; Max-Age=${I}; HttpOnly; SameSite=Lax; Secure`;return h&&(t+=`; Domain=${h}`),t},"mintCookieHeader")}}l(createRollout,"createRollout"),u(createRollout,"createRollout"),r(createRollout,"createRollout");
+"use strict";var H=Object.defineProperty;var u=(i,c)=>H(i,"name",{value:c,configurable:!0});var S=Object.defineProperty,r=u((i,c)=>S(i,"name",{value:c,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRollout=createRollout;const node_crypto_1=require("node:crypto"),manifest_1=require("../manifest"),edge_1=require("./edge");function createRollout(i){const c=i.clientIpHeader?.toLowerCase(),l=i.clientIpTrustedProxies??[],y=r(e=>{if(!e)return!1;const t=e.startsWith("::ffff:")?e.slice(7):e;return l.length===0?t==="127.0.0.1"||e==="::1":l.some(o=>(0,manifest_1.matchCidr)(t,o))},"peerTrusted"),f=r((e,t)=>{if(c&&y(e.socket?.remoteAddress??void 0)){const o=(0,edge_1.hdr)(e.headers[c]);if(o)return o}return t},"clientIpOf"),C=(i.attributeHeaders??[]).map(e=>e.toLowerCase()),m=i.uidHeader?.toLowerCase(),d=!!i.cookie,p=i.cookie?.name??"lensmcp_did",a=i.cookie?.secret,k=i.cookie?.domain,I=i.cookie?.maxAge??31536e3;d&&!a&&console.warn("[gateway] device cookie has no secret \u2014 values are UNSIGNED (set cookie.secret to prevent bucket-grinding).");const h=r(e=>(0,node_crypto_1.createHmac)("sha256",a).update(e).digest("base64url"),"signId"),b=r(e=>a?`${e}.${h(e)}`:e,"signedCookie"),x=r(e=>{if(!a)return e||void 0;const t=e.lastIndexOf(".");if(t<0)return;const o=e.slice(0,t),n=Buffer.from(e.slice(t+1)),s=Buffer.from(h(o));return n.length===s.length&&(0,node_crypto_1.timingSafeEqual)(n,s)?o:void 0},"verifyCookie"),_=r((e,t)=>{if(e)for(const o of e.split(";")){const n=o.indexOf("=");if(n>0&&o.slice(0,n).trim()===t)return decodeURIComponent(o.slice(n+1).trim())}},"parseCookie");return{clientIpOf:f,buildAttrs:r((e,t,o,n)=>{const s={...o??{}};s.ip=f(e,t),s.method=(e.method??"GET").toUpperCase(),s.path=(e.url??"/").split("?")[0],n&&(s.device=n);for(const g of C){const v=(0,edge_1.hdr)(e.headers[g]);v!==void 0&&(s["header."+g]=v)}return s},"buildAttrs"),resolveStickyKey:r(e=>{if(d){const t=_(e.headers.cookie,p),o=t?x(t):void 0;if(o)return{key:o,mint:!1}}if(m){const t=(0,edge_1.hdr)(e.headers[m]);if(t)return{key:t,mint:!1}}return d?{key:"d_"+(0,node_crypto_1.randomBytes)(12).toString("base64url"),mint:!0}:{mint:!1}},"resolveStickyKey"),mintCookieHeader:r(e=>{let t=`${p}=${encodeURIComponent(b(e))}; Path=/; Max-Age=${I}; HttpOnly; SameSite=Lax; Secure`;return k&&(t+=`; Domain=${k}`),t},"mintCookieHeader")}}u(createRollout,"createRollout"),r(createRollout,"createRollout");

package/executors/gateway/prod-runtime/routing.js

@@ -1 +1 @@
-"use strict";var m=Object.defineProperty;var l=(e,s)=>m(e,"name",{value:s,configurable:!0});var d=Object.defineProperty,u=l((e,s)=>d(e,"name",{value:s,configurable:!0}),"u"),h=Object.defineProperty,r=u((e,s)=>h(e,"name",{value:s,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRouteTable=createRouteTable;const manifest_1=require("../manifest");function createRouteTable(e,s){const o=[],c=new Map;let i=e.manifests.list();const f=r(a=>{i=a;const t=(0,manifest_1.buildRouteTable)(a);o.length=0,o.push(...t),c.clear();for(const n of a)c.set(n.service,n)},"apply"),p=r(a=>{if(f(a),e.healthChecker){const t=new Set;for(const n of o)n.upstream&&t.add(n.upstream);for(const n of e.pods?.endpoints?.()??[])t.add(n);e.healthChecker.track([...t])}s.emit("info",`gateway routes: ${o.length} on ${i.length} services`,"gateway-up",{kind:"gateway-up",routes:o.map(t=>({host:t.host??"(default)",service:t.service,internal:!!t.internal}))})},"rebuild");f(i);const b=e.manifests.watch?.(a=>p(a));return{routes:o,manifestByService:c,rebuild:p,manifests:r(()=>i,"manifests"),stop:r(()=>b?.(),"stop")}}l(createRouteTable,"createRouteTable"),u(createRouteTable,"createRouteTable"),r(createRouteTable,"createRouteTable");
+"use strict";var d=Object.defineProperty;var u=(e,o)=>d(e,"name",{value:o,configurable:!0});var h=Object.defineProperty,r=u((e,o)=>h(e,"name",{value:o,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRouteTable=createRouteTable;const manifest_1=require("../manifest");function createRouteTable(e,o){const n=[],c=new Map;let i=e.manifests.list();const l=r(a=>{i=a;const t=(0,manifest_1.buildRouteTable)(a);n.length=0,n.push(...t),c.clear();for(const s of a)c.set(s.service,s)},"apply"),f=r(a=>{if(l(a),e.healthChecker){const t=new Set;for(const s of n)s.upstream&&t.add(s.upstream);for(const s of e.pods?.endpoints?.()??[])t.add(s);e.healthChecker.track([...t])}o.emit("info",`gateway routes: ${n.length} on ${i.length} services`,"gateway-up",{kind:"gateway-up",routes:n.map(t=>({host:t.host??"(default)",service:t.service,internal:!!t.internal}))})},"rebuild");l(i);const p=e.manifests.watch?.(a=>f(a));return{routes:n,manifestByService:c,rebuild:f,manifests:r(()=>i,"manifests"),stop:r(()=>p?.(),"stop")}}u(createRouteTable,"createRouteTable"),r(createRouteTable,"createRouteTable");