@lensmcp/cluster 1.23.8 → 1.23.10

package/executors/gateway/prod-runtime/body-stall.js

@@ -1 +1 @@
-"use strict";var o=Object.defineProperty;var l=(r,t)=>o(r,"name",{value:t,configurable:!0});var a=Object.defineProperty,e=l((r,t)=>a(r,"name",{value:t,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createBodyStallGuard=void 0;var body_stall_1=require("../body-stall");Object.defineProperty(exports,"createBodyStallGuard",{enumerable:!0,get:e(function(){return body_stall_1.createBodyStallGuard},"get")});
+"use strict";var u=Object.defineProperty;var d=(r,t)=>u(r,"name",{value:t,configurable:!0});var o=Object.defineProperty,l=d((r,t)=>o(r,"name",{value:t,configurable:!0}),"l"),a=Object.defineProperty,e=l((r,t)=>a(r,"name",{value:t,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createBodyStallGuard=void 0;var body_stall_1=require("../body-stall");Object.defineProperty(exports,"createBodyStallGuard",{enumerable:!0,get:e(function(){return body_stall_1.createBodyStallGuard},"get")});

package/executors/gateway/prod-runtime/cors.js

@@ -1 +1 @@
-"use strict";var i=Object.defineProperty;var n=(s,a)=>i(s,"name",{value:a,configurable:!0});var c=Object.defineProperty,t=n((s,a)=>c(s,"name",{value:a,configurable:!0}),"t");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createCors=createCors;const addVaryOrigin=t(s=>{const a=s.getHeader("vary"),e=Array.isArray(a)?a.join(", "):typeof a=="string"?a:"";if(e.trim()==="*")return;const o=e.split(",").map(r=>r.trim()).filter(Boolean);o.some(r=>r.toLowerCase()==="origin")||s.header("vary",[...o,"Origin"].join(", "))},"addVaryOrigin");function createCors(s,a){return{setCors:t((e,o)=>{const r=o.headers.origin;if(r&&s.corsCredentialOrigins.has(r.toLowerCase())){e.header("access-control-allow-origin",r),e.header("access-control-allow-credentials","true"),addVaryOrigin(e);return}e.header("access-control-allow-origin",String(r??"*")),addVaryOrigin(e)},"setCors"),applyResponseCors:t((e,o)=>{const r=e.headers.origin;r&&!o.getHeader("access-control-allow-origin")&&(s.corsCredentialOrigins.has(r.toLowerCase())?(o.header("access-control-allow-origin",r),o.header("access-control-allow-credentials","true"),addVaryOrigin(o)):a.get(e)?.proxied||(o.header("access-control-allow-origin",String(r)),addVaryOrigin(o)))},"applyResponseCors")}}n(createCors,"createCors"),t(createCors,"createCors");
+"use strict";var d=Object.defineProperty;var l=(o,e)=>d(o,"name",{value:e,configurable:!0});var i=Object.defineProperty,n=l((o,e)=>i(o,"name",{value:e,configurable:!0}),"n"),c=Object.defineProperty,t=n((o,e)=>c(o,"name",{value:e,configurable:!0}),"t");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createCors=createCors;const addVaryOrigin=t(o=>{const e=o.getHeader("vary"),a=Array.isArray(e)?e.join(", "):typeof e=="string"?e:"";if(a.trim()==="*")return;const s=a.split(",").map(r=>r.trim()).filter(Boolean);s.some(r=>r.toLowerCase()==="origin")||o.header("vary",[...s,"Origin"].join(", "))},"addVaryOrigin");function createCors(o,e){return{setCors:t((a,s)=>{const r=s.headers.origin;if(r&&o.corsCredentialOrigins.has(r.toLowerCase())){a.header("access-control-allow-origin",r),a.header("access-control-allow-credentials","true"),addVaryOrigin(a);return}a.header("access-control-allow-origin",String(r??"*")),addVaryOrigin(a)},"setCors"),applyResponseCors:t((a,s)=>{const r=a.headers.origin;r&&!s.getHeader("access-control-allow-origin")&&(o.corsCredentialOrigins.has(r.toLowerCase())?(s.header("access-control-allow-origin",r),s.header("access-control-allow-credentials","true"),addVaryOrigin(s)):e.get(a)?.proxied||(s.header("access-control-allow-origin",String(r)),addVaryOrigin(s)))},"applyResponseCors")}}l(createCors,"createCors"),n(createCors,"createCors"),t(createCors,"createCors");

package/executors/gateway/prod-runtime/edge.js

@@ -1 +1 @@
-"use strict";var p=Object.defineProperty;var i=(e,r)=>p(e,"name",{value:r,configurable:!0});var c=Object.defineProperty,t=i((e,r)=>c(e,"name",{value:r,configurable:!0}),"t");Object.defineProperty(exports,"__esModule",{value:!0}),exports.safeUrl=exports.rememberRawTarget=exports.rawTargetOf=exports.RAW_TARGET=exports.canonicalPath=exports.canonicalize=exports.ENCODED_STRUCTURE=exports.addVary=exports.tokenMatches=exports.NO_STORE=exports.sendError=exports.hdr=exports.eid=void 0;const node_crypto_1=require("node:crypto"),gateway_errors_1=require("../gateway-errors"),eid=t(()=>Date.now().toString(36)+(0,node_crypto_1.randomBytes)(6).toString("hex"),"eid");exports.eid=eid;const hdr=t(e=>typeof e=="string"&&e!==""?e:Array.isArray(e)?e[0]:void 0,"hdr");exports.hdr=hdr;const sendError=t((e,r,o,n,s)=>{const a=(0,gateway_errors_1.ensureRequestId)(r);return e.code(o).header("x-request-id",a).header("cache-control",exports.NO_STORE).type(gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE).send((0,gateway_errors_1.gatewayErrorBody)(o,n,a,s))},"sendError");exports.sendError=sendError,exports.NO_STORE="no-store";const tokenMatches=t((e,r)=>{if(!r)return!1;const o=Buffer.from(e??""),n=Buffer.from(r);return o.length===n.length&&(0,node_crypto_1.timingSafeEqual)(o,n)},"tokenMatches");exports.tokenMatches=tokenMatches;const addVary=t((e,r)=>{const o=e.vary,n=Array.isArray(o)?o.join(", "):typeof o=="string"?o:"";if(n.trim()==="*")return;const s=n.split(",").map(a=>a.trim()).filter(Boolean);s.some(a=>a.toLowerCase()===r.toLowerCase())||(e.vary=[...s,r].join(", "))},"addVary");exports.addVary=addVary;var canonical_path_1=require("../canonical-path");Object.defineProperty(exports,"ENCODED_STRUCTURE",{enumerable:!0,get:t(function(){return canonical_path_1.ENCODED_STRUCTURE},"get")}),Object.defineProperty(exports,"canonicalize",{enumerable:!0,get:t(function(){return canonical_path_1.canonicalize},"get")}),Object.defineProperty(exports,"canonicalPath",{enumerable:!0,get:t(function(){return canonical_path_1.canonicalPath},"get")}),Object.defineProperty(exports,"RAW_TARGET",{enumerable:!0,get:t(function(){return canonical_path_1.RAW_TARGET},"get")}),Object.defineProperty(exports,"rawTargetOf",{enumerable:!0,get:t(function(){return canonical_path_1.rawTargetOf},"get")}),Object.defineProperty(exports,"rememberRawTarget",{enumerable:!0,get:t(function(){return canonical_path_1.rememberRawTarget},"get")});const safeUrl=t(e=>{if(!e)return"(unset)";try{const r=new URL(e);return`${r.protocol}//${r.host}${r.pathname}`}catch{return"(set)"}},"safeUrl");exports.safeUrl=safeUrl;
+"use strict";var u=Object.defineProperty;var d=(e,r)=>u(e,"name",{value:r,configurable:!0});var p=Object.defineProperty,i=d((e,r)=>p(e,"name",{value:r,configurable:!0}),"i"),c=Object.defineProperty,t=i((e,r)=>c(e,"name",{value:r,configurable:!0}),"t");Object.defineProperty(exports,"__esModule",{value:!0}),exports.safeUrl=exports.rememberRawTarget=exports.rawTargetOf=exports.RAW_TARGET=exports.canonicalPath=exports.canonicalize=exports.ENCODED_STRUCTURE=exports.addVary=exports.tokenMatches=exports.NO_STORE=exports.sendError=exports.hdr=exports.eid=void 0;const node_crypto_1=require("node:crypto"),gateway_errors_1=require("../gateway-errors"),eid=t(()=>Date.now().toString(36)+(0,node_crypto_1.randomBytes)(6).toString("hex"),"eid");exports.eid=eid;const hdr=t(e=>typeof e=="string"&&e!==""?e:Array.isArray(e)?e[0]:void 0,"hdr");exports.hdr=hdr;const sendError=t((e,r,o,n,s)=>{const a=(0,gateway_errors_1.ensureRequestId)(r);return e.code(o).header("x-request-id",a).header("cache-control",exports.NO_STORE).type(gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE).send((0,gateway_errors_1.gatewayErrorBody)(o,n,a,s))},"sendError");exports.sendError=sendError,exports.NO_STORE="no-store";const tokenMatches=t((e,r)=>{if(!r)return!1;const o=Buffer.from(e??""),n=Buffer.from(r);return o.length===n.length&&(0,node_crypto_1.timingSafeEqual)(o,n)},"tokenMatches");exports.tokenMatches=tokenMatches;const addVary=t((e,r)=>{const o=e.vary,n=Array.isArray(o)?o.join(", "):typeof o=="string"?o:"";if(n.trim()==="*")return;const s=n.split(",").map(a=>a.trim()).filter(Boolean);s.some(a=>a.toLowerCase()===r.toLowerCase())||(e.vary=[...s,r].join(", "))},"addVary");exports.addVary=addVary;var canonical_path_1=require("../canonical-path");Object.defineProperty(exports,"ENCODED_STRUCTURE",{enumerable:!0,get:t(function(){return canonical_path_1.ENCODED_STRUCTURE},"get")}),Object.defineProperty(exports,"canonicalize",{enumerable:!0,get:t(function(){return canonical_path_1.canonicalize},"get")}),Object.defineProperty(exports,"canonicalPath",{enumerable:!0,get:t(function(){return canonical_path_1.canonicalPath},"get")}),Object.defineProperty(exports,"RAW_TARGET",{enumerable:!0,get:t(function(){return canonical_path_1.RAW_TARGET},"get")}),Object.defineProperty(exports,"rawTargetOf",{enumerable:!0,get:t(function(){return canonical_path_1.rawTargetOf},"get")}),Object.defineProperty(exports,"rememberRawTarget",{enumerable:!0,get:t(function(){return canonical_path_1.rememberRawTarget},"get")});const safeUrl=t(e=>{if(!e)return"(unset)";try{const r=new URL(e);return`${r.protocol}//${r.host}${r.pathname}`}catch{return"(set)"}},"safeUrl");exports.safeUrl=safeUrl;

package/executors/gateway/prod-runtime/handler.js

@@ -1 +1 @@
-"use strict";var J=Object.defineProperty;var H=(y,n)=>J(y,"name",{value:n,configurable:!0});var G=Object.defineProperty,v=H((y,n)=>G(y,"name",{value:n,configurable:!0}),"v");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHandler=createHandler;const manifest_1=require("../manifest"),gateway_errors_1=require("../gateway-errors"),edge_1=require("./edge");function createHandler(y){const{rt:n,obs:d,cors:_,auth:N,upstream:L,rollout:w,hooks:p,reqState:U,spanByReq:$,ctxByReq:D}=y,M=!!n.opts.pods?.resolveVersion,q=!!n.opts.cookie?.secret,C=!!n.opts.pods?.bucket&&(q||!!n.opts.uidHeader),V=M||q||C,B=n.opts.upstreamRetries??1,F=v(l=>(0,edge_1.tokenMatches)(l.query?.token??(0,edge_1.hdr)(l.raw.headers["x-status-token"]),n.opts.statusToken),"statusTokenMatches"),K=v((l,o,e,f,m)=>{const a=l.raw;if(_.setCors(o,a),o.header("cache-control",edge_1.NO_STORE),a.method==="OPTIONS"){o.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(a.headers["access-control-request-headers"]??"*")).send();return}const s=n.table.routes.filter(i=>i.host&&(0,manifest_1.hostMatches)(i.host,e)&&i.prefix),h=m;if(s.length>0&&(h==="/health"||h==="/healthz")){o.code(200).type("application/json").send(JSON.stringify({status:"ok",host:e,services:s.map(i=>({service:i.service,prefix:i.prefix}))}));return}if(h==="/.well-known/lensmcp-routes"){if(!F(l)){(0,edge_1.sendError)(o,a,404,"not_found","No gateway route for this hostname.");return}o.code(200).type("application/json").send(JSON.stringify({host:e,routes:n.table.routes.filter(i=>!i.host||(0,manifest_1.hostMatches)(i.host,e)).map(i=>({host:i.host??"(default)",service:i.service,prefix:i.prefix,internal:!!i.internal,auth:i.auth}))}));return}(0,edge_1.sendError)(o,a,404,"not_found",s.length>0?`No service mounted at ${f} on ${e}.`:"No gateway route for this hostname.")},"handleNoRoute");return async(l,o)=>{const e=l.raw,f=(e.headers.host||"").split(":")[0],m=e.url??"/",a=d.beginTrace(e);(0,gateway_errors_1.ensureRequestId)(e),d.step(a,"received",{host:f,method:e.method,url:m});const s=p.any?p.httpContext(e,l,o,a):void 0;if(s&&D.set(l,s),s&&p.has("onRequest")&&(await p.run("onRequest",s),s.responded()))return o;if(e.httpVersionMajor<1)return d.finish(a,"gateway",400),(0,edge_1.sendError)(o,e,400,"bad_request","Bad Request");const h=(0,edge_1.canonicalize)(m);if(h===void 0)return d.step(a,"bad-path",{}),d.finish(a,"gateway",400),(0,edge_1.sendError)(o,e,400,"bad_request","Bad Request");const i=h.policy,b=h.path+h.query;b!==m&&(0,edge_1.rememberRawTarget)(e,m),e.url=b;const j=e.socket?.remoteAddress??l.ip,T=w.clientIpOf(e,j);if(n.opts.rateLimiter){const r=await n.opts.rateLimiter.check(T);if(!r.allowed)return o.header("retry-after",String(Math.ceil(r.retryAfterMs/1e3))),d.step(a,"rate-limited",{}),d.finish(a,"gateway",429),(0,edge_1.sendError)(o,e,429,"rate_limited","Too Many Requests")}const t=(0,manifest_1.matchRoute)(n.table.routes,f,i+h.query);if(!t)return K(l,o,f,b,i),o;if(s&&(s.route=t),d.step(a,"route-match",{project:t.service,...t.prefix?{prefix:t.prefix}:{},...t.internal?{internal:!0}:{}}),e.method==="OPTIONS")return _.setCors(o,e),o.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(e.headers["access-control-request-headers"]??"*")).send(),o;const k=n.opts.tracing?.startSpan(e,`gateway ${t.service}`,{"http.request.method":e.method??"GET","url.path":b.split("?")[0],"server.address":f,"lensmcp.service":t.service,...t.internal?{"lensmcp.internal":!0}:{}});if(k&&$.set(l,k),s&&p.has("beforeAuth")&&(await p.run("beforeAuth",s),s.responded()))return o;const O=t.internal?void 0:n.opts.identify?.(e);let S;if(t.internal){const r=N.internal(e,t,a);if(!r.ok)return d.finish(a,t.service,r.status),(0,edge_1.sendError)(o,e,r.status,r.reason,r.detail);S=r.caller,s&&(s.caller=S)}else{const r=N.public(e,t,i,O,T,a);if(!r.ok)return d.finish(a,t.service,r.status),(0,edge_1.sendError)(o,e,r.status,r.reason,r.detail);if(s&&(s.claims=O),s&&p.has("afterAuth")&&(await p.run("afterAuth",s),s.responded()))return o}if(e.headers["x-forwarded-for"]=w.forwardedFor(e,j),e.headers["x-forwarded-proto"]=n.opts.tls?"https":"http",e.headers["x-forwarded-host"]=e.headers.host??f,n.opts.serviceKeys?.[t.service]&&(e.headers["x-internal-token"]=n.opts.serviceKeys[t.service]),t.prependPrefix){const r=e.url??"/",c=t.prependPrefix;r!==c&&!r.startsWith(c+"/")&&(e.url=c+r)}const x=(0,edge_1.hdr)(e.headers[n.versionHeader]);let P=x,R=!1,E;if(V&&!t.internal&&!x){const r=w.resolveStickyKey(e);r.mint&&(E=r.key);const c=M?n.opts.pods.resolveVersion(t.service,w.buildAttrs(e,T,O,r.key)):void 0;if(c)P=c.version,R=!0,d.step(a,"targeting",{rule:c.rule,version:c.version});else if(r.key){const g=n.opts.pods?.bucket?.(t.service,r.key);g&&(P=g.version,R=!0,d.step(a,"targeting",{mode:"sticky",version:g.version}))}}const u=await L.resolveUpstream(t,a,P,R);if(!u)return d.finish(a,t.service,503),(0,edge_1.sendError)(o,e,503,"unavailable",`Service ${t.service} has no available upstream.`);if(!("url"in u))return d.finish(a,t.service,502),(0,edge_1.sendError)(o,e,502,"unavailable",`Service ${t.service}: socket upstreams are not supported by the prod gateway.`);const z=new URL(u.url).origin,A=u.url,I={route:t,caller:S,startedAt:Date.now(),trace:a,version:u.version,upLabel:A};return U.set(l,I),s&&(s.version=u.version),d.step(a,u.version?"rollout":"upstream",{upstream:A,...u.version?{version:u.version,...x?{pinned:!0}:{}}:{}}),k&&n.opts.tracing.inject(k,e.headers),s&&p.has("beforeForward")&&(await p.run("beforeForward",s),s.responded())?o:o.from(void 0,{getUpstream:v(()=>z,"getUpstream"),retriesCount:B,rewriteHeaders:v(r=>{if(I.proxied=!0,a&&(r["x-lensmcp-upstream"]=A),r["x-request-id"]||(r["x-request-id"]=(0,gateway_errors_1.ensureRequestId)(e)),u.version&&(r["x-lensmcp-version"]=u.version),(x||u.version)&&(0,edge_1.addVary)(r,n.versionHeader),(E||C&&q)&&(0,edge_1.addVary)(r,"Cookie"),delete r["x-powered-by"],delete r.connection,delete r["keep-alive"],delete r["proxy-connection"],r.server="LensMCP",E){const c=r["set-cookie"],g=Array.isArray(c)?c:c?[c]:[];r["set-cookie"]=[...g,w.mintCookieHeader(E)]}return r},"rewriteHeaders"),onError:v((r,{error:c})=>{n.opts.pods?.drop?.(t.service,u),s&&p.has("onError")&&(s.error=c,p.run("onError",s)),(0,edge_1.sendError)(r,e,502,"unavailable",`Upstream ${t.service} unavailable.`)},"onError")})}}H(createHandler,"createHandler"),v(createHandler,"createHandler");
+"use strict";var Q=Object.defineProperty;var _=(f,o)=>Q(f,"name",{value:o,configurable:!0});var J=Object.defineProperty,H=_((f,o)=>J(f,"name",{value:o,configurable:!0}),"H"),G=Object.defineProperty,v=H((f,o)=>G(f,"name",{value:o,configurable:!0}),"v");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHandler=createHandler;const manifest_1=require("../manifest"),gateway_errors_1=require("../gateway-errors"),edge_1=require("./edge");function createHandler(f){const{rt:o,obs:d,cors:N,auth:M,upstream:U,rollout:w,hooks:p,reqState:$,spanByReq:D,ctxByReq:V}=f,C=!!o.opts.pods?.resolveVersion,q=!!o.opts.cookie?.secret,j=!!o.opts.pods?.bucket&&(q||!!o.opts.uidHeader),B=C||q||j,F=o.opts.upstreamRetries??1,K=v(u=>(0,edge_1.tokenMatches)(u.query?.token??(0,edge_1.hdr)(u.raw.headers["x-status-token"]),o.opts.statusToken),"statusTokenMatches"),z=v((u,a,e,m,y)=>{const n=u.raw;if(N.setCors(a,n),a.header("cache-control",edge_1.NO_STORE),n.method==="OPTIONS"){a.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(n.headers["access-control-request-headers"]??"*")).send();return}const s=o.table.routes.filter(i=>i.host&&(0,manifest_1.hostMatches)(i.host,e)&&i.prefix),h=y;if(s.length>0&&(h==="/health"||h==="/healthz")){a.code(200).type("application/json").send(JSON.stringify({status:"ok",host:e,services:s.map(i=>({service:i.service,prefix:i.prefix}))}));return}if(h==="/.well-known/lensmcp-routes"){if(!K(u)){(0,edge_1.sendError)(a,n,404,"not_found","No gateway route for this hostname.");return}a.code(200).type("application/json").send(JSON.stringify({host:e,routes:o.table.routes.filter(i=>!i.host||(0,manifest_1.hostMatches)(i.host,e)).map(i=>({host:i.host??"(default)",service:i.service,prefix:i.prefix,internal:!!i.internal,auth:i.auth}))}));return}(0,edge_1.sendError)(a,n,404,"not_found",s.length>0?`No service mounted at ${m} on ${e}.`:"No gateway route for this hostname.")},"handleNoRoute");return async(u,a)=>{const e=u.raw,m=(e.headers.host||"").split(":")[0],y=e.url??"/",n=d.beginTrace(e);(0,gateway_errors_1.ensureRequestId)(e),d.step(n,"received",{host:m,method:e.method,url:y});const s=p.any?p.httpContext(e,u,a,n):void 0;if(s&&V.set(u,s),s&&p.has("onRequest")&&(await p.run("onRequest",s),s.responded()))return a;if(e.httpVersionMajor<1)return d.finish(n,"gateway",400),(0,edge_1.sendError)(a,e,400,"bad_request","Bad Request");const h=(0,edge_1.canonicalize)(y);if(h===void 0)return d.step(n,"bad-path",{}),d.finish(n,"gateway",400),(0,edge_1.sendError)(a,e,400,"bad_request","Bad Request");const i=h.policy,b=h.path+h.query;b!==y&&(0,edge_1.rememberRawTarget)(e,y),e.url=b;const I=e.socket?.remoteAddress??u.ip,T=w.clientIpOf(e,I);if(o.opts.rateLimiter){const r=await o.opts.rateLimiter.check(T);if(!r.allowed)return a.header("retry-after",String(Math.ceil(r.retryAfterMs/1e3))),d.step(n,"rate-limited",{}),d.finish(n,"gateway",429),(0,edge_1.sendError)(a,e,429,"rate_limited","Too Many Requests")}const t=(0,manifest_1.matchRoute)(o.table.routes,m,i+h.query);if(!t)return z(u,a,m,b,i),a;if(s&&(s.route=t),d.step(n,"route-match",{project:t.service,...t.prefix?{prefix:t.prefix}:{},...t.internal?{internal:!0}:{}}),e.method==="OPTIONS")return N.setCors(a,e),a.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(e.headers["access-control-request-headers"]??"*")).send(),a;const k=o.opts.tracing?.startSpan(e,`gateway ${t.service}`,{"http.request.method":e.method??"GET","url.path":b.split("?")[0],"server.address":m,"lensmcp.service":t.service,...t.internal?{"lensmcp.internal":!0}:{}});if(k&&D.set(u,k),s&&p.has("beforeAuth")&&(await p.run("beforeAuth",s),s.responded()))return a;const O=t.internal?void 0:o.opts.identify?.(e);let S;if(t.internal){const r=M.internal(e,t,n);if(!r.ok)return d.finish(n,t.service,r.status),(0,edge_1.sendError)(a,e,r.status,r.reason,r.detail);S=r.caller,s&&(s.caller=S)}else{const r=M.public(e,t,i,O,T,n);if(!r.ok)return d.finish(n,t.service,r.status),(0,edge_1.sendError)(a,e,r.status,r.reason,r.detail);if(s&&(s.claims=O),s&&p.has("afterAuth")&&(await p.run("afterAuth",s),s.responded()))return a}if(e.headers["x-forwarded-for"]=w.forwardedFor(e,I),e.headers["x-forwarded-proto"]=o.opts.tls?"https":"http",e.headers["x-forwarded-host"]=e.headers.host??m,o.opts.serviceKeys?.[t.service]&&(e.headers["x-internal-token"]=o.opts.serviceKeys[t.service]),t.prependPrefix){const r=e.url??"/",c=t.prependPrefix;r!==c&&!r.startsWith(c+"/")&&(e.url=c+r)}const x=(0,edge_1.hdr)(e.headers[o.versionHeader]);let P=x,R=!1,E;if(B&&!t.internal&&!x){const r=w.resolveStickyKey(e);r.mint&&(E=r.key);const c=C?o.opts.pods.resolveVersion(t.service,w.buildAttrs(e,T,O,r.key)):void 0;if(c)P=c.version,R=!0,d.step(n,"targeting",{rule:c.rule,version:c.version});else if(r.key){const g=o.opts.pods?.bucket?.(t.service,r.key);g&&(P=g.version,R=!0,d.step(n,"targeting",{mode:"sticky",version:g.version}))}}const l=await U.resolveUpstream(t,n,P,R);if(!l)return d.finish(n,t.service,503),(0,edge_1.sendError)(a,e,503,"unavailable",`Service ${t.service} has no available upstream.`);if(!("url"in l))return d.finish(n,t.service,502),(0,edge_1.sendError)(a,e,502,"unavailable",`Service ${t.service}: socket upstreams are not supported by the prod gateway.`);const W=new URL(l.url).origin,A=l.url,L={route:t,caller:S,startedAt:Date.now(),trace:n,version:l.version,upLabel:A};return $.set(u,L),s&&(s.version=l.version),d.step(n,l.version?"rollout":"upstream",{upstream:A,...l.version?{version:l.version,...x?{pinned:!0}:{}}:{}}),k&&o.opts.tracing.inject(k,e.headers),s&&p.has("beforeForward")&&(await p.run("beforeForward",s),s.responded())?a:a.from(void 0,{getUpstream:v(()=>W,"getUpstream"),retriesCount:F,rewriteHeaders:v(r=>{if(L.proxied=!0,n&&(r["x-lensmcp-upstream"]=A),r["x-request-id"]||(r["x-request-id"]=(0,gateway_errors_1.ensureRequestId)(e)),l.version&&(r["x-lensmcp-version"]=l.version),(x||l.version)&&(0,edge_1.addVary)(r,o.versionHeader),(E||j&&q)&&(0,edge_1.addVary)(r,"Cookie"),delete r["x-powered-by"],delete r.connection,delete r["keep-alive"],delete r["proxy-connection"],r.server="LensMCP",E){const c=r["set-cookie"],g=Array.isArray(c)?c:c?[c]:[];r["set-cookie"]=[...g,w.mintCookieHeader(E)]}return r},"rewriteHeaders"),onError:v((r,{error:c})=>{o.opts.pods?.drop?.(t.service,l),s&&p.has("onError")&&(s.error=c,p.run("onError",s)),(0,edge_1.sendError)(r,e,502,"unavailable",`Upstream ${t.service} unavailable.`)},"onError")})}}_(createHandler,"createHandler"),H(createHandler,"createHandler"),v(createHandler,"createHandler");

package/executors/gateway/prod-runtime/hooks.js

@@ -1 +1 @@
-"use strict";var f=Object.defineProperty;var i=(t,d)=>f(t,"name",{value:d,configurable:!0});var l=Object.defineProperty,n=i((t,d)=>l(t,"name",{value:d,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHooks=createHooks;const edge_1=require("./edge"),TERMINAL_PHASES=new Set(["onResponse","onError"]);function createHooks(t){const d=n(async(e,o)=>{const r=t[e];if(!r||r.length===0)return;const s=TERMINAL_PHASES.has(e);for(const a of r){if(!s&&o.responded())return;await a(o)}},"run"),u=n(e=>(t[e]?.length??0)>0,"has");return{any:["onRequest","beforeAuth","afterAuth","beforeForward","onResponse","onError","onUpgrade"].some(e=>u(e)),run:d,has:u,httpContext:n((e,o,r,s)=>{let a=!1;return{req:e,request:o,reply:r,socket:void 0,trace:s,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n((c,v,p)=>{(0,edge_1.sendError)(r,e,c,v,p),a=!0},"sendError"),responded:n(()=>a||r.raw.writableEnded,"responded")}},"httpContext"),upgradeContext:n((e,o,r)=>{let s=!1;return{req:e,request:void 0,reply:void 0,socket:o,trace:r,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n(()=>{try{o.destroy()}catch{}s=!0},"sendError"),responded:n(()=>s||o.destroyed,"responded")}},"upgradeContext")}}i(createHooks,"createHooks"),n(createHooks,"createHooks");
+"use strict";var y=Object.defineProperty;var u=(o,s)=>y(o,"name",{value:s,configurable:!0});var f=Object.defineProperty,i=u((o,s)=>f(o,"name",{value:s,configurable:!0}),"i"),l=Object.defineProperty,n=i((o,s)=>l(o,"name",{value:s,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHooks=createHooks;const edge_1=require("./edge"),TERMINAL_PHASES=new Set(["onResponse","onError"]);function createHooks(o){const s=n(async(e,t)=>{const r=o[e];if(!r||r.length===0)return;const d=TERMINAL_PHASES.has(e);for(const a of r){if(!d&&t.responded())return;await a(t)}},"run"),c=n(e=>(o[e]?.length??0)>0,"has");return{any:["onRequest","beforeAuth","afterAuth","beforeForward","onResponse","onError","onUpgrade"].some(e=>c(e)),run:s,has:c,httpContext:n((e,t,r,d)=>{let a=!1;return{req:e,request:t,reply:r,socket:void 0,trace:d,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n((v,p,h)=>{(0,edge_1.sendError)(r,e,v,p,h),a=!0},"sendError"),responded:n(()=>a||r.raw.writableEnded,"responded")}},"httpContext"),upgradeContext:n((e,t,r)=>{let d=!1;return{req:e,request:void 0,reply:void 0,socket:t,trace:r,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n(()=>{try{t.destroy()}catch{}d=!0},"sendError"),responded:n(()=>d||t.destroyed,"responded")}},"upgradeContext")}}u(createHooks,"createHooks"),i(createHooks,"createHooks"),n(createHooks,"createHooks");

package/executors/gateway/prod-runtime/observability.js

@@ -1 +1 @@
-"use strict";var b=Object.defineProperty;var p=(o,d)=>b(o,"name",{value:d,configurable:!0});var y=Object.defineProperty,c=p((o,d)=>y(o,"name",{value:d,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createObservability=createObservability;const redact_1=require("@lensmcp/core/redact"),edge_1=require("./edge");function createObservability(o,d){const v=c((e,t,s,r,a)=>{if(o.emit)try{o.emit({id:(0,edge_1.eid)(),sessionId:"pending",timestamp:Date.now(),source:"gateway",category:"cluster",severity:e,context:(0,redact_1.redactDeep)({sessionId:"pending",...a}),fingerprint:s,title:(0,redact_1.safeTitle)(t),raw:r&&(0,redact_1.redactDeep)(r)})}catch{}},"emit"),h=new Map,q=c((e,t,s,r,a)=>{const n=e.host??"(default)",u=(r?r+"\u21D2":"")+n+"\u2192"+e.service+(a?"@"+a:""),i=h.get(u)??{host:n,service:e.service,caller:r,version:a,count:0,totalMs:0,errors:0};i.count+=1,i.totalMs+=t,(s>=500||s===0)&&(i.errors+=1),h.set(u,i)},"recordEdge"),m=Math.max(1,o.statusWindows??12),f=[],w=new Map,M=c(()=>[...new Set(d().map(e=>e.service))],"routeServices"),S=c(()=>{const e=new Map;for(const s of h.values()){const r=e.get(s.service)??{requests:0,errors:0,totalMs:0,versions:new Set};r.requests+=s.count,r.errors+=s.errors,r.totalMs+=s.totalMs,s.version&&r.versions.add(s.version),e.set(s.service,r)}const t=Date.now();for(const[s,r]of e)r.requests>0&&w.set(s,t);for(f.push(e);f.length>m;)f.shift()},"pushStatusWindow"),g=c(()=>{const e=new Map;for(const s of f)for(const[r,a]of s){const n=e.get(r)??{requests:0,errors:0,totalMs:0,versions:new Set};n.requests+=a.requests,n.errors+=a.errors,n.totalMs+=a.totalMs;for(const u of a.versions)n.versions.add(u);e.set(r,n)}const t=d();return M().map(s=>{const r=e.get(s)??{requests:0,errors:0,totalMs:0,versions:new Set},a=[...new Set(t.filter(i=>i.service===s).map(i=>i.host??"(default)"))],n=r.requests?r.errors/r.requests:0;let u=r.requests===0?"idle":n>=.5?"down":n>=.05?"degraded":"healthy";if(o.healthChecker){const i=t.filter(l=>l.service===s&&l.upstream).map(l=>l.upstream);i.length&&i.every(l=>!o.healthChecker.isHealthy(l))&&(u="down")}return{service:s,hosts:a,status:u,requests:r.requests,errorRate:+n.toFixed(4),avgMs:r.requests?Math.round(r.totalMs/r.requests):0,versions:[...r.versions],lastSeen:w.get(s)??null}})},"buildStatusSnapshot");return{emit:v,beginTrace:c(e=>{if(!o.emit)return;const t=(0,edge_1.hdr)(e.headers["x-lensmcp-flow-id"]);let s=(0,edge_1.hdr)(e.headers["x-request-id"]);if(!(!t&&!s&&!(0,edge_1.hdr)(e.headers.traceparent)))return s||(s=(0,edge_1.eid)(),e.headers["x-request-id"]=s),{startedAt:Date.now(),method:(e.method??"GET").toUpperCase(),host:(e.headers.host||"").split(":")[0],url:e.url??"/",steps:[],...t?{flowId:t}:{},...s?{requestId:s}:{}}},"beginTrace"),step:c((e,t,s)=>{e&&e.steps.push({step:t,atMs:Date.now()-e.startedAt,...s})},"step"),finish:c((e,t,s,r)=>{!e||e.done||(e.done=!0,v(s>=500?"error":"info",`gateway ${e.method} ${e.host}${e.url} \u2192 ${s} (${Date.now()-e.startedAt}ms)`,`gateway-request:${t}`,{kind:"gateway-request",project:t,host:e.host,method:e.method,url:e.url,status:s,durationMs:Date.now()-e.startedAt,startedAt:e.startedAt,steps:e.steps,...r},{...e.flowId?{flowId:e.flowId}:{},...e.requestId?{requestId:e.requestId}:{}}))},"finish"),recordEdge:q,buildStatusSnapshot:g,startFlusher:c(()=>{const e=setInterval(()=>{if(S(),o.onStatus)try{o.onStatus(g())}catch{}if(o.emit)for(const t of h.values())v(t.errors?"warning":"info",`traffic ${t.host} \u2192 ${t.service}${t.version?"@"+t.version:""}: ${t.count} req`,`gateway-traffic:${t.host}->${t.service}${t.version?"@"+t.version:""}`,{kind:"gateway-traffic",host:t.host,project:t.service,caller:t.caller,version:t.version,count:t.count,avgMs:Math.round(t.totalMs/t.count),errors:t.errors});h.clear()},o.trafficFlushMs??5e3);return e.unref?.(),e},"startFlusher")}}p(createObservability,"createObservability"),c(createObservability,"createObservability");
+"use strict";var I=Object.defineProperty;var w=(o,u)=>I(o,"name",{value:u,configurable:!0});var b=Object.defineProperty,p=w((o,u)=>b(o,"name",{value:u,configurable:!0}),"p"),y=Object.defineProperty,c=p((o,u)=>y(o,"name",{value:u,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createObservability=createObservability;const redact_1=require("@lensmcp/core/redact"),edge_1=require("./edge");function createObservability(o,u){const v=c((e,t,s,r,a)=>{if(o.emit)try{o.emit({id:(0,edge_1.eid)(),sessionId:"pending",timestamp:Date.now(),source:"gateway",category:"cluster",severity:e,context:(0,redact_1.redactDeep)({sessionId:"pending",...a}),fingerprint:s,title:(0,redact_1.safeTitle)(t),raw:r&&(0,redact_1.redactDeep)(r)})}catch{}},"emit"),h=new Map,q=c((e,t,s,r,a)=>{const n=e.host??"(default)",d=(r?r+"\u21D2":"")+n+"\u2192"+e.service+(a?"@"+a:""),i=h.get(d)??{host:n,service:e.service,caller:r,version:a,count:0,totalMs:0,errors:0};i.count+=1,i.totalMs+=t,(s>=500||s===0)&&(i.errors+=1),h.set(d,i)},"recordEdge"),M=Math.max(1,o.statusWindows??12),f=[],g=new Map,S=c(()=>[...new Set(u().map(e=>e.service))],"routeServices"),$=c(()=>{const e=new Map;for(const s of h.values()){const r=e.get(s.service)??{requests:0,errors:0,totalMs:0,versions:new Set};r.requests+=s.count,r.errors+=s.errors,r.totalMs+=s.totalMs,s.version&&r.versions.add(s.version),e.set(s.service,r)}const t=Date.now();for(const[s,r]of e)r.requests>0&&g.set(s,t);for(f.push(e);f.length>M;)f.shift()},"pushStatusWindow"),m=c(()=>{const e=new Map;for(const s of f)for(const[r,a]of s){const n=e.get(r)??{requests:0,errors:0,totalMs:0,versions:new Set};n.requests+=a.requests,n.errors+=a.errors,n.totalMs+=a.totalMs;for(const d of a.versions)n.versions.add(d);e.set(r,n)}const t=u();return S().map(s=>{const r=e.get(s)??{requests:0,errors:0,totalMs:0,versions:new Set},a=[...new Set(t.filter(i=>i.service===s).map(i=>i.host??"(default)"))],n=r.requests?r.errors/r.requests:0;let d=r.requests===0?"idle":n>=.5?"down":n>=.05?"degraded":"healthy";if(o.healthChecker){const i=t.filter(l=>l.service===s&&l.upstream).map(l=>l.upstream);i.length&&i.every(l=>!o.healthChecker.isHealthy(l))&&(d="down")}return{service:s,hosts:a,status:d,requests:r.requests,errorRate:+n.toFixed(4),avgMs:r.requests?Math.round(r.totalMs/r.requests):0,versions:[...r.versions],lastSeen:g.get(s)??null}})},"buildStatusSnapshot");return{emit:v,beginTrace:c(e=>{if(!o.emit)return;const t=(0,edge_1.hdr)(e.headers["x-lensmcp-flow-id"]);let s=(0,edge_1.hdr)(e.headers["x-request-id"]);if(!(!t&&!s&&!(0,edge_1.hdr)(e.headers.traceparent)))return s||(s=(0,edge_1.eid)(),e.headers["x-request-id"]=s),{startedAt:Date.now(),method:(e.method??"GET").toUpperCase(),host:(e.headers.host||"").split(":")[0],url:e.url??"/",steps:[],...t?{flowId:t}:{},...s?{requestId:s}:{}}},"beginTrace"),step:c((e,t,s)=>{e&&e.steps.push({step:t,atMs:Date.now()-e.startedAt,...s})},"step"),finish:c((e,t,s,r)=>{!e||e.done||(e.done=!0,v(s>=500?"error":"info",`gateway ${e.method} ${e.host}${e.url} \u2192 ${s} (${Date.now()-e.startedAt}ms)`,`gateway-request:${t}`,{kind:"gateway-request",project:t,host:e.host,method:e.method,url:e.url,status:s,durationMs:Date.now()-e.startedAt,startedAt:e.startedAt,steps:e.steps,...r},{...e.flowId?{flowId:e.flowId}:{},...e.requestId?{requestId:e.requestId}:{}}))},"finish"),recordEdge:q,buildStatusSnapshot:m,startFlusher:c(()=>{const e=setInterval(()=>{if($(),o.onStatus)try{o.onStatus(m())}catch{}if(o.emit)for(const t of h.values())v(t.errors?"warning":"info",`traffic ${t.host} \u2192 ${t.service}${t.version?"@"+t.version:""}: ${t.count} req`,`gateway-traffic:${t.host}->${t.service}${t.version?"@"+t.version:""}`,{kind:"gateway-traffic",host:t.host,project:t.service,caller:t.caller,version:t.version,count:t.count,avgMs:Math.round(t.totalMs/t.count),errors:t.errors});h.clear()},o.trafficFlushMs??5e3);return e.unref?.(),e},"startFlusher")}}w(createObservability,"createObservability"),p(createObservability,"createObservability"),c(createObservability,"createObservability");

package/executors/gateway/prod-runtime/rollout.js

@@ -1 +1 @@
-"use strict";var b=Object.defineProperty;var d=(o,s)=>b(o,"name",{value:s,configurable:!0});var H=Object.defineProperty,c=d((o,s)=>H(o,"name",{value:s,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRollout=createRollout;const node_crypto_1=require("node:crypto"),client_ip_1=require("../client-ip"),edge_1=require("./edge");function createRollout(o){const s=(0,client_ip_1.createClientIpResolver)({...o.clientIpHeader?{clientIpHeader:o.clientIpHeader}:{},...o.clientIpTrustedProxies?{clientIpTrustedProxies:o.clientIpTrustedProxies}:{},trustProxyHops:o.trustProxyIp?Math.max(1,Math.floor(o.trustProxyHops??1)):0}),h=s.clientIpOf,I=s.forwardedFor,g=(o.attributeHeaders??[]).map(e=>e.toLowerCase()),l=o.uidHeader?.toLowerCase(),a=o.cookie?.secret,u=!!o.cookie&&!!a,p=o.cookie?.name??"lensmcp_did",f=o.cookie?.domain,x=o.cookie?.maxAge??31536e3;o.cookie&&!a&&console.warn("[gateway] device cookie has NO secret \u2014 sticky cookie bucketing is DISABLED (set cookie.secret / LENSMCP_GW_COOKIE_SECRET to enable it). An unsigned cookie is attacker-choosable.");const m=c(e=>(0,node_crypto_1.createHmac)("sha256",a).update(e).digest("base64url"),"signId"),C=c(e=>`${e}.${m(e)}`,"signedCookie"),v=c(e=>{if(!a)return;const r=e.lastIndexOf(".");if(r<0)return;const t=e.slice(0,r),n=Buffer.from(e.slice(r+1)),i=Buffer.from(m(t));return n.length===i.length&&(0,node_crypto_1.timingSafeEqual)(n,i)?t:void 0},"verifyCookie"),_=c((e,r)=>{if(e)for(const t of e.split(";")){const n=t.indexOf("=");if(n>0&&t.slice(0,n).trim()===r){const i=t.slice(n+1).trim();try{return decodeURIComponent(i)}catch{return}}}},"parseCookie");return{clientIpOf:h,forwardedFor:I,buildAttrs:c((e,r,t,n)=>{const i={...t??{}};i.ip=r,i.method=(e.method??"GET").toUpperCase(),i.path=(e.url??"/").split("?")[0],n&&(i.device=n);for(const k of g){const y=(0,edge_1.hdr)(e.headers[k]);y!==void 0&&(i["header."+k]=y)}return i},"buildAttrs"),resolveStickyKey:c(e=>{if(u){const r=_(e.headers.cookie,p),t=r?v(r):void 0;if(t)return{key:t,mint:!1}}if(l){const r=(0,edge_1.hdr)(e.headers[l]);if(r)return{key:r,mint:!1}}return u?{key:"d_"+(0,node_crypto_1.randomBytes)(12).toString("base64url"),mint:!0}:{mint:!1}},"resolveStickyKey"),mintCookieHeader:c(e=>{let r=`${p}=${encodeURIComponent(C(e))}; Path=/; Max-Age=${x}; HttpOnly; SameSite=Lax; Secure`;return f&&(r+=`; Domain=${f}`),r},"mintCookieHeader")}}d(createRollout,"createRollout"),c(createRollout,"createRollout");
+"use strict";var P=Object.defineProperty;var l=(t,s)=>P(t,"name",{value:s,configurable:!0});var b=Object.defineProperty,d=l((t,s)=>b(t,"name",{value:s,configurable:!0}),"d"),H=Object.defineProperty,c=d((t,s)=>H(t,"name",{value:s,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRollout=createRollout;const node_crypto_1=require("node:crypto"),client_ip_1=require("../client-ip"),edge_1=require("./edge");function createRollout(t){const s=(0,client_ip_1.createClientIpResolver)({...t.clientIpHeader?{clientIpHeader:t.clientIpHeader}:{},...t.clientIpTrustedProxies?{clientIpTrustedProxies:t.clientIpTrustedProxies}:{},trustProxyHops:t.trustProxyIp?Math.max(1,Math.floor(t.trustProxyHops??1)):0}),g=s.clientIpOf,I=s.forwardedFor,v=(t.attributeHeaders??[]).map(e=>e.toLowerCase()),u=t.uidHeader?.toLowerCase(),a=t.cookie?.secret,p=!!t.cookie&&!!a,f=t.cookie?.name??"lensmcp_did",m=t.cookie?.domain,x=t.cookie?.maxAge??31536e3;t.cookie&&!a&&console.warn("[gateway] device cookie has NO secret \u2014 sticky cookie bucketing is DISABLED (set cookie.secret / LENSMCP_GW_COOKIE_SECRET to enable it). An unsigned cookie is attacker-choosable.");const k=c(e=>(0,node_crypto_1.createHmac)("sha256",a).update(e).digest("base64url"),"signId"),C=c(e=>`${e}.${k(e)}`,"signedCookie"),_=c(e=>{if(!a)return;const r=e.lastIndexOf(".");if(r<0)return;const o=e.slice(0,r),n=Buffer.from(e.slice(r+1)),i=Buffer.from(k(o));return n.length===i.length&&(0,node_crypto_1.timingSafeEqual)(n,i)?o:void 0},"verifyCookie"),O=c((e,r)=>{if(e)for(const o of e.split(";")){const n=o.indexOf("=");if(n>0&&o.slice(0,n).trim()===r){const i=o.slice(n+1).trim();try{return decodeURIComponent(i)}catch{return}}}},"parseCookie");return{clientIpOf:g,forwardedFor:I,buildAttrs:c((e,r,o,n)=>{const i={...o??{}};i.ip=r,i.method=(e.method??"GET").toUpperCase(),i.path=(e.url??"/").split("?")[0],n&&(i.device=n);for(const y of v){const h=(0,edge_1.hdr)(e.headers[y]);h!==void 0&&(i["header."+y]=h)}return i},"buildAttrs"),resolveStickyKey:c(e=>{if(p){const r=O(e.headers.cookie,f),o=r?_(r):void 0;if(o)return{key:o,mint:!1}}if(u){const r=(0,edge_1.hdr)(e.headers[u]);if(r)return{key:r,mint:!1}}return p?{key:"d_"+(0,node_crypto_1.randomBytes)(12).toString("base64url"),mint:!0}:{mint:!1}},"resolveStickyKey"),mintCookieHeader:c(e=>{let r=`${f}=${encodeURIComponent(C(e))}; Path=/; Max-Age=${x}; HttpOnly; SameSite=Lax; Secure`;return m&&(r+=`; Domain=${m}`),r},"mintCookieHeader")}}l(createRollout,"createRollout"),d(createRollout,"createRollout"),c(createRollout,"createRollout");

package/executors/gateway/prod-runtime/routing.js

@@ -1 +1 @@
-"use strict";var m=Object.defineProperty;var i=(a,n)=>m(a,"name",{value:n,configurable:!0});var d=Object.defineProperty,r=i((a,n)=>d(a,"name",{value:n,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRouteTable=createRouteTable;const manifest_1=require("../manifest");function createRouteTable(a,n){const s=[],c=new Map;let o=a.manifests.list();const u=r(e=>{o=e;const t=(0,manifest_1.buildRouteTable)(e);s.length=0,s.push(...t),c.clear();for(const p of e)c.set(p.service,p)},"apply"),l=r(()=>{if(!a.healthChecker)return;const e=new Set;for(const t of s)t.upstream&&e.add(t.upstream);for(const t of a.pods?.endpoints?.()??[])e.add(t);a.healthChecker.track([...e])},"trackUpstreams"),f=r(e=>{u(e),l(),n.emit("info",`gateway routes: ${s.length} on ${o.length} services`,"gateway-up",{kind:"gateway-up",routes:s.map(t=>({host:t.host??"(default)",service:t.service,internal:!!t.internal}))})},"rebuild");u(o);const h=a.manifests.watch?.(e=>f(e));return{routes:s,manifestByService:c,rebuild:f,trackUpstreams:l,manifests:r(()=>o,"manifests"),stop:r(()=>h?.(),"stop")}}i(createRouteTable,"createRouteTable"),r(createRouteTable,"createRouteTable");
+"use strict";var v=Object.defineProperty;var u=(e,a)=>v(e,"name",{value:a,configurable:!0});var m=Object.defineProperty,i=u((e,a)=>m(e,"name",{value:a,configurable:!0}),"i"),d=Object.defineProperty,r=i((e,a)=>d(e,"name",{value:a,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRouteTable=createRouteTable;const manifest_1=require("../manifest");function createRouteTable(e,a){const n=[],c=new Map;let o=e.manifests.list();const l=r(t=>{o=t;const s=(0,manifest_1.buildRouteTable)(t);n.length=0,n.push(...s),c.clear();for(const h of t)c.set(h.service,h)},"apply"),f=r(()=>{if(!e.healthChecker)return;const t=new Set;for(const s of n)s.upstream&&t.add(s.upstream);for(const s of e.pods?.endpoints?.()??[])t.add(s);e.healthChecker.track([...t])},"trackUpstreams"),p=r(t=>{l(t),f(),a.emit("info",`gateway routes: ${n.length} on ${o.length} services`,"gateway-up",{kind:"gateway-up",routes:n.map(s=>({host:s.host??"(default)",service:s.service,internal:!!s.internal}))})},"rebuild");l(o);const b=e.manifests.watch?.(t=>p(t));return{routes:n,manifestByService:c,rebuild:p,trackUpstreams:f,manifests:r(()=>o,"manifests"),stop:r(()=>b?.(),"stop")}}u(createRouteTable,"createRouteTable"),i(createRouteTable,"createRouteTable"),r(createRouteTable,"createRouteTable");

package/executors/gateway/prod-runtime/server.js

@@ -1 +1 @@
-"use strict";var A=Object.defineProperty;var h=(e,a)=>A(e,"name",{value:a,configurable:!0});var R=Object.defineProperty,n=h((e,a)=>R(e,"name",{value:a,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.startProdGateway=startProdGateway;const observability_1=require("./observability"),routing_1=require("./routing"),rollout_1=require("./rollout"),upstream_1=require("./upstream"),auth_1=require("./auth"),hooks_1=require("./hooks"),cors_1=require("./cors"),handler_1=require("./handler"),upgrade_1=require("./upgrade"),app_1=require("./app");async function startProdGateway(e){const a=e.ports?.length?e.ports:[e.tls?8443:8080],j=e.authenticate??(t=>{if(t==="jwt")throw new Error("jwt route but no authenticator configured")}),C=(e.versionHeader??"x-lensmcp-version").toLowerCase(),P=!!e.accessLog,L=new Set((e.corsCredentialOrigins??[]).map(t=>t.toLowerCase())),d=new Map;for(const[t,s]of Object.entries(e.serviceKeys??{}))typeof s=="string"&&s.trim()!==""?d.set(s,t):console.warn(`[gateway] service key for "${t}" is empty \u2014 east-west auth for that service is DISABLED (all internal routes 401) until a key is set.`);const w={},r=(0,observability_1.createObservability)(e,()=>w.current.routes),o=(0,routing_1.createRouteTable)(e,r);w.current=o;const i={opts:e,table:o,keyToProject:d,versionHeader:C,accessLog:P,corsCredentialOrigins:L},u=(0,rollout_1.createRollout)(e),y=(0,upstream_1.createUpstream)(e,r),g=(0,auth_1.createEdgeAuth)(i,r,u,j),c=(0,hooks_1.createHooks)(e.hooks??{}),p=new WeakMap,b=new WeakMap,m=new WeakMap,f=(0,cors_1.createCors)(i,p),O=(0,handler_1.createHandler)({rt:i,obs:r,cors:f,auth:g,upstream:y,rollout:u,hooks:c,reqState:p,spanByReq:b,ctxByReq:m}),M=(0,upgrade_1.createUpgrade)({rt:i,obs:r,auth:g,upstream:y,hooks:c,rollout:u}),{buildApp:S}=(0,app_1.createApp)({rt:i,obs:r,cors:f,hooks:c,handler:O,upgrade:M,reqState:p,spanByReq:b,ctxByReq:m}),x=r.startFlusher();o.rebuild(o.manifests());const k=[],q=[];for(const t of a){const s=await S();await s.listen({port:t,host:"0.0.0.0"});const l=s.server.address(),_=typeof l=="object"&&l?l.port:t;q.push(_),console.log(`[gateway] listening on ${e.tls?"https":"http"}://0.0.0.0:${_}`),k.push(s)}e.healthChecker?.start();let v=!1;return{ports:q,routes:n(()=>o.routes,"routes"),status:r.buildStatusSnapshot,refreshUpstreams:o.trackUpstreams,stop:n(async()=>{v||(v=!0,clearInterval(x),o.stop(),e.healthChecker?.stop(),e.rateLimiter?.stop(),e.metrics?.stop(),r.emit("info","gateway down","gateway-down",{kind:"gateway-down"}),await Promise.all(k.map(t=>t.close())))},"stop")}}h(startProdGateway,"startProdGateway"),n(startProdGateway,"startProdGateway");
+"use strict";var G=Object.defineProperty;var d=(e,a)=>G(e,"name",{value:a,configurable:!0});var A=Object.defineProperty,h=d((e,a)=>A(e,"name",{value:a,configurable:!0}),"h"),R=Object.defineProperty,n=h((e,a)=>R(e,"name",{value:a,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.startProdGateway=startProdGateway;const observability_1=require("./observability"),routing_1=require("./routing"),rollout_1=require("./rollout"),upstream_1=require("./upstream"),auth_1=require("./auth"),hooks_1=require("./hooks"),cors_1=require("./cors"),handler_1=require("./handler"),upgrade_1=require("./upgrade"),app_1=require("./app");async function startProdGateway(e){const a=e.ports?.length?e.ports:[e.tls?8443:8080],j=e.authenticate??(t=>{if(t==="jwt")throw new Error("jwt route but no authenticator configured")}),C=(e.versionHeader??"x-lensmcp-version").toLowerCase(),O=!!e.accessLog,L=new Set((e.corsCredentialOrigins??[]).map(t=>t.toLowerCase())),w=new Map;for(const[t,s]of Object.entries(e.serviceKeys??{}))typeof s=="string"&&s.trim()!==""?w.set(s,t):console.warn(`[gateway] service key for "${t}" is empty \u2014 east-west auth for that service is DISABLED (all internal routes 401) until a key is set.`);const y={},r=(0,observability_1.createObservability)(e,()=>y.current.routes),o=(0,routing_1.createRouteTable)(e,r);y.current=o;const i={opts:e,table:o,keyToProject:w,versionHeader:C,accessLog:O,corsCredentialOrigins:L},u=(0,rollout_1.createRollout)(e),g=(0,upstream_1.createUpstream)(e,r),b=(0,auth_1.createEdgeAuth)(i,r,u,j),c=(0,hooks_1.createHooks)(e.hooks??{}),p=new WeakMap,f=new WeakMap,m=new WeakMap,k=(0,cors_1.createCors)(i,p),S=(0,handler_1.createHandler)({rt:i,obs:r,cors:k,auth:b,upstream:g,rollout:u,hooks:c,reqState:p,spanByReq:f,ctxByReq:m}),x=(0,upgrade_1.createUpgrade)({rt:i,obs:r,auth:b,upstream:g,hooks:c,rollout:u}),{buildApp:M}=(0,app_1.createApp)({rt:i,obs:r,cors:k,hooks:c,handler:S,upgrade:x,reqState:p,spanByReq:f,ctxByReq:m}),B=r.startFlusher();o.rebuild(o.manifests());const v=[],q=[];for(const t of a){const s=await M();await s.listen({port:t,host:"0.0.0.0"});const l=s.server.address(),P=typeof l=="object"&&l?l.port:t;q.push(P),console.log(`[gateway] listening on ${e.tls?"https":"http"}://0.0.0.0:${P}`),v.push(s)}e.healthChecker?.start();let _=!1;return{ports:q,routes:n(()=>o.routes,"routes"),status:r.buildStatusSnapshot,refreshUpstreams:o.trackUpstreams,stop:n(async()=>{_||(_=!0,clearInterval(B),o.stop(),e.healthChecker?.stop(),e.rateLimiter?.stop(),e.metrics?.stop(),r.emit("info","gateway down","gateway-down",{kind:"gateway-down"}),await Promise.all(v.map(t=>t.close())))},"stop")}}d(startProdGateway,"startProdGateway"),h(startProdGateway,"startProdGateway"),n(startProdGateway,"startProdGateway");

package/executors/gateway/prod-runtime/trust.js

@@ -1 +1 @@
-"use strict";var d=Object.defineProperty;var p=(t,e)=>d(t,"name",{value:e,configurable:!0});var x=Object.defineProperty,r=p((t,e)=>x(t,"name",{value:e,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.stampIdentity=exports.stripTrust=exports.HOP_BY_HOP=exports.TRUST_HEADERS=void 0,exports.TRUST_HEADERS=["x-internal-token","x-api-key-id","x-user-id","x-tenant-id","x-user-roles","x-user-permissions"],exports.HOP_BY_HOP=["connection","proxy-connection","keep-alive"];const stripTrust=r(t=>{for(const e of exports.TRUST_HEADERS)delete t.headers[e];for(const e of exports.HOP_BY_HOP)delete t.headers[e]},"stripTrust");exports.stripTrust=stripTrust;const stampIdentity=r((t,e)=>{const i=r((a,s)=>{(typeof s=="string"&&s!==""||typeof s=="number")&&(t.headers[a]=String(s))},"set");i("x-user-id",e.sub),i("x-tenant-id",e.tid);const o=e.roles;Array.isArray(o)&&o.length&&(t.headers["x-user-roles"]=o.map(String).join(","));const n=e.perms;Array.isArray(n)&&n.length&&(t.headers["x-user-permissions"]=n.map(String).join(","))},"stampIdentity");exports.stampIdentity=stampIdentity;
+"use strict";var c=Object.defineProperty;var a=(t,e)=>c(t,"name",{value:e,configurable:!0});var d=Object.defineProperty,p=a((t,e)=>d(t,"name",{value:e,configurable:!0}),"p"),x=Object.defineProperty,r=p((t,e)=>x(t,"name",{value:e,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.stampIdentity=exports.stripTrust=exports.HOP_BY_HOP=exports.TRUST_HEADERS=void 0,exports.TRUST_HEADERS=["x-internal-token","x-api-key-id","x-user-id","x-tenant-id","x-user-roles","x-user-permissions"],exports.HOP_BY_HOP=["connection","proxy-connection","keep-alive"];const stripTrust=r(t=>{for(const e of exports.TRUST_HEADERS)delete t.headers[e];for(const e of exports.HOP_BY_HOP)delete t.headers[e]},"stripTrust");exports.stripTrust=stripTrust;const stampIdentity=r((t,e)=>{const i=r((u,s)=>{(typeof s=="string"&&s!==""||typeof s=="number")&&(t.headers[u]=String(s))},"set");i("x-user-id",e.sub),i("x-tenant-id",e.tid);const o=e.roles;Array.isArray(o)&&o.length&&(t.headers["x-user-roles"]=o.map(String).join(","));const n=e.perms;Array.isArray(n)&&n.length&&(t.headers["x-user-permissions"]=n.map(String).join(","))},"stampIdentity");exports.stampIdentity=stampIdentity;

package/executors/gateway/prod-runtime/upgrade.js

@@ -1,12 +1,12 @@
-"use strict";var V=Object.defineProperty;var A=(p,s)=>V(p,"name",{value:s,configurable:!0});var F=Object.defineProperty,u=A((p,s)=>F(p,"name",{value:s,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createUpgrade=createUpgrade;const tslib_1=require("tslib"),net=tslib_1.__importStar(require("node:net")),tls=tslib_1.__importStar(require("node:tls")),manifest_1=require("../manifest"),edge_1=require("./edge"),trust_1=require("./trust"),validHeaderValue=u(p=>/^[\t\x20-\x7e\x80-\xff]*$/.test(p),"validHeaderValue"),validToken=u(p=>/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(p),"validToken"),FORWARDED_HEADERS=["x-forwarded-for","x-forwarded-proto","x-forwarded-host"],MAX_HEAD_BYTES=64*1024,HANDSHAKE_TIMEOUT_MS=3e4;function createUpgrade(p){const{rt:s,obs:g,auth:S,upstream:z,hooks:y,rollout:E}=p,l=u((e,t,i,c)=>{g.emit("warning",`gateway upgrade rejected (${t})${i?` for ${i}`:""}`,`gateway-upgrade:${i??"(none)"}:${t}`,{kind:"gateway-upgrade-rejected",reason:t,...i?{project:i}:{},...c}),e.destroy()},"reject"),I=u((e,t,i="")=>{try{e.end(`HTTP/1.1 ${t}\r
-${i}Connection: close\r
+"use strict";var G=Object.defineProperty;var S=(d,n)=>G(d,"name",{value:n,configurable:!0});var V=Object.defineProperty,A=S((d,n)=>V(d,"name",{value:n,configurable:!0}),"A"),F=Object.defineProperty,u=A((d,n)=>F(d,"name",{value:n,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createUpgrade=createUpgrade;const tslib_1=require("tslib"),net=tslib_1.__importStar(require("node:net")),tls=tslib_1.__importStar(require("node:tls")),manifest_1=require("../manifest"),edge_1=require("./edge"),trust_1=require("./trust"),validHeaderValue=u(d=>/^[\t\x20-\x7e\x80-\xff]*$/.test(d),"validHeaderValue"),validToken=u(d=>/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(d),"validToken"),FORWARDED_HEADERS=["x-forwarded-for","x-forwarded-proto","x-forwarded-host"],MAX_HEAD_BYTES=64*1024,HANDSHAKE_TIMEOUT_MS=3e4;function createUpgrade(d){const{rt:n,obs:h,auth:U,upstream:I,hooks:y,rollout:E}=d,l=u((e,t,s,p)=>{h.emit("warning",`gateway upgrade rejected (${t})${s?` for ${s}`:""}`,`gateway-upgrade:${s??"(none)"}:${t}`,{kind:"gateway-upgrade-rejected",reason:t,...s?{project:s}:{},...p}),e.destroy()},"reject"),K=u((e,t,s="")=>{try{e.end(`HTTP/1.1 ${t}\r
+${s}Connection: close\r
 Content-Length: 0\r
 \r
-`)}catch{e.destroy()}},"refuse"),K=u(async(e,t,i)=>{(0,trust_1.stripTrust)(e);const c=(e.headers.host||"").split(":")[0],m=(0,edge_1.canonicalize)(e.url??"/");if(m===void 0){l(t,"bad-path");return}const U=m.policy;e.url=m.path+m.query;const r=(0,manifest_1.matchRoute)(s.table.routes,c,U+m.query);if(!r){l(t,"no-route",void 0,{host:c});return}const R=e.socket?.remoteAddress??"",q=E.clientIpOf(e,R);if(s.opts.rateLimiter){const a=await s.opts.rateLimiter.check(q);if(!a.allowed){g.emit("warning",`gateway upgrade rate-limited for ${r.service}`,`gateway-upgrade:${r.service}:rate-limited`,{kind:"gateway-upgrade-rejected",reason:"rate-limited",project:r.service}),I(t,"429 Too Many Requests",`Retry-After: ${Math.ceil(a.retryAfterMs/1e3)}\r
-`);return}}const n=y.any?y.upgradeContext(e,t,void 0):void 0;n&&(n.route=r);const P=r.internal?void 0:s.opts.identify?.(e);let T;if(r.internal){const a=S.internal(e,r,void 0);if(!a.ok){l(t,"auth-failed",r.service);return}T=a.caller,n&&(n.caller=T)}else{if(!S.public(e,r,U,P,q,void 0).ok){l(t,"auth-failed",r.service);return}if(n&&(n.claims=P),n&&y.has("afterAuth")&&(await y.run("afterAuth",n),n.responded()))return}if(e.headers["x-forwarded-for"]=E.forwardedFor(e,R),e.headers["x-forwarded-proto"]=s.opts.tls?"https":"http",e.headers["x-forwarded-host"]=e.headers.host??c,s.opts.serviceKeys?.[r.service]&&(e.headers["x-internal-token"]=s.opts.serviceKeys[r.service]),r.prependPrefix){const a=e.url??"/",o=r.prependPrefix;a!==o&&!a.startsWith(o+"/")&&(e.url=o+a)}if(n&&y.has("onUpgrade")&&(await y.run("onUpgrade",n),n.responded()))return;const N=(0,edge_1.hdr)(e.headers[s.versionHeader]),x=await z.resolveUpstream(r,void 0,N);if(!x||!("url"in x)){l(t,"no-upstream",r.service);return}const f=new URL(x.url),B=new Set([...trust_1.TRUST_HEADERS,"x-api-key","connection","proxy-connection","keep-alive",...FORWARDED_HEADERS]),C=e.method??"GET",k=e.url??"/";if(!validToken(C)||!validHeaderValue(k)||k.includes(" ")){l(t,"bad-request-line",r.service);return}const _=[`${C} ${k} HTTP/1.1`,"Connection: Upgrade"];for(let a=0;a<e.rawHeaders.length;a+=2){const o=e.rawHeaders[a],$=e.rawHeaders[a+1]??"";if(!B.has(o.toLowerCase())){if(!validToken(o)||!validHeaderValue($)){l(t,"bad-header",r.service,{header:o.toLowerCase()});return}_.push(`${o}: ${$}`)}}for(const a of[...trust_1.TRUST_HEADERS,...FORWARDED_HEADERS]){const o=e.headers[a];if(!(typeof o!="string"||o==="")){if(!validHeaderValue(o)){l(t,"bad-identity-value",r.service,{header:a});return}_.push(`${a}: ${o}`)}}const b=f.protocol==="https:"||f.protocol==="wss:",D=Number(f.port)||(b?443:80),h=s.opts.undici,d=b?tls.connect({port:D,host:f.hostname,...net.isIP(f.hostname)?{}:{servername:f.hostname},rejectUnauthorized:h?.rejectUnauthorized??!1,...h?.cert?{cert:h.cert}:{},...h?.key?{key:h.key}:{},...h?.ca?{ca:h.ca}:{}}):net.connect(D,f.hostname);let v=!1;const w=u(a=>{v||(v=!0,clearTimeout(j),g.emit("warning",`gateway upgrade failed (${a}) for ${r.service}`,`gateway-upgrade:${r.service}:${a}`,{kind:"gateway-upgrade-rejected",reason:a,project:r.service}),d.destroy(),t.destroy())},"abort"),j=setTimeout(()=>w("handshake-timeout"),HANDSHAKE_TIMEOUT_MS);j.unref?.(),d.on("error",()=>w("upstream-error")),t.on("error",()=>w("client-error")),d.on(b?"secureConnect":"connect",()=>{d.write(_.join(`\r
+`)}catch{e.destroy()}},"refuse"),N=u(async(e,t,s)=>{(0,trust_1.stripTrust)(e);const p=(e.headers.host||"").split(":")[0],v=(0,edge_1.canonicalize)(e.url??"/");if(v===void 0){l(t,"bad-path");return}const R=v.policy;e.url=v.path+v.query;const r=(0,manifest_1.matchRoute)(n.table.routes,p,R+v.query);if(!r){l(t,"no-route",void 0,{host:p});return}const q=e.socket?.remoteAddress??"",P=E.clientIpOf(e,q);if(n.opts.rateLimiter){const a=await n.opts.rateLimiter.check(P);if(!a.allowed){h.emit("warning",`gateway upgrade rate-limited for ${r.service}`,`gateway-upgrade:${r.service}:rate-limited`,{kind:"gateway-upgrade-rejected",reason:"rate-limited",project:r.service}),K(t,"429 Too Many Requests",`Retry-After: ${Math.ceil(a.retryAfterMs/1e3)}\r
+`);return}}const i=y.any?y.upgradeContext(e,t,void 0):void 0;i&&(i.route=r);const O=r.internal?void 0:n.opts.identify?.(e);let T;if(r.internal){const a=U.internal(e,r,void 0);if(!a.ok){l(t,"auth-failed",r.service);return}T=a.caller,i&&(i.caller=T)}else{if(!U.public(e,r,R,O,P,void 0).ok){l(t,"auth-failed",r.service);return}if(i&&(i.claims=O),i&&y.has("afterAuth")&&(await y.run("afterAuth",i),i.responded()))return}if(e.headers["x-forwarded-for"]=E.forwardedFor(e,q),e.headers["x-forwarded-proto"]=n.opts.tls?"https":"http",e.headers["x-forwarded-host"]=e.headers.host??p,n.opts.serviceKeys?.[r.service]&&(e.headers["x-internal-token"]=n.opts.serviceKeys[r.service]),r.prependPrefix){const a=e.url??"/",o=r.prependPrefix;a!==o&&!a.startsWith(o+"/")&&(e.url=o+a)}if(i&&y.has("onUpgrade")&&(await y.run("onUpgrade",i),i.responded()))return;const B=(0,edge_1.hdr)(e.headers[n.versionHeader]),x=await I.resolveUpstream(r,void 0,B);if(!x||!("url"in x)){l(t,"no-upstream",r.service);return}const f=new URL(x.url),W=new Set([...trust_1.TRUST_HEADERS,"x-api-key","connection","proxy-connection","keep-alive",...FORWARDED_HEADERS]),C=e.method??"GET",b=e.url??"/";if(!validToken(C)||!validHeaderValue(b)||b.includes(" ")){l(t,"bad-request-line",r.service);return}const k=[`${C} ${b} HTTP/1.1`,"Connection: Upgrade"];for(let a=0;a<e.rawHeaders.length;a+=2){const o=e.rawHeaders[a],$=e.rawHeaders[a+1]??"";if(!W.has(o.toLowerCase())){if(!validToken(o)||!validHeaderValue($)){l(t,"bad-header",r.service,{header:o.toLowerCase()});return}k.push(`${o}: ${$}`)}}for(const a of[...trust_1.TRUST_HEADERS,...FORWARDED_HEADERS]){const o=e.headers[a];if(!(typeof o!="string"||o==="")){if(!validHeaderValue(o)){l(t,"bad-identity-value",r.service,{header:a});return}k.push(`${a}: ${o}`)}}const _=f.protocol==="https:"||f.protocol==="wss:",D=Number(f.port)||(_?443:80),g=n.opts.undici,c=_?tls.connect({port:D,host:f.hostname,...net.isIP(f.hostname)?{}:{servername:f.hostname},rejectUnauthorized:g?.rejectUnauthorized??!1,...g?.cert?{cert:g.cert}:{},...g?.key?{key:g.key}:{},...g?.ca?{ca:g.ca}:{}}):net.connect(D,f.hostname);let m=!1;const w=u(a=>{m||(m=!0,clearTimeout(j),h.emit("warning",`gateway upgrade failed (${a}) for ${r.service}`,`gateway-upgrade:${r.service}:${a}`,{kind:"gateway-upgrade-rejected",reason:a,project:r.service}),c.destroy(),t.destroy())},"abort"),j=setTimeout(()=>w("handshake-timeout"),HANDSHAKE_TIMEOUT_MS);j.unref?.(),c.on("error",()=>w("upstream-error")),t.on("error",()=>w("client-error")),c.on(_?"secureConnect":"connect",()=>{c.write(k.join(`\r
 `)+`\r
 \r
-`),i?.length&&d.write(i)});const M=[];let O=0;const L=u(a=>{if(v)return;M.push(a),O+=a.length;const o=Buffer.concat(M),$=o.indexOf(`\r
+`),s?.length&&c.write(s)});const M=[];let L=0;const z=u(a=>{if(m)return;M.push(a),L+=a.length;const o=Buffer.concat(M),$=o.indexOf(`\r
 \r
-`);if($===-1){O>MAX_HEAD_BYTES&&w("oversized-response-head");return}v=!0,clearTimeout(j),d.off("data",L);const H=Number(/^HTTP\/1\.[01] (\d{3})/.exec(o.subarray(0,o.indexOf(`\r
-`)).toString("latin1"))?.[1]);if(H!==101){g.emit("warning",`gateway upgrade refused upstream (${H||"malformed"}) for ${r.service}`,`gateway-upgrade:${r.service}:upstream-refused`,{kind:"gateway-upgrade-rejected",reason:"upstream-refused",project:r.service,status:H||0}),t.end(o.subarray(0,$+4)),d.destroy();return}g.recordEdge(r,0,101,T,x.version),t.write(o),d.pipe(t),t.pipe(d)},"onHead");d.on("data",L),d.on("close",()=>{v||w("upstream-closed")})},"run");return(e,t,i)=>{K(e,t,i).catch(c=>{g.emit("error",`gateway upgrade error: ${c?.message??String(c)}`,"gateway-upgrade:(none):exception",{kind:"gateway-upgrade-rejected",reason:"exception",error:c?.message??String(c)});try{t.destroy()}catch{}})}}A(createUpgrade,"createUpgrade"),u(createUpgrade,"createUpgrade");
+`);if($===-1){L>MAX_HEAD_BYTES&&w("oversized-response-head");return}m=!0,clearTimeout(j),c.off("data",z);const H=Number(/^HTTP\/1\.[01] (\d{3})/.exec(o.subarray(0,o.indexOf(`\r
+`)).toString("latin1"))?.[1]);if(H!==101){h.emit("warning",`gateway upgrade refused upstream (${H||"malformed"}) for ${r.service}`,`gateway-upgrade:${r.service}:upstream-refused`,{kind:"gateway-upgrade-rejected",reason:"upstream-refused",project:r.service,status:H||0}),t.end(o.subarray(0,$+4)),c.destroy();return}h.recordEdge(r,0,101,T,x.version),t.write(o),c.pipe(t),t.pipe(c)},"onHead");c.on("data",z),c.on("close",()=>{m||w("upstream-closed")})},"run");return(e,t,s)=>{N(e,t,s).catch(p=>{h.emit("error",`gateway upgrade error: ${p?.message??String(p)}`,"gateway-upgrade:(none):exception",{kind:"gateway-upgrade-rejected",reason:"exception",error:p?.message??String(p)});try{t.destroy()}catch{}})}}S(createUpgrade,"createUpgrade"),A(createUpgrade,"createUpgrade"),u(createUpgrade,"createUpgrade");

package/executors/gateway/prod-runtime/upstream.js

@@ -1 +1 @@
-"use strict";var v=Object.defineProperty;var p=(e,t)=>v(e,"name",{value:t,configurable:!0});var u=Object.defineProperty,s=p((e,t)=>u(e,"name",{value:t,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createUpstream=createUpstream;function createUpstream(e,t){return{resolveUpstream:s(async(r,o,i,n)=>{if(r.upstream)return{url:r.upstream};const c={...i?{version:i}:{},...n?{allowDrained:!0}:{},...e.healthChecker?{isHealthy:s(l=>e.healthChecker.isHealthy(l),"isHealthy")}:{}};let a=e.pods?.pick(r.service,c);return!a&&e.pods?.ensureUp&&(t.step(o,"ensure-up",{project:r.service}),await e.pods.ensureUp(r.service)&&(a=e.pods.pick(r.service,c))),a},"resolveUpstream")}}p(createUpstream,"createUpstream"),s(createUpstream,"createUpstream");
+"use strict";var d=Object.defineProperty;var c=(e,r)=>d(e,"name",{value:r,configurable:!0});var v=Object.defineProperty,p=c((e,r)=>v(e,"name",{value:r,configurable:!0}),"p"),u=Object.defineProperty,s=p((e,r)=>u(e,"name",{value:r,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createUpstream=createUpstream;function createUpstream(e,r){return{resolveUpstream:s(async(t,o,i,l)=>{if(t.upstream)return{url:t.upstream};const n={...i?{version:i}:{},...l?{allowDrained:!0}:{},...e.healthChecker?{isHealthy:s(m=>e.healthChecker.isHealthy(m),"isHealthy")}:{}};let a=e.pods?.pick(t.service,n);return!a&&e.pods?.ensureUp&&(r.step(o,"ensure-up",{project:t.service}),await e.pods.ensureUp(t.service)&&(a=e.pods.pick(t.service,n))),a},"resolveUpstream")}}c(createUpstream,"createUpstream"),p(createUpstream,"createUpstream"),s(createUpstream,"createUpstream");

package/executors/gateway/providers-prod.js

@@ -1 +1 @@
-"use strict";var V=Object.defineProperty;var g=(t,o)=>V(t,"name",{value:o,configurable:!0});var P=Object.defineProperty,n=g((t,o)=>P(t,"name",{value:o,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.isRolloutShape=void 0,exports.staticManifestProvider=staticManifestProvider,exports.fileManifestProvider=fileManifestProvider,exports.rolloutPodProvider=rolloutPodProvider,exports.endpointsPodProvider=endpointsPodProvider;const node_fs_1=require("node:fs"),manifest_1=require("./manifest"),FLAT="_flat",isCohortList=n(t=>Array.isArray(t)&&t.every(o=>!!o&&typeof o=="object"&&Array.isArray(o.urls)),"isCohortList"),isUrlList=n(t=>Array.isArray(t)&&t.every(o=>typeof o=="string"),"isUrlList"),isSpec=n(t=>!!t&&typeof t=="object"&&!Array.isArray(t)&&isCohortList(t.cohorts),"isSpec"),isRolloutShape=n(t=>Object.values(t).some(o=>isSpec(o)||isCohortList(o)&&o.length>0),"isRolloutShape");exports.isRolloutShape=isRolloutShape;const isValidEntry=n(t=>isSpec(t)||isCohortList(t)||isUrlList(t),"isValidEntry"),toSpec=n(t=>Array.isArray(t)?isUrlList(t)?{rules:[],cohorts:[{version:FLAT,weight:1,urls:t}]}:{rules:[],cohorts:t}:{rules:t.rules??[],cohorts:t.cohorts??[]},"toSpec");function staticManifestProvider(t){return{list:n(()=>t,"list")}}g(staticManifestProvider,"staticManifestProvider"),n(staticManifestProvider,"staticManifestProvider");function parseManifests(t){let o;try{o=JSON.parse(t)}catch{return}const l=Array.isArray(o)?o:o?.manifests;if(!Array.isArray(l))return;const d=l.filter(f=>!!f&&typeof f=="object"&&typeof f.service=="string"&&Array.isArray(f.mounts));return d.length>0?d:void 0}g(parseManifests,"parseManifests"),n(parseManifests,"parseManifests");function fileManifestProvider(t,o={}){const l=o.onError??(()=>{});let d=[],f=-1;const w=new Set,A=n(()=>{if(!(0,node_fs_1.existsSync)(t))return;let u;try{u=(0,node_fs_1.statSync)(t).mtimeMs}catch{return}if(u===f)return;let M;try{M=(0,node_fs_1.readFileSync)(t,"utf8")}catch(e){l(e);return}const s=parseManifests(M);if(!s){l(new Error(`[gateway] rejecting invalid manifest file ${t} \u2014 keeping last-good`));return}f=u,d=s;for(const e of w)try{e(d)}catch(r){l(r)}},"reload");A();let m;try{m=(0,node_fs_1.watch)(t,{persistent:!1},()=>A())}catch{}const b=setInterval(A,o.pollMs??1e3);return b.unref?.(),{list:n(()=>d,"list"),watch:n(u=>(w.add(u),()=>w.delete(u)),"watch"),stop:n(()=>{try{m?.close()}catch{}clearInterval(b)},"stop")}}g(fileManifestProvider,"fileManifestProvider"),n(fileManifestProvider,"fileManifestProvider");function rolloutPodProvider(t,o={}){const l=new Map,d=o.onError??(()=>{}),f=n(s=>({cohorts:s.cohorts.map(e=>({...e,urls:e.urls.slice()})),select:(0,manifest_1.smoothWeightedSelector)(s.cohorts.map(e=>e.weight)),rr:s.cohorts.map(()=>-1),rules:s.rules??[]}),"build"),w=n(s=>{const e=new Map,r=[];for(const[c,a]of Object.entries(s??{})){const h=n(()=>{const S=l.get(c);S&&e.set(c,S),r.push(c)},"keepLastGood");if(!isValidEntry(a)){h();continue}try{e.set(c,f(toSpec(a)))}catch{h()}}r.length&&d(new Error(`[gateway] rollout config: ignoring invalid entr${r.length>1?"ies":"y"} for ${r.join(", ")} \u2014 keeping last-good`)),l.clear();for(const[c,a]of e)l.set(c,a)},"load");w(t);const A=n(s=>s.cohorts.findIndex(e=>e.urls.length>0),"firstNonEmpty"),m=3e4,b=3e5,u=new Map,M=n(s=>{const e=u.get(s);return!!e&&Date.now()<e.until},"isEjected");return{pick(s,e){const r=l.get(s);if(!r||r.cohorts.length===0)return;const c=e?.isHealthy,a=c||u.size>0?i=>!M(i)&&(c?c(i):!0):void 0,h=n((i,p)=>{const j=r.cohorts[i];if(!j||j.urls.length===0)return;const E=j.urls.length;for(let _=0;_<E;_++){r.rr[i]=(r.rr[i]+1)%E;const L=j.urls[r.rr[i]];if(!p||p(L))return L}},"pickUrl"),S=n(i=>i.urls.length>0&&(e?.allowDrained===!0||i.weight>0),"pinnable"),k=e?.version?r.cohorts.findIndex(i=>i.version===e.version&&S(i)):-1;if(k>=0){const i=h(k,a)??h(k);if(i===void 0)return;const p=r.cohorts[k].version;return p===FLAT?{url:i}:{url:i,version:p}}let v=r.select();(!r.cohorts[v]||r.cohorts[v].urls.length===0)&&(v=A(r));let y=h(v,a);if(y===void 0&&a)for(let i=0;i<r.cohorts.length;i++){const p=h(i,a);if(p!==void 0){v=i,y=p;break}}if(y===void 0&&(y=h(v)),y===void 0)return;const x=r.cohorts[v]?.version;return x===void 0||x===FLAT?{url:y}:{url:y,version:x}},endpoints(){const s=new Set;for(const e of l.values())for(const r of e.cohorts)for(const c of r.urls)s.add(c);return[...s]},resolveVersion(s,e){const r=l.get(s);return r&&r.rules.length?(0,manifest_1.pickTargetedVersion)(r.rules,e):void 0},bucket(s,e){const r=l.get(s);if(!r||r.cohorts.length===0)return;const c=r.cohorts[(0,manifest_1.bucketByWeight)(`${e}:${s}`,r.cohorts.map(a=>a.weight))];return c&&c.version!==FLAT?{version:c.version}:void 0},ensureUp:n(async()=>!0,"ensureUp"),drop(s,e){if(!("url"in e))return;const r=Date.now(),c=u.get(e.url),a=c&&r<c.until+b?c.strikes+1:1;u.set(e.url,{until:r+Math.min(m*2**(a-1),b),strikes:a})},update:w}}g(rolloutPodProvider,"rolloutPodProvider"),n(rolloutPodProvider,"rolloutPodProvider");function endpointsPodProvider(t,o={}){const l=rolloutPodProvider(t,o);return{...l,resolveVersion:n(()=>{},"resolveVersion"),bucket:n(()=>{},"bucket"),update:n(d=>l.update(d),"update")}}g(endpointsPodProvider,"endpointsPodProvider"),n(endpointsPodProvider,"endpointsPodProvider");
+"use strict";var U=Object.defineProperty;var w=(r,o)=>U(r,"name",{value:o,configurable:!0});var V=Object.defineProperty,g=w((r,o)=>V(r,"name",{value:o,configurable:!0}),"g"),P=Object.defineProperty,n=g((r,o)=>P(r,"name",{value:o,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.isRolloutShape=void 0,exports.staticManifestProvider=staticManifestProvider,exports.fileManifestProvider=fileManifestProvider,exports.rolloutPodProvider=rolloutPodProvider,exports.endpointsPodProvider=endpointsPodProvider;const node_fs_1=require("node:fs"),manifest_1=require("./manifest"),FLAT="_flat",isCohortList=n(r=>Array.isArray(r)&&r.every(o=>!!o&&typeof o=="object"&&Array.isArray(o.urls)),"isCohortList"),isUrlList=n(r=>Array.isArray(r)&&r.every(o=>typeof o=="string"),"isUrlList"),isSpec=n(r=>!!r&&typeof r=="object"&&!Array.isArray(r)&&isCohortList(r.cohorts),"isSpec"),isRolloutShape=n(r=>Object.values(r).some(o=>isSpec(o)||isCohortList(o)&&o.length>0),"isRolloutShape");exports.isRolloutShape=isRolloutShape;const isValidEntry=n(r=>isSpec(r)||isCohortList(r)||isUrlList(r),"isValidEntry"),toSpec=n(r=>Array.isArray(r)?isUrlList(r)?{rules:[],cohorts:[{version:FLAT,weight:1,urls:r}]}:{rules:[],cohorts:r}:{rules:r.rules??[],cohorts:r.cohorts??[]},"toSpec");function staticManifestProvider(r){return{list:n(()=>r,"list")}}w(staticManifestProvider,"staticManifestProvider"),g(staticManifestProvider,"staticManifestProvider"),n(staticManifestProvider,"staticManifestProvider");function parseManifests(r){let o;try{o=JSON.parse(r)}catch{return}const l=Array.isArray(o)?o:o?.manifests;if(!Array.isArray(l))return;const d=l.filter(f=>!!f&&typeof f=="object"&&typeof f.service=="string"&&Array.isArray(f.mounts));return d.length>0?d:void 0}w(parseManifests,"parseManifests"),g(parseManifests,"parseManifests"),n(parseManifests,"parseManifests");function fileManifestProvider(r,o={}){const l=o.onError??(()=>{});let d=[],f=-1;const M=new Set,b=n(()=>{if(!(0,node_fs_1.existsSync)(r))return;let u;try{u=(0,node_fs_1.statSync)(r).mtimeMs}catch{return}if(u===f)return;let S;try{S=(0,node_fs_1.readFileSync)(r,"utf8")}catch(t){l(t);return}const s=parseManifests(S);if(!s){l(new Error(`[gateway] rejecting invalid manifest file ${r} \u2014 keeping last-good`));return}f=u,d=s;for(const t of M)try{t(d)}catch(e){l(e)}},"reload");b();let A;try{A=(0,node_fs_1.watch)(r,{persistent:!1},()=>b())}catch{}const m=setInterval(b,o.pollMs??1e3);return m.unref?.(),{list:n(()=>d,"list"),watch:n(u=>(M.add(u),()=>M.delete(u)),"watch"),stop:n(()=>{try{A?.close()}catch{}clearInterval(m)},"stop")}}w(fileManifestProvider,"fileManifestProvider"),g(fileManifestProvider,"fileManifestProvider"),n(fileManifestProvider,"fileManifestProvider");function rolloutPodProvider(r,o={}){const l=new Map,d=o.onError??(()=>{}),f=n(s=>({cohorts:s.cohorts.map(t=>({...t,urls:t.urls.slice()})),select:(0,manifest_1.smoothWeightedSelector)(s.cohorts.map(t=>t.weight)),rr:s.cohorts.map(()=>-1),rules:s.rules??[]}),"build"),M=n(s=>{const t=new Map,e=[];for(const[c,a]of Object.entries(s??{})){const h=n(()=>{const k=l.get(c);k&&t.set(c,k),e.push(c)},"keepLastGood");if(!isValidEntry(a)){h();continue}try{t.set(c,f(toSpec(a)))}catch{h()}}e.length&&d(new Error(`[gateway] rollout config: ignoring invalid entr${e.length>1?"ies":"y"} for ${e.join(", ")} \u2014 keeping last-good`)),l.clear();for(const[c,a]of t)l.set(c,a)},"load");M(r);const b=n(s=>s.cohorts.findIndex(t=>t.urls.length>0),"firstNonEmpty"),A=3e4,m=3e5,u=new Map,S=n(s=>{const t=u.get(s);return!!t&&Date.now()<t.until},"isEjected");return{pick(s,t){const e=l.get(s);if(!e||e.cohorts.length===0)return;const c=t?.isHealthy,a=c||u.size>0?i=>!S(i)&&(c?c(i):!0):void 0,h=n((i,p)=>{const x=e.cohorts[i];if(!x||x.urls.length===0)return;const L=x.urls.length;for(let _=0;_<L;_++){e.rr[i]=(e.rr[i]+1)%L;const O=x.urls[e.rr[i]];if(!p||p(O))return O}},"pickUrl"),k=n(i=>i.urls.length>0&&(t?.allowDrained===!0||i.weight>0),"pinnable"),j=t?.version?e.cohorts.findIndex(i=>i.version===t.version&&k(i)):-1;if(j>=0){const i=h(j,a)??h(j);if(i===void 0)return;const p=e.cohorts[j].version;return p===FLAT?{url:i}:{url:i,version:p}}let v=e.select();(!e.cohorts[v]||e.cohorts[v].urls.length===0)&&(v=b(e));let y=h(v,a);if(y===void 0&&a)for(let i=0;i<e.cohorts.length;i++){const p=h(i,a);if(p!==void 0){v=i,y=p;break}}if(y===void 0&&(y=h(v)),y===void 0)return;const E=e.cohorts[v]?.version;return E===void 0||E===FLAT?{url:y}:{url:y,version:E}},endpoints(){const s=new Set;for(const t of l.values())for(const e of t.cohorts)for(const c of e.urls)s.add(c);return[...s]},resolveVersion(s,t){const e=l.get(s);return e&&e.rules.length?(0,manifest_1.pickTargetedVersion)(e.rules,t):void 0},bucket(s,t){const e=l.get(s);if(!e||e.cohorts.length===0)return;const c=e.cohorts[(0,manifest_1.bucketByWeight)(`${t}:${s}`,e.cohorts.map(a=>a.weight))];return c&&c.version!==FLAT?{version:c.version}:void 0},ensureUp:n(async()=>!0,"ensureUp"),drop(s,t){if(!("url"in t))return;const e=Date.now(),c=u.get(t.url),a=c&&e<c.until+m?c.strikes+1:1;u.set(t.url,{until:e+Math.min(A*2**(a-1),m),strikes:a})},update:M}}w(rolloutPodProvider,"rolloutPodProvider"),g(rolloutPodProvider,"rolloutPodProvider"),n(rolloutPodProvider,"rolloutPodProvider");function endpointsPodProvider(r,o={}){const l=rolloutPodProvider(r,o);return{...l,resolveVersion:n(()=>{},"resolveVersion"),bucket:n(()=>{},"bucket"),update:n(d=>l.update(d),"update")}}w(endpointsPodProvider,"endpointsPodProvider"),g(endpointsPodProvider,"endpointsPodProvider"),n(endpointsPodProvider,"endpointsPodProvider");

package/executors/gateway/rate-limit.js

@@ -1,4 +1,4 @@
-"use strict";var E=Object.defineProperty;var k=(a,e)=>E(a,"name",{value:e,configurable:!0});var A=Object.defineProperty,c=k((a,e)=>A(a,"name",{value:e,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRateLimiter=createRateLimiter,exports.createRedisRateLimiter=createRedisRateLimiter;function createRateLimiter(a){const e=Math.max(1,a.limit),s=Math.max(1,a.windowMs),n=a.now??Date.now,m=e/s,o=new Map,f=c((l,r)=>Math.min(e,l.tokens+(r-l.last)*m),"refilled"),u=setInterval(()=>{const l=n();for(const[r,t]of o)f(t,l)>=e&&o.delete(r)},s);return u.unref?.(),{check(l){const r=n();let t=o.get(l);return t||(t={tokens:e,last:r},o.set(l,t)),t.tokens=f(t,r),t.last=r,t.tokens>=1?(t.tokens-=1,{allowed:!0,remaining:Math.floor(t.tokens),retryAfterMs:0}):{allowed:!1,remaining:0,retryAfterMs:Math.ceil((1-t.tokens)/m)}},stop(){clearInterval(u)}}}k(createRateLimiter,"createRateLimiter"),c(createRateLimiter,"createRateLimiter");const BUCKET_LUA=`
+"use strict";var v=Object.defineProperty;var M=(r,e)=>v(r,"name",{value:e,configurable:!0});var E=Object.defineProperty,k=M((r,e)=>E(r,"name",{value:e,configurable:!0}),"k"),A=Object.defineProperty,c=k((r,e)=>A(r,"name",{value:e,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRateLimiter=createRateLimiter,exports.createRedisRateLimiter=createRedisRateLimiter;function createRateLimiter(r){const e=Math.max(1,r.limit),i=Math.max(1,r.windowMs),n=r.now??Date.now,m=e/i,l=new Map,f=c((a,o)=>Math.min(e,a.tokens+(o-a.last)*m),"refilled"),u=setInterval(()=>{const a=n();for(const[o,t]of l)f(t,a)>=e&&l.delete(o)},i);return u.unref?.(),{check(a){const o=n();let t=l.get(a);return t||(t={tokens:e,last:o},l.set(a,t)),t.tokens=f(t,o),t.last=o,t.tokens>=1?(t.tokens-=1,{allowed:!0,remaining:Math.floor(t.tokens),retryAfterMs:0}):{allowed:!1,remaining:0,retryAfterMs:Math.ceil((1-t.tokens)/m)}},stop(){clearInterval(u)}}}M(createRateLimiter,"createRateLimiter"),k(createRateLimiter,"createRateLimiter"),c(createRateLimiter,"createRateLimiter");const BUCKET_LUA=`
 local b = redis.call('HMGET', KEYS[1], 't', 's')
 local cap = tonumber(ARGV[1])
 local refill = tonumber(ARGV[2])
@@ -15,4 +15,4 @@ redis.call('HSET', KEYS[1], 't', tokens, 's', now)
 redis.call('PEXPIRE', KEYS[1], ttl)
 local retry = 0
 if ok == 0 then retry = math.ceil((1 - tokens) / refill) end
-return {ok, math.floor(tokens), retry}`,RL_TIMEOUT=Symbol("rl-timeout"),RL_FAIL=Symbol("rl-fail");function createRedisRateLimiter(a,e){const s=Math.max(1,e.limit),n=Math.max(1,e.windowMs),m=e.prefix??"lensmcp:gw:rl:",o=Math.max(1,e.timeoutMs??100),f=e.failOpen!==!1,u=s/n,l=Math.ceil(n)+1e3;let r=!1;const t=c(M=>(r||(r=!0,e.onFailure?.(M)),f?{allowed:!0,remaining:s,retryAfterMs:0}:{allowed:!1,remaining:0,retryAfterMs:n}),"onFail");return{async check(M){let w,h="redis unavailable";const b=Promise.resolve(a.eval(BUCKET_LUA,1,`${m}${M}`,s,u,l)).then(i=>i,i=>(h=String(i?.message??i),RL_FAIL)),R=new Promise(i=>{w=setTimeout(()=>i(RL_TIMEOUT),o)}),d=await Promise.race([b,R]);if(clearTimeout(w),d===RL_TIMEOUT||d===RL_FAIL)return t(d===RL_TIMEOUT?`redis timed out after ${o}ms`:h);const[y,p,g]=d;return y===1?{allowed:!0,remaining:Number(p)||0,retryAfterMs:0}:{allowed:!1,remaining:0,retryAfterMs:Number(g)||n}},stop(){}}}k(createRedisRateLimiter,"createRedisRateLimiter"),c(createRedisRateLimiter,"createRedisRateLimiter");
+return {ok, math.floor(tokens), retry}`,RL_TIMEOUT=Symbol("rl-timeout"),RL_FAIL=Symbol("rl-fail");function createRedisRateLimiter(r,e){const i=Math.max(1,e.limit),n=Math.max(1,e.windowMs),m=e.prefix??"lensmcp:gw:rl:",l=Math.max(1,e.timeoutMs??100),f=e.failOpen!==!1,u=i/n,a=Math.ceil(n)+1e3;let o=!1;const t=c(w=>(o||(o=!0,e.onFailure?.(w)),f?{allowed:!0,remaining:i,retryAfterMs:0}:{allowed:!1,remaining:0,retryAfterMs:n}),"onFail");return{async check(w){let b,h="redis unavailable";const R=Promise.resolve(r.eval(BUCKET_LUA,1,`${m}${w}`,i,u,a)).then(s=>s,s=>(h=String(s?.message??s),RL_FAIL)),p=new Promise(s=>{b=setTimeout(()=>s(RL_TIMEOUT),l)}),d=await Promise.race([R,p]);if(clearTimeout(b),d===RL_TIMEOUT||d===RL_FAIL)return t(d===RL_TIMEOUT?`redis timed out after ${l}ms`:h);const[y,g,L]=d;return y===1?{allowed:!0,remaining:Number(g)||0,retryAfterMs:0}:{allowed:!1,remaining:0,retryAfterMs:Number(L)||n}},stop(){}}}M(createRedisRateLimiter,"createRedisRateLimiter"),k(createRedisRateLimiter,"createRedisRateLimiter"),c(createRedisRateLimiter,"createRedisRateLimiter");

package/executors/gateway/registry-source.js

@@ -1 +1 @@
-"use strict";var g=Object.defineProperty;var u=(e,t)=>g(e,"name",{value:t,configurable:!0});var y=Object.defineProperty,n=u((e,t)=>y(e,"name",{value:t,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.changeChannel=exports.rolloutKey=exports.manifestKey=exports.DEFAULT_REGISTRY_PREFIX=void 0,exports.redisRegistrySource=redisRegistrySource,exports.createRegistryProviders=createRegistryProviders;const providers_prod_1=require("./providers-prod");exports.DEFAULT_REGISTRY_PREFIX="lensmcp:gw";const manifestKey=n((e,t)=>`${e}:manifest:${t}`,"manifestKey");exports.manifestKey=manifestKey;const rolloutKey=n((e,t)=>`${e}:rollout:${t}`,"rolloutKey");exports.rolloutKey=rolloutKey;const changeChannel=n(e=>`${e}:changed`,"changeChannel");exports.changeChannel=changeChannel;function parseManifest(e){try{const t=JSON.parse(e);return t&&typeof t.service=="string"&&Array.isArray(t.mounts)?t:void 0}catch{return}}u(parseManifest,"parseManifest"),n(parseManifest,"parseManifest");function redisRegistrySource(e,t={}){const a=t.prefix??exports.DEFAULT_REGISTRY_PREFIX;let s;const c=`${a}:rollout:`;return{async read(){const i=await e.keys(`${a}:manifest:*`),d=i.length?(await e.mget(...i)).filter(r=>!!r).map(parseManifest).filter(r=>!!r):[],o=await e.keys(`${c}*`),l={};if(o.length){const r=await e.mget(...o);o.forEach((p,h)=>{const f=r[h];if(f)try{l[p.slice(c.length)]=JSON.parse(f)}catch{}})}return{manifests:d,endpoints:l}},async watch(i){return s=e.duplicate(),await s.subscribe((0,exports.changeChannel)(a)),s.on("message",()=>i()),async()=>{try{await s?.quit()}catch{}}},stop(){s?.quit().catch(()=>{})}}}u(redisRegistrySource,"redisRegistrySource"),n(redisRegistrySource,"redisRegistrySource");function createRegistryProviders(e,t={}){const a=t.onError??(()=>{});let s=[];const c=new Set,i=(0,providers_prod_1.rolloutPodProvider)({},{onError:a});let d,o;const l=n(async()=>{let r;try{r=await e.read()}catch(p){a(p);return}if(s.length>0&&r.manifests.length===0){a(new Error("[gateway] registry read came back EMPTY while serving routes \u2014 keeping last-good (set the registry to a single manifest to drain deliberately)"));return}s=r.manifests,(Object.keys(r.endpoints).length>0||s.length===0)&&i.update(r.endpoints);for(const p of c)try{p(s)}catch(h){a(h)}},"refresh");return{manifests:{list:n(()=>s,"list"),watch:n(r=>(c.add(r),()=>c.delete(r)),"watch")},pods:i,async start(){if(await l(),e.watch)try{d=await e.watch(()=>{l()})}catch(r){a(r)}o=setInterval(()=>{l()},t.pollMs??5e3),o.unref?.()},stop(){d?.(),o&&clearInterval(o),e.stop?.()}}}u(createRegistryProviders,"createRegistryProviders"),n(createRegistryProviders,"createRegistryProviders");
+"use strict";var v=Object.defineProperty;var d=(e,t)=>v(e,"name",{value:t,configurable:!0});var g=Object.defineProperty,u=d((e,t)=>g(e,"name",{value:t,configurable:!0}),"u"),y=Object.defineProperty,n=u((e,t)=>y(e,"name",{value:t,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.changeChannel=exports.rolloutKey=exports.manifestKey=exports.DEFAULT_REGISTRY_PREFIX=void 0,exports.redisRegistrySource=redisRegistrySource,exports.createRegistryProviders=createRegistryProviders;const providers_prod_1=require("./providers-prod");exports.DEFAULT_REGISTRY_PREFIX="lensmcp:gw";const manifestKey=n((e,t)=>`${e}:manifest:${t}`,"manifestKey");exports.manifestKey=manifestKey;const rolloutKey=n((e,t)=>`${e}:rollout:${t}`,"rolloutKey");exports.rolloutKey=rolloutKey;const changeChannel=n(e=>`${e}:changed`,"changeChannel");exports.changeChannel=changeChannel;function parseManifest(e){try{const t=JSON.parse(e);return t&&typeof t.service=="string"&&Array.isArray(t.mounts)?t:void 0}catch{return}}d(parseManifest,"parseManifest"),u(parseManifest,"parseManifest"),n(parseManifest,"parseManifest");function redisRegistrySource(e,t={}){const a=t.prefix??exports.DEFAULT_REGISTRY_PREFIX;let s;const c=`${a}:rollout:`;return{async read(){const i=await e.keys(`${a}:manifest:*`),f=i.length?(await e.mget(...i)).filter(r=>!!r).map(parseManifest).filter(r=>!!r):[],o=await e.keys(`${c}*`),l={};if(o.length){const r=await e.mget(...o);o.forEach((p,h)=>{const m=r[h];if(m)try{l[p.slice(c.length)]=JSON.parse(m)}catch{}})}return{manifests:f,endpoints:l}},async watch(i){return s=e.duplicate(),await s.subscribe((0,exports.changeChannel)(a)),s.on("message",()=>i()),async()=>{try{await s?.quit()}catch{}}},stop(){s?.quit().catch(()=>{})}}}d(redisRegistrySource,"redisRegistrySource"),u(redisRegistrySource,"redisRegistrySource"),n(redisRegistrySource,"redisRegistrySource");function createRegistryProviders(e,t={}){const a=t.onError??(()=>{});let s=[];const c=new Set,i=(0,providers_prod_1.rolloutPodProvider)({},{onError:a});let f,o;const l=n(async()=>{let r;try{r=await e.read()}catch(p){a(p);return}if(s.length>0&&r.manifests.length===0){a(new Error("[gateway] registry read came back EMPTY while serving routes \u2014 keeping last-good (set the registry to a single manifest to drain deliberately)"));return}s=r.manifests,(Object.keys(r.endpoints).length>0||s.length===0)&&i.update(r.endpoints);for(const p of c)try{p(s)}catch(h){a(h)}},"refresh");return{manifests:{list:n(()=>s,"list"),watch:n(r=>(c.add(r),()=>c.delete(r)),"watch")},pods:i,async start(){if(await l(),e.watch)try{f=await e.watch(()=>{l()})}catch(r){a(r)}o=setInterval(()=>{l()},t.pollMs??5e3),o.unref?.()},stop(){f?.(),o&&clearInterval(o),e.stop?.()}}}d(createRegistryProviders,"createRegistryProviders"),u(createRegistryProviders,"createRegistryProviders"),n(createRegistryProviders,"createRegistryProviders");

package/executors/gateway/rollout-ops.js

@@ -1,2 +1,2 @@
-"use strict";var d=Object.defineProperty;var c=(n,r)=>d(n,"name",{value:r,configurable:!0});var h=Object.defineProperty,i=c((n,r)=>h(n,"name",{value:r,configurable:!0}),"i");Object.defineProperty(exports,"__esModule",{value:!0}),exports.applyRolloutOp=applyRolloutOp,exports.summarizeRollout=summarizeRollout,exports.parseRolloutCommand=parseRolloutCommand;const RULE_OPS=new Set(["eq","ne","in","nin","prefix","suffix","contains","regex","exists","gt","lt","cidr"]),clone=i(n=>JSON.parse(JSON.stringify(n)),"clone");function asSpec(n,r){if(r===void 0)return{rules:[],cohorts:[]};if(Array.isArray(r)){if(r.length&&typeof r[0]=="string")throw new Error(`service "${n}" is a flat endpoint list; convert it to cohorts first (e.g. add-cohort)`);return{rules:[],cohorts:r}}return{rules:r.rules??[],cohorts:r.cohorts??[]}}c(asSpec,"asSpec"),i(asSpec,"asSpec");const findCohort=i((n,r)=>n.cohorts.find(o=>o.version===r),"findCohort");function reqWeight(n){if(!Number.isFinite(n)||n<0)throw new Error(`weight must be a number \u2265 0 (got ${n})`);return n}c(reqWeight,"reqWeight"),i(reqWeight,"reqWeight");function applyRolloutOp(n,r){const o=clone(n),e=asSpec(r.service,o[r.service]);switch(r.kind){case"add-cohort":{if(findCohort(e,r.version))throw new Error(`cohort "${r.version}" already exists on "${r.service}" \u2014 use set-weight`);if(!r.urls.length)throw new Error("add-cohort needs at least one upstream url");e.cohorts.push({version:r.version,weight:reqWeight(r.weight),urls:r.urls.slice()});break}case"set-weight":{const t=findCohort(e,r.version);if(!t)throw new Error(`no cohort "${r.version}" on "${r.service}"`);t.weight=reqWeight(r.weight);break}case"remove-cohort":{if(!findCohort(e,r.version))throw new Error(`no cohort "${r.version}" on "${r.service}"`);e.cohorts=e.cohorts.filter(t=>t.version!==r.version);break}case"promote":{if(!findCohort(e,r.version))throw new Error(`no cohort "${r.version}" on "${r.service}"`);for(const t of e.cohorts)t.weight=t.version===r.version?100:0;break}case"abort":{const t=findCohort(e,r.version);if(!t)throw new Error(`no cohort "${r.version}" on "${r.service}"`);t.weight=0;break}case"add-rule":{validateRule(r.rule),e.rules=[...(e.rules??[]).filter(t=>!r.rule.name||t.name!==r.rule.name),r.rule];break}case"remove-rule":{const t=(e.rules??[]).length;if(e.rules=(e.rules??[]).filter(s=>s.name!==r.name),e.rules.length===t)throw new Error(`no rule named "${r.name}" on "${r.service}"`);break}}return o[r.service]=e.rules&&e.rules.length?{rules:e.rules,cohorts:e.cohorts}:e.cohorts,o}c(applyRolloutOp,"applyRolloutOp"),i(applyRolloutOp,"applyRolloutOp");function validateRule(n){if(!n||typeof n.version!="string"||!n.version)throw new Error("rule needs a non-empty version");if(!n.when||typeof n.when!="object")throw new Error("rule needs a `when` condition");const r=i(o=>{const e=o;if("all"in e||"any"in e||"not"in e){for(const t of["all","any"])Array.isArray(e[t])&&e[t].forEach(r);e.not&&r(e.not);return}if(typeof e.attr!="string"||!RULE_OPS.has(e.op))throw new Error(`invalid rule condition (attr/op): ${JSON.stringify(e)}`)},"walk");r(n.when)}c(validateRule,"validateRule"),i(validateRule,"validateRule");function summarizeRollout(n,r){const o=r?[r]:Object.keys(n);if(!o.length)return"(no services in rollout config)";const e=[];for(const t of o){const s=n[t];if(s===void 0){e.push(`${t}: (not present)`);continue}if(Array.isArray(s)&&s.length&&typeof s[0]=="string"){e.push(`${t}: flat LB \u2192 ${s.join(", ")}`);continue}const u=asSpec(t,s),l=u.cohorts.reduce((a,v)=>a+Math.max(0,v.weight),0)||1;e.push(`${t}:`);for(const a of u.cohorts)e.push(`  \u2022 ${a.version.padEnd(16)} weight ${String(a.weight).padStart(3)} (${(Math.max(0,a.weight)/l*100).toFixed(0)}%)  ${a.urls.length} url(s)`);for(const a of u.rules??[])e.push(`  \u25B8 rule ${(a.name??"(unnamed)").padEnd(16)} \u2192 ${a.version}   ${ruleSummary(a.when)}`)}return e.join(`
-`)}c(summarizeRollout,"summarizeRollout"),i(summarizeRollout,"summarizeRollout");function ruleSummary(n){const r=n;return"all"in r?"("+r.all.map(ruleSummary).join(" AND ")+")":"any"in r?"("+r.any.map(ruleSummary).join(" OR ")+")":"not"in r?"NOT "+ruleSummary(r.not):`${r.attr} ${r.op}${r.value!==void 0?" "+JSON.stringify(r.value):""}`}c(ruleSummary,"ruleSummary"),i(ruleSummary,"ruleSummary");function parseRolloutCommand(n){const[r,...o]=n,e=i((t,s)=>{if(o.length<t)throw new Error(`usage: ${r} ${s}`)},"need");switch(r){case"status":return{status:o[0]};case"add-cohort":return e(4,"<service> <version> <weight> <url> [url...]"),{op:{kind:"add-cohort",service:o[0],version:o[1],weight:Number(o[2]),urls:o.slice(3)}};case"set-weight":return e(3,"<service> <version> <weight>"),{op:{kind:"set-weight",service:o[0],version:o[1],weight:Number(o[2])}};case"remove-cohort":return e(2,"<service> <version>"),{op:{kind:"remove-cohort",service:o[0],version:o[1]}};case"promote":return e(2,"<service> <version>"),{op:{kind:"promote",service:o[0],version:o[1]}};case"abort":return e(2,"<service> <version>"),{op:{kind:"abort",service:o[0],version:o[1]}};case"add-rule":{e(6,"<service> <name> <attr> <op> <value> <version>");const t=o[3],s=o[4]??"",u=t==="in"||t==="nin"?s.split(",").map(l=>l.trim()).filter(Boolean):s;return{op:{kind:"add-rule",service:o[0],rule:{name:o[1],when:{attr:o[2],op:t,value:u},version:o[5]}}}}case"remove-rule":return e(2,"<service> <name>"),{op:{kind:"remove-rule",service:o[0],name:o[1]}};default:throw new Error(`unknown command "${r??""}". commands: status, add-cohort, set-weight, remove-cohort, promote, abort, add-rule, remove-rule`)}}c(parseRolloutCommand,"parseRolloutCommand"),i(parseRolloutCommand,"parseRolloutCommand");
+"use strict";var p=Object.defineProperty;var u=(t,e)=>p(t,"name",{value:e,configurable:!0});var d=Object.defineProperty,c=u((t,e)=>d(t,"name",{value:e,configurable:!0}),"c"),h=Object.defineProperty,i=c((t,e)=>h(t,"name",{value:e,configurable:!0}),"i");Object.defineProperty(exports,"__esModule",{value:!0}),exports.applyRolloutOp=applyRolloutOp,exports.summarizeRollout=summarizeRollout,exports.parseRolloutCommand=parseRolloutCommand;const RULE_OPS=new Set(["eq","ne","in","nin","prefix","suffix","contains","regex","exists","gt","lt","cidr"]),clone=i(t=>JSON.parse(JSON.stringify(t)),"clone");function asSpec(t,e){if(e===void 0)return{rules:[],cohorts:[]};if(Array.isArray(e)){if(e.length&&typeof e[0]=="string")throw new Error(`service "${t}" is a flat endpoint list; convert it to cohorts first (e.g. add-cohort)`);return{rules:[],cohorts:e}}return{rules:e.rules??[],cohorts:e.cohorts??[]}}u(asSpec,"asSpec"),c(asSpec,"asSpec"),i(asSpec,"asSpec");const findCohort=i((t,e)=>t.cohorts.find(o=>o.version===e),"findCohort");function reqWeight(t){if(!Number.isFinite(t)||t<0)throw new Error(`weight must be a number \u2265 0 (got ${t})`);return t}u(reqWeight,"reqWeight"),c(reqWeight,"reqWeight"),i(reqWeight,"reqWeight");function applyRolloutOp(t,e){const o=clone(t),r=asSpec(e.service,o[e.service]);switch(e.kind){case"add-cohort":{if(findCohort(r,e.version))throw new Error(`cohort "${e.version}" already exists on "${e.service}" \u2014 use set-weight`);if(!e.urls.length)throw new Error("add-cohort needs at least one upstream url");r.cohorts.push({version:e.version,weight:reqWeight(e.weight),urls:e.urls.slice()});break}case"set-weight":{const n=findCohort(r,e.version);if(!n)throw new Error(`no cohort "${e.version}" on "${e.service}"`);n.weight=reqWeight(e.weight);break}case"remove-cohort":{if(!findCohort(r,e.version))throw new Error(`no cohort "${e.version}" on "${e.service}"`);r.cohorts=r.cohorts.filter(n=>n.version!==e.version);break}case"promote":{if(!findCohort(r,e.version))throw new Error(`no cohort "${e.version}" on "${e.service}"`);for(const n of r.cohorts)n.weight=n.version===e.version?100:0;break}case"abort":{const n=findCohort(r,e.version);if(!n)throw new Error(`no cohort "${e.version}" on "${e.service}"`);n.weight=0;break}case"add-rule":{validateRule(e.rule),r.rules=[...(r.rules??[]).filter(n=>!e.rule.name||n.name!==e.rule.name),e.rule];break}case"remove-rule":{const n=(r.rules??[]).length;if(r.rules=(r.rules??[]).filter(s=>s.name!==e.name),r.rules.length===n)throw new Error(`no rule named "${e.name}" on "${e.service}"`);break}}return o[e.service]=r.rules&&r.rules.length?{rules:r.rules,cohorts:r.cohorts}:r.cohorts,o}u(applyRolloutOp,"applyRolloutOp"),c(applyRolloutOp,"applyRolloutOp"),i(applyRolloutOp,"applyRolloutOp");function validateRule(t){if(!t||typeof t.version!="string"||!t.version)throw new Error("rule needs a non-empty version");if(!t.when||typeof t.when!="object")throw new Error("rule needs a `when` condition");const e=i(o=>{const r=o;if("all"in r||"any"in r||"not"in r){for(const n of["all","any"])Array.isArray(r[n])&&r[n].forEach(e);r.not&&e(r.not);return}if(typeof r.attr!="string"||!RULE_OPS.has(r.op))throw new Error(`invalid rule condition (attr/op): ${JSON.stringify(r)}`)},"walk");e(t.when)}u(validateRule,"validateRule"),c(validateRule,"validateRule"),i(validateRule,"validateRule");function summarizeRollout(t,e){const o=e?[e]:Object.keys(t);if(!o.length)return"(no services in rollout config)";const r=[];for(const n of o){const s=t[n];if(s===void 0){r.push(`${n}: (not present)`);continue}if(Array.isArray(s)&&s.length&&typeof s[0]=="string"){r.push(`${n}: flat LB \u2192 ${s.join(", ")}`);continue}const l=asSpec(n,s),v=l.cohorts.reduce((a,m)=>a+Math.max(0,m.weight),0)||1;r.push(`${n}:`);for(const a of l.cohorts)r.push(`  \u2022 ${a.version.padEnd(16)} weight ${String(a.weight).padStart(3)} (${(Math.max(0,a.weight)/v*100).toFixed(0)}%)  ${a.urls.length} url(s)`);for(const a of l.rules??[])r.push(`  \u25B8 rule ${(a.name??"(unnamed)").padEnd(16)} \u2192 ${a.version}   ${ruleSummary(a.when)}`)}return r.join(`
+`)}u(summarizeRollout,"summarizeRollout"),c(summarizeRollout,"summarizeRollout"),i(summarizeRollout,"summarizeRollout");function ruleSummary(t){const e=t;return"all"in e?"("+e.all.map(ruleSummary).join(" AND ")+")":"any"in e?"("+e.any.map(ruleSummary).join(" OR ")+")":"not"in e?"NOT "+ruleSummary(e.not):`${e.attr} ${e.op}${e.value!==void 0?" "+JSON.stringify(e.value):""}`}u(ruleSummary,"ruleSummary"),c(ruleSummary,"ruleSummary"),i(ruleSummary,"ruleSummary");function parseRolloutCommand(t){const[e,...o]=t,r=i((n,s)=>{if(o.length<n)throw new Error(`usage: ${e} ${s}`)},"need");switch(e){case"status":return{status:o[0]};case"add-cohort":return r(4,"<service> <version> <weight> <url> [url...]"),{op:{kind:"add-cohort",service:o[0],version:o[1],weight:Number(o[2]),urls:o.slice(3)}};case"set-weight":return r(3,"<service> <version> <weight>"),{op:{kind:"set-weight",service:o[0],version:o[1],weight:Number(o[2])}};case"remove-cohort":return r(2,"<service> <version>"),{op:{kind:"remove-cohort",service:o[0],version:o[1]}};case"promote":return r(2,"<service> <version>"),{op:{kind:"promote",service:o[0],version:o[1]}};case"abort":return r(2,"<service> <version>"),{op:{kind:"abort",service:o[0],version:o[1]}};case"add-rule":{r(6,"<service> <name> <attr> <op> <value> <version>");const n=o[3],s=o[4]??"",l=n==="in"||n==="nin"?s.split(",").map(v=>v.trim()).filter(Boolean):s;return{op:{kind:"add-rule",service:o[0],rule:{name:o[1],when:{attr:o[2],op:n,value:l},version:o[5]}}}}case"remove-rule":return r(2,"<service> <name>"),{op:{kind:"remove-rule",service:o[0],name:o[1]}};default:throw new Error(`unknown command "${e??""}". commands: status, add-cohort, set-weight, remove-cohort, promote, abort, add-rule, remove-rule`)}}u(parseRolloutCommand,"parseRolloutCommand"),c(parseRolloutCommand,"parseRolloutCommand"),i(parseRolloutCommand,"parseRolloutCommand");

package/executors/gateway/runtime/auth.js

@@ -1 +1 @@
-"use strict";var y=Object.defineProperty;var f=(n,u)=>y(n,"name",{value:u,configurable:!0});var h=Object.defineProperty,d=f((n,u)=>h(n,"name",{value:u,configurable:!0}),"d");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createEdgeAuth=createEdgeAuth;const manifest_1=require("../manifest"),dev_auth_1=require("./dev-auth"),edge_1=require("./edge");function createEdgeAuth(n,u,m){const{traceStep:o}=u;return{internal:d((e,k,r)=>{const c=String(e.headers["x-api-key"]??""),a=n.keyToProject.get(c);if(!a)return o(r,"auth",{mode:"x-api-key",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Invalid or missing x-api-key for internal route."};const t=n.keyToWorkspace?.get(c),l=k.svc?.wsKey;if(t&&l&&t!==l)return o(r,"auth",{mode:"x-api-key",ok:!1,reason:"cross-workspace",caller:a,callerWorkspace:t,routeWorkspace:l}),{ok:!1,status:401,reason:"unauthorized",detail:"Invalid or missing x-api-key for internal route."};e.headers["x-api-key-id"]=a,t?e.headers["x-api-key-workspace"]=t:delete e.headers["x-api-key-workspace"],e.__lensmcpCaller=a,delete e.headers["x-api-key"];const i=(0,edge_1.callerContextOf)(e);for(const[p,s]of Object.entries(i))e.headers[p]=s;return o(r,"auth",{mode:"x-api-key",ok:!0,caller:a,...t?{callerWorkspace:t}:{},...i["x-tenant-id"]!==void 0?{callerTenant:!0}:{},...i["x-user-id"]!==void 0?{callerUser:!0}:{}}),{ok:!0,caller:a}},"internal"),public:d((e,k,r,c)=>{const a=k.auth;if(a){const t=c??(0,edge_1.canonicalPath)(e.url??"/")??(e.url??"/").split("?")[0],l=(e.method??"GET").toUpperCase(),i=(0,manifest_1.authRuleFor)(a,t,l);if(i.mode==="jwt"){const p=String(e.headers.host??"").split(":")[0].toLowerCase(),s=(0,dev_auth_1.verifyDevJwt)(e,m?.for(p));return s?i.rule&&!(0,manifest_1.evalRule)(i.rule,(0,dev_auth_1.devAttrs)(e,s,t))?(o(r,"authz",{ok:!1}),{ok:!1,status:403,reason:"forbidden",detail:"Forbidden: insufficient permission"}):((0,dev_auth_1.stampIdentity)(e,s),o(r,"auth",{mode:"jwt",ok:!0}),{ok:!0,claims:s}):(o(r,"auth",{mode:"jwt",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: invalid or missing token"})}return o(r,"auth",{mode:i.mode}),{ok:!0}}return o(r,"auth",{mode:"public",unconfigured:!0}),{ok:!0}},"publicAuth")}}f(createEdgeAuth,"createEdgeAuth"),d(createEdgeAuth,"createEdgeAuth");
+"use strict";var g=Object.defineProperty;var m=(o,n)=>g(o,"name",{value:n,configurable:!0});var y=Object.defineProperty,f=m((o,n)=>y(o,"name",{value:n,configurable:!0}),"f"),h=Object.defineProperty,d=f((o,n)=>h(o,"name",{value:n,configurable:!0}),"d");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createEdgeAuth=createEdgeAuth;const manifest_1=require("../manifest"),dev_auth_1=require("./dev-auth"),edge_1=require("./edge");function createEdgeAuth(o,n,v){const{traceStep:i}=n;return{internal:d((e,p,r)=>{const c=String(e.headers["x-api-key"]??""),a=o.keyToProject.get(c);if(!a)return i(r,"auth",{mode:"x-api-key",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Invalid or missing x-api-key for internal route."};const t=o.keyToWorkspace?.get(c),l=p.svc?.wsKey;if(t&&l&&t!==l)return i(r,"auth",{mode:"x-api-key",ok:!1,reason:"cross-workspace",caller:a,callerWorkspace:t,routeWorkspace:l}),{ok:!1,status:401,reason:"unauthorized",detail:"Invalid or missing x-api-key for internal route."};e.headers["x-api-key-id"]=a,t?e.headers["x-api-key-workspace"]=t:delete e.headers["x-api-key-workspace"],e.__lensmcpCaller=a,delete e.headers["x-api-key"];const s=(0,edge_1.callerContextOf)(e);for(const[k,u]of Object.entries(s))e.headers[k]=u;return i(r,"auth",{mode:"x-api-key",ok:!0,caller:a,...t?{callerWorkspace:t}:{},...s["x-tenant-id"]!==void 0?{callerTenant:!0}:{},...s["x-user-id"]!==void 0?{callerUser:!0}:{}}),{ok:!0,caller:a}},"internal"),public:d((e,p,r,c)=>{const a=p.auth;if(a){const t=c??(0,edge_1.canonicalPath)(e.url??"/")??(e.url??"/").split("?")[0],l=(e.method??"GET").toUpperCase(),s=(0,manifest_1.authRuleFor)(a,t,l);if(s.mode==="jwt"){const k=String(e.headers.host??"").split(":")[0].toLowerCase(),u=(0,dev_auth_1.verifyDevJwt)(e,v?.for(k));return u?s.rule&&!(0,manifest_1.evalRule)(s.rule,(0,dev_auth_1.devAttrs)(e,u,t))?(i(r,"authz",{ok:!1}),{ok:!1,status:403,reason:"forbidden",detail:"Forbidden: insufficient permission"}):((0,dev_auth_1.stampIdentity)(e,u),i(r,"auth",{mode:"jwt",ok:!0}),{ok:!0,claims:u}):(i(r,"auth",{mode:"jwt",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: invalid or missing token"})}return i(r,"auth",{mode:s.mode}),{ok:!0}}return i(r,"auth",{mode:"public",unconfigured:!0}),{ok:!0}},"publicAuth")}}m(createEdgeAuth,"createEdgeAuth"),f(createEdgeAuth,"createEdgeAuth"),d(createEdgeAuth,"createEdgeAuth");

package/executors/gateway/runtime/chooser.js

@@ -1,11 +1,11 @@
-"use strict";var l=Object.defineProperty;var i=(o,e)=>l(o,"name",{value:e,configurable:!0});var p=Object.defineProperty,n=i((o,e)=>p(o,"name",{value:e,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.isLoopbackRequest=isLoopbackRequest,exports.displayRoot=displayRoot,exports.renderChooserPage=renderChooserPage,exports.serveChooser=serveChooser;const node_os_1=require("node:os"),workspace_registry_1=require("./workspace-registry"),esc=n(o=>o.replace(/[&<>"']/g,e=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[e]),"esc");function isLoopbackRequest(o){const e=o.socket?.remoteAddress;if(!e)return!1;const t=e.startsWith("::ffff:")?e.slice(7):e;return t==="::1"||t==="127.0.0.1"||/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(t)}i(isLoopbackRequest,"isLoopbackRequest"),n(isLoopbackRequest,"isLoopbackRequest");function displayRoot(o,e=(0,node_os_1.homedir)()){const t=o.replace(/\/+$/,"").split("/").filter(Boolean),r=t.slice(-2).join("/");if(!r)return"/";const a=e!==""&&(o===e||o.startsWith(`${e}/`)),s=t.length>2;return a?s?`~/\u2026/${r}`:`~/${r}`:s?`\u2026/${r}`:`/${r}`}i(displayRoot,"displayRoot"),n(displayRoot,"displayRoot");function renderChooserPage(o,e){const t=o.map(a=>({...a,live:a.key===e||(0,workspace_registry_1.isWorkspaceLive)(a)})).sort((a,s)=>Number(s.live)-Number(a.live)||a.key.localeCompare(s.key)),r=t.length===0?'<p class="empty">No workspaces registered yet. Start a gateway in a workspace (<code>lensmcp gateway start</code>) and it will appear here.</p>':t.map(a=>{const s=a.key===e?'<span class="badge here">running here</span>':a.live?'<span class="badge live">live</span>':'<span class="badge off">offline</span>',d=a.live?'<span class="open">Open dashboard \u2192</span>':'<span class="hint">start its gateway to open</span>',c=`<div class="card-main">
-      <div class="key">${esc(a.key)} ${s}</div>
-      <div class="root">${esc(displayRoot(a.root))}</div>
+"use strict";var g=Object.defineProperty;var c=(o,e)=>g(o,"name",{value:e,configurable:!0});var l=Object.defineProperty,i=c((o,e)=>l(o,"name",{value:e,configurable:!0}),"i"),p=Object.defineProperty,n=i((o,e)=>p(o,"name",{value:e,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.isLoopbackRequest=isLoopbackRequest,exports.displayRoot=displayRoot,exports.renderChooserPage=renderChooserPage,exports.serveChooser=serveChooser;const node_os_1=require("node:os"),workspace_registry_1=require("./workspace-registry"),esc=n(o=>o.replace(/[&<>"']/g,e=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[e]),"esc");function isLoopbackRequest(o){const e=o.socket?.remoteAddress;if(!e)return!1;const t=e.startsWith("::ffff:")?e.slice(7):e;return t==="::1"||t==="127.0.0.1"||/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(t)}c(isLoopbackRequest,"isLoopbackRequest"),i(isLoopbackRequest,"isLoopbackRequest"),n(isLoopbackRequest,"isLoopbackRequest");function displayRoot(o,e=(0,node_os_1.homedir)()){const t=o.replace(/\/+$/,"").split("/").filter(Boolean),a=t.slice(-2).join("/");if(!a)return"/";const r=e!==""&&(o===e||o.startsWith(`${e}/`)),s=t.length>2;return r?s?`~/\u2026/${a}`:`~/${a}`:s?`\u2026/${a}`:`/${a}`}c(displayRoot,"displayRoot"),i(displayRoot,"displayRoot"),n(displayRoot,"displayRoot");function renderChooserPage(o,e){const t=o.map(r=>({...r,live:r.key===e||(0,workspace_registry_1.isWorkspaceLive)(r)})).sort((r,s)=>Number(s.live)-Number(r.live)||r.key.localeCompare(s.key)),a=t.length===0?'<p class="empty">No workspaces registered yet. Start a gateway in a workspace (<code>lensmcp gateway start</code>) and it will appear here.</p>':t.map(r=>{const s=r.key===e?'<span class="badge here">running here</span>':r.live?'<span class="badge live">live</span>':'<span class="badge off">offline</span>',f=r.live?'<span class="open">Open dashboard \u2192</span>':'<span class="hint">start its gateway to open</span>',d=`<div class="card-main">
+      <div class="key">${esc(r.key)} ${s}</div>
+      <div class="root">${esc(displayRoot(r.root))}</div>
     </div>
-    <div class="card-action">${d}</div>`;return a.live?`<a class="card is-live" href="${esc(a.base)}/">
-    ${c}
+    <div class="card-action">${f}</div>`;return r.live?`<a class="card is-live" href="${esc(r.base)}/">
+    ${d}
   </a>`:`<div class="card is-off">
-    ${c}
+    ${d}
   </div>`}).join(`
 `);return`<!doctype html>
 <html lang="en"><head>
@@ -42,10 +42,10 @@
 <body><div class="wrap">
   <header>
     <h1>LensMCP workspaces</h1>
-    <p class="sub">Pick a workspace to open its dashboard. ${t.filter(a=>a.live).length} live \xB7 ${t.length} known.</p>
+    <p class="sub">Pick a workspace to open its dashboard. ${t.filter(r=>r.live).length} live \xB7 ${t.length} known.</p>
   </header>
   <div class="list">
-${r}
+${a}
   </div>
   <footer>Served by the gateway on <code>lensmcp.local</code>. This list updates as gateways start and stop.</footer>
-</div></body></html>`}i(renderChooserPage,"renderChooserPage"),n(renderChooserPage,"renderChooserPage");function serveChooser(o,e,t){if(t&&!isLoopbackRequest(t)){o.writeHead(404,{"content-type":"text/plain; charset=utf-8","cache-control":"no-store"}),o.end("not found");return}const r=renderChooserPage((0,workspace_registry_1.readWorkspaces)(),e);o.writeHead(200,{"content-type":"text/html; charset=utf-8","cache-control":"no-store"}),o.end(r)}i(serveChooser,"serveChooser"),n(serveChooser,"serveChooser");
+</div></body></html>`}c(renderChooserPage,"renderChooserPage"),i(renderChooserPage,"renderChooserPage"),n(renderChooserPage,"renderChooserPage");function serveChooser(o,e,t){if(t&&!isLoopbackRequest(t)){o.writeHead(404,{"content-type":"text/plain; charset=utf-8","cache-control":"no-store"}),o.end("not found");return}const a=renderChooserPage((0,workspace_registry_1.readWorkspaces)(),e);o.writeHead(200,{"content-type":"text/html; charset=utf-8","cache-control":"no-store"}),o.end(a)}c(serveChooser,"serveChooser"),i(serveChooser,"serveChooser"),n(serveChooser,"serveChooser");

package/executors/gateway/runtime/control.js

@@ -1,2 +1,2 @@
-"use strict";var f=Object.defineProperty;var p=(t,e)=>f(t,"name",{value:e,configurable:!0});var h=Object.defineProperty,u=p((t,e)=>h(t,"name",{value:e,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.controlSocketPath=controlSocketPath,exports.clusterVersion=clusterVersion,exports.ensureOwnerOnlyDir=ensureOwnerOnlyDir,exports.startControlServer=startControlServer;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),http=tslib_1.__importStar(require("node:http")),os=tslib_1.__importStar(require("node:os")),path=tslib_1.__importStar(require("node:path")),discovery_1=require("./discovery"),service_keys_1=require("./service-keys"),workspace_log_1=require("./workspace-log");function controlSocketPath(){const t=process.env.LENSMCP_HOME||os.homedir();return path.join(t,".lensmcp","control.sock")}p(controlSocketPath,"controlSocketPath"),u(controlSocketPath,"controlSocketPath");function clusterVersion(){let t=__dirname;for(let e=0;e<6;e++){const n=path.join(t,"package.json");if(fs.existsSync(n))try{const s=JSON.parse(fs.readFileSync(n,"utf8"));if(s.name==="@lensmcp/cluster"&&typeof s.version=="string")return s.version}catch{}const c=path.dirname(t);if(c===t)break;t=c}}p(clusterVersion,"clusterVersion"),u(clusterVersion,"clusterVersion");function readJsonBody(t){return new Promise((e,n)=>{let c="";t.on("data",s=>{c+=s,c.length>1e6&&n(new Error("body too large"))}),t.on("end",()=>{try{e(c?JSON.parse(c):{})}catch(s){n(s)}}),t.on("error",n)})}p(readJsonBody,"readJsonBody"),u(readJsonBody,"readJsonBody");function ensureOwnerOnlyDir(t){try{fs.mkdirSync(t,{recursive:!0,mode:448})}catch{}try{const e=fs.lstatSync(t);return e.isDirectory()?((e.mode&63)!==0&&fs.chmodSync(t,448),!0):!1}catch{return!1}}p(ensureOwnerOnlyDir,"ensureOwnerOnlyDir"),u(ensureOwnerOnlyDir,"ensureOwnerOnlyDir");function startControlServer(t){const{rt:e}=t,n=controlSocketPath(),c=path.dirname(n);ensureOwnerOnlyDir(c)||console.warn(`[gateway] control home ${c} is not a usable owner-only directory \u2014 refusing to expose the control plane there.`);try{fs.unlinkSync(n)}catch{}const s=u((i,a,l)=>{i.writeHead(a,{"content-type":"application/json"}),i.end(JSON.stringify(l))},"send"),v=http.createServer((i,a)=>{(async()=>{try{const l=(i.url??"").split("?")[0];if(i.method==="GET"&&l==="/list")return s(a,200,{workspaces:e.registry.keys().map(r=>{const o=e.registry.get(r);return{key:r,root:o?.root,routes:o?.routes.length??0,services:o?.services.length??0}})});if(i.method==="GET"&&l==="/status"){const r=clusterVersion();return s(a,200,{daemon:{pid:process.pid,wsKey:e.wsKey,...r?{version:r}:{}},workspaces:e.registry.keys().map(o=>{const y=e.registry.get(o);return{key:o,root:y?.root,routes:y?.routes.length??0,services:y?.services.length??0,isDaemon:o===e.wsKey}}),services:e.registry.allServices().map(o=>({project:o.project,wsKey:o.wsKey,host:o.decl.host,state:o.state}))})}if(i.method==="POST"&&l==="/register"){const r=await readJsonBody(i);if(!r.wsKey||!r.root)return s(a,400,{error:"wsKey and root are required"});const o=r.projects??{},y=(0,discovery_1.projectSourceRoots)(r.root,o,r.projectDependencies),{routes:w,services:d}=(0,discovery_1.discoverRoutes)(r.root,o,void 0,r.wsKey,y),k={wsKey:r.wsKey,root:r.root,routes:w,services:d};try{const g=(0,service_keys_1.adoptServiceKeys)(e,r.root,d,r.wsKey);g.added.length>0&&console.log(`[gateway] adopted east-west keys for ${r.wsKey}: ${g.added.join(", ")}`)}catch(g){console.error(`[gateway] could not adopt east-west keys for ${r.wsKey}: ${g.message}`)}try{(0,workspace_log_1.workspaceLogWriter)(r.root)?.(`[gateway] ${new Date().toISOString()} this workspace ('${r.wsKey}') is served by the daemon at ${e.root} (pid ${process.pid}); its gateway-level log is ${path.join(e.root,".lensmcp","gateway.log")}. Pod output for this workspace follows here. Attach live with \`lensmcp logs <service>\`.
-`)}catch{}return e.registry.register(k),await t.onRegister?.(k),e.rebuildRoutes(),s(a,200,{ok:!0,wsKey:r.wsKey,routes:w.length,services:d.length,workspaces:e.registry.keys()})}if(i.method==="POST"&&l==="/unregister"){const r=await readJsonBody(i);if(!r.wsKey)return s(a,400,{error:"wsKey is required"});const o=e.registry.unregister(r.wsKey);if(o){for(const y of o.services){const w=(0,service_keys_1.serviceKeyId)(y.wsKey??r.wsKey,y.project),d=e.serviceKeys[w];d&&(delete e.serviceKeys[w],e.keyToProject.delete(d),e.keyToWorkspace?.delete(d))}for(const y of o.services)t.killService(y,"workspace unregistered");t.onUnregister?.(o)}return e.rebuildRoutes(),s(a,200,{ok:!0,removed:!!o,workspaces:e.registry.keys()})}s(a,404,{error:"not found"})}catch(l){s(a,500,{error:l.message})}})()});return v.listen(n,()=>{try{fs.chmodSync(n,384)}catch(i){console.warn(`[gateway] could not restrict ${n} to 0600:`,i.message)}}),{socketPath:n,close:u(()=>{v.close();try{fs.unlinkSync(n)}catch{}},"close")}}p(startControlServer,"startControlServer"),u(startControlServer,"startControlServer");
+"use strict";var S=Object.defineProperty;var w=(t,e)=>S(t,"name",{value:e,configurable:!0});var f=Object.defineProperty,p=w((t,e)=>f(t,"name",{value:e,configurable:!0}),"p"),h=Object.defineProperty,u=p((t,e)=>h(t,"name",{value:e,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.controlSocketPath=controlSocketPath,exports.clusterVersion=clusterVersion,exports.ensureOwnerOnlyDir=ensureOwnerOnlyDir,exports.startControlServer=startControlServer;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),http=tslib_1.__importStar(require("node:http")),os=tslib_1.__importStar(require("node:os")),path=tslib_1.__importStar(require("node:path")),discovery_1=require("./discovery"),service_keys_1=require("./service-keys"),workspace_log_1=require("./workspace-log");function controlSocketPath(){const t=process.env.LENSMCP_HOME||os.homedir();return path.join(t,".lensmcp","control.sock")}w(controlSocketPath,"controlSocketPath"),p(controlSocketPath,"controlSocketPath"),u(controlSocketPath,"controlSocketPath");function clusterVersion(){let t=__dirname;for(let e=0;e<6;e++){const n=path.join(t,"package.json");if(fs.existsSync(n))try{const s=JSON.parse(fs.readFileSync(n,"utf8"));if(s.name==="@lensmcp/cluster"&&typeof s.version=="string")return s.version}catch{}const i=path.dirname(t);if(i===t)break;t=i}}w(clusterVersion,"clusterVersion"),p(clusterVersion,"clusterVersion"),u(clusterVersion,"clusterVersion");function readJsonBody(t){return new Promise((e,n)=>{let i="";t.on("data",s=>{i+=s,i.length>1e6&&n(new Error("body too large"))}),t.on("end",()=>{try{e(i?JSON.parse(i):{})}catch(s){n(s)}}),t.on("error",n)})}w(readJsonBody,"readJsonBody"),p(readJsonBody,"readJsonBody"),u(readJsonBody,"readJsonBody");function ensureOwnerOnlyDir(t){try{fs.mkdirSync(t,{recursive:!0,mode:448})}catch{}try{const e=fs.lstatSync(t);return e.isDirectory()?((e.mode&63)!==0&&fs.chmodSync(t,448),!0):!1}catch{return!1}}w(ensureOwnerOnlyDir,"ensureOwnerOnlyDir"),p(ensureOwnerOnlyDir,"ensureOwnerOnlyDir"),u(ensureOwnerOnlyDir,"ensureOwnerOnlyDir");function startControlServer(t){const{rt:e}=t,n=controlSocketPath(),i=path.dirname(n);ensureOwnerOnlyDir(i)||console.warn(`[gateway] control home ${i} is not a usable owner-only directory \u2014 refusing to expose the control plane there.`);try{fs.unlinkSync(n)}catch{}const s=u((c,a,l)=>{c.writeHead(a,{"content-type":"application/json"}),c.end(JSON.stringify(l))},"send"),k=http.createServer((c,a)=>{(async()=>{try{const l=(c.url??"").split("?")[0];if(c.method==="GET"&&l==="/list")return s(a,200,{workspaces:e.registry.keys().map(r=>{const o=e.registry.get(r);return{key:r,root:o?.root,routes:o?.routes.length??0,services:o?.services.length??0}})});if(c.method==="GET"&&l==="/status"){const r=clusterVersion();return s(a,200,{daemon:{pid:process.pid,wsKey:e.wsKey,...r?{version:r}:{}},workspaces:e.registry.keys().map(o=>{const y=e.registry.get(o);return{key:o,root:y?.root,routes:y?.routes.length??0,services:y?.services.length??0,isDaemon:o===e.wsKey}}),services:e.registry.allServices().map(o=>({project:o.project,wsKey:o.wsKey,host:o.decl.host,state:o.state}))})}if(c.method==="POST"&&l==="/register"){const r=await readJsonBody(c);if(!r.wsKey||!r.root)return s(a,400,{error:"wsKey and root are required"});const o=r.projects??{},y=(0,discovery_1.projectSourceRoots)(r.root,o,r.projectDependencies),{routes:g,services:d}=(0,discovery_1.discoverRoutes)(r.root,o,void 0,r.wsKey,y),m={wsKey:r.wsKey,root:r.root,routes:g,services:d};try{const v=(0,service_keys_1.adoptServiceKeys)(e,r.root,d,r.wsKey);v.added.length>0&&console.log(`[gateway] adopted east-west keys for ${r.wsKey}: ${v.added.join(", ")}`)}catch(v){console.error(`[gateway] could not adopt east-west keys for ${r.wsKey}: ${v.message}`)}try{(0,workspace_log_1.workspaceLogWriter)(r.root)?.(`[gateway] ${new Date().toISOString()} this workspace ('${r.wsKey}') is served by the daemon at ${e.root} (pid ${process.pid}); its gateway-level log is ${path.join(e.root,".lensmcp","gateway.log")}. Pod output for this workspace follows here. Attach live with \`lensmcp logs <service>\`.
+`)}catch{}return e.registry.register(m),await t.onRegister?.(m),e.rebuildRoutes(),s(a,200,{ok:!0,wsKey:r.wsKey,routes:g.length,services:d.length,workspaces:e.registry.keys()})}if(c.method==="POST"&&l==="/unregister"){const r=await readJsonBody(c);if(!r.wsKey)return s(a,400,{error:"wsKey is required"});const o=e.registry.unregister(r.wsKey);if(o){for(const y of o.services){const g=(0,service_keys_1.serviceKeyId)(y.wsKey??r.wsKey,y.project),d=e.serviceKeys[g];d&&(delete e.serviceKeys[g],e.keyToProject.delete(d),e.keyToWorkspace?.delete(d))}for(const y of o.services)t.killService(y,"workspace unregistered");t.onUnregister?.(o)}return e.rebuildRoutes(),s(a,200,{ok:!0,removed:!!o,workspaces:e.registry.keys()})}s(a,404,{error:"not found"})}catch(l){s(a,500,{error:l.message})}})()});return k.listen(n,()=>{try{fs.chmodSync(n,384)}catch(c){console.warn(`[gateway] could not restrict ${n} to 0600:`,c.message)}}),{socketPath:n,close:u(()=>{k.close();try{fs.unlinkSync(n)}catch{}},"close")}}w(startControlServer,"startControlServer"),p(startControlServer,"startControlServer"),u(startControlServer,"startControlServer");

package/executors/gateway/runtime/dev-auth.js

@@ -1 +1 @@
-"use strict";var h=Object.defineProperty;var a=(e,r)=>h(e,"name",{value:r,configurable:!0});var l=Object.defineProperty,u=a((e,r)=>l(e,"name",{value:r,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.devAttrs=void 0,exports.verifyDevJwt=verifyDevJwt,exports.stampIdentity=stampIdentity;const node_crypto_1=require("node:crypto"),edge_1=require("./edge");function bearerToken(e){const r=Array.isArray(e.headers.authorization)?e.headers.authorization[0]:e.headers.authorization,t=String(r??"");return t.startsWith("Bearer ")?t.slice(7):void 0}a(bearerToken,"bearerToken"),u(bearerToken,"bearerToken");function verifyDevJwt(e,r){const t=bearerToken(e);if(!t)return;const[s,n,f]=t.split(".");if(!s||!n||!f)return;if(r)return r.verify(t);let o;try{o=JSON.parse(Buffer.from(s,"base64url").toString()).alg}catch{return}if(typeof o=="string"&&o!=="HS256"){if(process.env.LENSMCP_GW_DEV_JWT_INSECURE_DECODE!=="1")return;try{const i=JSON.parse(Buffer.from(n,"base64url").toString());return typeof i.exp=="number"&&Date.now()/1e3>i.exp?void 0:i}catch{return}}const d=process.env.AUTH_JWT_SECRET??"tetros-dev-secret",y=(0,node_crypto_1.createHmac)("sha256",d).update(`${s}.${n}`).digest("base64url"),p=Buffer.from(f),c=Buffer.from(y);if(!(p.length!==c.length||!(0,node_crypto_1.timingSafeEqual)(p,c)))try{const i=JSON.parse(Buffer.from(n,"base64url").toString());return typeof i.exp=="number"&&Date.now()/1e3>i.exp?void 0:i}catch{return}}a(verifyDevJwt,"verifyDevJwt"),u(verifyDevJwt,"verifyDevJwt");function stampIdentity(e,r){const t=u((f,o)=>{o!=null&&o!==""&&(e.headers[f]=String(o))},"set");t("x-user-id",r.sub),t("x-tenant-id",r.tid);const s=r.roles;Array.isArray(s)&&s.length&&(e.headers["x-user-roles"]=s.map(String).join(","));const n=r.perms;Array.isArray(n)&&n.length&&(e.headers["x-user-permissions"]=n.map(String).join(","))}a(stampIdentity,"stampIdentity"),u(stampIdentity,"stampIdentity");const devAttrs=u((e,r,t)=>({...r,ip:(0,edge_1.clientIpOf)(e),method:(e.method??"GET").toUpperCase(),path:t??(0,edge_1.canonicalPath)(e.url??"/")??(e.url??"/").split("?")[0]}),"devAttrs");exports.devAttrs=devAttrs;
+"use strict";var m=Object.defineProperty;var f=(e,r)=>m(e,"name",{value:r,configurable:!0});var h=Object.defineProperty,a=f((e,r)=>h(e,"name",{value:r,configurable:!0}),"a"),l=Object.defineProperty,u=a((e,r)=>l(e,"name",{value:r,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.devAttrs=void 0,exports.verifyDevJwt=verifyDevJwt,exports.stampIdentity=stampIdentity;const node_crypto_1=require("node:crypto"),edge_1=require("./edge");function bearerToken(e){const r=Array.isArray(e.headers.authorization)?e.headers.authorization[0]:e.headers.authorization,t=String(r??"");return t.startsWith("Bearer ")?t.slice(7):void 0}f(bearerToken,"bearerToken"),a(bearerToken,"bearerToken"),u(bearerToken,"bearerToken");function verifyDevJwt(e,r){const t=bearerToken(e);if(!t)return;const[s,n,p]=t.split(".");if(!s||!n||!p)return;if(r)return r.verify(t);let i;try{i=JSON.parse(Buffer.from(s,"base64url").toString()).alg}catch{return}if(typeof i=="string"&&i!=="HS256"){if(process.env.LENSMCP_GW_DEV_JWT_INSECURE_DECODE!=="1")return;try{const o=JSON.parse(Buffer.from(n,"base64url").toString());return typeof o.exp=="number"&&Date.now()/1e3>o.exp?void 0:o}catch{return}}const y=process.env.AUTH_JWT_SECRET??"tetros-dev-secret",v=(0,node_crypto_1.createHmac)("sha256",y).update(`${s}.${n}`).digest("base64url"),c=Buffer.from(p),d=Buffer.from(v);if(!(c.length!==d.length||!(0,node_crypto_1.timingSafeEqual)(c,d)))try{const o=JSON.parse(Buffer.from(n,"base64url").toString());return typeof o.exp=="number"&&Date.now()/1e3>o.exp?void 0:o}catch{return}}f(verifyDevJwt,"verifyDevJwt"),a(verifyDevJwt,"verifyDevJwt"),u(verifyDevJwt,"verifyDevJwt");function stampIdentity(e,r){const t=u((p,i)=>{i!=null&&i!==""&&(e.headers[p]=String(i))},"set");t("x-user-id",r.sub),t("x-tenant-id",r.tid);const s=r.roles;Array.isArray(s)&&s.length&&(e.headers["x-user-roles"]=s.map(String).join(","));const n=r.perms;Array.isArray(n)&&n.length&&(e.headers["x-user-permissions"]=n.map(String).join(","))}f(stampIdentity,"stampIdentity"),a(stampIdentity,"stampIdentity"),u(stampIdentity,"stampIdentity");const devAttrs=u((e,r,t)=>({...r,ip:(0,edge_1.clientIpOf)(e),method:(e.method??"GET").toUpperCase(),path:t??(0,edge_1.canonicalPath)(e.url??"/")??(e.url??"/").split("?")[0]}),"devAttrs");exports.devAttrs=devAttrs;

package/executors/gateway/runtime/discovery.js

@@ -1 +1 @@
-"use strict";var y=Object.defineProperty;var d=(e,s)=>y(e,"name",{value:s,configurable:!0});var g=Object.defineProperty,p=d((e,s)=>g(e,"name",{value:s,configurable:!0}),"p");Object.defineProperty(exports,"__esModule",{value:!0}),exports.RETIRING_SUFFIX=void 0,exports.pickSock=pickSock,exports.lensPortFromUpstream=lensPortFromUpstream,exports.discoverRoutes=discoverRoutes,exports.projectSourceRoots=projectSourceRoots;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),os=tslib_1.__importStar(require("node:os")),path=tslib_1.__importStar(require("node:path")),manifest_1=require("../manifest"),scope_1=require("./scope");exports.RETIRING_SUFFIX=".retiring";function pickSock(e,s=1500){const u=Date.now();if(u-e.scannedAt>s){try{const n=fs.readdirSync(e.dir),a=n.filter(o=>/^child-\d+(?:-g\d+)?\.sock$/.test(o)),l=a.filter(o=>!n.includes(o+exports.RETIRING_SUFFIX));e.socks=(l.length>0?l:a).map(o=>path.join(e.dir,o))}catch{e.socks=[]}e.scannedAt=u}if(e.socks.length!==0)return e.idx=(e.idx+1)%e.socks.length,e.socks[e.idx]}d(pickSock,"pickSock"),p(pickSock,"pickSock");function lensPortFromUpstream(e){if(!e)return;const s=/:(\d+)/.exec(e);return s?Number(s[1]):void 0}d(lensPortFromUpstream,"lensPortFromUpstream"),p(lensPortFromUpstream,"lensPortFromUpstream");function discoverRoutes(e,s,u=os.tmpdir(),n="",a={}){const l=p(c=>n?path.join(u,n,`${c}-devserver`):path.join(u,`${c}-devserver`),"sockDirFor"),o=[],h=[],r=[];let i;for(const[c,S]of Object.entries(s)){let t;try{const f=JSON.parse(fs.readFileSync(path.join(e,S.root,"project.json"),"utf8"));t=f.cluster??f.davnx}catch{continue}if(!t)continue;let v,k,m,j;if(t.service)t.lens&&console.warn(`[gateway] ${c}: cluster.lens is ignored for pod (service) decls \u2014 backends are instrumented by serve-hmr.`),v={dir:l(t.service),socks:[],idx:-1,scannedAt:0},k={project:c,decl:t,root:e,wsKey:n,pool:v,state:"down",lastUsed:Date.now(),inflight:0,lastScaleAt:0},h.push(k);else if(t.lens){const f=t.port??lensPortFromUpstream(t.upstream)??5173;m=`http://localhost:${f}`,j={project:c,...n?{workspaceKey:n}:{},workspaceRoot:e,projectRoot:path.join(e,S.root),port:f,...a[c]?.length?{sourceRoots:a[c]}:{}}}else if(m=t.upstream??(t.port?`http://localhost:${t.port}`:void 0),!m){console.warn(`[gateway] ${c}: no service/upstream/port \u2014 skipped.`);continue}const x={project:c,prependPrefix:t.prependPrefix,target:m,pool:v,svc:k,prefix:t.path,auth:t.auth,lens:j};t.host&&(o.push({...x,host:t.host}),r.push(t.host),v&&t.internalHost!==!1&&o.push({...x,host:typeof t.internalHost=="string"?t.internalHost:`internal.${t.host}`,internal:!0})),t.default&&(i={...x,prefix:void 0})}return i&&(i.apex=(0,scope_1.baseDomainOf)(r),o.push(i)),(0,manifest_1.sortBySpecificity)(o),{routes:o,services:h}}d(discoverRoutes,"discoverRoutes"),p(discoverRoutes,"discoverRoutes");function projectSourceRoots(e,s,u={}){const n={};for(const a of Object.keys(s)){const l=new Set,o=p(r=>{if(!l.has(r)){l.add(r);for(const i of u[r]??[])o(i)}},"visit");o(a);const h=[...l].map(r=>s[r]?.root).filter(r=>typeof r=="string").map(r=>path.resolve(e,r)).filter(r=>{const i=path.relative(e,r);return i===""||i!==".."&&!i.startsWith(`..${path.sep}`)&&!path.isAbsolute(i)});n[a]=[...new Set(h)]}return n}d(projectSourceRoots,"projectSourceRoots"),p(projectSourceRoots,"projectSourceRoots");
+"use strict";var b=Object.defineProperty;var f=(e,o)=>b(e,"name",{value:o,configurable:!0});var y=Object.defineProperty,d=f((e,o)=>y(e,"name",{value:o,configurable:!0}),"d"),g=Object.defineProperty,p=d((e,o)=>g(e,"name",{value:o,configurable:!0}),"p");Object.defineProperty(exports,"__esModule",{value:!0}),exports.RETIRING_SUFFIX=void 0,exports.pickSock=pickSock,exports.lensPortFromUpstream=lensPortFromUpstream,exports.discoverRoutes=discoverRoutes,exports.projectSourceRoots=projectSourceRoots;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),os=tslib_1.__importStar(require("node:os")),path=tslib_1.__importStar(require("node:path")),manifest_1=require("../manifest"),scope_1=require("./scope");exports.RETIRING_SUFFIX=".retiring";function pickSock(e,o=1500){const u=Date.now();if(u-e.scannedAt>o){try{const i=fs.readdirSync(e.dir),a=i.filter(r=>/^child-\d+(?:-g\d+)?\.sock$/.test(r)),l=a.filter(r=>!i.includes(r+exports.RETIRING_SUFFIX));e.socks=(l.length>0?l:a).map(r=>path.join(e.dir,r))}catch{e.socks=[]}e.scannedAt=u}if(e.socks.length!==0)return e.idx=(e.idx+1)%e.socks.length,e.socks[e.idx]}f(pickSock,"pickSock"),d(pickSock,"pickSock"),p(pickSock,"pickSock");function lensPortFromUpstream(e){if(!e)return;const o=/:(\d+)/.exec(e);return o?Number(o[1]):void 0}f(lensPortFromUpstream,"lensPortFromUpstream"),d(lensPortFromUpstream,"lensPortFromUpstream"),p(lensPortFromUpstream,"lensPortFromUpstream");function discoverRoutes(e,o,u=os.tmpdir(),i="",a={}){const l=p(c=>i?path.join(u,i,`${c}-devserver`):path.join(u,`${c}-devserver`),"sockDirFor"),r=[],v=[],s=[];let n;for(const[c,x]of Object.entries(o)){let t;try{const h=JSON.parse(fs.readFileSync(path.join(e,x.root,"project.json"),"utf8"));t=h.cluster??h.davnx}catch{continue}if(!t)continue;let m,S,k,R;if(t.service)t.lens&&console.warn(`[gateway] ${c}: cluster.lens is ignored for pod (service) decls \u2014 backends are instrumented by serve-hmr.`),m={dir:l(t.service),socks:[],idx:-1,scannedAt:0},S={project:c,decl:t,root:e,wsKey:i,pool:m,state:"down",lastUsed:Date.now(),inflight:0,lastScaleAt:0},v.push(S);else if(t.lens){const h=t.port??lensPortFromUpstream(t.upstream)??5173;k=`http://localhost:${h}`,R={project:c,...i?{workspaceKey:i}:{},workspaceRoot:e,projectRoot:path.join(e,x.root),port:h,...a[c]?.length?{sourceRoots:a[c]}:{}}}else if(k=t.upstream??(t.port?`http://localhost:${t.port}`:void 0),!k){console.warn(`[gateway] ${c}: no service/upstream/port \u2014 skipped.`);continue}const j={project:c,prependPrefix:t.prependPrefix,target:k,pool:m,svc:S,prefix:t.path,auth:t.auth,lens:R};t.host&&(r.push({...j,host:t.host}),s.push(t.host),m&&t.internalHost!==!1&&r.push({...j,host:typeof t.internalHost=="string"?t.internalHost:`internal.${t.host}`,internal:!0})),t.default&&(n={...j,prefix:void 0})}return n&&(n.apex=(0,scope_1.baseDomainOf)(s),r.push(n)),(0,manifest_1.sortBySpecificity)(r),{routes:r,services:v}}f(discoverRoutes,"discoverRoutes"),d(discoverRoutes,"discoverRoutes"),p(discoverRoutes,"discoverRoutes");function projectSourceRoots(e,o,u={}){const i={};for(const a of Object.keys(o)){const l=new Set,r=p(s=>{if(!l.has(s)){l.add(s);for(const n of u[s]??[])r(n)}},"visit");r(a);const v=[...l].map(s=>o[s]?.root).filter(s=>typeof s=="string").map(s=>path.resolve(e,s)).filter(s=>{const n=path.relative(e,s);return n===""||n!==".."&&!n.startsWith(`..${path.sep}`)&&!path.isAbsolute(n)});i[a]=[...new Set(v)]}return i}f(projectSourceRoots,"projectSourceRoots"),d(projectSourceRoots,"projectSourceRoots"),p(projectSourceRoots,"projectSourceRoots");

package/executors/gateway/runtime/edge.js

@@ -1 +1 @@
-"use strict";var d=Object.defineProperty;var c=(e,r)=>d(e,"name",{value:r,configurable:!0});var p=Object.defineProperty,o=c((e,r)=>p(e,"name",{value:r,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.PREFLIGHT_METHODS_ROUTED=exports.PREFLIGHT_METHODS_NOROUTE=exports.corsPreflight=exports.cors=exports.isRoutedOrigin=exports.callerContextOf=exports.CALLER_CONTEXT=exports.CALLER_CONTEXT_HEADERS=exports.GATEWAY_OWNED_HEADERS=exports.sendError=exports.stampForwardingHeaders=exports.clientIpOf=exports.resolveClientIp=exports.CLIENT_IP=exports.rememberRawTarget=exports.rawTargetOf=exports.RAW_TARGET=exports.canonicalPath=exports.canonicalize=exports.ENCODED_STRUCTURE=void 0,exports.stripOwnedHeaders=stripOwnedHeaders;const gateway_errors_1=require("../gateway-errors"),client_ip_1=require("../client-ip"),manifest_1=require("../manifest");var canonical_path_1=require("../canonical-path");Object.defineProperty(exports,"ENCODED_STRUCTURE",{enumerable:!0,get:o(function(){return canonical_path_1.ENCODED_STRUCTURE},"get")}),Object.defineProperty(exports,"canonicalize",{enumerable:!0,get:o(function(){return canonical_path_1.canonicalize},"get")}),Object.defineProperty(exports,"canonicalPath",{enumerable:!0,get:o(function(){return canonical_path_1.canonicalPath},"get")}),Object.defineProperty(exports,"RAW_TARGET",{enumerable:!0,get:o(function(){return canonical_path_1.RAW_TARGET},"get")}),Object.defineProperty(exports,"rawTargetOf",{enumerable:!0,get:o(function(){return canonical_path_1.rawTargetOf},"get")}),Object.defineProperty(exports,"rememberRawTarget",{enumerable:!0,get:o(function(){return canonical_path_1.rememberRawTarget},"get")}),exports.CLIENT_IP=Symbol.for("lensmcp.gateway.clientIp");const FORWARDED=Symbol.for("lensmcp.gateway.forwarded"),peerOnly=(0,client_ip_1.createClientIpResolver)({}),resolverOf=o(e=>e.clientIp??peerOnly,"resolverOf"),peerOf=o(e=>e.socket?.remoteAddress??"","peerOf"),resolveClientIp=o((e,r)=>{const t=resolverOf(e).clientIpOf(r,peerOf(r));return r[exports.CLIENT_IP]=t,t},"resolveClientIp");exports.resolveClientIp=resolveClientIp;const clientIpOf=o(e=>e[exports.CLIENT_IP]??peerOf(e),"clientIpOf");exports.clientIpOf=clientIpOf;const stampForwardingHeaders=o((e,r)=>{const t=r;if(t[FORWARDED])return;t[FORWARDED]=!0;const s=peerOf(r);r.headers["x-forwarded-for"]=resolverOf(e).forwardedFor(r,s),r.headers["x-forwarded-proto"]=e.https?"https":"http";const n=r.headers.host;(resolverOf(e).trustProxyHops===0||!r.headers["x-forwarded-host"])&&(n?r.headers["x-forwarded-host"]=n:delete r.headers["x-forwarded-host"])},"stampForwardingHeaders");exports.stampForwardingHeaders=stampForwardingHeaders;const sendError=o((e,r,t,s,n,i,l)=>{const a=(0,gateway_errors_1.ensureRequestId)(r);return e.headersSent||e.writeHead(t,{"content-type":gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE,"x-request-id":a,...l??{}}),e.end((0,gateway_errors_1.gatewayErrorBody)(t,s,a,n,i)),a},"sendError");exports.sendError=sendError,exports.GATEWAY_OWNED_HEADERS=["x-internal-token","x-api-key-id","x-api-key-workspace","x-user-id","x-tenant-id","x-user-roles","x-user-permissions"],exports.CALLER_CONTEXT_HEADERS=["x-tenant-id","x-user-id"],exports.CALLER_CONTEXT=Symbol.for("lensmcp.gateway.callerContext");const CALLER_CONTEXT_VALUE=/^[\x21-\x2b\x2d-\x7e]{1,128}$/;function stripOwnedHeaders(e){const r={};for(const t of exports.CALLER_CONTEXT_HEADERS){const s=e.headers[t];typeof s=="string"&&CALLER_CONTEXT_VALUE.test(s)&&(r[t]=s)}e[exports.CALLER_CONTEXT]=r;for(const t of exports.GATEWAY_OWNED_HEADERS)delete e.headers[t]}c(stripOwnedHeaders,"stripOwnedHeaders"),o(stripOwnedHeaders,"stripOwnedHeaders");const callerContextOf=o(e=>e[exports.CALLER_CONTEXT]??{},"callerContextOf");exports.callerContextOf=callerContextOf;const isRoutedOrigin=o((e,r)=>{if(!e||e==="null")return!1;let t;try{t=new URL(e).hostname.toLowerCase()}catch{return!1}return t?t==="localhost"||t==="127.0.0.1"||t==="::1"?!0:r.some(s=>!!s.host&&(0,manifest_1.hostMatches)(s.host,t)):!1},"isRoutedOrigin");exports.isRoutedOrigin=isRoutedOrigin;const cors=o((e,r,t)=>{const s=e.headers.origin;typeof s!="string"||s===""||(r.setHeader("vary","Origin"),(0,exports.isRoutedOrigin)(s,t)&&(r.setHeader("access-control-allow-origin",s),r.setHeader("access-control-allow-credentials","true")))},"cors");exports.cors=cors;const corsPreflight=o((e,r,t,s)=>{(0,exports.cors)(e,r,s),r.writeHead(204,{"access-control-allow-methods":t,"access-control-allow-headers":String(e.headers["access-control-request-headers"]??"*")}),r.end()},"corsPreflight");exports.corsPreflight=corsPreflight,exports.PREFLIGHT_METHODS_NOROUTE="GET,HEAD,OPTIONS",exports.PREFLIGHT_METHODS_ROUTED="GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS";
+"use strict";var x=Object.defineProperty;var i=(e,r)=>x(e,"name",{value:r,configurable:!0});var d=Object.defineProperty,c=i((e,r)=>d(e,"name",{value:r,configurable:!0}),"c"),p=Object.defineProperty,o=c((e,r)=>p(e,"name",{value:r,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.PREFLIGHT_METHODS_ROUTED=exports.PREFLIGHT_METHODS_NOROUTE=exports.corsPreflight=exports.cors=exports.isRoutedOrigin=exports.callerContextOf=exports.CALLER_CONTEXT=exports.CALLER_CONTEXT_HEADERS=exports.GATEWAY_OWNED_HEADERS=exports.sendError=exports.stampForwardingHeaders=exports.clientIpOf=exports.resolveClientIp=exports.CLIENT_IP=exports.rememberRawTarget=exports.rawTargetOf=exports.RAW_TARGET=exports.canonicalPath=exports.canonicalize=exports.ENCODED_STRUCTURE=void 0,exports.stripOwnedHeaders=stripOwnedHeaders;const gateway_errors_1=require("../gateway-errors"),client_ip_1=require("../client-ip"),manifest_1=require("../manifest");var canonical_path_1=require("../canonical-path");Object.defineProperty(exports,"ENCODED_STRUCTURE",{enumerable:!0,get:o(function(){return canonical_path_1.ENCODED_STRUCTURE},"get")}),Object.defineProperty(exports,"canonicalize",{enumerable:!0,get:o(function(){return canonical_path_1.canonicalize},"get")}),Object.defineProperty(exports,"canonicalPath",{enumerable:!0,get:o(function(){return canonical_path_1.canonicalPath},"get")}),Object.defineProperty(exports,"RAW_TARGET",{enumerable:!0,get:o(function(){return canonical_path_1.RAW_TARGET},"get")}),Object.defineProperty(exports,"rawTargetOf",{enumerable:!0,get:o(function(){return canonical_path_1.rawTargetOf},"get")}),Object.defineProperty(exports,"rememberRawTarget",{enumerable:!0,get:o(function(){return canonical_path_1.rememberRawTarget},"get")}),exports.CLIENT_IP=Symbol.for("lensmcp.gateway.clientIp");const FORWARDED=Symbol.for("lensmcp.gateway.forwarded"),peerOnly=(0,client_ip_1.createClientIpResolver)({}),resolverOf=o(e=>e.clientIp??peerOnly,"resolverOf"),peerOf=o(e=>e.socket?.remoteAddress??"","peerOf"),resolveClientIp=o((e,r)=>{const t=resolverOf(e).clientIpOf(r,peerOf(r));return r[exports.CLIENT_IP]=t,t},"resolveClientIp");exports.resolveClientIp=resolveClientIp;const clientIpOf=o(e=>e[exports.CLIENT_IP]??peerOf(e),"clientIpOf");exports.clientIpOf=clientIpOf;const stampForwardingHeaders=o((e,r)=>{const t=r;if(t[FORWARDED])return;t[FORWARDED]=!0;const s=peerOf(r);r.headers["x-forwarded-for"]=resolverOf(e).forwardedFor(r,s),r.headers["x-forwarded-proto"]=e.https?"https":"http";const n=r.headers.host;(resolverOf(e).trustProxyHops===0||!r.headers["x-forwarded-host"])&&(n?r.headers["x-forwarded-host"]=n:delete r.headers["x-forwarded-host"])},"stampForwardingHeaders");exports.stampForwardingHeaders=stampForwardingHeaders;const sendError=o((e,r,t,s,n,l,E)=>{const a=(0,gateway_errors_1.ensureRequestId)(r);return e.headersSent||e.writeHead(t,{"content-type":gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE,"x-request-id":a,...E??{}}),e.end((0,gateway_errors_1.gatewayErrorBody)(t,s,a,n,l)),a},"sendError");exports.sendError=sendError,exports.GATEWAY_OWNED_HEADERS=["x-internal-token","x-api-key-id","x-api-key-workspace","x-user-id","x-tenant-id","x-user-roles","x-user-permissions"],exports.CALLER_CONTEXT_HEADERS=["x-tenant-id","x-user-id"],exports.CALLER_CONTEXT=Symbol.for("lensmcp.gateway.callerContext");const CALLER_CONTEXT_VALUE=/^[\x21-\x2b\x2d-\x7e]{1,128}$/;function stripOwnedHeaders(e){const r={};for(const t of exports.CALLER_CONTEXT_HEADERS){const s=e.headers[t];typeof s=="string"&&CALLER_CONTEXT_VALUE.test(s)&&(r[t]=s)}e[exports.CALLER_CONTEXT]=r;for(const t of exports.GATEWAY_OWNED_HEADERS)delete e.headers[t]}i(stripOwnedHeaders,"stripOwnedHeaders"),c(stripOwnedHeaders,"stripOwnedHeaders"),o(stripOwnedHeaders,"stripOwnedHeaders");const callerContextOf=o(e=>e[exports.CALLER_CONTEXT]??{},"callerContextOf");exports.callerContextOf=callerContextOf;const isRoutedOrigin=o((e,r)=>{if(!e||e==="null")return!1;let t;try{t=new URL(e).hostname.toLowerCase()}catch{return!1}return t?t==="localhost"||t==="127.0.0.1"||t==="::1"?!0:r.some(s=>!!s.host&&(0,manifest_1.hostMatches)(s.host,t)):!1},"isRoutedOrigin");exports.isRoutedOrigin=isRoutedOrigin;const cors=o((e,r,t)=>{const s=e.headers.origin;typeof s!="string"||s===""||(r.setHeader("vary","Origin"),(0,exports.isRoutedOrigin)(s,t)&&(r.setHeader("access-control-allow-origin",s),r.setHeader("access-control-allow-credentials","true")))},"cors");exports.cors=cors;const corsPreflight=o((e,r,t,s)=>{(0,exports.cors)(e,r,s),r.writeHead(204,{"access-control-allow-methods":t,"access-control-allow-headers":String(e.headers["access-control-request-headers"]??"*")}),r.end()},"corsPreflight");exports.corsPreflight=corsPreflight,exports.PREFLIGHT_METHODS_NOROUTE="GET,HEAD,OPTIONS",exports.PREFLIGHT_METHODS_ROUTED="GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS";