@lensmcp/cluster 1.25.34 → 1.25.36

package/executors/gateway/main.prod-gateway.js

@@ -1,2 +1,2 @@
-"use strict";var ce=Object.defineProperty;var R=(e,r)=>ce(e,"name",{value:r,configurable:!0});var ie=Object.defineProperty,a=R((e,r)=>ie(e,"name",{value:r,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0});const tslib_1=require("tslib"),node_fs_1=require("node:fs"),node_crypto_1=require("node:crypto"),node_path_1=require("node:path"),node_os_1=require("node:os"),node_cluster_1=tslib_1.__importDefault(require("node:cluster")),prod_gateway_lib_1=require("./prod-gateway.lib"),jwt_claims_1=require("./jwt-claims"),jwks_verify_1=require("./jwks-verify"),otel_tracing_1=require("./otel-tracing"),health_check_1=require("./health-check"),rate_limit_1=require("./rate-limit"),metrics_1=require("./metrics"),edge_1=require("./prod-runtime/edge"),registry_source_1=require("./registry-source"),providers_prod_1=require("./providers-prod"),prod_config_1=require("./prod-config");function readJson(e,r){if(!e)return r;try{return JSON.parse((0,node_fs_1.readFileSync)(e,"utf8"))}catch(n){return console.error(`[gateway] could not read ${e}:`,n.message),r}}R(readJson,"readJson"),a(readJson,"readJson");function watchJsonFile(e,r,n=1e3){let u=-1;const _=setInterval(a(()=>{if(!(0,node_fs_1.existsSync)(e))return;let p;try{p=(0,node_fs_1.statSync)(e).mtimeMs}catch{return}if(p===u)return;let w;try{w=JSON.parse((0,node_fs_1.readFileSync)(e,"utf8"))}catch(g){console.error("[gateway] endpoints reload:",g.message);return}u=p,r(w)},"tick"),n);return _.unref?.(),()=>clearInterval(_)}R(watchJsonFile,"watchJsonFile"),a(watchJsonFile,"watchJsonFile");async function main(){const e=process.env,r=(0,prod_config_1.parseGatewayEnv)(e),n=r.ports;process.on("uncaughtException",s=>console.error("[gateway] uncaughtException:",s)),process.on("unhandledRejection",s=>console.error("[gateway] unhandledRejection:",s));const u=[];let _=!1;const p=a(async s=>{if(!_){_=!0,console.log(`[gateway] ${s} \u2014 draining\u2026`);for(const t of u)try{await t()}catch{}process.exit(0)}},"shutdown");for(const s of["SIGTERM","SIGINT"])process.on(s,()=>{p(s)});const w=e.LENSMCP_GW_REDIS_URL;let g,m,$,b;const O={};let f;if(w){const s=require("ioredis"),t=new s(w);f=t;const o=(0,registry_source_1.createRegistryProviders)((0,registry_source_1.redisRegistrySource)(t,e.LENSMCP_GW_REDIS_PREFIX?{prefix:e.LENSMCP_GW_REDIS_PREFIX}:{}),{onError:a(i=>console.error("[gateway] registry:",i instanceof Error?i.message:i),"onError")});await o.start(),g=o.manifests,m=o.pods,b=o,console.log(`[gateway] registry: Redis-backed, live (${g.list().length} service(s))`)}else{const s=e.LENSMCP_GW_MANIFESTS;s?g=(0,providers_prod_1.fileManifestProvider)(s,{onError:a(o=>console.error("[gateway] manifest:",o instanceof Error?o.message:o),"onError")}):(console.warn("[gateway] no LENSMCP_GW_MANIFESTS / LENSMCP_GW_REDIS_URL \u2014 starting with an EMPTY route table (all requests 404 until manifests arrive)."),g=(0,providers_prod_1.staticManifestProvider)([]));const t=e.LENSMCP_GW_ENDPOINTS;if(t){const o=a(E=>console.error("[gateway] endpoints:",E instanceof Error?E.message:E),"onEpError"),i=readJson(t,{}),c=Object.keys(i).length,l=(0,providers_prod_1.isRolloutShape)(i);m=l?(0,providers_prod_1.rolloutPodProvider)(i,{onError:o}):(0,providers_prod_1.endpointsPodProvider)(i,{onError:o}),console.log(c?`[gateway] endpoints: ${l?"ROLLOUT (weighted cohorts)":"flat"} \u2014 ${c} service(s)`:`[gateway] endpoints: ${(0,node_fs_1.existsSync)(t)?"present but empty/unreadable":"file not there yet"} \u2014 watching ${t}`),$=watchJsonFile(t,E=>{try{m?.update?.(E),O.current?.refreshUpstreams(),console.log("[gateway] endpoints reloaded")}catch(ae){console.error("[gateway] endpoints reload failed:",ae.message)}})}}const Z=readJson(e.LENSMCP_GW_KEYS,{}),A=e.LENSMCP_GW_TLS_KEY&&e.LENSMCP_GW_TLS_CERT?{key:(0,node_fs_1.readFileSync)(e.LENSMCP_GW_TLS_KEY),cert:(0,node_fs_1.readFileSync)(e.LENSMCP_GW_TLS_CERT)}:void 0,ee=r.jwt.presenceOnly,D=r.jwt.jwksUrl,M=r.jwt.secret,S=D?(0,jwks_verify_1.createJwksVerifier)({jwksUrl:D,...r.jwt.issuer?{issuer:r.jwt.issuer}:{},...r.jwt.audience?{audience:r.jwt.audience}:{}}):void 0,re=a(s=>{if(!M)return;const t=s.split(".");if(t.length===3)try{if(JSON.parse(Buffer.from(t[0],"base64url").toString()).alg!=="HS256")return;const o=(0,node_crypto_1.createHmac)("sha256",M).update(t[0]+"."+t[1]).digest("base64url"),i=Buffer.from(t[2]),c=Buffer.from(o);if(i.length!==c.length||!(0,node_crypto_1.timingSafeEqual)(i,c))return;const l=JSON.parse(Buffer.from(t[1],"base64url").toString());return(0,jwt_claims_1.checkStandardClaims)(l,{...r.jwt.issuer?{issuer:r.jwt.issuer}:{},...r.jwt.audience?.length?{audience:r.jwt.audience}:{}})?l:void 0}catch{return}},"hs256"),F=a(s=>{const t=String(s.headers.authorization??"");if(!t.startsWith("Bearer "))return;const o=t.slice(7);return S?S.verify(o):re(o)},"bearerClaims"),j=S||M?F:void 0,te=a((s,t)=>{if(s==="jwt"){if(S||M){if(!F(t))throw new Error("invalid or missing token");return}if(!ee)throw new Error("jwt route but no verifier configured (set LENSMCP_GW_JWKS_URL or LENSMCP_GW_JWT_SECRET)");if(!String(t.headers.authorization??"").startsWith("Bearer "))throw new Error("missing bearer token")}},"authenticate"),{attributeHeaders:q,trustProxyHops:se,trustProxyIp:U,uidHeader:x,cookie:J}=r,y=e.LENSMCP_EVENT_FILE,H=y?(()=>{try{return require("@lensmcp/node-instrumentation")}catch{return}})():void 0,K=H?.createEventFloodGuard({burst:30,perSec:5});let B=!1;const I=y?s=>{try{const t=K?K.admit(String(s.fingerprint??"")):{ok:!0,suppressed:0};if(!t.ok)return;B||((0,node_fs_1.mkdirSync)((0,node_path_1.dirname)(y),{recursive:!0}),B=!0);const o=s.raw,i=JSON.stringify(t.suppressed>0?{...s,raw:{...o,floodSuppressed:t.suppressed}}:s)+`
-`;H?.maybeRotateEventFile(y,i.length),(0,node_fs_1.appendFileSync)(y,i)}catch{}}:void 0;if(S)try{await S.refresh(),console.log("[gateway] JWKS loaded")}catch(s){console.error("[gateway] initial JWKS load failed (will retry in background):",s.message)}const{accessLog:oe,clientIpHeader:z,clientIpTrustedProxies:X,undici:d}=r;if(r.mtlsFromRedis&&f){const s=e.LENSMCP_GW_REDIS_PREFIX??"lensmcp:gw",[t,o,i]=await f.mget(`${s}:mtls:cert`,`${s}:mtls:key`,`${s}:mtls:ca`);t&&(d.cert=t),o&&(d.key=o),i&&(d.ca=i),(t||o)&&console.log("[gateway] mTLS materials loaded from Redis")}else e.LENSMCP_GW_MTLS_CERT&&(d.cert=(0,node_fs_1.readFileSync)(e.LENSMCP_GW_MTLS_CERT)),e.LENSMCP_GW_MTLS_KEY&&(d.key=(0,node_fs_1.readFileSync)(e.LENSMCP_GW_MTLS_KEY)),e.LENSMCP_GW_MTLS_CA&&(d.ca=(0,node_fs_1.readFileSync)(e.LENSMCP_GW_MTLS_CA));(0,prod_config_1.finalizeUpstreamTls)(d).autoEnabled&&console.log("[gateway] upstream TLS verification ENABLED (a CA is configured; set LENSMCP_GW_UPSTREAM_TLS_VERIFY=0 to opt out)"),(0,prod_config_1.finalizeUpstreamH2)(d,e)&&console.log(`[gateway] mTLS to upstreams ON over ${d.allowH2?"h2":"h1.1"} (server validation ${d.rejectUnauthorized?"enabled":"OFF"})`);const{upstreamRetries:C,server:Y}=r,T=(0,otel_tracing_1.setupTracing)({...e.OTEL_SERVICE_NAME?{serviceName:e.OTEL_SERVICE_NAME}:{},...e.LENSMCP_GW_OTEL_SAMPLE?{sampleRatio:Number(e.LENSMCP_GW_OTEL_SAMPLE)}:{}});T&&console.log(`[gateway] OTLP tracing on \u2192 ${(0,edge_1.safeUrl)(e.OTEL_EXPORTER_OTLP_ENDPOINT)}`);const{statusEnabled:P,statusToken:L}=r,V=(0,node_os_1.hostname)(),ne=r.statusTtlSec,Q=f,k=P&&Q?s=>{for(const t of s)Q.set(`status:${t.service}:${V}`,JSON.stringify({...t,instance:V,at:Date.now()}),"EX",ne).catch(()=>{})}:void 0;P&&!L&&console.warn("[gateway] LENSMCP_GW_STATUS=1 but no LENSMCP_GW_STATUS_TOKEN \u2014 /statusz stays DISABLED (404) until a token is set (fail-closed). The Redis status:* fan-out still runs."),P&&console.log(`[gateway] status on \u2014 /statusz${L?"":" (endpoint disabled: no token)"}${k?" + Redis status:* fan-out":""}`);const v=r.health?(0,health_check_1.createHealthChecker)(r.health):void 0;v&&console.log(`[gateway] active health-checking on (path ${r.health?.path??"/healthz"})`);let h,G;if(r.rateLimit){const{limit:s,windowMs:t,wantRedis:o,failClosed:i}=r.rateLimit;if(o){const c=r.rateLimit.dedicatedUrl;let l;if(c){const E=require("ioredis");G=new E(c),l=G}else f&&(l=f);l?(h=(0,rate_limit_1.createRedisRateLimiter)(l,{limit:s,windowMs:t,prefix:`${e.LENSMCP_GW_REDIS_PREFIX??"lensmcp:gw"}:rl:`,...r.rateLimit.timeoutMs!==void 0?{timeoutMs:r.rateLimit.timeoutMs}:{},...i?{failOpen:!1}:{},onFailure:a(E=>console.error(`[gateway] RATE LIMITER DEGRADED \u2014 Redis unusable (${E}). Requests are being ${i?"DENIED":"ALLOWED"} without a limit check. Check the ACL covers ${e.LENSMCP_GW_REDIS_PREFIX??"lensmcp:gw"}:rl:*`),"onFailure")}),console.log(`[gateway] rate limit on \u2014 ${s} req / ${t}ms GLOBAL (Redis: ${c?"dedicated":"shared registry"}, fail-${i?"closed":"open"}) per client IP`)):console.warn("[gateway] LENSMCP_GW_RATE_LIMIT_REDIS set but no Redis configured (set LENSMCP_GW_REDIS_URL or LENSMCP_GW_RATE_LIMIT_REDIS_URL) \u2014 falling back to PER-INSTANCE in-memory limiting.")}if(!h){const c=(0,prod_config_1.workerCount)(e),l=(0,prod_config_1.perWorkerLimit)(s,c);h=(0,rate_limit_1.createRateLimiter)({limit:l,windowMs:t}),console.log(`[gateway] rate limit on \u2014 ${s} req / ${t}ms per client IP (in-memory`+(c>1?`, ${l}/worker \xD7 ${c} workers`:", per-instance")+")")}}const W=r.metricsEnabled?(0,metrics_1.createProcessMetrics)():void 0;W&&console.log(`[gateway] process metrics on \u2014 /metricsz${L?" (token-gated)":" (DISABLED: needs LENSMCP_GW_STATUS_TOKEN)"}`);const N=await(0,prod_gateway_lib_1.startProdGateway)({...n.length?{ports:n}:{},manifests:g,...m?{pods:m}:{},serviceKeys:Z,authenticate:te,...A?{tls:A}:{},...I?{emit:I}:{},...j?{identify:j}:{},...q.length?{attributeHeaders:q}:{},...U?{trustProxyIp:U,trustProxyHops:se}:{},...J?{cookie:J}:{},...x?{uidHeader:x}:{},...oe?{accessLog:!0}:{},...z?{clientIpHeader:z}:{},...X.length?{clientIpTrustedProxies:X}:{},...T?{tracing:T}:{},...P?{statusEndpoint:!0}:{},...L?{statusToken:L}:{},...k?{onStatus:k}:{},...v?{healthChecker:v}:{},...h?{rateLimiter:h}:{},...W?{metrics:W}:{},...r.trafficFlushMs!==void 0?{trafficFlushMs:r.trafficFlushMs}:{},...C!==void 0&&Number.isFinite(C)?{upstreamRetries:C}:{},...Object.keys(d).length?{undici:d}:{},...Object.keys(Y).length?{server:Y}:{}});O.current=N,console.log(`[gateway] production gateway up on ${N.ports.join(", ")} (${N.routes().length} routes${I?", lens ON":""})`),u.push(()=>g.stop?.(),()=>$?.(),()=>b?.stop(),()=>G?.quit(),()=>S?.stop(),()=>N.stop(),()=>T?.shutdown())}R(main,"main"),a(main,"main");const WORKERS=(0,prod_config_1.workerCount)(process.env);if(WORKERS>1&&node_cluster_1.default.isPrimary){if(console.log(`[gateway] primary ${process.pid}: forking ${WORKERS} workers (one per core)\u2026`),process.env.LENSMCP_GW_RATE_LIMIT&&!(0,prod_config_1.redisLimiterConfigured)(process.env)){const n=process.env.LENSMCP_GW_RATE_LIMIT_REDIS==="1",u=Number(process.env.LENSMCP_GW_RATE_LIMIT),_=(0,prod_config_1.perWorkerLimit)(u,WORKERS);console.warn(`[gateway] WARNING: ${n?"LENSMCP_GW_RATE_LIMIT_REDIS=1 is set but no Redis URL is \u2014 each worker will fall back to":"using"} the in-memory rate limiter with ${WORKERS} workers. Each worker now enforces ${_} req/window so the total stays \u2248 ${u}; a single client's burst can still land unevenly across workers. Set ${n?"LENSMCP_GW_REDIS_URL (or LENSMCP_GW_RATE_LIMIT_REDIS_URL)":"LENSMCP_GW_RATE_LIMIT_REDIS=1 and a Redis URL"} for one shared global budget.`)}let e=!1;for(let n=0;n<WORKERS;n++)node_cluster_1.default.fork();node_cluster_1.default.on("exit",(n,u,_)=>{e||(console.warn(`[gateway] worker ${n.process.pid} exited (code=${u} sig=${_??""}) \u2014 respawning.`),node_cluster_1.default.fork())});const r=a(n=>{if(!e){e=!0,console.log(`[gateway] primary: ${n} \u2014 stopping ${Object.keys(node_cluster_1.default.workers??{}).length} workers\u2026`);for(const u of Object.values(node_cluster_1.default.workers??{}))try{u?.kill(n)}catch{}setTimeout(()=>process.exit(0),12e3).unref()}},"stopAll");process.on("SIGTERM",()=>r("SIGTERM")),process.on("SIGINT",()=>r("SIGINT"))}else main().catch(e=>{console.error("[gateway] FATAL: could not start \u2014",e instanceof Error?e.stack??e.message:e),process.exit(1)});
+"use strict";var ue=Object.defineProperty;var M=(e,t)=>ue(e,"name",{value:t,configurable:!0});var ce=Object.defineProperty,R=M((e,t)=>ce(e,"name",{value:t,configurable:!0}),"R"),ie=Object.defineProperty,a=R((e,t)=>ie(e,"name",{value:t,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0});const tslib_1=require("tslib"),node_fs_1=require("node:fs"),node_crypto_1=require("node:crypto"),node_path_1=require("node:path"),node_os_1=require("node:os"),node_cluster_1=tslib_1.__importDefault(require("node:cluster")),prod_gateway_lib_1=require("./prod-gateway.lib"),jwt_claims_1=require("./jwt-claims"),jwks_verify_1=require("./jwks-verify"),otel_tracing_1=require("./otel-tracing"),health_check_1=require("./health-check"),rate_limit_1=require("./rate-limit"),metrics_1=require("./metrics"),edge_1=require("./prod-runtime/edge"),registry_source_1=require("./registry-source"),providers_prod_1=require("./providers-prod"),prod_config_1=require("./prod-config");function readJson(e,t){if(!e)return t;try{return JSON.parse((0,node_fs_1.readFileSync)(e,"utf8"))}catch(n){return console.error(`[gateway] could not read ${e}:`,n.message),t}}M(readJson,"readJson"),R(readJson,"readJson"),a(readJson,"readJson");function watchJsonFile(e,t,n=1e3){let u=-1;const _=setInterval(a(()=>{if(!(0,node_fs_1.existsSync)(e))return;let p;try{p=(0,node_fs_1.statSync)(e).mtimeMs}catch{return}if(p===u)return;let w;try{w=JSON.parse((0,node_fs_1.readFileSync)(e,"utf8"))}catch(g){console.error("[gateway] endpoints reload:",g.message);return}u=p,t(w)},"tick"),n);return _.unref?.(),()=>clearInterval(_)}M(watchJsonFile,"watchJsonFile"),R(watchJsonFile,"watchJsonFile"),a(watchJsonFile,"watchJsonFile");async function main(){const e=process.env,t=(0,prod_config_1.parseGatewayEnv)(e),n=t.ports;process.on("uncaughtException",s=>console.error("[gateway] uncaughtException:",s)),process.on("unhandledRejection",s=>console.error("[gateway] unhandledRejection:",s));const u=[];let _=!1;const p=a(async s=>{if(!_){_=!0,console.log(`[gateway] ${s} \u2014 draining\u2026`);for(const r of u)try{await r()}catch{}process.exit(0)}},"shutdown");for(const s of["SIGTERM","SIGINT"])process.on(s,()=>{p(s)});const w=e.LENSMCP_GW_REDIS_URL;let g,m,$,O;const A={};let f;if(w){const s=require("ioredis"),r=new s(w);f=r;const o=(0,registry_source_1.createRegistryProviders)((0,registry_source_1.redisRegistrySource)(r,e.LENSMCP_GW_REDIS_PREFIX?{prefix:e.LENSMCP_GW_REDIS_PREFIX}:{}),{onError:a(i=>console.error("[gateway] registry:",i instanceof Error?i.message:i),"onError")});await o.start(),g=o.manifests,m=o.pods,O=o,console.log(`[gateway] registry: Redis-backed, live (${g.list().length} service(s))`)}else{const s=e.LENSMCP_GW_MANIFESTS;s?g=(0,providers_prod_1.fileManifestProvider)(s,{onError:a(o=>console.error("[gateway] manifest:",o instanceof Error?o.message:o),"onError")}):(console.warn("[gateway] no LENSMCP_GW_MANIFESTS / LENSMCP_GW_REDIS_URL \u2014 starting with an EMPTY route table (all requests 404 until manifests arrive)."),g=(0,providers_prod_1.staticManifestProvider)([]));const r=e.LENSMCP_GW_ENDPOINTS;if(r){const o=a(E=>console.error("[gateway] endpoints:",E instanceof Error?E.message:E),"onEpError"),i=readJson(r,{}),c=Object.keys(i).length,l=(0,providers_prod_1.isRolloutShape)(i);m=l?(0,providers_prod_1.rolloutPodProvider)(i,{onError:o}):(0,providers_prod_1.endpointsPodProvider)(i,{onError:o}),console.log(c?`[gateway] endpoints: ${l?"ROLLOUT (weighted cohorts)":"flat"} \u2014 ${c} service(s)`:`[gateway] endpoints: ${(0,node_fs_1.existsSync)(r)?"present but empty/unreadable":"file not there yet"} \u2014 watching ${r}`),$=watchJsonFile(r,E=>{try{m?.update?.(E),A.current?.refreshUpstreams(),console.log("[gateway] endpoints reloaded")}catch(le){console.error("[gateway] endpoints reload failed:",le.message)}})}}const ee=readJson(e.LENSMCP_GW_KEYS,{}),F=e.LENSMCP_GW_TLS_KEY&&e.LENSMCP_GW_TLS_CERT?{key:(0,node_fs_1.readFileSync)(e.LENSMCP_GW_TLS_KEY),cert:(0,node_fs_1.readFileSync)(e.LENSMCP_GW_TLS_CERT)}:void 0,te=t.jwt.presenceOnly,j=t.jwt.jwksUrl,T=t.jwt.secret,S=j?(0,jwks_verify_1.createJwksVerifier)({jwksUrl:j,...t.jwt.issuer?{issuer:t.jwt.issuer}:{},...t.jwt.audience?{audience:t.jwt.audience}:{}}):void 0,re=a(s=>{if(!T)return;const r=s.split(".");if(r.length===3)try{if(JSON.parse(Buffer.from(r[0],"base64url").toString()).alg!=="HS256")return;const o=(0,node_crypto_1.createHmac)("sha256",T).update(r[0]+"."+r[1]).digest("base64url"),i=Buffer.from(r[2]),c=Buffer.from(o);if(i.length!==c.length||!(0,node_crypto_1.timingSafeEqual)(i,c))return;const l=JSON.parse(Buffer.from(r[1],"base64url").toString());return(0,jwt_claims_1.checkStandardClaims)(l,{...t.jwt.issuer?{issuer:t.jwt.issuer}:{},...t.jwt.audience?.length?{audience:t.jwt.audience}:{}})?l:void 0}catch{return}},"hs256"),D=a(s=>{const r=String(s.headers.authorization??"");if(!r.startsWith("Bearer "))return;const o=r.slice(7);return S?S.verify(o):re(o)},"bearerClaims"),q=S?(0,jwks_verify_1.bearerIdentify)(S):T?D:void 0,se=a((s,r)=>{if(s==="jwt"){if(S||T){if(!D(r))throw new Error("invalid or missing token");return}if(!te)throw new Error("jwt route but no verifier configured (set LENSMCP_GW_JWKS_URL or LENSMCP_GW_JWT_SECRET)");if(!String(r.headers.authorization??"").startsWith("Bearer "))throw new Error("missing bearer token")}},"authenticate"),{attributeHeaders:U,trustProxyHops:oe,trustProxyIp:x,uidHeader:J,cookie:H}=t,y=e.LENSMCP_EVENT_FILE,K=y?(()=>{try{return require("@lensmcp/node-instrumentation")}catch{return}})():void 0,B=K?.createEventFloodGuard({burst:30,perSec:5});let z=!1;const C=y?s=>{try{const r=B?B.admit(String(s.fingerprint??"")):{ok:!0,suppressed:0};if(!r.ok)return;z||((0,node_fs_1.mkdirSync)((0,node_path_1.dirname)(y),{recursive:!0}),z=!0);const o=s.raw,i=JSON.stringify(r.suppressed>0?{...s,raw:{...o,floodSuppressed:r.suppressed}}:s)+`
+`;K?.maybeRotateEventFile(y,i.length),(0,node_fs_1.appendFileSync)(y,i)}catch{}}:void 0;if(S)try{await S.refresh(),console.log("[gateway] JWKS loaded")}catch(s){console.error("[gateway] initial JWKS load failed (will retry in background):",s.message)}const{accessLog:ae,clientIpHeader:X,clientIpTrustedProxies:Y,undici:d}=t;if(t.mtlsFromRedis&&f){const s=e.LENSMCP_GW_REDIS_PREFIX??"lensmcp:gw",[r,o,i]=await f.mget(`${s}:mtls:cert`,`${s}:mtls:key`,`${s}:mtls:ca`);r&&(d.cert=r),o&&(d.key=o),i&&(d.ca=i),(r||o)&&console.log("[gateway] mTLS materials loaded from Redis")}else e.LENSMCP_GW_MTLS_CERT&&(d.cert=(0,node_fs_1.readFileSync)(e.LENSMCP_GW_MTLS_CERT)),e.LENSMCP_GW_MTLS_KEY&&(d.key=(0,node_fs_1.readFileSync)(e.LENSMCP_GW_MTLS_KEY)),e.LENSMCP_GW_MTLS_CA&&(d.ca=(0,node_fs_1.readFileSync)(e.LENSMCP_GW_MTLS_CA));(0,prod_config_1.finalizeUpstreamTls)(d).autoEnabled&&console.log("[gateway] upstream TLS verification ENABLED (a CA is configured; set LENSMCP_GW_UPSTREAM_TLS_VERIFY=0 to opt out)"),(0,prod_config_1.finalizeUpstreamH2)(d,e)&&console.log(`[gateway] mTLS to upstreams ON over ${d.allowH2?"h2":"h1.1"} (server validation ${d.rejectUnauthorized?"enabled":"OFF"})`);const{upstreamRetries:v,server:V}=t,P=(0,otel_tracing_1.setupTracing)({...e.OTEL_SERVICE_NAME?{serviceName:e.OTEL_SERVICE_NAME}:{},...e.LENSMCP_GW_OTEL_SAMPLE?{sampleRatio:Number(e.LENSMCP_GW_OTEL_SAMPLE)}:{}});P&&console.log(`[gateway] OTLP tracing on \u2192 ${(0,edge_1.safeUrl)(e.OTEL_EXPORTER_OTLP_ENDPOINT)}`);const{statusEnabled:N,statusToken:L}=t,Q=(0,node_os_1.hostname)(),ne=t.statusTtlSec,Z=f,k=N&&Z?s=>{for(const r of s)Z.set(`status:${r.service}:${Q}`,JSON.stringify({...r,instance:Q,at:Date.now()}),"EX",ne).catch(()=>{})}:void 0;N&&!L&&console.warn("[gateway] LENSMCP_GW_STATUS=1 but no LENSMCP_GW_STATUS_TOKEN \u2014 /statusz stays DISABLED (404) until a token is set (fail-closed). The Redis status:* fan-out still runs."),N&&console.log(`[gateway] status on \u2014 /statusz${L?"":" (endpoint disabled: no token)"}${k?" + Redis status:* fan-out":""}`);const G=t.health?(0,health_check_1.createHealthChecker)(t.health):void 0;G&&console.log(`[gateway] active health-checking on (path ${t.health?.path??"/healthz"})`);let h,W;if(t.rateLimit){const{limit:s,windowMs:r,wantRedis:o,failClosed:i}=t.rateLimit;if(o){const c=t.rateLimit.dedicatedUrl;let l;if(c){const E=require("ioredis");W=new E(c),l=W}else f&&(l=f);l?(h=(0,rate_limit_1.createRedisRateLimiter)(l,{limit:s,windowMs:r,prefix:`${e.LENSMCP_GW_REDIS_PREFIX??"lensmcp:gw"}:rl:`,...t.rateLimit.timeoutMs!==void 0?{timeoutMs:t.rateLimit.timeoutMs}:{},...i?{failOpen:!1}:{},onFailure:a(E=>console.error(`[gateway] RATE LIMITER DEGRADED \u2014 Redis unusable (${E}). Requests are being ${i?"DENIED":"ALLOWED"} without a limit check. Check the ACL covers ${e.LENSMCP_GW_REDIS_PREFIX??"lensmcp:gw"}:rl:*`),"onFailure")}),console.log(`[gateway] rate limit on \u2014 ${s} req / ${r}ms GLOBAL (Redis: ${c?"dedicated":"shared registry"}, fail-${i?"closed":"open"}) per client IP`)):console.warn("[gateway] LENSMCP_GW_RATE_LIMIT_REDIS set but no Redis configured (set LENSMCP_GW_REDIS_URL or LENSMCP_GW_RATE_LIMIT_REDIS_URL) \u2014 falling back to PER-INSTANCE in-memory limiting.")}if(!h){const c=(0,prod_config_1.workerCount)(e),l=(0,prod_config_1.perWorkerLimit)(s,c);h=(0,rate_limit_1.createRateLimiter)({limit:l,windowMs:r}),console.log(`[gateway] rate limit on \u2014 ${s} req / ${r}ms per client IP (in-memory`+(c>1?`, ${l}/worker \xD7 ${c} workers`:", per-instance")+")")}}const b=t.metricsEnabled?(0,metrics_1.createProcessMetrics)():void 0;b&&console.log(`[gateway] process metrics on \u2014 /metricsz${L?" (token-gated)":" (DISABLED: needs LENSMCP_GW_STATUS_TOKEN)"}`);const I=await(0,prod_gateway_lib_1.startProdGateway)({...n.length?{ports:n}:{},manifests:g,...m?{pods:m}:{},serviceKeys:ee,authenticate:se,...F?{tls:F}:{},...C?{emit:C}:{},...q?{identify:q}:{},...U.length?{attributeHeaders:U}:{},...x?{trustProxyIp:x,trustProxyHops:oe}:{},...H?{cookie:H}:{},...J?{uidHeader:J}:{},...ae?{accessLog:!0}:{},...X?{clientIpHeader:X}:{},...Y.length?{clientIpTrustedProxies:Y}:{},...P?{tracing:P}:{},...N?{statusEndpoint:!0}:{},...L?{statusToken:L}:{},...k?{onStatus:k}:{},...G?{healthChecker:G}:{},...h?{rateLimiter:h}:{},...b?{metrics:b}:{},...t.trafficFlushMs!==void 0?{trafficFlushMs:t.trafficFlushMs}:{},...v!==void 0&&Number.isFinite(v)?{upstreamRetries:v}:{},...Object.keys(d).length?{undici:d}:{},...Object.keys(V).length?{server:V}:{}});A.current=I,console.log(`[gateway] production gateway up on ${I.ports.join(", ")} (${I.routes().length} routes${C?", lens ON":""})`),u.push(()=>g.stop?.(),()=>$?.(),()=>O?.stop(),()=>W?.quit(),()=>S?.stop(),()=>I.stop(),()=>P?.shutdown())}M(main,"main"),R(main,"main"),a(main,"main");const WORKERS=(0,prod_config_1.workerCount)(process.env);if(WORKERS>1&&node_cluster_1.default.isPrimary){if(console.log(`[gateway] primary ${process.pid}: forking ${WORKERS} workers (one per core)\u2026`),process.env.LENSMCP_GW_RATE_LIMIT&&!(0,prod_config_1.redisLimiterConfigured)(process.env)){const n=process.env.LENSMCP_GW_RATE_LIMIT_REDIS==="1",u=Number(process.env.LENSMCP_GW_RATE_LIMIT),_=(0,prod_config_1.perWorkerLimit)(u,WORKERS);console.warn(`[gateway] WARNING: ${n?"LENSMCP_GW_RATE_LIMIT_REDIS=1 is set but no Redis URL is \u2014 each worker will fall back to":"using"} the in-memory rate limiter with ${WORKERS} workers. Each worker now enforces ${_} req/window so the total stays \u2248 ${u}; a single client's burst can still land unevenly across workers. Set ${n?"LENSMCP_GW_REDIS_URL (or LENSMCP_GW_RATE_LIMIT_REDIS_URL)":"LENSMCP_GW_RATE_LIMIT_REDIS=1 and a Redis URL"} for one shared global budget.`)}let e=!1;for(let n=0;n<WORKERS;n++)node_cluster_1.default.fork();node_cluster_1.default.on("exit",(n,u,_)=>{e||(console.warn(`[gateway] worker ${n.process.pid} exited (code=${u} sig=${_??""}) \u2014 respawning.`),node_cluster_1.default.fork())});const t=a(n=>{if(!e){e=!0,console.log(`[gateway] primary: ${n} \u2014 stopping ${Object.keys(node_cluster_1.default.workers??{}).length} workers\u2026`);for(const u of Object.values(node_cluster_1.default.workers??{}))try{u?.kill(n)}catch{}setTimeout(()=>process.exit(0),12e3).unref()}},"stopAll");process.on("SIGTERM",()=>t("SIGTERM")),process.on("SIGINT",()=>t("SIGINT"))}else main().catch(e=>{console.error("[gateway] FATAL: could not start \u2014",e instanceof Error?e.stack??e.message:e),process.exit(1)});

package/executors/gateway/main.rollout.js

@@ -1,4 +1,4 @@
-"use strict";var p=Object.defineProperty;var l=(e,r)=>p(e,"name",{value:r,configurable:!0});var a=Object.defineProperty,i=l((e,r)=>a(e,"name",{value:r,configurable:!0}),"i");Object.defineProperty(exports,"__esModule",{value:!0}),exports.runRollout=runRollout;const node_fs_1=require("node:fs"),rollout_ops_1=require("./rollout-ops"),registry_source_1=require("./registry-source"),USAGE=`lensmcp rollout \u2014 edit the gateway rollout config (file or Redis registry)
+"use strict";var v=Object.defineProperty;var c=(e,r)=>v(e,"name",{value:r,configurable:!0});var p=Object.defineProperty,l=c((e,r)=>p(e,"name",{value:r,configurable:!0}),"l"),a=Object.defineProperty,i=l((e,r)=>a(e,"name",{value:r,configurable:!0}),"i");Object.defineProperty(exports,"__esModule",{value:!0}),exports.runRollout=runRollout;const node_fs_1=require("node:fs"),rollout_ops_1=require("./rollout-ops"),registry_source_1=require("./registry-source"),USAGE=`lensmcp rollout \u2014 edit the gateway rollout config (file or Redis registry)
 
 Usage: <config.json> <command> [args]
        --redis <url> [--prefix <p>] <command> [args]
@@ -16,9 +16,9 @@ Commands:
 `)?e:e+`
 `),"out"),err=i(e=>process.stderr.write(e.endsWith(`
 `)?e:e+`
-`),"err");function extractFlag(e,r){const o=e.indexOf(r);return o<0?{rest:e}:{value:e[o+1],rest:[...e.slice(0,o),...e.slice(o+2)]}}l(extractFlag,"extractFlag"),i(extractFlag,"extractFlag");function runFile(e){const[r,...o]=e;if(!r||!o.length)return err(USAGE),2;let s;try{s=JSON.parse((0,node_fs_1.readFileSync)(r,"utf8"))}catch(t){return err(`cannot read ${r}: ${t.message}`),1}try{const t=(0,rollout_ops_1.parseRolloutCommand)(o);if(!t.op)return out((0,rollout_ops_1.summarizeRollout)(s,t.status)),0;const n=(0,rollout_ops_1.applyRolloutOp)(s,t.op);return(0,node_fs_1.writeFileSync)(`${r}.tmp`,JSON.stringify(n,null,2)+`
+`),"err");function extractFlag(e,r){const o=e.indexOf(r);return o<0?{rest:e}:{value:e[o+1],rest:[...e.slice(0,o),...e.slice(o+2)]}}c(extractFlag,"extractFlag"),l(extractFlag,"extractFlag"),i(extractFlag,"extractFlag");function runFile(e){const[r,...o]=e;if(!r||!o.length)return err(USAGE),2;let s;try{s=JSON.parse((0,node_fs_1.readFileSync)(r,"utf8"))}catch(t){return err(`cannot read ${r}: ${t.message}`),1}try{const t=(0,rollout_ops_1.parseRolloutCommand)(o);if(!t.op)return out((0,rollout_ops_1.summarizeRollout)(s,t.status)),0;const n=(0,rollout_ops_1.applyRolloutOp)(s,t.op);return(0,node_fs_1.writeFileSync)(`${r}.tmp`,JSON.stringify(n,null,2)+`
 `),(0,node_fs_1.renameSync)(`${r}.tmp`,r),out(`\u2713 ${t.op.kind} ${t.op.service}
 
-${(0,rollout_ops_1.summarizeRollout)(n,t.op.service)}`),0}catch(t){return err(`\u2717 ${t.message}`),1}}l(runFile,"runFile"),i(runFile,"runFile");async function runRedis(e,r,o){if(!o.length)return err(USAGE),2;let s;try{const t=require("ioredis");s=new t(e)}catch{return err('--redis needs the "ioredis" package installed (peer dep of @lensmcp/cluster)'),1}try{const{endpoints:t}=await(0,registry_source_1.redisRegistrySource)(s,{prefix:r}).read(),n=(0,rollout_ops_1.parseRolloutCommand)(o);if(!n.op)return out((0,rollout_ops_1.summarizeRollout)(t,n.status)),0;const c=(0,rollout_ops_1.applyRolloutOp)(t,n.op),u=n.op.service,d=c[u];return d===void 0?await s.del((0,registry_source_1.rolloutKey)(r,u)):await s.set((0,registry_source_1.rolloutKey)(r,u),JSON.stringify(d)),await s.publish((0,registry_source_1.changeChannel)(r),u),out(`\u2713 ${n.op.kind} ${u} \u2192 redis ${r} (published)
+${(0,rollout_ops_1.summarizeRollout)(n,t.op.service)}`),0}catch(t){return err(`\u2717 ${t.message}`),1}}c(runFile,"runFile"),l(runFile,"runFile"),i(runFile,"runFile");async function runRedis(e,r,o){if(!o.length)return err(USAGE),2;let s;try{const t=require("ioredis");s=new t(e)}catch{return err('--redis needs the "ioredis" package installed (peer dep of @lensmcp/cluster)'),1}try{const{endpoints:t}=await(0,registry_source_1.redisRegistrySource)(s,{prefix:r}).read(),n=(0,rollout_ops_1.parseRolloutCommand)(o);if(!n.op)return out((0,rollout_ops_1.summarizeRollout)(t,n.status)),0;const d=(0,rollout_ops_1.applyRolloutOp)(t,n.op),u=n.op.service,m=d[u];return m===void 0?await s.del((0,registry_source_1.rolloutKey)(r,u)):await s.set((0,registry_source_1.rolloutKey)(r,u),JSON.stringify(m)),await s.publish((0,registry_source_1.changeChannel)(r),u),out(`\u2713 ${n.op.kind} ${u} \u2192 redis ${r} (published)
 
-${(0,rollout_ops_1.summarizeRollout)(c,u)}`),0}catch(t){return err(`\u2717 ${t.message}`),1}finally{try{await s.quit()}catch{}}}l(runRedis,"runRedis"),i(runRedis,"runRedis");async function runRollout(e){const r=extractFlag(e,"--redis"),o=extractFlag(r.rest,"--prefix");return r.value?runRedis(r.value,o.value??registry_source_1.DEFAULT_REGISTRY_PREFIX,o.rest):runFile(o.rest)}l(runRollout,"runRollout"),i(runRollout,"runRollout"),require.main===module&&runRollout(process.argv.slice(2)).then(e=>process.exit(e));
+${(0,rollout_ops_1.summarizeRollout)(d,u)}`),0}catch(t){return err(`\u2717 ${t.message}`),1}finally{try{await s.quit()}catch{}}}c(runRedis,"runRedis"),l(runRedis,"runRedis"),i(runRedis,"runRedis");async function runRollout(e){const r=extractFlag(e,"--redis"),o=extractFlag(r.rest,"--prefix");return r.value?runRedis(r.value,o.value??registry_source_1.DEFAULT_REGISTRY_PREFIX,o.rest):runFile(o.rest)}c(runRollout,"runRollout"),l(runRollout,"runRollout"),i(runRollout,"runRollout"),require.main===module&&runRollout(process.argv.slice(2)).then(e=>process.exit(e));

package/executors/gateway/manifest.js

@@ -1 +1 @@
-"use strict";var h=Object.defineProperty;var i=(t,r)=>h(t,"name",{value:r,configurable:!0});var f=Object.defineProperty,o=i((t,r)=>f(t,"name",{value:r,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.smoothWeightedSelector=smoothWeightedSelector,exports.hostMatches=hostMatches,exports.matchRoute=matchRoute,exports.pathUnderPrefix=pathUnderPrefix,exports.sortBySpecificity=sortBySpecificity,exports.authForPath=authForPath,exports.authPathMatches=authPathMatches,exports.authRuleFor=authRuleFor,exports.authRuleForPath=authRuleForPath,exports.buildRouteTable=buildRouteTable,exports.manifestFromClusterDecl=manifestFromClusterDecl,exports.matchCidr=matchCidr,exports.evalRule=evalRule,exports.pickTargetedVersion=pickTargetedVersion,exports.fnv1a=fnv1a,exports.bucketByWeight=bucketByWeight;function smoothWeightedSelector(t){const r=t.map(()=>0),e=t.reduce((s,n)=>s+Math.max(0,n),0);return()=>{if(e<=0||t.length===0)return 0;let s=0;for(let n=0;n<t.length;n++)r[n]+=Math.max(0,t[n]),r[n]>r[s]&&(s=n);return r[s]-=e,s}}i(smoothWeightedSelector,"smoothWeightedSelector"),o(smoothWeightedSelector,"smoothWeightedSelector");function hostMatches(t,r){const e=t.toLowerCase(),s=r.toLowerCase();return e.startsWith("*.")?s.endsWith(e.slice(1))||s===e.slice(2):s===e}i(hostMatches,"hostMatches"),o(hostMatches,"hostMatches");function matchRoute(t,r,e){const s=t.some(a=>a.host&&hostMatches(a.host,r));let n;if(s)n=t.filter(a=>a.host&&hostMatches(a.host,r)),n.some(a=>a.host===r)?n=n.filter(a=>a.host===r):n.length>1&&(n=[...n].sort((a,u)=>u.host.length-a.host.length));else{const a=t.filter(u=>!u.host);if(a.length<=1)n=a;else{const u=a.filter(l=>l.apex&&(r===l.apex||r.endsWith("."+l.apex))).sort((l,c)=>c.apex.length-l.apex.length);n=u.length>0?u:a.filter(l=>!l.apex)}}return n.find(a=>!a.prefix||pathUnderPrefix(e,a.prefix))}i(matchRoute,"matchRoute"),o(matchRoute,"matchRoute");function pathUnderPrefix(t,r){let e=r.length;for(;e>0&&r.charCodeAt(e-1)===47;)e-=1;if(e===0)return!0;if(t.length<e||t.slice(0,e).toLowerCase()!==r.slice(0,e).toLowerCase())return!1;const s=t.charCodeAt(e);return Number.isNaN(s)||s===47||s===63}i(pathUnderPrefix,"pathUnderPrefix"),o(pathUnderPrefix,"pathUnderPrefix");function sortBySpecificity(t){const r=o(e=>(e.host?2:0)+(e.prefix?1:0),"rank");return t.sort((e,s)=>r(s)-r(e)||(s.prefix?.length??0)-(e.prefix?.length??0)),t}i(sortBySpecificity,"sortBySpecificity"),o(sortBySpecificity,"sortBySpecificity");function authForPath(t,r,e){if(e)return"internal";const s=t.auth?.overrides??[];for(const n of s)if(r.startsWith(n.path))return n.mode;return t.auth?.default??"jwt"}i(authForPath,"authForPath"),o(authForPath,"authForPath");function authPathMatches(t,r){const e=t.split("/").filter(Boolean),s=(r.split("?")[0]??"").split("/").filter(Boolean);if(s.length<e.length)return!1;for(let n=0;n<e.length;n++){const a=e[n];if(!(a==="*"||a.startsWith(":"))&&a.toLowerCase()!==s[n].toLowerCase())return!1}return!0}i(authPathMatches,"authPathMatches"),o(authPathMatches,"authPathMatches");function authRuleFor(t,r,e){const s=e.toUpperCase();for(const n of t?.overrides??[]){if(!authPathMatches(n.path,r)||n.methods&&!n.methods.some(u=>u.toUpperCase()===s))continue;const a=n.rule??(n.permission?{attr:"perms",op:"hastoken",value:n.permission}:void 0);return{mode:n.mode??t?.default??"jwt",...a?{rule:a}:{}}}return{mode:t?.default??"jwt"}}i(authRuleFor,"authRuleFor"),o(authRuleFor,"authRuleFor");function authRuleForPath(t,r,e,s){return s?{mode:"internal"}:authRuleFor(t.auth,r,e)}i(authRuleForPath,"authRuleForPath"),o(authRuleForPath,"authRuleForPath");function buildRouteTable(t){const r=[];for(const e of t){const s=e.auth?.default??"jwt";for(const n of e.mounts){const a={service:e.service,...n.path?{prefix:n.path}:{},...e.prependPrefix?{prependPrefix:e.prependPrefix}:{},...e.upstream?{upstream:e.upstream}:{}};r.push({...a,host:n.host,auth:s}),e.internal&&e.internalHost!==!1&&r.push({...a,host:typeof e.internalHost=="string"?e.internalHost:`internal.${n.host}`,internal:!0,auth:"internal"})}e.default&&r.push({service:e.service,...e.prependPrefix?{prependPrefix:e.prependPrefix}:{},...e.upstream?{upstream:e.upstream}:{},default:!0,auth:s})}return sortBySpecificity(r)}i(buildRouteTable,"buildRouteTable"),o(buildRouteTable,"buildRouteTable");function manifestFromClusterDecl(t,r){const e=r.upstream??(r.port?`http://localhost:${r.port}`:void 0);if(!(!r.service&&!e))return{service:r.service??t,mounts:r.host?[{host:r.host,...r.path?{path:r.path}:{}}]:[],internal:!!r.service,...r.internalHost!==void 0?{internalHost:r.internalHost}:{},...r.default?{default:!0}:{},...r.prependPrefix?{prependPrefix:r.prependPrefix}:{},...r.auth?{auth:r.auth}:{},...e?{upstream:e}:{}}}i(manifestFromClusterDecl,"manifestFromClusterDecl"),o(manifestFromClusterDecl,"manifestFromClusterDecl");const isGroup=o(t=>"all"in t||"any"in t||"not"in t,"isGroup"),reCache=new Map,compileRe=o(t=>{if(t.length>512)return null;if(reCache.has(t))return reCache.get(t);let r;try{r=new RegExp(t)}catch{r=null}return reCache.set(t,r),r},"compileRe");function ipToInt(t){const r=(t.startsWith("::ffff:")?t.slice(7):t).split(".");if(r.length!==4)return null;let e=0;for(const s of r){const n=Number(s);if(!Number.isInteger(n)||n<0||n>255||s.length>1&&s[0]==="0")return null;e=e*256+n}return e>>>0}i(ipToInt,"ipToInt"),o(ipToInt,"ipToInt");function matchCidr(t,r){const e=r.indexOf("/");if(e<0)return!1;const s=Number(r.slice(e+1));if(!Number.isInteger(s)||s<0||s>32)return!1;const n=ipToInt(t),a=ipToInt(r.slice(0,e));if(n===null||a===null)return!1;if(s===0)return!0;const u=(s===32?4294967295:~((1<<32-s)-1))>>>0;return(n&u)>>>0===(a&u)>>>0}i(matchCidr,"matchCidr"),o(matchCidr,"matchCidr");const str=o(t=>t==null?"":String(t),"str"),eq=o((t,r)=>str(t)===str(r),"eq");function evalCondition(t,r){const e=r[t.attr],s=e!=null;switch(t.op){case"exists":return s;case"ne":return!s||!eq(e,t.value)}if(!s)return!1;switch(t.op){case"eq":return eq(e,t.value);case"in":return Array.isArray(t.value)&&t.value.some(n=>Array.isArray(e)?e.some(a=>eq(a,n)):eq(e,n));case"nin":return Array.isArray(t.value)&&!t.value.some(n=>Array.isArray(e)?e.some(a=>eq(a,n)):eq(e,n));case"prefix":return str(e).startsWith(str(t.value));case"suffix":return str(e).endsWith(str(t.value));case"domain":{const n=str(e).lastIndexOf("@"),a=(n===-1?str(e):str(e).slice(n+1)).toLowerCase().replace(/\.$/,""),u=str(t.value).toLowerCase().replace(/^\./,"").replace(/\.$/,"");return!!u&&(a===u||a.endsWith("."+u))}case"contains":return Array.isArray(e)?e.some(n=>eq(n,t.value)):str(e).includes(str(t.value));case"hastoken":{const n=str(t.value);return Array.isArray(e)?e.some(a=>eq(a,t.value)):str(e).split(/[\s,]+/).filter(Boolean).includes(n)}case"regex":{const n=compileRe(str(t.value));return n?n.test(str(e)):!1}case"gt":return Number(e)>Number(t.value);case"lt":return Number(e)<Number(t.value);case"cidr":return matchCidr(str(e),str(t.value));default:return!1}}i(evalCondition,"evalCondition"),o(evalCondition,"evalCondition");function evalRule(t,r){if(!isGroup(t))return evalCondition(t,r);const e=Array.isArray(t.all)&&t.all.length?t.all:void 0,s=Array.isArray(t.any)&&t.any.length?t.any:void 0,n=t.not&&Object.keys(t.not).length?t.not:void 0;return n&&evalRule(n,r)||e&&!e.every(a=>evalRule(a,r))||s&&!s.some(a=>evalRule(a,r))?!1:!!(e||s||n)}i(evalRule,"evalRule"),o(evalRule,"evalRule");function pickTargetedVersion(t,r){for(const e of t)if(evalRule(e.when,r))return{version:e.version,...e.name?{rule:e.name}:{}}}i(pickTargetedVersion,"pickTargetedVersion"),o(pickTargetedVersion,"pickTargetedVersion");function fnv1a(t){let r=2166136261;for(let e=0;e<t.length;e++)r^=t.charCodeAt(e),r=Math.imul(r,16777619);return r>>>0}i(fnv1a,"fnv1a"),o(fnv1a,"fnv1a");function bucketByWeight(t,r){const e=r.reduce((a,u)=>a+Math.max(0,u),0);if(e<=0||r.length===0)return 0;const s=fnv1a(t)%1e4;let n=0;for(let a=0;a<r.length;a++)if(n+=Math.max(0,r[a])/e*1e4,s<n)return a;return r.length-1}i(bucketByWeight,"bucketByWeight"),o(bucketByWeight,"bucketByWeight");
+"use strict";var d=Object.defineProperty;var u=(t,r)=>d(t,"name",{value:r,configurable:!0});var h=Object.defineProperty,i=u((t,r)=>h(t,"name",{value:r,configurable:!0}),"i"),f=Object.defineProperty,o=i((t,r)=>f(t,"name",{value:r,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.smoothWeightedSelector=smoothWeightedSelector,exports.hostMatches=hostMatches,exports.matchRoute=matchRoute,exports.pathUnderPrefix=pathUnderPrefix,exports.sortBySpecificity=sortBySpecificity,exports.authForPath=authForPath,exports.authPathMatches=authPathMatches,exports.authRuleFor=authRuleFor,exports.authRuleForPath=authRuleForPath,exports.buildRouteTable=buildRouteTable,exports.manifestFromClusterDecl=manifestFromClusterDecl,exports.matchCidr=matchCidr,exports.evalRule=evalRule,exports.pickTargetedVersion=pickTargetedVersion,exports.fnv1a=fnv1a,exports.bucketByWeight=bucketByWeight;function smoothWeightedSelector(t){const r=t.map(()=>0),e=t.reduce((s,n)=>s+Math.max(0,n),0);return()=>{if(e<=0||t.length===0)return 0;let s=0;for(let n=0;n<t.length;n++)r[n]+=Math.max(0,t[n]),r[n]>r[s]&&(s=n);return r[s]-=e,s}}u(smoothWeightedSelector,"smoothWeightedSelector"),i(smoothWeightedSelector,"smoothWeightedSelector"),o(smoothWeightedSelector,"smoothWeightedSelector");function hostMatches(t,r){const e=t.toLowerCase(),s=r.toLowerCase();return e.startsWith("*.")?s.endsWith(e.slice(1))||s===e.slice(2):s===e}u(hostMatches,"hostMatches"),i(hostMatches,"hostMatches"),o(hostMatches,"hostMatches");function matchRoute(t,r,e){const s=t.some(a=>a.host&&hostMatches(a.host,r));let n;if(s)n=t.filter(a=>a.host&&hostMatches(a.host,r)),n.some(a=>a.host===r)?n=n.filter(a=>a.host===r):n.length>1&&(n=[...n].sort((a,l)=>l.host.length-a.host.length));else{const a=t.filter(l=>!l.host);if(a.length<=1)n=a;else{const l=a.filter(c=>c.apex&&(r===c.apex||r.endsWith("."+c.apex))).sort((c,p)=>p.apex.length-c.apex.length);n=l.length>0?l:a.filter(c=>!c.apex)}}return n.find(a=>!a.prefix||pathUnderPrefix(e,a.prefix))}u(matchRoute,"matchRoute"),i(matchRoute,"matchRoute"),o(matchRoute,"matchRoute");function pathUnderPrefix(t,r){let e=r.length;for(;e>0&&r.charCodeAt(e-1)===47;)e-=1;if(e===0)return!0;if(t.length<e||t.slice(0,e).toLowerCase()!==r.slice(0,e).toLowerCase())return!1;const s=t.charCodeAt(e);return Number.isNaN(s)||s===47||s===63}u(pathUnderPrefix,"pathUnderPrefix"),i(pathUnderPrefix,"pathUnderPrefix"),o(pathUnderPrefix,"pathUnderPrefix");function sortBySpecificity(t){const r=o(e=>(e.host?2:0)+(e.prefix?1:0),"rank");return t.sort((e,s)=>r(s)-r(e)||(s.prefix?.length??0)-(e.prefix?.length??0)),t}u(sortBySpecificity,"sortBySpecificity"),i(sortBySpecificity,"sortBySpecificity"),o(sortBySpecificity,"sortBySpecificity");function authForPath(t,r,e){if(e)return"internal";const s=t.auth?.overrides??[];for(const n of s)if(r.startsWith(n.path))return n.mode;return t.auth?.default??"jwt"}u(authForPath,"authForPath"),i(authForPath,"authForPath"),o(authForPath,"authForPath");function authPathMatches(t,r){const e=t.split("/").filter(Boolean),s=(r.split("?")[0]??"").split("/").filter(Boolean);if(s.length<e.length)return!1;for(let n=0;n<e.length;n++){const a=e[n];if(!(a==="*"||a.startsWith(":"))&&a.toLowerCase()!==s[n].toLowerCase())return!1}return!0}u(authPathMatches,"authPathMatches"),i(authPathMatches,"authPathMatches"),o(authPathMatches,"authPathMatches");function authRuleFor(t,r,e){const s=e.toUpperCase();for(const n of t?.overrides??[]){if(!authPathMatches(n.path,r)||n.methods&&!n.methods.some(l=>l.toUpperCase()===s))continue;const a=n.rule??(n.permission?{attr:"perms",op:"hastoken",value:n.permission}:void 0);return{mode:n.mode??t?.default??"jwt",...a?{rule:a}:{}}}return{mode:t?.default??"jwt"}}u(authRuleFor,"authRuleFor"),i(authRuleFor,"authRuleFor"),o(authRuleFor,"authRuleFor");function authRuleForPath(t,r,e,s){return s?{mode:"internal"}:authRuleFor(t.auth,r,e)}u(authRuleForPath,"authRuleForPath"),i(authRuleForPath,"authRuleForPath"),o(authRuleForPath,"authRuleForPath");function buildRouteTable(t){const r=[];for(const e of t){const s=e.auth?.default??"jwt";for(const n of e.mounts){const a={service:e.service,...n.path?{prefix:n.path}:{},...e.prependPrefix?{prependPrefix:e.prependPrefix}:{},...e.upstream?{upstream:e.upstream}:{}};r.push({...a,host:n.host,auth:s}),e.internal&&e.internalHost!==!1&&r.push({...a,host:typeof e.internalHost=="string"?e.internalHost:`internal.${n.host}`,internal:!0,auth:"internal"})}e.default&&r.push({service:e.service,...e.prependPrefix?{prependPrefix:e.prependPrefix}:{},...e.upstream?{upstream:e.upstream}:{},default:!0,auth:s})}return sortBySpecificity(r)}u(buildRouteTable,"buildRouteTable"),i(buildRouteTable,"buildRouteTable"),o(buildRouteTable,"buildRouteTable");function manifestFromClusterDecl(t,r){const e=r.upstream??(r.port?`http://localhost:${r.port}`:void 0);if(!(!r.service&&!e))return{service:r.service??t,mounts:r.host?[{host:r.host,...r.path?{path:r.path}:{}}]:[],internal:!!r.service,...r.internalHost!==void 0?{internalHost:r.internalHost}:{},...r.default?{default:!0}:{},...r.prependPrefix?{prependPrefix:r.prependPrefix}:{},...r.auth?{auth:r.auth}:{},...e?{upstream:e}:{}}}u(manifestFromClusterDecl,"manifestFromClusterDecl"),i(manifestFromClusterDecl,"manifestFromClusterDecl"),o(manifestFromClusterDecl,"manifestFromClusterDecl");const isGroup=o(t=>"all"in t||"any"in t||"not"in t,"isGroup"),reCache=new Map,compileRe=o(t=>{if(t.length>512)return null;if(reCache.has(t))return reCache.get(t);let r;try{r=new RegExp(t)}catch{r=null}return reCache.set(t,r),r},"compileRe");function ipToInt(t){const r=(t.startsWith("::ffff:")?t.slice(7):t).split(".");if(r.length!==4)return null;let e=0;for(const s of r){const n=Number(s);if(!Number.isInteger(n)||n<0||n>255||s.length>1&&s[0]==="0")return null;e=e*256+n}return e>>>0}u(ipToInt,"ipToInt"),i(ipToInt,"ipToInt"),o(ipToInt,"ipToInt");function matchCidr(t,r){const e=r.indexOf("/");if(e<0)return!1;const s=Number(r.slice(e+1));if(!Number.isInteger(s)||s<0||s>32)return!1;const n=ipToInt(t),a=ipToInt(r.slice(0,e));if(n===null||a===null)return!1;if(s===0)return!0;const l=(s===32?4294967295:~((1<<32-s)-1))>>>0;return(n&l)>>>0===(a&l)>>>0}u(matchCidr,"matchCidr"),i(matchCidr,"matchCidr"),o(matchCidr,"matchCidr");const str=o(t=>t==null?"":String(t),"str"),eq=o((t,r)=>str(t)===str(r),"eq");function evalCondition(t,r){const e=r[t.attr],s=e!=null;switch(t.op){case"exists":return s;case"ne":return!s||!eq(e,t.value)}if(!s)return!1;switch(t.op){case"eq":return eq(e,t.value);case"in":return Array.isArray(t.value)&&t.value.some(n=>Array.isArray(e)?e.some(a=>eq(a,n)):eq(e,n));case"nin":return Array.isArray(t.value)&&!t.value.some(n=>Array.isArray(e)?e.some(a=>eq(a,n)):eq(e,n));case"prefix":return str(e).startsWith(str(t.value));case"suffix":return str(e).endsWith(str(t.value));case"domain":{const n=str(e).lastIndexOf("@"),a=(n===-1?str(e):str(e).slice(n+1)).toLowerCase().replace(/\.$/,""),l=str(t.value).toLowerCase().replace(/^\./,"").replace(/\.$/,"");return!!l&&(a===l||a.endsWith("."+l))}case"contains":return Array.isArray(e)?e.some(n=>eq(n,t.value)):str(e).includes(str(t.value));case"hastoken":{const n=str(t.value);return Array.isArray(e)?e.some(a=>eq(a,t.value)):str(e).split(/[\s,]+/).filter(Boolean).includes(n)}case"regex":{const n=compileRe(str(t.value));return n?n.test(str(e)):!1}case"gt":return Number(e)>Number(t.value);case"lt":return Number(e)<Number(t.value);case"cidr":return matchCidr(str(e),str(t.value));default:return!1}}u(evalCondition,"evalCondition"),i(evalCondition,"evalCondition"),o(evalCondition,"evalCondition");function evalRule(t,r){if(!isGroup(t))return evalCondition(t,r);const e=Array.isArray(t.all)&&t.all.length?t.all:void 0,s=Array.isArray(t.any)&&t.any.length?t.any:void 0,n=t.not&&Object.keys(t.not).length?t.not:void 0;return n&&evalRule(n,r)||e&&!e.every(a=>evalRule(a,r))||s&&!s.some(a=>evalRule(a,r))?!1:!!(e||s||n)}u(evalRule,"evalRule"),i(evalRule,"evalRule"),o(evalRule,"evalRule");function pickTargetedVersion(t,r){for(const e of t)if(evalRule(e.when,r))return{version:e.version,...e.name?{rule:e.name}:{}}}u(pickTargetedVersion,"pickTargetedVersion"),i(pickTargetedVersion,"pickTargetedVersion"),o(pickTargetedVersion,"pickTargetedVersion");function fnv1a(t){let r=2166136261;for(let e=0;e<t.length;e++)r^=t.charCodeAt(e),r=Math.imul(r,16777619);return r>>>0}u(fnv1a,"fnv1a"),i(fnv1a,"fnv1a"),o(fnv1a,"fnv1a");function bucketByWeight(t,r){const e=r.reduce((a,l)=>a+Math.max(0,l),0);if(e<=0||r.length===0)return 0;const s=fnv1a(t)%1e4;let n=0;for(let a=0;a<r.length;a++)if(n+=Math.max(0,r[a])/e*1e4,s<n)return a;return r.length-1}u(bucketByWeight,"bucketByWeight"),i(bucketByWeight,"bucketByWeight"),o(bucketByWeight,"bucketByWeight");

package/executors/gateway/metrics.js

@@ -1 +1 @@
-"use strict";var y=Object.defineProperty;var l=(r,e)=>y(r,"name",{value:e,configurable:!0});var f=Object.defineProperty,p=l((r,e)=>f(r,"name",{value:e,configurable:!0}),"p");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createProcessMetrics=createProcessMetrics;const node_perf_hooks_1=require("node:perf_hooks"),MB=1024*1024,round=p((r,e=1)=>{const t=10**e;return Math.round(r*t)/t},"round");function createProcessMetrics(){const r=Date.now(),e=(0,node_perf_hooks_1.monitorEventLoopDelay)({resolution:10});e.enable();let t=process.cpuUsage(),i=Date.now(),o=0,M=0,d=0,m=0,u=0;const a=p(s=>round(s/1e6,2),"lagMs");return{recordRequest(s){o+=1,s>=500||s===0?m+=1:s>=400?d+=1:s>=200&&(M+=1)},snapshot(){const s=Date.now(),x=Math.max(1,s-i),n=process.cpuUsage(t),c=process.memoryUsage(),h=(n.user+n.system)/1e3,g={uptimeSec:Math.round((s-r)/1e3),rssMB:round(c.rss/MB),heapUsedMB:round(c.heapUsed/MB),heapTotalMB:round(c.heapTotal/MB),externalMB:round(c.external/MB),cpu:{userMs:round(n.user/1e3),systemMs:round(n.system/1e3),percent:round(h/x*100)},loopLagMs:{mean:a(e.mean),p50:a(e.percentile(50)),p90:a(e.percentile(90)),p99:a(e.percentile(99)),max:a(e.max)},requests:{total:o,sinceLast:o-u,perSec:Math.round((o-u)/x*1e3),s2xx:M,s4xx:d,s5xx:m}};return t=process.cpuUsage(),i=s,u=o,e.reset(),g},stop(){e.disable()}}}l(createProcessMetrics,"createProcessMetrics"),p(createProcessMetrics,"createProcessMetrics");
+"use strict";var v=Object.defineProperty;var i=(r,e)=>v(r,"name",{value:e,configurable:!0});var y=Object.defineProperty,l=i((r,e)=>y(r,"name",{value:e,configurable:!0}),"l"),f=Object.defineProperty,p=l((r,e)=>f(r,"name",{value:e,configurable:!0}),"p");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createProcessMetrics=createProcessMetrics;const node_perf_hooks_1=require("node:perf_hooks"),MB=1024*1024,round=p((r,e=1)=>{const t=10**e;return Math.round(r*t)/t},"round");function createProcessMetrics(){const r=Date.now(),e=(0,node_perf_hooks_1.monitorEventLoopDelay)({resolution:10});e.enable();let t=process.cpuUsage(),M=Date.now(),o=0,d=0,m=0,x=0,u=0;const a=p(s=>round(s/1e6,2),"lagMs");return{recordRequest(s){o+=1,s>=500||s===0?x+=1:s>=400?m+=1:s>=200&&(d+=1)},snapshot(){const s=Date.now(),h=Math.max(1,s-M),n=process.cpuUsage(t),c=process.memoryUsage(),g=(n.user+n.system)/1e3,b={uptimeSec:Math.round((s-r)/1e3),rssMB:round(c.rss/MB),heapUsedMB:round(c.heapUsed/MB),heapTotalMB:round(c.heapTotal/MB),externalMB:round(c.external/MB),cpu:{userMs:round(n.user/1e3),systemMs:round(n.system/1e3),percent:round(g/h*100)},loopLagMs:{mean:a(e.mean),p50:a(e.percentile(50)),p90:a(e.percentile(90)),p99:a(e.percentile(99)),max:a(e.max)},requests:{total:o,sinceLast:o-u,perSec:Math.round((o-u)/h*1e3),s2xx:d,s4xx:m,s5xx:x}};return t=process.cpuUsage(),M=s,u=o,e.reset(),b},stop(){e.disable()}}}i(createProcessMetrics,"createProcessMetrics"),l(createProcessMetrics,"createProcessMetrics"),p(createProcessMetrics,"createProcessMetrics");

package/executors/gateway/otel-tracing.js

@@ -1 +1 @@
-"use strict";var O=Object.defineProperty;var c=(e,r)=>O(e,"name",{value:r,configurable:!0});var T=Object.defineProperty,o=c((e,r)=>T(e,"name",{value:r,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.setupTracing=setupTracing;const api_1=require("@opentelemetry/api"),core_1=require("@opentelemetry/core"),sdk_trace_base_1=require("@opentelemetry/sdk-trace-base"),resources_1=require("@opentelemetry/resources"),exporter_trace_otlp_http_1=require("@opentelemetry/exporter-trace-otlp-http"),firstHeader=o((e,r)=>{const t=e[r.toLowerCase()];return Array.isArray(t)?t[0]:t},"firstHeader"),getter={keys:o(e=>Object.keys(e),"keys"),get:o((e,r)=>firstHeader(e,r),"get")},setter={set:o((e,r,t)=>{e[r.toLowerCase()]=t},"set")};function setupTracing(e={}){const r=e.endpoint??process.env.OTEL_EXPORTER_OTLP_ENDPOINT;if(!r)return;const t=r.replace(/\/+$/,""),u=/\/v1\/traces$/.test(t)?t:`${t}/v1/traces`,d=new exporter_trace_otlp_http_1.OTLPTraceExporter({url:u,...e.headers?{headers:e.headers}:{}}),p=new sdk_trace_base_1.BasicTracerProvider({resource:(0,resources_1.resourceFromAttributes)({"service.name":e.serviceName??process.env.OTEL_SERVICE_NAME??"lensmcp-gateway"}),sampler:new sdk_trace_base_1.ParentBasedSampler({root:new sdk_trace_base_1.TraceIdRatioBasedSampler(e.sampleRatio??1)}),spanProcessors:[new sdk_trace_base_1.BatchSpanProcessor(d)]}),_=p.getTracer("lensmcp-gateway"),i=new core_1.W3CTraceContextPropagator;return{startSpan(s,a,n){const l=i.extract(api_1.ROOT_CONTEXT,s.headers,getter);return _.startSpan(a,{kind:api_1.SpanKind.SERVER,attributes:n},l)},inject(s,a){i.inject(api_1.trace.setSpan(api_1.ROOT_CONTEXT,s),a,setter)},end(s,a,n){n&&s.setAttributes(n),s.setAttribute("http.response.status_code",a),(a>=500||a===0)&&s.setStatus({code:api_1.SpanStatusCode.ERROR}),s.end()},shutdown:o(()=>p.shutdown(),"shutdown")}}c(setupTracing,"setupTracing"),o(setupTracing,"setupTracing");
+"use strict";var y=Object.defineProperty;var p=(e,r)=>y(e,"name",{value:r,configurable:!0});var O=Object.defineProperty,c=p((e,r)=>O(e,"name",{value:r,configurable:!0}),"c"),T=Object.defineProperty,o=c((e,r)=>T(e,"name",{value:r,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.setupTracing=setupTracing;const api_1=require("@opentelemetry/api"),core_1=require("@opentelemetry/core"),sdk_trace_base_1=require("@opentelemetry/sdk-trace-base"),resources_1=require("@opentelemetry/resources"),exporter_trace_otlp_http_1=require("@opentelemetry/exporter-trace-otlp-http"),firstHeader=o((e,r)=>{const t=e[r.toLowerCase()];return Array.isArray(t)?t[0]:t},"firstHeader"),getter={keys:o(e=>Object.keys(e),"keys"),get:o((e,r)=>firstHeader(e,r),"get")},setter={set:o((e,r,t)=>{e[r.toLowerCase()]=t},"set")};function setupTracing(e={}){const r=e.endpoint??process.env.OTEL_EXPORTER_OTLP_ENDPOINT;if(!r)return;const t=r.replace(/\/+$/,""),d=/\/v1\/traces$/.test(t)?t:`${t}/v1/traces`,l=new exporter_trace_otlp_http_1.OTLPTraceExporter({url:d,...e.headers?{headers:e.headers}:{}}),i=new sdk_trace_base_1.BasicTracerProvider({resource:(0,resources_1.resourceFromAttributes)({"service.name":e.serviceName??process.env.OTEL_SERVICE_NAME??"lensmcp-gateway"}),sampler:new sdk_trace_base_1.ParentBasedSampler({root:new sdk_trace_base_1.TraceIdRatioBasedSampler(e.sampleRatio??1)}),spanProcessors:[new sdk_trace_base_1.BatchSpanProcessor(l)]}),_=i.getTracer("lensmcp-gateway"),u=new core_1.W3CTraceContextPropagator;return{startSpan(s,a,n){const m=u.extract(api_1.ROOT_CONTEXT,s.headers,getter);return _.startSpan(a,{kind:api_1.SpanKind.SERVER,attributes:n},m)},inject(s,a){u.inject(api_1.trace.setSpan(api_1.ROOT_CONTEXT,s),a,setter)},end(s,a,n){n&&s.setAttributes(n),s.setAttribute("http.response.status_code",a),(a>=500||a===0)&&s.setStatus({code:api_1.SpanStatusCode.ERROR}),s.end()},shutdown:o(()=>i.shutdown(),"shutdown")}}p(setupTracing,"setupTracing"),c(setupTracing,"setupTracing"),o(setupTracing,"setupTracing");

package/executors/gateway/prod-config.js

@@ -1 +1 @@
-"use strict";var w=Object.defineProperty;var S=(_,E)=>w(_,"name",{value:E,configurable:!0});var k=Object.defineProperty,t=S((_,E)=>k(_,"name",{value:E,configurable:!0}),"t");Object.defineProperty(exports,"__esModule",{value:!0}),exports.parseGatewayEnv=parseGatewayEnv,exports.redisLimiterConfigured=redisLimiterConfigured,exports.perWorkerLimit=perWorkerLimit,exports.workerCount=workerCount,exports.finalizeUpstreamTls=finalizeUpstreamTls,exports.finalizeUpstreamH2=finalizeUpstreamH2;const node_os_1=require("node:os"),num=t(_=>{if(_===void 0||_.trim()==="")return;const E=Number(_);return Number.isFinite(E)?E:void 0},"num"),csv=t(_=>(_??"").split(",").map(E=>E.trim()).filter(Boolean),"csv"),flag=t(_=>_==="1","flag");function parseGatewayEnv(_){const E=csv(_.LENSMCP_GW_PORTS??_.PORT).map(Number).filter(L=>Number.isFinite(L)&&L>=0&&L<=65535),r=Math.max(0,Math.floor(num(_.LENSMCP_GW_TRUST_PROXY)??0)),i={},N=_.LENSMCP_GW_UPSTREAM_TLS_VERIFY;N==="1"?i.rejectUnauthorized=!0:N==="0"&&(i.rejectUnauthorized=!1),flag(_.LENSMCP_GW_UPSTREAM_H2)&&(i.allowH2=!0);const a=num(_.LENSMCP_GW_UNDICI_CONNECTIONS);a!==void 0&&(i.connections=a);const T=num(_.LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS);T!==void 0&&(i.bodyTimeout=T);const P=num(_.LENSMCP_GW_UNDICI_PIPELINING);P!==void 0&&(i.pipelining=P);const W=num(_.LENSMCP_GW_UNDICI_HEADERS_TIMEOUT_MS);W!==void 0&&(i.headersTimeout=W);const I=num(_.LENSMCP_GW_UNDICI_KEEPALIVE_MS);I!==void 0&&(i.keepAliveTimeout=I);const o={},u=num(_.LENSMCP_GW_KEEPALIVE_MS);u!==void 0&&(o.keepAliveTimeout=u);const d=num(_.LENSMCP_GW_REQUEST_TIMEOUT_MS);d!==void 0&&(o.requestTimeout=d);const G=num(_.LENSMCP_GW_HEADERS_TIMEOUT_MS);G!==void 0&&(o.headersTimeout=G);const c=num(_.LENSMCP_GW_MAX_HEADERS);c!==void 0&&(o.maxHeadersCount=c);const R=num(_.LENSMCP_GW_CONN_CHECK_MS);R!==void 0&&(o.connectionsCheckingInterval=R);const l=num(_.LENSMCP_GW_MAX_CONNECTIONS);l!==void 0&&(o.maxConnections=l);const m=num(_.LENSMCP_GW_BODY_STALL_MS);m!==void 0&&(o.bodyStallMs=m);const e=_.LENSMCP_GW_COOKIE_SECRET,M=_.LENSMCP_GW_COOKIE_NAME,n=_.LENSMCP_GW_COOKIE_DOMAIN,A=num(_.LENSMCP_GW_COOKIE_MAXAGE),U=e||M||n?{...M?{name:M}:{},...e?{secret:e}:{},...n?{domain:n}:{},...A!==void 0?{maxAge:A}:{}}:void 0,v=num(_.LENSMCP_GW_RATE_LIMIT),s=_.LENSMCP_GW_RATE_LIMIT_REDIS_URL,p=num(_.LENSMCP_GW_RATE_LIMIT_TIMEOUT_MS),O=v===void 0?void 0:{limit:v,windowMs:num(_.LENSMCP_GW_RATE_WINDOW_MS)??6e4,wantRedis:flag(_.LENSMCP_GW_RATE_LIMIT_REDIS)||!!s,...s?{dedicatedUrl:s}:{},...p!==void 0?{timeoutMs:p}:{},failClosed:flag(_.LENSMCP_GW_RATE_LIMIT_FAIL_CLOSED)},f=_.LENSMCP_GW_HEALTH_PATH,H=num(_.LENSMCP_GW_HEALTH_INTERVAL_MS),D=num(_.LENSMCP_GW_HEALTH_TIMEOUT_MS),h=flag(_.LENSMCP_GW_HEALTH_CHECK),b=h?{...f?{path:f}:{},...H!==void 0?{intervalMs:H}:{},...D!==void 0?{timeoutMs:D}:{}}:void 0,C=num(_.LENSMCP_GW_TRAFFIC_FLUSH_MS),x=csv(_.LENSMCP_GW_JWT_AUD);return{ports:E,workers:workerCount(_),undici:i,server:o,...num(_.LENSMCP_GW_UPSTREAM_RETRIES)!==void 0?{upstreamRetries:num(_.LENSMCP_GW_UPSTREAM_RETRIES)}:{},trustProxyIp:r>0,trustProxyHops:r,...U?{cookie:U}:{},attributeHeaders:csv(_.LENSMCP_GW_ATTR_HEADERS),..._.LENSMCP_GW_CLIENT_IP_HEADER?{clientIpHeader:_.LENSMCP_GW_CLIENT_IP_HEADER}:{},clientIpTrustedProxies:csv(_.LENSMCP_GW_CLIENT_IP_TRUSTED_PROXIES),..._.LENSMCP_GW_UID_HEADER?{uidHeader:_.LENSMCP_GW_UID_HEADER}:{},accessLog:flag(_.LENSMCP_GW_ACCESS_LOG),statusEnabled:flag(_.LENSMCP_GW_STATUS),..._.LENSMCP_GW_STATUS_TOKEN?{statusToken:_.LENSMCP_GW_STATUS_TOKEN}:{},metricsEnabled:flag(_.LENSMCP_GW_METRICS),statusTtlSec:Math.max(3,Math.ceil((C??5e3)/1e3*3)),...C!==void 0?{trafficFlushMs:C}:{},...O?{rateLimit:O}:{},...b?{health:b}:{},healthCheckEnabled:h,jwt:{..._.LENSMCP_GW_JWKS_URL?{jwksUrl:_.LENSMCP_GW_JWKS_URL}:{},..._.LENSMCP_GW_JWT_SECRET?{secret:_.LENSMCP_GW_JWT_SECRET}:{},..._.LENSMCP_GW_JWT_ISS?{issuer:_.LENSMCP_GW_JWT_ISS}:{},...x.length?{audience:x}:{},presenceOnly:flag(_.LENSMCP_GW_JWT_PRESENCE_ONLY)},mtlsFromRedis:flag(_.LENSMCP_GW_MTLS_FROM_REDIS)}}S(parseGatewayEnv,"parseGatewayEnv"),t(parseGatewayEnv,"parseGatewayEnv");function redisLimiterConfigured(_){return _.LENSMCP_GW_RATE_LIMIT_REDIS_URL?!0:flag(_.LENSMCP_GW_RATE_LIMIT_REDIS)&&!!_.LENSMCP_GW_REDIS_URL}S(redisLimiterConfigured,"redisLimiterConfigured"),t(redisLimiterConfigured,"redisLimiterConfigured");function perWorkerLimit(_,E){if(!Number.isFinite(_)||_<=0)return _;const r=Number.isFinite(E)&&E>1?Math.floor(E):1;return Math.max(1,Math.floor(_/r))}S(perWorkerLimit,"perWorkerLimit"),t(perWorkerLimit,"perWorkerLimit");function workerCount(_){const E=(_.LENSMCP_GW_WORKERS??"1").trim().toLowerCase();if(E==="auto"||E==="max"||E==="0")return Math.max(1,(0,node_os_1.cpus)().length);const r=Math.floor(Number(E));return Number.isFinite(r)&&r>0?r:1}S(workerCount,"workerCount"),t(workerCount,"workerCount");function finalizeUpstreamTls(_){return _.ca&&_.rejectUnauthorized===void 0?(_.rejectUnauthorized=!0,{autoEnabled:!0}):{autoEnabled:!1}}S(finalizeUpstreamTls,"finalizeUpstreamTls"),t(finalizeUpstreamTls,"finalizeUpstreamTls");function finalizeUpstreamH2(_,E){return _.cert&&_.key?(E.LENSMCP_GW_UPSTREAM_H2!=="0"&&(_.allowH2=!0),!0):!1}S(finalizeUpstreamH2,"finalizeUpstreamH2"),t(finalizeUpstreamH2,"finalizeUpstreamH2");
+"use strict";var y=Object.defineProperty;var o=(e,E)=>y(e,"name",{value:E,configurable:!0});var w=Object.defineProperty,S=o((e,E)=>w(e,"name",{value:E,configurable:!0}),"S"),k=Object.defineProperty,t=S((e,E)=>k(e,"name",{value:E,configurable:!0}),"t");Object.defineProperty(exports,"__esModule",{value:!0}),exports.parseGatewayEnv=parseGatewayEnv,exports.redisLimiterConfigured=redisLimiterConfigured,exports.perWorkerLimit=perWorkerLimit,exports.workerCount=workerCount,exports.finalizeUpstreamTls=finalizeUpstreamTls,exports.finalizeUpstreamH2=finalizeUpstreamH2;const node_os_1=require("node:os"),num=t(e=>{if(e===void 0||e.trim()==="")return;const E=Number(e);return Number.isFinite(E)?E:void 0},"num"),csv=t(e=>(e??"").split(",").map(E=>E.trim()).filter(Boolean),"csv"),flag=t(e=>e==="1","flag");function parseGatewayEnv(e){const E=csv(e.LENSMCP_GW_PORTS??e.PORT).map(Number).filter(L=>Number.isFinite(L)&&L>=0&&L<=65535),r=Math.max(0,Math.floor(num(e.LENSMCP_GW_TRUST_PROXY)??0)),i={},N=e.LENSMCP_GW_UPSTREAM_TLS_VERIFY;N==="1"?i.rejectUnauthorized=!0:N==="0"&&(i.rejectUnauthorized=!1),flag(e.LENSMCP_GW_UPSTREAM_H2)&&(i.allowH2=!0);const T=num(e.LENSMCP_GW_UNDICI_CONNECTIONS);T!==void 0&&(i.connections=T);const P=num(e.LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS);P!==void 0&&(i.bodyTimeout=P);const u=num(e.LENSMCP_GW_UNDICI_PIPELINING);u!==void 0&&(i.pipelining=u);const W=num(e.LENSMCP_GW_UNDICI_HEADERS_TIMEOUT_MS);W!==void 0&&(i.headersTimeout=W);const I=num(e.LENSMCP_GW_UNDICI_KEEPALIVE_MS);I!==void 0&&(i.keepAliveTimeout=I);const _={},d=num(e.LENSMCP_GW_KEEPALIVE_MS);d!==void 0&&(_.keepAliveTimeout=d);const G=num(e.LENSMCP_GW_REQUEST_TIMEOUT_MS);G!==void 0&&(_.requestTimeout=G);const c=num(e.LENSMCP_GW_HEADERS_TIMEOUT_MS);c!==void 0&&(_.headersTimeout=c);const l=num(e.LENSMCP_GW_MAX_HEADERS);l!==void 0&&(_.maxHeadersCount=l);const R=num(e.LENSMCP_GW_CONN_CHECK_MS);R!==void 0&&(_.connectionsCheckingInterval=R);const m=num(e.LENSMCP_GW_MAX_CONNECTIONS);m!==void 0&&(_.maxConnections=m);const A=num(e.LENSMCP_GW_BODY_STALL_MS);A!==void 0&&(_.bodyStallMs=A);const n=e.LENSMCP_GW_COOKIE_SECRET,M=e.LENSMCP_GW_COOKIE_NAME,s=e.LENSMCP_GW_COOKIE_DOMAIN,U=num(e.LENSMCP_GW_COOKIE_MAXAGE),p=n||M||s?{...M?{name:M}:{},...n?{secret:n}:{},...s?{domain:s}:{},...U!==void 0?{maxAge:U}:{}}:void 0,v=num(e.LENSMCP_GW_RATE_LIMIT),a=e.LENSMCP_GW_RATE_LIMIT_REDIS_URL,O=num(e.LENSMCP_GW_RATE_LIMIT_TIMEOUT_MS),f=v===void 0?void 0:{limit:v,windowMs:num(e.LENSMCP_GW_RATE_WINDOW_MS)??6e4,wantRedis:flag(e.LENSMCP_GW_RATE_LIMIT_REDIS)||!!a,...a?{dedicatedUrl:a}:{},...O!==void 0?{timeoutMs:O}:{},failClosed:flag(e.LENSMCP_GW_RATE_LIMIT_FAIL_CLOSED)},H=e.LENSMCP_GW_HEALTH_PATH,D=num(e.LENSMCP_GW_HEALTH_INTERVAL_MS),h=num(e.LENSMCP_GW_HEALTH_TIMEOUT_MS),b=flag(e.LENSMCP_GW_HEALTH_CHECK),x=b?{...H?{path:H}:{},...D!==void 0?{intervalMs:D}:{},...h!==void 0?{timeoutMs:h}:{}}:void 0,C=num(e.LENSMCP_GW_TRAFFIC_FLUSH_MS),g=csv(e.LENSMCP_GW_JWT_AUD);return{ports:E,workers:workerCount(e),undici:i,server:_,...num(e.LENSMCP_GW_UPSTREAM_RETRIES)!==void 0?{upstreamRetries:num(e.LENSMCP_GW_UPSTREAM_RETRIES)}:{},trustProxyIp:r>0,trustProxyHops:r,...p?{cookie:p}:{},attributeHeaders:csv(e.LENSMCP_GW_ATTR_HEADERS),...e.LENSMCP_GW_CLIENT_IP_HEADER?{clientIpHeader:e.LENSMCP_GW_CLIENT_IP_HEADER}:{},clientIpTrustedProxies:csv(e.LENSMCP_GW_CLIENT_IP_TRUSTED_PROXIES),...e.LENSMCP_GW_UID_HEADER?{uidHeader:e.LENSMCP_GW_UID_HEADER}:{},accessLog:flag(e.LENSMCP_GW_ACCESS_LOG),statusEnabled:flag(e.LENSMCP_GW_STATUS),...e.LENSMCP_GW_STATUS_TOKEN?{statusToken:e.LENSMCP_GW_STATUS_TOKEN}:{},metricsEnabled:flag(e.LENSMCP_GW_METRICS),statusTtlSec:Math.max(3,Math.ceil((C??5e3)/1e3*3)),...C!==void 0?{trafficFlushMs:C}:{},...f?{rateLimit:f}:{},...x?{health:x}:{},healthCheckEnabled:b,jwt:{...e.LENSMCP_GW_JWKS_URL?{jwksUrl:e.LENSMCP_GW_JWKS_URL}:{},...e.LENSMCP_GW_JWT_SECRET?{secret:e.LENSMCP_GW_JWT_SECRET}:{},...e.LENSMCP_GW_JWT_ISS?{issuer:e.LENSMCP_GW_JWT_ISS}:{},...g.length?{audience:g}:{},presenceOnly:flag(e.LENSMCP_GW_JWT_PRESENCE_ONLY)},mtlsFromRedis:flag(e.LENSMCP_GW_MTLS_FROM_REDIS)}}o(parseGatewayEnv,"parseGatewayEnv"),S(parseGatewayEnv,"parseGatewayEnv"),t(parseGatewayEnv,"parseGatewayEnv");function redisLimiterConfigured(e){return e.LENSMCP_GW_RATE_LIMIT_REDIS_URL?!0:flag(e.LENSMCP_GW_RATE_LIMIT_REDIS)&&!!e.LENSMCP_GW_REDIS_URL}o(redisLimiterConfigured,"redisLimiterConfigured"),S(redisLimiterConfigured,"redisLimiterConfigured"),t(redisLimiterConfigured,"redisLimiterConfigured");function perWorkerLimit(e,E){if(!Number.isFinite(e)||e<=0)return e;const r=Number.isFinite(E)&&E>1?Math.floor(E):1;return Math.max(1,Math.floor(e/r))}o(perWorkerLimit,"perWorkerLimit"),S(perWorkerLimit,"perWorkerLimit"),t(perWorkerLimit,"perWorkerLimit");function workerCount(e){const E=(e.LENSMCP_GW_WORKERS??"1").trim().toLowerCase();if(E==="auto"||E==="max"||E==="0")return Math.max(1,(0,node_os_1.cpus)().length);const r=Math.floor(Number(E));return Number.isFinite(r)&&r>0?r:1}o(workerCount,"workerCount"),S(workerCount,"workerCount"),t(workerCount,"workerCount");function finalizeUpstreamTls(e){return e.ca&&e.rejectUnauthorized===void 0?(e.rejectUnauthorized=!0,{autoEnabled:!0}):{autoEnabled:!1}}o(finalizeUpstreamTls,"finalizeUpstreamTls"),S(finalizeUpstreamTls,"finalizeUpstreamTls"),t(finalizeUpstreamTls,"finalizeUpstreamTls");function finalizeUpstreamH2(e,E){return e.cert&&e.key?(E.LENSMCP_GW_UPSTREAM_H2!=="0"&&(e.allowH2=!0),!0):!1}o(finalizeUpstreamH2,"finalizeUpstreamH2"),S(finalizeUpstreamH2,"finalizeUpstreamH2"),t(finalizeUpstreamH2,"finalizeUpstreamH2");

package/executors/gateway/prod-gateway.lib.js

@@ -1 +1 @@
-"use strict";var s=Object.defineProperty;var o=(r,t)=>s(r,"name",{value:t,configurable:!0});var a=Object.defineProperty,e=o((r,t)=>a(r,"name",{value:t,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.startProdGateway=void 0;var server_1=require("./prod-runtime/server");Object.defineProperty(exports,"startProdGateway",{enumerable:!0,get:e(function(){return server_1.startProdGateway},"get")});
+"use strict";var u=Object.defineProperty;var n=(r,t)=>u(r,"name",{value:t,configurable:!0});var s=Object.defineProperty,o=n((r,t)=>s(r,"name",{value:t,configurable:!0}),"o"),a=Object.defineProperty,e=o((r,t)=>a(r,"name",{value:t,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.startProdGateway=void 0;var server_1=require("./prod-runtime/server");Object.defineProperty(exports,"startProdGateway",{enumerable:!0,get:e(function(){return server_1.startProdGateway},"get")});

package/executors/gateway/prod-runtime/access-log.js

@@ -1 +1 @@
-"use strict";var g=Object.defineProperty;var u=(t,r)=>g(t,"name",{value:r,configurable:!0});var d=Object.defineProperty,n=u((t,r)=>d(t,"name",{value:r,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.logAccess=void 0;const edge_1=require("./edge"),logAccess=n((t,r,e)=>{const s=t.raw,o=r.statusCode??0,a=(s.headers.host||"").split(":")[0],i=(s.url||"/").split("?")[0],c=(0,edge_1.rawTargetOf)(s),l=Math.round(r.elapsedTime);try{console.log(JSON.stringify({severity:o>=500?"ERROR":o>=400?"WARNING":"INFO",time:new Date().toISOString(),message:`${s.method} ${a}${i} ${o} ${l}ms`,method:s.method,host:a,path:i,status:o,ms:l,...c?{rawPath:c.split("?")[0]}:{},...e?{service:e.route.service,upstream:e.upLabel}:{},...e?.version?{version:e.version}:{},...e?.caller?{caller:e.caller}:{},...s.headers["x-request-id"]?{requestId:String(s.headers["x-request-id"])}:{}}))}catch{}},"logAccess");exports.logAccess=logAccess;
+"use strict";var v=Object.defineProperty;var p=(s,e)=>v(s,"name",{value:e,configurable:!0});var g=Object.defineProperty,u=p((s,e)=>g(s,"name",{value:e,configurable:!0}),"u"),d=Object.defineProperty,n=u((s,e)=>d(s,"name",{value:e,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.logAccess=void 0;const edge_1=require("./edge"),logAccess=n((s,e,r)=>{const t=s.raw,a=e.statusCode??0,o=(t.headers.host||"").split(":")[0],i=(t.url||"/").split("?")[0],c=(0,edge_1.rawTargetOf)(t),l=Math.round(e.elapsedTime);try{console.log(JSON.stringify({severity:a>=500?"ERROR":a>=400?"WARNING":"INFO",time:new Date().toISOString(),message:`${t.method} ${o}${i} ${a} ${l}ms`,method:t.method,host:o,path:i,status:a,ms:l,...c?{rawPath:c.split("?")[0]}:{},...r?{service:r.route.service,upstream:r.upLabel}:{},...r?.version?{version:r.version}:{},...r?.caller?{caller:r.caller}:{},...t.headers["x-request-id"]?{requestId:String(t.headers["x-request-id"])}:{}}))}catch{}},"logAccess");exports.logAccess=logAccess;

package/executors/gateway/prod-runtime/app.js

@@ -1 +1 @@
-"use strict";var x=Object.defineProperty;var h=(c,a)=>x(c,"name",{value:a,configurable:!0});var C=Object.defineProperty,u=h((c,a)=>C(c,"name",{value:a,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createApp=createApp;const tslib_1=require("tslib"),fastify_1=tslib_1.__importDefault(require("fastify")),reply_from_1=tslib_1.__importDefault(require("@fastify/reply-from")),edge_1=require("./edge"),trust_1=require("./trust"),body_stall_1=require("./body-stall"),access_log_1=require("./access-log");function createApp(c){const{rt:a,obs:l,cors:k,hooks:y,handler:v,upgrade:_,reqState:m,spanByReq:g,ctxByReq:T}=c,e=a.opts;return{buildApp:u(async()=>{const b=e.server?.keepAliveTimeout??62e4,s=(0,fastify_1.default)({logger:!1,keepAliveTimeout:b,requestTimeout:e.server?.requestTimeout??0,...e.server?.connectionTimeout!==void 0?{connectionTimeout:e.server.connectionTimeout}:{},...e.trustProxyIp?{trustProxy:Math.max(1,Math.floor(e.trustProxyHops??1))}:{},...e.tls?{https:{key:e.tls.key,cert:e.tls.cert}}:{}});s.server.headersTimeout=e.server?.headersTimeout??6e4,e.server?.connectionsCheckingInterval!==void 0&&(s.server.connectionsCheckingInterval=e.server.connectionsCheckingInterval),e.server?.maxHeadersCount!==void 0&&(s.server.maxHeadersCount=e.server.maxHeadersCount),e.server?.maxConnections!==void 0&&(s.server.maxConnections=e.server.maxConnections),s.removeAllContentTypeParsers(),s.addContentTypeParser("*",(r,t,n)=>n(null,t)),await s.register(reply_from_1.default,{disableRequestLogging:!0,undici:{connections:e.undici?.connections??256,pipelining:e.undici?.pipelining??1,keepAliveTimeout:e.undici?.keepAliveTimeout??6e4,bodyTimeout:e.undici?.bodyTimeout??0,headersTimeout:e.undici?.headersTimeout??6e4,...e.undici?.allowH2?{allowH2:!0}:{},connect:{rejectUnauthorized:e.undici?.rejectUnauthorized??!1,...e.undici?.cert?{cert:e.undici.cert}:{},...e.undici?.key?{key:e.undici.key}:{},...e.undici?.ca?{ca:e.undici.ca}:{}}}}),s.get("/livez",(r,t)=>{t.header("cache-control",edge_1.NO_STORE).type("text/plain").send("ok")}),s.get("/readyz",(r,t)=>{const n=a.table.routes.length>0;t.code(n?200:503).header("cache-control",edge_1.NO_STORE).type("text/plain").send(n?"ready":"no routes loaded")});const f=u(r=>(0,edge_1.tokenMatches)(r.query?.token??(0,edge_1.hdr)(r.raw.headers["x-status-token"]),e.statusToken),"opToken");s.get("/statusz",(r,t)=>{if(!e.statusEndpoint||!e.statusToken){t.code(404).header("cache-control",edge_1.NO_STORE).type("text/plain").send("not found");return}if(!f(r)){t.code(401).header("cache-control",edge_1.NO_STORE).type("text/plain").send("unauthorized");return}t.header("cache-control",edge_1.NO_STORE).type("application/json").send(JSON.stringify({generatedAt:Date.now(),services:l.buildStatusSnapshot(),endpoints:e.healthChecker?.snapshot()??[]}))}),s.get("/metricsz",(r,t)=>{if(!e.metrics||!e.statusToken){t.code(404).header("cache-control",edge_1.NO_STORE).type("text/plain").send("not found");return}if(!f(r)){t.code(401).header("cache-control",edge_1.NO_STORE).type("text/plain").send("unauthorized");return}t.header("cache-control",edge_1.NO_STORE).type("application/json").send(JSON.stringify(e.metrics.snapshot()))});const p=(0,body_stall_1.createBodyStallGuard)(e.server?.bodyStallMs??6e4);return s.addHook("onClose",(r,t)=>{p.stop(),t()}),s.addHook("onRequest",(r,t,n)=>{(0,trust_1.stripTrust)(r.raw),p.arm(r.raw),p.armResponse(t.raw),n()}),s.addHook("onSend",(r,t,n,o)=>{k.applyResponseCors(r,t),o(null,n)}),s.addHook("onResponse",(r,t,n)=>{const o=m.get(r);o&&(l.recordEdge(o.route,Date.now()-o.startedAt,t.statusCode??0,o.caller,o.version),l.finish(o.trace,o.route.service,t.statusCode??0,{upstream:o.upLabel,...o.version?{version:o.version}:{},...o.caller?{caller:o.caller}:{}}),m.delete(r));const d=g.get(r);d&&(e.tracing.end(d,t.statusCode??0,{...o?.upLabel?{"upstream.url":o.upLabel}:{},...o?.version?{"lensmcp.version":o.version}:{}}),g.delete(r)),e.metrics?.recordRequest(t.statusCode??0),a.accessLog&&(0,access_log_1.logAccess)(r,t,o);const i=T.get(r);i&&(i.status=t.statusCode??0,y.has("onResponse")&&y.run("onResponse",i),T.delete(r)),n()}),s.setErrorHandler((r,t,n)=>{const o=r,d=o.message??String(r);l.emit("error",`gateway request error: ${d}`,`gateway-error:${o.code??"exception"}`,{kind:"gateway-request-error",error:d,...o.code?{code:o.code}:{}});const i=typeof o.statusCode=="number"&&o.statusCode>=400&&o.statusCode<600?o.statusCode:500;(0,edge_1.sendError)(n,t.raw,i,i===400?"bad_request":"internal")}),s.setNotFoundHandler((r,t)=>{(0,edge_1.sendError)(t,r.raw,404,"not_found","No gateway route for this hostname.")}),s.all("/",v),s.all("/*",v),s.server.on("upgrade",_),s},"buildApp")}}h(createApp,"createApp"),u(createApp,"createApp");
+"use strict";var q=Object.defineProperty;var y=(i,a)=>q(i,"name",{value:a,configurable:!0});var x=Object.defineProperty,h=y((i,a)=>x(i,"name",{value:a,configurable:!0}),"h"),C=Object.defineProperty,u=h((i,a)=>C(i,"name",{value:a,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createApp=createApp;const tslib_1=require("tslib"),fastify_1=tslib_1.__importDefault(require("fastify")),reply_from_1=tslib_1.__importDefault(require("@fastify/reply-from")),edge_1=require("./edge"),trust_1=require("./trust"),body_stall_1=require("./body-stall"),access_log_1=require("./access-log");function createApp(i){const{rt:a,obs:l,cors:_,hooks:v,handler:m,upgrade:b,reqState:g,spanByReq:f,ctxByReq:T}=i,e=a.opts;return{buildApp:u(async()=>{const O=e.server?.keepAliveTimeout??62e4,n=(0,fastify_1.default)({logger:!1,keepAliveTimeout:O,requestTimeout:e.server?.requestTimeout??0,...e.server?.connectionTimeout!==void 0?{connectionTimeout:e.server.connectionTimeout}:{},...e.trustProxyIp?{trustProxy:Math.max(1,Math.floor(e.trustProxyHops??1))}:{},...e.tls?{https:{key:e.tls.key,cert:e.tls.cert}}:{}});n.server.headersTimeout=e.server?.headersTimeout??6e4,e.server?.connectionsCheckingInterval!==void 0&&(n.server.connectionsCheckingInterval=e.server.connectionsCheckingInterval),e.server?.maxHeadersCount!==void 0&&(n.server.maxHeadersCount=e.server.maxHeadersCount),e.server?.maxConnections!==void 0&&(n.server.maxConnections=e.server.maxConnections),n.removeAllContentTypeParsers(),n.addContentTypeParser("*",(r,t,s)=>s(null,t)),await n.register(reply_from_1.default,{disableRequestLogging:!0,undici:{connections:e.undici?.connections??256,pipelining:e.undici?.pipelining??1,keepAliveTimeout:e.undici?.keepAliveTimeout??6e4,bodyTimeout:e.undici?.bodyTimeout??0,headersTimeout:e.undici?.headersTimeout??6e4,...e.undici?.allowH2?{allowH2:!0}:{},connect:{rejectUnauthorized:e.undici?.rejectUnauthorized??!1,...e.undici?.cert?{cert:e.undici.cert}:{},...e.undici?.key?{key:e.undici.key}:{},...e.undici?.ca?{ca:e.undici.ca}:{}}}}),n.get("/livez",(r,t)=>{t.header("cache-control",edge_1.NO_STORE).type("text/plain").send("ok")}),n.get("/readyz",(r,t)=>{const s=a.table.routes.length>0;t.code(s?200:503).header("cache-control",edge_1.NO_STORE).type("text/plain").send(s?"ready":"no routes loaded")});const k=u(r=>(0,edge_1.tokenMatches)(r.query?.token??(0,edge_1.hdr)(r.raw.headers["x-status-token"]),e.statusToken),"opToken");n.get("/statusz",(r,t)=>{if(!e.statusEndpoint||!e.statusToken){t.code(404).header("cache-control",edge_1.NO_STORE).type("text/plain").send("not found");return}if(!k(r)){t.code(401).header("cache-control",edge_1.NO_STORE).type("text/plain").send("unauthorized");return}t.header("cache-control",edge_1.NO_STORE).type("application/json").send(JSON.stringify({generatedAt:Date.now(),services:l.buildStatusSnapshot(),endpoints:e.healthChecker?.snapshot()??[]}))}),n.get("/metricsz",(r,t)=>{if(!e.metrics||!e.statusToken){t.code(404).header("cache-control",edge_1.NO_STORE).type("text/plain").send("not found");return}if(!k(r)){t.code(401).header("cache-control",edge_1.NO_STORE).type("text/plain").send("unauthorized");return}t.header("cache-control",edge_1.NO_STORE).type("application/json").send(JSON.stringify(e.metrics.snapshot()))});const p=(0,body_stall_1.createBodyStallGuard)(e.server?.bodyStallMs??6e4);return n.addHook("onClose",(r,t)=>{p.stop(),t()}),n.addHook("onRequest",(r,t,s)=>{(0,trust_1.stripTrust)(r.raw),p.arm(r.raw),p.armResponse(t.raw),s()}),n.addHook("onSend",(r,t,s,o)=>{_.applyResponseCors(r,t),o(null,s)}),n.addHook("onResponse",(r,t,s)=>{const o=g.get(r);o&&(l.recordEdge(o.route,Date.now()-o.startedAt,t.statusCode??0,o.caller,o.version),l.finish(o.trace,o.route.service,t.statusCode??0,{upstream:o.upLabel,...o.version?{version:o.version}:{},...o.caller?{caller:o.caller}:{}}),g.delete(r));const d=f.get(r);d&&(e.tracing.end(d,t.statusCode??0,{...o?.upLabel?{"upstream.url":o.upLabel}:{},...o?.version?{"lensmcp.version":o.version}:{}}),f.delete(r)),e.metrics?.recordRequest(t.statusCode??0),a.accessLog&&(0,access_log_1.logAccess)(r,t,o);const c=T.get(r);c&&(c.status=t.statusCode??0,v.has("onResponse")&&v.run("onResponse",c),T.delete(r)),s()}),n.setErrorHandler((r,t,s)=>{const o=r,d=o.message??String(r);l.emit("error",`gateway request error: ${d}`,`gateway-error:${o.code??"exception"}`,{kind:"gateway-request-error",error:d,...o.code?{code:o.code}:{}});const c=typeof o.statusCode=="number"&&o.statusCode>=400&&o.statusCode<600?o.statusCode:500;(0,edge_1.sendError)(s,t.raw,c,c===400?"bad_request":"internal")}),n.setNotFoundHandler((r,t)=>{(0,edge_1.sendError)(t,r.raw,404,"not_found","No gateway route for this hostname.")}),n.all("/",m),n.all("/*",m),n.server.on("upgrade",b),n},"buildApp")}}y(createApp,"createApp"),h(createApp,"createApp"),u(createApp,"createApp");

package/executors/gateway/prod-runtime/auth.js

@@ -1 +1 @@
-"use strict";var f=Object.defineProperty;var l=(i,e)=>f(i,"name",{value:e,configurable:!0});var k=Object.defineProperty,o=l((i,e)=>k(i,"name",{value:e,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createEdgeAuth=createEdgeAuth;const manifest_1=require("../manifest"),trust_1=require("./trust");function createEdgeAuth(i,e,p,c){return{internal:o((r,d,s)=>{const t=r.headers["x-api-key"],u=typeof t=="string"?t:Array.isArray(t)?t[0]:void 0,a=u?i.keyToProject.get(u):void 0;return a?(r.headers["x-api-key-id"]=a,delete r.headers["x-api-key"],e.step(s,"auth",{mode:"x-api-key",ok:!0,caller:a}),{ok:!0,caller:a}):(e.step(s,"auth",{mode:"x-api-key",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Invalid or missing x-api-key for internal route."})},"internal"),public:o((r,d,s,t,u,a)=>{const h=i.table.manifestByService.get(d.service),n=h?(0,manifest_1.authRuleForPath)(h,s,r.method??"GET",!1):{mode:d.auth};if(n.mode==="jwt"){if(i.opts.identify){if(!t)return e.step(a,"auth",{mode:"jwt",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: invalid or missing token"}}else try{c("jwt",r)}catch(m){return e.step(a,"auth",{mode:"jwt",ok:!1,reason:m.message}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: invalid or missing token"}}return n.rule&&(!t||!(0,manifest_1.evalRule)(n.rule,p.buildAttrs(r,u,t,void 0)))?(e.step(a,"authz",{ok:!1}),{ok:!1,status:403,reason:"forbidden",detail:"Forbidden: insufficient permission"}):(e.step(a,"auth",{mode:"jwt",ok:!0}),t&&(0,trust_1.stampIdentity)(r,t),{ok:!0})}return e.step(a,"auth",{mode:n.mode}),{ok:!0}},"publicAuth")}}l(createEdgeAuth,"createEdgeAuth"),o(createEdgeAuth,"createEdgeAuth");
+"use strict";var v=Object.defineProperty;var h=(a,e)=>v(a,"name",{value:e,configurable:!0});var f=Object.defineProperty,l=h((a,e)=>f(a,"name",{value:e,configurable:!0}),"l"),k=Object.defineProperty,o=l((a,e)=>k(a,"name",{value:e,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createEdgeAuth=createEdgeAuth;const manifest_1=require("../manifest"),trust_1=require("./trust");function createEdgeAuth(a,e,p,m){return{internal:o((i,d,n)=>{const t=i.headers["x-api-key"],u=typeof t=="string"?t:Array.isArray(t)?t[0]:void 0,r=u?a.keyToProject.get(u):void 0;return r?(i.headers["x-api-key-id"]=r,delete i.headers["x-api-key"],e.step(n,"auth",{mode:"x-api-key",ok:!0,caller:r}),{ok:!0,caller:r}):(e.step(n,"auth",{mode:"x-api-key",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Invalid or missing x-api-key for internal route."})},"internal"),public:o((i,d,n,t,u,r)=>{const c=a.table.manifestByService.get(d.service),s=c?(0,manifest_1.authRuleForPath)(c,n,i.method??"GET",!1):{mode:d.auth};if(s.mode==="jwt"){if(a.opts.identify){if(!t)return e.step(r,"auth",{mode:"jwt",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: invalid or missing token"}}else try{m("jwt",i)}catch(y){return e.step(r,"auth",{mode:"jwt",ok:!1,reason:y.message}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: invalid or missing token"}}return s.rule&&(!t||!(0,manifest_1.evalRule)(s.rule,p.buildAttrs(i,u,t,void 0)))?(e.step(r,"authz",{ok:!1}),{ok:!1,status:403,reason:"forbidden",detail:"Forbidden: insufficient permission"}):(e.step(r,"auth",{mode:"jwt",ok:!0}),t&&(0,trust_1.stampIdentity)(i,t),{ok:!0})}return e.step(r,"auth",{mode:s.mode}),{ok:!0}},"publicAuth")}}h(createEdgeAuth,"createEdgeAuth"),l(createEdgeAuth,"createEdgeAuth"),o(createEdgeAuth,"createEdgeAuth");

package/executors/gateway/prod-runtime/body-stall.js

@@ -1 +1 @@
-"use strict";var o=Object.defineProperty;var l=(r,t)=>o(r,"name",{value:t,configurable:!0});var a=Object.defineProperty,e=l((r,t)=>a(r,"name",{value:t,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createBodyStallGuard=void 0;var body_stall_1=require("../body-stall");Object.defineProperty(exports,"createBodyStallGuard",{enumerable:!0,get:e(function(){return body_stall_1.createBodyStallGuard},"get")});
+"use strict";var u=Object.defineProperty;var d=(r,t)=>u(r,"name",{value:t,configurable:!0});var o=Object.defineProperty,l=d((r,t)=>o(r,"name",{value:t,configurable:!0}),"l"),a=Object.defineProperty,e=l((r,t)=>a(r,"name",{value:t,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createBodyStallGuard=void 0;var body_stall_1=require("../body-stall");Object.defineProperty(exports,"createBodyStallGuard",{enumerable:!0,get:e(function(){return body_stall_1.createBodyStallGuard},"get")});

package/executors/gateway/prod-runtime/cors.js

@@ -1 +1 @@
-"use strict";var i=Object.defineProperty;var n=(s,a)=>i(s,"name",{value:a,configurable:!0});var c=Object.defineProperty,t=n((s,a)=>c(s,"name",{value:a,configurable:!0}),"t");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createCors=createCors;const addVaryOrigin=t(s=>{const a=s.getHeader("vary"),e=Array.isArray(a)?a.join(", "):typeof a=="string"?a:"";if(e.trim()==="*")return;const o=e.split(",").map(r=>r.trim()).filter(Boolean);o.some(r=>r.toLowerCase()==="origin")||s.header("vary",[...o,"Origin"].join(", "))},"addVaryOrigin");function createCors(s,a){return{setCors:t((e,o)=>{const r=o.headers.origin;if(r&&s.corsCredentialOrigins.has(r.toLowerCase())){e.header("access-control-allow-origin",r),e.header("access-control-allow-credentials","true"),addVaryOrigin(e);return}e.header("access-control-allow-origin",String(r??"*")),addVaryOrigin(e)},"setCors"),applyResponseCors:t((e,o)=>{const r=e.headers.origin;r&&!o.getHeader("access-control-allow-origin")&&(s.corsCredentialOrigins.has(r.toLowerCase())?(o.header("access-control-allow-origin",r),o.header("access-control-allow-credentials","true"),addVaryOrigin(o)):a.get(e)?.proxied||(o.header("access-control-allow-origin",String(r)),addVaryOrigin(o)))},"applyResponseCors")}}n(createCors,"createCors"),t(createCors,"createCors");
+"use strict";var d=Object.defineProperty;var l=(o,e)=>d(o,"name",{value:e,configurable:!0});var i=Object.defineProperty,n=l((o,e)=>i(o,"name",{value:e,configurable:!0}),"n"),c=Object.defineProperty,t=n((o,e)=>c(o,"name",{value:e,configurable:!0}),"t");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createCors=createCors;const addVaryOrigin=t(o=>{const e=o.getHeader("vary"),a=Array.isArray(e)?e.join(", "):typeof e=="string"?e:"";if(a.trim()==="*")return;const s=a.split(",").map(r=>r.trim()).filter(Boolean);s.some(r=>r.toLowerCase()==="origin")||o.header("vary",[...s,"Origin"].join(", "))},"addVaryOrigin");function createCors(o,e){return{setCors:t((a,s)=>{const r=s.headers.origin;if(r&&o.corsCredentialOrigins.has(r.toLowerCase())){a.header("access-control-allow-origin",r),a.header("access-control-allow-credentials","true"),addVaryOrigin(a);return}a.header("access-control-allow-origin",String(r??"*")),addVaryOrigin(a)},"setCors"),applyResponseCors:t((a,s)=>{const r=a.headers.origin;r&&!s.getHeader("access-control-allow-origin")&&(o.corsCredentialOrigins.has(r.toLowerCase())?(s.header("access-control-allow-origin",r),s.header("access-control-allow-credentials","true"),addVaryOrigin(s)):e.get(a)?.proxied||(s.header("access-control-allow-origin",String(r)),addVaryOrigin(s)))},"applyResponseCors")}}l(createCors,"createCors"),n(createCors,"createCors"),t(createCors,"createCors");

package/executors/gateway/prod-runtime/edge.js

@@ -1 +1 @@
-"use strict";var p=Object.defineProperty;var i=(e,r)=>p(e,"name",{value:r,configurable:!0});var c=Object.defineProperty,t=i((e,r)=>c(e,"name",{value:r,configurable:!0}),"t");Object.defineProperty(exports,"__esModule",{value:!0}),exports.safeUrl=exports.rememberRawTarget=exports.rawTargetOf=exports.RAW_TARGET=exports.canonicalPath=exports.canonicalize=exports.ENCODED_STRUCTURE=exports.addVary=exports.tokenMatches=exports.NO_STORE=exports.sendError=exports.hdr=exports.eid=void 0;const node_crypto_1=require("node:crypto"),gateway_errors_1=require("../gateway-errors"),eid=t(()=>Date.now().toString(36)+(0,node_crypto_1.randomBytes)(6).toString("hex"),"eid");exports.eid=eid;const hdr=t(e=>typeof e=="string"&&e!==""?e:Array.isArray(e)?e[0]:void 0,"hdr");exports.hdr=hdr;const sendError=t((e,r,o,n,s)=>{const a=(0,gateway_errors_1.ensureRequestId)(r);return e.code(o).header("x-request-id",a).header("cache-control",exports.NO_STORE).type(gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE).send((0,gateway_errors_1.gatewayErrorBody)(o,n,a,s))},"sendError");exports.sendError=sendError,exports.NO_STORE="no-store";const tokenMatches=t((e,r)=>{if(!r)return!1;const o=Buffer.from(e??""),n=Buffer.from(r);return o.length===n.length&&(0,node_crypto_1.timingSafeEqual)(o,n)},"tokenMatches");exports.tokenMatches=tokenMatches;const addVary=t((e,r)=>{const o=e.vary,n=Array.isArray(o)?o.join(", "):typeof o=="string"?o:"";if(n.trim()==="*")return;const s=n.split(",").map(a=>a.trim()).filter(Boolean);s.some(a=>a.toLowerCase()===r.toLowerCase())||(e.vary=[...s,r].join(", "))},"addVary");exports.addVary=addVary;var canonical_path_1=require("../canonical-path");Object.defineProperty(exports,"ENCODED_STRUCTURE",{enumerable:!0,get:t(function(){return canonical_path_1.ENCODED_STRUCTURE},"get")}),Object.defineProperty(exports,"canonicalize",{enumerable:!0,get:t(function(){return canonical_path_1.canonicalize},"get")}),Object.defineProperty(exports,"canonicalPath",{enumerable:!0,get:t(function(){return canonical_path_1.canonicalPath},"get")}),Object.defineProperty(exports,"RAW_TARGET",{enumerable:!0,get:t(function(){return canonical_path_1.RAW_TARGET},"get")}),Object.defineProperty(exports,"rawTargetOf",{enumerable:!0,get:t(function(){return canonical_path_1.rawTargetOf},"get")}),Object.defineProperty(exports,"rememberRawTarget",{enumerable:!0,get:t(function(){return canonical_path_1.rememberRawTarget},"get")});const safeUrl=t(e=>{if(!e)return"(unset)";try{const r=new URL(e);return`${r.protocol}//${r.host}${r.pathname}`}catch{return"(set)"}},"safeUrl");exports.safeUrl=safeUrl;
+"use strict";var u=Object.defineProperty;var d=(e,r)=>u(e,"name",{value:r,configurable:!0});var p=Object.defineProperty,i=d((e,r)=>p(e,"name",{value:r,configurable:!0}),"i"),c=Object.defineProperty,t=i((e,r)=>c(e,"name",{value:r,configurable:!0}),"t");Object.defineProperty(exports,"__esModule",{value:!0}),exports.safeUrl=exports.rememberRawTarget=exports.rawTargetOf=exports.RAW_TARGET=exports.canonicalPath=exports.canonicalize=exports.ENCODED_STRUCTURE=exports.addVary=exports.tokenMatches=exports.NO_STORE=exports.sendError=exports.hdr=exports.eid=void 0;const node_crypto_1=require("node:crypto"),gateway_errors_1=require("../gateway-errors"),eid=t(()=>Date.now().toString(36)+(0,node_crypto_1.randomBytes)(6).toString("hex"),"eid");exports.eid=eid;const hdr=t(e=>typeof e=="string"&&e!==""?e:Array.isArray(e)?e[0]:void 0,"hdr");exports.hdr=hdr;const sendError=t((e,r,o,n,s)=>{const a=(0,gateway_errors_1.ensureRequestId)(r);return e.code(o).header("x-request-id",a).header("cache-control",exports.NO_STORE).type(gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE).send((0,gateway_errors_1.gatewayErrorBody)(o,n,a,s))},"sendError");exports.sendError=sendError,exports.NO_STORE="no-store";const tokenMatches=t((e,r)=>{if(!r)return!1;const o=Buffer.from(e??""),n=Buffer.from(r);return o.length===n.length&&(0,node_crypto_1.timingSafeEqual)(o,n)},"tokenMatches");exports.tokenMatches=tokenMatches;const addVary=t((e,r)=>{const o=e.vary,n=Array.isArray(o)?o.join(", "):typeof o=="string"?o:"";if(n.trim()==="*")return;const s=n.split(",").map(a=>a.trim()).filter(Boolean);s.some(a=>a.toLowerCase()===r.toLowerCase())||(e.vary=[...s,r].join(", "))},"addVary");exports.addVary=addVary;var canonical_path_1=require("../canonical-path");Object.defineProperty(exports,"ENCODED_STRUCTURE",{enumerable:!0,get:t(function(){return canonical_path_1.ENCODED_STRUCTURE},"get")}),Object.defineProperty(exports,"canonicalize",{enumerable:!0,get:t(function(){return canonical_path_1.canonicalize},"get")}),Object.defineProperty(exports,"canonicalPath",{enumerable:!0,get:t(function(){return canonical_path_1.canonicalPath},"get")}),Object.defineProperty(exports,"RAW_TARGET",{enumerable:!0,get:t(function(){return canonical_path_1.RAW_TARGET},"get")}),Object.defineProperty(exports,"rawTargetOf",{enumerable:!0,get:t(function(){return canonical_path_1.rawTargetOf},"get")}),Object.defineProperty(exports,"rememberRawTarget",{enumerable:!0,get:t(function(){return canonical_path_1.rememberRawTarget},"get")});const safeUrl=t(e=>{if(!e)return"(unset)";try{const r=new URL(e);return`${r.protocol}//${r.host}${r.pathname}`}catch{return"(set)"}},"safeUrl");exports.safeUrl=safeUrl;

package/executors/gateway/prod-runtime/handler.js

@@ -1 +1 @@
-"use strict";var J=Object.defineProperty;var H=(y,n)=>J(y,"name",{value:n,configurable:!0});var G=Object.defineProperty,v=H((y,n)=>G(y,"name",{value:n,configurable:!0}),"v");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHandler=createHandler;const manifest_1=require("../manifest"),gateway_errors_1=require("../gateway-errors"),edge_1=require("./edge");function createHandler(y){const{rt:n,obs:d,cors:_,auth:N,upstream:L,rollout:w,hooks:p,reqState:U,spanByReq:$,ctxByReq:D}=y,M=!!n.opts.pods?.resolveVersion,q=!!n.opts.cookie?.secret,C=!!n.opts.pods?.bucket&&(q||!!n.opts.uidHeader),V=M||q||C,B=n.opts.upstreamRetries??1,F=v(l=>(0,edge_1.tokenMatches)(l.query?.token??(0,edge_1.hdr)(l.raw.headers["x-status-token"]),n.opts.statusToken),"statusTokenMatches"),K=v((l,o,e,f,m)=>{const a=l.raw;if(_.setCors(o,a),o.header("cache-control",edge_1.NO_STORE),a.method==="OPTIONS"){o.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(a.headers["access-control-request-headers"]??"*")).send();return}const s=n.table.routes.filter(i=>i.host&&(0,manifest_1.hostMatches)(i.host,e)&&i.prefix),h=m;if(s.length>0&&(h==="/health"||h==="/healthz")){o.code(200).type("application/json").send(JSON.stringify({status:"ok",host:e,services:s.map(i=>({service:i.service,prefix:i.prefix}))}));return}if(h==="/.well-known/lensmcp-routes"){if(!F(l)){(0,edge_1.sendError)(o,a,404,"not_found","No gateway route for this hostname.");return}o.code(200).type("application/json").send(JSON.stringify({host:e,routes:n.table.routes.filter(i=>!i.host||(0,manifest_1.hostMatches)(i.host,e)).map(i=>({host:i.host??"(default)",service:i.service,prefix:i.prefix,internal:!!i.internal,auth:i.auth}))}));return}(0,edge_1.sendError)(o,a,404,"not_found",s.length>0?`No service mounted at ${f} on ${e}.`:"No gateway route for this hostname.")},"handleNoRoute");return async(l,o)=>{const e=l.raw,f=(e.headers.host||"").split(":")[0],m=e.url??"/",a=d.beginTrace(e);(0,gateway_errors_1.ensureRequestId)(e),d.step(a,"received",{host:f,method:e.method,url:m});const s=p.any?p.httpContext(e,l,o,a):void 0;if(s&&D.set(l,s),s&&p.has("onRequest")&&(await p.run("onRequest",s),s.responded()))return o;if(e.httpVersionMajor<1)return d.finish(a,"gateway",400),(0,edge_1.sendError)(o,e,400,"bad_request","Bad Request");const h=(0,edge_1.canonicalize)(m);if(h===void 0)return d.step(a,"bad-path",{}),d.finish(a,"gateway",400),(0,edge_1.sendError)(o,e,400,"bad_request","Bad Request");const i=h.policy,b=h.path+h.query;b!==m&&(0,edge_1.rememberRawTarget)(e,m),e.url=b;const j=e.socket?.remoteAddress??l.ip,T=w.clientIpOf(e,j);if(n.opts.rateLimiter){const r=await n.opts.rateLimiter.check(T);if(!r.allowed)return o.header("retry-after",String(Math.ceil(r.retryAfterMs/1e3))),d.step(a,"rate-limited",{}),d.finish(a,"gateway",429),(0,edge_1.sendError)(o,e,429,"rate_limited","Too Many Requests")}const t=(0,manifest_1.matchRoute)(n.table.routes,f,i+h.query);if(!t)return K(l,o,f,b,i),o;if(s&&(s.route=t),d.step(a,"route-match",{project:t.service,...t.prefix?{prefix:t.prefix}:{},...t.internal?{internal:!0}:{}}),e.method==="OPTIONS")return _.setCors(o,e),o.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(e.headers["access-control-request-headers"]??"*")).send(),o;const k=n.opts.tracing?.startSpan(e,`gateway ${t.service}`,{"http.request.method":e.method??"GET","url.path":b.split("?")[0],"server.address":f,"lensmcp.service":t.service,...t.internal?{"lensmcp.internal":!0}:{}});if(k&&$.set(l,k),s&&p.has("beforeAuth")&&(await p.run("beforeAuth",s),s.responded()))return o;const O=t.internal?void 0:n.opts.identify?.(e);let S;if(t.internal){const r=N.internal(e,t,a);if(!r.ok)return d.finish(a,t.service,r.status),(0,edge_1.sendError)(o,e,r.status,r.reason,r.detail);S=r.caller,s&&(s.caller=S)}else{const r=N.public(e,t,i,O,T,a);if(!r.ok)return d.finish(a,t.service,r.status),(0,edge_1.sendError)(o,e,r.status,r.reason,r.detail);if(s&&(s.claims=O),s&&p.has("afterAuth")&&(await p.run("afterAuth",s),s.responded()))return o}if(e.headers["x-forwarded-for"]=w.forwardedFor(e,j),e.headers["x-forwarded-proto"]=n.opts.tls?"https":"http",e.headers["x-forwarded-host"]=e.headers.host??f,n.opts.serviceKeys?.[t.service]&&(e.headers["x-internal-token"]=n.opts.serviceKeys[t.service]),t.prependPrefix){const r=e.url??"/",c=t.prependPrefix;r!==c&&!r.startsWith(c+"/")&&(e.url=c+r)}const x=(0,edge_1.hdr)(e.headers[n.versionHeader]);let P=x,R=!1,E;if(V&&!t.internal&&!x){const r=w.resolveStickyKey(e);r.mint&&(E=r.key);const c=M?n.opts.pods.resolveVersion(t.service,w.buildAttrs(e,T,O,r.key)):void 0;if(c)P=c.version,R=!0,d.step(a,"targeting",{rule:c.rule,version:c.version});else if(r.key){const g=n.opts.pods?.bucket?.(t.service,r.key);g&&(P=g.version,R=!0,d.step(a,"targeting",{mode:"sticky",version:g.version}))}}const u=await L.resolveUpstream(t,a,P,R);if(!u)return d.finish(a,t.service,503),(0,edge_1.sendError)(o,e,503,"unavailable",`Service ${t.service} has no available upstream.`);if(!("url"in u))return d.finish(a,t.service,502),(0,edge_1.sendError)(o,e,502,"unavailable",`Service ${t.service}: socket upstreams are not supported by the prod gateway.`);const z=new URL(u.url).origin,A=u.url,I={route:t,caller:S,startedAt:Date.now(),trace:a,version:u.version,upLabel:A};return U.set(l,I),s&&(s.version=u.version),d.step(a,u.version?"rollout":"upstream",{upstream:A,...u.version?{version:u.version,...x?{pinned:!0}:{}}:{}}),k&&n.opts.tracing.inject(k,e.headers),s&&p.has("beforeForward")&&(await p.run("beforeForward",s),s.responded())?o:o.from(void 0,{getUpstream:v(()=>z,"getUpstream"),retriesCount:B,rewriteHeaders:v(r=>{if(I.proxied=!0,a&&(r["x-lensmcp-upstream"]=A),r["x-request-id"]||(r["x-request-id"]=(0,gateway_errors_1.ensureRequestId)(e)),u.version&&(r["x-lensmcp-version"]=u.version),(x||u.version)&&(0,edge_1.addVary)(r,n.versionHeader),(E||C&&q)&&(0,edge_1.addVary)(r,"Cookie"),delete r["x-powered-by"],delete r.connection,delete r["keep-alive"],delete r["proxy-connection"],r.server="LensMCP",E){const c=r["set-cookie"],g=Array.isArray(c)?c:c?[c]:[];r["set-cookie"]=[...g,w.mintCookieHeader(E)]}return r},"rewriteHeaders"),onError:v((r,{error:c})=>{n.opts.pods?.drop?.(t.service,u),s&&p.has("onError")&&(s.error=c,p.run("onError",s)),(0,edge_1.sendError)(r,e,502,"unavailable",`Upstream ${t.service} unavailable.`)},"onError")})}}H(createHandler,"createHandler"),v(createHandler,"createHandler");
+"use strict";var X=Object.defineProperty;var N=(f,o)=>X(f,"name",{value:o,configurable:!0});var W=Object.defineProperty,_=N((f,o)=>W(f,"name",{value:o,configurable:!0}),"_"),z=Object.defineProperty,v=_((f,o)=>z(f,"name",{value:o,configurable:!0}),"v");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHandler=createHandler;const manifest_1=require("../manifest"),gateway_errors_1=require("../gateway-errors"),edge_1=require("./edge");function createHandler(f){const{rt:o,obs:d,cors:M,auth:C,upstream:$,rollout:w,hooks:p,reqState:D,spanByReq:V,ctxByReq:B}=f,j=!!o.opts.pods?.resolveVersion,q=!!o.opts.cookie?.secret,I=!!o.opts.pods?.bucket&&(q||!!o.opts.uidHeader),F=j||q||I,G=o.opts.upstreamRetries??1,K=v(u=>(0,edge_1.tokenMatches)(u.query?.token??(0,edge_1.hdr)(u.raw.headers["x-status-token"]),o.opts.statusToken),"statusTokenMatches"),J=v((u,a,e,m,y)=>{const n=u.raw;if(M.setCors(a,n),a.header("cache-control",edge_1.NO_STORE),n.method==="OPTIONS"){a.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(n.headers["access-control-request-headers"]??"*")).send();return}const s=o.table.routes.filter(i=>i.host&&(0,manifest_1.hostMatches)(i.host,e)&&i.prefix),h=y;if(s.length>0&&(h==="/health"||h==="/healthz")){a.code(200).type("application/json").send(JSON.stringify({status:"ok",host:e,services:s.map(i=>({service:i.service,prefix:i.prefix}))}));return}if(h==="/.well-known/lensmcp-routes"){if(!K(u)){(0,edge_1.sendError)(a,n,404,"not_found","No gateway route for this hostname.");return}a.code(200).type("application/json").send(JSON.stringify({host:e,routes:o.table.routes.filter(i=>!i.host||(0,manifest_1.hostMatches)(i.host,e)).map(i=>({host:i.host??"(default)",service:i.service,prefix:i.prefix,internal:!!i.internal,auth:i.auth}))}));return}(0,edge_1.sendError)(a,n,404,"not_found",s.length>0?`No service mounted at ${m} on ${e}.`:"No gateway route for this hostname.")},"handleNoRoute");return async(u,a)=>{const e=u.raw,m=(e.headers.host||"").split(":")[0],y=e.url??"/",n=d.beginTrace(e);(0,gateway_errors_1.ensureRequestId)(e),d.step(n,"received",{host:m,method:e.method,url:y});const s=p.any?p.httpContext(e,u,a,n):void 0;if(s&&B.set(u,s),s&&p.has("onRequest")&&(await p.run("onRequest",s),s.responded()))return a;if(e.httpVersionMajor<1)return d.finish(n,"gateway",400),(0,edge_1.sendError)(a,e,400,"bad_request","Bad Request");const h=(0,edge_1.canonicalize)(y);if(h===void 0)return d.step(n,"bad-path",{}),d.finish(n,"gateway",400),(0,edge_1.sendError)(a,e,400,"bad_request","Bad Request");const i=h.policy,b=h.path+h.query;b!==y&&(0,edge_1.rememberRawTarget)(e,y),e.url=b;const L=e.socket?.remoteAddress??u.ip,T=w.clientIpOf(e,L);if(o.opts.rateLimiter){const r=await o.opts.rateLimiter.check(T);if(!r.allowed)return a.header("retry-after",String(Math.ceil(r.retryAfterMs/1e3))),d.step(n,"rate-limited",{}),d.finish(n,"gateway",429),(0,edge_1.sendError)(a,e,429,"rate_limited","Too Many Requests")}const t=(0,manifest_1.matchRoute)(o.table.routes,m,i+h.query);if(!t)return J(u,a,m,b,i),a;if(s&&(s.route=t),d.step(n,"route-match",{project:t.service,...t.prefix?{prefix:t.prefix}:{},...t.internal?{internal:!0}:{}}),e.method==="OPTIONS")return M.setCors(a,e),a.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(e.headers["access-control-request-headers"]??"*")).send(),a;const k=o.opts.tracing?.startSpan(e,`gateway ${t.service}`,{"http.request.method":e.method??"GET","url.path":b.split("?")[0],"server.address":m,"lensmcp.service":t.service,...t.internal?{"lensmcp.internal":!0}:{}});if(k&&V.set(u,k),s&&p.has("beforeAuth")&&(await p.run("beforeAuth",s),s.responded()))return a;const O=t.internal?void 0:o.opts.identify?.(e),P=O instanceof Promise?await O:O;let S;if(t.internal){const r=C.internal(e,t,n);if(!r.ok)return d.finish(n,t.service,r.status),(0,edge_1.sendError)(a,e,r.status,r.reason,r.detail);S=r.caller,s&&(s.caller=S)}else{const r=C.public(e,t,i,P,T,n);if(!r.ok)return d.finish(n,t.service,r.status),(0,edge_1.sendError)(a,e,r.status,r.reason,r.detail);if(s&&(s.claims=P),s&&p.has("afterAuth")&&(await p.run("afterAuth",s),s.responded()))return a}if(e.headers["x-forwarded-for"]=w.forwardedFor(e,L),e.headers["x-forwarded-proto"]=o.opts.tls?"https":"http",e.headers["x-forwarded-host"]=e.headers.host??m,o.opts.serviceKeys?.[t.service]&&(e.headers["x-internal-token"]=o.opts.serviceKeys[t.service]),t.prependPrefix){const r=e.url??"/",c=t.prependPrefix;r!==c&&!r.startsWith(c+"/")&&(e.url=c+r)}const x=(0,edge_1.hdr)(e.headers[o.versionHeader]);let R=x,A=!1,E;if(F&&!t.internal&&!x){const r=w.resolveStickyKey(e);r.mint&&(E=r.key);const c=j?o.opts.pods.resolveVersion(t.service,w.buildAttrs(e,T,P,r.key)):void 0;if(c)R=c.version,A=!0,d.step(n,"targeting",{rule:c.rule,version:c.version});else if(r.key){const g=o.opts.pods?.bucket?.(t.service,r.key);g&&(R=g.version,A=!0,d.step(n,"targeting",{mode:"sticky",version:g.version}))}}const l=await $.resolveUpstream(t,n,R,A);if(!l)return d.finish(n,t.service,503),(0,edge_1.sendError)(a,e,503,"unavailable",`Service ${t.service} has no available upstream.`);if(!("url"in l))return d.finish(n,t.service,502),(0,edge_1.sendError)(a,e,502,"unavailable",`Service ${t.service}: socket upstreams are not supported by the prod gateway.`);const Q=new URL(l.url).origin,H=l.url,U={route:t,caller:S,startedAt:Date.now(),trace:n,version:l.version,upLabel:H};return D.set(u,U),s&&(s.version=l.version),d.step(n,l.version?"rollout":"upstream",{upstream:H,...l.version?{version:l.version,...x?{pinned:!0}:{}}:{}}),k&&o.opts.tracing.inject(k,e.headers),s&&p.has("beforeForward")&&(await p.run("beforeForward",s),s.responded())?a:a.from(void 0,{getUpstream:v(()=>Q,"getUpstream"),retriesCount:G,rewriteHeaders:v(r=>{if(U.proxied=!0,n&&(r["x-lensmcp-upstream"]=H),r["x-request-id"]||(r["x-request-id"]=(0,gateway_errors_1.ensureRequestId)(e)),l.version&&(r["x-lensmcp-version"]=l.version),(x||l.version)&&(0,edge_1.addVary)(r,o.versionHeader),(E||I&&q)&&(0,edge_1.addVary)(r,"Cookie"),delete r["x-powered-by"],delete r.connection,delete r["keep-alive"],delete r["proxy-connection"],r.server="LensMCP",E){const c=r["set-cookie"],g=Array.isArray(c)?c:c?[c]:[];r["set-cookie"]=[...g,w.mintCookieHeader(E)]}return r},"rewriteHeaders"),onError:v((r,{error:c})=>{o.opts.pods?.drop?.(t.service,l),s&&p.has("onError")&&(s.error=c,p.run("onError",s)),(0,edge_1.sendError)(r,e,502,"unavailable",`Upstream ${t.service} unavailable.`)},"onError")})}}N(createHandler,"createHandler"),_(createHandler,"createHandler"),v(createHandler,"createHandler");

package/executors/gateway/prod-runtime/hooks.js

@@ -1 +1 @@
-"use strict";var f=Object.defineProperty;var i=(t,d)=>f(t,"name",{value:d,configurable:!0});var l=Object.defineProperty,n=i((t,d)=>l(t,"name",{value:d,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHooks=createHooks;const edge_1=require("./edge"),TERMINAL_PHASES=new Set(["onResponse","onError"]);function createHooks(t){const d=n(async(e,o)=>{const r=t[e];if(!r||r.length===0)return;const s=TERMINAL_PHASES.has(e);for(const a of r){if(!s&&o.responded())return;await a(o)}},"run"),u=n(e=>(t[e]?.length??0)>0,"has");return{any:["onRequest","beforeAuth","afterAuth","beforeForward","onResponse","onError","onUpgrade"].some(e=>u(e)),run:d,has:u,httpContext:n((e,o,r,s)=>{let a=!1;return{req:e,request:o,reply:r,socket:void 0,trace:s,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n((c,v,p)=>{(0,edge_1.sendError)(r,e,c,v,p),a=!0},"sendError"),responded:n(()=>a||r.raw.writableEnded,"responded")}},"httpContext"),upgradeContext:n((e,o,r)=>{let s=!1;return{req:e,request:void 0,reply:void 0,socket:o,trace:r,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n(()=>{try{o.destroy()}catch{}s=!0},"sendError"),responded:n(()=>s||o.destroyed,"responded")}},"upgradeContext")}}i(createHooks,"createHooks"),n(createHooks,"createHooks");
+"use strict";var y=Object.defineProperty;var u=(o,s)=>y(o,"name",{value:s,configurable:!0});var f=Object.defineProperty,i=u((o,s)=>f(o,"name",{value:s,configurable:!0}),"i"),l=Object.defineProperty,n=i((o,s)=>l(o,"name",{value:s,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHooks=createHooks;const edge_1=require("./edge"),TERMINAL_PHASES=new Set(["onResponse","onError"]);function createHooks(o){const s=n(async(e,t)=>{const r=o[e];if(!r||r.length===0)return;const d=TERMINAL_PHASES.has(e);for(const a of r){if(!d&&t.responded())return;await a(t)}},"run"),c=n(e=>(o[e]?.length??0)>0,"has");return{any:["onRequest","beforeAuth","afterAuth","beforeForward","onResponse","onError","onUpgrade"].some(e=>c(e)),run:s,has:c,httpContext:n((e,t,r,d)=>{let a=!1;return{req:e,request:t,reply:r,socket:void 0,trace:d,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n((v,p,h)=>{(0,edge_1.sendError)(r,e,v,p,h),a=!0},"sendError"),responded:n(()=>a||r.raw.writableEnded,"responded")}},"httpContext"),upgradeContext:n((e,t,r)=>{let d=!1;return{req:e,request:void 0,reply:void 0,socket:t,trace:r,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n(()=>{try{t.destroy()}catch{}d=!0},"sendError"),responded:n(()=>d||t.destroyed,"responded")}},"upgradeContext")}}u(createHooks,"createHooks"),i(createHooks,"createHooks"),n(createHooks,"createHooks");

package/executors/gateway/prod-runtime/observability.js

@@ -1 +1 @@
-"use strict";var b=Object.defineProperty;var p=(o,d)=>b(o,"name",{value:d,configurable:!0});var y=Object.defineProperty,c=p((o,d)=>y(o,"name",{value:d,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createObservability=createObservability;const redact_1=require("@lensmcp/core/redact"),edge_1=require("./edge");function createObservability(o,d){const v=c((e,t,s,r,a)=>{if(o.emit)try{o.emit({id:(0,edge_1.eid)(),sessionId:"pending",timestamp:Date.now(),source:"gateway",category:"cluster",severity:e,context:(0,redact_1.redactDeep)({sessionId:"pending",...a}),fingerprint:s,title:(0,redact_1.safeTitle)(t),raw:r&&(0,redact_1.redactDeep)(r)})}catch{}},"emit"),h=new Map,q=c((e,t,s,r,a)=>{const n=e.host??"(default)",u=(r?r+"\u21D2":"")+n+"\u2192"+e.service+(a?"@"+a:""),i=h.get(u)??{host:n,service:e.service,caller:r,version:a,count:0,totalMs:0,errors:0};i.count+=1,i.totalMs+=t,(s>=500||s===0)&&(i.errors+=1),h.set(u,i)},"recordEdge"),m=Math.max(1,o.statusWindows??12),f=[],w=new Map,M=c(()=>[...new Set(d().map(e=>e.service))],"routeServices"),S=c(()=>{const e=new Map;for(const s of h.values()){const r=e.get(s.service)??{requests:0,errors:0,totalMs:0,versions:new Set};r.requests+=s.count,r.errors+=s.errors,r.totalMs+=s.totalMs,s.version&&r.versions.add(s.version),e.set(s.service,r)}const t=Date.now();for(const[s,r]of e)r.requests>0&&w.set(s,t);for(f.push(e);f.length>m;)f.shift()},"pushStatusWindow"),g=c(()=>{const e=new Map;for(const s of f)for(const[r,a]of s){const n=e.get(r)??{requests:0,errors:0,totalMs:0,versions:new Set};n.requests+=a.requests,n.errors+=a.errors,n.totalMs+=a.totalMs;for(const u of a.versions)n.versions.add(u);e.set(r,n)}const t=d();return M().map(s=>{const r=e.get(s)??{requests:0,errors:0,totalMs:0,versions:new Set},a=[...new Set(t.filter(i=>i.service===s).map(i=>i.host??"(default)"))],n=r.requests?r.errors/r.requests:0;let u=r.requests===0?"idle":n>=.5?"down":n>=.05?"degraded":"healthy";if(o.healthChecker){const i=t.filter(l=>l.service===s&&l.upstream).map(l=>l.upstream);i.length&&i.every(l=>!o.healthChecker.isHealthy(l))&&(u="down")}return{service:s,hosts:a,status:u,requests:r.requests,errorRate:+n.toFixed(4),avgMs:r.requests?Math.round(r.totalMs/r.requests):0,versions:[...r.versions],lastSeen:w.get(s)??null}})},"buildStatusSnapshot");return{emit:v,beginTrace:c(e=>{if(!o.emit)return;const t=(0,edge_1.hdr)(e.headers["x-lensmcp-flow-id"]);let s=(0,edge_1.hdr)(e.headers["x-request-id"]);if(!(!t&&!s&&!(0,edge_1.hdr)(e.headers.traceparent)))return s||(s=(0,edge_1.eid)(),e.headers["x-request-id"]=s),{startedAt:Date.now(),method:(e.method??"GET").toUpperCase(),host:(e.headers.host||"").split(":")[0],url:e.url??"/",steps:[],...t?{flowId:t}:{},...s?{requestId:s}:{}}},"beginTrace"),step:c((e,t,s)=>{e&&e.steps.push({step:t,atMs:Date.now()-e.startedAt,...s})},"step"),finish:c((e,t,s,r)=>{!e||e.done||(e.done=!0,v(s>=500?"error":"info",`gateway ${e.method} ${e.host}${e.url} \u2192 ${s} (${Date.now()-e.startedAt}ms)`,`gateway-request:${t}`,{kind:"gateway-request",project:t,host:e.host,method:e.method,url:e.url,status:s,durationMs:Date.now()-e.startedAt,startedAt:e.startedAt,steps:e.steps,...r},{...e.flowId?{flowId:e.flowId}:{},...e.requestId?{requestId:e.requestId}:{}}))},"finish"),recordEdge:q,buildStatusSnapshot:g,startFlusher:c(()=>{const e=setInterval(()=>{if(S(),o.onStatus)try{o.onStatus(g())}catch{}if(o.emit)for(const t of h.values())v(t.errors?"warning":"info",`traffic ${t.host} \u2192 ${t.service}${t.version?"@"+t.version:""}: ${t.count} req`,`gateway-traffic:${t.host}->${t.service}${t.version?"@"+t.version:""}`,{kind:"gateway-traffic",host:t.host,project:t.service,caller:t.caller,version:t.version,count:t.count,avgMs:Math.round(t.totalMs/t.count),errors:t.errors});h.clear()},o.trafficFlushMs??5e3);return e.unref?.(),e},"startFlusher")}}p(createObservability,"createObservability"),c(createObservability,"createObservability");
+"use strict";var I=Object.defineProperty;var w=(o,u)=>I(o,"name",{value:u,configurable:!0});var b=Object.defineProperty,p=w((o,u)=>b(o,"name",{value:u,configurable:!0}),"p"),y=Object.defineProperty,c=p((o,u)=>y(o,"name",{value:u,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createObservability=createObservability;const redact_1=require("@lensmcp/core/redact"),edge_1=require("./edge");function createObservability(o,u){const v=c((e,t,s,r,a)=>{if(o.emit)try{o.emit({id:(0,edge_1.eid)(),sessionId:"pending",timestamp:Date.now(),source:"gateway",category:"cluster",severity:e,context:(0,redact_1.redactDeep)({sessionId:"pending",...a}),fingerprint:s,title:(0,redact_1.safeTitle)(t),raw:r&&(0,redact_1.redactDeep)(r)})}catch{}},"emit"),h=new Map,q=c((e,t,s,r,a)=>{const n=e.host??"(default)",d=(r?r+"\u21D2":"")+n+"\u2192"+e.service+(a?"@"+a:""),i=h.get(d)??{host:n,service:e.service,caller:r,version:a,count:0,totalMs:0,errors:0};i.count+=1,i.totalMs+=t,(s>=500||s===0)&&(i.errors+=1),h.set(d,i)},"recordEdge"),M=Math.max(1,o.statusWindows??12),f=[],g=new Map,S=c(()=>[...new Set(u().map(e=>e.service))],"routeServices"),$=c(()=>{const e=new Map;for(const s of h.values()){const r=e.get(s.service)??{requests:0,errors:0,totalMs:0,versions:new Set};r.requests+=s.count,r.errors+=s.errors,r.totalMs+=s.totalMs,s.version&&r.versions.add(s.version),e.set(s.service,r)}const t=Date.now();for(const[s,r]of e)r.requests>0&&g.set(s,t);for(f.push(e);f.length>M;)f.shift()},"pushStatusWindow"),m=c(()=>{const e=new Map;for(const s of f)for(const[r,a]of s){const n=e.get(r)??{requests:0,errors:0,totalMs:0,versions:new Set};n.requests+=a.requests,n.errors+=a.errors,n.totalMs+=a.totalMs;for(const d of a.versions)n.versions.add(d);e.set(r,n)}const t=u();return S().map(s=>{const r=e.get(s)??{requests:0,errors:0,totalMs:0,versions:new Set},a=[...new Set(t.filter(i=>i.service===s).map(i=>i.host??"(default)"))],n=r.requests?r.errors/r.requests:0;let d=r.requests===0?"idle":n>=.5?"down":n>=.05?"degraded":"healthy";if(o.healthChecker){const i=t.filter(l=>l.service===s&&l.upstream).map(l=>l.upstream);i.length&&i.every(l=>!o.healthChecker.isHealthy(l))&&(d="down")}return{service:s,hosts:a,status:d,requests:r.requests,errorRate:+n.toFixed(4),avgMs:r.requests?Math.round(r.totalMs/r.requests):0,versions:[...r.versions],lastSeen:g.get(s)??null}})},"buildStatusSnapshot");return{emit:v,beginTrace:c(e=>{if(!o.emit)return;const t=(0,edge_1.hdr)(e.headers["x-lensmcp-flow-id"]);let s=(0,edge_1.hdr)(e.headers["x-request-id"]);if(!(!t&&!s&&!(0,edge_1.hdr)(e.headers.traceparent)))return s||(s=(0,edge_1.eid)(),e.headers["x-request-id"]=s),{startedAt:Date.now(),method:(e.method??"GET").toUpperCase(),host:(e.headers.host||"").split(":")[0],url:e.url??"/",steps:[],...t?{flowId:t}:{},...s?{requestId:s}:{}}},"beginTrace"),step:c((e,t,s)=>{e&&e.steps.push({step:t,atMs:Date.now()-e.startedAt,...s})},"step"),finish:c((e,t,s,r)=>{!e||e.done||(e.done=!0,v(s>=500?"error":"info",`gateway ${e.method} ${e.host}${e.url} \u2192 ${s} (${Date.now()-e.startedAt}ms)`,`gateway-request:${t}`,{kind:"gateway-request",project:t,host:e.host,method:e.method,url:e.url,status:s,durationMs:Date.now()-e.startedAt,startedAt:e.startedAt,steps:e.steps,...r},{...e.flowId?{flowId:e.flowId}:{},...e.requestId?{requestId:e.requestId}:{}}))},"finish"),recordEdge:q,buildStatusSnapshot:m,startFlusher:c(()=>{const e=setInterval(()=>{if($(),o.onStatus)try{o.onStatus(m())}catch{}if(o.emit)for(const t of h.values())v(t.errors?"warning":"info",`traffic ${t.host} \u2192 ${t.service}${t.version?"@"+t.version:""}: ${t.count} req`,`gateway-traffic:${t.host}->${t.service}${t.version?"@"+t.version:""}`,{kind:"gateway-traffic",host:t.host,project:t.service,caller:t.caller,version:t.version,count:t.count,avgMs:Math.round(t.totalMs/t.count),errors:t.errors});h.clear()},o.trafficFlushMs??5e3);return e.unref?.(),e},"startFlusher")}}w(createObservability,"createObservability"),p(createObservability,"createObservability"),c(createObservability,"createObservability");

package/executors/gateway/prod-runtime/rollout.js

@@ -1 +1 @@
-"use strict";var b=Object.defineProperty;var d=(o,s)=>b(o,"name",{value:s,configurable:!0});var H=Object.defineProperty,c=d((o,s)=>H(o,"name",{value:s,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRollout=createRollout;const node_crypto_1=require("node:crypto"),client_ip_1=require("../client-ip"),edge_1=require("./edge");function createRollout(o){const s=(0,client_ip_1.createClientIpResolver)({...o.clientIpHeader?{clientIpHeader:o.clientIpHeader}:{},...o.clientIpTrustedProxies?{clientIpTrustedProxies:o.clientIpTrustedProxies}:{},trustProxyHops:o.trustProxyIp?Math.max(1,Math.floor(o.trustProxyHops??1)):0}),h=s.clientIpOf,I=s.forwardedFor,g=(o.attributeHeaders??[]).map(e=>e.toLowerCase()),l=o.uidHeader?.toLowerCase(),a=o.cookie?.secret,u=!!o.cookie&&!!a,p=o.cookie?.name??"lensmcp_did",f=o.cookie?.domain,x=o.cookie?.maxAge??31536e3;o.cookie&&!a&&console.warn("[gateway] device cookie has NO secret \u2014 sticky cookie bucketing is DISABLED (set cookie.secret / LENSMCP_GW_COOKIE_SECRET to enable it). An unsigned cookie is attacker-choosable.");const m=c(e=>(0,node_crypto_1.createHmac)("sha256",a).update(e).digest("base64url"),"signId"),C=c(e=>`${e}.${m(e)}`,"signedCookie"),v=c(e=>{if(!a)return;const r=e.lastIndexOf(".");if(r<0)return;const t=e.slice(0,r),n=Buffer.from(e.slice(r+1)),i=Buffer.from(m(t));return n.length===i.length&&(0,node_crypto_1.timingSafeEqual)(n,i)?t:void 0},"verifyCookie"),_=c((e,r)=>{if(e)for(const t of e.split(";")){const n=t.indexOf("=");if(n>0&&t.slice(0,n).trim()===r){const i=t.slice(n+1).trim();try{return decodeURIComponent(i)}catch{return}}}},"parseCookie");return{clientIpOf:h,forwardedFor:I,buildAttrs:c((e,r,t,n)=>{const i={...t??{}};i.ip=r,i.method=(e.method??"GET").toUpperCase(),i.path=(e.url??"/").split("?")[0],n&&(i.device=n);for(const k of g){const y=(0,edge_1.hdr)(e.headers[k]);y!==void 0&&(i["header."+k]=y)}return i},"buildAttrs"),resolveStickyKey:c(e=>{if(u){const r=_(e.headers.cookie,p),t=r?v(r):void 0;if(t)return{key:t,mint:!1}}if(l){const r=(0,edge_1.hdr)(e.headers[l]);if(r)return{key:r,mint:!1}}return u?{key:"d_"+(0,node_crypto_1.randomBytes)(12).toString("base64url"),mint:!0}:{mint:!1}},"resolveStickyKey"),mintCookieHeader:c(e=>{let r=`${p}=${encodeURIComponent(C(e))}; Path=/; Max-Age=${x}; HttpOnly; SameSite=Lax; Secure`;return f&&(r+=`; Domain=${f}`),r},"mintCookieHeader")}}d(createRollout,"createRollout"),c(createRollout,"createRollout");
+"use strict";var P=Object.defineProperty;var l=(t,s)=>P(t,"name",{value:s,configurable:!0});var b=Object.defineProperty,d=l((t,s)=>b(t,"name",{value:s,configurable:!0}),"d"),H=Object.defineProperty,c=d((t,s)=>H(t,"name",{value:s,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRollout=createRollout;const node_crypto_1=require("node:crypto"),client_ip_1=require("../client-ip"),edge_1=require("./edge");function createRollout(t){const s=(0,client_ip_1.createClientIpResolver)({...t.clientIpHeader?{clientIpHeader:t.clientIpHeader}:{},...t.clientIpTrustedProxies?{clientIpTrustedProxies:t.clientIpTrustedProxies}:{},trustProxyHops:t.trustProxyIp?Math.max(1,Math.floor(t.trustProxyHops??1)):0}),g=s.clientIpOf,I=s.forwardedFor,v=(t.attributeHeaders??[]).map(e=>e.toLowerCase()),u=t.uidHeader?.toLowerCase(),a=t.cookie?.secret,p=!!t.cookie&&!!a,f=t.cookie?.name??"lensmcp_did",m=t.cookie?.domain,x=t.cookie?.maxAge??31536e3;t.cookie&&!a&&console.warn("[gateway] device cookie has NO secret \u2014 sticky cookie bucketing is DISABLED (set cookie.secret / LENSMCP_GW_COOKIE_SECRET to enable it). An unsigned cookie is attacker-choosable.");const k=c(e=>(0,node_crypto_1.createHmac)("sha256",a).update(e).digest("base64url"),"signId"),C=c(e=>`${e}.${k(e)}`,"signedCookie"),_=c(e=>{if(!a)return;const r=e.lastIndexOf(".");if(r<0)return;const o=e.slice(0,r),n=Buffer.from(e.slice(r+1)),i=Buffer.from(k(o));return n.length===i.length&&(0,node_crypto_1.timingSafeEqual)(n,i)?o:void 0},"verifyCookie"),O=c((e,r)=>{if(e)for(const o of e.split(";")){const n=o.indexOf("=");if(n>0&&o.slice(0,n).trim()===r){const i=o.slice(n+1).trim();try{return decodeURIComponent(i)}catch{return}}}},"parseCookie");return{clientIpOf:g,forwardedFor:I,buildAttrs:c((e,r,o,n)=>{const i={...o??{}};i.ip=r,i.method=(e.method??"GET").toUpperCase(),i.path=(e.url??"/").split("?")[0],n&&(i.device=n);for(const y of v){const h=(0,edge_1.hdr)(e.headers[y]);h!==void 0&&(i["header."+y]=h)}return i},"buildAttrs"),resolveStickyKey:c(e=>{if(p){const r=O(e.headers.cookie,f),o=r?_(r):void 0;if(o)return{key:o,mint:!1}}if(u){const r=(0,edge_1.hdr)(e.headers[u]);if(r)return{key:r,mint:!1}}return p?{key:"d_"+(0,node_crypto_1.randomBytes)(12).toString("base64url"),mint:!0}:{mint:!1}},"resolveStickyKey"),mintCookieHeader:c(e=>{let r=`${f}=${encodeURIComponent(C(e))}; Path=/; Max-Age=${x}; HttpOnly; SameSite=Lax; Secure`;return m&&(r+=`; Domain=${m}`),r},"mintCookieHeader")}}l(createRollout,"createRollout"),d(createRollout,"createRollout"),c(createRollout,"createRollout");

package/executors/gateway/prod-runtime/routing.js

@@ -1 +1 @@
-"use strict";var m=Object.defineProperty;var i=(a,n)=>m(a,"name",{value:n,configurable:!0});var d=Object.defineProperty,r=i((a,n)=>d(a,"name",{value:n,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRouteTable=createRouteTable;const manifest_1=require("../manifest");function createRouteTable(a,n){const s=[],c=new Map;let o=a.manifests.list();const u=r(e=>{o=e;const t=(0,manifest_1.buildRouteTable)(e);s.length=0,s.push(...t),c.clear();for(const p of e)c.set(p.service,p)},"apply"),l=r(()=>{if(!a.healthChecker)return;const e=new Set;for(const t of s)t.upstream&&e.add(t.upstream);for(const t of a.pods?.endpoints?.()??[])e.add(t);a.healthChecker.track([...e])},"trackUpstreams"),f=r(e=>{u(e),l(),n.emit("info",`gateway routes: ${s.length} on ${o.length} services`,"gateway-up",{kind:"gateway-up",routes:s.map(t=>({host:t.host??"(default)",service:t.service,internal:!!t.internal}))})},"rebuild");u(o);const h=a.manifests.watch?.(e=>f(e));return{routes:s,manifestByService:c,rebuild:f,trackUpstreams:l,manifests:r(()=>o,"manifests"),stop:r(()=>h?.(),"stop")}}i(createRouteTable,"createRouteTable"),r(createRouteTable,"createRouteTable");
+"use strict";var v=Object.defineProperty;var u=(e,a)=>v(e,"name",{value:a,configurable:!0});var m=Object.defineProperty,i=u((e,a)=>m(e,"name",{value:a,configurable:!0}),"i"),d=Object.defineProperty,r=i((e,a)=>d(e,"name",{value:a,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRouteTable=createRouteTable;const manifest_1=require("../manifest");function createRouteTable(e,a){const n=[],c=new Map;let o=e.manifests.list();const l=r(t=>{o=t;const s=(0,manifest_1.buildRouteTable)(t);n.length=0,n.push(...s),c.clear();for(const h of t)c.set(h.service,h)},"apply"),f=r(()=>{if(!e.healthChecker)return;const t=new Set;for(const s of n)s.upstream&&t.add(s.upstream);for(const s of e.pods?.endpoints?.()??[])t.add(s);e.healthChecker.track([...t])},"trackUpstreams"),p=r(t=>{l(t),f(),a.emit("info",`gateway routes: ${n.length} on ${o.length} services`,"gateway-up",{kind:"gateway-up",routes:n.map(s=>({host:s.host??"(default)",service:s.service,internal:!!s.internal}))})},"rebuild");l(o);const b=e.manifests.watch?.(t=>p(t));return{routes:n,manifestByService:c,rebuild:p,trackUpstreams:f,manifests:r(()=>o,"manifests"),stop:r(()=>b?.(),"stop")}}u(createRouteTable,"createRouteTable"),i(createRouteTable,"createRouteTable"),r(createRouteTable,"createRouteTable");

package/executors/gateway/prod-runtime/server.js

@@ -1 +1 @@
-"use strict";var A=Object.defineProperty;var h=(e,a)=>A(e,"name",{value:a,configurable:!0});var R=Object.defineProperty,n=h((e,a)=>R(e,"name",{value:a,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.startProdGateway=startProdGateway;const observability_1=require("./observability"),routing_1=require("./routing"),rollout_1=require("./rollout"),upstream_1=require("./upstream"),auth_1=require("./auth"),hooks_1=require("./hooks"),cors_1=require("./cors"),handler_1=require("./handler"),upgrade_1=require("./upgrade"),app_1=require("./app");async function startProdGateway(e){const a=e.ports?.length?e.ports:[e.tls?8443:8080],j=e.authenticate??(t=>{if(t==="jwt")throw new Error("jwt route but no authenticator configured")}),C=(e.versionHeader??"x-lensmcp-version").toLowerCase(),P=!!e.accessLog,L=new Set((e.corsCredentialOrigins??[]).map(t=>t.toLowerCase())),d=new Map;for(const[t,s]of Object.entries(e.serviceKeys??{}))typeof s=="string"&&s.trim()!==""?d.set(s,t):console.warn(`[gateway] service key for "${t}" is empty \u2014 east-west auth for that service is DISABLED (all internal routes 401) until a key is set.`);const w={},r=(0,observability_1.createObservability)(e,()=>w.current.routes),o=(0,routing_1.createRouteTable)(e,r);w.current=o;const i={opts:e,table:o,keyToProject:d,versionHeader:C,accessLog:P,corsCredentialOrigins:L},u=(0,rollout_1.createRollout)(e),y=(0,upstream_1.createUpstream)(e,r),g=(0,auth_1.createEdgeAuth)(i,r,u,j),c=(0,hooks_1.createHooks)(e.hooks??{}),p=new WeakMap,b=new WeakMap,m=new WeakMap,f=(0,cors_1.createCors)(i,p),O=(0,handler_1.createHandler)({rt:i,obs:r,cors:f,auth:g,upstream:y,rollout:u,hooks:c,reqState:p,spanByReq:b,ctxByReq:m}),M=(0,upgrade_1.createUpgrade)({rt:i,obs:r,auth:g,upstream:y,hooks:c,rollout:u}),{buildApp:S}=(0,app_1.createApp)({rt:i,obs:r,cors:f,hooks:c,handler:O,upgrade:M,reqState:p,spanByReq:b,ctxByReq:m}),x=r.startFlusher();o.rebuild(o.manifests());const k=[],q=[];for(const t of a){const s=await S();await s.listen({port:t,host:"0.0.0.0"});const l=s.server.address(),_=typeof l=="object"&&l?l.port:t;q.push(_),console.log(`[gateway] listening on ${e.tls?"https":"http"}://0.0.0.0:${_}`),k.push(s)}e.healthChecker?.start();let v=!1;return{ports:q,routes:n(()=>o.routes,"routes"),status:r.buildStatusSnapshot,refreshUpstreams:o.trackUpstreams,stop:n(async()=>{v||(v=!0,clearInterval(x),o.stop(),e.healthChecker?.stop(),e.rateLimiter?.stop(),e.metrics?.stop(),r.emit("info","gateway down","gateway-down",{kind:"gateway-down"}),await Promise.all(k.map(t=>t.close())))},"stop")}}h(startProdGateway,"startProdGateway"),n(startProdGateway,"startProdGateway");
+"use strict";var G=Object.defineProperty;var d=(e,a)=>G(e,"name",{value:a,configurable:!0});var A=Object.defineProperty,h=d((e,a)=>A(e,"name",{value:a,configurable:!0}),"h"),R=Object.defineProperty,n=h((e,a)=>R(e,"name",{value:a,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.startProdGateway=startProdGateway;const observability_1=require("./observability"),routing_1=require("./routing"),rollout_1=require("./rollout"),upstream_1=require("./upstream"),auth_1=require("./auth"),hooks_1=require("./hooks"),cors_1=require("./cors"),handler_1=require("./handler"),upgrade_1=require("./upgrade"),app_1=require("./app");async function startProdGateway(e){const a=e.ports?.length?e.ports:[e.tls?8443:8080],j=e.authenticate??(t=>{if(t==="jwt")throw new Error("jwt route but no authenticator configured")}),C=(e.versionHeader??"x-lensmcp-version").toLowerCase(),O=!!e.accessLog,L=new Set((e.corsCredentialOrigins??[]).map(t=>t.toLowerCase())),w=new Map;for(const[t,s]of Object.entries(e.serviceKeys??{}))typeof s=="string"&&s.trim()!==""?w.set(s,t):console.warn(`[gateway] service key for "${t}" is empty \u2014 east-west auth for that service is DISABLED (all internal routes 401) until a key is set.`);const y={},r=(0,observability_1.createObservability)(e,()=>y.current.routes),o=(0,routing_1.createRouteTable)(e,r);y.current=o;const i={opts:e,table:o,keyToProject:w,versionHeader:C,accessLog:O,corsCredentialOrigins:L},u=(0,rollout_1.createRollout)(e),g=(0,upstream_1.createUpstream)(e,r),b=(0,auth_1.createEdgeAuth)(i,r,u,j),c=(0,hooks_1.createHooks)(e.hooks??{}),p=new WeakMap,f=new WeakMap,m=new WeakMap,k=(0,cors_1.createCors)(i,p),S=(0,handler_1.createHandler)({rt:i,obs:r,cors:k,auth:b,upstream:g,rollout:u,hooks:c,reqState:p,spanByReq:f,ctxByReq:m}),x=(0,upgrade_1.createUpgrade)({rt:i,obs:r,auth:b,upstream:g,hooks:c,rollout:u}),{buildApp:M}=(0,app_1.createApp)({rt:i,obs:r,cors:k,hooks:c,handler:S,upgrade:x,reqState:p,spanByReq:f,ctxByReq:m}),B=r.startFlusher();o.rebuild(o.manifests());const v=[],q=[];for(const t of a){const s=await M();await s.listen({port:t,host:"0.0.0.0"});const l=s.server.address(),P=typeof l=="object"&&l?l.port:t;q.push(P),console.log(`[gateway] listening on ${e.tls?"https":"http"}://0.0.0.0:${P}`),v.push(s)}e.healthChecker?.start();let _=!1;return{ports:q,routes:n(()=>o.routes,"routes"),status:r.buildStatusSnapshot,refreshUpstreams:o.trackUpstreams,stop:n(async()=>{_||(_=!0,clearInterval(B),o.stop(),e.healthChecker?.stop(),e.rateLimiter?.stop(),e.metrics?.stop(),r.emit("info","gateway down","gateway-down",{kind:"gateway-down"}),await Promise.all(v.map(t=>t.close())))},"stop")}}d(startProdGateway,"startProdGateway"),h(startProdGateway,"startProdGateway"),n(startProdGateway,"startProdGateway");

package/executors/gateway/prod-runtime/trust.js

@@ -1 +1 @@
-"use strict";var d=Object.defineProperty;var p=(t,e)=>d(t,"name",{value:e,configurable:!0});var x=Object.defineProperty,r=p((t,e)=>x(t,"name",{value:e,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.stampIdentity=exports.stripTrust=exports.HOP_BY_HOP=exports.TRUST_HEADERS=void 0,exports.TRUST_HEADERS=["x-internal-token","x-api-key-id","x-user-id","x-tenant-id","x-user-roles","x-user-permissions"],exports.HOP_BY_HOP=["connection","proxy-connection","keep-alive"];const stripTrust=r(t=>{for(const e of exports.TRUST_HEADERS)delete t.headers[e];for(const e of exports.HOP_BY_HOP)delete t.headers[e]},"stripTrust");exports.stripTrust=stripTrust;const stampIdentity=r((t,e)=>{const i=r((a,s)=>{(typeof s=="string"&&s!==""||typeof s=="number")&&(t.headers[a]=String(s))},"set");i("x-user-id",e.sub),i("x-tenant-id",e.tid);const o=e.roles;Array.isArray(o)&&o.length&&(t.headers["x-user-roles"]=o.map(String).join(","));const n=e.perms;Array.isArray(n)&&n.length&&(t.headers["x-user-permissions"]=n.map(String).join(","))},"stampIdentity");exports.stampIdentity=stampIdentity;
+"use strict";var c=Object.defineProperty;var a=(t,e)=>c(t,"name",{value:e,configurable:!0});var d=Object.defineProperty,p=a((t,e)=>d(t,"name",{value:e,configurable:!0}),"p"),x=Object.defineProperty,r=p((t,e)=>x(t,"name",{value:e,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.stampIdentity=exports.stripTrust=exports.HOP_BY_HOP=exports.TRUST_HEADERS=void 0,exports.TRUST_HEADERS=["x-internal-token","x-api-key-id","x-user-id","x-tenant-id","x-user-roles","x-user-permissions"],exports.HOP_BY_HOP=["connection","proxy-connection","keep-alive"];const stripTrust=r(t=>{for(const e of exports.TRUST_HEADERS)delete t.headers[e];for(const e of exports.HOP_BY_HOP)delete t.headers[e]},"stripTrust");exports.stripTrust=stripTrust;const stampIdentity=r((t,e)=>{const i=r((u,s)=>{(typeof s=="string"&&s!==""||typeof s=="number")&&(t.headers[u]=String(s))},"set");i("x-user-id",e.sub),i("x-tenant-id",e.tid);const o=e.roles;Array.isArray(o)&&o.length&&(t.headers["x-user-roles"]=o.map(String).join(","));const n=e.perms;Array.isArray(n)&&n.length&&(t.headers["x-user-permissions"]=n.map(String).join(","))},"stampIdentity");exports.stampIdentity=stampIdentity;

package/executors/gateway/prod-runtime/types.d.ts

@@ -146,8 +146,12 @@ export interface ProdGatewayOptions {
      *  Exact-matched, case-insensitive. Omit (default) → no credentialed CORS (the Bearer-only edge). */
     corsCredentialOrigins?: string[];
     /** Return verified subject attributes (e.g. JWT claims) for ABAC routing.
-     *  MUST verify (signature/exp) — forged claims must not reach the rules. */
-    identify?: (req: http.IncomingMessage) => Record<string, unknown> | undefined;
+     *  MUST verify (signature/exp) — forged claims must not reach the rules.
+     *  Answer synchronously whenever possible: it runs on every identity-routed request, and the
+     *  gateway awaits ONLY a returned `Promise` (so a sync answer costs no microtask). Return one
+     *  only to wait — e.g. a JWKS `kid` miss waiting on the key-set refresh (`bearerIdentify`,
+     *  issues/closed/prod-gateway-20). A rejection fails the request, as a throw does. */
+    identify?: (req: http.IncomingMessage) => Record<string, unknown> | undefined | Promise<Record<string, unknown> | undefined>;
     /** Allowlist of request headers exposed to rules as `header.<name>` attributes. */
     attributeHeaders?: string[];
     /** Take the `ip` attribute from `X-Forwarded-For` (behind a trusted LB); default false →

package/executors/gateway/prod-runtime/upgrade.js

@@ -1,12 +1,12 @@
-"use strict";var V=Object.defineProperty;var A=(p,s)=>V(p,"name",{value:s,configurable:!0});var F=Object.defineProperty,u=A((p,s)=>F(p,"name",{value:s,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createUpgrade=createUpgrade;const tslib_1=require("tslib"),net=tslib_1.__importStar(require("node:net")),tls=tslib_1.__importStar(require("node:tls")),manifest_1=require("../manifest"),edge_1=require("./edge"),trust_1=require("./trust"),validHeaderValue=u(p=>/^[\t\x20-\x7e\x80-\xff]*$/.test(p),"validHeaderValue"),validToken=u(p=>/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(p),"validToken"),FORWARDED_HEADERS=["x-forwarded-for","x-forwarded-proto","x-forwarded-host"],MAX_HEAD_BYTES=64*1024,HANDSHAKE_TIMEOUT_MS=3e4;function createUpgrade(p){const{rt:s,obs:g,auth:S,upstream:z,hooks:y,rollout:E}=p,l=u((e,t,i,c)=>{g.emit("warning",`gateway upgrade rejected (${t})${i?` for ${i}`:""}`,`gateway-upgrade:${i??"(none)"}:${t}`,{kind:"gateway-upgrade-rejected",reason:t,...i?{project:i}:{},...c}),e.destroy()},"reject"),I=u((e,t,i="")=>{try{e.end(`HTTP/1.1 ${t}\r
-${i}Connection: close\r
+"use strict";var X=Object.defineProperty;var U=(d,n)=>X(d,"name",{value:n,configurable:!0});var W=Object.defineProperty,E=U((d,n)=>W(d,"name",{value:n,configurable:!0}),"E"),G=Object.defineProperty,u=E((d,n)=>G(d,"name",{value:n,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createUpgrade=createUpgrade;const tslib_1=require("tslib"),net=tslib_1.__importStar(require("node:net")),tls=tslib_1.__importStar(require("node:tls")),manifest_1=require("../manifest"),edge_1=require("./edge"),trust_1=require("./trust"),validHeaderValue=u(d=>/^[\t\x20-\x7e\x80-\xff]*$/.test(d),"validHeaderValue"),validToken=u(d=>/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(d),"validToken"),FORWARDED_HEADERS=["x-forwarded-for","x-forwarded-proto","x-forwarded-host"],MAX_HEAD_BYTES=64*1024,HANDSHAKE_TIMEOUT_MS=3e4;function createUpgrade(d){const{rt:n,obs:h,auth:R,upstream:K,hooks:y,rollout:q}=d,l=u((e,r,s,p)=>{h.emit("warning",`gateway upgrade rejected (${r})${s?` for ${s}`:""}`,`gateway-upgrade:${s??"(none)"}:${r}`,{kind:"gateway-upgrade-rejected",reason:r,...s?{project:s}:{},...p}),e.destroy()},"reject"),N=u((e,r,s="")=>{try{e.end(`HTTP/1.1 ${r}\r
+${s}Connection: close\r
 Content-Length: 0\r
 \r
-`)}catch{e.destroy()}},"refuse"),K=u(async(e,t,i)=>{(0,trust_1.stripTrust)(e);const c=(e.headers.host||"").split(":")[0],m=(0,edge_1.canonicalize)(e.url??"/");if(m===void 0){l(t,"bad-path");return}const U=m.policy;e.url=m.path+m.query;const r=(0,manifest_1.matchRoute)(s.table.routes,c,U+m.query);if(!r){l(t,"no-route",void 0,{host:c});return}const R=e.socket?.remoteAddress??"",q=E.clientIpOf(e,R);if(s.opts.rateLimiter){const a=await s.opts.rateLimiter.check(q);if(!a.allowed){g.emit("warning",`gateway upgrade rate-limited for ${r.service}`,`gateway-upgrade:${r.service}:rate-limited`,{kind:"gateway-upgrade-rejected",reason:"rate-limited",project:r.service}),I(t,"429 Too Many Requests",`Retry-After: ${Math.ceil(a.retryAfterMs/1e3)}\r
-`);return}}const n=y.any?y.upgradeContext(e,t,void 0):void 0;n&&(n.route=r);const P=r.internal?void 0:s.opts.identify?.(e);let T;if(r.internal){const a=S.internal(e,r,void 0);if(!a.ok){l(t,"auth-failed",r.service);return}T=a.caller,n&&(n.caller=T)}else{if(!S.public(e,r,U,P,q,void 0).ok){l(t,"auth-failed",r.service);return}if(n&&(n.claims=P),n&&y.has("afterAuth")&&(await y.run("afterAuth",n),n.responded()))return}if(e.headers["x-forwarded-for"]=E.forwardedFor(e,R),e.headers["x-forwarded-proto"]=s.opts.tls?"https":"http",e.headers["x-forwarded-host"]=e.headers.host??c,s.opts.serviceKeys?.[r.service]&&(e.headers["x-internal-token"]=s.opts.serviceKeys[r.service]),r.prependPrefix){const a=e.url??"/",o=r.prependPrefix;a!==o&&!a.startsWith(o+"/")&&(e.url=o+a)}if(n&&y.has("onUpgrade")&&(await y.run("onUpgrade",n),n.responded()))return;const N=(0,edge_1.hdr)(e.headers[s.versionHeader]),x=await z.resolveUpstream(r,void 0,N);if(!x||!("url"in x)){l(t,"no-upstream",r.service);return}const f=new URL(x.url),B=new Set([...trust_1.TRUST_HEADERS,"x-api-key","connection","proxy-connection","keep-alive",...FORWARDED_HEADERS]),C=e.method??"GET",k=e.url??"/";if(!validToken(C)||!validHeaderValue(k)||k.includes(" ")){l(t,"bad-request-line",r.service);return}const _=[`${C} ${k} HTTP/1.1`,"Connection: Upgrade"];for(let a=0;a<e.rawHeaders.length;a+=2){const o=e.rawHeaders[a],$=e.rawHeaders[a+1]??"";if(!B.has(o.toLowerCase())){if(!validToken(o)||!validHeaderValue($)){l(t,"bad-header",r.service,{header:o.toLowerCase()});return}_.push(`${o}: ${$}`)}}for(const a of[...trust_1.TRUST_HEADERS,...FORWARDED_HEADERS]){const o=e.headers[a];if(!(typeof o!="string"||o==="")){if(!validHeaderValue(o)){l(t,"bad-identity-value",r.service,{header:a});return}_.push(`${a}: ${o}`)}}const b=f.protocol==="https:"||f.protocol==="wss:",D=Number(f.port)||(b?443:80),h=s.opts.undici,d=b?tls.connect({port:D,host:f.hostname,...net.isIP(f.hostname)?{}:{servername:f.hostname},rejectUnauthorized:h?.rejectUnauthorized??!1,...h?.cert?{cert:h.cert}:{},...h?.key?{key:h.key}:{},...h?.ca?{ca:h.ca}:{}}):net.connect(D,f.hostname);let v=!1;const w=u(a=>{v||(v=!0,clearTimeout(j),g.emit("warning",`gateway upgrade failed (${a}) for ${r.service}`,`gateway-upgrade:${r.service}:${a}`,{kind:"gateway-upgrade-rejected",reason:a,project:r.service}),d.destroy(),t.destroy())},"abort"),j=setTimeout(()=>w("handshake-timeout"),HANDSHAKE_TIMEOUT_MS);j.unref?.(),d.on("error",()=>w("upstream-error")),t.on("error",()=>w("client-error")),d.on(b?"secureConnect":"connect",()=>{d.write(_.join(`\r
+`)}catch{e.destroy()}},"refuse"),B=u(async(e,r,s)=>{(0,trust_1.stripTrust)(e);const p=(e.headers.host||"").split(":")[0],m=(0,edge_1.canonicalize)(e.url??"/");if(m===void 0){l(r,"bad-path");return}const P=m.policy;e.url=m.path+m.query;const a=(0,manifest_1.matchRoute)(n.table.routes,p,P+m.query);if(!a){l(r,"no-route",void 0,{host:p});return}const O=e.socket?.remoteAddress??"",C=q.clientIpOf(e,O);if(n.opts.rateLimiter){const t=await n.opts.rateLimiter.check(C);if(!t.allowed){h.emit("warning",`gateway upgrade rate-limited for ${a.service}`,`gateway-upgrade:${a.service}:rate-limited`,{kind:"gateway-upgrade-rejected",reason:"rate-limited",project:a.service}),N(r,"429 Too Many Requests",`Retry-After: ${Math.ceil(t.retryAfterMs/1e3)}\r
+`);return}}const i=y.any?y.upgradeContext(e,r,void 0):void 0;i&&(i.route=a);const b=a.internal?void 0:n.opts.identify?.(e);let x;if(b instanceof Promise){const t=u(()=>{},"ignore");if(r.on("error",t),x=await b,r.off("error",t),r.destroyed)return}else x=b;let k;if(a.internal){const t=R.internal(e,a,void 0);if(!t.ok){l(r,"auth-failed",a.service);return}k=t.caller,i&&(i.caller=k)}else{if(!R.public(e,a,P,x,C,void 0).ok){l(r,"auth-failed",a.service);return}if(i&&(i.claims=x),i&&y.has("afterAuth")&&(await y.run("afterAuth",i),i.responded()))return}if(e.headers["x-forwarded-for"]=q.forwardedFor(e,O),e.headers["x-forwarded-proto"]=n.opts.tls?"https":"http",e.headers["x-forwarded-host"]=e.headers.host??p,n.opts.serviceKeys?.[a.service]&&(e.headers["x-internal-token"]=n.opts.serviceKeys[a.service]),a.prependPrefix){const t=e.url??"/",o=a.prependPrefix;t!==o&&!t.startsWith(o+"/")&&(e.url=o+t)}if(i&&y.has("onUpgrade")&&(await y.run("onUpgrade",i),i.responded()))return;const F=(0,edge_1.hdr)(e.headers[n.versionHeader]),T=await K.resolveUpstream(a,void 0,F);if(!T||!("url"in T)){l(r,"no-upstream",a.service);return}const f=new URL(T.url),V=new Set([...trust_1.TRUST_HEADERS,"x-api-key","connection","proxy-connection","keep-alive",...FORWARDED_HEADERS]),D=e.method??"GET",_=e.url??"/";if(!validToken(D)||!validHeaderValue(_)||_.includes(" ")){l(r,"bad-request-line",a.service);return}const j=[`${D} ${_} HTTP/1.1`,"Connection: Upgrade"];for(let t=0;t<e.rawHeaders.length;t+=2){const o=e.rawHeaders[t],$=e.rawHeaders[t+1]??"";if(!V.has(o.toLowerCase())){if(!validToken(o)||!validHeaderValue($)){l(r,"bad-header",a.service,{header:o.toLowerCase()});return}j.push(`${o}: ${$}`)}}for(const t of[...trust_1.TRUST_HEADERS,...FORWARDED_HEADERS]){const o=e.headers[t];if(!(typeof o!="string"||o==="")){if(!validHeaderValue(o)){l(r,"bad-identity-value",a.service,{header:t});return}j.push(`${t}: ${o}`)}}const H=f.protocol==="https:"||f.protocol==="wss:",M=Number(f.port)||(H?443:80),g=n.opts.undici,c=H?tls.connect({port:M,host:f.hostname,...net.isIP(f.hostname)?{}:{servername:f.hostname},rejectUnauthorized:g?.rejectUnauthorized??!1,...g?.cert?{cert:g.cert}:{},...g?.key?{key:g.key}:{},...g?.ca?{ca:g.ca}:{}}):net.connect(M,f.hostname);let v=!1;const w=u(t=>{v||(v=!0,clearTimeout(A),h.emit("warning",`gateway upgrade failed (${t}) for ${a.service}`,`gateway-upgrade:${a.service}:${t}`,{kind:"gateway-upgrade-rejected",reason:t,project:a.service}),c.destroy(),r.destroy())},"abort"),A=setTimeout(()=>w("handshake-timeout"),HANDSHAKE_TIMEOUT_MS);A.unref?.(),c.on("error",()=>w("upstream-error")),r.on("error",()=>w("client-error")),c.on(H?"secureConnect":"connect",()=>{c.write(j.join(`\r
 `)+`\r
 \r
-`),i?.length&&d.write(i)});const M=[];let O=0;const L=u(a=>{if(v)return;M.push(a),O+=a.length;const o=Buffer.concat(M),$=o.indexOf(`\r
+`),s?.length&&c.write(s)});const L=[];let z=0;const I=u(t=>{if(v)return;L.push(t),z+=t.length;const o=Buffer.concat(L),$=o.indexOf(`\r
 \r
-`);if($===-1){O>MAX_HEAD_BYTES&&w("oversized-response-head");return}v=!0,clearTimeout(j),d.off("data",L);const H=Number(/^HTTP\/1\.[01] (\d{3})/.exec(o.subarray(0,o.indexOf(`\r
-`)).toString("latin1"))?.[1]);if(H!==101){g.emit("warning",`gateway upgrade refused upstream (${H||"malformed"}) for ${r.service}`,`gateway-upgrade:${r.service}:upstream-refused`,{kind:"gateway-upgrade-rejected",reason:"upstream-refused",project:r.service,status:H||0}),t.end(o.subarray(0,$+4)),d.destroy();return}g.recordEdge(r,0,101,T,x.version),t.write(o),d.pipe(t),t.pipe(d)},"onHead");d.on("data",L),d.on("close",()=>{v||w("upstream-closed")})},"run");return(e,t,i)=>{K(e,t,i).catch(c=>{g.emit("error",`gateway upgrade error: ${c?.message??String(c)}`,"gateway-upgrade:(none):exception",{kind:"gateway-upgrade-rejected",reason:"exception",error:c?.message??String(c)});try{t.destroy()}catch{}})}}A(createUpgrade,"createUpgrade"),u(createUpgrade,"createUpgrade");
+`);if($===-1){z>MAX_HEAD_BYTES&&w("oversized-response-head");return}v=!0,clearTimeout(A),c.off("data",I);const S=Number(/^HTTP\/1\.[01] (\d{3})/.exec(o.subarray(0,o.indexOf(`\r
+`)).toString("latin1"))?.[1]);if(S!==101){h.emit("warning",`gateway upgrade refused upstream (${S||"malformed"}) for ${a.service}`,`gateway-upgrade:${a.service}:upstream-refused`,{kind:"gateway-upgrade-rejected",reason:"upstream-refused",project:a.service,status:S||0}),r.end(o.subarray(0,$+4)),c.destroy();return}h.recordEdge(a,0,101,k,T.version),r.write(o),c.pipe(r),r.pipe(c)},"onHead");c.on("data",I),c.on("close",()=>{v||w("upstream-closed")})},"run");return(e,r,s)=>{B(e,r,s).catch(p=>{h.emit("error",`gateway upgrade error: ${p?.message??String(p)}`,"gateway-upgrade:(none):exception",{kind:"gateway-upgrade-rejected",reason:"exception",error:p?.message??String(p)});try{r.destroy()}catch{}})}}U(createUpgrade,"createUpgrade"),E(createUpgrade,"createUpgrade"),u(createUpgrade,"createUpgrade");

package/executors/gateway/prod-runtime/upstream.js

@@ -1 +1 @@
-"use strict";var v=Object.defineProperty;var p=(e,t)=>v(e,"name",{value:t,configurable:!0});var u=Object.defineProperty,s=p((e,t)=>u(e,"name",{value:t,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createUpstream=createUpstream;function createUpstream(e,t){return{resolveUpstream:s(async(r,o,i,n)=>{if(r.upstream)return{url:r.upstream};const c={...i?{version:i}:{},...n?{allowDrained:!0}:{},...e.healthChecker?{isHealthy:s(l=>e.healthChecker.isHealthy(l),"isHealthy")}:{}};let a=e.pods?.pick(r.service,c);return!a&&e.pods?.ensureUp&&(t.step(o,"ensure-up",{project:r.service}),await e.pods.ensureUp(r.service)&&(a=e.pods.pick(r.service,c))),a},"resolveUpstream")}}p(createUpstream,"createUpstream"),s(createUpstream,"createUpstream");
+"use strict";var d=Object.defineProperty;var c=(e,r)=>d(e,"name",{value:r,configurable:!0});var v=Object.defineProperty,p=c((e,r)=>v(e,"name",{value:r,configurable:!0}),"p"),u=Object.defineProperty,s=p((e,r)=>u(e,"name",{value:r,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createUpstream=createUpstream;function createUpstream(e,r){return{resolveUpstream:s(async(t,o,i,l)=>{if(t.upstream)return{url:t.upstream};const n={...i?{version:i}:{},...l?{allowDrained:!0}:{},...e.healthChecker?{isHealthy:s(m=>e.healthChecker.isHealthy(m),"isHealthy")}:{}};let a=e.pods?.pick(t.service,n);return!a&&e.pods?.ensureUp&&(r.step(o,"ensure-up",{project:t.service}),await e.pods.ensureUp(t.service)&&(a=e.pods.pick(t.service,n))),a},"resolveUpstream")}}c(createUpstream,"createUpstream"),p(createUpstream,"createUpstream"),s(createUpstream,"createUpstream");