@lensmcp/cluster 1.25.8 → 1.25.9

package/executors/gateway/prod-config.js

@@ -1 +1 @@
-"use strict";var w=Object.defineProperty;var S=(_,E)=>w(_,"name",{value:E,configurable:!0});var k=Object.defineProperty,t=S((_,E)=>k(_,"name",{value:E,configurable:!0}),"t");Object.defineProperty(exports,"__esModule",{value:!0}),exports.parseGatewayEnv=parseGatewayEnv,exports.redisLimiterConfigured=redisLimiterConfigured,exports.perWorkerLimit=perWorkerLimit,exports.workerCount=workerCount,exports.finalizeUpstreamTls=finalizeUpstreamTls,exports.finalizeUpstreamH2=finalizeUpstreamH2;const node_os_1=require("node:os"),num=t(_=>{if(_===void 0||_.trim()==="")return;const E=Number(_);return Number.isFinite(E)?E:void 0},"num"),csv=t(_=>(_??"").split(",").map(E=>E.trim()).filter(Boolean),"csv"),flag=t(_=>_==="1","flag");function parseGatewayEnv(_){const E=csv(_.LENSMCP_GW_PORTS??_.PORT).map(Number).filter(L=>Number.isFinite(L)&&L>=0&&L<=65535),r=Math.max(0,Math.floor(num(_.LENSMCP_GW_TRUST_PROXY)??0)),i={},N=_.LENSMCP_GW_UPSTREAM_TLS_VERIFY;N==="1"?i.rejectUnauthorized=!0:N==="0"&&(i.rejectUnauthorized=!1),flag(_.LENSMCP_GW_UPSTREAM_H2)&&(i.allowH2=!0);const a=num(_.LENSMCP_GW_UNDICI_CONNECTIONS);a!==void 0&&(i.connections=a);const T=num(_.LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS);T!==void 0&&(i.bodyTimeout=T);const P=num(_.LENSMCP_GW_UNDICI_PIPELINING);P!==void 0&&(i.pipelining=P);const W=num(_.LENSMCP_GW_UNDICI_HEADERS_TIMEOUT_MS);W!==void 0&&(i.headersTimeout=W);const I=num(_.LENSMCP_GW_UNDICI_KEEPALIVE_MS);I!==void 0&&(i.keepAliveTimeout=I);const o={},u=num(_.LENSMCP_GW_KEEPALIVE_MS);u!==void 0&&(o.keepAliveTimeout=u);const d=num(_.LENSMCP_GW_REQUEST_TIMEOUT_MS);d!==void 0&&(o.requestTimeout=d);const G=num(_.LENSMCP_GW_HEADERS_TIMEOUT_MS);G!==void 0&&(o.headersTimeout=G);const c=num(_.LENSMCP_GW_MAX_HEADERS);c!==void 0&&(o.maxHeadersCount=c);const R=num(_.LENSMCP_GW_CONN_CHECK_MS);R!==void 0&&(o.connectionsCheckingInterval=R);const l=num(_.LENSMCP_GW_MAX_CONNECTIONS);l!==void 0&&(o.maxConnections=l);const m=num(_.LENSMCP_GW_BODY_STALL_MS);m!==void 0&&(o.bodyStallMs=m);const e=_.LENSMCP_GW_COOKIE_SECRET,M=_.LENSMCP_GW_COOKIE_NAME,n=_.LENSMCP_GW_COOKIE_DOMAIN,A=num(_.LENSMCP_GW_COOKIE_MAXAGE),U=e||M||n?{...M?{name:M}:{},...e?{secret:e}:{},...n?{domain:n}:{},...A!==void 0?{maxAge:A}:{}}:void 0,v=num(_.LENSMCP_GW_RATE_LIMIT),s=_.LENSMCP_GW_RATE_LIMIT_REDIS_URL,p=num(_.LENSMCP_GW_RATE_LIMIT_TIMEOUT_MS),O=v===void 0?void 0:{limit:v,windowMs:num(_.LENSMCP_GW_RATE_WINDOW_MS)??6e4,wantRedis:flag(_.LENSMCP_GW_RATE_LIMIT_REDIS)||!!s,...s?{dedicatedUrl:s}:{},...p!==void 0?{timeoutMs:p}:{},failClosed:flag(_.LENSMCP_GW_RATE_LIMIT_FAIL_CLOSED)},f=_.LENSMCP_GW_HEALTH_PATH,H=num(_.LENSMCP_GW_HEALTH_INTERVAL_MS),D=num(_.LENSMCP_GW_HEALTH_TIMEOUT_MS),h=flag(_.LENSMCP_GW_HEALTH_CHECK),b=h?{...f?{path:f}:{},...H!==void 0?{intervalMs:H}:{},...D!==void 0?{timeoutMs:D}:{}}:void 0,C=num(_.LENSMCP_GW_TRAFFIC_FLUSH_MS),x=csv(_.LENSMCP_GW_JWT_AUD);return{ports:E,workers:workerCount(_),undici:i,server:o,...num(_.LENSMCP_GW_UPSTREAM_RETRIES)!==void 0?{upstreamRetries:num(_.LENSMCP_GW_UPSTREAM_RETRIES)}:{},trustProxyIp:r>0,trustProxyHops:r,...U?{cookie:U}:{},attributeHeaders:csv(_.LENSMCP_GW_ATTR_HEADERS),..._.LENSMCP_GW_CLIENT_IP_HEADER?{clientIpHeader:_.LENSMCP_GW_CLIENT_IP_HEADER}:{},clientIpTrustedProxies:csv(_.LENSMCP_GW_CLIENT_IP_TRUSTED_PROXIES),..._.LENSMCP_GW_UID_HEADER?{uidHeader:_.LENSMCP_GW_UID_HEADER}:{},accessLog:flag(_.LENSMCP_GW_ACCESS_LOG),statusEnabled:flag(_.LENSMCP_GW_STATUS),..._.LENSMCP_GW_STATUS_TOKEN?{statusToken:_.LENSMCP_GW_STATUS_TOKEN}:{},metricsEnabled:flag(_.LENSMCP_GW_METRICS),statusTtlSec:Math.max(3,Math.ceil((C??5e3)/1e3*3)),...C!==void 0?{trafficFlushMs:C}:{},...O?{rateLimit:O}:{},...b?{health:b}:{},healthCheckEnabled:h,jwt:{..._.LENSMCP_GW_JWKS_URL?{jwksUrl:_.LENSMCP_GW_JWKS_URL}:{},..._.LENSMCP_GW_JWT_SECRET?{secret:_.LENSMCP_GW_JWT_SECRET}:{},..._.LENSMCP_GW_JWT_ISS?{issuer:_.LENSMCP_GW_JWT_ISS}:{},...x.length?{audience:x}:{},presenceOnly:flag(_.LENSMCP_GW_JWT_PRESENCE_ONLY)},mtlsFromRedis:flag(_.LENSMCP_GW_MTLS_FROM_REDIS)}}S(parseGatewayEnv,"parseGatewayEnv"),t(parseGatewayEnv,"parseGatewayEnv");function redisLimiterConfigured(_){return _.LENSMCP_GW_RATE_LIMIT_REDIS_URL?!0:flag(_.LENSMCP_GW_RATE_LIMIT_REDIS)&&!!_.LENSMCP_GW_REDIS_URL}S(redisLimiterConfigured,"redisLimiterConfigured"),t(redisLimiterConfigured,"redisLimiterConfigured");function perWorkerLimit(_,E){if(!Number.isFinite(_)||_<=0)return _;const r=Number.isFinite(E)&&E>1?Math.floor(E):1;return Math.max(1,Math.floor(_/r))}S(perWorkerLimit,"perWorkerLimit"),t(perWorkerLimit,"perWorkerLimit");function workerCount(_){const E=(_.LENSMCP_GW_WORKERS??"1").trim().toLowerCase();if(E==="auto"||E==="max"||E==="0")return Math.max(1,(0,node_os_1.cpus)().length);const r=Math.floor(Number(E));return Number.isFinite(r)&&r>0?r:1}S(workerCount,"workerCount"),t(workerCount,"workerCount");function finalizeUpstreamTls(_){return _.ca&&_.rejectUnauthorized===void 0?(_.rejectUnauthorized=!0,{autoEnabled:!0}):{autoEnabled:!1}}S(finalizeUpstreamTls,"finalizeUpstreamTls"),t(finalizeUpstreamTls,"finalizeUpstreamTls");function finalizeUpstreamH2(_,E){return _.cert&&_.key?(E.LENSMCP_GW_UPSTREAM_H2!=="0"&&(_.allowH2=!0),!0):!1}S(finalizeUpstreamH2,"finalizeUpstreamH2"),t(finalizeUpstreamH2,"finalizeUpstreamH2");
+"use strict";var y=Object.defineProperty;var o=(e,E)=>y(e,"name",{value:E,configurable:!0});var w=Object.defineProperty,S=o((e,E)=>w(e,"name",{value:E,configurable:!0}),"S"),k=Object.defineProperty,t=S((e,E)=>k(e,"name",{value:E,configurable:!0}),"t");Object.defineProperty(exports,"__esModule",{value:!0}),exports.parseGatewayEnv=parseGatewayEnv,exports.redisLimiterConfigured=redisLimiterConfigured,exports.perWorkerLimit=perWorkerLimit,exports.workerCount=workerCount,exports.finalizeUpstreamTls=finalizeUpstreamTls,exports.finalizeUpstreamH2=finalizeUpstreamH2;const node_os_1=require("node:os"),num=t(e=>{if(e===void 0||e.trim()==="")return;const E=Number(e);return Number.isFinite(E)?E:void 0},"num"),csv=t(e=>(e??"").split(",").map(E=>E.trim()).filter(Boolean),"csv"),flag=t(e=>e==="1","flag");function parseGatewayEnv(e){const E=csv(e.LENSMCP_GW_PORTS??e.PORT).map(Number).filter(L=>Number.isFinite(L)&&L>=0&&L<=65535),r=Math.max(0,Math.floor(num(e.LENSMCP_GW_TRUST_PROXY)??0)),i={},N=e.LENSMCP_GW_UPSTREAM_TLS_VERIFY;N==="1"?i.rejectUnauthorized=!0:N==="0"&&(i.rejectUnauthorized=!1),flag(e.LENSMCP_GW_UPSTREAM_H2)&&(i.allowH2=!0);const T=num(e.LENSMCP_GW_UNDICI_CONNECTIONS);T!==void 0&&(i.connections=T);const P=num(e.LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS);P!==void 0&&(i.bodyTimeout=P);const u=num(e.LENSMCP_GW_UNDICI_PIPELINING);u!==void 0&&(i.pipelining=u);const W=num(e.LENSMCP_GW_UNDICI_HEADERS_TIMEOUT_MS);W!==void 0&&(i.headersTimeout=W);const I=num(e.LENSMCP_GW_UNDICI_KEEPALIVE_MS);I!==void 0&&(i.keepAliveTimeout=I);const _={},d=num(e.LENSMCP_GW_KEEPALIVE_MS);d!==void 0&&(_.keepAliveTimeout=d);const G=num(e.LENSMCP_GW_REQUEST_TIMEOUT_MS);G!==void 0&&(_.requestTimeout=G);const c=num(e.LENSMCP_GW_HEADERS_TIMEOUT_MS);c!==void 0&&(_.headersTimeout=c);const l=num(e.LENSMCP_GW_MAX_HEADERS);l!==void 0&&(_.maxHeadersCount=l);const R=num(e.LENSMCP_GW_CONN_CHECK_MS);R!==void 0&&(_.connectionsCheckingInterval=R);const m=num(e.LENSMCP_GW_MAX_CONNECTIONS);m!==void 0&&(_.maxConnections=m);const A=num(e.LENSMCP_GW_BODY_STALL_MS);A!==void 0&&(_.bodyStallMs=A);const n=e.LENSMCP_GW_COOKIE_SECRET,M=e.LENSMCP_GW_COOKIE_NAME,s=e.LENSMCP_GW_COOKIE_DOMAIN,U=num(e.LENSMCP_GW_COOKIE_MAXAGE),p=n||M||s?{...M?{name:M}:{},...n?{secret:n}:{},...s?{domain:s}:{},...U!==void 0?{maxAge:U}:{}}:void 0,v=num(e.LENSMCP_GW_RATE_LIMIT),a=e.LENSMCP_GW_RATE_LIMIT_REDIS_URL,O=num(e.LENSMCP_GW_RATE_LIMIT_TIMEOUT_MS),f=v===void 0?void 0:{limit:v,windowMs:num(e.LENSMCP_GW_RATE_WINDOW_MS)??6e4,wantRedis:flag(e.LENSMCP_GW_RATE_LIMIT_REDIS)||!!a,...a?{dedicatedUrl:a}:{},...O!==void 0?{timeoutMs:O}:{},failClosed:flag(e.LENSMCP_GW_RATE_LIMIT_FAIL_CLOSED)},H=e.LENSMCP_GW_HEALTH_PATH,D=num(e.LENSMCP_GW_HEALTH_INTERVAL_MS),h=num(e.LENSMCP_GW_HEALTH_TIMEOUT_MS),b=flag(e.LENSMCP_GW_HEALTH_CHECK),x=b?{...H?{path:H}:{},...D!==void 0?{intervalMs:D}:{},...h!==void 0?{timeoutMs:h}:{}}:void 0,C=num(e.LENSMCP_GW_TRAFFIC_FLUSH_MS),g=csv(e.LENSMCP_GW_JWT_AUD);return{ports:E,workers:workerCount(e),undici:i,server:_,...num(e.LENSMCP_GW_UPSTREAM_RETRIES)!==void 0?{upstreamRetries:num(e.LENSMCP_GW_UPSTREAM_RETRIES)}:{},trustProxyIp:r>0,trustProxyHops:r,...p?{cookie:p}:{},attributeHeaders:csv(e.LENSMCP_GW_ATTR_HEADERS),...e.LENSMCP_GW_CLIENT_IP_HEADER?{clientIpHeader:e.LENSMCP_GW_CLIENT_IP_HEADER}:{},clientIpTrustedProxies:csv(e.LENSMCP_GW_CLIENT_IP_TRUSTED_PROXIES),...e.LENSMCP_GW_UID_HEADER?{uidHeader:e.LENSMCP_GW_UID_HEADER}:{},accessLog:flag(e.LENSMCP_GW_ACCESS_LOG),statusEnabled:flag(e.LENSMCP_GW_STATUS),...e.LENSMCP_GW_STATUS_TOKEN?{statusToken:e.LENSMCP_GW_STATUS_TOKEN}:{},metricsEnabled:flag(e.LENSMCP_GW_METRICS),statusTtlSec:Math.max(3,Math.ceil((C??5e3)/1e3*3)),...C!==void 0?{trafficFlushMs:C}:{},...f?{rateLimit:f}:{},...x?{health:x}:{},healthCheckEnabled:b,jwt:{...e.LENSMCP_GW_JWKS_URL?{jwksUrl:e.LENSMCP_GW_JWKS_URL}:{},...e.LENSMCP_GW_JWT_SECRET?{secret:e.LENSMCP_GW_JWT_SECRET}:{},...e.LENSMCP_GW_JWT_ISS?{issuer:e.LENSMCP_GW_JWT_ISS}:{},...g.length?{audience:g}:{},presenceOnly:flag(e.LENSMCP_GW_JWT_PRESENCE_ONLY)},mtlsFromRedis:flag(e.LENSMCP_GW_MTLS_FROM_REDIS)}}o(parseGatewayEnv,"parseGatewayEnv"),S(parseGatewayEnv,"parseGatewayEnv"),t(parseGatewayEnv,"parseGatewayEnv");function redisLimiterConfigured(e){return e.LENSMCP_GW_RATE_LIMIT_REDIS_URL?!0:flag(e.LENSMCP_GW_RATE_LIMIT_REDIS)&&!!e.LENSMCP_GW_REDIS_URL}o(redisLimiterConfigured,"redisLimiterConfigured"),S(redisLimiterConfigured,"redisLimiterConfigured"),t(redisLimiterConfigured,"redisLimiterConfigured");function perWorkerLimit(e,E){if(!Number.isFinite(e)||e<=0)return e;const r=Number.isFinite(E)&&E>1?Math.floor(E):1;return Math.max(1,Math.floor(e/r))}o(perWorkerLimit,"perWorkerLimit"),S(perWorkerLimit,"perWorkerLimit"),t(perWorkerLimit,"perWorkerLimit");function workerCount(e){const E=(e.LENSMCP_GW_WORKERS??"1").trim().toLowerCase();if(E==="auto"||E==="max"||E==="0")return Math.max(1,(0,node_os_1.cpus)().length);const r=Math.floor(Number(E));return Number.isFinite(r)&&r>0?r:1}o(workerCount,"workerCount"),S(workerCount,"workerCount"),t(workerCount,"workerCount");function finalizeUpstreamTls(e){return e.ca&&e.rejectUnauthorized===void 0?(e.rejectUnauthorized=!0,{autoEnabled:!0}):{autoEnabled:!1}}o(finalizeUpstreamTls,"finalizeUpstreamTls"),S(finalizeUpstreamTls,"finalizeUpstreamTls"),t(finalizeUpstreamTls,"finalizeUpstreamTls");function finalizeUpstreamH2(e,E){return e.cert&&e.key?(E.LENSMCP_GW_UPSTREAM_H2!=="0"&&(e.allowH2=!0),!0):!1}o(finalizeUpstreamH2,"finalizeUpstreamH2"),S(finalizeUpstreamH2,"finalizeUpstreamH2"),t(finalizeUpstreamH2,"finalizeUpstreamH2");

package/executors/gateway/prod-gateway.lib.js

@@ -1 +1 @@
-"use strict";var s=Object.defineProperty;var o=(r,t)=>s(r,"name",{value:t,configurable:!0});var a=Object.defineProperty,e=o((r,t)=>a(r,"name",{value:t,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.startProdGateway=void 0;var server_1=require("./prod-runtime/server");Object.defineProperty(exports,"startProdGateway",{enumerable:!0,get:e(function(){return server_1.startProdGateway},"get")});
+"use strict";var u=Object.defineProperty;var n=(r,t)=>u(r,"name",{value:t,configurable:!0});var s=Object.defineProperty,o=n((r,t)=>s(r,"name",{value:t,configurable:!0}),"o"),a=Object.defineProperty,e=o((r,t)=>a(r,"name",{value:t,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.startProdGateway=void 0;var server_1=require("./prod-runtime/server");Object.defineProperty(exports,"startProdGateway",{enumerable:!0,get:e(function(){return server_1.startProdGateway},"get")});

package/executors/gateway/prod-runtime/access-log.js

@@ -1 +1 @@
-"use strict";var g=Object.defineProperty;var u=(t,r)=>g(t,"name",{value:r,configurable:!0});var d=Object.defineProperty,n=u((t,r)=>d(t,"name",{value:r,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.logAccess=void 0;const edge_1=require("./edge"),logAccess=n((t,r,e)=>{const s=t.raw,o=r.statusCode??0,a=(s.headers.host||"").split(":")[0],i=(s.url||"/").split("?")[0],c=(0,edge_1.rawTargetOf)(s),l=Math.round(r.elapsedTime);try{console.log(JSON.stringify({severity:o>=500?"ERROR":o>=400?"WARNING":"INFO",time:new Date().toISOString(),message:`${s.method} ${a}${i} ${o} ${l}ms`,method:s.method,host:a,path:i,status:o,ms:l,...c?{rawPath:c.split("?")[0]}:{},...e?{service:e.route.service,upstream:e.upLabel}:{},...e?.version?{version:e.version}:{},...e?.caller?{caller:e.caller}:{},...s.headers["x-request-id"]?{requestId:String(s.headers["x-request-id"])}:{}}))}catch{}},"logAccess");exports.logAccess=logAccess;
+"use strict";var v=Object.defineProperty;var p=(s,e)=>v(s,"name",{value:e,configurable:!0});var g=Object.defineProperty,u=p((s,e)=>g(s,"name",{value:e,configurable:!0}),"u"),d=Object.defineProperty,n=u((s,e)=>d(s,"name",{value:e,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.logAccess=void 0;const edge_1=require("./edge"),logAccess=n((s,e,r)=>{const t=s.raw,a=e.statusCode??0,o=(t.headers.host||"").split(":")[0],i=(t.url||"/").split("?")[0],c=(0,edge_1.rawTargetOf)(t),l=Math.round(e.elapsedTime);try{console.log(JSON.stringify({severity:a>=500?"ERROR":a>=400?"WARNING":"INFO",time:new Date().toISOString(),message:`${t.method} ${o}${i} ${a} ${l}ms`,method:t.method,host:o,path:i,status:a,ms:l,...c?{rawPath:c.split("?")[0]}:{},...r?{service:r.route.service,upstream:r.upLabel}:{},...r?.version?{version:r.version}:{},...r?.caller?{caller:r.caller}:{},...t.headers["x-request-id"]?{requestId:String(t.headers["x-request-id"])}:{}}))}catch{}},"logAccess");exports.logAccess=logAccess;

package/executors/gateway/prod-runtime/app.js

@@ -1 +1 @@
-"use strict";var x=Object.defineProperty;var h=(c,a)=>x(c,"name",{value:a,configurable:!0});var C=Object.defineProperty,u=h((c,a)=>C(c,"name",{value:a,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createApp=createApp;const tslib_1=require("tslib"),fastify_1=tslib_1.__importDefault(require("fastify")),reply_from_1=tslib_1.__importDefault(require("@fastify/reply-from")),edge_1=require("./edge"),trust_1=require("./trust"),body_stall_1=require("./body-stall"),access_log_1=require("./access-log");function createApp(c){const{rt:a,obs:l,cors:k,hooks:y,handler:v,upgrade:_,reqState:m,spanByReq:g,ctxByReq:T}=c,e=a.opts;return{buildApp:u(async()=>{const b=e.server?.keepAliveTimeout??62e4,s=(0,fastify_1.default)({logger:!1,keepAliveTimeout:b,requestTimeout:e.server?.requestTimeout??0,...e.server?.connectionTimeout!==void 0?{connectionTimeout:e.server.connectionTimeout}:{},...e.trustProxyIp?{trustProxy:Math.max(1,Math.floor(e.trustProxyHops??1))}:{},...e.tls?{https:{key:e.tls.key,cert:e.tls.cert}}:{}});s.server.headersTimeout=e.server?.headersTimeout??6e4,e.server?.connectionsCheckingInterval!==void 0&&(s.server.connectionsCheckingInterval=e.server.connectionsCheckingInterval),e.server?.maxHeadersCount!==void 0&&(s.server.maxHeadersCount=e.server.maxHeadersCount),e.server?.maxConnections!==void 0&&(s.server.maxConnections=e.server.maxConnections),s.removeAllContentTypeParsers(),s.addContentTypeParser("*",(r,t,n)=>n(null,t)),await s.register(reply_from_1.default,{disableRequestLogging:!0,undici:{connections:e.undici?.connections??256,pipelining:e.undici?.pipelining??1,keepAliveTimeout:e.undici?.keepAliveTimeout??6e4,bodyTimeout:e.undici?.bodyTimeout??0,headersTimeout:e.undici?.headersTimeout??6e4,...e.undici?.allowH2?{allowH2:!0}:{},connect:{rejectUnauthorized:e.undici?.rejectUnauthorized??!1,...e.undici?.cert?{cert:e.undici.cert}:{},...e.undici?.key?{key:e.undici.key}:{},...e.undici?.ca?{ca:e.undici.ca}:{}}}}),s.get("/livez",(r,t)=>{t.header("cache-control",edge_1.NO_STORE).type("text/plain").send("ok")}),s.get("/readyz",(r,t)=>{const n=a.table.routes.length>0;t.code(n?200:503).header("cache-control",edge_1.NO_STORE).type("text/plain").send(n?"ready":"no routes loaded")});const f=u(r=>(0,edge_1.tokenMatches)(r.query?.token??(0,edge_1.hdr)(r.raw.headers["x-status-token"]),e.statusToken),"opToken");s.get("/statusz",(r,t)=>{if(!e.statusEndpoint||!e.statusToken){t.code(404).header("cache-control",edge_1.NO_STORE).type("text/plain").send("not found");return}if(!f(r)){t.code(401).header("cache-control",edge_1.NO_STORE).type("text/plain").send("unauthorized");return}t.header("cache-control",edge_1.NO_STORE).type("application/json").send(JSON.stringify({generatedAt:Date.now(),services:l.buildStatusSnapshot(),endpoints:e.healthChecker?.snapshot()??[]}))}),s.get("/metricsz",(r,t)=>{if(!e.metrics||!e.statusToken){t.code(404).header("cache-control",edge_1.NO_STORE).type("text/plain").send("not found");return}if(!f(r)){t.code(401).header("cache-control",edge_1.NO_STORE).type("text/plain").send("unauthorized");return}t.header("cache-control",edge_1.NO_STORE).type("application/json").send(JSON.stringify(e.metrics.snapshot()))});const p=(0,body_stall_1.createBodyStallGuard)(e.server?.bodyStallMs??6e4);return s.addHook("onClose",(r,t)=>{p.stop(),t()}),s.addHook("onRequest",(r,t,n)=>{(0,trust_1.stripTrust)(r.raw),p.arm(r.raw),p.armResponse(t.raw),n()}),s.addHook("onSend",(r,t,n,o)=>{k.applyResponseCors(r,t),o(null,n)}),s.addHook("onResponse",(r,t,n)=>{const o=m.get(r);o&&(l.recordEdge(o.route,Date.now()-o.startedAt,t.statusCode??0,o.caller,o.version),l.finish(o.trace,o.route.service,t.statusCode??0,{upstream:o.upLabel,...o.version?{version:o.version}:{},...o.caller?{caller:o.caller}:{}}),m.delete(r));const d=g.get(r);d&&(e.tracing.end(d,t.statusCode??0,{...o?.upLabel?{"upstream.url":o.upLabel}:{},...o?.version?{"lensmcp.version":o.version}:{}}),g.delete(r)),e.metrics?.recordRequest(t.statusCode??0),a.accessLog&&(0,access_log_1.logAccess)(r,t,o);const i=T.get(r);i&&(i.status=t.statusCode??0,y.has("onResponse")&&y.run("onResponse",i),T.delete(r)),n()}),s.setErrorHandler((r,t,n)=>{const o=r,d=o.message??String(r);l.emit("error",`gateway request error: ${d}`,`gateway-error:${o.code??"exception"}`,{kind:"gateway-request-error",error:d,...o.code?{code:o.code}:{}});const i=typeof o.statusCode=="number"&&o.statusCode>=400&&o.statusCode<600?o.statusCode:500;(0,edge_1.sendError)(n,t.raw,i,i===400?"bad_request":"internal")}),s.setNotFoundHandler((r,t)=>{(0,edge_1.sendError)(t,r.raw,404,"not_found","No gateway route for this hostname.")}),s.all("/",v),s.all("/*",v),s.server.on("upgrade",_),s},"buildApp")}}h(createApp,"createApp"),u(createApp,"createApp");
+"use strict";var q=Object.defineProperty;var y=(i,a)=>q(i,"name",{value:a,configurable:!0});var x=Object.defineProperty,h=y((i,a)=>x(i,"name",{value:a,configurable:!0}),"h"),C=Object.defineProperty,u=h((i,a)=>C(i,"name",{value:a,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createApp=createApp;const tslib_1=require("tslib"),fastify_1=tslib_1.__importDefault(require("fastify")),reply_from_1=tslib_1.__importDefault(require("@fastify/reply-from")),edge_1=require("./edge"),trust_1=require("./trust"),body_stall_1=require("./body-stall"),access_log_1=require("./access-log");function createApp(i){const{rt:a,obs:l,cors:_,hooks:v,handler:m,upgrade:b,reqState:g,spanByReq:f,ctxByReq:T}=i,e=a.opts;return{buildApp:u(async()=>{const O=e.server?.keepAliveTimeout??62e4,n=(0,fastify_1.default)({logger:!1,keepAliveTimeout:O,requestTimeout:e.server?.requestTimeout??0,...e.server?.connectionTimeout!==void 0?{connectionTimeout:e.server.connectionTimeout}:{},...e.trustProxyIp?{trustProxy:Math.max(1,Math.floor(e.trustProxyHops??1))}:{},...e.tls?{https:{key:e.tls.key,cert:e.tls.cert}}:{}});n.server.headersTimeout=e.server?.headersTimeout??6e4,e.server?.connectionsCheckingInterval!==void 0&&(n.server.connectionsCheckingInterval=e.server.connectionsCheckingInterval),e.server?.maxHeadersCount!==void 0&&(n.server.maxHeadersCount=e.server.maxHeadersCount),e.server?.maxConnections!==void 0&&(n.server.maxConnections=e.server.maxConnections),n.removeAllContentTypeParsers(),n.addContentTypeParser("*",(r,t,s)=>s(null,t)),await n.register(reply_from_1.default,{disableRequestLogging:!0,undici:{connections:e.undici?.connections??256,pipelining:e.undici?.pipelining??1,keepAliveTimeout:e.undici?.keepAliveTimeout??6e4,bodyTimeout:e.undici?.bodyTimeout??0,headersTimeout:e.undici?.headersTimeout??6e4,...e.undici?.allowH2?{allowH2:!0}:{},connect:{rejectUnauthorized:e.undici?.rejectUnauthorized??!1,...e.undici?.cert?{cert:e.undici.cert}:{},...e.undici?.key?{key:e.undici.key}:{},...e.undici?.ca?{ca:e.undici.ca}:{}}}}),n.get("/livez",(r,t)=>{t.header("cache-control",edge_1.NO_STORE).type("text/plain").send("ok")}),n.get("/readyz",(r,t)=>{const s=a.table.routes.length>0;t.code(s?200:503).header("cache-control",edge_1.NO_STORE).type("text/plain").send(s?"ready":"no routes loaded")});const k=u(r=>(0,edge_1.tokenMatches)(r.query?.token??(0,edge_1.hdr)(r.raw.headers["x-status-token"]),e.statusToken),"opToken");n.get("/statusz",(r,t)=>{if(!e.statusEndpoint||!e.statusToken){t.code(404).header("cache-control",edge_1.NO_STORE).type("text/plain").send("not found");return}if(!k(r)){t.code(401).header("cache-control",edge_1.NO_STORE).type("text/plain").send("unauthorized");return}t.header("cache-control",edge_1.NO_STORE).type("application/json").send(JSON.stringify({generatedAt:Date.now(),services:l.buildStatusSnapshot(),endpoints:e.healthChecker?.snapshot()??[]}))}),n.get("/metricsz",(r,t)=>{if(!e.metrics||!e.statusToken){t.code(404).header("cache-control",edge_1.NO_STORE).type("text/plain").send("not found");return}if(!k(r)){t.code(401).header("cache-control",edge_1.NO_STORE).type("text/plain").send("unauthorized");return}t.header("cache-control",edge_1.NO_STORE).type("application/json").send(JSON.stringify(e.metrics.snapshot()))});const p=(0,body_stall_1.createBodyStallGuard)(e.server?.bodyStallMs??6e4);return n.addHook("onClose",(r,t)=>{p.stop(),t()}),n.addHook("onRequest",(r,t,s)=>{(0,trust_1.stripTrust)(r.raw),p.arm(r.raw),p.armResponse(t.raw),s()}),n.addHook("onSend",(r,t,s,o)=>{_.applyResponseCors(r,t),o(null,s)}),n.addHook("onResponse",(r,t,s)=>{const o=g.get(r);o&&(l.recordEdge(o.route,Date.now()-o.startedAt,t.statusCode??0,o.caller,o.version),l.finish(o.trace,o.route.service,t.statusCode??0,{upstream:o.upLabel,...o.version?{version:o.version}:{},...o.caller?{caller:o.caller}:{}}),g.delete(r));const d=f.get(r);d&&(e.tracing.end(d,t.statusCode??0,{...o?.upLabel?{"upstream.url":o.upLabel}:{},...o?.version?{"lensmcp.version":o.version}:{}}),f.delete(r)),e.metrics?.recordRequest(t.statusCode??0),a.accessLog&&(0,access_log_1.logAccess)(r,t,o);const c=T.get(r);c&&(c.status=t.statusCode??0,v.has("onResponse")&&v.run("onResponse",c),T.delete(r)),s()}),n.setErrorHandler((r,t,s)=>{const o=r,d=o.message??String(r);l.emit("error",`gateway request error: ${d}`,`gateway-error:${o.code??"exception"}`,{kind:"gateway-request-error",error:d,...o.code?{code:o.code}:{}});const c=typeof o.statusCode=="number"&&o.statusCode>=400&&o.statusCode<600?o.statusCode:500;(0,edge_1.sendError)(s,t.raw,c,c===400?"bad_request":"internal")}),n.setNotFoundHandler((r,t)=>{(0,edge_1.sendError)(t,r.raw,404,"not_found","No gateway route for this hostname.")}),n.all("/",m),n.all("/*",m),n.server.on("upgrade",b),n},"buildApp")}}y(createApp,"createApp"),h(createApp,"createApp"),u(createApp,"createApp");

package/executors/gateway/prod-runtime/auth.js

@@ -1 +1 @@
-"use strict";var f=Object.defineProperty;var l=(i,e)=>f(i,"name",{value:e,configurable:!0});var k=Object.defineProperty,o=l((i,e)=>k(i,"name",{value:e,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createEdgeAuth=createEdgeAuth;const manifest_1=require("../manifest"),trust_1=require("./trust");function createEdgeAuth(i,e,p,c){return{internal:o((r,d,s)=>{const t=r.headers["x-api-key"],u=typeof t=="string"?t:Array.isArray(t)?t[0]:void 0,a=u?i.keyToProject.get(u):void 0;return a?(r.headers["x-api-key-id"]=a,delete r.headers["x-api-key"],e.step(s,"auth",{mode:"x-api-key",ok:!0,caller:a}),{ok:!0,caller:a}):(e.step(s,"auth",{mode:"x-api-key",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Invalid or missing x-api-key for internal route."})},"internal"),public:o((r,d,s,t,u,a)=>{const h=i.table.manifestByService.get(d.service),n=h?(0,manifest_1.authRuleForPath)(h,s,r.method??"GET",!1):{mode:d.auth};if(n.mode==="jwt"){if(i.opts.identify){if(!t)return e.step(a,"auth",{mode:"jwt",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: invalid or missing token"}}else try{c("jwt",r)}catch(m){return e.step(a,"auth",{mode:"jwt",ok:!1,reason:m.message}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: invalid or missing token"}}return n.rule&&(!t||!(0,manifest_1.evalRule)(n.rule,p.buildAttrs(r,u,t,void 0)))?(e.step(a,"authz",{ok:!1}),{ok:!1,status:403,reason:"forbidden",detail:"Forbidden: insufficient permission"}):(e.step(a,"auth",{mode:"jwt",ok:!0}),t&&(0,trust_1.stampIdentity)(r,t),{ok:!0})}return e.step(a,"auth",{mode:n.mode}),{ok:!0}},"publicAuth")}}l(createEdgeAuth,"createEdgeAuth"),o(createEdgeAuth,"createEdgeAuth");
+"use strict";var v=Object.defineProperty;var h=(a,e)=>v(a,"name",{value:e,configurable:!0});var f=Object.defineProperty,l=h((a,e)=>f(a,"name",{value:e,configurable:!0}),"l"),k=Object.defineProperty,o=l((a,e)=>k(a,"name",{value:e,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createEdgeAuth=createEdgeAuth;const manifest_1=require("../manifest"),trust_1=require("./trust");function createEdgeAuth(a,e,p,m){return{internal:o((i,d,n)=>{const t=i.headers["x-api-key"],u=typeof t=="string"?t:Array.isArray(t)?t[0]:void 0,r=u?a.keyToProject.get(u):void 0;return r?(i.headers["x-api-key-id"]=r,delete i.headers["x-api-key"],e.step(n,"auth",{mode:"x-api-key",ok:!0,caller:r}),{ok:!0,caller:r}):(e.step(n,"auth",{mode:"x-api-key",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Invalid or missing x-api-key for internal route."})},"internal"),public:o((i,d,n,t,u,r)=>{const c=a.table.manifestByService.get(d.service),s=c?(0,manifest_1.authRuleForPath)(c,n,i.method??"GET",!1):{mode:d.auth};if(s.mode==="jwt"){if(a.opts.identify){if(!t)return e.step(r,"auth",{mode:"jwt",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: invalid or missing token"}}else try{m("jwt",i)}catch(y){return e.step(r,"auth",{mode:"jwt",ok:!1,reason:y.message}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: invalid or missing token"}}return s.rule&&(!t||!(0,manifest_1.evalRule)(s.rule,p.buildAttrs(i,u,t,void 0)))?(e.step(r,"authz",{ok:!1}),{ok:!1,status:403,reason:"forbidden",detail:"Forbidden: insufficient permission"}):(e.step(r,"auth",{mode:"jwt",ok:!0}),t&&(0,trust_1.stampIdentity)(i,t),{ok:!0})}return e.step(r,"auth",{mode:s.mode}),{ok:!0}},"publicAuth")}}h(createEdgeAuth,"createEdgeAuth"),l(createEdgeAuth,"createEdgeAuth"),o(createEdgeAuth,"createEdgeAuth");

package/executors/gateway/prod-runtime/body-stall.js

@@ -1 +1 @@
-"use strict";var o=Object.defineProperty;var l=(r,t)=>o(r,"name",{value:t,configurable:!0});var a=Object.defineProperty,e=l((r,t)=>a(r,"name",{value:t,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createBodyStallGuard=void 0;var body_stall_1=require("../body-stall");Object.defineProperty(exports,"createBodyStallGuard",{enumerable:!0,get:e(function(){return body_stall_1.createBodyStallGuard},"get")});
+"use strict";var u=Object.defineProperty;var d=(r,t)=>u(r,"name",{value:t,configurable:!0});var o=Object.defineProperty,l=d((r,t)=>o(r,"name",{value:t,configurable:!0}),"l"),a=Object.defineProperty,e=l((r,t)=>a(r,"name",{value:t,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createBodyStallGuard=void 0;var body_stall_1=require("../body-stall");Object.defineProperty(exports,"createBodyStallGuard",{enumerable:!0,get:e(function(){return body_stall_1.createBodyStallGuard},"get")});

package/executors/gateway/prod-runtime/cors.js

@@ -1 +1 @@
-"use strict";var i=Object.defineProperty;var n=(s,a)=>i(s,"name",{value:a,configurable:!0});var c=Object.defineProperty,t=n((s,a)=>c(s,"name",{value:a,configurable:!0}),"t");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createCors=createCors;const addVaryOrigin=t(s=>{const a=s.getHeader("vary"),e=Array.isArray(a)?a.join(", "):typeof a=="string"?a:"";if(e.trim()==="*")return;const o=e.split(",").map(r=>r.trim()).filter(Boolean);o.some(r=>r.toLowerCase()==="origin")||s.header("vary",[...o,"Origin"].join(", "))},"addVaryOrigin");function createCors(s,a){return{setCors:t((e,o)=>{const r=o.headers.origin;if(r&&s.corsCredentialOrigins.has(r.toLowerCase())){e.header("access-control-allow-origin",r),e.header("access-control-allow-credentials","true"),addVaryOrigin(e);return}e.header("access-control-allow-origin",String(r??"*")),addVaryOrigin(e)},"setCors"),applyResponseCors:t((e,o)=>{const r=e.headers.origin;r&&!o.getHeader("access-control-allow-origin")&&(s.corsCredentialOrigins.has(r.toLowerCase())?(o.header("access-control-allow-origin",r),o.header("access-control-allow-credentials","true"),addVaryOrigin(o)):a.get(e)?.proxied||(o.header("access-control-allow-origin",String(r)),addVaryOrigin(o)))},"applyResponseCors")}}n(createCors,"createCors"),t(createCors,"createCors");
+"use strict";var d=Object.defineProperty;var l=(o,e)=>d(o,"name",{value:e,configurable:!0});var i=Object.defineProperty,n=l((o,e)=>i(o,"name",{value:e,configurable:!0}),"n"),c=Object.defineProperty,t=n((o,e)=>c(o,"name",{value:e,configurable:!0}),"t");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createCors=createCors;const addVaryOrigin=t(o=>{const e=o.getHeader("vary"),a=Array.isArray(e)?e.join(", "):typeof e=="string"?e:"";if(a.trim()==="*")return;const s=a.split(",").map(r=>r.trim()).filter(Boolean);s.some(r=>r.toLowerCase()==="origin")||o.header("vary",[...s,"Origin"].join(", "))},"addVaryOrigin");function createCors(o,e){return{setCors:t((a,s)=>{const r=s.headers.origin;if(r&&o.corsCredentialOrigins.has(r.toLowerCase())){a.header("access-control-allow-origin",r),a.header("access-control-allow-credentials","true"),addVaryOrigin(a);return}a.header("access-control-allow-origin",String(r??"*")),addVaryOrigin(a)},"setCors"),applyResponseCors:t((a,s)=>{const r=a.headers.origin;r&&!s.getHeader("access-control-allow-origin")&&(o.corsCredentialOrigins.has(r.toLowerCase())?(s.header("access-control-allow-origin",r),s.header("access-control-allow-credentials","true"),addVaryOrigin(s)):e.get(a)?.proxied||(s.header("access-control-allow-origin",String(r)),addVaryOrigin(s)))},"applyResponseCors")}}l(createCors,"createCors"),n(createCors,"createCors"),t(createCors,"createCors");

package/executors/gateway/prod-runtime/edge.js

@@ -1 +1 @@
-"use strict";var p=Object.defineProperty;var i=(e,r)=>p(e,"name",{value:r,configurable:!0});var c=Object.defineProperty,t=i((e,r)=>c(e,"name",{value:r,configurable:!0}),"t");Object.defineProperty(exports,"__esModule",{value:!0}),exports.safeUrl=exports.rememberRawTarget=exports.rawTargetOf=exports.RAW_TARGET=exports.canonicalPath=exports.canonicalize=exports.ENCODED_STRUCTURE=exports.addVary=exports.tokenMatches=exports.NO_STORE=exports.sendError=exports.hdr=exports.eid=void 0;const node_crypto_1=require("node:crypto"),gateway_errors_1=require("../gateway-errors"),eid=t(()=>Date.now().toString(36)+(0,node_crypto_1.randomBytes)(6).toString("hex"),"eid");exports.eid=eid;const hdr=t(e=>typeof e=="string"&&e!==""?e:Array.isArray(e)?e[0]:void 0,"hdr");exports.hdr=hdr;const sendError=t((e,r,o,n,s)=>{const a=(0,gateway_errors_1.ensureRequestId)(r);return e.code(o).header("x-request-id",a).header("cache-control",exports.NO_STORE).type(gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE).send((0,gateway_errors_1.gatewayErrorBody)(o,n,a,s))},"sendError");exports.sendError=sendError,exports.NO_STORE="no-store";const tokenMatches=t((e,r)=>{if(!r)return!1;const o=Buffer.from(e??""),n=Buffer.from(r);return o.length===n.length&&(0,node_crypto_1.timingSafeEqual)(o,n)},"tokenMatches");exports.tokenMatches=tokenMatches;const addVary=t((e,r)=>{const o=e.vary,n=Array.isArray(o)?o.join(", "):typeof o=="string"?o:"";if(n.trim()==="*")return;const s=n.split(",").map(a=>a.trim()).filter(Boolean);s.some(a=>a.toLowerCase()===r.toLowerCase())||(e.vary=[...s,r].join(", "))},"addVary");exports.addVary=addVary;var canonical_path_1=require("../canonical-path");Object.defineProperty(exports,"ENCODED_STRUCTURE",{enumerable:!0,get:t(function(){return canonical_path_1.ENCODED_STRUCTURE},"get")}),Object.defineProperty(exports,"canonicalize",{enumerable:!0,get:t(function(){return canonical_path_1.canonicalize},"get")}),Object.defineProperty(exports,"canonicalPath",{enumerable:!0,get:t(function(){return canonical_path_1.canonicalPath},"get")}),Object.defineProperty(exports,"RAW_TARGET",{enumerable:!0,get:t(function(){return canonical_path_1.RAW_TARGET},"get")}),Object.defineProperty(exports,"rawTargetOf",{enumerable:!0,get:t(function(){return canonical_path_1.rawTargetOf},"get")}),Object.defineProperty(exports,"rememberRawTarget",{enumerable:!0,get:t(function(){return canonical_path_1.rememberRawTarget},"get")});const safeUrl=t(e=>{if(!e)return"(unset)";try{const r=new URL(e);return`${r.protocol}//${r.host}${r.pathname}`}catch{return"(set)"}},"safeUrl");exports.safeUrl=safeUrl;
+"use strict";var u=Object.defineProperty;var d=(e,r)=>u(e,"name",{value:r,configurable:!0});var p=Object.defineProperty,i=d((e,r)=>p(e,"name",{value:r,configurable:!0}),"i"),c=Object.defineProperty,t=i((e,r)=>c(e,"name",{value:r,configurable:!0}),"t");Object.defineProperty(exports,"__esModule",{value:!0}),exports.safeUrl=exports.rememberRawTarget=exports.rawTargetOf=exports.RAW_TARGET=exports.canonicalPath=exports.canonicalize=exports.ENCODED_STRUCTURE=exports.addVary=exports.tokenMatches=exports.NO_STORE=exports.sendError=exports.hdr=exports.eid=void 0;const node_crypto_1=require("node:crypto"),gateway_errors_1=require("../gateway-errors"),eid=t(()=>Date.now().toString(36)+(0,node_crypto_1.randomBytes)(6).toString("hex"),"eid");exports.eid=eid;const hdr=t(e=>typeof e=="string"&&e!==""?e:Array.isArray(e)?e[0]:void 0,"hdr");exports.hdr=hdr;const sendError=t((e,r,o,n,s)=>{const a=(0,gateway_errors_1.ensureRequestId)(r);return e.code(o).header("x-request-id",a).header("cache-control",exports.NO_STORE).type(gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE).send((0,gateway_errors_1.gatewayErrorBody)(o,n,a,s))},"sendError");exports.sendError=sendError,exports.NO_STORE="no-store";const tokenMatches=t((e,r)=>{if(!r)return!1;const o=Buffer.from(e??""),n=Buffer.from(r);return o.length===n.length&&(0,node_crypto_1.timingSafeEqual)(o,n)},"tokenMatches");exports.tokenMatches=tokenMatches;const addVary=t((e,r)=>{const o=e.vary,n=Array.isArray(o)?o.join(", "):typeof o=="string"?o:"";if(n.trim()==="*")return;const s=n.split(",").map(a=>a.trim()).filter(Boolean);s.some(a=>a.toLowerCase()===r.toLowerCase())||(e.vary=[...s,r].join(", "))},"addVary");exports.addVary=addVary;var canonical_path_1=require("../canonical-path");Object.defineProperty(exports,"ENCODED_STRUCTURE",{enumerable:!0,get:t(function(){return canonical_path_1.ENCODED_STRUCTURE},"get")}),Object.defineProperty(exports,"canonicalize",{enumerable:!0,get:t(function(){return canonical_path_1.canonicalize},"get")}),Object.defineProperty(exports,"canonicalPath",{enumerable:!0,get:t(function(){return canonical_path_1.canonicalPath},"get")}),Object.defineProperty(exports,"RAW_TARGET",{enumerable:!0,get:t(function(){return canonical_path_1.RAW_TARGET},"get")}),Object.defineProperty(exports,"rawTargetOf",{enumerable:!0,get:t(function(){return canonical_path_1.rawTargetOf},"get")}),Object.defineProperty(exports,"rememberRawTarget",{enumerable:!0,get:t(function(){return canonical_path_1.rememberRawTarget},"get")});const safeUrl=t(e=>{if(!e)return"(unset)";try{const r=new URL(e);return`${r.protocol}//${r.host}${r.pathname}`}catch{return"(set)"}},"safeUrl");exports.safeUrl=safeUrl;

package/executors/gateway/prod-runtime/handler.js

@@ -1 +1 @@
-"use strict";var J=Object.defineProperty;var H=(y,n)=>J(y,"name",{value:n,configurable:!0});var G=Object.defineProperty,v=H((y,n)=>G(y,"name",{value:n,configurable:!0}),"v");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHandler=createHandler;const manifest_1=require("../manifest"),gateway_errors_1=require("../gateway-errors"),edge_1=require("./edge");function createHandler(y){const{rt:n,obs:d,cors:_,auth:N,upstream:L,rollout:w,hooks:p,reqState:U,spanByReq:$,ctxByReq:D}=y,M=!!n.opts.pods?.resolveVersion,q=!!n.opts.cookie?.secret,C=!!n.opts.pods?.bucket&&(q||!!n.opts.uidHeader),V=M||q||C,B=n.opts.upstreamRetries??1,F=v(l=>(0,edge_1.tokenMatches)(l.query?.token??(0,edge_1.hdr)(l.raw.headers["x-status-token"]),n.opts.statusToken),"statusTokenMatches"),K=v((l,o,e,f,m)=>{const a=l.raw;if(_.setCors(o,a),o.header("cache-control",edge_1.NO_STORE),a.method==="OPTIONS"){o.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(a.headers["access-control-request-headers"]??"*")).send();return}const s=n.table.routes.filter(i=>i.host&&(0,manifest_1.hostMatches)(i.host,e)&&i.prefix),h=m;if(s.length>0&&(h==="/health"||h==="/healthz")){o.code(200).type("application/json").send(JSON.stringify({status:"ok",host:e,services:s.map(i=>({service:i.service,prefix:i.prefix}))}));return}if(h==="/.well-known/lensmcp-routes"){if(!F(l)){(0,edge_1.sendError)(o,a,404,"not_found","No gateway route for this hostname.");return}o.code(200).type("application/json").send(JSON.stringify({host:e,routes:n.table.routes.filter(i=>!i.host||(0,manifest_1.hostMatches)(i.host,e)).map(i=>({host:i.host??"(default)",service:i.service,prefix:i.prefix,internal:!!i.internal,auth:i.auth}))}));return}(0,edge_1.sendError)(o,a,404,"not_found",s.length>0?`No service mounted at ${f} on ${e}.`:"No gateway route for this hostname.")},"handleNoRoute");return async(l,o)=>{const e=l.raw,f=(e.headers.host||"").split(":")[0],m=e.url??"/",a=d.beginTrace(e);(0,gateway_errors_1.ensureRequestId)(e),d.step(a,"received",{host:f,method:e.method,url:m});const s=p.any?p.httpContext(e,l,o,a):void 0;if(s&&D.set(l,s),s&&p.has("onRequest")&&(await p.run("onRequest",s),s.responded()))return o;if(e.httpVersionMajor<1)return d.finish(a,"gateway",400),(0,edge_1.sendError)(o,e,400,"bad_request","Bad Request");const h=(0,edge_1.canonicalize)(m);if(h===void 0)return d.step(a,"bad-path",{}),d.finish(a,"gateway",400),(0,edge_1.sendError)(o,e,400,"bad_request","Bad Request");const i=h.policy,b=h.path+h.query;b!==m&&(0,edge_1.rememberRawTarget)(e,m),e.url=b;const j=e.socket?.remoteAddress??l.ip,T=w.clientIpOf(e,j);if(n.opts.rateLimiter){const r=await n.opts.rateLimiter.check(T);if(!r.allowed)return o.header("retry-after",String(Math.ceil(r.retryAfterMs/1e3))),d.step(a,"rate-limited",{}),d.finish(a,"gateway",429),(0,edge_1.sendError)(o,e,429,"rate_limited","Too Many Requests")}const t=(0,manifest_1.matchRoute)(n.table.routes,f,i+h.query);if(!t)return K(l,o,f,b,i),o;if(s&&(s.route=t),d.step(a,"route-match",{project:t.service,...t.prefix?{prefix:t.prefix}:{},...t.internal?{internal:!0}:{}}),e.method==="OPTIONS")return _.setCors(o,e),o.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(e.headers["access-control-request-headers"]??"*")).send(),o;const k=n.opts.tracing?.startSpan(e,`gateway ${t.service}`,{"http.request.method":e.method??"GET","url.path":b.split("?")[0],"server.address":f,"lensmcp.service":t.service,...t.internal?{"lensmcp.internal":!0}:{}});if(k&&$.set(l,k),s&&p.has("beforeAuth")&&(await p.run("beforeAuth",s),s.responded()))return o;const O=t.internal?void 0:n.opts.identify?.(e);let S;if(t.internal){const r=N.internal(e,t,a);if(!r.ok)return d.finish(a,t.service,r.status),(0,edge_1.sendError)(o,e,r.status,r.reason,r.detail);S=r.caller,s&&(s.caller=S)}else{const r=N.public(e,t,i,O,T,a);if(!r.ok)return d.finish(a,t.service,r.status),(0,edge_1.sendError)(o,e,r.status,r.reason,r.detail);if(s&&(s.claims=O),s&&p.has("afterAuth")&&(await p.run("afterAuth",s),s.responded()))return o}if(e.headers["x-forwarded-for"]=w.forwardedFor(e,j),e.headers["x-forwarded-proto"]=n.opts.tls?"https":"http",e.headers["x-forwarded-host"]=e.headers.host??f,n.opts.serviceKeys?.[t.service]&&(e.headers["x-internal-token"]=n.opts.serviceKeys[t.service]),t.prependPrefix){const r=e.url??"/",c=t.prependPrefix;r!==c&&!r.startsWith(c+"/")&&(e.url=c+r)}const x=(0,edge_1.hdr)(e.headers[n.versionHeader]);let P=x,R=!1,E;if(V&&!t.internal&&!x){const r=w.resolveStickyKey(e);r.mint&&(E=r.key);const c=M?n.opts.pods.resolveVersion(t.service,w.buildAttrs(e,T,O,r.key)):void 0;if(c)P=c.version,R=!0,d.step(a,"targeting",{rule:c.rule,version:c.version});else if(r.key){const g=n.opts.pods?.bucket?.(t.service,r.key);g&&(P=g.version,R=!0,d.step(a,"targeting",{mode:"sticky",version:g.version}))}}const u=await L.resolveUpstream(t,a,P,R);if(!u)return d.finish(a,t.service,503),(0,edge_1.sendError)(o,e,503,"unavailable",`Service ${t.service} has no available upstream.`);if(!("url"in u))return d.finish(a,t.service,502),(0,edge_1.sendError)(o,e,502,"unavailable",`Service ${t.service}: socket upstreams are not supported by the prod gateway.`);const z=new URL(u.url).origin,A=u.url,I={route:t,caller:S,startedAt:Date.now(),trace:a,version:u.version,upLabel:A};return U.set(l,I),s&&(s.version=u.version),d.step(a,u.version?"rollout":"upstream",{upstream:A,...u.version?{version:u.version,...x?{pinned:!0}:{}}:{}}),k&&n.opts.tracing.inject(k,e.headers),s&&p.has("beforeForward")&&(await p.run("beforeForward",s),s.responded())?o:o.from(void 0,{getUpstream:v(()=>z,"getUpstream"),retriesCount:B,rewriteHeaders:v(r=>{if(I.proxied=!0,a&&(r["x-lensmcp-upstream"]=A),r["x-request-id"]||(r["x-request-id"]=(0,gateway_errors_1.ensureRequestId)(e)),u.version&&(r["x-lensmcp-version"]=u.version),(x||u.version)&&(0,edge_1.addVary)(r,n.versionHeader),(E||C&&q)&&(0,edge_1.addVary)(r,"Cookie"),delete r["x-powered-by"],delete r.connection,delete r["keep-alive"],delete r["proxy-connection"],r.server="LensMCP",E){const c=r["set-cookie"],g=Array.isArray(c)?c:c?[c]:[];r["set-cookie"]=[...g,w.mintCookieHeader(E)]}return r},"rewriteHeaders"),onError:v((r,{error:c})=>{n.opts.pods?.drop?.(t.service,u),s&&p.has("onError")&&(s.error=c,p.run("onError",s)),(0,edge_1.sendError)(r,e,502,"unavailable",`Upstream ${t.service} unavailable.`)},"onError")})}}H(createHandler,"createHandler"),v(createHandler,"createHandler");
+"use strict";var Q=Object.defineProperty;var _=(f,o)=>Q(f,"name",{value:o,configurable:!0});var J=Object.defineProperty,H=_((f,o)=>J(f,"name",{value:o,configurable:!0}),"H"),G=Object.defineProperty,v=H((f,o)=>G(f,"name",{value:o,configurable:!0}),"v");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHandler=createHandler;const manifest_1=require("../manifest"),gateway_errors_1=require("../gateway-errors"),edge_1=require("./edge");function createHandler(f){const{rt:o,obs:d,cors:N,auth:M,upstream:U,rollout:w,hooks:p,reqState:$,spanByReq:D,ctxByReq:V}=f,C=!!o.opts.pods?.resolveVersion,q=!!o.opts.cookie?.secret,j=!!o.opts.pods?.bucket&&(q||!!o.opts.uidHeader),B=C||q||j,F=o.opts.upstreamRetries??1,K=v(u=>(0,edge_1.tokenMatches)(u.query?.token??(0,edge_1.hdr)(u.raw.headers["x-status-token"]),o.opts.statusToken),"statusTokenMatches"),z=v((u,a,e,m,y)=>{const n=u.raw;if(N.setCors(a,n),a.header("cache-control",edge_1.NO_STORE),n.method==="OPTIONS"){a.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(n.headers["access-control-request-headers"]??"*")).send();return}const s=o.table.routes.filter(i=>i.host&&(0,manifest_1.hostMatches)(i.host,e)&&i.prefix),h=y;if(s.length>0&&(h==="/health"||h==="/healthz")){a.code(200).type("application/json").send(JSON.stringify({status:"ok",host:e,services:s.map(i=>({service:i.service,prefix:i.prefix}))}));return}if(h==="/.well-known/lensmcp-routes"){if(!K(u)){(0,edge_1.sendError)(a,n,404,"not_found","No gateway route for this hostname.");return}a.code(200).type("application/json").send(JSON.stringify({host:e,routes:o.table.routes.filter(i=>!i.host||(0,manifest_1.hostMatches)(i.host,e)).map(i=>({host:i.host??"(default)",service:i.service,prefix:i.prefix,internal:!!i.internal,auth:i.auth}))}));return}(0,edge_1.sendError)(a,n,404,"not_found",s.length>0?`No service mounted at ${m} on ${e}.`:"No gateway route for this hostname.")},"handleNoRoute");return async(u,a)=>{const e=u.raw,m=(e.headers.host||"").split(":")[0],y=e.url??"/",n=d.beginTrace(e);(0,gateway_errors_1.ensureRequestId)(e),d.step(n,"received",{host:m,method:e.method,url:y});const s=p.any?p.httpContext(e,u,a,n):void 0;if(s&&V.set(u,s),s&&p.has("onRequest")&&(await p.run("onRequest",s),s.responded()))return a;if(e.httpVersionMajor<1)return d.finish(n,"gateway",400),(0,edge_1.sendError)(a,e,400,"bad_request","Bad Request");const h=(0,edge_1.canonicalize)(y);if(h===void 0)return d.step(n,"bad-path",{}),d.finish(n,"gateway",400),(0,edge_1.sendError)(a,e,400,"bad_request","Bad Request");const i=h.policy,b=h.path+h.query;b!==y&&(0,edge_1.rememberRawTarget)(e,y),e.url=b;const I=e.socket?.remoteAddress??u.ip,T=w.clientIpOf(e,I);if(o.opts.rateLimiter){const r=await o.opts.rateLimiter.check(T);if(!r.allowed)return a.header("retry-after",String(Math.ceil(r.retryAfterMs/1e3))),d.step(n,"rate-limited",{}),d.finish(n,"gateway",429),(0,edge_1.sendError)(a,e,429,"rate_limited","Too Many Requests")}const t=(0,manifest_1.matchRoute)(o.table.routes,m,i+h.query);if(!t)return z(u,a,m,b,i),a;if(s&&(s.route=t),d.step(n,"route-match",{project:t.service,...t.prefix?{prefix:t.prefix}:{},...t.internal?{internal:!0}:{}}),e.method==="OPTIONS")return N.setCors(a,e),a.code(204).header("access-control-allow-methods","GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS").header("access-control-allow-headers",String(e.headers["access-control-request-headers"]??"*")).send(),a;const k=o.opts.tracing?.startSpan(e,`gateway ${t.service}`,{"http.request.method":e.method??"GET","url.path":b.split("?")[0],"server.address":m,"lensmcp.service":t.service,...t.internal?{"lensmcp.internal":!0}:{}});if(k&&D.set(u,k),s&&p.has("beforeAuth")&&(await p.run("beforeAuth",s),s.responded()))return a;const O=t.internal?void 0:o.opts.identify?.(e);let S;if(t.internal){const r=M.internal(e,t,n);if(!r.ok)return d.finish(n,t.service,r.status),(0,edge_1.sendError)(a,e,r.status,r.reason,r.detail);S=r.caller,s&&(s.caller=S)}else{const r=M.public(e,t,i,O,T,n);if(!r.ok)return d.finish(n,t.service,r.status),(0,edge_1.sendError)(a,e,r.status,r.reason,r.detail);if(s&&(s.claims=O),s&&p.has("afterAuth")&&(await p.run("afterAuth",s),s.responded()))return a}if(e.headers["x-forwarded-for"]=w.forwardedFor(e,I),e.headers["x-forwarded-proto"]=o.opts.tls?"https":"http",e.headers["x-forwarded-host"]=e.headers.host??m,o.opts.serviceKeys?.[t.service]&&(e.headers["x-internal-token"]=o.opts.serviceKeys[t.service]),t.prependPrefix){const r=e.url??"/",c=t.prependPrefix;r!==c&&!r.startsWith(c+"/")&&(e.url=c+r)}const x=(0,edge_1.hdr)(e.headers[o.versionHeader]);let P=x,R=!1,E;if(B&&!t.internal&&!x){const r=w.resolveStickyKey(e);r.mint&&(E=r.key);const c=C?o.opts.pods.resolveVersion(t.service,w.buildAttrs(e,T,O,r.key)):void 0;if(c)P=c.version,R=!0,d.step(n,"targeting",{rule:c.rule,version:c.version});else if(r.key){const g=o.opts.pods?.bucket?.(t.service,r.key);g&&(P=g.version,R=!0,d.step(n,"targeting",{mode:"sticky",version:g.version}))}}const l=await U.resolveUpstream(t,n,P,R);if(!l)return d.finish(n,t.service,503),(0,edge_1.sendError)(a,e,503,"unavailable",`Service ${t.service} has no available upstream.`);if(!("url"in l))return d.finish(n,t.service,502),(0,edge_1.sendError)(a,e,502,"unavailable",`Service ${t.service}: socket upstreams are not supported by the prod gateway.`);const W=new URL(l.url).origin,A=l.url,L={route:t,caller:S,startedAt:Date.now(),trace:n,version:l.version,upLabel:A};return $.set(u,L),s&&(s.version=l.version),d.step(n,l.version?"rollout":"upstream",{upstream:A,...l.version?{version:l.version,...x?{pinned:!0}:{}}:{}}),k&&o.opts.tracing.inject(k,e.headers),s&&p.has("beforeForward")&&(await p.run("beforeForward",s),s.responded())?a:a.from(void 0,{getUpstream:v(()=>W,"getUpstream"),retriesCount:F,rewriteHeaders:v(r=>{if(L.proxied=!0,n&&(r["x-lensmcp-upstream"]=A),r["x-request-id"]||(r["x-request-id"]=(0,gateway_errors_1.ensureRequestId)(e)),l.version&&(r["x-lensmcp-version"]=l.version),(x||l.version)&&(0,edge_1.addVary)(r,o.versionHeader),(E||j&&q)&&(0,edge_1.addVary)(r,"Cookie"),delete r["x-powered-by"],delete r.connection,delete r["keep-alive"],delete r["proxy-connection"],r.server="LensMCP",E){const c=r["set-cookie"],g=Array.isArray(c)?c:c?[c]:[];r["set-cookie"]=[...g,w.mintCookieHeader(E)]}return r},"rewriteHeaders"),onError:v((r,{error:c})=>{o.opts.pods?.drop?.(t.service,l),s&&p.has("onError")&&(s.error=c,p.run("onError",s)),(0,edge_1.sendError)(r,e,502,"unavailable",`Upstream ${t.service} unavailable.`)},"onError")})}}_(createHandler,"createHandler"),H(createHandler,"createHandler"),v(createHandler,"createHandler");

package/executors/gateway/prod-runtime/hooks.js

@@ -1 +1 @@
-"use strict";var f=Object.defineProperty;var i=(t,d)=>f(t,"name",{value:d,configurable:!0});var l=Object.defineProperty,n=i((t,d)=>l(t,"name",{value:d,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHooks=createHooks;const edge_1=require("./edge"),TERMINAL_PHASES=new Set(["onResponse","onError"]);function createHooks(t){const d=n(async(e,o)=>{const r=t[e];if(!r||r.length===0)return;const s=TERMINAL_PHASES.has(e);for(const a of r){if(!s&&o.responded())return;await a(o)}},"run"),u=n(e=>(t[e]?.length??0)>0,"has");return{any:["onRequest","beforeAuth","afterAuth","beforeForward","onResponse","onError","onUpgrade"].some(e=>u(e)),run:d,has:u,httpContext:n((e,o,r,s)=>{let a=!1;return{req:e,request:o,reply:r,socket:void 0,trace:s,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n((c,v,p)=>{(0,edge_1.sendError)(r,e,c,v,p),a=!0},"sendError"),responded:n(()=>a||r.raw.writableEnded,"responded")}},"httpContext"),upgradeContext:n((e,o,r)=>{let s=!1;return{req:e,request:void 0,reply:void 0,socket:o,trace:r,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n(()=>{try{o.destroy()}catch{}s=!0},"sendError"),responded:n(()=>s||o.destroyed,"responded")}},"upgradeContext")}}i(createHooks,"createHooks"),n(createHooks,"createHooks");
+"use strict";var y=Object.defineProperty;var u=(o,s)=>y(o,"name",{value:s,configurable:!0});var f=Object.defineProperty,i=u((o,s)=>f(o,"name",{value:s,configurable:!0}),"i"),l=Object.defineProperty,n=i((o,s)=>l(o,"name",{value:s,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHooks=createHooks;const edge_1=require("./edge"),TERMINAL_PHASES=new Set(["onResponse","onError"]);function createHooks(o){const s=n(async(e,t)=>{const r=o[e];if(!r||r.length===0)return;const d=TERMINAL_PHASES.has(e);for(const a of r){if(!d&&t.responded())return;await a(t)}},"run"),c=n(e=>(o[e]?.length??0)>0,"has");return{any:["onRequest","beforeAuth","afterAuth","beforeForward","onResponse","onError","onUpgrade"].some(e=>c(e)),run:s,has:c,httpContext:n((e,t,r,d)=>{let a=!1;return{req:e,request:t,reply:r,socket:void 0,trace:d,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n((v,p,h)=>{(0,edge_1.sendError)(r,e,v,p,h),a=!0},"sendError"),responded:n(()=>a||r.raw.writableEnded,"responded")}},"httpContext"),upgradeContext:n((e,t,r)=>{let d=!1;return{req:e,request:void 0,reply:void 0,socket:t,trace:r,route:void 0,caller:void 0,claims:void 0,version:void 0,error:void 0,status:void 0,sendError:n(()=>{try{t.destroy()}catch{}d=!0},"sendError"),responded:n(()=>d||t.destroyed,"responded")}},"upgradeContext")}}u(createHooks,"createHooks"),i(createHooks,"createHooks"),n(createHooks,"createHooks");

package/executors/gateway/prod-runtime/observability.js

@@ -1 +1 @@
-"use strict";var b=Object.defineProperty;var p=(o,d)=>b(o,"name",{value:d,configurable:!0});var y=Object.defineProperty,c=p((o,d)=>y(o,"name",{value:d,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createObservability=createObservability;const redact_1=require("@lensmcp/core/redact"),edge_1=require("./edge");function createObservability(o,d){const v=c((e,t,s,r,a)=>{if(o.emit)try{o.emit({id:(0,edge_1.eid)(),sessionId:"pending",timestamp:Date.now(),source:"gateway",category:"cluster",severity:e,context:(0,redact_1.redactDeep)({sessionId:"pending",...a}),fingerprint:s,title:(0,redact_1.safeTitle)(t),raw:r&&(0,redact_1.redactDeep)(r)})}catch{}},"emit"),h=new Map,q=c((e,t,s,r,a)=>{const n=e.host??"(default)",u=(r?r+"\u21D2":"")+n+"\u2192"+e.service+(a?"@"+a:""),i=h.get(u)??{host:n,service:e.service,caller:r,version:a,count:0,totalMs:0,errors:0};i.count+=1,i.totalMs+=t,(s>=500||s===0)&&(i.errors+=1),h.set(u,i)},"recordEdge"),m=Math.max(1,o.statusWindows??12),f=[],w=new Map,M=c(()=>[...new Set(d().map(e=>e.service))],"routeServices"),S=c(()=>{const e=new Map;for(const s of h.values()){const r=e.get(s.service)??{requests:0,errors:0,totalMs:0,versions:new Set};r.requests+=s.count,r.errors+=s.errors,r.totalMs+=s.totalMs,s.version&&r.versions.add(s.version),e.set(s.service,r)}const t=Date.now();for(const[s,r]of e)r.requests>0&&w.set(s,t);for(f.push(e);f.length>m;)f.shift()},"pushStatusWindow"),g=c(()=>{const e=new Map;for(const s of f)for(const[r,a]of s){const n=e.get(r)??{requests:0,errors:0,totalMs:0,versions:new Set};n.requests+=a.requests,n.errors+=a.errors,n.totalMs+=a.totalMs;for(const u of a.versions)n.versions.add(u);e.set(r,n)}const t=d();return M().map(s=>{const r=e.get(s)??{requests:0,errors:0,totalMs:0,versions:new Set},a=[...new Set(t.filter(i=>i.service===s).map(i=>i.host??"(default)"))],n=r.requests?r.errors/r.requests:0;let u=r.requests===0?"idle":n>=.5?"down":n>=.05?"degraded":"healthy";if(o.healthChecker){const i=t.filter(l=>l.service===s&&l.upstream).map(l=>l.upstream);i.length&&i.every(l=>!o.healthChecker.isHealthy(l))&&(u="down")}return{service:s,hosts:a,status:u,requests:r.requests,errorRate:+n.toFixed(4),avgMs:r.requests?Math.round(r.totalMs/r.requests):0,versions:[...r.versions],lastSeen:w.get(s)??null}})},"buildStatusSnapshot");return{emit:v,beginTrace:c(e=>{if(!o.emit)return;const t=(0,edge_1.hdr)(e.headers["x-lensmcp-flow-id"]);let s=(0,edge_1.hdr)(e.headers["x-request-id"]);if(!(!t&&!s&&!(0,edge_1.hdr)(e.headers.traceparent)))return s||(s=(0,edge_1.eid)(),e.headers["x-request-id"]=s),{startedAt:Date.now(),method:(e.method??"GET").toUpperCase(),host:(e.headers.host||"").split(":")[0],url:e.url??"/",steps:[],...t?{flowId:t}:{},...s?{requestId:s}:{}}},"beginTrace"),step:c((e,t,s)=>{e&&e.steps.push({step:t,atMs:Date.now()-e.startedAt,...s})},"step"),finish:c((e,t,s,r)=>{!e||e.done||(e.done=!0,v(s>=500?"error":"info",`gateway ${e.method} ${e.host}${e.url} \u2192 ${s} (${Date.now()-e.startedAt}ms)`,`gateway-request:${t}`,{kind:"gateway-request",project:t,host:e.host,method:e.method,url:e.url,status:s,durationMs:Date.now()-e.startedAt,startedAt:e.startedAt,steps:e.steps,...r},{...e.flowId?{flowId:e.flowId}:{},...e.requestId?{requestId:e.requestId}:{}}))},"finish"),recordEdge:q,buildStatusSnapshot:g,startFlusher:c(()=>{const e=setInterval(()=>{if(S(),o.onStatus)try{o.onStatus(g())}catch{}if(o.emit)for(const t of h.values())v(t.errors?"warning":"info",`traffic ${t.host} \u2192 ${t.service}${t.version?"@"+t.version:""}: ${t.count} req`,`gateway-traffic:${t.host}->${t.service}${t.version?"@"+t.version:""}`,{kind:"gateway-traffic",host:t.host,project:t.service,caller:t.caller,version:t.version,count:t.count,avgMs:Math.round(t.totalMs/t.count),errors:t.errors});h.clear()},o.trafficFlushMs??5e3);return e.unref?.(),e},"startFlusher")}}p(createObservability,"createObservability"),c(createObservability,"createObservability");
+"use strict";var I=Object.defineProperty;var w=(o,u)=>I(o,"name",{value:u,configurable:!0});var b=Object.defineProperty,p=w((o,u)=>b(o,"name",{value:u,configurable:!0}),"p"),y=Object.defineProperty,c=p((o,u)=>y(o,"name",{value:u,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createObservability=createObservability;const redact_1=require("@lensmcp/core/redact"),edge_1=require("./edge");function createObservability(o,u){const v=c((e,t,s,r,a)=>{if(o.emit)try{o.emit({id:(0,edge_1.eid)(),sessionId:"pending",timestamp:Date.now(),source:"gateway",category:"cluster",severity:e,context:(0,redact_1.redactDeep)({sessionId:"pending",...a}),fingerprint:s,title:(0,redact_1.safeTitle)(t),raw:r&&(0,redact_1.redactDeep)(r)})}catch{}},"emit"),h=new Map,q=c((e,t,s,r,a)=>{const n=e.host??"(default)",d=(r?r+"\u21D2":"")+n+"\u2192"+e.service+(a?"@"+a:""),i=h.get(d)??{host:n,service:e.service,caller:r,version:a,count:0,totalMs:0,errors:0};i.count+=1,i.totalMs+=t,(s>=500||s===0)&&(i.errors+=1),h.set(d,i)},"recordEdge"),M=Math.max(1,o.statusWindows??12),f=[],g=new Map,S=c(()=>[...new Set(u().map(e=>e.service))],"routeServices"),$=c(()=>{const e=new Map;for(const s of h.values()){const r=e.get(s.service)??{requests:0,errors:0,totalMs:0,versions:new Set};r.requests+=s.count,r.errors+=s.errors,r.totalMs+=s.totalMs,s.version&&r.versions.add(s.version),e.set(s.service,r)}const t=Date.now();for(const[s,r]of e)r.requests>0&&g.set(s,t);for(f.push(e);f.length>M;)f.shift()},"pushStatusWindow"),m=c(()=>{const e=new Map;for(const s of f)for(const[r,a]of s){const n=e.get(r)??{requests:0,errors:0,totalMs:0,versions:new Set};n.requests+=a.requests,n.errors+=a.errors,n.totalMs+=a.totalMs;for(const d of a.versions)n.versions.add(d);e.set(r,n)}const t=u();return S().map(s=>{const r=e.get(s)??{requests:0,errors:0,totalMs:0,versions:new Set},a=[...new Set(t.filter(i=>i.service===s).map(i=>i.host??"(default)"))],n=r.requests?r.errors/r.requests:0;let d=r.requests===0?"idle":n>=.5?"down":n>=.05?"degraded":"healthy";if(o.healthChecker){const i=t.filter(l=>l.service===s&&l.upstream).map(l=>l.upstream);i.length&&i.every(l=>!o.healthChecker.isHealthy(l))&&(d="down")}return{service:s,hosts:a,status:d,requests:r.requests,errorRate:+n.toFixed(4),avgMs:r.requests?Math.round(r.totalMs/r.requests):0,versions:[...r.versions],lastSeen:g.get(s)??null}})},"buildStatusSnapshot");return{emit:v,beginTrace:c(e=>{if(!o.emit)return;const t=(0,edge_1.hdr)(e.headers["x-lensmcp-flow-id"]);let s=(0,edge_1.hdr)(e.headers["x-request-id"]);if(!(!t&&!s&&!(0,edge_1.hdr)(e.headers.traceparent)))return s||(s=(0,edge_1.eid)(),e.headers["x-request-id"]=s),{startedAt:Date.now(),method:(e.method??"GET").toUpperCase(),host:(e.headers.host||"").split(":")[0],url:e.url??"/",steps:[],...t?{flowId:t}:{},...s?{requestId:s}:{}}},"beginTrace"),step:c((e,t,s)=>{e&&e.steps.push({step:t,atMs:Date.now()-e.startedAt,...s})},"step"),finish:c((e,t,s,r)=>{!e||e.done||(e.done=!0,v(s>=500?"error":"info",`gateway ${e.method} ${e.host}${e.url} \u2192 ${s} (${Date.now()-e.startedAt}ms)`,`gateway-request:${t}`,{kind:"gateway-request",project:t,host:e.host,method:e.method,url:e.url,status:s,durationMs:Date.now()-e.startedAt,startedAt:e.startedAt,steps:e.steps,...r},{...e.flowId?{flowId:e.flowId}:{},...e.requestId?{requestId:e.requestId}:{}}))},"finish"),recordEdge:q,buildStatusSnapshot:m,startFlusher:c(()=>{const e=setInterval(()=>{if($(),o.onStatus)try{o.onStatus(m())}catch{}if(o.emit)for(const t of h.values())v(t.errors?"warning":"info",`traffic ${t.host} \u2192 ${t.service}${t.version?"@"+t.version:""}: ${t.count} req`,`gateway-traffic:${t.host}->${t.service}${t.version?"@"+t.version:""}`,{kind:"gateway-traffic",host:t.host,project:t.service,caller:t.caller,version:t.version,count:t.count,avgMs:Math.round(t.totalMs/t.count),errors:t.errors});h.clear()},o.trafficFlushMs??5e3);return e.unref?.(),e},"startFlusher")}}w(createObservability,"createObservability"),p(createObservability,"createObservability"),c(createObservability,"createObservability");

package/executors/gateway/prod-runtime/rollout.js

@@ -1 +1 @@
-"use strict";var b=Object.defineProperty;var d=(o,s)=>b(o,"name",{value:s,configurable:!0});var H=Object.defineProperty,c=d((o,s)=>H(o,"name",{value:s,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRollout=createRollout;const node_crypto_1=require("node:crypto"),client_ip_1=require("../client-ip"),edge_1=require("./edge");function createRollout(o){const s=(0,client_ip_1.createClientIpResolver)({...o.clientIpHeader?{clientIpHeader:o.clientIpHeader}:{},...o.clientIpTrustedProxies?{clientIpTrustedProxies:o.clientIpTrustedProxies}:{},trustProxyHops:o.trustProxyIp?Math.max(1,Math.floor(o.trustProxyHops??1)):0}),h=s.clientIpOf,I=s.forwardedFor,g=(o.attributeHeaders??[]).map(e=>e.toLowerCase()),l=o.uidHeader?.toLowerCase(),a=o.cookie?.secret,u=!!o.cookie&&!!a,p=o.cookie?.name??"lensmcp_did",f=o.cookie?.domain,x=o.cookie?.maxAge??31536e3;o.cookie&&!a&&console.warn("[gateway] device cookie has NO secret \u2014 sticky cookie bucketing is DISABLED (set cookie.secret / LENSMCP_GW_COOKIE_SECRET to enable it). An unsigned cookie is attacker-choosable.");const m=c(e=>(0,node_crypto_1.createHmac)("sha256",a).update(e).digest("base64url"),"signId"),C=c(e=>`${e}.${m(e)}`,"signedCookie"),v=c(e=>{if(!a)return;const r=e.lastIndexOf(".");if(r<0)return;const t=e.slice(0,r),n=Buffer.from(e.slice(r+1)),i=Buffer.from(m(t));return n.length===i.length&&(0,node_crypto_1.timingSafeEqual)(n,i)?t:void 0},"verifyCookie"),_=c((e,r)=>{if(e)for(const t of e.split(";")){const n=t.indexOf("=");if(n>0&&t.slice(0,n).trim()===r){const i=t.slice(n+1).trim();try{return decodeURIComponent(i)}catch{return}}}},"parseCookie");return{clientIpOf:h,forwardedFor:I,buildAttrs:c((e,r,t,n)=>{const i={...t??{}};i.ip=r,i.method=(e.method??"GET").toUpperCase(),i.path=(e.url??"/").split("?")[0],n&&(i.device=n);for(const k of g){const y=(0,edge_1.hdr)(e.headers[k]);y!==void 0&&(i["header."+k]=y)}return i},"buildAttrs"),resolveStickyKey:c(e=>{if(u){const r=_(e.headers.cookie,p),t=r?v(r):void 0;if(t)return{key:t,mint:!1}}if(l){const r=(0,edge_1.hdr)(e.headers[l]);if(r)return{key:r,mint:!1}}return u?{key:"d_"+(0,node_crypto_1.randomBytes)(12).toString("base64url"),mint:!0}:{mint:!1}},"resolveStickyKey"),mintCookieHeader:c(e=>{let r=`${p}=${encodeURIComponent(C(e))}; Path=/; Max-Age=${x}; HttpOnly; SameSite=Lax; Secure`;return f&&(r+=`; Domain=${f}`),r},"mintCookieHeader")}}d(createRollout,"createRollout"),c(createRollout,"createRollout");
+"use strict";var P=Object.defineProperty;var l=(t,s)=>P(t,"name",{value:s,configurable:!0});var b=Object.defineProperty,d=l((t,s)=>b(t,"name",{value:s,configurable:!0}),"d"),H=Object.defineProperty,c=d((t,s)=>H(t,"name",{value:s,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRollout=createRollout;const node_crypto_1=require("node:crypto"),client_ip_1=require("../client-ip"),edge_1=require("./edge");function createRollout(t){const s=(0,client_ip_1.createClientIpResolver)({...t.clientIpHeader?{clientIpHeader:t.clientIpHeader}:{},...t.clientIpTrustedProxies?{clientIpTrustedProxies:t.clientIpTrustedProxies}:{},trustProxyHops:t.trustProxyIp?Math.max(1,Math.floor(t.trustProxyHops??1)):0}),g=s.clientIpOf,I=s.forwardedFor,v=(t.attributeHeaders??[]).map(e=>e.toLowerCase()),u=t.uidHeader?.toLowerCase(),a=t.cookie?.secret,p=!!t.cookie&&!!a,f=t.cookie?.name??"lensmcp_did",m=t.cookie?.domain,x=t.cookie?.maxAge??31536e3;t.cookie&&!a&&console.warn("[gateway] device cookie has NO secret \u2014 sticky cookie bucketing is DISABLED (set cookie.secret / LENSMCP_GW_COOKIE_SECRET to enable it). An unsigned cookie is attacker-choosable.");const k=c(e=>(0,node_crypto_1.createHmac)("sha256",a).update(e).digest("base64url"),"signId"),C=c(e=>`${e}.${k(e)}`,"signedCookie"),_=c(e=>{if(!a)return;const r=e.lastIndexOf(".");if(r<0)return;const o=e.slice(0,r),n=Buffer.from(e.slice(r+1)),i=Buffer.from(k(o));return n.length===i.length&&(0,node_crypto_1.timingSafeEqual)(n,i)?o:void 0},"verifyCookie"),O=c((e,r)=>{if(e)for(const o of e.split(";")){const n=o.indexOf("=");if(n>0&&o.slice(0,n).trim()===r){const i=o.slice(n+1).trim();try{return decodeURIComponent(i)}catch{return}}}},"parseCookie");return{clientIpOf:g,forwardedFor:I,buildAttrs:c((e,r,o,n)=>{const i={...o??{}};i.ip=r,i.method=(e.method??"GET").toUpperCase(),i.path=(e.url??"/").split("?")[0],n&&(i.device=n);for(const y of v){const h=(0,edge_1.hdr)(e.headers[y]);h!==void 0&&(i["header."+y]=h)}return i},"buildAttrs"),resolveStickyKey:c(e=>{if(p){const r=O(e.headers.cookie,f),o=r?_(r):void 0;if(o)return{key:o,mint:!1}}if(u){const r=(0,edge_1.hdr)(e.headers[u]);if(r)return{key:r,mint:!1}}return p?{key:"d_"+(0,node_crypto_1.randomBytes)(12).toString("base64url"),mint:!0}:{mint:!1}},"resolveStickyKey"),mintCookieHeader:c(e=>{let r=`${f}=${encodeURIComponent(C(e))}; Path=/; Max-Age=${x}; HttpOnly; SameSite=Lax; Secure`;return m&&(r+=`; Domain=${m}`),r},"mintCookieHeader")}}l(createRollout,"createRollout"),d(createRollout,"createRollout"),c(createRollout,"createRollout");

package/executors/gateway/prod-runtime/routing.js

@@ -1 +1 @@
-"use strict";var m=Object.defineProperty;var i=(a,n)=>m(a,"name",{value:n,configurable:!0});var d=Object.defineProperty,r=i((a,n)=>d(a,"name",{value:n,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRouteTable=createRouteTable;const manifest_1=require("../manifest");function createRouteTable(a,n){const s=[],c=new Map;let o=a.manifests.list();const u=r(e=>{o=e;const t=(0,manifest_1.buildRouteTable)(e);s.length=0,s.push(...t),c.clear();for(const p of e)c.set(p.service,p)},"apply"),l=r(()=>{if(!a.healthChecker)return;const e=new Set;for(const t of s)t.upstream&&e.add(t.upstream);for(const t of a.pods?.endpoints?.()??[])e.add(t);a.healthChecker.track([...e])},"trackUpstreams"),f=r(e=>{u(e),l(),n.emit("info",`gateway routes: ${s.length} on ${o.length} services`,"gateway-up",{kind:"gateway-up",routes:s.map(t=>({host:t.host??"(default)",service:t.service,internal:!!t.internal}))})},"rebuild");u(o);const h=a.manifests.watch?.(e=>f(e));return{routes:s,manifestByService:c,rebuild:f,trackUpstreams:l,manifests:r(()=>o,"manifests"),stop:r(()=>h?.(),"stop")}}i(createRouteTable,"createRouteTable"),r(createRouteTable,"createRouteTable");
+"use strict";var v=Object.defineProperty;var u=(e,a)=>v(e,"name",{value:a,configurable:!0});var m=Object.defineProperty,i=u((e,a)=>m(e,"name",{value:a,configurable:!0}),"i"),d=Object.defineProperty,r=i((e,a)=>d(e,"name",{value:a,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRouteTable=createRouteTable;const manifest_1=require("../manifest");function createRouteTable(e,a){const n=[],c=new Map;let o=e.manifests.list();const l=r(t=>{o=t;const s=(0,manifest_1.buildRouteTable)(t);n.length=0,n.push(...s),c.clear();for(const h of t)c.set(h.service,h)},"apply"),f=r(()=>{if(!e.healthChecker)return;const t=new Set;for(const s of n)s.upstream&&t.add(s.upstream);for(const s of e.pods?.endpoints?.()??[])t.add(s);e.healthChecker.track([...t])},"trackUpstreams"),p=r(t=>{l(t),f(),a.emit("info",`gateway routes: ${n.length} on ${o.length} services`,"gateway-up",{kind:"gateway-up",routes:n.map(s=>({host:s.host??"(default)",service:s.service,internal:!!s.internal}))})},"rebuild");l(o);const b=e.manifests.watch?.(t=>p(t));return{routes:n,manifestByService:c,rebuild:p,trackUpstreams:f,manifests:r(()=>o,"manifests"),stop:r(()=>b?.(),"stop")}}u(createRouteTable,"createRouteTable"),i(createRouteTable,"createRouteTable"),r(createRouteTable,"createRouteTable");

package/executors/gateway/prod-runtime/server.js

@@ -1 +1 @@
-"use strict";var A=Object.defineProperty;var h=(e,a)=>A(e,"name",{value:a,configurable:!0});var R=Object.defineProperty,n=h((e,a)=>R(e,"name",{value:a,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.startProdGateway=startProdGateway;const observability_1=require("./observability"),routing_1=require("./routing"),rollout_1=require("./rollout"),upstream_1=require("./upstream"),auth_1=require("./auth"),hooks_1=require("./hooks"),cors_1=require("./cors"),handler_1=require("./handler"),upgrade_1=require("./upgrade"),app_1=require("./app");async function startProdGateway(e){const a=e.ports?.length?e.ports:[e.tls?8443:8080],j=e.authenticate??(t=>{if(t==="jwt")throw new Error("jwt route but no authenticator configured")}),C=(e.versionHeader??"x-lensmcp-version").toLowerCase(),P=!!e.accessLog,L=new Set((e.corsCredentialOrigins??[]).map(t=>t.toLowerCase())),d=new Map;for(const[t,s]of Object.entries(e.serviceKeys??{}))typeof s=="string"&&s.trim()!==""?d.set(s,t):console.warn(`[gateway] service key for "${t}" is empty \u2014 east-west auth for that service is DISABLED (all internal routes 401) until a key is set.`);const w={},r=(0,observability_1.createObservability)(e,()=>w.current.routes),o=(0,routing_1.createRouteTable)(e,r);w.current=o;const i={opts:e,table:o,keyToProject:d,versionHeader:C,accessLog:P,corsCredentialOrigins:L},u=(0,rollout_1.createRollout)(e),y=(0,upstream_1.createUpstream)(e,r),g=(0,auth_1.createEdgeAuth)(i,r,u,j),c=(0,hooks_1.createHooks)(e.hooks??{}),p=new WeakMap,b=new WeakMap,m=new WeakMap,f=(0,cors_1.createCors)(i,p),O=(0,handler_1.createHandler)({rt:i,obs:r,cors:f,auth:g,upstream:y,rollout:u,hooks:c,reqState:p,spanByReq:b,ctxByReq:m}),M=(0,upgrade_1.createUpgrade)({rt:i,obs:r,auth:g,upstream:y,hooks:c,rollout:u}),{buildApp:S}=(0,app_1.createApp)({rt:i,obs:r,cors:f,hooks:c,handler:O,upgrade:M,reqState:p,spanByReq:b,ctxByReq:m}),x=r.startFlusher();o.rebuild(o.manifests());const k=[],q=[];for(const t of a){const s=await S();await s.listen({port:t,host:"0.0.0.0"});const l=s.server.address(),_=typeof l=="object"&&l?l.port:t;q.push(_),console.log(`[gateway] listening on ${e.tls?"https":"http"}://0.0.0.0:${_}`),k.push(s)}e.healthChecker?.start();let v=!1;return{ports:q,routes:n(()=>o.routes,"routes"),status:r.buildStatusSnapshot,refreshUpstreams:o.trackUpstreams,stop:n(async()=>{v||(v=!0,clearInterval(x),o.stop(),e.healthChecker?.stop(),e.rateLimiter?.stop(),e.metrics?.stop(),r.emit("info","gateway down","gateway-down",{kind:"gateway-down"}),await Promise.all(k.map(t=>t.close())))},"stop")}}h(startProdGateway,"startProdGateway"),n(startProdGateway,"startProdGateway");
+"use strict";var G=Object.defineProperty;var d=(e,a)=>G(e,"name",{value:a,configurable:!0});var A=Object.defineProperty,h=d((e,a)=>A(e,"name",{value:a,configurable:!0}),"h"),R=Object.defineProperty,n=h((e,a)=>R(e,"name",{value:a,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.startProdGateway=startProdGateway;const observability_1=require("./observability"),routing_1=require("./routing"),rollout_1=require("./rollout"),upstream_1=require("./upstream"),auth_1=require("./auth"),hooks_1=require("./hooks"),cors_1=require("./cors"),handler_1=require("./handler"),upgrade_1=require("./upgrade"),app_1=require("./app");async function startProdGateway(e){const a=e.ports?.length?e.ports:[e.tls?8443:8080],j=e.authenticate??(t=>{if(t==="jwt")throw new Error("jwt route but no authenticator configured")}),C=(e.versionHeader??"x-lensmcp-version").toLowerCase(),O=!!e.accessLog,L=new Set((e.corsCredentialOrigins??[]).map(t=>t.toLowerCase())),w=new Map;for(const[t,s]of Object.entries(e.serviceKeys??{}))typeof s=="string"&&s.trim()!==""?w.set(s,t):console.warn(`[gateway] service key for "${t}" is empty \u2014 east-west auth for that service is DISABLED (all internal routes 401) until a key is set.`);const y={},r=(0,observability_1.createObservability)(e,()=>y.current.routes),o=(0,routing_1.createRouteTable)(e,r);y.current=o;const i={opts:e,table:o,keyToProject:w,versionHeader:C,accessLog:O,corsCredentialOrigins:L},u=(0,rollout_1.createRollout)(e),g=(0,upstream_1.createUpstream)(e,r),b=(0,auth_1.createEdgeAuth)(i,r,u,j),c=(0,hooks_1.createHooks)(e.hooks??{}),p=new WeakMap,f=new WeakMap,m=new WeakMap,k=(0,cors_1.createCors)(i,p),S=(0,handler_1.createHandler)({rt:i,obs:r,cors:k,auth:b,upstream:g,rollout:u,hooks:c,reqState:p,spanByReq:f,ctxByReq:m}),x=(0,upgrade_1.createUpgrade)({rt:i,obs:r,auth:b,upstream:g,hooks:c,rollout:u}),{buildApp:M}=(0,app_1.createApp)({rt:i,obs:r,cors:k,hooks:c,handler:S,upgrade:x,reqState:p,spanByReq:f,ctxByReq:m}),B=r.startFlusher();o.rebuild(o.manifests());const v=[],q=[];for(const t of a){const s=await M();await s.listen({port:t,host:"0.0.0.0"});const l=s.server.address(),P=typeof l=="object"&&l?l.port:t;q.push(P),console.log(`[gateway] listening on ${e.tls?"https":"http"}://0.0.0.0:${P}`),v.push(s)}e.healthChecker?.start();let _=!1;return{ports:q,routes:n(()=>o.routes,"routes"),status:r.buildStatusSnapshot,refreshUpstreams:o.trackUpstreams,stop:n(async()=>{_||(_=!0,clearInterval(B),o.stop(),e.healthChecker?.stop(),e.rateLimiter?.stop(),e.metrics?.stop(),r.emit("info","gateway down","gateway-down",{kind:"gateway-down"}),await Promise.all(v.map(t=>t.close())))},"stop")}}d(startProdGateway,"startProdGateway"),h(startProdGateway,"startProdGateway"),n(startProdGateway,"startProdGateway");

package/executors/gateway/prod-runtime/trust.js

@@ -1 +1 @@
-"use strict";var d=Object.defineProperty;var p=(t,e)=>d(t,"name",{value:e,configurable:!0});var x=Object.defineProperty,r=p((t,e)=>x(t,"name",{value:e,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.stampIdentity=exports.stripTrust=exports.HOP_BY_HOP=exports.TRUST_HEADERS=void 0,exports.TRUST_HEADERS=["x-internal-token","x-api-key-id","x-user-id","x-tenant-id","x-user-roles","x-user-permissions"],exports.HOP_BY_HOP=["connection","proxy-connection","keep-alive"];const stripTrust=r(t=>{for(const e of exports.TRUST_HEADERS)delete t.headers[e];for(const e of exports.HOP_BY_HOP)delete t.headers[e]},"stripTrust");exports.stripTrust=stripTrust;const stampIdentity=r((t,e)=>{const i=r((a,s)=>{(typeof s=="string"&&s!==""||typeof s=="number")&&(t.headers[a]=String(s))},"set");i("x-user-id",e.sub),i("x-tenant-id",e.tid);const o=e.roles;Array.isArray(o)&&o.length&&(t.headers["x-user-roles"]=o.map(String).join(","));const n=e.perms;Array.isArray(n)&&n.length&&(t.headers["x-user-permissions"]=n.map(String).join(","))},"stampIdentity");exports.stampIdentity=stampIdentity;
+"use strict";var c=Object.defineProperty;var a=(t,e)=>c(t,"name",{value:e,configurable:!0});var d=Object.defineProperty,p=a((t,e)=>d(t,"name",{value:e,configurable:!0}),"p"),x=Object.defineProperty,r=p((t,e)=>x(t,"name",{value:e,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.stampIdentity=exports.stripTrust=exports.HOP_BY_HOP=exports.TRUST_HEADERS=void 0,exports.TRUST_HEADERS=["x-internal-token","x-api-key-id","x-user-id","x-tenant-id","x-user-roles","x-user-permissions"],exports.HOP_BY_HOP=["connection","proxy-connection","keep-alive"];const stripTrust=r(t=>{for(const e of exports.TRUST_HEADERS)delete t.headers[e];for(const e of exports.HOP_BY_HOP)delete t.headers[e]},"stripTrust");exports.stripTrust=stripTrust;const stampIdentity=r((t,e)=>{const i=r((u,s)=>{(typeof s=="string"&&s!==""||typeof s=="number")&&(t.headers[u]=String(s))},"set");i("x-user-id",e.sub),i("x-tenant-id",e.tid);const o=e.roles;Array.isArray(o)&&o.length&&(t.headers["x-user-roles"]=o.map(String).join(","));const n=e.perms;Array.isArray(n)&&n.length&&(t.headers["x-user-permissions"]=n.map(String).join(","))},"stampIdentity");exports.stampIdentity=stampIdentity;

package/executors/gateway/prod-runtime/upgrade.js

@@ -1,12 +1,12 @@
-"use strict";var V=Object.defineProperty;var A=(p,s)=>V(p,"name",{value:s,configurable:!0});var F=Object.defineProperty,u=A((p,s)=>F(p,"name",{value:s,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createUpgrade=createUpgrade;const tslib_1=require("tslib"),net=tslib_1.__importStar(require("node:net")),tls=tslib_1.__importStar(require("node:tls")),manifest_1=require("../manifest"),edge_1=require("./edge"),trust_1=require("./trust"),validHeaderValue=u(p=>/^[\t\x20-\x7e\x80-\xff]*$/.test(p),"validHeaderValue"),validToken=u(p=>/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(p),"validToken"),FORWARDED_HEADERS=["x-forwarded-for","x-forwarded-proto","x-forwarded-host"],MAX_HEAD_BYTES=64*1024,HANDSHAKE_TIMEOUT_MS=3e4;function createUpgrade(p){const{rt:s,obs:g,auth:S,upstream:z,hooks:y,rollout:E}=p,l=u((e,t,i,c)=>{g.emit("warning",`gateway upgrade rejected (${t})${i?` for ${i}`:""}`,`gateway-upgrade:${i??"(none)"}:${t}`,{kind:"gateway-upgrade-rejected",reason:t,...i?{project:i}:{},...c}),e.destroy()},"reject"),I=u((e,t,i="")=>{try{e.end(`HTTP/1.1 ${t}\r
-${i}Connection: close\r
+"use strict";var G=Object.defineProperty;var S=(d,n)=>G(d,"name",{value:n,configurable:!0});var V=Object.defineProperty,A=S((d,n)=>V(d,"name",{value:n,configurable:!0}),"A"),F=Object.defineProperty,u=A((d,n)=>F(d,"name",{value:n,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createUpgrade=createUpgrade;const tslib_1=require("tslib"),net=tslib_1.__importStar(require("node:net")),tls=tslib_1.__importStar(require("node:tls")),manifest_1=require("../manifest"),edge_1=require("./edge"),trust_1=require("./trust"),validHeaderValue=u(d=>/^[\t\x20-\x7e\x80-\xff]*$/.test(d),"validHeaderValue"),validToken=u(d=>/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(d),"validToken"),FORWARDED_HEADERS=["x-forwarded-for","x-forwarded-proto","x-forwarded-host"],MAX_HEAD_BYTES=64*1024,HANDSHAKE_TIMEOUT_MS=3e4;function createUpgrade(d){const{rt:n,obs:h,auth:U,upstream:I,hooks:y,rollout:E}=d,l=u((e,t,s,p)=>{h.emit("warning",`gateway upgrade rejected (${t})${s?` for ${s}`:""}`,`gateway-upgrade:${s??"(none)"}:${t}`,{kind:"gateway-upgrade-rejected",reason:t,...s?{project:s}:{},...p}),e.destroy()},"reject"),K=u((e,t,s="")=>{try{e.end(`HTTP/1.1 ${t}\r
+${s}Connection: close\r
 Content-Length: 0\r
 \r
-`)}catch{e.destroy()}},"refuse"),K=u(async(e,t,i)=>{(0,trust_1.stripTrust)(e);const c=(e.headers.host||"").split(":")[0],m=(0,edge_1.canonicalize)(e.url??"/");if(m===void 0){l(t,"bad-path");return}const U=m.policy;e.url=m.path+m.query;const r=(0,manifest_1.matchRoute)(s.table.routes,c,U+m.query);if(!r){l(t,"no-route",void 0,{host:c});return}const R=e.socket?.remoteAddress??"",q=E.clientIpOf(e,R);if(s.opts.rateLimiter){const a=await s.opts.rateLimiter.check(q);if(!a.allowed){g.emit("warning",`gateway upgrade rate-limited for ${r.service}`,`gateway-upgrade:${r.service}:rate-limited`,{kind:"gateway-upgrade-rejected",reason:"rate-limited",project:r.service}),I(t,"429 Too Many Requests",`Retry-After: ${Math.ceil(a.retryAfterMs/1e3)}\r
-`);return}}const n=y.any?y.upgradeContext(e,t,void 0):void 0;n&&(n.route=r);const P=r.internal?void 0:s.opts.identify?.(e);let T;if(r.internal){const a=S.internal(e,r,void 0);if(!a.ok){l(t,"auth-failed",r.service);return}T=a.caller,n&&(n.caller=T)}else{if(!S.public(e,r,U,P,q,void 0).ok){l(t,"auth-failed",r.service);return}if(n&&(n.claims=P),n&&y.has("afterAuth")&&(await y.run("afterAuth",n),n.responded()))return}if(e.headers["x-forwarded-for"]=E.forwardedFor(e,R),e.headers["x-forwarded-proto"]=s.opts.tls?"https":"http",e.headers["x-forwarded-host"]=e.headers.host??c,s.opts.serviceKeys?.[r.service]&&(e.headers["x-internal-token"]=s.opts.serviceKeys[r.service]),r.prependPrefix){const a=e.url??"/",o=r.prependPrefix;a!==o&&!a.startsWith(o+"/")&&(e.url=o+a)}if(n&&y.has("onUpgrade")&&(await y.run("onUpgrade",n),n.responded()))return;const N=(0,edge_1.hdr)(e.headers[s.versionHeader]),x=await z.resolveUpstream(r,void 0,N);if(!x||!("url"in x)){l(t,"no-upstream",r.service);return}const f=new URL(x.url),B=new Set([...trust_1.TRUST_HEADERS,"x-api-key","connection","proxy-connection","keep-alive",...FORWARDED_HEADERS]),C=e.method??"GET",k=e.url??"/";if(!validToken(C)||!validHeaderValue(k)||k.includes(" ")){l(t,"bad-request-line",r.service);return}const _=[`${C} ${k} HTTP/1.1`,"Connection: Upgrade"];for(let a=0;a<e.rawHeaders.length;a+=2){const o=e.rawHeaders[a],$=e.rawHeaders[a+1]??"";if(!B.has(o.toLowerCase())){if(!validToken(o)||!validHeaderValue($)){l(t,"bad-header",r.service,{header:o.toLowerCase()});return}_.push(`${o}: ${$}`)}}for(const a of[...trust_1.TRUST_HEADERS,...FORWARDED_HEADERS]){const o=e.headers[a];if(!(typeof o!="string"||o==="")){if(!validHeaderValue(o)){l(t,"bad-identity-value",r.service,{header:a});return}_.push(`${a}: ${o}`)}}const b=f.protocol==="https:"||f.protocol==="wss:",D=Number(f.port)||(b?443:80),h=s.opts.undici,d=b?tls.connect({port:D,host:f.hostname,...net.isIP(f.hostname)?{}:{servername:f.hostname},rejectUnauthorized:h?.rejectUnauthorized??!1,...h?.cert?{cert:h.cert}:{},...h?.key?{key:h.key}:{},...h?.ca?{ca:h.ca}:{}}):net.connect(D,f.hostname);let v=!1;const w=u(a=>{v||(v=!0,clearTimeout(j),g.emit("warning",`gateway upgrade failed (${a}) for ${r.service}`,`gateway-upgrade:${r.service}:${a}`,{kind:"gateway-upgrade-rejected",reason:a,project:r.service}),d.destroy(),t.destroy())},"abort"),j=setTimeout(()=>w("handshake-timeout"),HANDSHAKE_TIMEOUT_MS);j.unref?.(),d.on("error",()=>w("upstream-error")),t.on("error",()=>w("client-error")),d.on(b?"secureConnect":"connect",()=>{d.write(_.join(`\r
+`)}catch{e.destroy()}},"refuse"),N=u(async(e,t,s)=>{(0,trust_1.stripTrust)(e);const p=(e.headers.host||"").split(":")[0],v=(0,edge_1.canonicalize)(e.url??"/");if(v===void 0){l(t,"bad-path");return}const R=v.policy;e.url=v.path+v.query;const r=(0,manifest_1.matchRoute)(n.table.routes,p,R+v.query);if(!r){l(t,"no-route",void 0,{host:p});return}const q=e.socket?.remoteAddress??"",P=E.clientIpOf(e,q);if(n.opts.rateLimiter){const a=await n.opts.rateLimiter.check(P);if(!a.allowed){h.emit("warning",`gateway upgrade rate-limited for ${r.service}`,`gateway-upgrade:${r.service}:rate-limited`,{kind:"gateway-upgrade-rejected",reason:"rate-limited",project:r.service}),K(t,"429 Too Many Requests",`Retry-After: ${Math.ceil(a.retryAfterMs/1e3)}\r
+`);return}}const i=y.any?y.upgradeContext(e,t,void 0):void 0;i&&(i.route=r);const O=r.internal?void 0:n.opts.identify?.(e);let T;if(r.internal){const a=U.internal(e,r,void 0);if(!a.ok){l(t,"auth-failed",r.service);return}T=a.caller,i&&(i.caller=T)}else{if(!U.public(e,r,R,O,P,void 0).ok){l(t,"auth-failed",r.service);return}if(i&&(i.claims=O),i&&y.has("afterAuth")&&(await y.run("afterAuth",i),i.responded()))return}if(e.headers["x-forwarded-for"]=E.forwardedFor(e,q),e.headers["x-forwarded-proto"]=n.opts.tls?"https":"http",e.headers["x-forwarded-host"]=e.headers.host??p,n.opts.serviceKeys?.[r.service]&&(e.headers["x-internal-token"]=n.opts.serviceKeys[r.service]),r.prependPrefix){const a=e.url??"/",o=r.prependPrefix;a!==o&&!a.startsWith(o+"/")&&(e.url=o+a)}if(i&&y.has("onUpgrade")&&(await y.run("onUpgrade",i),i.responded()))return;const B=(0,edge_1.hdr)(e.headers[n.versionHeader]),x=await I.resolveUpstream(r,void 0,B);if(!x||!("url"in x)){l(t,"no-upstream",r.service);return}const f=new URL(x.url),W=new Set([...trust_1.TRUST_HEADERS,"x-api-key","connection","proxy-connection","keep-alive",...FORWARDED_HEADERS]),C=e.method??"GET",b=e.url??"/";if(!validToken(C)||!validHeaderValue(b)||b.includes(" ")){l(t,"bad-request-line",r.service);return}const k=[`${C} ${b} HTTP/1.1`,"Connection: Upgrade"];for(let a=0;a<e.rawHeaders.length;a+=2){const o=e.rawHeaders[a],$=e.rawHeaders[a+1]??"";if(!W.has(o.toLowerCase())){if(!validToken(o)||!validHeaderValue($)){l(t,"bad-header",r.service,{header:o.toLowerCase()});return}k.push(`${o}: ${$}`)}}for(const a of[...trust_1.TRUST_HEADERS,...FORWARDED_HEADERS]){const o=e.headers[a];if(!(typeof o!="string"||o==="")){if(!validHeaderValue(o)){l(t,"bad-identity-value",r.service,{header:a});return}k.push(`${a}: ${o}`)}}const _=f.protocol==="https:"||f.protocol==="wss:",D=Number(f.port)||(_?443:80),g=n.opts.undici,c=_?tls.connect({port:D,host:f.hostname,...net.isIP(f.hostname)?{}:{servername:f.hostname},rejectUnauthorized:g?.rejectUnauthorized??!1,...g?.cert?{cert:g.cert}:{},...g?.key?{key:g.key}:{},...g?.ca?{ca:g.ca}:{}}):net.connect(D,f.hostname);let m=!1;const w=u(a=>{m||(m=!0,clearTimeout(j),h.emit("warning",`gateway upgrade failed (${a}) for ${r.service}`,`gateway-upgrade:${r.service}:${a}`,{kind:"gateway-upgrade-rejected",reason:a,project:r.service}),c.destroy(),t.destroy())},"abort"),j=setTimeout(()=>w("handshake-timeout"),HANDSHAKE_TIMEOUT_MS);j.unref?.(),c.on("error",()=>w("upstream-error")),t.on("error",()=>w("client-error")),c.on(_?"secureConnect":"connect",()=>{c.write(k.join(`\r
 `)+`\r
 \r
-`),i?.length&&d.write(i)});const M=[];let O=0;const L=u(a=>{if(v)return;M.push(a),O+=a.length;const o=Buffer.concat(M),$=o.indexOf(`\r
+`),s?.length&&c.write(s)});const M=[];let L=0;const z=u(a=>{if(m)return;M.push(a),L+=a.length;const o=Buffer.concat(M),$=o.indexOf(`\r
 \r
-`);if($===-1){O>MAX_HEAD_BYTES&&w("oversized-response-head");return}v=!0,clearTimeout(j),d.off("data",L);const H=Number(/^HTTP\/1\.[01] (\d{3})/.exec(o.subarray(0,o.indexOf(`\r
-`)).toString("latin1"))?.[1]);if(H!==101){g.emit("warning",`gateway upgrade refused upstream (${H||"malformed"}) for ${r.service}`,`gateway-upgrade:${r.service}:upstream-refused`,{kind:"gateway-upgrade-rejected",reason:"upstream-refused",project:r.service,status:H||0}),t.end(o.subarray(0,$+4)),d.destroy();return}g.recordEdge(r,0,101,T,x.version),t.write(o),d.pipe(t),t.pipe(d)},"onHead");d.on("data",L),d.on("close",()=>{v||w("upstream-closed")})},"run");return(e,t,i)=>{K(e,t,i).catch(c=>{g.emit("error",`gateway upgrade error: ${c?.message??String(c)}`,"gateway-upgrade:(none):exception",{kind:"gateway-upgrade-rejected",reason:"exception",error:c?.message??String(c)});try{t.destroy()}catch{}})}}A(createUpgrade,"createUpgrade"),u(createUpgrade,"createUpgrade");
+`);if($===-1){L>MAX_HEAD_BYTES&&w("oversized-response-head");return}m=!0,clearTimeout(j),c.off("data",z);const H=Number(/^HTTP\/1\.[01] (\d{3})/.exec(o.subarray(0,o.indexOf(`\r
+`)).toString("latin1"))?.[1]);if(H!==101){h.emit("warning",`gateway upgrade refused upstream (${H||"malformed"}) for ${r.service}`,`gateway-upgrade:${r.service}:upstream-refused`,{kind:"gateway-upgrade-rejected",reason:"upstream-refused",project:r.service,status:H||0}),t.end(o.subarray(0,$+4)),c.destroy();return}h.recordEdge(r,0,101,T,x.version),t.write(o),c.pipe(t),t.pipe(c)},"onHead");c.on("data",z),c.on("close",()=>{m||w("upstream-closed")})},"run");return(e,t,s)=>{N(e,t,s).catch(p=>{h.emit("error",`gateway upgrade error: ${p?.message??String(p)}`,"gateway-upgrade:(none):exception",{kind:"gateway-upgrade-rejected",reason:"exception",error:p?.message??String(p)});try{t.destroy()}catch{}})}}S(createUpgrade,"createUpgrade"),A(createUpgrade,"createUpgrade"),u(createUpgrade,"createUpgrade");

package/executors/gateway/prod-runtime/upstream.js

@@ -1 +1 @@
-"use strict";var v=Object.defineProperty;var p=(e,t)=>v(e,"name",{value:t,configurable:!0});var u=Object.defineProperty,s=p((e,t)=>u(e,"name",{value:t,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createUpstream=createUpstream;function createUpstream(e,t){return{resolveUpstream:s(async(r,o,i,n)=>{if(r.upstream)return{url:r.upstream};const c={...i?{version:i}:{},...n?{allowDrained:!0}:{},...e.healthChecker?{isHealthy:s(l=>e.healthChecker.isHealthy(l),"isHealthy")}:{}};let a=e.pods?.pick(r.service,c);return!a&&e.pods?.ensureUp&&(t.step(o,"ensure-up",{project:r.service}),await e.pods.ensureUp(r.service)&&(a=e.pods.pick(r.service,c))),a},"resolveUpstream")}}p(createUpstream,"createUpstream"),s(createUpstream,"createUpstream");
+"use strict";var d=Object.defineProperty;var c=(e,r)=>d(e,"name",{value:r,configurable:!0});var v=Object.defineProperty,p=c((e,r)=>v(e,"name",{value:r,configurable:!0}),"p"),u=Object.defineProperty,s=p((e,r)=>u(e,"name",{value:r,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createUpstream=createUpstream;function createUpstream(e,r){return{resolveUpstream:s(async(t,o,i,l)=>{if(t.upstream)return{url:t.upstream};const n={...i?{version:i}:{},...l?{allowDrained:!0}:{},...e.healthChecker?{isHealthy:s(m=>e.healthChecker.isHealthy(m),"isHealthy")}:{}};let a=e.pods?.pick(t.service,n);return!a&&e.pods?.ensureUp&&(r.step(o,"ensure-up",{project:t.service}),await e.pods.ensureUp(t.service)&&(a=e.pods.pick(t.service,n))),a},"resolveUpstream")}}c(createUpstream,"createUpstream"),p(createUpstream,"createUpstream"),s(createUpstream,"createUpstream");

package/executors/gateway/providers-prod.js

@@ -1 +1 @@
-"use strict";var V=Object.defineProperty;var g=(t,o)=>V(t,"name",{value:o,configurable:!0});var P=Object.defineProperty,n=g((t,o)=>P(t,"name",{value:o,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.isRolloutShape=void 0,exports.staticManifestProvider=staticManifestProvider,exports.fileManifestProvider=fileManifestProvider,exports.rolloutPodProvider=rolloutPodProvider,exports.endpointsPodProvider=endpointsPodProvider;const node_fs_1=require("node:fs"),manifest_1=require("./manifest"),FLAT="_flat",isCohortList=n(t=>Array.isArray(t)&&t.every(o=>!!o&&typeof o=="object"&&Array.isArray(o.urls)),"isCohortList"),isUrlList=n(t=>Array.isArray(t)&&t.every(o=>typeof o=="string"),"isUrlList"),isSpec=n(t=>!!t&&typeof t=="object"&&!Array.isArray(t)&&isCohortList(t.cohorts),"isSpec"),isRolloutShape=n(t=>Object.values(t).some(o=>isSpec(o)||isCohortList(o)&&o.length>0),"isRolloutShape");exports.isRolloutShape=isRolloutShape;const isValidEntry=n(t=>isSpec(t)||isCohortList(t)||isUrlList(t),"isValidEntry"),toSpec=n(t=>Array.isArray(t)?isUrlList(t)?{rules:[],cohorts:[{version:FLAT,weight:1,urls:t}]}:{rules:[],cohorts:t}:{rules:t.rules??[],cohorts:t.cohorts??[]},"toSpec");function staticManifestProvider(t){return{list:n(()=>t,"list")}}g(staticManifestProvider,"staticManifestProvider"),n(staticManifestProvider,"staticManifestProvider");function parseManifests(t){let o;try{o=JSON.parse(t)}catch{return}const l=Array.isArray(o)?o:o?.manifests;if(!Array.isArray(l))return;const d=l.filter(f=>!!f&&typeof f=="object"&&typeof f.service=="string"&&Array.isArray(f.mounts));return d.length>0?d:void 0}g(parseManifests,"parseManifests"),n(parseManifests,"parseManifests");function fileManifestProvider(t,o={}){const l=o.onError??(()=>{});let d=[],f=-1;const w=new Set,A=n(()=>{if(!(0,node_fs_1.existsSync)(t))return;let u;try{u=(0,node_fs_1.statSync)(t).mtimeMs}catch{return}if(u===f)return;let M;try{M=(0,node_fs_1.readFileSync)(t,"utf8")}catch(e){l(e);return}const s=parseManifests(M);if(!s){l(new Error(`[gateway] rejecting invalid manifest file ${t} \u2014 keeping last-good`));return}f=u,d=s;for(const e of w)try{e(d)}catch(r){l(r)}},"reload");A();let m;try{m=(0,node_fs_1.watch)(t,{persistent:!1},()=>A())}catch{}const b=setInterval(A,o.pollMs??1e3);return b.unref?.(),{list:n(()=>d,"list"),watch:n(u=>(w.add(u),()=>w.delete(u)),"watch"),stop:n(()=>{try{m?.close()}catch{}clearInterval(b)},"stop")}}g(fileManifestProvider,"fileManifestProvider"),n(fileManifestProvider,"fileManifestProvider");function rolloutPodProvider(t,o={}){const l=new Map,d=o.onError??(()=>{}),f=n(s=>({cohorts:s.cohorts.map(e=>({...e,urls:e.urls.slice()})),select:(0,manifest_1.smoothWeightedSelector)(s.cohorts.map(e=>e.weight)),rr:s.cohorts.map(()=>-1),rules:s.rules??[]}),"build"),w=n(s=>{const e=new Map,r=[];for(const[c,a]of Object.entries(s??{})){const h=n(()=>{const S=l.get(c);S&&e.set(c,S),r.push(c)},"keepLastGood");if(!isValidEntry(a)){h();continue}try{e.set(c,f(toSpec(a)))}catch{h()}}r.length&&d(new Error(`[gateway] rollout config: ignoring invalid entr${r.length>1?"ies":"y"} for ${r.join(", ")} \u2014 keeping last-good`)),l.clear();for(const[c,a]of e)l.set(c,a)},"load");w(t);const A=n(s=>s.cohorts.findIndex(e=>e.urls.length>0),"firstNonEmpty"),m=3e4,b=3e5,u=new Map,M=n(s=>{const e=u.get(s);return!!e&&Date.now()<e.until},"isEjected");return{pick(s,e){const r=l.get(s);if(!r||r.cohorts.length===0)return;const c=e?.isHealthy,a=c||u.size>0?i=>!M(i)&&(c?c(i):!0):void 0,h=n((i,p)=>{const j=r.cohorts[i];if(!j||j.urls.length===0)return;const E=j.urls.length;for(let _=0;_<E;_++){r.rr[i]=(r.rr[i]+1)%E;const L=j.urls[r.rr[i]];if(!p||p(L))return L}},"pickUrl"),S=n(i=>i.urls.length>0&&(e?.allowDrained===!0||i.weight>0),"pinnable"),k=e?.version?r.cohorts.findIndex(i=>i.version===e.version&&S(i)):-1;if(k>=0){const i=h(k,a)??h(k);if(i===void 0)return;const p=r.cohorts[k].version;return p===FLAT?{url:i}:{url:i,version:p}}let v=r.select();(!r.cohorts[v]||r.cohorts[v].urls.length===0)&&(v=A(r));let y=h(v,a);if(y===void 0&&a)for(let i=0;i<r.cohorts.length;i++){const p=h(i,a);if(p!==void 0){v=i,y=p;break}}if(y===void 0&&(y=h(v)),y===void 0)return;const x=r.cohorts[v]?.version;return x===void 0||x===FLAT?{url:y}:{url:y,version:x}},endpoints(){const s=new Set;for(const e of l.values())for(const r of e.cohorts)for(const c of r.urls)s.add(c);return[...s]},resolveVersion(s,e){const r=l.get(s);return r&&r.rules.length?(0,manifest_1.pickTargetedVersion)(r.rules,e):void 0},bucket(s,e){const r=l.get(s);if(!r||r.cohorts.length===0)return;const c=r.cohorts[(0,manifest_1.bucketByWeight)(`${e}:${s}`,r.cohorts.map(a=>a.weight))];return c&&c.version!==FLAT?{version:c.version}:void 0},ensureUp:n(async()=>!0,"ensureUp"),drop(s,e){if(!("url"in e))return;const r=Date.now(),c=u.get(e.url),a=c&&r<c.until+b?c.strikes+1:1;u.set(e.url,{until:r+Math.min(m*2**(a-1),b),strikes:a})},update:w}}g(rolloutPodProvider,"rolloutPodProvider"),n(rolloutPodProvider,"rolloutPodProvider");function endpointsPodProvider(t,o={}){const l=rolloutPodProvider(t,o);return{...l,resolveVersion:n(()=>{},"resolveVersion"),bucket:n(()=>{},"bucket"),update:n(d=>l.update(d),"update")}}g(endpointsPodProvider,"endpointsPodProvider"),n(endpointsPodProvider,"endpointsPodProvider");
+"use strict";var U=Object.defineProperty;var w=(r,o)=>U(r,"name",{value:o,configurable:!0});var V=Object.defineProperty,g=w((r,o)=>V(r,"name",{value:o,configurable:!0}),"g"),P=Object.defineProperty,n=g((r,o)=>P(r,"name",{value:o,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.isRolloutShape=void 0,exports.staticManifestProvider=staticManifestProvider,exports.fileManifestProvider=fileManifestProvider,exports.rolloutPodProvider=rolloutPodProvider,exports.endpointsPodProvider=endpointsPodProvider;const node_fs_1=require("node:fs"),manifest_1=require("./manifest"),FLAT="_flat",isCohortList=n(r=>Array.isArray(r)&&r.every(o=>!!o&&typeof o=="object"&&Array.isArray(o.urls)),"isCohortList"),isUrlList=n(r=>Array.isArray(r)&&r.every(o=>typeof o=="string"),"isUrlList"),isSpec=n(r=>!!r&&typeof r=="object"&&!Array.isArray(r)&&isCohortList(r.cohorts),"isSpec"),isRolloutShape=n(r=>Object.values(r).some(o=>isSpec(o)||isCohortList(o)&&o.length>0),"isRolloutShape");exports.isRolloutShape=isRolloutShape;const isValidEntry=n(r=>isSpec(r)||isCohortList(r)||isUrlList(r),"isValidEntry"),toSpec=n(r=>Array.isArray(r)?isUrlList(r)?{rules:[],cohorts:[{version:FLAT,weight:1,urls:r}]}:{rules:[],cohorts:r}:{rules:r.rules??[],cohorts:r.cohorts??[]},"toSpec");function staticManifestProvider(r){return{list:n(()=>r,"list")}}w(staticManifestProvider,"staticManifestProvider"),g(staticManifestProvider,"staticManifestProvider"),n(staticManifestProvider,"staticManifestProvider");function parseManifests(r){let o;try{o=JSON.parse(r)}catch{return}const l=Array.isArray(o)?o:o?.manifests;if(!Array.isArray(l))return;const d=l.filter(f=>!!f&&typeof f=="object"&&typeof f.service=="string"&&Array.isArray(f.mounts));return d.length>0?d:void 0}w(parseManifests,"parseManifests"),g(parseManifests,"parseManifests"),n(parseManifests,"parseManifests");function fileManifestProvider(r,o={}){const l=o.onError??(()=>{});let d=[],f=-1;const M=new Set,b=n(()=>{if(!(0,node_fs_1.existsSync)(r))return;let u;try{u=(0,node_fs_1.statSync)(r).mtimeMs}catch{return}if(u===f)return;let S;try{S=(0,node_fs_1.readFileSync)(r,"utf8")}catch(t){l(t);return}const s=parseManifests(S);if(!s){l(new Error(`[gateway] rejecting invalid manifest file ${r} \u2014 keeping last-good`));return}f=u,d=s;for(const t of M)try{t(d)}catch(e){l(e)}},"reload");b();let A;try{A=(0,node_fs_1.watch)(r,{persistent:!1},()=>b())}catch{}const m=setInterval(b,o.pollMs??1e3);return m.unref?.(),{list:n(()=>d,"list"),watch:n(u=>(M.add(u),()=>M.delete(u)),"watch"),stop:n(()=>{try{A?.close()}catch{}clearInterval(m)},"stop")}}w(fileManifestProvider,"fileManifestProvider"),g(fileManifestProvider,"fileManifestProvider"),n(fileManifestProvider,"fileManifestProvider");function rolloutPodProvider(r,o={}){const l=new Map,d=o.onError??(()=>{}),f=n(s=>({cohorts:s.cohorts.map(t=>({...t,urls:t.urls.slice()})),select:(0,manifest_1.smoothWeightedSelector)(s.cohorts.map(t=>t.weight)),rr:s.cohorts.map(()=>-1),rules:s.rules??[]}),"build"),M=n(s=>{const t=new Map,e=[];for(const[c,a]of Object.entries(s??{})){const h=n(()=>{const k=l.get(c);k&&t.set(c,k),e.push(c)},"keepLastGood");if(!isValidEntry(a)){h();continue}try{t.set(c,f(toSpec(a)))}catch{h()}}e.length&&d(new Error(`[gateway] rollout config: ignoring invalid entr${e.length>1?"ies":"y"} for ${e.join(", ")} \u2014 keeping last-good`)),l.clear();for(const[c,a]of t)l.set(c,a)},"load");M(r);const b=n(s=>s.cohorts.findIndex(t=>t.urls.length>0),"firstNonEmpty"),A=3e4,m=3e5,u=new Map,S=n(s=>{const t=u.get(s);return!!t&&Date.now()<t.until},"isEjected");return{pick(s,t){const e=l.get(s);if(!e||e.cohorts.length===0)return;const c=t?.isHealthy,a=c||u.size>0?i=>!S(i)&&(c?c(i):!0):void 0,h=n((i,p)=>{const x=e.cohorts[i];if(!x||x.urls.length===0)return;const L=x.urls.length;for(let _=0;_<L;_++){e.rr[i]=(e.rr[i]+1)%L;const O=x.urls[e.rr[i]];if(!p||p(O))return O}},"pickUrl"),k=n(i=>i.urls.length>0&&(t?.allowDrained===!0||i.weight>0),"pinnable"),j=t?.version?e.cohorts.findIndex(i=>i.version===t.version&&k(i)):-1;if(j>=0){const i=h(j,a)??h(j);if(i===void 0)return;const p=e.cohorts[j].version;return p===FLAT?{url:i}:{url:i,version:p}}let v=e.select();(!e.cohorts[v]||e.cohorts[v].urls.length===0)&&(v=b(e));let y=h(v,a);if(y===void 0&&a)for(let i=0;i<e.cohorts.length;i++){const p=h(i,a);if(p!==void 0){v=i,y=p;break}}if(y===void 0&&(y=h(v)),y===void 0)return;const E=e.cohorts[v]?.version;return E===void 0||E===FLAT?{url:y}:{url:y,version:E}},endpoints(){const s=new Set;for(const t of l.values())for(const e of t.cohorts)for(const c of e.urls)s.add(c);return[...s]},resolveVersion(s,t){const e=l.get(s);return e&&e.rules.length?(0,manifest_1.pickTargetedVersion)(e.rules,t):void 0},bucket(s,t){const e=l.get(s);if(!e||e.cohorts.length===0)return;const c=e.cohorts[(0,manifest_1.bucketByWeight)(`${t}:${s}`,e.cohorts.map(a=>a.weight))];return c&&c.version!==FLAT?{version:c.version}:void 0},ensureUp:n(async()=>!0,"ensureUp"),drop(s,t){if(!("url"in t))return;const e=Date.now(),c=u.get(t.url),a=c&&e<c.until+m?c.strikes+1:1;u.set(t.url,{until:e+Math.min(A*2**(a-1),m),strikes:a})},update:M}}w(rolloutPodProvider,"rolloutPodProvider"),g(rolloutPodProvider,"rolloutPodProvider"),n(rolloutPodProvider,"rolloutPodProvider");function endpointsPodProvider(r,o={}){const l=rolloutPodProvider(r,o);return{...l,resolveVersion:n(()=>{},"resolveVersion"),bucket:n(()=>{},"bucket"),update:n(d=>l.update(d),"update")}}w(endpointsPodProvider,"endpointsPodProvider"),g(endpointsPodProvider,"endpointsPodProvider"),n(endpointsPodProvider,"endpointsPodProvider");

package/executors/gateway/rate-limit.js

@@ -1,4 +1,4 @@
-"use strict";var E=Object.defineProperty;var k=(a,e)=>E(a,"name",{value:e,configurable:!0});var A=Object.defineProperty,c=k((a,e)=>A(a,"name",{value:e,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRateLimiter=createRateLimiter,exports.createRedisRateLimiter=createRedisRateLimiter;function createRateLimiter(a){const e=Math.max(1,a.limit),s=Math.max(1,a.windowMs),n=a.now??Date.now,m=e/s,o=new Map,f=c((l,r)=>Math.min(e,l.tokens+(r-l.last)*m),"refilled"),u=setInterval(()=>{const l=n();for(const[r,t]of o)f(t,l)>=e&&o.delete(r)},s);return u.unref?.(),{check(l){const r=n();let t=o.get(l);return t||(t={tokens:e,last:r},o.set(l,t)),t.tokens=f(t,r),t.last=r,t.tokens>=1?(t.tokens-=1,{allowed:!0,remaining:Math.floor(t.tokens),retryAfterMs:0}):{allowed:!1,remaining:0,retryAfterMs:Math.ceil((1-t.tokens)/m)}},stop(){clearInterval(u)}}}k(createRateLimiter,"createRateLimiter"),c(createRateLimiter,"createRateLimiter");const BUCKET_LUA=`
+"use strict";var v=Object.defineProperty;var M=(r,e)=>v(r,"name",{value:e,configurable:!0});var E=Object.defineProperty,k=M((r,e)=>E(r,"name",{value:e,configurable:!0}),"k"),A=Object.defineProperty,c=k((r,e)=>A(r,"name",{value:e,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRateLimiter=createRateLimiter,exports.createRedisRateLimiter=createRedisRateLimiter;function createRateLimiter(r){const e=Math.max(1,r.limit),i=Math.max(1,r.windowMs),n=r.now??Date.now,m=e/i,l=new Map,f=c((a,o)=>Math.min(e,a.tokens+(o-a.last)*m),"refilled"),u=setInterval(()=>{const a=n();for(const[o,t]of l)f(t,a)>=e&&l.delete(o)},i);return u.unref?.(),{check(a){const o=n();let t=l.get(a);return t||(t={tokens:e,last:o},l.set(a,t)),t.tokens=f(t,o),t.last=o,t.tokens>=1?(t.tokens-=1,{allowed:!0,remaining:Math.floor(t.tokens),retryAfterMs:0}):{allowed:!1,remaining:0,retryAfterMs:Math.ceil((1-t.tokens)/m)}},stop(){clearInterval(u)}}}M(createRateLimiter,"createRateLimiter"),k(createRateLimiter,"createRateLimiter"),c(createRateLimiter,"createRateLimiter");const BUCKET_LUA=`
 local b = redis.call('HMGET', KEYS[1], 't', 's')
 local cap = tonumber(ARGV[1])
 local refill = tonumber(ARGV[2])
@@ -15,4 +15,4 @@ redis.call('HSET', KEYS[1], 't', tokens, 's', now)
 redis.call('PEXPIRE', KEYS[1], ttl)
 local retry = 0
 if ok == 0 then retry = math.ceil((1 - tokens) / refill) end
-return {ok, math.floor(tokens), retry}`,RL_TIMEOUT=Symbol("rl-timeout"),RL_FAIL=Symbol("rl-fail");function createRedisRateLimiter(a,e){const s=Math.max(1,e.limit),n=Math.max(1,e.windowMs),m=e.prefix??"lensmcp:gw:rl:",o=Math.max(1,e.timeoutMs??100),f=e.failOpen!==!1,u=s/n,l=Math.ceil(n)+1e3;let r=!1;const t=c(M=>(r||(r=!0,e.onFailure?.(M)),f?{allowed:!0,remaining:s,retryAfterMs:0}:{allowed:!1,remaining:0,retryAfterMs:n}),"onFail");return{async check(M){let w,h="redis unavailable";const b=Promise.resolve(a.eval(BUCKET_LUA,1,`${m}${M}`,s,u,l)).then(i=>i,i=>(h=String(i?.message??i),RL_FAIL)),R=new Promise(i=>{w=setTimeout(()=>i(RL_TIMEOUT),o)}),d=await Promise.race([b,R]);if(clearTimeout(w),d===RL_TIMEOUT||d===RL_FAIL)return t(d===RL_TIMEOUT?`redis timed out after ${o}ms`:h);const[y,p,g]=d;return y===1?{allowed:!0,remaining:Number(p)||0,retryAfterMs:0}:{allowed:!1,remaining:0,retryAfterMs:Number(g)||n}},stop(){}}}k(createRedisRateLimiter,"createRedisRateLimiter"),c(createRedisRateLimiter,"createRedisRateLimiter");
+return {ok, math.floor(tokens), retry}`,RL_TIMEOUT=Symbol("rl-timeout"),RL_FAIL=Symbol("rl-fail");function createRedisRateLimiter(r,e){const i=Math.max(1,e.limit),n=Math.max(1,e.windowMs),m=e.prefix??"lensmcp:gw:rl:",l=Math.max(1,e.timeoutMs??100),f=e.failOpen!==!1,u=i/n,a=Math.ceil(n)+1e3;let o=!1;const t=c(w=>(o||(o=!0,e.onFailure?.(w)),f?{allowed:!0,remaining:i,retryAfterMs:0}:{allowed:!1,remaining:0,retryAfterMs:n}),"onFail");return{async check(w){let b,h="redis unavailable";const R=Promise.resolve(r.eval(BUCKET_LUA,1,`${m}${w}`,i,u,a)).then(s=>s,s=>(h=String(s?.message??s),RL_FAIL)),p=new Promise(s=>{b=setTimeout(()=>s(RL_TIMEOUT),l)}),d=await Promise.race([R,p]);if(clearTimeout(b),d===RL_TIMEOUT||d===RL_FAIL)return t(d===RL_TIMEOUT?`redis timed out after ${l}ms`:h);const[y,g,L]=d;return y===1?{allowed:!0,remaining:Number(g)||0,retryAfterMs:0}:{allowed:!1,remaining:0,retryAfterMs:Number(L)||n}},stop(){}}}M(createRedisRateLimiter,"createRedisRateLimiter"),k(createRedisRateLimiter,"createRedisRateLimiter"),c(createRedisRateLimiter,"createRedisRateLimiter");

package/executors/gateway/registry-source.js

@@ -1 +1 @@
-"use strict";var g=Object.defineProperty;var u=(e,t)=>g(e,"name",{value:t,configurable:!0});var y=Object.defineProperty,n=u((e,t)=>y(e,"name",{value:t,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.changeChannel=exports.rolloutKey=exports.manifestKey=exports.DEFAULT_REGISTRY_PREFIX=void 0,exports.redisRegistrySource=redisRegistrySource,exports.createRegistryProviders=createRegistryProviders;const providers_prod_1=require("./providers-prod");exports.DEFAULT_REGISTRY_PREFIX="lensmcp:gw";const manifestKey=n((e,t)=>`${e}:manifest:${t}`,"manifestKey");exports.manifestKey=manifestKey;const rolloutKey=n((e,t)=>`${e}:rollout:${t}`,"rolloutKey");exports.rolloutKey=rolloutKey;const changeChannel=n(e=>`${e}:changed`,"changeChannel");exports.changeChannel=changeChannel;function parseManifest(e){try{const t=JSON.parse(e);return t&&typeof t.service=="string"&&Array.isArray(t.mounts)?t:void 0}catch{return}}u(parseManifest,"parseManifest"),n(parseManifest,"parseManifest");function redisRegistrySource(e,t={}){const a=t.prefix??exports.DEFAULT_REGISTRY_PREFIX;let s;const c=`${a}:rollout:`;return{async read(){const i=await e.keys(`${a}:manifest:*`),d=i.length?(await e.mget(...i)).filter(r=>!!r).map(parseManifest).filter(r=>!!r):[],o=await e.keys(`${c}*`),l={};if(o.length){const r=await e.mget(...o);o.forEach((p,h)=>{const f=r[h];if(f)try{l[p.slice(c.length)]=JSON.parse(f)}catch{}})}return{manifests:d,endpoints:l}},async watch(i){return s=e.duplicate(),await s.subscribe((0,exports.changeChannel)(a)),s.on("message",()=>i()),async()=>{try{await s?.quit()}catch{}}},stop(){s?.quit().catch(()=>{})}}}u(redisRegistrySource,"redisRegistrySource"),n(redisRegistrySource,"redisRegistrySource");function createRegistryProviders(e,t={}){const a=t.onError??(()=>{});let s=[];const c=new Set,i=(0,providers_prod_1.rolloutPodProvider)({},{onError:a});let d,o;const l=n(async()=>{let r;try{r=await e.read()}catch(p){a(p);return}if(s.length>0&&r.manifests.length===0){a(new Error("[gateway] registry read came back EMPTY while serving routes \u2014 keeping last-good (set the registry to a single manifest to drain deliberately)"));return}s=r.manifests,(Object.keys(r.endpoints).length>0||s.length===0)&&i.update(r.endpoints);for(const p of c)try{p(s)}catch(h){a(h)}},"refresh");return{manifests:{list:n(()=>s,"list"),watch:n(r=>(c.add(r),()=>c.delete(r)),"watch")},pods:i,async start(){if(await l(),e.watch)try{d=await e.watch(()=>{l()})}catch(r){a(r)}o=setInterval(()=>{l()},t.pollMs??5e3),o.unref?.()},stop(){d?.(),o&&clearInterval(o),e.stop?.()}}}u(createRegistryProviders,"createRegistryProviders"),n(createRegistryProviders,"createRegistryProviders");
+"use strict";var v=Object.defineProperty;var d=(e,t)=>v(e,"name",{value:t,configurable:!0});var g=Object.defineProperty,u=d((e,t)=>g(e,"name",{value:t,configurable:!0}),"u"),y=Object.defineProperty,n=u((e,t)=>y(e,"name",{value:t,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.changeChannel=exports.rolloutKey=exports.manifestKey=exports.DEFAULT_REGISTRY_PREFIX=void 0,exports.redisRegistrySource=redisRegistrySource,exports.createRegistryProviders=createRegistryProviders;const providers_prod_1=require("./providers-prod");exports.DEFAULT_REGISTRY_PREFIX="lensmcp:gw";const manifestKey=n((e,t)=>`${e}:manifest:${t}`,"manifestKey");exports.manifestKey=manifestKey;const rolloutKey=n((e,t)=>`${e}:rollout:${t}`,"rolloutKey");exports.rolloutKey=rolloutKey;const changeChannel=n(e=>`${e}:changed`,"changeChannel");exports.changeChannel=changeChannel;function parseManifest(e){try{const t=JSON.parse(e);return t&&typeof t.service=="string"&&Array.isArray(t.mounts)?t:void 0}catch{return}}d(parseManifest,"parseManifest"),u(parseManifest,"parseManifest"),n(parseManifest,"parseManifest");function redisRegistrySource(e,t={}){const a=t.prefix??exports.DEFAULT_REGISTRY_PREFIX;let s;const c=`${a}:rollout:`;return{async read(){const i=await e.keys(`${a}:manifest:*`),f=i.length?(await e.mget(...i)).filter(r=>!!r).map(parseManifest).filter(r=>!!r):[],o=await e.keys(`${c}*`),l={};if(o.length){const r=await e.mget(...o);o.forEach((p,h)=>{const m=r[h];if(m)try{l[p.slice(c.length)]=JSON.parse(m)}catch{}})}return{manifests:f,endpoints:l}},async watch(i){return s=e.duplicate(),await s.subscribe((0,exports.changeChannel)(a)),s.on("message",()=>i()),async()=>{try{await s?.quit()}catch{}}},stop(){s?.quit().catch(()=>{})}}}d(redisRegistrySource,"redisRegistrySource"),u(redisRegistrySource,"redisRegistrySource"),n(redisRegistrySource,"redisRegistrySource");function createRegistryProviders(e,t={}){const a=t.onError??(()=>{});let s=[];const c=new Set,i=(0,providers_prod_1.rolloutPodProvider)({},{onError:a});let f,o;const l=n(async()=>{let r;try{r=await e.read()}catch(p){a(p);return}if(s.length>0&&r.manifests.length===0){a(new Error("[gateway] registry read came back EMPTY while serving routes \u2014 keeping last-good (set the registry to a single manifest to drain deliberately)"));return}s=r.manifests,(Object.keys(r.endpoints).length>0||s.length===0)&&i.update(r.endpoints);for(const p of c)try{p(s)}catch(h){a(h)}},"refresh");return{manifests:{list:n(()=>s,"list"),watch:n(r=>(c.add(r),()=>c.delete(r)),"watch")},pods:i,async start(){if(await l(),e.watch)try{f=await e.watch(()=>{l()})}catch(r){a(r)}o=setInterval(()=>{l()},t.pollMs??5e3),o.unref?.()},stop(){f?.(),o&&clearInterval(o),e.stop?.()}}}d(createRegistryProviders,"createRegistryProviders"),u(createRegistryProviders,"createRegistryProviders"),n(createRegistryProviders,"createRegistryProviders");

package/executors/gateway/rollout-ops.js

@@ -1,2 +1,2 @@
-"use strict";var d=Object.defineProperty;var c=(n,r)=>d(n,"name",{value:r,configurable:!0});var h=Object.defineProperty,i=c((n,r)=>h(n,"name",{value:r,configurable:!0}),"i");Object.defineProperty(exports,"__esModule",{value:!0}),exports.applyRolloutOp=applyRolloutOp,exports.summarizeRollout=summarizeRollout,exports.parseRolloutCommand=parseRolloutCommand;const RULE_OPS=new Set(["eq","ne","in","nin","prefix","suffix","contains","regex","exists","gt","lt","cidr"]),clone=i(n=>JSON.parse(JSON.stringify(n)),"clone");function asSpec(n,r){if(r===void 0)return{rules:[],cohorts:[]};if(Array.isArray(r)){if(r.length&&typeof r[0]=="string")throw new Error(`service "${n}" is a flat endpoint list; convert it to cohorts first (e.g. add-cohort)`);return{rules:[],cohorts:r}}return{rules:r.rules??[],cohorts:r.cohorts??[]}}c(asSpec,"asSpec"),i(asSpec,"asSpec");const findCohort=i((n,r)=>n.cohorts.find(o=>o.version===r),"findCohort");function reqWeight(n){if(!Number.isFinite(n)||n<0)throw new Error(`weight must be a number \u2265 0 (got ${n})`);return n}c(reqWeight,"reqWeight"),i(reqWeight,"reqWeight");function applyRolloutOp(n,r){const o=clone(n),e=asSpec(r.service,o[r.service]);switch(r.kind){case"add-cohort":{if(findCohort(e,r.version))throw new Error(`cohort "${r.version}" already exists on "${r.service}" \u2014 use set-weight`);if(!r.urls.length)throw new Error("add-cohort needs at least one upstream url");e.cohorts.push({version:r.version,weight:reqWeight(r.weight),urls:r.urls.slice()});break}case"set-weight":{const t=findCohort(e,r.version);if(!t)throw new Error(`no cohort "${r.version}" on "${r.service}"`);t.weight=reqWeight(r.weight);break}case"remove-cohort":{if(!findCohort(e,r.version))throw new Error(`no cohort "${r.version}" on "${r.service}"`);e.cohorts=e.cohorts.filter(t=>t.version!==r.version);break}case"promote":{if(!findCohort(e,r.version))throw new Error(`no cohort "${r.version}" on "${r.service}"`);for(const t of e.cohorts)t.weight=t.version===r.version?100:0;break}case"abort":{const t=findCohort(e,r.version);if(!t)throw new Error(`no cohort "${r.version}" on "${r.service}"`);t.weight=0;break}case"add-rule":{validateRule(r.rule),e.rules=[...(e.rules??[]).filter(t=>!r.rule.name||t.name!==r.rule.name),r.rule];break}case"remove-rule":{const t=(e.rules??[]).length;if(e.rules=(e.rules??[]).filter(s=>s.name!==r.name),e.rules.length===t)throw new Error(`no rule named "${r.name}" on "${r.service}"`);break}}return o[r.service]=e.rules&&e.rules.length?{rules:e.rules,cohorts:e.cohorts}:e.cohorts,o}c(applyRolloutOp,"applyRolloutOp"),i(applyRolloutOp,"applyRolloutOp");function validateRule(n){if(!n||typeof n.version!="string"||!n.version)throw new Error("rule needs a non-empty version");if(!n.when||typeof n.when!="object")throw new Error("rule needs a `when` condition");const r=i(o=>{const e=o;if("all"in e||"any"in e||"not"in e){for(const t of["all","any"])Array.isArray(e[t])&&e[t].forEach(r);e.not&&r(e.not);return}if(typeof e.attr!="string"||!RULE_OPS.has(e.op))throw new Error(`invalid rule condition (attr/op): ${JSON.stringify(e)}`)},"walk");r(n.when)}c(validateRule,"validateRule"),i(validateRule,"validateRule");function summarizeRollout(n,r){const o=r?[r]:Object.keys(n);if(!o.length)return"(no services in rollout config)";const e=[];for(const t of o){const s=n[t];if(s===void 0){e.push(`${t}: (not present)`);continue}if(Array.isArray(s)&&s.length&&typeof s[0]=="string"){e.push(`${t}: flat LB \u2192 ${s.join(", ")}`);continue}const u=asSpec(t,s),l=u.cohorts.reduce((a,v)=>a+Math.max(0,v.weight),0)||1;e.push(`${t}:`);for(const a of u.cohorts)e.push(`  \u2022 ${a.version.padEnd(16)} weight ${String(a.weight).padStart(3)} (${(Math.max(0,a.weight)/l*100).toFixed(0)}%)  ${a.urls.length} url(s)`);for(const a of u.rules??[])e.push(`  \u25B8 rule ${(a.name??"(unnamed)").padEnd(16)} \u2192 ${a.version}   ${ruleSummary(a.when)}`)}return e.join(`
-`)}c(summarizeRollout,"summarizeRollout"),i(summarizeRollout,"summarizeRollout");function ruleSummary(n){const r=n;return"all"in r?"("+r.all.map(ruleSummary).join(" AND ")+")":"any"in r?"("+r.any.map(ruleSummary).join(" OR ")+")":"not"in r?"NOT "+ruleSummary(r.not):`${r.attr} ${r.op}${r.value!==void 0?" "+JSON.stringify(r.value):""}`}c(ruleSummary,"ruleSummary"),i(ruleSummary,"ruleSummary");function parseRolloutCommand(n){const[r,...o]=n,e=i((t,s)=>{if(o.length<t)throw new Error(`usage: ${r} ${s}`)},"need");switch(r){case"status":return{status:o[0]};case"add-cohort":return e(4,"<service> <version> <weight> <url> [url...]"),{op:{kind:"add-cohort",service:o[0],version:o[1],weight:Number(o[2]),urls:o.slice(3)}};case"set-weight":return e(3,"<service> <version> <weight>"),{op:{kind:"set-weight",service:o[0],version:o[1],weight:Number(o[2])}};case"remove-cohort":return e(2,"<service> <version>"),{op:{kind:"remove-cohort",service:o[0],version:o[1]}};case"promote":return e(2,"<service> <version>"),{op:{kind:"promote",service:o[0],version:o[1]}};case"abort":return e(2,"<service> <version>"),{op:{kind:"abort",service:o[0],version:o[1]}};case"add-rule":{e(6,"<service> <name> <attr> <op> <value> <version>");const t=o[3],s=o[4]??"",u=t==="in"||t==="nin"?s.split(",").map(l=>l.trim()).filter(Boolean):s;return{op:{kind:"add-rule",service:o[0],rule:{name:o[1],when:{attr:o[2],op:t,value:u},version:o[5]}}}}case"remove-rule":return e(2,"<service> <name>"),{op:{kind:"remove-rule",service:o[0],name:o[1]}};default:throw new Error(`unknown command "${r??""}". commands: status, add-cohort, set-weight, remove-cohort, promote, abort, add-rule, remove-rule`)}}c(parseRolloutCommand,"parseRolloutCommand"),i(parseRolloutCommand,"parseRolloutCommand");
+"use strict";var p=Object.defineProperty;var u=(t,e)=>p(t,"name",{value:e,configurable:!0});var d=Object.defineProperty,c=u((t,e)=>d(t,"name",{value:e,configurable:!0}),"c"),h=Object.defineProperty,i=c((t,e)=>h(t,"name",{value:e,configurable:!0}),"i");Object.defineProperty(exports,"__esModule",{value:!0}),exports.applyRolloutOp=applyRolloutOp,exports.summarizeRollout=summarizeRollout,exports.parseRolloutCommand=parseRolloutCommand;const RULE_OPS=new Set(["eq","ne","in","nin","prefix","suffix","contains","regex","exists","gt","lt","cidr"]),clone=i(t=>JSON.parse(JSON.stringify(t)),"clone");function asSpec(t,e){if(e===void 0)return{rules:[],cohorts:[]};if(Array.isArray(e)){if(e.length&&typeof e[0]=="string")throw new Error(`service "${t}" is a flat endpoint list; convert it to cohorts first (e.g. add-cohort)`);return{rules:[],cohorts:e}}return{rules:e.rules??[],cohorts:e.cohorts??[]}}u(asSpec,"asSpec"),c(asSpec,"asSpec"),i(asSpec,"asSpec");const findCohort=i((t,e)=>t.cohorts.find(o=>o.version===e),"findCohort");function reqWeight(t){if(!Number.isFinite(t)||t<0)throw new Error(`weight must be a number \u2265 0 (got ${t})`);return t}u(reqWeight,"reqWeight"),c(reqWeight,"reqWeight"),i(reqWeight,"reqWeight");function applyRolloutOp(t,e){const o=clone(t),r=asSpec(e.service,o[e.service]);switch(e.kind){case"add-cohort":{if(findCohort(r,e.version))throw new Error(`cohort "${e.version}" already exists on "${e.service}" \u2014 use set-weight`);if(!e.urls.length)throw new Error("add-cohort needs at least one upstream url");r.cohorts.push({version:e.version,weight:reqWeight(e.weight),urls:e.urls.slice()});break}case"set-weight":{const n=findCohort(r,e.version);if(!n)throw new Error(`no cohort "${e.version}" on "${e.service}"`);n.weight=reqWeight(e.weight);break}case"remove-cohort":{if(!findCohort(r,e.version))throw new Error(`no cohort "${e.version}" on "${e.service}"`);r.cohorts=r.cohorts.filter(n=>n.version!==e.version);break}case"promote":{if(!findCohort(r,e.version))throw new Error(`no cohort "${e.version}" on "${e.service}"`);for(const n of r.cohorts)n.weight=n.version===e.version?100:0;break}case"abort":{const n=findCohort(r,e.version);if(!n)throw new Error(`no cohort "${e.version}" on "${e.service}"`);n.weight=0;break}case"add-rule":{validateRule(e.rule),r.rules=[...(r.rules??[]).filter(n=>!e.rule.name||n.name!==e.rule.name),e.rule];break}case"remove-rule":{const n=(r.rules??[]).length;if(r.rules=(r.rules??[]).filter(s=>s.name!==e.name),r.rules.length===n)throw new Error(`no rule named "${e.name}" on "${e.service}"`);break}}return o[e.service]=r.rules&&r.rules.length?{rules:r.rules,cohorts:r.cohorts}:r.cohorts,o}u(applyRolloutOp,"applyRolloutOp"),c(applyRolloutOp,"applyRolloutOp"),i(applyRolloutOp,"applyRolloutOp");function validateRule(t){if(!t||typeof t.version!="string"||!t.version)throw new Error("rule needs a non-empty version");if(!t.when||typeof t.when!="object")throw new Error("rule needs a `when` condition");const e=i(o=>{const r=o;if("all"in r||"any"in r||"not"in r){for(const n of["all","any"])Array.isArray(r[n])&&r[n].forEach(e);r.not&&e(r.not);return}if(typeof r.attr!="string"||!RULE_OPS.has(r.op))throw new Error(`invalid rule condition (attr/op): ${JSON.stringify(r)}`)},"walk");e(t.when)}u(validateRule,"validateRule"),c(validateRule,"validateRule"),i(validateRule,"validateRule");function summarizeRollout(t,e){const o=e?[e]:Object.keys(t);if(!o.length)return"(no services in rollout config)";const r=[];for(const n of o){const s=t[n];if(s===void 0){r.push(`${n}: (not present)`);continue}if(Array.isArray(s)&&s.length&&typeof s[0]=="string"){r.push(`${n}: flat LB \u2192 ${s.join(", ")}`);continue}const l=asSpec(n,s),v=l.cohorts.reduce((a,m)=>a+Math.max(0,m.weight),0)||1;r.push(`${n}:`);for(const a of l.cohorts)r.push(`  \u2022 ${a.version.padEnd(16)} weight ${String(a.weight).padStart(3)} (${(Math.max(0,a.weight)/v*100).toFixed(0)}%)  ${a.urls.length} url(s)`);for(const a of l.rules??[])r.push(`  \u25B8 rule ${(a.name??"(unnamed)").padEnd(16)} \u2192 ${a.version}   ${ruleSummary(a.when)}`)}return r.join(`
+`)}u(summarizeRollout,"summarizeRollout"),c(summarizeRollout,"summarizeRollout"),i(summarizeRollout,"summarizeRollout");function ruleSummary(t){const e=t;return"all"in e?"("+e.all.map(ruleSummary).join(" AND ")+")":"any"in e?"("+e.any.map(ruleSummary).join(" OR ")+")":"not"in e?"NOT "+ruleSummary(e.not):`${e.attr} ${e.op}${e.value!==void 0?" "+JSON.stringify(e.value):""}`}u(ruleSummary,"ruleSummary"),c(ruleSummary,"ruleSummary"),i(ruleSummary,"ruleSummary");function parseRolloutCommand(t){const[e,...o]=t,r=i((n,s)=>{if(o.length<n)throw new Error(`usage: ${e} ${s}`)},"need");switch(e){case"status":return{status:o[0]};case"add-cohort":return r(4,"<service> <version> <weight> <url> [url...]"),{op:{kind:"add-cohort",service:o[0],version:o[1],weight:Number(o[2]),urls:o.slice(3)}};case"set-weight":return r(3,"<service> <version> <weight>"),{op:{kind:"set-weight",service:o[0],version:o[1],weight:Number(o[2])}};case"remove-cohort":return r(2,"<service> <version>"),{op:{kind:"remove-cohort",service:o[0],version:o[1]}};case"promote":return r(2,"<service> <version>"),{op:{kind:"promote",service:o[0],version:o[1]}};case"abort":return r(2,"<service> <version>"),{op:{kind:"abort",service:o[0],version:o[1]}};case"add-rule":{r(6,"<service> <name> <attr> <op> <value> <version>");const n=o[3],s=o[4]??"",l=n==="in"||n==="nin"?s.split(",").map(v=>v.trim()).filter(Boolean):s;return{op:{kind:"add-rule",service:o[0],rule:{name:o[1],when:{attr:o[2],op:n,value:l},version:o[5]}}}}case"remove-rule":return r(2,"<service> <name>"),{op:{kind:"remove-rule",service:o[0],name:o[1]}};default:throw new Error(`unknown command "${e??""}". commands: status, add-cohort, set-weight, remove-cohort, promote, abort, add-rule, remove-rule`)}}u(parseRolloutCommand,"parseRolloutCommand"),c(parseRolloutCommand,"parseRolloutCommand"),i(parseRolloutCommand,"parseRolloutCommand");

package/executors/gateway/runtime/act.js

@@ -1 +1 @@
-"use strict";var b=Object.defineProperty;var S=(e,a)=>b(e,"name",{value:a,configurable:!0});var h=Object.defineProperty,c=S((e,a)=>h(e,"name",{value:a,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.ACT_MAX_IDENTITIES=exports.ACT_RETAIN_MS=exports.ACT_TICKET_MS=exports.ACT_TICKET=exports.ACT_HEADER=void 0,exports.fromBrowser=fromBrowser,exports.actTicketOf=actTicketOf,exports.setActTicketAside=setActTicketAside,exports.createActStore=createActStore;const tslib_1=require("tslib"),node_crypto_1=require("node:crypto"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path"));exports.ACT_HEADER="x-lensmcp-act",exports.ACT_TICKET=Symbol.for("lensmcp.gateway.actTicket"),exports.ACT_TICKET_MS=6e4,exports.ACT_RETAIN_MS=720*60*6e4,exports.ACT_MAX_IDENTITIES=20;const TOKEN_MARGIN_S=30,MAX_OPEN_TICKETS=200,WRITE_EVERY_MS=3e4,TIME_CLAIMS=new Set(["exp","iat","nbf","jti"]),TICKET_VALUE=/^[A-Za-z0-9_-]{43}$/;function fromBrowser(e){return typeof e.headers["sec-fetch-mode"]=="string"||typeof e.headers["sec-fetch-site"]=="string"}S(fromBrowser,"fromBrowser"),c(fromBrowser,"fromBrowser");function actTicketOf(e){return e[exports.ACT_TICKET]}S(actTicketOf,"actTicketOf"),c(actTicketOf,"actTicketOf");function setActTicketAside(e){const a=e.headers[exports.ACT_HEADER];typeof a=="string"&&TICKET_VALUE.test(a)&&(e[exports.ACT_TICKET]=a)}S(setActTicketAside,"setActTicketAside"),c(setActTicketAside,"setActTicketAside");const str=c(e=>typeof e=="string"&&e.length>0&&e.length<=256?e:void 0,"str"),keyOf=c(e=>{const a=str(e.sub);return a?`${a}\0${str(e.tid)??""}`:void 0},"keyOf"),safeName=c(e=>e.replace(/[^A-Za-z0-9._-]/g,"_").slice(0,120)||"_","safeName");function viewOf(e,a){const A=e.claims,d=Array.isArray(A.roles)?A.roles.filter(T=>typeof T=="string").slice(0,20):void 0,y=str(A.tid),u=str(A.email),E=str(A.name)??str(A.preferred_username);return{user:str(A.sub),...y?{tenant:y}:{},...u?{email:u}:{},...E?{name:E}:{},...d?.length?{roles:d}:{},host:e.host,firstSeenAt:e.firstSeenAt,lastSeenAt:e.lastSeenAt,mode:e.token&&e.tokenExp!==void 0&&e.tokenExp-TOKEN_MARGIN_S>a/1e3?"token":"identity"}}S(viewOf,"viewOf"),c(viewOf,"viewOf");function createActStore(e={}){const a=e.now??Date.now,A=new Map,d=new Map,y=new Map,u=new Set,E=c(t=>e.dir?path.join(e.dir,`${safeName(t)}.json`):void 0,"file"),T=c(t=>{let s=A.get(t);if(s)return s;s=new Map,A.set(t,s);const n=E(t);if(!n)return s;try{const o=JSON.parse(fs.readFileSync(n,"utf8"));for(const i of Array.isArray(o.identities)?o.identities:[]){const r=i;if(!r||typeof r!="object"||!r.claims||typeof r.claims!="object"||typeof r.host!="string"||typeof r.firstSeenAt!="number"||typeof r.lastSeenAt!="number")continue;const f=keyOf(r.claims);f&&s.set(f,{claims:r.claims,host:r.host,firstSeenAt:r.firstSeenAt,lastSeenAt:r.lastSeenAt})}}catch{}return s},"load"),g=c((t,s)=>{for(const[n,o]of t)s-o.lastSeenAt>exports.ACT_RETAIN_MS&&t.delete(n);if(t.size>exports.ACT_MAX_IDENTITIES){const n=[...t.entries()].sort((o,i)=>o[1].lastSeenAt-i[1].lastSeenAt).slice(0,t.size-exports.ACT_MAX_IDENTITIES);for(const[o]of n)t.delete(o)}},"prune"),k=c((t,s)=>{const n=E(t),o=A.get(t);if(u.delete(t),!(!n||!o)){y.set(t,s);try{fs.mkdirSync(path.dirname(n),{recursive:!0,mode:448});const i=[...o.values()].map(f=>({claims:f.claims,host:f.host,firstSeenAt:f.firstSeenAt,lastSeenAt:f.lastSeenAt})),r=`${n}.${process.pid}.tmp`;fs.writeFileSync(r,JSON.stringify({identities:i},null,1),{mode:384}),fs.renameSync(r,n)}catch{}}},"write"),I=c((t,s,n,o,i=a())=>{const r=keyOf(s);if(!r)return;const f=T(t),_={};for(const[x,w]of Object.entries(s))TIME_CLAIMS.has(x)||(_[x]=w);const m=f.get(r),l=typeof s.exp=="number"?s.exp:void 0,p=!m||m.host!==o||JSON.stringify(m.claims)!==JSON.stringify(_);f.set(r,{claims:_,host:o,firstSeenAt:m?.firstSeenAt??i,lastSeenAt:i,...n&&l!==void 0?{token:n,tokenExp:l}:m?.token?{token:m.token,tokenExp:m.tokenExp}:{}}),g(f,i),p&&u.add(t),(p||i-(y.get(t)??0)>=WRITE_EVERY_MS)&&k(t,i)},"remember"),C=c((t,s=a())=>{const n=T(t);return g(n,s),[...n.values()].sort((o,i)=>i.lastSeenAt-o.lastSeenAt).map(o=>viewOf(o,s))},"list");return{remember:I,list:C,mint:c((t,s,n=a())=>{const o=T(t);g(o,n);const i=s.user?.trim().toLowerCase(),r=s.tenant?.trim(),f=[...o.entries()].filter(([,l])=>{const p=l.claims;return r&&str(p.tid)!==r?!1:i?[p.sub,p.email,p.name,p.preferred_username].some(x=>typeof x=="string"&&x.toLowerCase()===i):!0}).sort((l,p)=>p[1].lastSeenAt-l[1].lastSeenAt)[0];if(!f){const l=C(t,n);return{error:l.length?`No signed-in identity matches${i?` user '${s.user}'`:""}${r?` in tenant '${r}'`:""} \u2014 ${l.length} known (see identities).`:"No one has signed in to this workspace's app since the gateway started remembering identities. Sign in once in the browser \u2014 the gateway keeps the identity it verified for 30 days.",identities:l}}for(const[l,p]of d)p.expiresAt<=n&&d.delete(l);d.size>=MAX_OPEN_TICKETS&&d.delete(d.keys().next().value);const _=(0,node_crypto_1.randomBytes)(32).toString("base64url"),m=n+exports.ACT_TICKET_MS;return d.set(_,{wsKey:t,key:f[0],expiresAt:m}),{ticket:_,expiresAt:m,identity:viewOf(f[1],n)}},"mint"),redeem:c((t,s,n=a())=>{const o=d.get(t);if(!o||(d.delete(t),o.expiresAt<=n||o.wsKey!==s))return;const i=T(s).get(o.key);if(!i)return;const r=viewOf(i,n);return r.mode==="token"?{token:i.token,claims:i.claims,view:r}:{claims:i.claims,view:r}},"redeem"),flush:c(()=>{const t=a();for(const s of[...u])k(s,t)},"flush")}}S(createActStore,"createActStore"),c(createActStore,"createActStore");
+"use strict";var M=Object.defineProperty;var u=(e,a)=>M(e,"name",{value:a,configurable:!0});var b=Object.defineProperty,S=u((e,a)=>b(e,"name",{value:a,configurable:!0}),"S"),h=Object.defineProperty,c=S((e,a)=>h(e,"name",{value:a,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.ACT_MAX_IDENTITIES=exports.ACT_RETAIN_MS=exports.ACT_TICKET_MS=exports.ACT_TICKET=exports.ACT_HEADER=void 0,exports.fromBrowser=fromBrowser,exports.actTicketOf=actTicketOf,exports.setActTicketAside=setActTicketAside,exports.createActStore=createActStore;const tslib_1=require("tslib"),node_crypto_1=require("node:crypto"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path"));exports.ACT_HEADER="x-lensmcp-act",exports.ACT_TICKET=Symbol.for("lensmcp.gateway.actTicket"),exports.ACT_TICKET_MS=6e4,exports.ACT_RETAIN_MS=720*60*6e4,exports.ACT_MAX_IDENTITIES=20;const TOKEN_MARGIN_S=30,MAX_OPEN_TICKETS=200,WRITE_EVERY_MS=3e4,TIME_CLAIMS=new Set(["exp","iat","nbf","jti"]),TICKET_VALUE=/^[A-Za-z0-9_-]{43}$/;function fromBrowser(e){return typeof e.headers["sec-fetch-mode"]=="string"||typeof e.headers["sec-fetch-site"]=="string"}u(fromBrowser,"fromBrowser"),S(fromBrowser,"fromBrowser"),c(fromBrowser,"fromBrowser");function actTicketOf(e){return e[exports.ACT_TICKET]}u(actTicketOf,"actTicketOf"),S(actTicketOf,"actTicketOf"),c(actTicketOf,"actTicketOf");function setActTicketAside(e){const a=e.headers[exports.ACT_HEADER];typeof a=="string"&&TICKET_VALUE.test(a)&&(e[exports.ACT_TICKET]=a)}u(setActTicketAside,"setActTicketAside"),S(setActTicketAside,"setActTicketAside"),c(setActTicketAside,"setActTicketAside");const str=c(e=>typeof e=="string"&&e.length>0&&e.length<=256?e:void 0,"str"),keyOf=c(e=>{const a=str(e.sub);return a?`${a}\0${str(e.tid)??""}`:void 0},"keyOf"),safeName=c(e=>e.replace(/[^A-Za-z0-9._-]/g,"_").slice(0,120)||"_","safeName");function viewOf(e,a){const p=e.claims,d=Array.isArray(p.roles)?p.roles.filter(_=>typeof _=="string").slice(0,20):void 0,E=str(p.tid),T=str(p.email),x=str(p.name)??str(p.preferred_username);return{user:str(p.sub),...E?{tenant:E}:{},...T?{email:T}:{},...x?{name:x}:{},...d?.length?{roles:d}:{},host:e.host,firstSeenAt:e.firstSeenAt,lastSeenAt:e.lastSeenAt,mode:e.token&&e.tokenExp!==void 0&&e.tokenExp-TOKEN_MARGIN_S>a/1e3?"token":"identity"}}u(viewOf,"viewOf"),S(viewOf,"viewOf"),c(viewOf,"viewOf");function createActStore(e={}){const a=e.now??Date.now,p=new Map,d=new Map,E=new Map,T=new Set,x=c(t=>e.dir?path.join(e.dir,`${safeName(t)}.json`):void 0,"file"),_=c(t=>{let r=p.get(t);if(r)return r;r=new Map,p.set(t,r);const n=x(t);if(!n)return r;try{const o=JSON.parse(fs.readFileSync(n,"utf8"));for(const i of Array.isArray(o.identities)?o.identities:[]){const s=i;if(!s||typeof s!="object"||!s.claims||typeof s.claims!="object"||typeof s.host!="string"||typeof s.firstSeenAt!="number"||typeof s.lastSeenAt!="number")continue;const f=keyOf(s.claims);f&&r.set(f,{claims:s.claims,host:s.host,firstSeenAt:s.firstSeenAt,lastSeenAt:s.lastSeenAt})}}catch{}return r},"load"),g=c((t,r)=>{for(const[n,o]of t)r-o.lastSeenAt>exports.ACT_RETAIN_MS&&t.delete(n);if(t.size>exports.ACT_MAX_IDENTITIES){const n=[...t.entries()].sort((o,i)=>o[1].lastSeenAt-i[1].lastSeenAt).slice(0,t.size-exports.ACT_MAX_IDENTITIES);for(const[o]of n)t.delete(o)}},"prune"),w=c((t,r)=>{const n=x(t),o=p.get(t);if(T.delete(t),!(!n||!o)){E.set(t,r);try{fs.mkdirSync(path.dirname(n),{recursive:!0,mode:448});const i=[...o.values()].map(f=>({claims:f.claims,host:f.host,firstSeenAt:f.firstSeenAt,lastSeenAt:f.lastSeenAt})),s=`${n}.${process.pid}.tmp`;fs.writeFileSync(s,JSON.stringify({identities:i},null,1),{mode:384}),fs.renameSync(s,n)}catch{}}},"write"),I=c((t,r,n,o,i=a())=>{const s=keyOf(r);if(!s)return;const f=_(t),y={};for(const[k,v]of Object.entries(r))TIME_CLAIMS.has(k)||(y[k]=v);const m=f.get(s),l=typeof r.exp=="number"?r.exp:void 0,A=!m||m.host!==o||JSON.stringify(m.claims)!==JSON.stringify(y);f.set(s,{claims:y,host:o,firstSeenAt:m?.firstSeenAt??i,lastSeenAt:i,...n&&l!==void 0?{token:n,tokenExp:l}:m?.token?{token:m.token,tokenExp:m.tokenExp}:{}}),g(f,i),A&&T.add(t),(A||i-(E.get(t)??0)>=WRITE_EVERY_MS)&&w(t,i)},"remember"),C=c((t,r=a())=>{const n=_(t);return g(n,r),[...n.values()].sort((o,i)=>i.lastSeenAt-o.lastSeenAt).map(o=>viewOf(o,r))},"list");return{remember:I,list:C,mint:c((t,r,n=a())=>{const o=_(t);g(o,n);const i=r.user?.trim().toLowerCase(),s=r.tenant?.trim(),f=[...o.entries()].filter(([,l])=>{const A=l.claims;return s&&str(A.tid)!==s?!1:i?[A.sub,A.email,A.name,A.preferred_username].some(k=>typeof k=="string"&&k.toLowerCase()===i):!0}).sort((l,A)=>A[1].lastSeenAt-l[1].lastSeenAt)[0];if(!f){const l=C(t,n);return{error:l.length?`No signed-in identity matches${i?` user '${r.user}'`:""}${s?` in tenant '${s}'`:""} \u2014 ${l.length} known (see identities).`:"No one has signed in to this workspace's app since the gateway started remembering identities. Sign in once in the browser \u2014 the gateway keeps the identity it verified for 30 days.",identities:l}}for(const[l,A]of d)A.expiresAt<=n&&d.delete(l);d.size>=MAX_OPEN_TICKETS&&d.delete(d.keys().next().value);const y=(0,node_crypto_1.randomBytes)(32).toString("base64url"),m=n+exports.ACT_TICKET_MS;return d.set(y,{wsKey:t,key:f[0],expiresAt:m}),{ticket:y,expiresAt:m,identity:viewOf(f[1],n)}},"mint"),redeem:c((t,r,n=a())=>{const o=d.get(t);if(!o||(d.delete(t),o.expiresAt<=n||o.wsKey!==r))return;const i=_(r).get(o.key);if(!i)return;const s=viewOf(i,n);return s.mode==="token"?{token:i.token,claims:i.claims,view:s}:{claims:i.claims,view:s}},"redeem"),flush:c(()=>{const t=a();for(const r of[...T])w(r,t)},"flush")}}u(createActStore,"createActStore"),S(createActStore,"createActStore"),c(createActStore,"createActStore");

package/executors/gateway/runtime/auth.js

@@ -1 +1 @@
-"use strict";var _=Object.defineProperty;var w=(a,s)=>_(a,"name",{value:s,configurable:!0});var b=Object.defineProperty,p=w((a,s)=>b(a,"name",{value:s,configurable:!0}),"p");Object.defineProperty(exports,"__esModule",{value:!0}),exports.declaredCallerIds=declaredCallerIds,exports.createEdgeAuth=createEdgeAuth;const manifest_1=require("../manifest"),act_1=require("./act"),chooser_1=require("./chooser"),dev_auth_1=require("./dev-auth"),edge_1=require("./edge"),NO_CALLER_IDS=new Set;function declaredCallerIds(a,s,c){const k=(a.registry?a.registry.allServices():a.services).filter(r=>c===void 0||r.wsKey===c),i=k.find(r=>r.project===s)?.decl.callerIds;if(!Array.isArray(i)||i.length===0)return NO_CALLER_IDS;const e=new Set(k.map(r=>r.project));for(const[r,n]of a.keyToProject)(c===void 0||a.keyToWorkspace?.get(r)===c)&&e.add(n);return new Set(i.filter(r=>typeof r=="string"&&r!==s&&!e.has(r)))}w(declaredCallerIds,"declaredCallerIds"),p(declaredCallerIds,"declaredCallerIds");const bearerOf=p(a=>{const s=a.headers.authorization,c=Array.isArray(s)?s[0]:s;return typeof c=="string"&&c.startsWith("Bearer ")?c.slice(7):void 0},"bearerOf");function createEdgeAuth(a,s,c,k){const{traceStep:i}=s;return{internal:p((e,r,n)=>{const v=String(e.headers["x-api-key"]??""),o=a.keyToProject.get(v);if(!o)return i(n,"auth",{mode:"x-api-key",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Invalid or missing x-api-key for internal route."};const l=a.keyToWorkspace?.get(v),t=r.svc?.wsKey;if(l&&t&&l!==t)return i(n,"auth",{mode:"x-api-key",ok:!1,reason:"cross-workspace",caller:o,callerWorkspace:l,routeWorkspace:t}),{ok:!1,status:401,reason:"unauthorized",detail:"Invalid or missing x-api-key for internal route."};const d=(0,edge_1.claimedCallerIdOf)(e),h=d!==void 0&&d!==o&&declaredCallerIds(a,o,l).has(d)?d:o;e.headers["x-api-key-id"]=h,l?e.headers["x-api-key-workspace"]=l:delete e.headers["x-api-key-workspace"],e.__lensmcpCaller=o,delete e.headers["x-api-key"];const u=(0,edge_1.callerContextOf)(e);for(const[g,y]of Object.entries(u))e.headers[g]=y;return i(n,"auth",{mode:"x-api-key",ok:!0,caller:o,...h!==o?{as:h}:{},...d!==void 0&&d!==o&&h===o?{claimRefused:d}:{},...l?{callerWorkspace:l}:{},...u["x-tenant-id"]!==void 0?{callerTenant:!0}:{},...u["x-user-id"]!==void 0?{callerUser:!0}:{}}),{ok:!0,caller:o}},"internal"),public:p((e,r,n,v)=>{const o=r.wsKey??r.svc?.wsKey??a.wsKey,l=(0,act_1.actTicketOf)(e);let t;if(l!==void 0){if(t=k&&(0,chooser_1.isLoopbackRequest)(e)?k.redeem(l,o):void 0,!t)return i(n,"auth",{mode:"act",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: the act ticket is unknown, spent, expired or for another workspace \u2014 ask for a new one (lensmcp call)."};t.token?e.headers.authorization=`Bearer ${t.token}`:delete e.headers.authorization}const d=p(u=>t?{act:u,as:t.view.user,...t.view.tenant?{tenant:t.view.tenant}:{}}:{},"actStep"),h=r.auth;if(h){const u=v??(0,edge_1.canonicalPath)(e.url??"/")??(e.url??"/").split("?")[0],g=(e.method??"GET").toUpperCase(),y=(0,manifest_1.authRuleFor)(h,u,g);if(y.mode==="jwt"){const x=String(e.headers.host??"").split(":")[0].toLowerCase();let m=t&&!t.token?"identity":"token",f=m==="identity"?t.claims:(0,dev_auth_1.verifyDevJwt)(e,c?.for(x));return!f&&t&&(m="identity",f=t.claims,delete e.headers.authorization),f?y.rule&&!(0,manifest_1.evalRule)(y.rule,(0,dev_auth_1.devAttrs)(e,f,u))?(i(n,"authz",{ok:!1,...d(m)}),{ok:!1,status:403,reason:"forbidden",detail:"Forbidden: insufficient permission"}):((0,dev_auth_1.stampIdentity)(e,f),k&&!t&&(0,act_1.fromBrowser)(e)&&k.remember(o,f,bearerOf(e),x),i(n,"auth",{mode:"jwt",ok:!0,...d(m)}),{ok:!0,claims:f}):(i(n,"auth",{mode:"jwt",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: invalid or missing token"})}return i(n,"auth",{mode:y.mode,...d(t?.token?"token":"identity")}),{ok:!0}}return i(n,"auth",{mode:"public",unconfigured:!0,...d(t?.token?"token":"identity")}),{ok:!0}},"publicAuth")}}w(createEdgeAuth,"createEdgeAuth"),p(createEdgeAuth,"createEdgeAuth");
+"use strict";var z=Object.defineProperty;var g=(r,o)=>z(r,"name",{value:o,configurable:!0});var _=Object.defineProperty,w=g((r,o)=>_(r,"name",{value:o,configurable:!0}),"w"),b=Object.defineProperty,p=w((r,o)=>b(r,"name",{value:o,configurable:!0}),"p");Object.defineProperty(exports,"__esModule",{value:!0}),exports.declaredCallerIds=declaredCallerIds,exports.createEdgeAuth=createEdgeAuth;const manifest_1=require("../manifest"),act_1=require("./act"),chooser_1=require("./chooser"),dev_auth_1=require("./dev-auth"),edge_1=require("./edge"),NO_CALLER_IDS=new Set;function declaredCallerIds(r,o,c){const h=(r.registry?r.registry.allServices():r.services).filter(a=>c===void 0||a.wsKey===c),s=h.find(a=>a.project===o)?.decl.callerIds;if(!Array.isArray(s)||s.length===0)return NO_CALLER_IDS;const e=new Set(h.map(a=>a.project));for(const[a,n]of r.keyToProject)(c===void 0||r.keyToWorkspace?.get(a)===c)&&e.add(n);return new Set(s.filter(a=>typeof a=="string"&&a!==o&&!e.has(a)))}g(declaredCallerIds,"declaredCallerIds"),w(declaredCallerIds,"declaredCallerIds"),p(declaredCallerIds,"declaredCallerIds");const bearerOf=p(r=>{const o=r.headers.authorization,c=Array.isArray(o)?o[0]:o;return typeof c=="string"&&c.startsWith("Bearer ")?c.slice(7):void 0},"bearerOf");function createEdgeAuth(r,o,c,h){const{traceStep:s}=o;return{internal:p((e,a,n)=>{const m=String(e.headers["x-api-key"]??""),i=r.keyToProject.get(m);if(!i)return s(n,"auth",{mode:"x-api-key",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Invalid or missing x-api-key for internal route."};const l=r.keyToWorkspace?.get(m),t=a.svc?.wsKey;if(l&&t&&l!==t)return s(n,"auth",{mode:"x-api-key",ok:!1,reason:"cross-workspace",caller:i,callerWorkspace:l,routeWorkspace:t}),{ok:!1,status:401,reason:"unauthorized",detail:"Invalid or missing x-api-key for internal route."};const d=(0,edge_1.claimedCallerIdOf)(e),k=d!==void 0&&d!==i&&declaredCallerIds(r,i,l).has(d)?d:i;e.headers["x-api-key-id"]=k,l?e.headers["x-api-key-workspace"]=l:delete e.headers["x-api-key-workspace"],e.__lensmcpCaller=i,delete e.headers["x-api-key"];const u=(0,edge_1.callerContextOf)(e);for(const[x,y]of Object.entries(u))e.headers[x]=y;return s(n,"auth",{mode:"x-api-key",ok:!0,caller:i,...k!==i?{as:k}:{},...d!==void 0&&d!==i&&k===i?{claimRefused:d}:{},...l?{callerWorkspace:l}:{},...u["x-tenant-id"]!==void 0?{callerTenant:!0}:{},...u["x-user-id"]!==void 0?{callerUser:!0}:{}}),{ok:!0,caller:i}},"internal"),public:p((e,a,n,m)=>{const i=a.wsKey??a.svc?.wsKey??r.wsKey,l=(0,act_1.actTicketOf)(e);let t;if(l!==void 0){if(t=h&&(0,chooser_1.isLoopbackRequest)(e)?h.redeem(l,i):void 0,!t)return s(n,"auth",{mode:"act",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: the act ticket is unknown, spent, expired or for another workspace \u2014 ask for a new one (lensmcp call)."};t.token?e.headers.authorization=`Bearer ${t.token}`:delete e.headers.authorization}const d=p(u=>t?{act:u,as:t.view.user,...t.view.tenant?{tenant:t.view.tenant}:{}}:{},"actStep"),k=a.auth;if(k){const u=m??(0,edge_1.canonicalPath)(e.url??"/")??(e.url??"/").split("?")[0],x=(e.method??"GET").toUpperCase(),y=(0,manifest_1.authRuleFor)(k,u,x);if(y.mode==="jwt"){const j=String(e.headers.host??"").split(":")[0].toLowerCase();let v=t&&!t.token?"identity":"token",f=v==="identity"?t.claims:(0,dev_auth_1.verifyDevJwt)(e,c?.for(j));return!f&&t&&(v="identity",f=t.claims,delete e.headers.authorization),f?y.rule&&!(0,manifest_1.evalRule)(y.rule,(0,dev_auth_1.devAttrs)(e,f,u))?(s(n,"authz",{ok:!1,...d(v)}),{ok:!1,status:403,reason:"forbidden",detail:"Forbidden: insufficient permission"}):((0,dev_auth_1.stampIdentity)(e,f),h&&!t&&(0,act_1.fromBrowser)(e)&&h.remember(i,f,bearerOf(e),j),s(n,"auth",{mode:"jwt",ok:!0,...d(v)}),{ok:!0,claims:f}):(s(n,"auth",{mode:"jwt",ok:!1}),{ok:!1,status:401,reason:"unauthorized",detail:"Unauthorized: invalid or missing token"})}return s(n,"auth",{mode:y.mode,...d(t?.token?"token":"identity")}),{ok:!0}}return s(n,"auth",{mode:"public",unconfigured:!0,...d(t?.token?"token":"identity")}),{ok:!0}},"publicAuth")}}g(createEdgeAuth,"createEdgeAuth"),w(createEdgeAuth,"createEdgeAuth"),p(createEdgeAuth,"createEdgeAuth");