@lensmcp/cluster 1.9.0 → 1.11.0

package/executors/gateway/gateway.lib.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.lib.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/gateway.lib.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG9D,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAqE,KAAK,UAAU,EAAc,MAAM,YAAY,CAAC;AAQ5H,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAKzC;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAiB3F;AAED,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAQ9F;AASD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACzE;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sGAAsG;IACtG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B;;iGAE6F;IAC7F,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,2FAA2F;IAC3F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,QAAQ;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAE1F,MAAM,WAAW,KAAK;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;gEAC4D;IAC5D,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AAED;;;yBAGyB;AACzB,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,2DAA2D;AAC3D,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAWD;;;8CAG8C;AAC9C,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAUpD;AAED;;;+EAG+E;AAC/E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAmBpG;AAuBD,uFAAuF;AACvF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,SAAO,GAAG,MAAM,GAAG,SAAS,CAa7E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAC1C,WAAW,SAAc,GACxB;IAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE,CAyD7C;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA0sBxB"}
+{"version":3,"file":"gateway.lib.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/gateway.lib.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG9D,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAqE,KAAK,UAAU,EAAc,MAAM,YAAY,CAAC;AAQ5H,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAKzC;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAiC3F;AAED,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAQ9F;AASD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACzE;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sGAAsG;IACtG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B;;iGAE6F;IAC7F,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,2FAA2F;IAC3F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,QAAQ;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAE1F,MAAM,WAAW,KAAK;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;gEAC4D;IAC5D,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AAED;;;yBAGyB;AACzB,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,2DAA2D;AAC3D,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAWD;;;8CAG8C;AAC9C,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAUpD;AAED;;;+EAG+E;AAC/E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAmBpG;AAuBD,uFAAuF;AACvF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,SAAO,GAAG,MAAM,GAAG,SAAS,CAa7E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAC1C,WAAW,SAAc,GACxB;IAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE,CAyD7C;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAquBxB"}

package/executors/gateway/gateway.lib.js

@@ -39,6 +39,29 @@ function verifyDevJwt(req) {
     const [h, p, s] = auth.slice(7).split('.');
     if (!h || !p || !s)
         return undefined;
+    // An IdP that signs ASYMMETRIC (RS256 + JWKS — e.g. tetros's auth host) does NOT use the HS256 dev
+    // shared-secret this dev edge assumed. The PROD gateway verifies RS256 via jwks-verify; in dev we
+    // DECODE + exp-check the claims (no signature check) — the gateway is the only local ingress, the token
+    // came from the trusted local IdP, and a dev IdP's ephemeral per-pod keys make in-cluster JWKS
+    // verification unreliable. (The HS256 path below stays for services using the shared-secret convention.)
+    let alg;
+    try {
+        alg = JSON.parse(Buffer.from(h, 'base64url').toString())['alg'];
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof alg === 'string' && alg !== 'HS256') {
+        try {
+            const rsClaims = JSON.parse(Buffer.from(p, 'base64url').toString());
+            if (typeof rsClaims['exp'] === 'number' && Date.now() / 1000 > rsClaims['exp'])
+                return undefined;
+            return rsClaims;
+        }
+        catch {
+            return undefined;
+        }
+    }
     const expected = (0, node_crypto_1.createHmac)('sha256', secret).update(`${h}.${p}`).digest('base64url');
     const a = Buffer.from(s);
     const b = Buffer.from(expected);
@@ -694,7 +717,12 @@ async function startGateway(options, context) {
             }
             req.__lensmcpPod = path.basename(sock, '.sock');
             traceStep(trace, 'pod-select', { pod: path.basename(sock, '.sock'), pods: route.pool.socks.length, strategy: 'round-robin' });
-            proxy.web(req, res, { target: { socketPath: sock }, autoRewrite: true, agent: httpAgent }, (err) => {
+            // NO autoRewrite for a socketPath target: it's an OBJECT, and http-proxy's setRedirectHostRewrite
+            // does url.parse(options.target) on ANY 3xx response — which throws ("url must be a string, received
+            // Object") and CRASHES the gateway the instant a pod returns a redirect (e.g. the auth IdP's
+            // /authorize → login). A socket target has no host to rewrite anyway, and pods emit ABSOLUTE
+            // external redirect URLs, so no rewrite is needed.
+            proxy.web(req, res, { target: { socketPath: sock }, agent: httpAgent }, (err) => {
                 route.pool.socks = route.pool.socks.filter((s) => s !== sock); // drop dead pod until rescan
                 route.pool.idx = -1; // removing an element shifts indices — reset so the next pick walks cleanly from 0
                 try {
@@ -707,7 +735,9 @@ async function startGateway(options, context) {
             });
             return;
         }
-        proxy.web(req, res, { target: route.target, autoRewrite: true, changeOrigin: true, agent: agentForTarget(route.target) }, (err) => {
+        // autoRewrite ONLY for a string (external URL) target — a non-string target crashes
+        // setRedirectHostRewrite's url.parse(options.target) on a 3xx (see the socketPath case above).
+        proxy.web(req, res, { target: route.target, autoRewrite: typeof route.target === 'string', changeOrigin: true, agent: agentForTarget(route.target) }, (err) => {
             console.error(`[gateway] upstream ${route.project} (${route.target}):`, err.message);
             res.statusCode = 502;
             res.end(`Upstream ${route.project} unavailable.`);
@@ -785,6 +815,26 @@ async function startGateway(options, context) {
             ...(route.host ? { routeHost: route.host } : {}),
             ...(route.internal ? { internal: true } : {}),
         });
+        // CORS preflight on a ROUTED path: answer it HERE, BEFORE edge auth — an OPTIONS preflight carries
+        // no token/credentials by spec, so the JWT (or x-api-key) enforcement below would 401 it and the
+        // browser's CORS check fails with "No Access-Control-Allow-Origin". The matching real request
+        // (GET/POST with the token) still goes through auth normally; the service supplies CORS on it.
+        if (req.method === 'OPTIONS') {
+            cors(req, res);
+            res.writeHead(204, {
+                'access-control-allow-methods': 'GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS',
+                'access-control-allow-headers': String(req.headers['access-control-request-headers'] ?? '*'),
+            });
+            res.end();
+            return;
+        }
+        // CORS on EVERY routed response — including the 401/403/5xx the gateway generates ITSELF below (edge
+        // auth, authz, proxy errors). Without this, a gateway-generated error short-circuits before the upstream
+        // service (which carries CORS on success), so the browser sees the error WITHOUT an
+        // Access-Control-Allow-Origin and reports a CORS failure that MASKS the real status (e.g. a 401 the app
+        // should handle by re-authing). On the success path the upstream's CORS header overwrites this one
+        // (http-proxy setHeader), so there's no duplicate. The gateway is the edge CORS authority.
+        cors(req, res);
         if (route.internal) {
             // service-to-service: validate the CALLER's api key at the boundary
             const presented = String(req.headers['x-api-key'] ?? '');

package/executors/gateway/prod-gateway.lib.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prod-gateway.lib.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/prod-gateway.lib.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,OAAO,EAEL,KAAK,QAAQ,EAAc,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAqB,KAAK,KAAK,EAClG,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,aAAa,EAAa,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD;;+EAE+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC;oEACgE;IAChE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,2EAA2E;IAC3E,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;qFACiF;IACjF,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC;IACnE,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IACtD,8EAA8E;IAC9E,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAChD,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;qFACiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;2EAQuE;IACvE,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IACvP;;;;oFAIgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;sDAIkD;IAClD,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC;;oFAEgF;IAChF,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;6FACyF;IACzF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;0FACsF;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+FAA+F;IAC/F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;gFAE4E;IAC5E,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,IAAI,CAAC;IAC/C;;iFAE6E;IAC7E,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;+FAG2F;IAC3F,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;gGAC4F;IAC5F,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;uFAGmF;IACnF,MAAM,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrH;4EACwE;IACxE,SAAS,CAAC,EAAE,OAAO,CAAC;IAGpB;gFAC4E;IAC5E,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC9E,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;2DACuD;IACvD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;4EACwE;IACxE,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9E;sEACkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,KAAK,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,aAAa,EAAE,CAAC;IAC9B,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AA+BD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA0kB3F"}
+{"version":3,"file":"prod-gateway.lib.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/prod-gateway.lib.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,OAAO,EAEL,KAAK,QAAQ,EAAc,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAqB,KAAK,KAAK,EAClG,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,aAAa,EAAa,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD;;+EAE+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC;oEACgE;IAChE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,2EAA2E;IAC3E,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;qFACiF;IACjF,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC;IACnE,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IACtD,8EAA8E;IAC9E,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAChD,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;qFACiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;2EAQuE;IACvE,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IACvP;;;;oFAIgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;sDAIkD;IAClD,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC;;oFAEgF;IAChF,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;6FACyF;IACzF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;0FACsF;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+FAA+F;IAC/F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;gFAE4E;IAC5E,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,IAAI,CAAC;IAC/C;;iFAE6E;IAC7E,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;+FAG2F;IAC3F,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;gGAC4F;IAC5F,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;uFAGmF;IACnF,MAAM,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrH;4EACwE;IACxE,SAAS,CAAC,EAAE,OAAO,CAAC;IAGpB;gFAC4E;IAC5E,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC9E,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;2DACuD;IACvD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;4EACwE;IACxE,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9E;sEACkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,KAAK,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,aAAa,EAAE,CAAC;IAC9B,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AA+BD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAmmB3F"}

package/executors/gateway/prod-gateway.lib.js

@@ -415,6 +415,17 @@ async function startProdGateway(opts) {
             return reply;
         }
         step(trace, 'route-match', { project: route.service, ...(route.prefix ? { prefix: route.prefix } : {}), ...(route.internal ? { internal: true } : {}) });
+        // CORS preflight on a ROUTED path: answer it HERE, BEFORE edge auth — an OPTIONS preflight carries no
+        // token by spec, so the auth below would 401 it and the browser's CORS check fails. The real request
+        // still authenticates. (handleNoRoute covers UNROUTED preflights; this covers routed ones.)
+        if (req.method === 'OPTIONS') {
+            setCors(reply, req);
+            reply.code(204)
+                .header('access-control-allow-methods', 'GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS')
+                .header('access-control-allow-headers', String(req.headers['access-control-request-headers'] ?? '*'))
+                .send();
+            return reply;
+        }
         // OTel SERVER span (opt-in): continues the incoming traceparent. Stored now so
         // onResponse ends it on ANY exit path (auth reject / 503 / forward). Context is
         // injected into req.headers just before forwarding (below) so downstream parents to it.
@@ -757,6 +768,19 @@ async function startProdGateway(opts) {
             reply.type('application/json').send(JSON.stringify(opts.metrics.snapshot()));
         });
         app.addHook('onRequest', (request, _reply, done) => { stripTrust(request.raw); done(); });
+        // Edge CORS authority: stamp Access-Control-Allow-Origin on EVERY response that lacks it — including the
+        // 401/403/5xx the gateway generates ITSELF (edge auth/authz/proxy errors) which never reach an upstream.
+        // Without it the browser sees the error WITHOUT CORS and reports a CORS failure that MASKS the real
+        // status (e.g. a 401 the app should handle by re-authing). Add ONLY if absent so a proxied success keeps
+        // the upstream's header (no duplicate). No credentials (Bearer APIs; matches setCors).
+        app.addHook('onSend', (request, reply, payload, done) => {
+            const origin = request.headers.origin;
+            if (origin && !reply.getHeader('access-control-allow-origin')) {
+                reply.header('access-control-allow-origin', String(origin));
+                reply.header('vary', 'Origin');
+            }
+            done(null, payload);
+        });
         app.addHook('onResponse', (request, reply, done) => {
             const st = reqState.get(request);
             if (st) {

package/executors/gateway/ssrf-guard.d.ts

@@ -0,0 +1,97 @@
+/**
+ * SSRF guard for OUTBOUND fetches of a request- or config-supplied URL.
+ *
+ * The prod gateway today never fetches an attacker-controlled URL — upstreams
+ * are pinned in the manifest, the JWKS URL is operator env, and reply-from /
+ * undici do not chase redirects. This module exists so that the MOMENT a sink
+ * IS added (a remote-MCP / OpenAPI schema import, a webhook callback, a
+ * dynamically-discovered upstream — anything that fetches a URL it did not
+ * author) there is a ready, tested guard to wrap it with, instead of a naive
+ * `if (host === '127.0.0.1')` string check that the classic bypasses defeat.
+ *
+ * It defends the three canonical bypasses:
+ *   1. DNS name that RESOLVES to an internal IP (`127.0.0.1.nip.io`, rebinding)
+ *      → we resolve the host and check the RESOLVED addresses, not the string.
+ *   2. Redirect chase (`/redirect` 3xx → loopback) → `safeFetch` re-validates
+ *      EVERY hop with `redirect:'manual'`; it never blindly follows a Location.
+ *   3. IPv4-mapped IPv6 loopback (`[::ffff:127.0.0.1]`, `[::ffff:7f00:1]`) →
+ *      `net.BlockList` normalizes mapped forms against the IPv4 rules.
+ *
+ * Residual TOCTOU: between the resolve-and-check and the socket connect, a
+ * rebinding resolver could flip the record. Close it by pinning the connection
+ * to the validated address(es) with `pinnedLookup()` (pass to
+ * `new http.Agent({ lookup })` or an undici `connect:{ lookup }` dispatcher).
+ *
+ * Defaults are operator-overridable but FAIL CLOSED: anything unparseable, any
+ * non-http(s) scheme, embedded credentials, an empty host, or a host that
+ * resolves to no records is rejected.
+ */
+import { BlockList } from 'node:net';
+import type { LookupAddress } from 'node:dns';
+/** Thrown for every blocked URL — carries a machine-readable `reason` and, when
+ *  the block was an address, the offending `address` (the resolved IP, not the
+ *  hostname, so logs show what the name actually pointed at). */
+export declare class SsrfBlockedError extends Error {
+    readonly reason: string;
+    readonly url?: string;
+    readonly address?: string;
+    constructor(reason: string, url?: string, address?: string, cause?: unknown);
+}
+/** True if `ip` (a literal address) falls in a blocked range. Mapped IPv6 is
+ *  normalized by BlockList; an unparseable string is treated as blocked. */
+export declare function isBlockedAddress(ip: string, blockList?: BlockList): boolean;
+export interface FetchableUrlOptions {
+    /** Allowed URL schemes. Default `['http:', 'https:']`. */
+    allowedProtocols?: string[];
+    /** DNS resolver (injectable for tests). Default `dns.lookup(host, {all:true})`. */
+    resolve?: (host: string) => Promise<string[]>;
+    /** Override the blocked-range set. Default = the internal/non-routable set. */
+    blockList?: BlockList;
+    /** Escape hatch: skip all internal-range checks (e.g. a trusted-loopback dev
+     *  sink). Off by default — opt in explicitly, never from request input. */
+    allowPrivate?: boolean;
+}
+export interface FetchableUrl {
+    /** The parsed, validated URL. */
+    url: URL;
+    /** The host (brackets stripped for IPv6 literals). */
+    hostname: string;
+    /** Validated addresses: the literal IP, or every resolved DNS record. Feed to
+     *  `pinnedLookup()` to pin the connection and close the rebinding TOCTOU. */
+    addresses: string[];
+}
+/**
+ * Validate that `rawUrl` is safe to fetch. Rejects (throws `SsrfBlockedError`)
+ * a malformed URL, a disallowed scheme, embedded credentials, a missing host,
+ * a literal internal IP, or a host that resolves to ANY internal address.
+ * Returns the parsed URL and the validated address set on success.
+ */
+export declare function assertFetchableUrl(rawUrl: string | URL, opts?: FetchableUrlOptions): Promise<FetchableUrl>;
+export interface SafeFetchOptions extends FetchableUrlOptions {
+    /** Max redirect hops before giving up. Default 5. */
+    maxRedirects?: number;
+    /** Injectable fetch (tests). Default global `fetch`. */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * A `fetch` that validates the target — and re-validates every redirect hop —
+ * with the SSRF guard. Redirects are handled manually (`redirect:'manual'`) so
+ * a 3xx Location to an internal host is checked BEFORE it is followed, never
+ * chased blindly. Returns the final non-redirect `Response`.
+ *
+ * Note: each hop re-issues with the original `init` (method + body preserved —
+ * the security-relevant worst case for 307/308). A streamed request body cannot
+ * be replayed across hops.
+ */
+export declare function safeFetch(rawUrl: string | URL, init?: RequestInit, opts?: SafeFetchOptions): Promise<Response>;
+type LookupCallback = (err: NodeJS.ErrnoException | null, address?: string | LookupAddress[], family?: number) => void;
+/**
+ * A `dns.lookup`-compatible function that ONLY ever returns the pre-validated
+ * `addresses`. Pass it to `new http.Agent({ lookup })` or an undici
+ * `connect:{ lookup }` dispatcher so the socket connects to an address the
+ * guard already cleared — closing the DNS-rebinding TOCTOU between check and
+ * connect. Use the `addresses` from `assertFetchableUrl()`.
+ */
+export declare function pinnedLookup(addresses: readonly string[]): (hostname: string, options: unknown, callback?: LookupCallback) => void;
+export {};
+//# sourceMappingURL=ssrf-guard.d.ts.map

package/executors/gateway/ssrf-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-guard.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/ssrf-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAQ,SAAS,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C;;iEAEiE;AACjE,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;gBACd,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAU5E;AA6BD;4EAC4E;AAC5E,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,GAAE,SAA8B,GAAG,OAAO,CAI/F;AAQD,MAAM,WAAW,mBAAmB;IAClC,0DAA0D;IAC1D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,mFAAmF;IACnF,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9C,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;+EAC2E;IAC3E,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,GAAG,EAAE,GAAG,CAAC;IACT,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB;iFAC6E;IAC7E,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,GAAG,GAAG,EACpB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,YAAY,CAAC,CAgDvB;AAED,MAAM,WAAW,gBAAiB,SAAQ,mBAAmB;IAC3D,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,GAAG,GAAG,EACpB,IAAI,GAAE,WAAgB,EACtB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,QAAQ,CAAC,CAgBnB;AAED,KAAK,cAAc,GAAG,CACpB,GAAG,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,EACjC,OAAO,CAAC,EAAE,MAAM,GAAG,aAAa,EAAE,EAClC,MAAM,CAAC,EAAE,MAAM,KACZ,IAAI,CAAC;AAEV;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,SAAS,MAAM,EAAE,GAC3B,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,cAAc,KAAK,IAAI,CAezE"}

package/executors/gateway/ssrf-guard.js

@@ -0,0 +1,190 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SsrfBlockedError = void 0;
+exports.isBlockedAddress = isBlockedAddress;
+exports.assertFetchableUrl = assertFetchableUrl;
+exports.safeFetch = safeFetch;
+exports.pinnedLookup = pinnedLookup;
+/**
+ * SSRF guard for OUTBOUND fetches of a request- or config-supplied URL.
+ *
+ * The prod gateway today never fetches an attacker-controlled URL — upstreams
+ * are pinned in the manifest, the JWKS URL is operator env, and reply-from /
+ * undici do not chase redirects. This module exists so that the MOMENT a sink
+ * IS added (a remote-MCP / OpenAPI schema import, a webhook callback, a
+ * dynamically-discovered upstream — anything that fetches a URL it did not
+ * author) there is a ready, tested guard to wrap it with, instead of a naive
+ * `if (host === '127.0.0.1')` string check that the classic bypasses defeat.
+ *
+ * It defends the three canonical bypasses:
+ *   1. DNS name that RESOLVES to an internal IP (`127.0.0.1.nip.io`, rebinding)
+ *      → we resolve the host and check the RESOLVED addresses, not the string.
+ *   2. Redirect chase (`/redirect` 3xx → loopback) → `safeFetch` re-validates
+ *      EVERY hop with `redirect:'manual'`; it never blindly follows a Location.
+ *   3. IPv4-mapped IPv6 loopback (`[::ffff:127.0.0.1]`, `[::ffff:7f00:1]`) →
+ *      `net.BlockList` normalizes mapped forms against the IPv4 rules.
+ *
+ * Residual TOCTOU: between the resolve-and-check and the socket connect, a
+ * rebinding resolver could flip the record. Close it by pinning the connection
+ * to the validated address(es) with `pinnedLookup()` (pass to
+ * `new http.Agent({ lookup })` or an undici `connect:{ lookup }` dispatcher).
+ *
+ * Defaults are operator-overridable but FAIL CLOSED: anything unparseable, any
+ * non-http(s) scheme, embedded credentials, an empty host, or a host that
+ * resolves to no records is rejected.
+ */
+const node_net_1 = require("node:net");
+const promises_1 = require("node:dns/promises");
+/** Thrown for every blocked URL — carries a machine-readable `reason` and, when
+ *  the block was an address, the offending `address` (the resolved IP, not the
+ *  hostname, so logs show what the name actually pointed at). */
+class SsrfBlockedError extends Error {
+    constructor(reason, url, address, cause) {
+        super(`SSRF guard blocked ${url ?? 'request'}: ${reason}${address ? ` (${address})` : ''}`, cause !== undefined ? { cause } : undefined);
+        this.name = 'SsrfBlockedError';
+        this.reason = reason;
+        this.url = url;
+        this.address = address;
+    }
+}
+exports.SsrfBlockedError = SsrfBlockedError;
+/** The internal / non-routable ranges an outbound fetch must never reach.
+ *  Mapped IPv4-in-IPv6 (`::ffff:a.b.c.d`) is matched by the IPv4 rules — verified
+ *  in the spec — so we do NOT blanket-block `::ffff:0:0/96` (mapped *public*
+ *  IPv4 is legitimate). */
+function buildDefaultBlockList() {
+    const b = new node_net_1.BlockList();
+    // ── IPv4 ──
+    b.addSubnet('0.0.0.0', 8, 'ipv4'); // "this host" / 0.0.0.0
+    b.addSubnet('10.0.0.0', 8, 'ipv4'); // RFC1918 private
+    b.addSubnet('100.64.0.0', 10, 'ipv4'); // RFC6598 CGNAT
+    b.addSubnet('127.0.0.0', 8, 'ipv4'); // loopback
+    b.addSubnet('169.254.0.0', 16, 'ipv4'); // link-local incl. cloud metadata 169.254.169.254
+    b.addSubnet('172.16.0.0', 12, 'ipv4'); // RFC1918 private (172.16–172.31)
+    b.addSubnet('192.0.0.0', 24, 'ipv4'); // IETF protocol assignments
+    b.addSubnet('192.168.0.0', 16, 'ipv4'); // RFC1918 private
+    b.addSubnet('198.18.0.0', 15, 'ipv4'); // benchmarking
+    b.addSubnet('240.0.0.0', 4, 'ipv4'); // reserved + 255.255.255.255 broadcast
+    // ── IPv6 ──
+    b.addAddress('::', 'ipv6'); // unspecified
+    b.addAddress('::1', 'ipv6'); // loopback
+    b.addSubnet('fc00::', 7, 'ipv6'); // unique-local (ULA)
+    b.addSubnet('fe80::', 10, 'ipv6'); // link-local
+    return b;
+}
+const DEFAULT_BLOCK_LIST = buildDefaultBlockList();
+/** True if `ip` (a literal address) falls in a blocked range. Mapped IPv6 is
+ *  normalized by BlockList; an unparseable string is treated as blocked. */
+function isBlockedAddress(ip, blockList = DEFAULT_BLOCK_LIST) {
+    const fam = (0, node_net_1.isIP)(ip);
+    if (fam === 0)
+        return true; // not an IP → fail closed
+    return blockList.check(ip, fam === 6 ? 'ipv6' : 'ipv4');
+}
+const stripBrackets = (host) => host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+const defaultResolve = async (host) => (await (0, promises_1.lookup)(host, { all: true, verbatim: true })).map((r) => r.address);
+/**
+ * Validate that `rawUrl` is safe to fetch. Rejects (throws `SsrfBlockedError`)
+ * a malformed URL, a disallowed scheme, embedded credentials, a missing host,
+ * a literal internal IP, or a host that resolves to ANY internal address.
+ * Returns the parsed URL and the validated address set on success.
+ */
+async function assertFetchableUrl(rawUrl, opts = {}) {
+    const protocols = opts.allowedProtocols ?? ['http:', 'https:'];
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new SsrfBlockedError('malformed-url', String(rawUrl));
+    }
+    if (!protocols.includes(url.protocol)) {
+        throw new SsrfBlockedError(`scheme-not-allowed:${url.protocol}`, url.href);
+    }
+    if (url.username !== '' || url.password !== '') {
+        throw new SsrfBlockedError('embedded-credentials', url.href);
+    }
+    const hostname = stripBrackets(url.hostname);
+    if (hostname === '')
+        throw new SsrfBlockedError('missing-host', url.href);
+    if (opts.allowPrivate) {
+        return { url, hostname, addresses: (0, node_net_1.isIP)(hostname) ? [hostname] : [] };
+    }
+    const blockList = opts.blockList ?? DEFAULT_BLOCK_LIST;
+    // Literal IP (covers IPv4, IPv6, and IPv4-mapped IPv6 like [::ffff:127.0.0.1]).
+    if ((0, node_net_1.isIP)(hostname) !== 0) {
+        if (isBlockedAddress(hostname, blockList)) {
+            throw new SsrfBlockedError('blocked-address', url.href, hostname);
+        }
+        return { url, hostname, addresses: [hostname] };
+    }
+    // DNS name → resolve and check EVERY record (defeats nip.io / rebinding).
+    const resolve = opts.resolve ?? defaultResolve;
+    let addresses;
+    try {
+        addresses = await resolve(hostname);
+    }
+    catch (e) {
+        throw new SsrfBlockedError('dns-resolution-failed', url.href, undefined, e);
+    }
+    if (addresses.length === 0)
+        throw new SsrfBlockedError('dns-no-records', url.href);
+    for (const addr of addresses) {
+        if (isBlockedAddress(addr, blockList)) {
+            throw new SsrfBlockedError('blocked-resolved-address', url.href, addr);
+        }
+    }
+    return { url, hostname, addresses };
+}
+/**
+ * A `fetch` that validates the target — and re-validates every redirect hop —
+ * with the SSRF guard. Redirects are handled manually (`redirect:'manual'`) so
+ * a 3xx Location to an internal host is checked BEFORE it is followed, never
+ * chased blindly. Returns the final non-redirect `Response`.
+ *
+ * Note: each hop re-issues with the original `init` (method + body preserved —
+ * the security-relevant worst case for 307/308). A streamed request body cannot
+ * be replayed across hops.
+ */
+async function safeFetch(rawUrl, init = {}, opts = {}) {
+    const doFetch = opts.fetchImpl ?? globalThis.fetch;
+    const maxRedirects = opts.maxRedirects ?? 5;
+    let current = rawUrl;
+    for (let hop = 0;; hop++) {
+        const { url } = await assertFetchableUrl(current, opts); // re-validate THIS hop
+        const res = await doFetch(url, { ...init, redirect: 'manual' });
+        const location = res.headers.get('location');
+        if (res.status >= 300 && res.status < 400 && location) {
+            if (hop >= maxRedirects)
+                throw new SsrfBlockedError('too-many-redirects', url.href);
+            current = new URL(location, url).href; // resolve relative; loop re-validates next hop
+            continue;
+        }
+        return res;
+    }
+}
+/**
+ * A `dns.lookup`-compatible function that ONLY ever returns the pre-validated
+ * `addresses`. Pass it to `new http.Agent({ lookup })` or an undici
+ * `connect:{ lookup }` dispatcher so the socket connects to an address the
+ * guard already cleared — closing the DNS-rebinding TOCTOU between check and
+ * connect. Use the `addresses` from `assertFetchableUrl()`.
+ */
+function pinnedLookup(addresses) {
+    const recs = addresses.map((address) => ({
+        address,
+        family: (0, node_net_1.isIP)(address) === 6 ? 6 : 4,
+    }));
+    return (hostname, options, callback) => {
+        const cb = (typeof options === 'function' ? options : callback);
+        const all = typeof options === 'object' && options !== null && options.all === true;
+        if (recs.length === 0) {
+            cb(new Error(`SSRF guard: no pinned address for ${hostname}`));
+            return;
+        }
+        if (all)
+            cb(null, recs);
+        else
+            cb(null, recs[0].address, recs[0].family);
+    };
+}

package/gateway.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `@lensmcp/cluster/gateway` — the PRODUCTION gateway's public, extendable surface.
+ *
+ * This is the **deployable edge** (`startProdGateway` — Fastify + undici reverse
+ * proxy, manifest-driven, the thing `Dockerfile.prod-gateway` runs). A consumer
+ * (e.g. tetros' `server/apps/gateway`) imports from here to run or extend it with
+ * its own providers/middleware and ship a specialized image.
+ *
+ * ⚠️ This is NOT the DEV cluster gateway. The dev gateway is the
+ * `@lensmcp/cluster:gateway` nx EXECUTOR (`gateway.lib.ts` → `startGateway`) — a
+ * local-only HTTPS front door on :443 that fronts unix-socket pods for
+ * development. The two share a routing core (`manifest.ts`) but are separate
+ * lifecycles: dev = an nx target you run locally; prod = a containerized service
+ * you deploy. Kept on a separate subpath so the build-time webpack-config exports
+ * in the main `@lensmcp/cluster` entry never pull in fastify/undici.
+ */
+export { startProdGateway, type ProdGatewayOptions, type ProdGatewayHandle, type ServiceStatus, } from './executors/gateway/prod-gateway.lib';
+export { staticManifestProvider, endpointsPodProvider } from './executors/gateway/providers-prod';
+export { createRegistryProviders, redisRegistrySource, type RegistrySource, type RedisLike, DEFAULT_REGISTRY_PREFIX, } from './executors/gateway/registry-source';
+export { type RouteManifest, type RouteMount, type AuthMode, type AuthPolicy, type ManifestProvider, type PodProvider, type Upstream, type Route, manifestFromClusterDecl, } from './executors/gateway/manifest';
+//# sourceMappingURL=gateway.d.ts.map

package/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../../libs/cluster/src/gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAGlG,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAI7C,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,KAAK,EACV,uBAAuB,GACxB,MAAM,8BAA8B,CAAC"}

package/gateway.js

@@ -0,0 +1,35 @@
+"use strict";
+/**
+ * `@lensmcp/cluster/gateway` — the PRODUCTION gateway's public, extendable surface.
+ *
+ * This is the **deployable edge** (`startProdGateway` — Fastify + undici reverse
+ * proxy, manifest-driven, the thing `Dockerfile.prod-gateway` runs). A consumer
+ * (e.g. tetros' `server/apps/gateway`) imports from here to run or extend it with
+ * its own providers/middleware and ship a specialized image.
+ *
+ * ⚠️ This is NOT the DEV cluster gateway. The dev gateway is the
+ * `@lensmcp/cluster:gateway` nx EXECUTOR (`gateway.lib.ts` → `startGateway`) — a
+ * local-only HTTPS front door on :443 that fronts unix-socket pods for
+ * development. The two share a routing core (`manifest.ts`) but are separate
+ * lifecycles: dev = an nx target you run locally; prod = a containerized service
+ * you deploy. Kept on a separate subpath so the build-time webpack-config exports
+ * in the main `@lensmcp/cluster` entry never pull in fastify/undici.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.manifestFromClusterDecl = exports.DEFAULT_REGISTRY_PREFIX = exports.redisRegistrySource = exports.createRegistryProviders = exports.endpointsPodProvider = exports.staticManifestProvider = exports.startProdGateway = void 0;
+// The prod gateway engine + its option/handle contract.
+var prod_gateway_lib_1 = require("./executors/gateway/prod-gateway.lib");
+Object.defineProperty(exports, "startProdGateway", { enumerable: true, get: function () { return prod_gateway_lib_1.startProdGateway; } });
+// Static (in-memory) providers — build a gateway from explicit manifests/endpoints.
+var providers_prod_1 = require("./executors/gateway/providers-prod");
+Object.defineProperty(exports, "staticManifestProvider", { enumerable: true, get: function () { return providers_prod_1.staticManifestProvider; } });
+Object.defineProperty(exports, "endpointsPodProvider", { enumerable: true, get: function () { return providers_prod_1.endpointsPodProvider; } });
+// Redis-backed registry providers — the prod path (manifests/rollout read live from Redis).
+var registry_source_1 = require("./executors/gateway/registry-source");
+Object.defineProperty(exports, "createRegistryProviders", { enumerable: true, get: function () { return registry_source_1.createRegistryProviders; } });
+Object.defineProperty(exports, "redisRegistrySource", { enumerable: true, get: function () { return registry_source_1.redisRegistrySource; } });
+Object.defineProperty(exports, "DEFAULT_REGISTRY_PREFIX", { enumerable: true, get: function () { return registry_source_1.DEFAULT_REGISTRY_PREFIX; } });
+// Manifest/route types + the cluster-decl → manifest converter (derive prod
+// manifests from the SAME project.json `cluster` declarations dev uses).
+var manifest_1 = require("./executors/gateway/manifest");
+Object.defineProperty(exports, "manifestFromClusterDecl", { enumerable: true, get: function () { return manifest_1.manifestFromClusterDecl; } });

package/main.devserver.js

@@ -600,7 +600,10 @@ else {
             }
             if (route?.target) {
                 applyGatewayMiddleware(req);
-                proxy.web(req, res, { target: route.target, autoRewrite: true, changeOrigin: true }, (err) => {
+                // autoRewrite ONLY for a string (external URL) target: a route may target a child socketPath
+                // OBJECT, and http-proxy's setRedirectHostRewrite does url.parse(options.target) on ANY 3xx —
+                // which throws on an object and crashes the gateway (e.g. proxying the auth IdP's /authorize → login).
+                proxy.web(req, res, { target: route.target, autoRewrite: typeof route.target === 'string', changeOrigin: true }, (err) => {
                     console.error(`[parent] proxy error to ${route.target}:`, err);
                     res.statusCode = 502;
                     res.setHeader('content-type', 'text/plain; charset=utf-8');
@@ -630,7 +633,12 @@ else {
             }
             proxy.web(req, res, {
                 target: { socketPath: targetChild.socketPath },
-                autoRewrite: true,
+                // NO autoRewrite for a socketPath target: it's an OBJECT, and http-proxy's
+                // setRedirectHostRewrite does url.parse(options.target) on ANY 3xx response — which throws
+                // ("url must be a string, received Object") and CRASHES the gateway the moment a child
+                // returns a redirect (e.g. the auth IdP's /authorize → login). Host-rewrite is meaningless
+                // for a socket target anyway (no host to match), and our services emit ABSOLUTE external
+                // redirect URLs, so no rewrite is needed. (autoRewrite stays on the string-target route above.)
                 headers: {
                     'x-proxy-child-id': String(targetChild.id) // for logging/debugging
                 }
@@ -722,7 +730,8 @@ else {
                 }
                 proxy.web(req, res, {
                     target: { socketPath: targetChild.socketPath },
-                    autoRewrite: true,
+                    // NO autoRewrite — a socketPath target crashes http-proxy's setRedirectHostRewrite on a 3xx
+                    // (url.parse of the target OBJECT). See the public-port handler above.
                 }, (err) => {
                     targetChild.healthy = false;
                     targetChild.lastError = String(err?.stack || err);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/cluster",
-  "version": "1.9.0",
+  "version": "1.11.0",
   "description": "Run your Nx workspace as a local production cluster: pods on unix sockets with true HMR, one https gateway with per-project domains, scale-from-zero, autoscale, idle-kill, local-CA TLS — observed by the LensMCP lens.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -65,8 +65,8 @@
     }
   },
   "dependencies": {
-    "@lensmcp/node-instrumentation": "1.9.0",
-    "@lensmcp/nx-plugin": "1.9.0",
+    "@lensmcp/node-instrumentation": "1.11.0",
+    "@lensmcp/nx-plugin": "1.11.0",
     "fork-ts-checker-webpack-plugin": "^9.0.0",
     "glob": "^11.0.0",
     "http-proxy": "^1.18.0",