dhr-verma

This commit performs a significant **refactoring** within the **Historian-base** package by extracting duplicated route setup logic into a new `createRouteContext()` helper function. This utility, located in `routes/utils.ts`, centralizes the initialization of **routing** and **throttle middleware** configurations, affecting 9 existing route modules such as `git/blobs.ts` and `summaries.ts`. The change reduces code duplication and enhances maintainability across the **Historian routing layer**. It also introduces a new `IHistorianRouteContext` interface and includes comprehensive unit tests for the helper, ensuring its correct behavior.

This commit **optimizes the CI/CD pipeline** by **increasing the timeout duration** for the **code simplifier GitHub Actions workflow**. Specifically, the execution limit for the `code-simplifier.lock.yml` and `code-simplifier.md` workflows has been doubled from 30 to **60 minutes**. This **experimental adjustment** is a **maintenance** effort aimed at addressing recurring timeout issues in the code simplifier runs, thereby **improving the reliability** and completion rate of these automated checks. The change is expected to allow the `Execute GitHub Copilot CLI` step to finish successfully, preventing future workflow failures due to time limits.

This commit performs a **refactoring** within the `build-cli` package by **extracting duplicated logic** for identifying the latest stable version within a major release. The common functionality, previously found in the `check:latestVersions` and `vnext:check:latestVersions` commands, is now consolidated into a new pure helper function, `isLatestInMajor`, located in `src/library/latestVersions.ts`. This **maintenance** effort improves code readability and reduces redundancy, with both commands now delegating to the shared helper while preserving their original log output and ADO pipeline variable behavior. Comprehensive **unit tests** have been added for `isLatestInMajor` to ensure its correctness across various versioning scenarios, enhancing the robustness of the **version checking subsystem**.

This commit **refactors** the **build configuration** by **deduplicating** the glob patterns used to discover `package.json` files across various release groups. It extracts a repeated 4-entry glob array into a new constant, `releaseGroupPackageJsonGlobs`, within `fluidBuild.config.cjs`. This change improves **maintainability and readability** by centralizing the definition, affecting how `flub check buildversion` and `syncpack` tasks identify relevant packages without altering their functional scope. The repeated explanatory comment is also moved to the constant definition, appearing only once.

This commit introduces **proof-of-concept GitHub Agentic Workflows** to automate code simplification and deduplication within the repository. It adds two new **GitHub Actions workflows**: `code-simplifier.md` which proposes PRs for code simplification, and `duplicate-code-detector.md` which creates issues for code deduplication opportunities. This **new capability** integrates AI-powered automation into the repository's **development and maintenance processes**. These workflows are currently for **testing purposes** only, operating with **least privilege** to generate PRs or issues without intrusive changes.

This commit introduces **abort controller support** within the **Gitrest service**, enabling the cancellation of ongoing operations, particularly those interacting with the storage stack. It integrates conditional middleware into the `gitrest-base` Express application (`app.ts`) to manage abort controller contexts. Additionally, Axios interceptors are now conditionally configured in `runnerFactory.ts` to leverage abort signals for outgoing HTTP requests. This **new capability** enhances resource management by allowing Gitrest to proactively stop unneeded operations, contingent on the `axiosAbortSignalEnabled` configuration.

Updated r11 packages used in Historian and Gitrest (#24600)

This commit **fixes a bug** in the **Routerlicious abort controller middleware** that caused an `ERR_HTTP_HEADERS_SENT` error when requests landed on the **Alfred** server. The issue arose when the `axiosAbortSignalEnabled` configuration was true, leading to headers being sent after the response had already begun. This **bug fix** involves reordering the `abortControllerContext.bindAbortController` call within `server/routerlicious/packages/services-utils/src/abortControllerContext.ts` to execute after `next()`, preventing server crashes and ensuring correct header handling.

This commit **updates the Historian and Gitrest services** to integrate **abort controller functionality**, enhancing their ability to manage network requests. This **feature enhancement** introduces conditional binding of an abort controller context to the Express application in `historian-base/src/app.ts` and sets up Axios interceptors for abort signals within the `HistorianResourcesFactory` in `historian-base/src/runnerFactory.ts`. Both integrations are controlled by the `axiosAbortSignalEnabled` configuration, allowing for improved request cancellation and more robust resource management within the **Historian** service.

This commit introduces **abort controller support for S2S Axios requests**, enabling internal server-to-server calls to be canceled if the originating client disconnects. This **new capability** primarily affects the **Alfred** HTTP ingress service, preventing unnecessary server-side operations and allowing requests to fail faster. It leverages a new global context for abort signals, middleware functions, and enhanced error handling within the `restWrapper` to categorize client-aborted requests as a `499 NetworkError`. This improves resource efficiency by proactively terminating unneeded S2S operations when the client connection is lost.

This commit **refactors** the **Historian** and **Gitrest** services to enhance their telemetry context binding and service initialization. It updates the telemetry context to include the service name and passes this identifier to the `bindContext` function within `app.ts`, `restGitService.ts`, and `riddlerService.ts`. This **maintenance** work, driven by the consumption of updated `r11` packages, ensures more granular HTTP telemetry properties. A **breaking change** is introduced for AFR, which will need to update its `bindContext` calls to accommodate the newly passed service name.

This commit introduces a **new capability** to enhance **observability** for internal **server-to-server (S2S) API calls** within Routerlicious. It ensures that all outgoing S2S requests now include an `x-calling-service` header, identifying the originating service, and updates receiving logging middleware to record this information. This change impacts core services like **Alfred, Nexus, and Riddler**, along with the `services-client`'s `BasicRestWrapper` and `services-utils`'s `bindTelemetryContext` function, which now requires a `serviceName` parameter. The update is a **breaking change** for consumers of `bindTelemetryContext` and facilitates better tracing and debugging of inter-service communication.

Bumped r11 version in Historian and Gitrest (#24509)

This commit introduces a **new capability** for **dynamic timeout management** in **server-to-server (S2S) requests** within the **Routerlicious services-client** package. It replaces a static 30-second global timeout with a context-aware calculation to prevent S2S calls from exceeding the originating client's request timeout. The `restWrapper` now leverages a new `getTimeRemainingMs()` method, integrated into the `ITimeoutContext` and its implementations, to dynamically adjust the timeout for each S2S request. This **optimization** ensures that inter-service communication respects the overall request lifecycle, improving system reliability and preventing cascading timeouts.

This commit introduces a **new feature** to the **retry utility functions** within the `server/routerlicious/packages/services-core` package. A new parameter, `maxRetryDelayMs`, has been added to the `runWithRetry` and `requestWithRetry` functions. This enhancement allows callers to specify a maximum cumulative delay for all retry attempts, ensuring that operations fail faster by preventing exponential retries from exceeding a defined time limit. The change improves overall system responsiveness and resource utilization by providing better control over retry behavior.

This commit introduces an **invalid token cache** to the **Historian** service, enhancing its security and performance by preventing repeated validation attempts for known bad tokens. It integrates a Redis-backed cache into the `RiddlerService`, which now checks for and stores invalid tokens during the `verifyToken` process. The `IHistorianResourcesCustomizations` interface and `runnerFactory` are updated to support and initialize this new caching mechanism. This **new capability** streamlines token verification within the Historian, reducing load and improving response times for requests with invalid authentication.

This commit introduces a **performance optimization** by implementing an **invalid token cache** for the **Alfred** and **Nexus** services. It modifies the `TenantManager` within the `routerlicious-base` and `services` packages to store and retrieve tokens that have previously been deemed invalid by the Riddler service, preventing redundant API calls. This **new capability** significantly reduces the number of external validation requests, improving efficiency and reducing network load on the Riddler service during **token validation**. The change involves adding Redis client integration and updating the `verifyToken` logic to leverage this cache, impacting how `Alfred` and `Nexus` handle authentication.

This commit **integrates a new, shared deny list implementation** from `server-services-utils` into the **Historian service**, replacing its previous local version. It introduces `denyListMiddleware` across various **Git and repository route handlers** (e.g., `blobs`, `commits`, `refs`, `summaries`) to enforce access restrictions. This **feature enhancement** refactors the deny list instantiation to use separate document and tenant configurations, improving the service's ability to manage access control. The change ensures that all relevant Historian endpoints now leverage a standardized and more flexible deny list mechanism.

This commit introduces a **new capability** to **Alfred** and **Nexus** by implementing a comprehensive **document denyList** mechanism within the `routerlicious` service. This feature allows for blocking requests from specific tenants to mitigate DDoS attacks and preventing access to particular documents that might cause OOM issues due to their size, using a simplified single GUID for document identification. The implementation, primarily in `services-utils` with integration across Alfred's API routes and Nexus's `connectDocument` function, enhances the **security and stability** of the platform. This significantly improves the **robustness** of the service by providing granular control over access and resource consumption, with future plans to consolidate existing deny list logic from Historian into this new, unified system.

This commit **refactors** the **Historian service** by removing the `denyList` parameter from `createGitService` calls specifically for delete operations. The `denyList` mechanism, which is designed for DoS prevention, is not necessary for delete APIs and was therefore redundant. This change primarily affects **git reference deletion** and **summary deletion** within the `historian-base` package, streamlining the code and improving efficiency without impacting the service's security posture.