@lensmcp/cluster 1.18.4 → 1.18.6

package/basic-ssl.js

@@ -1,241 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CA_CERT_FILE = void 0;
-exports.caDir = caDir;
-exports.caCertPath = caCertPath;
-exports.getCertificateSync = getCertificateSync;
-exports.ensureCaSync = ensureCaSync;
-const tslib_1 = require("tslib");
-/**
- * Dev HTTPS certificates, mkcert-style: a long-lived LOCAL CA (10 years,
- * minted once per MACHINE, trusted once in the OS keychain) signs short-lived
- * leaf certs (30 days, re-minted per SAN set). Because the browser chains the
- * leaf to the trusted CA, cert rotation and new gateway hostnames never show
- * an interstitial again — unlike a bare self-signed cert, which would need
- * re-trusting on every change.
- *
- * The CA is MACHINE-LEVEL — `~/.lensmcp/ca/` (override the home via
- * `LENSMCP_HOME`, same convention as the workspace registry) — so every
- * workspace/daemon on the machine serves chains anchored to ONE CA:
- *  - the OS keychain holds exactly one "lensmcp local dev CA" (no same-CN
- *    collisions between per-workspace CAs shadowing each other in `trust`),
- *  - a pod's `NODE_EXTRA_CA_CERTS` stays valid across daemon handovers
- *    (guest workspace → own daemon), because every daemon signs with the
- *    same anchor.
- * The first machine-CA resolution PROMOTES a pre-existing per-workspace CA
- * (the pre-machine-CA layout) when one exists, so keychain trust already
- * granted to it carries over without another sudo prompt. LEAF certs stay
- * per-workspace in `<root>/node_modules/.cache/davnx-webpack` and are reused
- * only when they chain to the CURRENT machine CA (the issuer pin below).
- *
- * `getCertificateSync` returns ONE concatenated PEM (leaf key + leaf cert +
- * CA cert). Node's `https.createServer({ key: pem, cert: pem })` accepts it:
- * `key` takes the first private-key block, `cert` takes every certificate
- * block (leaf first, then the CA as the served chain).
- *
- * Trust once (macOS):
- *   sudo security add-trusted-cert -d -r trustRoot \
- *     -k /Library/Keychains/System.keychain ~/.lensmcp/ca/lensmcp-local-ca.crt
- */
-const crypto = tslib_1.__importStar(require("node:crypto"));
-const fs = tslib_1.__importStar(require("node:fs"));
-const os = tslib_1.__importStar(require("node:os"));
-const path = tslib_1.__importStar(require("node:path"));
-/** Re-mint the leaf when the cached one is older than this (TTL is 30 days). */
-const LEAF_MAX_AGE_MS = 25 * 24 * 60 * 60 * 1000;
-/** CA lifetime (~10 years) and the remaining-validity floor for reuse. */
-const CA_TTL_DAYS = 3650;
-const CA_MIN_REMAINING_MS = 30 * 24 * 60 * 60 * 1000;
-exports.CA_CERT_FILE = 'lensmcp-local-ca.crt';
-/** The legacy (pre-rebrand) CA filename — swept on mint so a stale `davnx-local-ca.crt` never lingers. */
-const LEGACY_CA_CERT_FILE = 'davnx-local-ca.crt';
-const CA_KEY_FILE = '_ca-key.pem';
-/** The machine-level CA directory: `~/.lensmcp/ca` (override home via `LENSMCP_HOME` — tests). */
-function caDir() {
-    const home = process.env['LENSMCP_HOME'] || os.homedir();
-    return path.join(home, '.lensmcp', 'ca');
-}
-/** Absolute path of the trust-once, machine-level CA certificate. */
-function caCertPath() {
-    return path.join(caDir(), exports.CA_CERT_FILE);
-}
-function getCertificateSync(cacheDir, name = 'lensmcp.dev', domains = []) {
-    // Resolve the CA FIRST (machine-level; promotes this workspace's legacy CA on first touch). The current
-    // CA pem then gates the leaf cache below — an issuer pin, see there.
-    const forge = require('node-forge');
-    fs.mkdirSync(cacheDir, { recursive: true });
-    const ca = loadOrCreateCa(forge, cacheDir);
-    const caPem = forge.pki.certificateToPem(ca.cert);
-    // The SAN set is part of the cache key: adding a gateway hostname must
-    // mint a fresh leaf, not serve a cached one that lacks the new SAN.
-    const sanKey = crypto
-        .createHash('sha256')
-        .update([name, ...[...domains].sort()].join('|'))
-        .digest('hex')
-        .slice(0, 12);
-    const leafPath = path.join(cacheDir, `_leaf-${sanKey}.pem`);
-    try {
-        const stat = fs.statSync(leafPath);
-        if (Date.now() - stat.ctimeMs < LEAF_MAX_AGE_MS) {
-            const cached = fs.readFileSync(leafPath, 'utf8');
-            // ISSUER PIN: the cached pem embeds the CA it chained to — serve it only when that is the CURRENT
-            // machine CA. With the CA machine-level, a stale leaf in THIS workspace can't be swept by a CA mint
-            // that happened elsewhere (another workspace, or pre-machine-CA code), so the old "a mint sweeps
-            // this dir's leaves" guarantee no longer covers every path; the pin does.
-            if (cached.includes(caPem))
-                return cached;
-        }
-    }
-    catch {
-        /* no cache yet */
-    }
-    const pem = createLeafCertificate(forge, ca, name, domains);
-    fs.writeFileSync(leafPath, pem);
-    // Stale leaves and the pre-1.3.4 self-signed cache just rot here — sweep
-    // them so the dir holds only the active leaf (+ any legacy CA pair, kept
-    // readable for older-code daemons that still anchor to it).
-    for (const f of fs.readdirSync(cacheDir)) {
-        const stale = (/^_leaf-.*\.pem$/.test(f) && f !== `_leaf-${sanKey}.pem`) ||
-            /^_cert.*\.pem$/.test(f) ||
-            /-dev\.crt$/.test(f) ||
-            f === LEGACY_CA_CERT_FILE;
-        if (stale) {
-            try {
-                fs.unlinkSync(path.join(cacheDir, f));
-            }
-            catch { /* best effort */ }
-        }
-    }
-    return pem;
-}
-/**
- * Ensure the machine-level CA exists (promoting `legacyCacheDir`'s per-workspace
- * CA when the machine store is still empty); returns the machine CA cert path.
- */
-function ensureCaSync(legacyCacheDir) {
-    const forge = require('node-forge');
-    loadOrCreateCa(forge, legacyCacheDir);
-    return caCertPath();
-}
-/** Read a CA pair from `dir`; undefined when absent, unreadable, or too close to expiry to reuse. */
-function readCaPair(dir, forge) {
-    try {
-        const cert = forge.pki.certificateFromPem(fs.readFileSync(path.join(dir, exports.CA_CERT_FILE), 'utf8'));
-        const key = forge.pki.privateKeyFromPem(fs.readFileSync(path.join(dir, CA_KEY_FILE), 'utf8'));
-        if (cert.validity.notAfter.getTime() - Date.now() > CA_MIN_REMAINING_MS) {
-            return { cert, key };
-        }
-    }
-    catch {
-        /* absent or unreadable */
-    }
-    return undefined;
-}
-function loadOrCreateCa(forge, promoteFromDir) {
-    const dir = caDir();
-    fs.mkdirSync(dir, { recursive: true });
-    const existing = readCaPair(dir, forge);
-    if (existing)
-        return existing;
-    // Files present but unusable (expired / half-written) — clear them so the `wx` claim below can win.
-    // Rotation this races is a once-per-decade event; last write wins is fine at dev grade.
-    for (const f of [CA_KEY_FILE, exports.CA_CERT_FILE]) {
-        try {
-            fs.unlinkSync(path.join(dir, f));
-        }
-        catch { /* absent */ }
-    }
-    // Candidate pair: PROMOTE the pre-machine-CA workspace pair when one exists — the exact cert the user
-    // already trusted in the keychain simply becomes the machine CA (no new sudo prompt). The workspace copy
-    // stays in place for any older-code daemon still anchoring to it. Otherwise mint fresh.
-    const promoted = promoteFromDir && promoteFromDir !== dir ? readCaPair(promoteFromDir, forge) : undefined;
-    const pair = promoted ?? mintCa(forge);
-    // Atomic claim on the KEY file (`wx`): concurrent daemons can race the first-ever machine resolution;
-    // exactly one pair may land on disk. The winner writes the cert right after; a loser adopts the winner's
-    // pair (bounded wait for that cert write).
-    try {
-        fs.writeFileSync(path.join(dir, CA_KEY_FILE), forge.pki.privateKeyToPem(pair.key), { mode: 0o600, flag: 'wx' });
-    }
-    catch (e) {
-        if (e.code !== 'EEXIST')
-            throw e;
-        const winner = spinReadCaPair(dir, forge);
-        if (winner)
-            return winner;
-        throw new Error(`machine dev CA at ${dir} is claimed but unreadable — remove the directory and retry`, { cause: e });
-    }
-    fs.writeFileSync(path.join(dir, exports.CA_CERT_FILE), forge.pki.certificateToPem(pair.cert));
-    if (promoted) {
-        console.log(`[ssl] promoted the existing workspace dev CA to the machine store (${dir}) — keychain trust carries over.`);
-    }
-    return pair;
-}
-/** Bounded sync wait for a concurrent claimer's cert write to land (claim→cert is two writes apart). */
-function spinReadCaPair(dir, forge) {
-    const deadline = Date.now() + 2000;
-    for (;;) {
-        const pair = readCaPair(dir, forge);
-        if (pair || Date.now() >= deadline)
-            return pair;
-        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25); // sync 25ms sleep
-    }
-}
-function mintCa(forge) {
-    const keys = forge.pki.rsa.generateKeyPair(2048);
-    const cert = forge.pki.createCertificate();
-    cert.publicKey = keys.publicKey;
-    cert.serialNumber = `00${Date.now().toString(16)}`;
-    cert.validity.notBefore = new Date(Date.now() - 24 * 60 * 60 * 1000); // clock-skew slack
-    cert.validity.notAfter = new Date();
-    cert.validity.notAfter.setDate(cert.validity.notAfter.getDate() + CA_TTL_DAYS);
-    const attrs = [
-        { name: 'commonName', value: 'lensmcp local dev CA' },
-        { name: 'organizationName', value: 'lensmcp' },
-        { shortName: 'OU', value: 'dev' },
-    ];
-    cert.setSubject(attrs);
-    cert.setIssuer(attrs);
-    cert.setExtensions([
-        { name: 'basicConstraints', cA: true, critical: true },
-        { name: 'keyUsage', keyCertSign: true, cRLSign: true, critical: true },
-        { name: 'subjectKeyIdentifier' },
-    ]);
-    cert.sign(keys.privateKey, forge.md.sha256.create());
-    return { cert, key: keys.privateKey };
-}
-function createLeafCertificate(forge, ca, name, domains, ttlDays = 30) {
-    const keys = forge.pki.rsa.generateKeyPair(2048);
-    const cert = forge.pki.createCertificate();
-    cert.publicKey = keys.publicKey;
-    cert.serialNumber = `00${Date.now().toString(16)}`;
-    cert.validity.notBefore = new Date(Date.now() - 24 * 60 * 60 * 1000); // clock-skew slack
-    cert.validity.notAfter = new Date();
-    cert.validity.notAfter.setDate(cert.validity.notAfter.getDate() + ttlDays);
-    cert.setSubject([
-        { name: 'commonName', value: name },
-        { name: 'organizationName', value: 'lensmcp' },
-        { shortName: 'OU', value: 'dev' },
-    ]);
-    cert.setIssuer(ca.cert.subject.attributes);
-    // SANs: localhost + loopbacks always; the gateway hostnames (incl. wildcards) on top.
-    const altNames = [
-        { type: 2, value: 'localhost' },
-        { type: 2, value: '*.localhost' },
-        { type: 7, ip: '127.0.0.1' },
-        { type: 7, ip: '::1' },
-        ...[...new Set(domains)].filter((d) => d && d !== 'localhost').map((d) => ({ type: 2, value: d })),
-    ];
-    // Apple/Chrome policy for leaf certs: SAN required, EKU serverAuth required,
-    // and a leaf must NOT be a CA — keyUsage stays signature/encipherment only.
-    cert.setExtensions([
-        { name: 'basicConstraints', cA: false },
-        { name: 'keyUsage', digitalSignature: true, keyEncipherment: true, critical: true },
-        { name: 'extKeyUsage', serverAuth: true, clientAuth: true },
-        { name: 'subjectAltName', altNames },
-        { name: 'subjectKeyIdentifier' },
-    ]);
-    cert.sign(ca.key, forge.md.sha256.create());
-    return (forge.pki.privateKeyToPem(keys.privateKey) +
-        forge.pki.certificateToPem(cert) +
-        forge.pki.certificateToPem(ca.cert));
-}
+"use strict";var f=Object.defineProperty;var c=(e,r)=>f(e,"name",{value:r,configurable:!0});var p=Object.defineProperty,a=c((e,r)=>p(e,"name",{value:r,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0}),exports.CA_CERT_FILE=void 0,exports.caDir=caDir,exports.caCertPath=caCertPath,exports.getCertificateSync=getCertificateSync,exports.ensureCaSync=ensureCaSync;const tslib_1=require("tslib"),crypto=tslib_1.__importStar(require("node:crypto")),fs=tslib_1.__importStar(require("node:fs")),os=tslib_1.__importStar(require("node:os")),path=tslib_1.__importStar(require("node:path")),LEAF_MAX_AGE_MS=600*60*60*1e3,CA_TTL_DAYS=3650,CA_MIN_REMAINING_MS=720*60*60*1e3;exports.CA_CERT_FILE="lensmcp-local-ca.crt";const LEGACY_CA_CERT_FILE="davnx-local-ca.crt",CA_KEY_FILE="_ca-key.pem";function caDir(){const e=process.env.LENSMCP_HOME||os.homedir();return path.join(e,".lensmcp","ca")}c(caDir,"caDir"),a(caDir,"caDir");function caCertPath(){return path.join(caDir(),exports.CA_CERT_FILE)}c(caCertPath,"caCertPath"),a(caCertPath,"caCertPath");function getCertificateSync(e,r="lensmcp.dev",t=[]){const n=require("node-forge");fs.mkdirSync(e,{recursive:!0});const l=loadOrCreateCa(n,e),o=n.pki.certificateToPem(l.cert),i=crypto.createHash("sha256").update([r,...[...t].sort()].join("|")).digest("hex").slice(0,12),s=path.join(e,`_leaf-${i}.pem`);try{const u=fs.statSync(s);if(Date.now()-u.ctimeMs<LEAF_MAX_AGE_MS){const m=fs.readFileSync(s,"utf8");if(m.includes(o))return m}}catch{}const y=createLeafCertificate(n,l,r,t);fs.writeFileSync(s,y);for(const u of fs.readdirSync(e))if(/^_leaf-.*\.pem$/.test(u)&&u!==`_leaf-${i}.pem`||/^_cert.*\.pem$/.test(u)||/-dev\.crt$/.test(u)||u===LEGACY_CA_CERT_FILE)try{fs.unlinkSync(path.join(e,u))}catch{}return y}c(getCertificateSync,"getCertificateSync"),a(getCertificateSync,"getCertificateSync");function ensureCaSync(e){const r=require("node-forge");return loadOrCreateCa(r,e),caCertPath()}c(ensureCaSync,"ensureCaSync"),a(ensureCaSync,"ensureCaSync");function readCaPair(e,r){try{const t=r.pki.certificateFromPem(fs.readFileSync(path.join(e,exports.CA_CERT_FILE),"utf8")),n=r.pki.privateKeyFromPem(fs.readFileSync(path.join(e,CA_KEY_FILE),"utf8"));if(t.validity.notAfter.getTime()-Date.now()>CA_MIN_REMAINING_MS)return{cert:t,key:n}}catch{}}c(readCaPair,"readCaPair"),a(readCaPair,"readCaPair");function loadOrCreateCa(e,r){const t=caDir();fs.mkdirSync(t,{recursive:!0});const n=readCaPair(t,e);if(n)return n;for(const i of[CA_KEY_FILE,exports.CA_CERT_FILE])try{fs.unlinkSync(path.join(t,i))}catch{}const l=r&&r!==t?readCaPair(r,e):void 0,o=l??mintCa(e);try{fs.writeFileSync(path.join(t,CA_KEY_FILE),e.pki.privateKeyToPem(o.key),{mode:384,flag:"wx"})}catch(i){if(i.code!=="EEXIST")throw i;const s=spinReadCaPair(t,e);if(s)return s;throw new Error(`machine dev CA at ${t} is claimed but unreadable \u2014 remove the directory and retry`,{cause:i})}return fs.writeFileSync(path.join(t,exports.CA_CERT_FILE),e.pki.certificateToPem(o.cert)),l&&console.log(`[ssl] promoted the existing workspace dev CA to the machine store (${t}) \u2014 keychain trust carries over.`),o}c(loadOrCreateCa,"loadOrCreateCa"),a(loadOrCreateCa,"loadOrCreateCa");function spinReadCaPair(e,r){const t=Date.now()+2e3;for(;;){const n=readCaPair(e,r);if(n||Date.now()>=t)return n;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,25)}}c(spinReadCaPair,"spinReadCaPair"),a(spinReadCaPair,"spinReadCaPair");function mintCa(e){const r=e.pki.rsa.generateKeyPair(2048),t=e.pki.createCertificate();t.publicKey=r.publicKey,t.serialNumber=`00${Date.now().toString(16)}`,t.validity.notBefore=new Date(Date.now()-1440*60*1e3),t.validity.notAfter=new Date,t.validity.notAfter.setDate(t.validity.notAfter.getDate()+CA_TTL_DAYS);const n=[{name:"commonName",value:"lensmcp local dev CA"},{name:"organizationName",value:"lensmcp"},{shortName:"OU",value:"dev"}];return t.setSubject(n),t.setIssuer(n),t.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,cRLSign:!0,critical:!0},{name:"subjectKeyIdentifier"}]),t.sign(r.privateKey,e.md.sha256.create()),{cert:t,key:r.privateKey}}c(mintCa,"mintCa"),a(mintCa,"mintCa");function createLeafCertificate(e,r,t,n,l=30){const o=e.pki.rsa.generateKeyPair(2048),i=e.pki.createCertificate();i.publicKey=o.publicKey,i.serialNumber=`00${Date.now().toString(16)}`,i.validity.notBefore=new Date(Date.now()-1440*60*1e3),i.validity.notAfter=new Date,i.validity.notAfter.setDate(i.validity.notAfter.getDate()+l),i.setSubject([{name:"commonName",value:t},{name:"organizationName",value:"lensmcp"},{shortName:"OU",value:"dev"}]),i.setIssuer(r.cert.subject.attributes);const s=[{type:2,value:"localhost"},{type:2,value:"*.localhost"},{type:7,ip:"127.0.0.1"},{type:7,ip:"::1"},...[...new Set(n)].filter(y=>y&&y!=="localhost").map(y=>({type:2,value:y}))];return i.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0,critical:!0},{name:"extKeyUsage",serverAuth:!0,clientAuth:!0},{name:"subjectAltName",altNames:s},{name:"subjectKeyIdentifier"}]),i.sign(r.key,e.md.sha256.create()),e.pki.privateKeyToPem(o.privateKey)+e.pki.certificateToPem(i)+e.pki.certificateToPem(r.cert)}c(createLeafCertificate,"createLeafCertificate"),a(createLeafCertificate,"createLeafCertificate");

package/build-scope-patterns.js

@@ -1,40 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildScopePatterns = buildScopePatterns;
-function buildScopePatterns(orgScopes) {
-    const allowlistPatterns = [];
-    const scopePrefixes = [];
-    const scopePatterns = [];
-    for (const scope of orgScopes) {
-        if (!scope)
-            continue;
-        const regexMatch = scope.match(/^\/(.+)\/([gimsuy]*)$/);
-        if (regexMatch) {
-            // Regex: /pattern/flags — strip 'g' flag to avoid stateful lastIndex in .test()
-            const flags = regexMatch[2].replace('g', '');
-            const regex = new RegExp(regexMatch[1], flags);
-            allowlistPatterns.push(regex);
-            scopePatterns.push(regex);
-        }
-        else if (scope.includes('/')) {
-            // Prefix: @frontegg/agenshield → matches @frontegg/agenshield*
-            const escaped = scope.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-            allowlistPatterns.push(new RegExp(`^${escaped}`));
-            scopePrefixes.push(scope);
-        }
-        else if (scope.startsWith('@')) {
-            // Org scope: @myorg → matches @myorg/*
-            const escaped = scope.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-            allowlistPatterns.push(new RegExp(`^${escaped}/`));
-            scopePrefixes.push(scope.endsWith('/') ? scope : `${scope}/`);
-        }
-        else {
-            // Exact package name: lodash → matches lodash and lodash/subpath
-            const escaped = scope.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-            const regex = new RegExp(`^${escaped}(/|$)`);
-            allowlistPatterns.push(regex);
-            scopePatterns.push(regex);
-        }
-    }
-    return { allowlistPatterns, scopePrefixes, scopePatterns };
-}
+"use strict";var l=Object.defineProperty;var i=(n,s)=>l(n,"name",{value:s,configurable:!0});var a=Object.defineProperty,u=i((n,s)=>a(n,"name",{value:s,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.buildScopePatterns=buildScopePatterns;function buildScopePatterns(n){const s=[],p=[],r=[];for(const e of n){if(!e)continue;const o=e.match(/^\/(.+)\/([gimsuy]*)$/);if(o){const t=o[2].replace("g",""),c=new RegExp(o[1],t);s.push(c),r.push(c)}else if(e.includes("/")){const t=e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");s.push(new RegExp(`^${t}`)),p.push(e)}else if(e.startsWith("@")){const t=e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");s.push(new RegExp(`^${t}/`)),p.push(e.endsWith("/")?e:`${e}/`)}else{const t=e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),c=new RegExp(`^${t}(/|$)`);s.push(c),r.push(c)}}return{allowlistPatterns:s,scopePrefixes:p,scopePatterns:r}}i(buildScopePatterns,"buildScopePatterns"),u(buildScopePatterns,"buildScopePatterns");

package/create-webpack-dev.js

@@ -1,186 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createDevWebpackConfig = createDevWebpackConfig;
-const tslib_1 = require("tslib");
-const app_plugin_1 = require("@nx/webpack/app-plugin");
-const fs = tslib_1.__importStar(require("node:fs"));
-const path = tslib_1.__importStar(require("node:path"));
-const webpack_node_externals_1 = tslib_1.__importDefault(require("webpack-node-externals"));
-const build_scope_patterns_1 = require("./build-scope-patterns");
-const tsgo_check_plugin_1 = require("./tsgo-check-plugin");
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const webpack = require('webpack');
-class DevServerReloadPlugin {
-    constructor(port, secure = false) {
-        // When the parent terminates TLS (gateway.https), notify over https with the
-        // self-signed cert accepted — the cert is ours (basic-ssl style, cached locally).
-        this.secure = secure;
-        this.url = `${secure ? 'https' : 'http'}://localhost:${port}/webpack/reload`;
-    }
-    notify() {
-        return new Promise((resolve, reject) => {
-            // eslint-disable-next-line @typescript-eslint/no-require-imports
-            const mod = (this.secure ? require('node:https') : require('node:http'));
-            const req = mod.request(this.url, { method: 'POST', headers: { 'content-type': 'application/json' }, rejectUnauthorized: false }, (res) => { res.resume(); res.on('end', resolve); });
-            req.on('error', reject);
-            req.end('{}');
-        });
-    }
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    apply(compiler) {
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        compiler.hooks.done.tap('DevServerReloadPlugin', async (stats) => {
-            try {
-                if (stats.hasErrors())
-                    return;
-                await this.notify();
-                console.log('[DevServerReloadPlugin] notified devserver to reload');
-            }
-            catch {
-                console.log('[DevServerReloadPlugin] devserver not running yet');
-            }
-        });
-    }
-}
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function createDevWebpackConfig(options) {
-    const { appRoot, outputDir, main, tsConfig, workspaceRoot, assets = [], port, memoryLimit = 8192, buildLibsFromSource = true, orgScopes = [], bundlePackages = [], additionalEntryPoints = [], nodeExternalsConfig: userNodeExternalsConfig, webpackConfigPath, } = options;
-    const { allowlistPatterns, scopePrefixes, scopePatterns } = (0, build_scope_patterns_1.buildScopePatterns)(orgScopes);
-    // Type-checking mode (LENSMCP_TYPECHECK): default = the resident fork-ts-checker pair (async,
-    // feeds the lens `error TS` service-error signal); 'off' = none (fastest, quietest — the signal
-    // is traded away); 'tsgo' = zero-resident cold re-checks via @typescript/native-preview (same
-    // signal, no idle memory — see tsgo-check-plugin.ts).
-    //
-    // tsgo still falls back to fork-ts-checker when no binary resolves — degrading gracefully beats
-    // failing a dev server — but that fallback is now an ANOMALY, not the expected "the flag shipped
-    // ahead of the devDep" state: @lensmcp/cluster DEPENDS on the compiler. So it also reports itself
-    // onto the lens bus. fork-ts-checker publishes to the CONSOLE only, so without this the
-    // `typecheck://` resources would sit at `producer: 'none'` with nothing naming the reason —
-    // the precise "looks healthy because nobody is watching" state this producer exists to end.
-    const typecheckMode = process.env.LENSMCP_TYPECHECK;
-    const tsgoBin = typecheckMode === 'tsgo' ? (0, tsgo_check_plugin_1.resolveTsgoBin)(workspaceRoot, process.env.LENSMCP_TSGO_BIN) : null;
-    if (typecheckMode === 'tsgo' && !tsgoBin) {
-        // No trailing period: `summariseProducers` renders this INSIDE a sentence it terminates itself.
-        const detail = `${tsgo_check_plugin_1.TSGO_MISSING_CAUSE}. Fell back to fork-ts-checker, which reports to the console only — ` +
-            `so typecheck:// has no producer for this project until it is fixed`;
-        console.warn(`[serve] ${options.appName}: LENSMCP_TYPECHECK=tsgo but ${detail}.`);
-        (0, tsgo_check_plugin_1.reportTsgoUnavailable)({ appName: options.appName, tsConfig, workspaceRoot, detail });
-    }
-    const useTsgo = !!tsgoBin;
-    // Build combined allowlist: orgScopes + bundlePackages + user-provided
-    const bundlePatterns = bundlePackages.map((pkg) => new RegExp(`^${pkg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(/|$)`));
-    const combinedAllowlist = [
-        /webpack\/hot\/poll\?100/,
-        ...allowlistPatterns,
-        ...bundlePatterns,
-        ...(userNodeExternalsConfig?.allowlist || []),
-    ];
-    const config = {
-        output: {
-            path: outputDir,
-            ...(process.env.NODE_ENV !== 'production' && {
-                devtoolModuleFilenameTemplate: '[absolute-resource-path]',
-            }),
-            clean: true,
-        },
-        externals: [
-            (0, webpack_node_externals_1.default)({
-                allowlist: combinedAllowlist,
-                additionalModuleDirs: userNodeExternalsConfig?.additionalModuleDirs || [],
-                ...(userNodeExternalsConfig?.importType && { importType: userNodeExternalsConfig.importType }),
-            }),
-            ({ request }, callback) => {
-                // Workspace-internal absolute requests are SOURCE regardless of the
-                // bucket layout (apps/, libs/, server/, shared/, web/, …) — bundle them.
-                // The apps/libs prefix checks below stay for explicitness/back-compat.
-                if (request &&
-                    path.isAbsolute(request) &&
-                    request.startsWith(workspaceRoot) &&
-                    !request.includes('node_modules')) {
-                    return callback();
-                }
-                if (request &&
-                    (request.startsWith(path.join(workspaceRoot, 'apps')) ||
-                        request.startsWith(path.join(workspaceRoot, 'libs')))) {
-                    return callback();
-                }
-                if (request && scopePrefixes.some((prefix) => request.startsWith(prefix))) {
-                    return callback();
-                }
-                if (request && scopePatterns.some((pattern) => pattern.test(request))) {
-                    return callback();
-                }
-                if (request && bundlePatterns.some((pattern) => pattern.test(request))) {
-                    return callback();
-                }
-                if (request && !(request.startsWith('./') || request.startsWith('..'))) {
-                    // Bare specifier: only a real node_modules package may stay external —
-                    // tsconfig-path aliases (e.g. @org/contracts → workspace source) must bundle.
-                    const rootSegment = request.startsWith('@')
-                        ? request.split('/').slice(0, 2).join('/')
-                        : request.split('/')[0];
-                    if (!fs.existsSync(path.join(workspaceRoot, 'node_modules', rootSegment))) {
-                        return callback();
-                    }
-                    return callback(null, `commonjs ${request}`);
-                }
-                return callback();
-            },
-        ],
-        mode: 'development',
-        devtool: 'eval-cheap-module-source-map',
-        plugins: [
-            new webpack.HotModuleReplacementPlugin(),
-            new app_plugin_1.NxAppWebpackPlugin({
-                target: 'node22',
-                compiler: 'tsc',
-                main,
-                additionalEntryPoints,
-                verbose: true,
-                sourceMap: 'eval-cheap-module-source-map',
-                mergeExternals: true,
-                externalDependencies: [],
-                memoryLimit,
-                tsConfig,
-                assets,
-                optimization: false,
-                progress: false,
-                outputHashing: 'none',
-                generatePackageJson: false,
-                watchDependencies: true,
-                // Type checking = the fork-ts-checker pair (2 worker processes, ~80MB per service) AND the
-                // source of the in-pod `error TS…` lines the gateway sniffs into the lens "service error"
-                // signal. Default ON. `LENSMCP_TYPECHECK=off` trades the signal for memory/CPU;
-                // `LENSMCP_TYPECHECK=tsgo` keeps the signal at zero resident cost (the TsgoCheckPlugin
-                // below replaces the resident pair with debounced cold native checks).
-                typeCheckOptions: process.env.LENSMCP_TYPECHECK === 'off' || useTsgo ? false : { async: true },
-                buildLibsFromSource,
-            }),
-            new DevServerReloadPlugin(port, options.httpsReload === true),
-            ...(useTsgo
-                ? [
-                    new tsgo_check_plugin_1.TsgoCheckPlugin({
-                        appName: options.appName,
-                        tsConfig,
-                        workspaceRoot,
-                        ...(process.env.LENSMCP_TSGO_BIN ? { binPath: process.env.LENSMCP_TSGO_BIN } : {}),
-                    }),
-                ]
-                : []),
-        ],
-        snapshot: { managedPaths: [/^(.+?[\\/])?node_modules[\\/]/] },
-        watch: true,
-        watchOptions: {
-            ignored: ['**/*.env.template', '**/config.template.json', '**/*.md', '**/dist/**', '**/migrations/**'],
-        },
-        cache: { type: 'filesystem' },
-    };
-    // Apply user webpack overrides if configured
-    if (webpackConfigPath) {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const overrideModule = require(path.resolve(appRoot, webpackConfigPath));
-        const overrideFn = overrideModule.default || overrideModule;
-        return overrideFn(config);
-    }
-    return config;
-}
+"use strict";var x=Object.defineProperty;var u=(o,t)=>x(o,"name",{value:t,configurable:!0});var T=Object.defineProperty,l=u((o,t)=>T(o,"name",{value:t,configurable:!0}),"l");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createDevWebpackConfig=createDevWebpackConfig;const tslib_1=require("tslib"),app_plugin_1=require("@nx/webpack/app-plugin"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path")),webpack_node_externals_1=tslib_1.__importDefault(require("webpack-node-externals")),build_scope_patterns_1=require("./build-scope-patterns"),tsgo_check_plugin_1=require("./tsgo-check-plugin"),webpack=require("webpack");class DevServerReloadPlugin{static{u(this,"DevServerReloadPlugin")}static{l(this,"DevServerReloadPlugin")}constructor(t,s=!1){this.secure=s,this.url=`${s?"https":"http"}://localhost:${t}/webpack/reload`}notify(){return new Promise((t,s)=>{const i=(this.secure?require("node:https"):require("node:http")).request(this.url,{method:"POST",headers:{"content-type":"application/json"},rejectUnauthorized:!1},a=>{a.resume(),a.on("end",t)});i.on("error",s),i.end("{}")})}apply(t){t.hooks.done.tap("DevServerReloadPlugin",async s=>{try{if(s.hasErrors())return;await this.notify(),console.log("[DevServerReloadPlugin] notified devserver to reload")}catch{console.log("[DevServerReloadPlugin] devserver not running yet")}})}}function createDevWebpackConfig(o){const{appRoot:t,outputDir:s,main:i,tsConfig:a,workspaceRoot:r,assets:f=[],port:b,memoryLimit:P=8192,buildLibsFromSource:k=!0,orgScopes:w=[],bundlePackages:S=[],additionalEntryPoints:C=[],nodeExternalsConfig:p,webpackConfigPath:d}=o,{allowlistPatterns:y,scopePrefixes:E,scopePatterns:N}=(0,build_scope_patterns_1.buildScopePatterns)(w),h=process.env.LENSMCP_TYPECHECK,m=h==="tsgo"?(0,tsgo_check_plugin_1.resolveTsgoBin)(r,process.env.LENSMCP_TSGO_BIN):null;if(h==="tsgo"&&!m){const e=`${tsgo_check_plugin_1.TSGO_MISSING_CAUSE}. Fell back to fork-ts-checker, which reports to the console only \u2014 so typecheck:// has no producer for this project until it is fixed`;console.warn(`[serve] ${o.appName}: LENSMCP_TYPECHECK=tsgo but ${e}.`),(0,tsgo_check_plugin_1.reportTsgoUnavailable)({appName:o.appName,tsConfig:a,workspaceRoot:r,detail:e})}const g=!!m,v=S.map(e=>new RegExp(`^${e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}(/|$)`)),D=[/webpack\/hot\/poll\?100/,...y,...v,...p?.allowlist||[]],_={output:{path:s,...process.env.NODE_ENV!=="production"&&{devtoolModuleFilenameTemplate:"[absolute-resource-path]"},clean:!0},externals:[(0,webpack_node_externals_1.default)({allowlist:D,additionalModuleDirs:p?.additionalModuleDirs||[],...p?.importType&&{importType:p.importType}}),({request:e},c)=>{if(e&&path.isAbsolute(e)&&e.startsWith(r)&&!e.includes("node_modules")||e&&(e.startsWith(path.join(r,"apps"))||e.startsWith(path.join(r,"libs")))||e&&E.some(n=>e.startsWith(n))||e&&N.some(n=>n.test(e))||e&&v.some(n=>n.test(e)))return c();if(e&&!(e.startsWith("./")||e.startsWith(".."))){const n=e.startsWith("@")?e.split("/").slice(0,2).join("/"):e.split("/")[0];return fs.existsSync(path.join(r,"node_modules",n))?c(null,`commonjs ${e}`):c()}return c()}],mode:"development",devtool:"eval-cheap-module-source-map",plugins:[new webpack.HotModuleReplacementPlugin,new app_plugin_1.NxAppWebpackPlugin({target:"node22",compiler:"tsc",main:i,additionalEntryPoints:C,verbose:!0,sourceMap:"eval-cheap-module-source-map",mergeExternals:!0,externalDependencies:[],memoryLimit:P,tsConfig:a,assets:f,optimization:!1,progress:!1,outputHashing:"none",generatePackageJson:!1,watchDependencies:!0,typeCheckOptions:process.env.LENSMCP_TYPECHECK==="off"||g?!1:{async:!0},buildLibsFromSource:k}),new DevServerReloadPlugin(b,o.httpsReload===!0),...g?[new tsgo_check_plugin_1.TsgoCheckPlugin({appName:o.appName,tsConfig:a,workspaceRoot:r,...process.env.LENSMCP_TSGO_BIN?{binPath:process.env.LENSMCP_TSGO_BIN}:{}})]:[]],snapshot:{managedPaths:[/^(.+?[\\/])?node_modules[\\/]/]},watch:!0,watchOptions:{ignored:["**/*.env.template","**/config.template.json","**/*.md","**/dist/**","**/migrations/**"]},cache:{type:"filesystem"}};if(d){const e=require(path.resolve(t,d));return(e.default||e)(_)}return _}u(createDevWebpackConfig,"createDevWebpackConfig"),l(createDevWebpackConfig,"createDevWebpackConfig");