@lensmcp/cluster 1.18.4 → 1.18.6

package/executors/gateway/runtime/scope.js

@@ -1,117 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.baseDomainOf = baseDomainOf;
-exports.readLensScope = readLensScope;
-exports.deriveMcpHttpPort = deriveMcpHttpPort;
-exports.readSourceSetExclude = readSourceSetExclude;
-exports.lensKeyFrom = lensKeyFrom;
-exports.lensSlug = lensSlug;
-const tslib_1 = require("tslib");
-/**
- * Per-workspace lens scope + dashboard-host derivation. Pure (fs reads only),
- * mirrors the `lensmcp` CLI's `workspace-scope` (kept in lock-step).
- */
-const fs = tslib_1.__importStar(require("node:fs"));
-const path = tslib_1.__importStar(require("node:path"));
-/** The base domain for the lens dashboard host — the longest common dotted
- *  suffix of the declared cluster hosts (e.g. ['api.tetros.ai.local',
- *  'tetros.ai.local'] → 'tetros.ai.local'). Falls back to the first host, then
- *  to 'lens.local' if no host is declared. */
-function baseDomainOf(hosts) {
-    const clean = hosts.filter((h) => !!h && !h.startsWith('*.'));
-    if (clean.length === 0)
-        return 'local';
-    // Use the SHORTEST host as the candidate base (most likely the apex), then
-    // require every other host to end with it.
-    const shortest = clean.reduce((a, b) => (b.length < a.length ? b : a));
-    if (clean.every((h) => h === shortest || h.endsWith('.' + shortest)))
-        return shortest;
-    // No clean common apex — derive the trailing 2-3 labels of the shortest host.
-    const parts = shortest.split('.');
-    return parts.slice(-Math.min(parts.length, 3)).join('.');
-}
-/** Lens-infra port bases — must equal `BASE_PORTS` in the CLI's workspace-scope. */
-const BASE_PORTS = { dashboard: 4321, mcpHttp: 4500 };
-/** FNV-1a → 0..(range-1). Same derivation as the CLI's `hashToRange`. */
-function hashToRange(s, range) {
-    let h = 0x811c9dc5;
-    for (let i = 0; i < s.length; i++) {
-        h ^= s.charCodeAt(i);
-        h = Math.imul(h, 0x01000193);
-    }
-    return Math.abs(h | 0) % range;
-}
-/** Per-workspace lens scope (key + ports + mount path). Prefers the
- *  CLI-written `.lensmcp/config.json` (so the gateway agrees with `lensmcp gateway`
- *  / `lensmcp dashboard` / the MCP shim); falls back to deriving from the workspace. */
-function readLensScope(root) {
-    try {
-        const cfg = JSON.parse(fs.readFileSync(path.join(root, '.lensmcp', 'config.json'), 'utf8'));
-        if (cfg && typeof cfg.key === 'string') {
-            return {
-                key: cfg.key,
-                dashboardPort: cfg.ports?.dashboard ?? BASE_PORTS.dashboard,
-                // Derive rather than fall back to a constant: a constant would put two
-                // config-less workspaces on ONE port, which is the cross-feed bug.
-                mcpHttpPort: cfg.ports?.mcpHttp ?? deriveMcpHttpPort(cfg.key),
-                basePath: cfg.dashboardBasePath ?? '/' + cfg.key,
-            };
-        }
-    }
-    catch {
-        /* no config yet — derive below */
-    }
-    const key = lensKeyFrom(root);
-    return {
-        key,
-        dashboardPort: BASE_PORTS.dashboard,
-        mcpHttpPort: deriveMcpHttpPort(key),
-        basePath: '/' + key,
-    };
-}
-/** The workspace's MCP HTTP port, derived from its key. In lock-step with the CLI. */
-function deriveMcpHttpPort(key) {
-    return BASE_PORTS.mcpHttp + hashToRange(key, 200);
-}
-/**
- * Per-workspace extra SOURCE-SET excludes (`.lensmcp/config.json` →
- * `sourceSet.exclude: string[]`) — top-level dir names the staleness scanner
- * must NOT treat as source. The scanner deliberately over-includes every
- * unmanaged bucket (`shared/`, `docs/`, …) in every pod's scope, but a bucket
- * like `docs/` can host source-extension files (`.json`, `.mdx`) that no pod
- * can ever import — each add there flips the signature and recycles pods for
- * nothing (foodguard 2026-07-29: a `docs/**\/*-intake.json` add recycled the
- * dashboard; 475 recycles in one day were scope-C adds). Names only (no
- * globs), matched exactly like the built-in excludes. Empty when unset.
- */
-function readSourceSetExclude(root) {
-    try {
-        const cfg = JSON.parse(fs.readFileSync(path.join(root, '.lensmcp', 'config.json'), 'utf8'));
-        const raw = cfg?.sourceSet?.exclude;
-        if (Array.isArray(raw)) {
-            return new Set(raw.filter((d) => typeof d === 'string' && d.length > 0 && !d.includes('/')));
-        }
-    }
-    catch {
-        /* no config — nothing extra to exclude */
-    }
-    return new Set();
-}
-function lensKeyFrom(root) {
-    try {
-        const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
-        if (pkg?.name)
-            return lensSlug(pkg.name);
-    }
-    catch {
-        /* fall through to dir name */
-    }
-    return lensSlug(path.basename(root));
-}
-function lensSlug(input) {
-    return (input
-        .toLowerCase()
-        .replace(/^@[^/]+\//, '')
-        .replace(/[^a-z0-9]+/g, '-')
-        .replace(/(^-|-$)/g, '') || 'workspace');
-}
+"use strict";var p=Object.defineProperty;var n=(t,r)=>p(t,"name",{value:r,configurable:!0});var c=Object.defineProperty,s=n((t,r)=>c(t,"name",{value:r,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.baseDomainOf=baseDomainOf,exports.readLensScope=readLensScope,exports.deriveMcpHttpPort=deriveMcpHttpPort,exports.readSourceSetExclude=readSourceSetExclude,exports.lensKeyFrom=lensKeyFrom,exports.lensSlug=lensSlug;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path"));function baseDomainOf(t){const r=t.filter(o=>!!o&&!o.startsWith("*."));if(r.length===0)return"local";const e=r.reduce((o,i)=>i.length<o.length?i:o);if(r.every(o=>o===e||o.endsWith("."+e)))return e;const a=e.split(".");return a.slice(-Math.min(a.length,3)).join(".")}n(baseDomainOf,"baseDomainOf"),s(baseDomainOf,"baseDomainOf");const BASE_PORTS={dashboard:4321,mcpHttp:4500};function hashToRange(t,r){let e=2166136261;for(let a=0;a<t.length;a++)e^=t.charCodeAt(a),e=Math.imul(e,16777619);return Math.abs(e|0)%r}n(hashToRange,"hashToRange"),s(hashToRange,"hashToRange");function readLensScope(t){try{const e=JSON.parse(fs.readFileSync(path.join(t,".lensmcp","config.json"),"utf8"));if(e&&typeof e.key=="string")return{key:e.key,dashboardPort:e.ports?.dashboard??BASE_PORTS.dashboard,mcpHttpPort:e.ports?.mcpHttp??deriveMcpHttpPort(e.key),basePath:e.dashboardBasePath??"/"+e.key}}catch{}const r=lensKeyFrom(t);return{key:r,dashboardPort:BASE_PORTS.dashboard,mcpHttpPort:deriveMcpHttpPort(r),basePath:"/"+r}}n(readLensScope,"readLensScope"),s(readLensScope,"readLensScope");function deriveMcpHttpPort(t){return BASE_PORTS.mcpHttp+hashToRange(t,200)}n(deriveMcpHttpPort,"deriveMcpHttpPort"),s(deriveMcpHttpPort,"deriveMcpHttpPort");function readSourceSetExclude(t){try{const r=JSON.parse(fs.readFileSync(path.join(t,".lensmcp","config.json"),"utf8"))?.sourceSet?.exclude;if(Array.isArray(r))return new Set(r.filter(e=>typeof e=="string"&&e.length>0&&!e.includes("/")))}catch{}return new Set}n(readSourceSetExclude,"readSourceSetExclude"),s(readSourceSetExclude,"readSourceSetExclude");function lensKeyFrom(t){try{const r=JSON.parse(fs.readFileSync(path.join(t,"package.json"),"utf8"));if(r?.name)return lensSlug(r.name)}catch{}return lensSlug(path.basename(t))}n(lensKeyFrom,"lensKeyFrom"),s(lensKeyFrom,"lensKeyFrom");function lensSlug(t){return t.toLowerCase().replace(/^@[^/]+\//,"").replace(/[^a-z0-9]+/g,"-").replace(/(^-|-$)/g,"")||"workspace"}n(lensSlug,"lensSlug"),s(lensSlug,"lensSlug");

package/executors/gateway/runtime/server.js

@@ -1,487 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BENIGN_SOCKET_ERRNOS = void 0;
-exports.buildEdgeVerifierPool = buildEdgeVerifierPool;
-exports.classifyClientError = classifyClientError;
-exports.createClientErrorLogGate = createClientErrorLogGate;
-exports.startGateway = startGateway;
-const tslib_1 = require("tslib");
-/**
- * The composition root. `startGateway` resolves options, discovers routes, wires
- * every layer (observability → service lifecycle → lens children → proxy → auth →
- * hooks → handler/upgrade), boots TLS + listeners, and returns a `GatewayHandle`.
- *
- * The TOP-TO-BOTTOM ORDER here is itself a contract: service keys load before the
- * runtime is built; lens children boot (pushing the dashboard route) BEFORE the
- * cert SANs are derived from `routes`; eager services boot before listeners; the
- * `gateway-up` event fires only after the ports are bound.
- */
-const http = tslib_1.__importStar(require("node:http"));
-const path = tslib_1.__importStar(require("node:path"));
-const discovery_1 = require("./discovery");
-const scope_1 = require("./scope");
-const route_registry_1 = require("./route-registry");
-const control_1 = require("./control");
-const workspace_registry_1 = require("./workspace-registry");
-const service_keys_1 = require("./service-keys");
-const observability_1 = require("./observability");
-const lifecycle_1 = require("./lifecycle");
-const lens_children_1 = require("./lens-children");
-const proxy_1 = require("./proxy");
-const auth_1 = require("./auth");
-const hooks_1 = require("./hooks");
-const handler_1 = require("./handler");
-const upgrade_1 = require("./upgrade");
-const jwks_verify_1 = require("../jwks-verify");
-const types_1 = require("./types");
-/**
- * A `fetch`-shaped shim for the JWKS pull that accepts the dev gateway's OWN self-signed cert. The dev
- * IdP's JWKS is served behind the same local HTTPS front door (e.g. `https://auth.tetros.ai.local`), whose
- * cert chains to the local basic-ssl CA — global `fetch` would reject it. Read-only GET of a public,
- * gateway-served JWKS document; the SIGNATURE trust comes from verifying tokens against those keys, not
- * from the transport. Falls back to plain `http` for an http URL. Dev-only (only the dev executor uses it).
- */
-function insecureLocalFetch(url, init) {
-    return new Promise((resolve, reject) => {
-        const mod = url.startsWith('https:') ? require('node:https') : require('node:http');
-        const req = mod.request(url, { method: 'GET', headers: init?.headers, rejectUnauthorized: false }, (res) => {
-            const chunks = [];
-            res.on('data', (c) => chunks.push(c));
-            res.on('end', () => {
-                const status = res.statusCode ?? 0;
-                const text = Buffer.concat(chunks).toString('utf8');
-                resolve({ ok: status >= 200 && status < 300, status, json: async () => JSON.parse(text) });
-            });
-        });
-        req.on('error', reject);
-        req.end();
-    });
-}
-/**
- * The dev edge's JWT verifiers — matching the prod gateway's RS256/JWKS posture so the LOCAL edge rejects
- * forged tokens instead of decode-accepting them, and MULTI-ISSUER for the shared daemon: every
- * `auth.<apex>` host in the LIVE route table is an IdP for its apex, and `for(host)` picks the verifier
- * whose apex the request host belongs to (longest apex wins) — so a foodguard token is verified against
- * `auth.foodguard.local/jwks.json`, a tetros token against `auth.tetros.ai.local/jwks.json`, on the SAME
- * :443 daemon. `LENSMCP_GW_JWKS_URL` (explicit, same env as prod) keeps its old meaning: one verifier for
- * everything. Auth hosts come from project.json (trusted), never from a token — no SSRF/attacker-chosen
- * JWKS. `for()` returns undefined when the host matches no IdP apex (→ non-HS256 tokens fail closed
- * unless the insecure opt-in is set).
- */
-function buildEdgeVerifierPool(getRoutes) {
-    const explicit = process.env['LENSMCP_GW_JWKS_URL'];
-    const issuer = process.env['LENSMCP_GW_JWT_ISS'];
-    const byApex = new Map();
-    let explicitVerifier;
-    const make = (jwksUrl, label) => {
-        console.log(`[gateway] edge JWT: verifying via JWKS ${jwksUrl}${label}`);
-        const v = (0, jwks_verify_1.createJwksVerifier)({ jwksUrl, ...(issuer ? { issuer } : {}), fetchImpl: insecureLocalFetch });
-        void v.refresh().catch((e) => console.warn('[gateway] edge JWKS warm failed (will retry):', e.message));
-        return v;
-    };
-    return {
-        // PER-APEX resolution over the LIVE route table: every `auth.<apex>` host is an
-        // IdP for its apex, so a SHARED multi-workspace daemon verifies each workspace's
-        // tokens against ITS OWN IdP's JWKS. Reading the routes lazily means a workspace
-        // REGISTERED LATER (control-plane /register) gets its verifier with no rebuild
-        // hook — and `LENSMCP_GW_JWKS_URL` keeps its old meaning (one verifier for all).
-        // The auth host comes from project.json (trusted), never from a token — no
-        // attacker-chosen JWKS.
-        for(host) {
-            if (explicit)
-                return (explicitVerifier ??= make(explicit, ''));
-            const h = host.split(':')[0].toLowerCase();
-            let best;
-            for (const r of getRoutes()) {
-                const rh = r.host;
-                if (typeof rh !== 'string' || !/^auth\./.test(rh) || rh.startsWith('internal.'))
-                    continue;
-                const apex = rh.slice('auth.'.length);
-                if ((h === apex || h.endsWith(`.${apex}`)) && (!best || apex.length > best.length))
-                    best = apex;
-            }
-            if (!best)
-                return undefined;
-            let v = byApex.get(best);
-            if (!v) {
-                v = make(`https://auth.${best}/jwks.json`, ` (auto-derived for apex ${best})`);
-                byApex.set(best, v);
-            }
-            return v;
-        },
-        stop() {
-            explicitVerifier?.stop();
-            for (const v of byApex.values())
-                v.stop();
-        },
-    };
-}
-/** Client-abort errnos that are NORMAL front-door traffic (a closed tab, a sleeping laptop, a canceled
- *  HMR socket) — dropped quietly. Anything else on an inbound socket is logged before the drop. */
-exports.BENIGN_SOCKET_ERRNOS = new Set(['ECONNRESET', 'EPIPE', 'ETIMEDOUT', 'ECONNABORTED', 'ECANCELED']);
-function classifyClientError(code, message) {
-    if (code && exports.BENIGN_SOCKET_ERRNOS.has(code))
-        return { status: null, report: false, cause: 'client-abort' };
-    // Peer half-closed mid-message: nobody is waiting for a 400, and writing one is the spurious-400 vector.
-    if (code === 'HPE_INVALID_EOF_STATE')
-        return { status: null, report: false, cause: 'truncated-at-eof' };
-    if (code === 'ERR_HTTP_REQUEST_TIMEOUT')
-        return { status: 408, report: true, cause: 'request-timeout' };
-    if (code === 'HPE_HEADER_OVERFLOW')
-        return { status: 431, report: true, cause: 'header-overflow' };
-    if (code?.startsWith('HPE_'))
-        return { status: 400, report: true, cause: 'parse-error' };
-    return { status: 400, report: true, cause: code ?? message ?? 'unknown' };
-}
-const CLIENT_ERROR_REASON = {
-    400: 'Bad Request',
-    408: 'Request Timeout',
-    431: 'Request Header Fields Too Large',
-};
-/** Per-cause log throttle for `clientError`: a desynced client or a port scanner can produce these in a
- *  tight loop, and the point is a dev NOTICING one — not drowning in thousands. One line per cause per
- *  window; the suppressed count rides the next admitted line. Exported for the unit test. */
-function createClientErrorLogGate(windowMs = 10_000) {
-    const lastAt = new Map();
-    return (cause) => {
-        const now = Date.now();
-        const prev = lastAt.get(cause) ?? 0;
-        if (now - prev < windowMs)
-            return false;
-        lastAt.set(cause, now);
-        return true;
-    };
-}
-/** Attach the inbound-socket error guard. EVERY socket the front door accepts gets an 'error' listener
- *  the moment it exists — both the raw TCP socket ('connection') and the post-handshake TLSSocket
- *  ('secureConnection', a DIFFERENT emitter). A client abort is routine, but with NO listener Node turns
- *  it into an UNHANDLED 'error' event that kills the whole daemon (observed: a days-old gateway died on
- *  `read ECONNRESET` at TLSWrap.onStreamRead — the exposed window is a socket the http layer has handed
- *  off, e.g. right after an 'upgrade', where no internal handler is attached any more). Handling =
- *  destroy the ONE socket; never the process. */
-function guardInboundSocket(socket) {
-    socket.on('error', (err) => {
-        if (!exports.BENIGN_SOCKET_ERRNOS.has(err.code ?? '')) {
-            console.warn(`[gateway] inbound socket error (${err.code ?? err.message}) — dropping this connection only`);
-        }
-        socket.destroy();
-    });
-}
-async function startGateway(options, context) {
-    // NB: this local `https` (TLS-on flag) deliberately SHADOWS the `node:https`
-    // module — which is why TLS/agents are reached via `require('node:https')`.
-    const https = options.https !== false;
-    const ports = options.ports?.length ? options.ports : [443];
-    const scanTtlMs = options.scanTtlMs ?? 1500;
-    const startupTimeoutMs = options.startupTimeoutMs ?? 120_000;
-    const sweepMs = options.sweepMs ?? 10_000;
-    const trafficFlushMs = options.trafficFlushMs ?? 5000;
-    // Set by stop(); read via rt.stopped() so an in-flight cold start neither
-    // spawns a process nor logs after the gateway is torn down.
-    let stopped = false;
-    // The gateway is a first-class lens source — the shared event file the MCP tails.
-    const eventFile = process.env['LENSMCP_EVENT_FILE'] ?? path.join(context.root, '.lensmcp', 'events.jsonl');
-    // --- discover ---------------------------------------------------------------
-    // The workspace key namespaces this workspace's pod sock dirs ($TMPDIR/<wsKey>/<service>-devserver) so a
-    // SHARED multi-workspace gateway can host several workspaces without their same-named services colliding
-    // (planning/multi-workspace-gateway.md). It flows to each service's devserver via `LENSMCP_WS_KEY` (see
-    // lifecycle.ts), and `discoverRoutes` derives the matching pool dir the gateway scans.
-    const wsKey = (0, scope_1.readLensScope)(context.root).key;
-    const { routes: discovered, services } = (0, discovery_1.discoverRoutes)(context.root, context.projectsConfigurations?.projects ?? {}, undefined, wsKey);
-    if (discovered.length === 0) {
-        throw new Error('[gateway] no project declares a `cluster` field — nothing to route.');
-    }
-    // --- the live multi-workspace route-fragment registry -----------------------
-    // This workspace registers its OWN fragment; `routes` is the merged table rebuilt IN PLACE from the
-    // registry (byte-identical to `discovered` for one workspace). A second workspace registers its fragment
-    // via the control endpoint and the daemon rebuilds live (planning/multi-workspace-gateway.md P3).
-    const registry = new route_registry_1.RouteRegistry();
-    registry.register({ wsKey, root: context.root, routes: discovered, services });
-    const routes = []; // the LIVE table the request pipeline reads (a stable ref, mutated in place)
-    // Assigned after the TLS servers are built (below) — re-mints the gateway cert with the CURRENT route
-    // hosts and hot-swaps it. Declared HERE (above rebuildRoutes) so rebuildRoutes can trigger it AFTER every
-    // live route change; a no-op until the TLS servers exist (the boot mint happens separately, below).
-    let refreshCert = () => { };
-    const rebuildRoutes = () => {
-        (0, route_registry_1.rebuildRoutesInPlace)(routes, registry);
-        // The cert tracks the live route hosts BY CONSTRUCTION: any register/unregister rebuilds the table then
-        // re-mints, so a dynamically-registered workspace's hostnames always join the SANs (no ERR_CERT_COMMON_
-        // NAME_INVALID). Wiring it here (not in the control onRegister) avoids the ordering trap where the cert
-        // was minted from the STALE table because onRegister ran before the control handler's rebuild.
-        refreshCert();
-    };
-    rebuildRoutes();
-    // --- per-service api keys (the gateway is the trust boundary) ---------------
-    const { serviceKeys, keyToProject } = (0, service_keys_1.loadServiceKeys)(context.root, services);
-    // --- the shared runtime (state + knobs; stopped() is a live getter) ---------
-    const rt = {
-        root: context.root,
-        wsKey,
-        eventFile,
-        routes,
-        registry,
-        rebuildRoutes,
-        services,
-        serviceKeys,
-        keyToProject,
-        scanTtlMs,
-        startupTimeoutMs,
-        sweepMs,
-        trafficFlushMs,
-        https,
-        // Absolute project root per project name — the scanner narrows each child's staleness scope with it
-        // (`sourceScopeDirs`), so a `server/**` file add stops recycling every `web/**` vite. Absent (a bare
-        // context with no projectsConfigurations) ⇒ the workspace-wide clock, i.e. previous behavior.
-        projectRoots: Object.fromEntries(Object.entries(context.projectsConfigurations?.projects ?? {})
-            .map(([name, cfg]) => [name, path.resolve(context.root, cfg.root)])),
-        stopped: () => stopped,
-    };
-    // --- layers -----------------------------------------------------------------
-    const obs = (0, observability_1.createObservability)(eventFile, { trafficFlushMs });
-    // One gate for every front-door port — a desynced client must not get N log lines because we bound N ports.
-    const admitClientErrorLog = createClientErrorLogGate();
-    const svcLayer = (0, lifecycle_1.createServiceLayer)(rt, obs);
-    const lens = (0, lens_children_1.createLensChildren)(rt, obs, options);
-    // The daemon CONTROL PLANE (loopback ~/.lensmcp/control.sock): a second workspace's `gateway start`
-    // REGISTERS its fragment here instead of fighting for :443, and the daemon HOSTS its services (spawns
-    // them, model A) + its dashboard (planning/multi-workspace-gateway.md P3). Harmless for a lone gateway.
-    const workspaceReapers = new Map();
-    let controlServer;
-    try {
-        controlServer = (0, control_1.startControlServer)({
-            rt,
-            killService: (svc, reason) => svcLayer.killSpawned(svc, reason),
-            onRegister: async (fragment) => {
-                // Host the registered workspace's dashboard AND its lens FRONTEND apps (both spawned in ITS root/bus;
-                // the dashboard appends its lensmcp.local/<key> route + the apps rewrite their route targets to the
-                // actual bound port — all BEFORE the control handler's rebuild, which AWAITS this). The cert re-mint
-                // happens in rebuildRoutes (called by the control handler right after this), once the full table is live.
-                const reapDash = await lens.hostWorkspaceDashboard(fragment);
-                const reapApps = await lens.hostWorkspaceApps(fragment);
-                workspaceReapers.set(fragment.wsKey, () => { reapDash?.(); reapApps(); });
-            },
-            onUnregister: (fragment) => {
-                workspaceReapers.get(fragment.wsKey)?.();
-                workspaceReapers.delete(fragment.wsKey);
-            },
-        });
-    }
-    catch (e) {
-        console.warn('[gateway] control plane failed to start (multi-workspace register disabled):', e.message);
-    }
-    const proxyLayer = (0, proxy_1.createProxy)(rt, obs, svcLayer);
-    // Edge JWT verification (mirrors the prod gateway): when a JWKS source is configured/derivable, the dev
-    // edge verifies RS256 tokens by `kid` against the IdP's published keys and REJECTS anything it can't
-    // verify (rogue kid / bad sig / alg:none / HS256-confusion / expired) — closing the dev decode-only bypass.
-    const edgeVerifiers = buildEdgeVerifierPool(() => rt.routes);
-    const edgeAuth = (0, auth_1.createEdgeAuth)(rt, obs, edgeVerifiers);
-    // Warm the key cache (non-fatal, non-blocking): the IdP pod may still be booting, so a failure here just
-    // means the first tokens fail closed until the on-miss/periodic refresh lands the keys (matches prod).
-    // Custom user middleware (the JWT seam; internal.* routes skip it) is wired as
-    // the BUILT-IN FIRST `afterAuth` hook — so "custom middleware runs AFTER core
-    // auth" and the `{ mode:'middleware' }` trace step are preserved.
-    let middleware;
-    if (options.middleware) {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const mod = require(path.resolve(context.root, options.middleware));
-        middleware = (mod.default ?? mod);
-    }
-    const builtinMiddleware = (ctx) => {
-        if (!middleware)
-            return;
-        try {
-            middleware(ctx.req);
-        }
-        catch (e) {
-            obs.traceStep(ctx.trace, 'auth', { mode: 'middleware', ok: false, reason: e.message });
-            if (ctx.route)
-                obs.finishTrace(ctx.trace, ctx.route.project, 401);
-            ctx.sendError(401, 'unauthorized', `Gateway middleware rejected the request: ${e.message}`);
-        }
-    };
-    const userHooks = options.hooks ?? {};
-    const hooks = (0, hooks_1.createHooks)({
-        ...userHooks,
-        afterAuth: [builtinMiddleware, ...(userHooks.afterAuth ?? [])],
-    });
-    const handler = (0, handler_1.createHandler)({ rt, obs, auth: edgeAuth, proxy: proxyLayer, hooks });
-    const upgrade = (0, upgrade_1.createUpgrade)({ rt, auth: edgeAuth, proxy: proxyLayer, hooks });
-    // Background timers (both `.unref()`'d): traffic-edge flush + idle sweeper.
-    const edgeFlusher = obs.startEdgeFlusher();
-    const sweeper = svcLayer.startSweeper();
-    // --- lens-mode children: dashboard + MCP singletons + `lens:true` apps ------
-    // MUST run before TLS — it pushes the dashboard route, which joins the cert SANs.
-    await lens.bootSingletonsAndApps();
-    // Eager services boot with the gateway.
-    for (const svc of services) {
-        if (svc.decl.eager)
-            void svcLayer.ensureUp(svc);
-    }
-    // --- TLS + listeners --------------------------------------------------------
-    let pem;
-    let caPath;
-    let mintCert;
-    if (https) {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const basicSsl = require('../../../basic-ssl');
-        const cacheDir = (0, service_keys_1.gatewayCacheDir)(context.root);
-        // SANs = the CURRENT route hosts. `rt.routes` is rebuilt live on register, so a re-mint (refreshCert
-        // below) automatically includes a newly-registered workspace's hostnames.
-        mintCert = () => basicSsl.getCertificateSync(cacheDir, 'gateway', rt.routes.map((r) => r.host).filter((h) => !!h));
-        pem = mintCert();
-        caPath = basicSsl.caCertPath(); // machine-level (~/.lensmcp/ca) — one anchor for every daemon
-    }
-    const servers = [];
-    const boundPorts = [];
-    for (const port of ports) {
-        // HTTP/2 (with allowHTTP1) for the TLS front door. A Vite dev page fetches
-        // HUNDREDS of ESM modules; over HTTP/1.1 the browser's ~6-connection-per-origin
-        // cap serializes that waterfall — each module sits "Stalled" waiting for a
-        // connection slot (measured: ~94% of a module's wall-time is stall, ~6% is the
-        // server), which is what makes dev asset loading feel slow through the gateway.
-        // h2 multiplexes every module over ONE connection + ONE TLS handshake, erasing
-        // both the 6-connection stall and the repeated handshakes. `allowHTTP1: true`
-        // keeps H1 clients working — notably Vite's HMR WebSocket, which browsers open
-        // as an H1 `Upgrade` on a SEPARATE connection (h2 has no Upgrade) and which still
-        // lands on `server.on('upgrade')` below. The forwarder (proxy.ts) branches by
-        // protocol: H1 keeps the proven node-http-proxy path; h2 uses a native forwarder
-        // because node-http-proxy emits connection-specific headers that are illegal in h2.
-        const server = pem
-            ? // eslint-disable-next-line @typescript-eslint/no-require-imports
-                require('node:http2').createSecureServer({
-                    key: pem,
-                    cert: pem,
-                    allowHTTP1: true,
-                    // A full Vite dev-app reload streams TENS of MB of transformed ESM
-                    // over ONE h2 session. Node's default `maxSessionMemory` is 10 MB —
-                    // cross it and the session RSTs its streams / sends GOAWAY, which the
-                    // browser reports as a BURST of ERR_HTTP2_PROTOCOL_ERROR (every
-                    // in-flight module fails at the same instant). Raise the ceiling and
-                    // the per-stream/peer limits to dev-front-door proportions.
-                    maxSessionMemory: 512,
-                    settings: { maxConcurrentStreams: 512 },
-                    peerMaxConcurrentStreams: 512,
-                }, (req, res) => handler(req, res))
-            : http.createServer(handler);
-        server.on('upgrade', upgrade);
-        server.on('error', (err) => console.error(`[gateway] port ${port}: ${err.code}`));
-        // Inbound-socket resilience (the ECONNRESET-crash fix): guard every accepted socket, and end
-        // handshake-phase ('tlsClientError') / H1 parse-phase ('clientError') faults on the ONE connection.
-        // Registering 'clientError' replaces Node's default 400-writer, so keep its semantics: a best-effort
-        // 400 on a still-writable socket, then destroy.
-        server.on('connection', guardInboundSocket);
-        server.on('secureConnection', guardInboundSocket); // never fires on a plain-http server — harmless
-        server.on('tlsClientError', (_err, tlsSocket) => tlsSocket.destroy());
-        server.on('clientError', (rawErr, socket) => {
-            // Node adds `bytesParsed`/`rawPacket` on an HTTP parse error (not on the base ErrnoException type):
-            // `bytesParsed` is the single most useful field for telling a truncated reuse race (0 / very low) from
-            // a genuinely malformed request, which is exactly what the old handler discarded.
-            const err = rawErr;
-            const v = classifyClientError(err.code, err.message);
-            // OBSERVABILITY (this used to be silent — the whole reason a gateway-invented 400 looked like an app
-            // bug). Rate-limited per cause so a port scanner or a desynced client cannot flood the log; the bus
-            // `emit` is separately flood-guarded by its fingerprint.
-            if (v.report && admitClientErrorLog(v.cause)) {
-                const peer = socket.remoteAddress ?? 'unknown';
-                const answer = v.status === null ? 'dropped' : String(v.status);
-                console.warn(`[gateway] inbound H1 clientError from ${peer}: ${v.cause} (${err.code ?? err.message}${err.bytesParsed !== undefined ? `, bytesParsed=${err.bytesParsed}` : ''}) → ${answer}. This status is the GATEWAY's, not the upstream service's.`);
-                obs.emit('warning', `inbound clientError: ${v.cause} → ${answer}`, `gateway-client-error:${v.cause}`, {
-                    kind: 'gateway-client-error', cause: v.cause, code: err.code ?? null, status: v.status, peer,
-                    bytesParsed: err.bytesParsed ?? null,
-                });
-            }
-            // Preserved intent: a best-effort status on a still-writable socket, then destroy.
-            if (v.status !== null && socket.writable)
-                socket.end(`HTTP/1.1 ${v.status} ${CLIENT_ERROR_REASON[v.status]}\r\n\r\n`);
-            socket.destroy();
-        });
-        // KEEP-ALIVE REUSE RACE. Node's server default `keepAliveTimeout` is 5s — and a Node HTTP client's
-        // pooled agent (Node 19+ `globalAgent` is keepAlive:true; vite's dev proxy uses it) idles on ~the same
-        // 5s. Both sides then race the SAME deadline: the client writes a request onto a socket the server is
-        // simultaneously closing, the server reads a truncated message, and the front door answers a bare
-        // `400` that the dev proxy forwards to the browser verbatim — a 400 on a request the service would
-        // have served 200. The documented fix is for the server's idle window to EXCEED every client's, so the
-        // server never closes first and the client always controls socket reuse. `headersTimeout` must stay
-        // above `keepAliveTimeout` (it bounds a request that has started arriving), and `requestTimeout` keeps
-        // its Node default. Dev-only front door, a handful of clients → holding idle sockets longer is free.
-        server.keepAliveTimeout = types_1.GATEWAY_KEEPALIVE_TIMEOUT_MS;
-        if (server.headersTimeout < types_1.GATEWAY_KEEPALIVE_TIMEOUT_MS + 5_000) {
-            server.headersTimeout = types_1.GATEWAY_KEEPALIVE_TIMEOUT_MS + 5_000;
-        }
-        // h2 SESSION resilience: without a `sessionError` handler ANY session-level
-        // fault (a client GOAWAY mid-burst, a flood-protection trip, a decode error)
-        // is unhandled → Node tears the session down, failing EVERY sibling stream at
-        // once. Handle it so ONE bad session logs + dies alone, never throwing and
-        // never taking the process (or other clients' sessions) with it. `session`
-        // errors are surfaced BOTH per-session and (unhandled) as `sessionError`.
-        const isH2 = pem != null;
-        if (isH2) {
-            const h2 = server;
-            h2.on('session', (session) => {
-                session.on('error', (err) => {
-                    const code = err.code ?? err.message;
-                    console.warn(`[gateway] h2 session error (${code}) — dropping this session only`);
-                    if (!session.destroyed)
-                        session.destroy();
-                });
-            });
-            h2.on('sessionError', (err) => {
-                console.warn(`[gateway] h2 sessionError: ${err.code ?? err.message}`);
-            });
-        }
-        await new Promise((resolve) => {
-            server.listen(port, () => {
-                const actual = server.address()?.port ?? port;
-                boundPorts.push(actual);
-                console.log(`[gateway] Listening on ${pem ? 'https' : 'http'}://localhost:${actual}`);
-                resolve();
-            });
-        });
-        servers.push(server);
-    }
-    // Now that the TLS servers exist, wire the live cert refresh: on a workspace register/unregister the
-    // control endpoint calls this to re-mint the gateway cert with the CURRENT route hosts and hot-swap it
-    // into every HTTP/2 secure server (setSecureContext), so a dynamically-registered workspace's hostnames
-    // are covered (no ERR_CERT_COMMON_NAME_INVALID).
-    if (mintCert) {
-        refreshCert = () => {
-            const fresh = mintCert();
-            for (const s of servers) {
-                s.setSecureContext?.({ key: fresh, cert: fresh });
-            }
-        };
-    }
-    console.log('[gateway] Routes:');
-    for (const r of routes) {
-        const dest = r.pool ? `pods@${r.pool.dir}` : r.target;
-        console.log(`[gateway]   ${r.host ?? '(default)'} → ${dest}${r.prependPrefix ? `  (+${r.prependPrefix})` : ''}${r.internal ? '  [internal: no middleware]' : ''}  [${r.project}]`);
-    }
-    if (caPath)
-        console.log(`[gateway] CA: ${caPath} — one-time setup via the trust executor.`);
-    obs.emit('info', `gateway up: ${routes.length} routes on ${boundPorts.join('/')}`, 'cluster-gateway', {
-        kind: 'gateway-up',
-        ports: boundPorts,
-        routes: routes.map((r) => ({ host: r.host ?? '(default)', project: r.project, mode: r.pool ? 'pods' : 'tcp', internal: !!r.internal, prependPrefix: r.prependPrefix })),
-    });
-    const stop = async () => {
-        if (stopped)
-            return;
-        stopped = true;
-        clearInterval(edgeFlusher);
-        clearInterval(sweeper);
-        obs.emit('info', 'gateway down', 'cluster-gateway', { kind: 'gateway-down' });
-        edgeVerifiers.stop(); // clear every JWKS periodic-refresh timer
-        controlServer?.close(); // tear down the control plane + its socket
-        (0, workspace_registry_1.unregisterWorkspace)(wsKey); // drop this workspace from the global chooser registry (graceful stop)
-        for (const svc of services)
-            svcLayer.killSpawned(svc, 'gateway shutdown');
-        // Reap the lens-mode managed children (dashboard + MCP singletons + each `lens:true` app's Vite/capture)
-        // — SIGTERM → grace → SIGKILL, awaited, so a SIGTERM-ignoring vite is gone BEFORE the daemon exits
-        // (otherwise it orphans + keeps its port). Same teardown as the pod services.
-        await lens.reapAll();
-        await Promise.all(servers.map((s) => new Promise((r) => s.close(() => r()))));
-        proxyLayer.closeProxy();
-        proxyLayer.destroyAgents(); // release pooled upstream sockets
-    };
-    return { ports: boundPorts, routes, services, stop };
-}
+"use strict";var Z=Object.defineProperty;var m=(r,o)=>Z(r,"name",{value:o,configurable:!0});var X=Object.defineProperty,n=m((r,o)=>X(r,"name",{value:o,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.BENIGN_SOCKET_ERRNOS=void 0,exports.buildEdgeVerifierPool=buildEdgeVerifierPool,exports.classifyClientError=classifyClientError,exports.createClientErrorLogGate=createClientErrorLogGate,exports.startGateway=startGateway;const tslib_1=require("tslib"),http=tslib_1.__importStar(require("node:http")),path=tslib_1.__importStar(require("node:path")),discovery_1=require("./discovery"),scope_1=require("./scope"),route_registry_1=require("./route-registry"),control_1=require("./control"),workspace_registry_1=require("./workspace-registry"),service_keys_1=require("./service-keys"),observability_1=require("./observability"),lifecycle_1=require("./lifecycle"),lens_children_1=require("./lens-children"),proxy_1=require("./proxy"),auth_1=require("./auth"),hooks_1=require("./hooks"),handler_1=require("./handler"),upgrade_1=require("./upgrade"),jwks_verify_1=require("../jwks-verify"),types_1=require("./types");function insecureLocalFetch(r,o){return new Promise((g,h)=>{const w=(r.startsWith("https:")?require("node:https"):require("node:http")).request(r,{method:"GET",headers:o?.headers,rejectUnauthorized:!1},_=>{const l=[];_.on("data",u=>l.push(u)),_.on("end",()=>{const u=_.statusCode??0,a=Buffer.concat(l).toString("utf8");g({ok:u>=200&&u<300,status:u,json:n(async()=>JSON.parse(a),"json")})})});w.on("error",h),w.end()})}m(insecureLocalFetch,"insecureLocalFetch"),n(insecureLocalFetch,"insecureLocalFetch");function buildEdgeVerifierPool(r){const o=process.env.LENSMCP_GW_JWKS_URL,g=process.env.LENSMCP_GW_JWT_ISS,h=new Map;let w;const _=n((l,u)=>{console.log(`[gateway] edge JWT: verifying via JWKS ${l}${u}`);const a=(0,jwks_verify_1.createJwksVerifier)({jwksUrl:l,...g?{issuer:g}:{},fetchImpl:insecureLocalFetch});return a.refresh().catch(E=>console.warn("[gateway] edge JWKS warm failed (will retry):",E.message)),a},"make");return{for(l){if(o)return w??=_(o,"");const u=l.split(":")[0].toLowerCase();let a;for(const v of r()){const S=v.host;if(typeof S!="string"||!/^auth\./.test(S)||S.startsWith("internal."))continue;const d=S.slice(5);(u===d||u.endsWith(`.${d}`))&&(!a||d.length>a.length)&&(a=d)}if(!a)return;let E=h.get(a);return E||(E=_(`https://auth.${a}/jwks.json`,` (auto-derived for apex ${a})`),h.set(a,E)),E},stop(){w?.stop();for(const l of h.values())l.stop()}}}m(buildEdgeVerifierPool,"buildEdgeVerifierPool"),n(buildEdgeVerifierPool,"buildEdgeVerifierPool"),exports.BENIGN_SOCKET_ERRNOS=new Set(["ECONNRESET","EPIPE","ETIMEDOUT","ECONNABORTED","ECANCELED"]);function classifyClientError(r,o){return r&&exports.BENIGN_SOCKET_ERRNOS.has(r)?{status:null,report:!1,cause:"client-abort"}:r==="HPE_INVALID_EOF_STATE"?{status:null,report:!1,cause:"truncated-at-eof"}:r==="ERR_HTTP_REQUEST_TIMEOUT"?{status:408,report:!0,cause:"request-timeout"}:r==="HPE_HEADER_OVERFLOW"?{status:431,report:!0,cause:"header-overflow"}:r?.startsWith("HPE_")?{status:400,report:!0,cause:"parse-error"}:{status:400,report:!0,cause:r??o??"unknown"}}m(classifyClientError,"classifyClientError"),n(classifyClientError,"classifyClientError");const CLIENT_ERROR_REASON={400:"Bad Request",408:"Request Timeout",431:"Request Header Fields Too Large"};function createClientErrorLogGate(r=1e4){const o=new Map;return g=>{const h=Date.now(),w=o.get(g)??0;return h-w<r?!1:(o.set(g,h),!0)}}m(createClientErrorLogGate,"createClientErrorLogGate"),n(createClientErrorLogGate,"createClientErrorLogGate");function guardInboundSocket(r){r.on("error",o=>{exports.BENIGN_SOCKET_ERRNOS.has(o.code??"")||console.warn(`[gateway] inbound socket error (${o.code??o.message}) \u2014 dropping this connection only`),r.destroy()})}m(guardInboundSocket,"guardInboundSocket"),n(guardInboundSocket,"guardInboundSocket");async function startGateway(r,o){const g=r.https!==!1,h=r.ports?.length?r.ports:[443],w=r.scanTtlMs??1500,_=r.startupTimeoutMs??12e4,l=r.sweepMs??1e4,u=r.trafficFlushMs??5e3;let a=!1;const E=process.env.LENSMCP_EVENT_FILE??path.join(o.root,".lensmcp","events.jsonl"),v=(0,scope_1.readLensScope)(o.root).key,{routes:S,services:d}=(0,discovery_1.discoverRoutes)(o.root,o.projectsConfigurations?.projects??{},void 0,v);if(S.length===0)throw new Error("[gateway] no project declares a `cluster` field \u2014 nothing to route.");const q=new route_registry_1.RouteRegistry;q.register({wsKey:v,root:o.root,routes:S,services:d});const T=[];let x=n(()=>{},"refreshCert");const N=n(()=>{(0,route_registry_1.rebuildRoutesInPlace)(T,q),x()},"rebuildRoutes");N();const{serviceKeys:V,keyToProject:D}=(0,service_keys_1.loadServiceKeys)(o.root,d),f={root:o.root,wsKey:v,eventFile:E,routes:T,registry:q,rebuildRoutes:N,services:d,serviceKeys:V,keyToProject:D,scanTtlMs:w,startupTimeoutMs:_,sweepMs:l,trafficFlushMs:u,https:g,projectRoots:Object.fromEntries(Object.entries(o.projectsConfigurations?.projects??{}).map(([e,t])=>[e,path.resolve(o.root,t.root)])),stopped:n(()=>a,"stopped")},p=(0,observability_1.createObservability)(E,{trafficFlushMs:u}),B=createClientErrorLogGate(),P=(0,lifecycle_1.createServiceLayer)(f,p),b=(0,lens_children_1.createLensChildren)(f,p,r),j=new Map;let I;try{I=(0,control_1.startControlServer)({rt:f,killService:n((e,t)=>P.killSpawned(e,t),"killService"),onRegister:n(async e=>{const t=await b.hostWorkspaceDashboard(e),i=await b.hostWorkspaceApps(e);j.set(e.wsKey,()=>{t?.(),i()})},"onRegister"),onUnregister:n(e=>{j.get(e.wsKey)?.(),j.delete(e.wsKey)},"onUnregister")})}catch(e){console.warn("[gateway] control plane failed to start (multi-workspace register disabled):",e.message)}const C=(0,proxy_1.createProxy)(f,p,P),L=buildEdgeVerifierPool(()=>f.routes),W=(0,auth_1.createEdgeAuth)(f,p,L);let A;if(r.middleware){const e=require(path.resolve(o.root,r.middleware));A=e.default??e}const J=n(e=>{if(A)try{A(e.req)}catch(t){p.traceStep(e.trace,"auth",{mode:"middleware",ok:!1,reason:t.message}),e.route&&p.finishTrace(e.trace,e.route.project,401),e.sendError(401,"unauthorized",`Gateway middleware rejected the request: ${t.message}`)}},"builtinMiddleware"),G=r.hooks??{},K=(0,hooks_1.createHooks)({...G,afterAuth:[J,...G.afterAuth??[]]}),U=(0,handler_1.createHandler)({rt:f,obs:p,auth:W,proxy:C,hooks:K}),Y=(0,upgrade_1.createUpgrade)({rt:f,auth:W,proxy:C,hooks:K}),z=p.startEdgeFlusher(),Q=P.startSweeper();await b.bootSingletonsAndApps();for(const e of d)e.decl.eager&&P.ensureUp(e);let k,M,$;if(g){const e=require("../../../basic-ssl"),t=(0,service_keys_1.gatewayCacheDir)(o.root);$=n(()=>e.getCertificateSync(t,"gateway",f.routes.map(i=>i.host).filter(i=>!!i)),"mintCert"),k=$(),M=e.caCertPath()}const O=[],R=[];for(const e of h){const t=k?require("node:http2").createSecureServer({key:k,cert:k,allowHTTP1:!0,maxSessionMemory:512,settings:{maxConcurrentStreams:512},peerMaxConcurrentStreams:512},(i,s)=>U(i,s)):http.createServer(U);if(t.on("upgrade",Y),t.on("error",i=>console.error(`[gateway] port ${e}: ${i.code}`)),t.on("connection",guardInboundSocket),t.on("secureConnection",guardInboundSocket),t.on("tlsClientError",(i,s)=>s.destroy()),t.on("clientError",(i,s)=>{const y=i,c=classifyClientError(y.code,y.message);if(c.report&&B(c.cause)){const F=s.remoteAddress??"unknown",H=c.status===null?"dropped":String(c.status);console.warn(`[gateway] inbound H1 clientError from ${F}: ${c.cause} (${y.code??y.message}${y.bytesParsed!==void 0?`, bytesParsed=${y.bytesParsed}`:""}) \u2192 ${H}. This status is the GATEWAY's, not the upstream service's.`),p.emit("warning",`inbound clientError: ${c.cause} \u2192 ${H}`,`gateway-client-error:${c.cause}`,{kind:"gateway-client-error",cause:c.cause,code:y.code??null,status:c.status,peer:F,bytesParsed:y.bytesParsed??null})}c.status!==null&&s.writable&&s.end(`HTTP/1.1 ${c.status} ${CLIENT_ERROR_REASON[c.status]}\r
+\r
+`),s.destroy()}),t.keepAliveTimeout=types_1.GATEWAY_KEEPALIVE_TIMEOUT_MS,t.headersTimeout<types_1.GATEWAY_KEEPALIVE_TIMEOUT_MS+5e3&&(t.headersTimeout=types_1.GATEWAY_KEEPALIVE_TIMEOUT_MS+5e3),k!=null){const i=t;i.on("session",s=>{s.on("error",y=>{const c=y.code??y.message;console.warn(`[gateway] h2 session error (${c}) \u2014 dropping this session only`),s.destroyed||s.destroy()})}),i.on("sessionError",s=>{console.warn(`[gateway] h2 sessionError: ${s.code??s.message}`)})}await new Promise(i=>{t.listen(e,()=>{const s=t.address()?.port??e;R.push(s),console.log(`[gateway] Listening on ${k?"https":"http"}://localhost:${s}`),i()})}),O.push(t)}$&&(x=n(()=>{const e=$();for(const t of O)t.setSecureContext?.({key:e,cert:e})},"refreshCert")),console.log("[gateway] Routes:");for(const e of T){const t=e.pool?`pods@${e.pool.dir}`:e.target;console.log(`[gateway]   ${e.host??"(default)"} \u2192 ${t}${e.prependPrefix?`  (+${e.prependPrefix})`:""}${e.internal?"  [internal: no middleware]":""}  [${e.project}]`)}return M&&console.log(`[gateway] CA: ${M} \u2014 one-time setup via the trust executor.`),p.emit("info",`gateway up: ${T.length} routes on ${R.join("/")}`,"cluster-gateway",{kind:"gateway-up",ports:R,routes:T.map(e=>({host:e.host??"(default)",project:e.project,mode:e.pool?"pods":"tcp",internal:!!e.internal,prependPrefix:e.prependPrefix}))}),{ports:R,routes:T,services:d,stop:n(async()=>{if(!a){a=!0,clearInterval(z),clearInterval(Q),p.emit("info","gateway down","cluster-gateway",{kind:"gateway-down"}),L.stop(),I?.close(),(0,workspace_registry_1.unregisterWorkspace)(v);for(const e of d)P.killSpawned(e,"gateway shutdown");await b.reapAll(),await Promise.all(O.map(e=>new Promise(t=>e.close(()=>t())))),C.closeProxy(),C.destroyAgents()}},"stop")}}m(startGateway,"startGateway"),n(startGateway,"startGateway");