@lensmcp/cluster 1.18.4 → 1.18.7

package/main.devserver.js

@@ -1,1117 +1,10 @@
-"use strict";
-// Parent/Child dual-mode runner with multi-child round-robin + hot reload.
-//
-// Parent (default):
-//  - Stable public port (env.PORT or first free >= 8100).
-//  - Spawns N children (env.CHILD_COUNT, default 2), each runs this file with APP_RUNNER=1.
-//  - Round-robin load balancing to healthy children.
-//  - POST /webpack/reload:
-//      * forwards 'reload' to all healthy children (they hot-swap in-process)
-//      * respawns any unhealthy/crashed children
-//  - If a child crashes, it is marked unhealthy; parent keeps serving via others.
-//  - If ALL are down, parent returns 503 with last errors. Parent only dies on user interrupt.
-//
-// Child (APP_RUNNER=1):
-//  - Loads webpack bundle (BUNDLE_PATH, default ./main.js) exporting global.createChildApp().
-//  - createChildApp() bootstraps NestJS+Fastify, returns a raw http.RequestListener handler.
-//  - Child wraps handler in http.createServer on a Unix socket; reports {type:'ready', socketPath} via IPC.
-//  - On 'reload' IPC or POST /webpack/reload, closes old app, re-imports bundle, swaps handler in-place.
-Object.defineProperty(exports, "__esModule", { value: true });
-const tslib_1 = require("tslib");
-const path = tslib_1.__importStar(require("node:path"));
-const fs = tslib_1.__importStar(require("node:fs"));
-const os = tslib_1.__importStar(require("node:os"));
-const node_child_process_1 = require("node:child_process");
-const http = tslib_1.__importStar(require("node:http"));
-const readline = tslib_1.__importStar(require("node:readline"));
-const inspector = tslib_1.__importStar(require("node:inspector"));
-const util = tslib_1.__importStar(require("node:util"));
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const httpProxy = require('http-proxy');
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const { prettyFactory } = require('pino-pretty');
-// ----------------------------- Shared Config ----------------------------------
-const BUNDLE_PATH = process.env.BUNDLE_PATH?.trim() || './main.js';
-const SERVICE_NAME = process.env.SERVICE_NAME || '';
-const SERVICE_PREFIX = process.env.SERVE_PREFIX ? `/${process.env.SERVE_PREFIX}` : '';
-const GATEWAY_MIDDLEWARE_PATH = process.env.GATEWAY_MIDDLEWARE || '';
-const GATEWAY_CONFIG = (() => {
-    const raw = process.env.GATEWAY_CONFIG;
-    if (!raw)
-        return {};
-    try {
-        return JSON.parse(raw);
-    }
-    catch {
-        return {};
-    }
-})();
-let gatewayMiddleware = null;
-if (GATEWAY_MIDDLEWARE_PATH) {
-    try {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const mod = require(GATEWAY_MIDDLEWARE_PATH);
-        gatewayMiddleware = typeof mod === 'function' ? mod : (typeof mod.default === 'function' ? mod.default : null);
-        if (!gatewayMiddleware) {
-            console.warn(`[gateway] ${GATEWAY_MIDDLEWARE_PATH} does not export a function, gateway disabled`);
-        }
-    }
-    catch (err) {
-        console.error(`[gateway] Failed to load middleware from ${GATEWAY_MIDDLEWARE_PATH}:`, err);
-    }
-}
-function applyGatewayMiddleware(req) {
-    if (!gatewayMiddleware)
-        return;
-    try {
-        gatewayMiddleware(req, GATEWAY_CONFIG);
-    }
-    catch (err) {
-        console.error('[gateway] Middleware error:', err);
-    }
-}
-const GATEWAY_ROUTES = (() => {
-    try {
-        return JSON.parse(process.env.GATEWAY_ROUTES || '[]');
-    }
-    catch {
-        return [];
-    }
-})();
-const GATEWAY_HTTPS = process.env.GATEWAY_HTTPS === '1';
-function hostMatches(pattern, host) {
-    if (pattern.startsWith('*.')) {
-        const suffix = pattern.slice(1); // ".tetros.localhost"
-        return host.endsWith(suffix) || host === pattern.slice(2);
-    }
-    return host === pattern;
-}
-function matchGatewayRoute(req) {
-    if (GATEWAY_ROUTES.length === 0)
-        return undefined;
-    const host = (req.headers.host || '').split(':')[0];
-    const url = req.url || '/';
-    for (const route of GATEWAY_ROUTES) {
-        if (route.host && !hostMatches(route.host, host))
-            continue;
-        if (route.prefix && !url.startsWith(route.prefix))
-            continue;
-        return route;
-    }
-    return undefined;
-}
-// ----------------------------- Worker Config ------------------------------------
-const WORKER_NAMES = (() => {
-    try {
-        return JSON.parse(process.env.WORKERS || '[]');
-    }
-    catch {
-        return [];
-    }
-})();
-// ----------------------------- Socket Helpers ---------------------------------
-// The pod sockets live under a per-WORKSPACE dir when the gateway sets `LENSMCP_WS_KEY` (the shared
-// multi-workspace gateway — planning/multi-workspace-gateway.md): `$TMPDIR/<wsKey>/<service>-devserver`.
-// Without a key (standalone `serve`, or a single-workspace gateway that predates this) it's the legacy
-// `$TMPDIR/<service>-devserver`. Namespacing is REQUIRED so two workspaces each running a service named
-// `agent`/`auth` don't share `$TMPDIR/agent-devserver` — which would cross-route the gateway into the wrong
-// workspace's pods and let one workspace's reap unlink the other's sockets. The gateway's `discovery.ts`
-// mirror MUST derive the identical path.
-const LENSMCP_WS_KEY = process.env.LENSMCP_WS_KEY || '';
-const SOCK_DIR = LENSMCP_WS_KEY
-    ? path.join(os.tmpdir(), LENSMCP_WS_KEY, `${SERVICE_NAME || 'lensmcp-cluster'}-devserver`)
-    : path.join(os.tmpdir(), `${SERVICE_NAME || 'lensmcp-cluster'}-devserver`);
-function childSockPath(id) {
-    return path.join(SOCK_DIR, `child-${id}.sock`);
-}
-/**
- * SOCKET OWNERSHIP (the generation race, foodguard 2026-07-26): when devserver generations
- * overlap — a killed nx runner's orphaned tree dying while the daemon's fresh spawn binds —
- * the DYING generation's cleanup used to unlink `child-1.sock` that the NEW generation had
- * just bound. The file vanished from disk while the live child held the (now anonymous)
- * inode: every gateway connect hit ENOENT/ghost, with no log and no evictable pod.
- *
- * The rule that closes it: **BIND steals, DEATH is guarded.** A binder writes a sidecar
- * `<sock>.owner` pidfile FIRST (so any concurrently-dying process already sees the new
- * owner), then unlinks the stale path and binds. Every death/cleanup path unlinks ONLY if
- * the owner file still names the pid it is cleaning up for — a foreign live owner means a
- * newer generation took the path, and the dying one must leave it alone.
- */
-function sockOwnerPath(sockPath) { return `${sockPath}.owner`; }
-/** Bind-time steal: claim ownership (pidfile first), then clear the stale path. */
-function claimSock(sockPath, ownerPid = process.pid) {
-    try {
-        fs.mkdirSync(path.dirname(sockPath), { recursive: true });
-    }
-    catch { /* exists */ }
-    try {
-        fs.writeFileSync(sockOwnerPath(sockPath), String(ownerPid));
-    }
-    catch { /* best-effort */ }
-    try {
-        fs.unlinkSync(sockPath);
-    }
-    catch { /* no stale socket */ }
-}
-/**
- * Death-path cleanup: unlink the socket ONLY when `expectedOwnerPid` (default: this
- * process) still owns it. A missing/unreadable owner file falls back to unlinking
- * (legacy sockets from a pre-ownership build).
- */
-function cleanupSock(sockPath, expectedOwnerPid = process.pid) {
-    if (!sockPath)
-        return;
-    try {
-        const owner = fs.readFileSync(sockOwnerPath(sockPath), 'utf8').trim();
-        if (owner && owner !== String(expectedOwnerPid))
-            return; // a newer generation owns the path
-    }
-    catch { /* no owner file → legacy behavior */ }
-    try {
-        fs.unlinkSync(sockPath);
-    }
-    catch { /* best-effort: socket already gone */ }
-    try {
-        fs.unlinkSync(sockOwnerPath(sockPath));
-    }
-    catch { /* best-effort */ }
-}
-// delete from CJS cache + require fresh
-async function importFresh(spec) {
-    process.env.DEVSERVER_MODE = '1';
-    const resolved = path.isAbsolute(spec) ? spec : path.join(__dirname, spec);
-    eval(`delete require.cache["${resolved}"]`); // delete from CJS cache
-    return eval(`require("${resolved}")`);
-}
-function debounce(fn, ms) {
-    let t = null;
-    return (...args) => {
-        if (t)
-            clearTimeout(t);
-        t = setTimeout(() => fn(...args), ms);
-    };
-}
-// ===================================================================================
-// CHILD MODE (APP_RUNNER=1) — loads bundle, bootstraps NestJS app, listens on socket
-// ===================================================================================
-if (process.env.APP_RUNNER === '1') {
-    // Debug: open the inspector on the port the parent allocated (serve `debugPort`
-    // option / LENSMCP_DEBUG_PORT base + pod slot) and report the ws URL up via IPC.
-    // inspector.open() itself prints the native "Debugger listening on ws://…" line,
-    // which WebStorm/VS Code run consoles turn into a one-click attach link. The
-    // matching inspector.close() on shutdown already lives below.
-    const openInspector = (port) => {
-        if (!inspector.url()) {
-            try {
-                inspector.open(port, '127.0.0.1', false);
-            }
-            catch (err) {
-                console.warn(`[child] inspector.open(${port}) failed (port taken by another devserver?) — falling back to a random port:`, err.message);
-                try {
-                    inspector.open(0, '127.0.0.1', false);
-                }
-                catch { /* no inspector at all — pod still serves, just undebuggable */ }
-            }
-        }
-        const url = inspector.url();
-        if (url && process.send)
-            process.send({ type: 'inspector-url', url });
-    };
-    const CHILD_DEBUG_PORT = Number(process.env.CHILD_DEBUG_PORT || '');
-    if (Number.isInteger(CHILD_DEBUG_PORT) && CHILD_DEBUG_PORT > 1024)
-        openInspector(CHILD_DEBUG_PORT);
-    // Zero-touch instrumentation: load BEFORE the app bundle so the require
-    // hook sees pg/ioredis/bullmq/@nestjs/core on their first load, builtins
-    // (fs/net/exec) are tapped, NestFactory.create grafts the lens module, and
-    // the child-app bridge owns global.createChildApp — a completely plain
-    // main.ts (NestFactory.create + app.listen) becomes a pod with no
-    // devserver contract in host source. Legacy dual-mode bundles overwrite
-    // global.createChildApp at import and keep working unchanged.
-    try {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        require('@lensmcp/node-instrumentation/register');
-    }
-    catch { /* instrumentation package absent — pods run untapped */ }
-    (async () => {
-        let current = null;
-        let swapping = false;
-        let pendingReload = false;
-        // Delegate starts as 503; swapped to the real handler after first boot
-        let delegate = (_req, res) => {
-            res.statusCode = 503;
-            res.end('starting');
-        };
-        async function swapNow() {
-            if (swapping) {
-                pendingReload = true;
-                console.log('[child] Reload deferred — will re-swap after current swap completes');
-                return current;
-            }
-            swapping = true;
-            // ── Stale-handler cleanup ──
-            // @frontegg/nestjs-common/app-builder registers process.on('uncaughtException')
-            // during build() and never removes it on close. After swap, the OLD handler
-            // fires during background teardown and crashes because its AsyncLocalStorage
-            // context is destroyed. Fix: wipe all handlers before re-import, then add
-            // a safe catch-all. The fresh bundle will register its own valid handlers.
-            process.removeAllListeners('uncaughtException');
-            process.removeAllListeners('unhandledRejection');
-            process.on('uncaughtException', (err, origin) => {
-                console.error(`[child] uncaughtException (${origin}):`, err);
-            });
-            process.on('unhandledRejection', (reason) => {
-                // Suppress known stale-context rejections from previous app's background teardown.
-                const msg = reason instanceof Error ? reason.stack || reason.message : String(reason);
-                if (msg.includes('FronteggContextScope') || msg.includes('populateLoggerMetadata')) {
-                    return; // swallow — old app context is gone, nothing to do
-                }
-                console.error('[child] unhandledRejection:', reason);
-            });
-            await importFresh(BUNDLE_PATH);
-            if (typeof global.createChildApp !== 'function') {
-                swapping = false;
-                throw new Error(`Bundle '${BUNDLE_PATH}' does not export createChildApp() and the zero-touch ` +
-                    `bridge is not active. Either install @lensmcp/node-instrumentation (a plain ` +
-                    `NestFactory.create + app.listen main.ts then just works) or set ` +
-                    `global.createChildApp in main.ts when DEVSERVER_MODE === '1'.`);
-            }
-            const next = await global.createChildApp();
-            const prev = current;
-            current = next;
-            delegate = next.handler;
-            console.log(`[child] Swapped to fresh app (previous closing in background)`);
-            if (prev)
-                prev.close().catch(err => console.error('[child] background close error:', err));
-            swapping = false;
-            if (pendingReload) {
-                pendingReload = false;
-                return swapNow();
-            }
-            return next;
-        }
-        // Create ONE debounced swapper that lives across requests
-        const debouncedSwap = debounce(async () => {
-            try {
-                console.log('[child] /webpack/reload');
-                await swapNow();
-            }
-            catch (e) {
-                console.error('[child] reload failed:', e);
-            }
-        }, 250);
-        // Raw HTTP server: admin reload endpoint + delegate all else to NestJS handler
-        const server = http.createServer((req, res) => {
-            if (req.method === 'POST' && req.url === '/webpack/reload') {
-                res.writeHead(200, { 'content-type': 'application/json' });
-                res.end(JSON.stringify({ ok: true }));
-                debouncedSwap();
-                return;
-            }
-            delegate(req, res);
-        });
-        const sockPath = process.env.CHILD_SOCK_PATH;
-        // ORPHAN GUARD: if the parent devserver dies (idle-kill, crash, tree
-        // SIGTERM that missed us), the IPC channel closes — exit immediately and
-        // remove our socket so no ghost pod (live process + stale sock) survives.
-        process.on('disconnect', () => {
-            cleanupSock(sockPath); // owner-guarded: never unlink a newer generation's socket
-            process.exit(0);
-        });
-        // boot once, then listen on Unix socket
-        try {
-            await swapNow();
-            const resolvedBundle = path.isAbsolute(BUNDLE_PATH) ? BUNDLE_PATH : path.join(__dirname, BUNDLE_PATH);
-            console.log(`[child] Using bundle: ${resolvedBundle}`);
-            claimSock(sockPath); // bind steals: claim ownership, then clear the stale path
-            server.listen(sockPath, () => {
-                console.log(`[child] Listening on ${sockPath}`);
-                if (process.send)
-                    process.send({ type: 'ready', socketPath: sockPath });
-            });
-        }
-        catch (err) {
-            console.error('[child] Startup error:', err);
-            if (process.send)
-                process.send({ type: 'boot-error', error: String(err?.stack || err) });
-            process.exitCode = 1;
-            return;
-        }
-        // IPC reload handler (parent-initiated reloads)
-        process.on('message', async (msg) => {
-            if (!msg || typeof msg !== 'object')
-                return;
-            // On-demand debugging (POST /webpack/debug): open the inspector NOW, in the
-            // running pod — no restart, app state intact. Already open → just re-report.
-            if (msg.type === 'debug-open') {
-                const port = Number(msg.port);
-                openInspector(Number.isInteger(port) && port > 1024 ? port : 0);
-                return;
-            }
-            if (msg.type === 'reload') {
-                try {
-                    await swapNow();
-                    if (process.send)
-                        process.send({ type: 'reloaded', socketPath: sockPath });
-                }
-                catch (e) {
-                    console.error('[child] reload error:', e);
-                    if (process.send)
-                        process.send({ type: 'reload-error', error: String(e?.stack || e) });
-                }
-            }
-        });
-        process.on('beforeExit', () => {
-            try {
-                inspector?.close?.();
-            }
-            catch {
-                /* inspector may already be detached */
-            }
-        });
-        const shutdown = async (sig) => {
-            console.log(`[child ${sig}] shutting down…`);
-            const closingApp = current?.close().catch(err => console.error('[child] close error:', err));
-            const closingServer = new Promise(resolve => server.close(() => resolve()));
-            cleanupSock(sockPath);
-            setTimeout(() => process.exit(0), 700).unref();
-            await Promise.all([closingApp, closingServer]);
-            process.exit(0);
-        };
-        ['SIGINT', 'SIGTERM', 'SIGHUP', 'SIGQUIT', 'SIGUSR2'].forEach(sig => {
-            process.on(sig, () => {
-                inspector?.close?.();
-                void shutdown(sig);
-            });
-        });
-    })();
-}
-else {
-    // ---------- Colored prefix helpers (no deps) ----------
-    const COLORS = [
-        '\x1b[36m', // cyan
-        '\x1b[33m', // yellow
-        '\x1b[35m', // magenta
-        '\x1b[32m', // green
-        '\x1b[34m', // blue
-        '\x1b[31m' // red
-    ];
-    const RESET = '\x1b[0m';
-    const CHILD_COUNT = Math.max(1, Number(process.env.CHILD_COUNT || 1));
-    // Debug base port (serve `debugPort` option / LENSMCP_DEBUG_PORT env): pod at
-    // slot S opens its inspector on base+S, workers on base+WORKER_DEBUG_PORT_OFFSET+i.
-    // Unset/0 → no inspectors at boot; POST /webpack/debug can still turn debugging on
-    // at runtime (mutating this base — sticky, so respawned pods stay debuggable).
-    // Each service needs its OWN base — two services sharing one base would race for
-    // the same ports (loser warns and runs undebuggable).
-    let debugBasePort = (() => {
-        const n = Number(process.env.LENSMCP_DEBUG_PORT || '');
-        return Number.isInteger(n) && n > 1024 ? n : 0;
-    })();
-    const WORKER_DEBUG_PORT_OFFSET = 20;
-    // Log tee (serve `logFile` option / LENSMCP_LOG_FILE env): every pod/worker line
-    // is ALSO appended, ANSI-stripped, to this file — so an IDE can tail it (WebStorm:
-    // run config → Logs tab) while the service itself runs anywhere (terminal, gateway).
-    const LOG_FILE = process.env.LENSMCP_LOG_FILE || '';
-    const logFileStream = LOG_FILE
-        ? (() => {
-            try {
-                fs.mkdirSync(path.dirname(LOG_FILE), { recursive: true });
-                return fs.createWriteStream(LOG_FILE, { flags: 'a' });
-            }
-            catch (err) {
-                console.warn(`[parent] cannot open log file ${LOG_FILE}:`, err.message);
-                return null;
-            }
-        })()
-        : null;
-    // eslint-disable-next-line no-control-regex
-    const ANSI_RE = /\x1b\[[0-9;]*m/g;
-    // ---------- Log hub ----------
-    // Every pod/worker line (and the parent's own lifecycle lines) fans out to:
-    //  • the terminal (unchanged),
-    //  • a ring buffer + live HTTP subscribers — GET /webpack/logs, which is what
-    //    `lensmcp logs <service>` attaches to from any terminal (human or agent),
-    //  • the optional LENSMCP_LOG_FILE tee (ANSI-stripped) for IDE Logs tabs.
-    const LOG_BUFFER_MAX = 2000;
-    const logBuffer = [];
-    const logSubscribers = new Set();
-    function emitLogLine(text) {
-        logBuffer.push(text);
-        if (logBuffer.length > LOG_BUFFER_MAX)
-            logBuffer.splice(0, logBuffer.length - LOG_BUFFER_MAX);
-        logFileStream?.write(text.replace(ANSI_RE, ''));
-        for (const sub of logSubscribers) {
-            try {
-                sub.res.write(sub.plain ? text.replace(ANSI_RE, '') : text);
-            }
-            catch {
-                logSubscribers.delete(sub);
-            }
-        }
-    }
-    // The parent's own console lines (ready/respawn/Debugger listening/proxy errors)
-    // belong in the stream too — mirror console.* into the hub.
-    for (const level of ['log', 'info', 'warn', 'error']) {
-        const orig = console[level].bind(console);
-        console[level] = (...args) => {
-            orig(...args);
-            emitLogLine(args.map((a) => (typeof a === 'string' ? a : util.inspect(a))).join(' ') + '\n');
-        };
-    }
-    const colorFor = (id) => {
-        return COLORS[(id - 1) % COLORS.length];
-    };
-    const tagFor = (id) => {
-        if (CHILD_COUNT === 1) {
-            return '';
-        }
-        const base = `[child#${id}] `;
-        return `${colorFor(id)}${base}${RESET}`;
-    };
-    const isJsonLog = (log) => {
-        return log.startsWith('{') && log.endsWith('}');
-    };
-    const wireProcLogging = (proc, tag) => {
-        const prettyLog = prettyFactory({
-            sync: true,
-            colorize: true,
-            crlf: true,
-            messageKey: 'message',
-            errorLikeObjectKeys: ['err', 'error'],
-            errorProps: 'type,message,stack',
-            ignore: [
-                'logContext', 'context', 'hostname', 'req', 'res', 'err.driverError',
-                'module', 'cloudEnvironment',
-                'frontegg-application-id', 'frontegg-tenant-id',
-                'frontegg-trace-id', 'frontegg-vendor-id',
-                'host', 'service', 'version',
-                'err', 'error',
-            ].join(','),
-            messageFormat: '{if module}[{module}] {end}{if context}[{context}] {end}{if logContext}[{logContext}] {end}{message}',
-            customPrettifiers: {
-                stack: (value) => '\n' + String(value),
-            },
-        });
-        const write = (kind, line) => {
-            const dest = kind === 'stdout' ? process.stdout : process.stderr;
-            const log = isJsonLog(line) ? prettyLog(line) : `${line}\n`;
-            dest.write(`${tag}${log}`);
-            emitLogLine(`${tag}${log}`);
-        };
-        const attach = (stream, kind) => {
-            if (!stream)
-                return;
-            const rl = readline.createInterface({ input: stream });
-            rl.on('line', (line) => write(kind, line));
-            rl.on('close', () => { });
-        };
-        attach(proc.stdout, 'stdout');
-        attach(proc.stderr, 'stderr');
-    };
-    const wireChildLogging = (info) => wireProcLogging(info.proc, tagFor(info.id));
-    (async () => {
-        // Ensure socket directory exists
-        fs.mkdirSync(SOCK_DIR, { recursive: true });
-        const proxy = httpProxy.createProxyServer({});
-        let publicPort = Number(process.env.PORT) || 0;
-        if (!publicPort)
-            publicPort = 9090;
-        const children = [];
-        const usedDebugSlots = new Set();
-        function allocDebugSlot() {
-            let slot = 0;
-            while (usedDebugSlots.has(slot))
-                slot++;
-            usedDebugSlots.add(slot);
-            return slot;
-        }
-        let nextId = 1;
-        let rrIndex = 0;
-        let shuttingDown = false; // set by the parent's signal handler
-        let desiredPods = CHILD_COUNT; // pool target; grown by /webpack/scale
-        let recentCrashRespawns = []; // timestamps — crash-loop backstop
-        function healthyChildren() {
-            return children.filter(c => c.healthy && typeof c.socketPath === 'string');
-        }
-        function pickChild() {
-            const healthy = healthyChildren();
-            if (healthy.length === 0)
-                return null;
-            const idx = rrIndex % healthy.length;
-            rrIndex = (rrIndex + 1) % healthy.length;
-            return healthy[idx];
-        }
-        async function spawnChild() {
-            const id = nextId++;
-            const sockPath = childSockPath(id);
-            cleanupSock(sockPath); // remove stale socket
-            // When running from TS source (local dev), children need @swc-node/register too
-            const childExecArgv = ['--enable-source-maps'];
-            if (__filename.endsWith('.ts')) {
-                childExecArgv.unshift('--require', '@swc-node/register');
-            }
-            // Stable inspector port: lowest free slot → debugBasePort+slot. Slots are
-            // released when a pod exits, so a crash-respawned pod reclaims the SAME port —
-            // an IDE "attach to 127.0.0.1:<port>" config survives respawns unedited.
-            const debugSlot = debugBasePort ? allocDebugSlot() : -1;
-            const proc = (0, node_child_process_1.fork)(__filename, {
-                env: {
-                    ...process.env,
-                    APP_RUNNER: '1',
-                    CHILD_SOCK_PATH: sockPath,
-                    ...(debugSlot >= 0 && { CHILD_DEBUG_PORT: String(debugBasePort + debugSlot) }),
-                },
-                stdio: ['inherit', 'pipe', 'pipe', 'ipc'],
-                execArgv: childExecArgv,
-            });
-            const info = { id, proc, healthy: false, lastError: null, debugSlot };
-            proc.on('message', (msg) => {
-                if (!msg || typeof msg !== 'object')
-                    return;
-                const m = msg;
-                if (m.type === 'ready') {
-                    info.socketPath = String(m.socketPath);
-                    info.healthy = true;
-                    console.log(`[parent] Child#${info.id} ready on socket ${info.socketPath}`);
-                }
-                else if (m.type === 'inspector-url') {
-                    info.inspectorUrl = String(m.url);
-                    // "Debugger listening on ws://…" is the exact phrase IDE run consoles
-                    // (WebStorm, VS Code) detect and render as a click-to-attach link.
-                    console.log(`[parent] Child#${info.id} Debugger listening on ${m.url}`);
-                }
-                else if (m.type === 'reloaded') {
-                    info.socketPath = String(m.socketPath);
-                    info.healthy = true;
-                    console.log(`[parent] Child#${info.id} hot-swapped on socket ${info.socketPath}`);
-                }
-                else if (m.type === 'reload-error') {
-                    info.lastError = String(m.error || 'unknown reload error');
-                    console.error(`[parent] Child#${info.id} reload error: ${info.lastError}`);
-                    info.healthy = false;
-                }
-                else if (m.type === 'boot-error') {
-                    info.lastError = String(m.error || 'unknown boot error');
-                    console.error(`[parent] Child#${info.id} boot error: ${info.lastError}`);
-                    info.healthy = false;
-                }
-            });
-            proc.on('exit', (code, signal) => {
-                if (info.debugSlot >= 0) {
-                    usedDebugSlots.delete(info.debugSlot);
-                    info.debugSlot = -1;
-                }
-                const clean = signal === 'SIGINT' || signal === 'SIGTERM' || code === 0;
-                if (clean) {
-                    console.log(`[parent] Child#${info.id} exited cleanly (code=${code}, signal=${signal ?? 'none'})`);
-                }
-                else {
-                    console.error(`[parent] Child#${info.id} crashed (code=${code}, signal=${signal ?? 'none'})`);
-                    if (!info.lastError)
-                        info.lastError = `Child exited abnormally (code=${code}, signal=${signal ?? 'none'})`;
-                }
-                info.healthy = false;
-                cleanupSock(info.socketPath, info.proc.pid); // guarded by the DEAD child's claim
-                info.socketPath = undefined;
-                // Supervise the pool: a CRASHED pod (not a clean shutdown, not a
-                // reload/idle-kill) must be replaced or the pool silently shrinks to
-                // zero (with CHILD_COUNT=1, the service dies until a code edit). Drop
-                // the corpse and respawn after a short backoff — with a crash-loop
-                // backstop so a bundle that dies on boot doesn't busy-spin forever.
-                if (!clean && !shuttingDown) {
-                    const i = children.indexOf(info);
-                    if (i >= 0)
-                        children.splice(i, 1);
-                    const now = Date.now();
-                    recentCrashRespawns = recentCrashRespawns.filter((t) => now - t < 30_000);
-                    if (recentCrashRespawns.length >= 5) {
-                        console.error(`[parent] crash-loop detected (${recentCrashRespawns.length} respawns/30s) — pausing auto-respawn; POST /webpack/reload to retry`);
-                        return;
-                    }
-                    recentCrashRespawns.push(now);
-                    setTimeout(() => {
-                        const live = children.filter((c) => c.proc.killed === false).length;
-                        if (!shuttingDown && live < desiredPods) {
-                            console.log(`[parent] respawning a crashed pod (${live}/${desiredPods} live)`);
-                            void spawnChild().catch(() => undefined); // spawnChild pushes to children + wires logging itself
-                        }
-                    }, 1500).unref?.();
-                }
-            });
-            children.push(info);
-            // connect stdout/stderr now that it's piped
-            wireChildLogging(info);
-            return info;
-        }
-        async function ensurePoolSize(n) {
-            desiredPods = Math.max(desiredPods, n); // remember the target so crash-respawn restores it
-            const live = children.filter(c => c.proc.killed === false);
-            const need = n - live.length;
-            for (let i = 0; i < need; i++) {
-                await spawnChild();
-            }
-        }
-        async function respawnUnhealthy() {
-            // Kill & replace children that are unhealthy or missing socketPaths
-            const toReplace = children.filter(c => !c.healthy || typeof c.socketPath !== 'string');
-            await Promise.all(toReplace.map(async (c) => {
-                try {
-                    c.proc.kill('SIGTERM');
-                }
-                catch { /* ignore */
-                }
-                cleanupSock(c.socketPath, c.proc.pid); // guarded by the replaced child's claim
-                c.socketPath = undefined;
-                // Remove from array
-                const idx = children.indexOf(c);
-                if (idx >= 0)
-                    children.splice(idx, 1);
-                // Spawn a fresh one
-                await spawnChild();
-            }));
-        }
-        const workerProcesses = [];
-        function spawnWorkerProcess(name) {
-            const bundleDir = path.dirname(path.isAbsolute(BUNDLE_PATH) ? BUNDLE_PATH : path.resolve(BUNDLE_PATH));
-            const workerBundle = path.join(bundleDir, `${name}.js`);
-            if (!fs.existsSync(workerBundle)) {
-                console.error(`[parent] Worker "${name}" bundle not found: ${workerBundle}`);
-                return null;
-            }
-            const workerExecArgv = ['--enable-source-maps'];
-            if (__filename.endsWith('.ts')) {
-                workerExecArgv.unshift('--require', '@swc-node/register');
-            }
-            // Workers get the same zero-touch taps as pods (fs/net/exec/db/redis/queue).
-            try {
-                workerExecArgv.push('--require', require.resolve('@lensmcp/node-instrumentation/register'));
-            }
-            catch { /* instrumentation package absent — workers run untapped */ }
-            // Workers get inspectors too, offset above the pod range: pods sit on
-            // base+slot, workers on base+20+i. The index comes from WORKER_NAMES order,
-            // so a worker keeps its port across restartWorkers(). With debugging off,
-            // --inspect-port only PRESETS the port (no listener) — SIGUSR1 from
-            // POST /webpack/debug activates it later without restarting the worker.
-            const workerDebugPort = (debugBasePort || 9229) + WORKER_DEBUG_PORT_OFFSET + Math.max(0, WORKER_NAMES.indexOf(name));
-            workerExecArgv.push(debugBasePort
-                ? `--inspect=127.0.0.1:${workerDebugPort}`
-                : `--inspect-port=127.0.0.1:${workerDebugPort}`);
-            const proc = (0, node_child_process_1.fork)(workerBundle, {
-                env: process.env,
-                stdio: ['inherit', 'pipe', 'pipe', 'ipc'],
-                execArgv: workerExecArgv,
-            });
-            const info = { name, proc, debugPort: workerDebugPort };
-            workerProcesses.push(info);
-            wireProcLogging(proc, `\x1b[35m[worker:${name}] \x1b[0m`);
-            proc.on('exit', (code, signal) => {
-                const clean = signal === 'SIGINT' || signal === 'SIGTERM' || code === 0;
-                if (!clean) {
-                    console.error(`[parent] Worker "${name}" crashed (code=${code}, signal=${signal ?? 'none'})`);
-                }
-                const idx = workerProcesses.indexOf(info);
-                if (idx >= 0)
-                    workerProcesses.splice(idx, 1);
-            });
-            console.log(`[parent] Worker "${name}" started (pid=${proc.pid})`);
-            return info;
-        }
-        function restartWorkers() {
-            for (const w of [...workerProcesses]) {
-                try {
-                    w.proc.kill('SIGTERM');
-                }
-                catch { /* worker already exited */ }
-            }
-            workerProcesses.length = 0;
-            for (const name of WORKER_NAMES) {
-                spawnWorkerProcess(name);
-            }
-        }
-        // Create ONE debounced forwarder that lives across requests
-        const debouncedForwardReload = debounce(async () => {
-            const healthies = healthyChildren();
-            if (healthies.length > 0) {
-                console.log(`[parent] Forwarding reload to ${healthies.length} child(ren)`);
-                for (const c of healthies)
-                    c.proc.send?.({ type: 'reload' });
-            }
-            await respawnUnhealthy();
-            if (WORKER_NAMES.length > 0)
-                restartWorkers();
-        }, 200);
-        // Start parent server (stable port)
-        const requestHandler = async (req, res) => {
-            // Admin endpoint: trigger rolling hot-reload & respawn crashed
-            if (req.method === 'POST' && req.url === '/webpack/reload') {
-                res.writeHead(200, { 'content-type': 'application/json' });
-                res.end(JSON.stringify({ ok: true }));
-                debouncedForwardReload();
-                return;
-            }
-            // Admin endpoint: grow the pod pool at runtime (gateway autoscaling).
-            if (req.method === 'POST' && req.url === '/webpack/scale') {
-                let body = '';
-                req.on('data', (c) => { body += c; });
-                req.on('end', async () => {
-                    let pods = 0;
-                    try {
-                        pods = Number(JSON.parse(body || '{}').pods) || 0;
-                    }
-                    catch { /* bad json */ }
-                    pods = Math.max(1, Math.min(pods, 16));
-                    await ensurePoolSize(pods);
-                    res.writeHead(200, { 'content-type': 'application/json' });
-                    res.end(JSON.stringify({ ok: true, pods }));
-                });
-                return;
-            }
-            // Admin endpoint: the live log stream — history, then follow (chunked text).
-            // `lensmcp logs <service>` attaches a terminal here (human), or takes a
-            // one-shot snapshot with ?follow=0&tail=N (agent). ?plain=1 strips ANSI.
-            if (req.method === 'GET' && req.url?.startsWith('/webpack/logs')) {
-                const q = new URL(req.url, 'http://localhost').searchParams;
-                const tail = Math.min(Math.max(Number(q.get('tail') ?? '100') || 0, 0), LOG_BUFFER_MAX);
-                const follow = q.get('follow') !== '0';
-                const plain = q.get('plain') === '1';
-                res.writeHead(200, { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-cache' });
-                const history = tail === 0 ? '' : logBuffer.slice(-tail).join('');
-                res.write(plain ? history.replace(ANSI_RE, '') : history);
-                if (!follow) {
-                    res.end();
-                    return;
-                }
-                const sub = { res, plain };
-                logSubscribers.add(sub);
-                req.on('close', () => logSubscribers.delete(sub));
-                return;
-            }
-            // Admin endpoint: attach a debugger to the RUNNING service — no restart, app
-            // state intact. POST /webpack/debug[?port=9339] opens (or re-reports) every
-            // pod's inspector and returns the ws URLs; the base becomes sticky so pods
-            // spawned later (respawn, scale) come up debuggable too. Workers are nudged
-            // via SIGUSR1 (their port was preset with --inspect-port at spawn).
-            if (req.method === 'POST' && req.url?.startsWith('/webpack/debug')) {
-                const requested = Number(new URL(req.url, 'http://localhost').searchParams.get('port') || '');
-                if (Number.isInteger(requested) && requested > 1024)
-                    debugBasePort = requested;
-                if (!debugBasePort)
-                    debugBasePort = 9229;
-                const targets = children.filter((c) => c.proc.exitCode === null && c.proc.signalCode === null);
-                for (const c of targets) {
-                    if (c.debugSlot < 0)
-                        c.debugSlot = allocDebugSlot();
-                    try {
-                        c.proc.send?.({ type: 'debug-open', port: debugBasePort + c.debugSlot });
-                    }
-                    catch { /* pod died mid-request */ }
-                }
-                for (const w of workerProcesses) {
-                    try {
-                        w.proc.kill('SIGUSR1');
-                    }
-                    catch { /* worker gone */ }
-                }
-                // inspector-url replies arrive async over IPC — wait briefly, then report
-                const deadline = Date.now() + 2000;
-                while (Date.now() < deadline && targets.some((c) => !c.inspectorUrl)) {
-                    await new Promise((r) => setTimeout(r, 50));
-                }
-                res.writeHead(200, { 'content-type': 'application/json' });
-                res.end(JSON.stringify({
-                    ok: true,
-                    basePort: debugBasePort,
-                    pods: targets.map((c) => ({ id: c.id, inspectorUrl: c.inspectorUrl ?? null })),
-                    workers: workerProcesses.map((w) => ({ name: w.name, port: w.debugPort })),
-                }, null, 2) + '\n');
-                return;
-            }
-            // Front-gateway routes: host/prefix match → external target, or fall
-            // through to this service's own children when the route has no target.
-            const route = matchGatewayRoute(req);
-            if (route?.prependPrefix && !req.url?.startsWith(route.prependPrefix)) {
-                req.url = route.prependPrefix + (req.url ?? '/');
-            }
-            if (route?.target) {
-                applyGatewayMiddleware(req);
-                // autoRewrite ONLY for a string (external URL) target: a route may target a child socketPath
-                // OBJECT, and http-proxy's setRedirectHostRewrite does url.parse(options.target) on ANY 3xx —
-                // which throws on an object and crashes the gateway (e.g. proxying the auth IdP's /authorize → login).
-                proxy.web(req, res, { target: route.target, autoRewrite: typeof route.target === 'string', changeOrigin: true }, (err) => {
-                    console.error(`[parent] proxy error to ${route.target}:`, err);
-                    res.statusCode = 502;
-                    res.setHeader('content-type', 'text/plain; charset=utf-8');
-                    res.end(`Upstream error from ${route.target}.`);
-                });
-                return;
-            }
-            // Enforce service prefix (mimics production gateway)
-            if (SERVICE_PREFIX) {
-                if (!req.url?.startsWith(SERVICE_PREFIX)) {
-                    res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' });
-                    res.end(`Not found. This service is mounted at ${SERVICE_PREFIX}/`);
-                    return;
-                }
-                req.url = req.url.slice(SERVICE_PREFIX.length) || '/';
-            }
-            // Gateway middleware: user-provided plugin modifies headers before proxying
-            applyGatewayMiddleware(req);
-            // Proxy all other traffic using round-robin among healthy children
-            const targetChild = pickChild();
-            if (!targetChild) {
-                res.statusCode = 503;
-                res.setHeader('content-type', 'text/plain; charset=utf-8');
-                const errs = children.map(c => `#${c.id}: ${c.lastError ?? 'no error recorded'}`).join('\n');
-                res.end(`No healthy children available. POST /webpack/reload to recover.\n\nLast errors:\n${errs}`);
-                return;
-            }
-            proxy.web(req, res, {
-                target: { socketPath: targetChild.socketPath },
-                // NO autoRewrite for a socketPath target: it's an OBJECT, and http-proxy's
-                // setRedirectHostRewrite does url.parse(options.target) on ANY 3xx response — which throws
-                // ("url must be a string, received Object") and CRASHES the gateway the moment a child
-                // returns a redirect (e.g. the auth IdP's /authorize → login). Host-rewrite is meaningless
-                // for a socket target anyway (no host to match), and our services emit ABSOLUTE external
-                // redirect URLs, so no rewrite is needed. (autoRewrite stays on the string-target route above.)
-                headers: {
-                    'x-proxy-child-id': String(targetChild.id) // for logging/debugging
-                }
-            }, (err) => {
-                console.error(`[parent] proxy error to Child#${targetChild.id}:`, err);
-                // Mark this child unhealthy so next request won't pick it
-                targetChild.healthy = false;
-                targetChild.lastError = String(err?.stack || err);
-                res.statusCode = 502;
-                res.setHeader('content-type', 'text/plain; charset=utf-8');
-                res.end(`Upstream error from Child#${targetChild.id}. Try /webpack/reload.\n${targetChild.lastError}`);
-            });
-        };
-        // Optional HTTPS, @vitejs/plugin-basic-ssl style: a cached self-signed cert
-        // (SANs: localhost + loopbacks + every configured route hostname) so
-        // https://*.localhost dev "just works" after a one-time browser trust.
-        let server;
-        let gatewayPem;
-        let gatewayCaPath;
-        const extraServers = [];
-        if (GATEWAY_HTTPS) {
-            // eslint-disable-next-line @typescript-eslint/no-require-imports
-            const basicSsl = require('./basic-ssl');
-            const certDomains = GATEWAY_ROUTES.map((r) => r.host).filter((h) => !!h);
-            const certCacheDir = path.join(process.cwd(), 'node_modules', '.cache', 'davnx-webpack');
-            gatewayPem = basicSsl.getCertificateSync(certCacheDir, SERVICE_NAME || 'lensmcp.dev', certDomains);
-            gatewayCaPath = basicSsl.caCertPath(); // machine-level (~/.lensmcp/ca)
-            // eslint-disable-next-line @typescript-eslint/no-require-imports
-            const httpsMod = require('node:https');
-            server = httpsMod.createServer({ key: gatewayPem, cert: gatewayPem }, requestHandler);
-        }
-        else {
-            server = http.createServer(requestHandler);
-        }
-        // WebSocket upgrades (vite HMR, app sockets): same routing as requests —
-        // external target when a route matches, otherwise a healthy child socket.
-        const upgradeHandler = (req, socket, head) => {
-            const route = matchGatewayRoute(req);
-            if (route?.prependPrefix && !req.url?.startsWith(route.prependPrefix)) {
-                req.url = route.prependPrefix + (req.url ?? '/');
-            }
-            if (route?.target) {
-                proxy.ws(req, socket, head, { target: route.target, changeOrigin: true }, () => socket.destroy());
-                return;
-            }
-            const targetChild = pickChild();
-            if (!targetChild) {
-                socket.destroy();
-                return;
-            }
-            proxy.ws(req, socket, head, { target: { socketPath: targetChild.socketPath } }, () => socket.destroy());
-        };
-        server.on('upgrade', upgradeHandler);
-        // The public TCP port is VESTIGIAL under the gateway: the gateway routes to this devserver over the
-        // unix-socket POOL ($TMPDIR/<service>-devserver/child-*.sock), never the TCP port. So a port clash must
-        // NOT crash the devserver — without this handler an EADDRINUSE (two services falling back to the same
-        // default port, or a not-yet-released port from a prior instance) throws an UNHANDLED 'error' that kills
-        // the parent → the supervisors respawn it → the old port is still held → EADDRINUSE again → a zombie
-        // devserver cascade. Handle it: log once and keep serving on the socket pool (gateway routing is
-        // unaffected). A distinct `cluster.port` / `config.<env>.yaml` port silences the warning.
-        server.on('error', (err) => {
-            if (err.code === 'EADDRINUSE') {
-                console.warn(`[parent] public port ${publicPort} already in use — continuing on the unix-socket pool only ` +
-                    `(gateway routing is unaffected). Give this service a distinct cluster.port to silence this.`);
-                return; // do NOT rethrow: the socket pool is the real routing path under the gateway.
-            }
-            console.error(`[parent] public server error:`, err);
-        });
-        // The child pods — which serve on the unix sockets the gateway routes to — are the REAL serving path.
-        // Fork them UNCONDITIONALLY, BEFORE (and independent of) the vestigial public TCP port. This block used
-        // to live in the public-`listen` SUCCESS callback, so a public-port EADDRINUSE (a cross-workspace clash —
-        // e.g. two workspaces' services on the same default port — or a not-yet-released prior instance) meant
-        // the callback never fired → NO pods were forked → with no TCP server bound the parent's event loop
-        // emptied and it exited code=0 → the supervisor respawned it → a zombie respawn storm (the "loser of a
-        // public-port race gets stuck with 0 pods" bug). Under the gateway EVERYTHING reaches this service
-        // through the socket pool, so pod creation must NEVER be gated on the vestigial TCP port. The pods'
-        // IPC channels keep the parent alive even when no TCP port ever binds.
-        await ensurePoolSize(CHILD_COUNT);
-        for (const name of WORKER_NAMES) {
-            spawnWorkerProcess(name);
-        }
-        server.listen(publicPort, () => {
-            const scheme = GATEWAY_HTTPS ? 'https' : 'http';
-            console.log(`[parent] Listening on ${scheme}://localhost:${publicPort}`);
-            if (SERVICE_PREFIX) {
-                console.log(`[parent] Service prefix: "${SERVICE_PREFIX}" (enforced — requests without it will get 404)`);
-            }
-            if (gatewayMiddleware) {
-                console.log(`[parent] Gateway middleware: ACTIVE (${GATEWAY_MIDDLEWARE_PATH})`);
-            }
-            if (GATEWAY_ROUTES.length > 0) {
-                console.log(`[parent] Gateway routes: ${GATEWAY_ROUTES.map((r) => `${r.host ?? '*'}${r.prefix ?? '/'}→${r.target ?? 'children'}`).join('  ')}`);
-            }
-            if (gatewayCaPath) {
-                console.log(`[parent] HTTPS dev CA (trust ONCE, then rotations/new hostnames stay green):`);
-                console.log(`[parent]   sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${gatewayCaPath}`);
-            }
-            console.log(`POST ${scheme}://localhost:${publicPort}/webpack/reload to trigger rolling swap/respawn`);
-        });
-        // Internal service-to-service port: plain http, straight to the children —
-        // NO gateway routes, NO gateway middleware (JWT etc.). Peers call this
-        // directly (http://localhost:<internalPort>/...) instead of going through
-        // the public front door, mirroring cluster-internal networking in prod.
-        const INTERNAL_PORT = Number(process.env.INTERNAL_PORT || 0);
-        if (INTERNAL_PORT > 0) {
-            const internalHandler = (req, res) => {
-                const targetChild = pickChild();
-                if (!targetChild) {
-                    res.statusCode = 503;
-                    res.setHeader('content-type', 'text/plain; charset=utf-8');
-                    res.end('No healthy children available.');
-                    return;
-                }
-                proxy.web(req, res, {
-                    target: { socketPath: targetChild.socketPath },
-                    // NO autoRewrite — a socketPath target crashes http-proxy's setRedirectHostRewrite on a 3xx
-                    // (url.parse of the target OBJECT). See the public-port handler above.
-                }, (err) => {
-                    targetChild.healthy = false;
-                    targetChild.lastError = String(err?.stack || err);
-                    res.statusCode = 502;
-                    res.end(`Upstream error from Child#${targetChild.id}.`);
-                });
-            };
-            const internal = http.createServer(internalHandler);
-            internal.on('upgrade', (req, socket, head) => {
-                const targetChild = pickChild();
-                if (!targetChild) {
-                    socket.destroy();
-                    return;
-                }
-                proxy.ws(req, socket, head, { target: { socketPath: targetChild.socketPath } }, () => socket.destroy());
-            });
-            internal.on('error', (err) => {
-                console.warn(`[parent] internal port ${INTERNAL_PORT} unavailable (${err.code}).`);
-            });
-            internal.listen(INTERNAL_PORT, () => {
-                console.log(`[parent] Internal (service-to-service, no gateway middleware) on http://localhost:${INTERNAL_PORT}`);
-            });
-            extraServers.push(internal);
-        }
-        // Extra listener ports sharing the SAME handler + upgrade routing. The
-        // point is pretty dev domains: with `gateway.https` + extraPorts [443],
-        // https://tetros.ai.local/ works with no :port in the URL (macOS lets
-        // unprivileged processes bind <1024; elsewhere we warn and carry on).
-        const EXTRA_PORTS = (() => {
-            try {
-                return JSON.parse(process.env.GATEWAY_EXTRA_PORTS || '[]');
-            }
-            catch {
-                return [];
-            }
-        })();
-        for (const extraPort of EXTRA_PORTS) {
-            if (!Number.isInteger(extraPort) || extraPort === Number(publicPort))
-                continue;
-            const extra = GATEWAY_HTTPS
-                ? // eslint-disable-next-line @typescript-eslint/no-require-imports
-                    require('node:https').createServer({ key: gatewayPem, cert: gatewayPem }, requestHandler)
-                : http.createServer(requestHandler);
-            extra.on('upgrade', upgradeHandler);
-            extra.on('error', (err) => {
-                console.warn(`[parent] extra port ${extraPort} unavailable (${err.code}) — main port still up.`);
-            });
-            extra.listen(extraPort, () => {
-                const scheme = GATEWAY_HTTPS ? 'https' : 'http';
-                console.log(`[parent] Also listening on ${scheme}://localhost:${extraPort}`);
-            });
-            extraServers.push(extra);
-        }
-        // Control socket: the SAME admin surface (logs/debug/reload/scale), reachable
-        // WITHOUT knowing the public port or scheme. `lensmcp logs <service>` finds it
-        // by deriving $TMPDIR[/<wsKey>]/<service>-devserver/parent.sock — the exact
-        // derivation the gateway uses for the pod pool dir. Plain HTTP: it's a
-        // per-user unix socket, TLS adds nothing.
-        const controlSockPath = path.join(SOCK_DIR, 'parent.sock');
-        claimSock(controlSockPath); // bind steals: claim + clear a crashed previous parent's leftover
-        const controlServer = http.createServer(requestHandler);
-        controlServer.on('error', (err) => {
-            console.warn(`[parent] control socket unavailable (${err.code}) — lensmcp logs/debug attach disabled.`);
-        });
-        controlServer.listen(controlSockPath);
-        extraServers.push(controlServer);
-        // Graceful shutdown of parent (children get SIGTERM)
-        const shutdown = async (sig) => {
-            shuttingDown = true; // stop crash-respawn from fighting the teardown
-            console.log(`[${sig}] [parent] shutting down…`);
-            cleanupSock(controlSockPath);
-            for (const extra of extraServers) {
-                try {
-                    extra.close();
-                }
-                catch { /* ignore */ }
-            }
-            for (const w of workerProcesses) {
-                try {
-                    w.proc.kill('SIGTERM');
-                }
-                catch { /* worker already exited */ }
-            }
-            for (const c of children) {
-                try {
-                    c.proc.kill('SIGTERM');
-                }
-                catch { /* ignore */
-                }
-                if (c.socketPath)
-                    cleanupSock(c.socketPath, c.proc.pid);
-            }
-            // Clean up socket directory
-            try {
-                fs.rmdirSync(SOCK_DIR);
-            }
-            catch { /* best-effort: dir missing or non-empty */ }
-            setTimeout(() => process.exit(0), 700).unref();
-        };
-        ['SIGINT', 'SIGTERM', 'SIGHUP', 'SIGQUIT', 'SIGUSR2'].forEach(sig => process.on(sig, () => void shutdown(sig)));
-        // Gateway watchdog: the gateway kills pods via its spawned process group, but an UNGRACEFUL
-        // gateway death (crash/SIGKILL) never runs that kill — the whole nx run → run-executor →
-        // devserver chain reparents to launchd and squats its ports/sockets forever (the 2026-07-28
-        // day-old orphan tree). We are layers below the gateway, so a ppid check can't see it — poll
-        // the stamped pid instead and tear down through the SAME graceful path when it's gone. The
-        // chain above us unwinds as our exit propagates. A pod run OUTSIDE a gateway (`nx serve`
-        // directly) has no LENSMCP_GATEWAY_PID and is untouched.
-        const gatewayPid = Number(process.env.LENSMCP_GATEWAY_PID ?? 0);
-        if (Number.isInteger(gatewayPid) && gatewayPid > 0) {
-            const watchdog = setInterval(() => {
-                try {
-                    process.kill(gatewayPid, 0);
-                }
-                catch (e) {
-                    if (e.code === 'EPERM')
-                        return; // exists, just not signalable
-                    clearInterval(watchdog);
-                    console.error(`[parent] gateway (pid ${gatewayPid}) is gone — shutting the pod down to avoid an orphan tree.`);
-                    void shutdown('gateway-gone');
-                }
-            }, 5_000);
-            watchdog.unref(); // never keeps an otherwise-done parent alive
-        }
-    })();
-}
+"use strict";var pe=Object.defineProperty;var h=(o,d)=>pe(o,"name",{value:d,configurable:!0});var ie=Object.defineProperty,a=h((o,d)=>ie(o,"name",{value:d,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0});const tslib_1=require("tslib"),path=tslib_1.__importStar(require("node:path")),fs=tslib_1.__importStar(require("node:fs")),os=tslib_1.__importStar(require("node:os")),node_child_process_1=require("node:child_process"),http=tslib_1.__importStar(require("node:http")),readline=tslib_1.__importStar(require("node:readline")),inspector=tslib_1.__importStar(require("node:inspector")),util=tslib_1.__importStar(require("node:util")),httpProxy=require("http-proxy"),{prettyFactory}=require("pino-pretty"),BUNDLE_PATH=process.env.BUNDLE_PATH?.trim()||"./main.js",SERVICE_NAME=process.env.SERVICE_NAME||"",SERVICE_PREFIX=process.env.SERVE_PREFIX?`/${process.env.SERVE_PREFIX}`:"",GATEWAY_MIDDLEWARE_PATH=process.env.GATEWAY_MIDDLEWARE||"",GATEWAY_CONFIG=(()=>{const o=process.env.GATEWAY_CONFIG;if(!o)return{};try{return JSON.parse(o)}catch{return{}}})();let gatewayMiddleware=null;if(GATEWAY_MIDDLEWARE_PATH)try{const o=require(GATEWAY_MIDDLEWARE_PATH);gatewayMiddleware=typeof o=="function"?o:typeof o.default=="function"?o.default:null,gatewayMiddleware||console.warn(`[gateway] ${GATEWAY_MIDDLEWARE_PATH} does not export a function, gateway disabled`)}catch(o){console.error(`[gateway] Failed to load middleware from ${GATEWAY_MIDDLEWARE_PATH}:`,o)}function applyGatewayMiddleware(o){if(gatewayMiddleware)try{gatewayMiddleware(o,GATEWAY_CONFIG)}catch(d){console.error("[gateway] Middleware error:",d)}}h(applyGatewayMiddleware,"applyGatewayMiddleware"),a(applyGatewayMiddleware,"applyGatewayMiddleware");const GATEWAY_ROUTES=(()=>{try{return JSON.parse(process.env.GATEWAY_ROUTES||"[]")}catch{return[]}})(),GATEWAY_HTTPS=process.env.GATEWAY_HTTPS==="1";function hostMatches(o,d){if(o.startsWith("*.")){const g=o.slice(1);return d.endsWith(g)||d===o.slice(2)}return d===o}h(hostMatches,"hostMatches"),a(hostMatches,"hostMatches");function matchGatewayRoute(o){if(GATEWAY_ROUTES.length===0)return;const d=(o.headers.host||"").split(":")[0],g=o.url||"/";for(const f of GATEWAY_ROUTES)if(!(f.host&&!hostMatches(f.host,d))&&!(f.prefix&&!g.startsWith(f.prefix)))return f}h(matchGatewayRoute,"matchGatewayRoute"),a(matchGatewayRoute,"matchGatewayRoute");const WORKER_NAMES=(()=>{try{return JSON.parse(process.env.WORKERS||"[]")}catch{return[]}})(),LENSMCP_WS_KEY=process.env.LENSMCP_WS_KEY||"",SOCK_DIR=LENSMCP_WS_KEY?path.join(os.tmpdir(),LENSMCP_WS_KEY,`${SERVICE_NAME||"lensmcp-cluster"}-devserver`):path.join(os.tmpdir(),`${SERVICE_NAME||"lensmcp-cluster"}-devserver`);function childSockPath(o){return path.join(SOCK_DIR,`child-${o}.sock`)}h(childSockPath,"childSockPath"),a(childSockPath,"childSockPath");function sockOwnerPath(o){return`${o}.owner`}h(sockOwnerPath,"sockOwnerPath"),a(sockOwnerPath,"sockOwnerPath");function claimSock(o,d=process.pid){try{fs.mkdirSync(path.dirname(o),{recursive:!0})}catch{}try{fs.writeFileSync(sockOwnerPath(o),String(d))}catch{}try{fs.unlinkSync(o)}catch{}}h(claimSock,"claimSock"),a(claimSock,"claimSock");function cleanupSock(o,d=process.pid){if(o){try{const g=fs.readFileSync(sockOwnerPath(o),"utf8").trim();if(g&&g!==String(d))return}catch{}try{fs.unlinkSync(o)}catch{}try{fs.unlinkSync(sockOwnerPath(o))}catch{}}}h(cleanupSock,"cleanupSock"),a(cleanupSock,"cleanupSock");async function importFresh(spec){process.env.DEVSERVER_MODE="1";const resolved=path.isAbsolute(spec)?spec:path.join(__dirname,spec);return eval(`delete require.cache["${resolved}"]`),eval(`require("${resolved}")`)}h(importFresh,"importFresh"),a(importFresh,"importFresh");function debounce(o,d){let g=null;return(...f)=>{g&&clearTimeout(g),g=setTimeout(()=>o(...f),d)}}if(h(debounce,"debounce"),a(debounce,"debounce"),process.env.APP_RUNNER==="1"){const o=a(g=>{if(!inspector.url())try{inspector.open(g,"127.0.0.1",!1)}catch(m){console.warn(`[child] inspector.open(${g}) failed (port taken by another devserver?) \u2014 falling back to a random port:`,m.message);try{inspector.open(0,"127.0.0.1",!1)}catch{}}const f=inspector.url();f&&process.send&&process.send({type:"inspector-url",url:f})},"openInspector"),d=Number(process.env.CHILD_DEBUG_PORT||"");Number.isInteger(d)&&d>1024&&o(d);try{require("@lensmcp/node-instrumentation/register")}catch{}(async()=>{let g=null,f=!1,m=!1,H=a((p,u)=>{u.statusCode=503,u.end("starting")},"delegate");async function P(){if(f)return m=!0,console.log("[child] Reload deferred \u2014 will re-swap after current swap completes"),g;if(f=!0,process.removeAllListeners("uncaughtException"),process.removeAllListeners("unhandledRejection"),process.on("uncaughtException",(w,k)=>{console.error(`[child] uncaughtException (${k}):`,w)}),process.on("unhandledRejection",w=>{const k=w instanceof Error?w.stack||w.message:String(w);k.includes("FronteggContextScope")||k.includes("populateLoggerMetadata")||console.error("[child] unhandledRejection:",w)}),await importFresh(BUNDLE_PATH),typeof global.createChildApp!="function")throw f=!1,new Error(`Bundle '${BUNDLE_PATH}' does not export createChildApp() and the zero-touch bridge is not active. Either install @lensmcp/node-instrumentation (a plain NestFactory.create + app.listen main.ts then just works) or set global.createChildApp in main.ts when DEVSERVER_MODE === '1'.`);const p=await global.createChildApp(),u=g;return g=p,H=p.handler,console.log("[child] Swapped to fresh app (previous closing in background)"),u&&u.close().catch(w=>console.error("[child] background close error:",w)),f=!1,m?(m=!1,P()):p}h(P,"I"),a(P,"swapNow");const B=debounce(async()=>{try{console.log("[child] /webpack/reload"),await P()}catch(p){console.error("[child] reload failed:",p)}},250),C=http.createServer((p,u)=>{if(p.method==="POST"&&p.url==="/webpack/reload"){u.writeHead(200,{"content-type":"application/json"}),u.end(JSON.stringify({ok:!0})),B();return}H(p,u)}),_=process.env.CHILD_SOCK_PATH;process.on("disconnect",()=>{cleanupSock(_),process.exit(0)});try{await P();const p=path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.join(__dirname,BUNDLE_PATH);console.log(`[child] Using bundle: ${p}`),claimSock(_),C.listen(_,()=>{console.log(`[child] Listening on ${_}`),process.send&&process.send({type:"ready",socketPath:_})})}catch(p){console.error("[child] Startup error:",p),process.send&&process.send({type:"boot-error",error:String(p?.stack||p)}),process.exitCode=1;return}process.on("message",async p=>{if(!(!p||typeof p!="object")){if(p.type==="debug-open"){const u=Number(p.port);o(Number.isInteger(u)&&u>1024?u:0);return}if(p.type==="reload")try{await P(),process.send&&process.send({type:"reloaded",socketPath:_})}catch(u){console.error("[child] reload error:",u),process.send&&process.send({type:"reload-error",error:String(u?.stack||u)})}}}),process.on("beforeExit",()=>{try{inspector?.close?.()}catch{}});const x=a(async p=>{console.log(`[child ${p}] shutting down\u2026`);const u=g?.close().catch(k=>console.error("[child] close error:",k)),w=new Promise(k=>C.close(()=>k()));cleanupSock(_),setTimeout(()=>process.exit(0),700).unref(),await Promise.all([u,w]),process.exit(0)},"shutdown");["SIGINT","SIGTERM","SIGHUP","SIGQUIT","SIGUSR2"].forEach(p=>{process.on(p,()=>{inspector?.close?.(),x(p)})})})()}else{let o=h(function(i){x.push(i),x.length>_&&x.splice(0,x.length-_),B?.write(i.replace(C,""));for(const y of p)try{y.res.write(y.plain?i.replace(C,""):i)}catch{p.delete(y)}},"p");a(o,"emitLogLine");const d=["\x1B[36m","\x1B[33m","\x1B[35m","\x1B[32m","\x1B[34m","\x1B[31m"],g="\x1B[0m",f=Math.max(1,Number(process.env.CHILD_COUNT||1));let m=(()=>{const i=Number(process.env.LENSMCP_DEBUG_PORT||"");return Number.isInteger(i)&&i>1024?i:0})();const H=20,P=process.env.LENSMCP_LOG_FILE||"",B=P?(()=>{try{return fs.mkdirSync(path.dirname(P),{recursive:!0}),fs.createWriteStream(P,{flags:"a"})}catch(i){return console.warn(`[parent] cannot open log file ${P}:`,i.message),null}})():null,C=/\x1b\[[0-9;]*m/g,_=2e3,x=[],p=new Set;for(const i of["log","info","warn","error"]){const y=console[i].bind(console);console[i]=(...E)=>{y(...E),o(E.map(A=>typeof A=="string"?A:util.inspect(A)).join(" ")+`
+`)}}const u=a(i=>d[(i-1)%d.length],"colorFor"),w=a(i=>{if(f===1)return"";const y=`[child#${i}] `;return`${u(i)}${y}${g}`},"tagFor"),k=a(i=>i.startsWith("{")&&i.endsWith("}"),"isJsonLog"),Z=a((i,y)=>{const E=prettyFactory({sync:!0,colorize:!0,crlf:!0,messageKey:"message",errorLikeObjectKeys:["err","error"],errorProps:"type,message,stack",ignore:["logContext","context","hostname","req","res","err.driverError","module","cloudEnvironment","frontegg-application-id","frontegg-tenant-id","frontegg-trace-id","frontegg-vendor-id","host","service","version","err","error"].join(","),messageFormat:"{if module}[{module}] {end}{if context}[{context}] {end}{if logContext}[{logContext}] {end}{message}",customPrettifiers:{stack:a($=>`
+`+String($),"stack")}}),A=a(($,T)=>{const v=$==="stdout"?process.stdout:process.stderr,b=k(T)?E(T):`${T}
+`;v.write(`${y}${b}`),o(`${y}${b}`)},"write"),G=a(($,T)=>{if(!$)return;const v=readline.createInterface({input:$});v.on("line",b=>A(T,b)),v.on("close",()=>{})},"attach");G(i.stdout,"stdout"),G(i.stderr,"stderr")},"wireProcLogging"),se=a(i=>Z(i.proc,w(i.id)),"wireChildLogging");(async()=>{fs.mkdirSync(SOCK_DIR,{recursive:!0});const i=httpProxy.createProxyServer({});let y=Number(process.env.PORT)||0;y||(y=9090);const E=[],A=new Set;function G(){let e=0;for(;A.has(e);)e++;return A.add(e),e}h(G,"G"),a(G,"allocDebugSlot");let $=1,T=0,v=!1,b=f,O=[];function K(){return E.filter(e=>e.healthy&&typeof e.socketPath=="string")}h(K,"Q"),a(K,"healthyChildren");function M(){const e=K();if(e.length===0)return null;const t=T%e.length;return T=(T+1)%e.length,e[t]}h(M,"U"),a(M,"pickChild");async function U(){const e=$++,t=childSockPath(e);cleanupSock(t);const l=["--enable-source-maps"];__filename.endsWith(".ts")&&l.unshift("--require","@swc-node/register");const n=m?G():-1,c=(0,node_child_process_1.fork)(__filename,{env:{...process.env,APP_RUNNER:"1",CHILD_SOCK_PATH:t,...n>=0&&{CHILD_DEBUG_PORT:String(m+n)}},stdio:["inherit","pipe","pipe","ipc"],execArgv:l}),r={id:e,proc:c,healthy:!1,lastError:null,debugSlot:n};return c.on("message",S=>{if(!S||typeof S!="object")return;const s=S;s.type==="ready"?(r.socketPath=String(s.socketPath),r.healthy=!0,console.log(`[parent] Child#${r.id} ready on socket ${r.socketPath}`)):s.type==="inspector-url"?(r.inspectorUrl=String(s.url),console.log(`[parent] Child#${r.id} Debugger listening on ${s.url}`)):s.type==="reloaded"?(r.socketPath=String(s.socketPath),r.healthy=!0,console.log(`[parent] Child#${r.id} hot-swapped on socket ${r.socketPath}`)):s.type==="reload-error"?(r.lastError=String(s.error||"unknown reload error"),console.error(`[parent] Child#${r.id} reload error: ${r.lastError}`),r.healthy=!1):s.type==="boot-error"&&(r.lastError=String(s.error||"unknown boot error"),console.error(`[parent] Child#${r.id} boot error: ${r.lastError}`),r.healthy=!1)}),c.on("exit",(S,s)=>{r.debugSlot>=0&&(A.delete(r.debugSlot),r.debugSlot=-1);const R=s==="SIGINT"||s==="SIGTERM"||S===0;if(R?console.log(`[parent] Child#${r.id} exited cleanly (code=${S}, signal=${s??"none"})`):(console.error(`[parent] Child#${r.id} crashed (code=${S}, signal=${s??"none"})`),r.lastError||(r.lastError=`Child exited abnormally (code=${S}, signal=${s??"none"})`)),r.healthy=!1,cleanupSock(r.socketPath,r.proc.pid),r.socketPath=void 0,!R&&!v){const N=E.indexOf(r);N>=0&&E.splice(N,1);const ne=Date.now();if(O=O.filter(q=>ne-q<3e4),O.length>=5){console.error(`[parent] crash-loop detected (${O.length} respawns/30s) \u2014 pausing auto-respawn; POST /webpack/reload to retry`);return}O.push(ne),setTimeout(()=>{const q=E.filter(le=>le.proc.killed===!1).length;!v&&q<b&&(console.log(`[parent] respawning a crashed pod (${q}/${b} live)`),U().catch(()=>{}))},1500).unref?.()}}),E.push(r),se(r),r}h(U,"K"),a(U,"spawnChild");async function V(e){b=Math.max(b,e);const t=E.filter(n=>n.proc.killed===!1),l=e-t.length;for(let n=0;n<l;n++)await U()}h(V,"Z"),a(V,"ensurePoolSize");async function ee(){const e=E.filter(t=>!t.healthy||typeof t.socketPath!="string");await Promise.all(e.map(async t=>{try{t.proc.kill("SIGTERM")}catch{}cleanupSock(t.socketPath,t.proc.pid),t.socketPath=void 0;const l=E.indexOf(t);l>=0&&E.splice(l,1),await U()}))}h(ee,"oe"),a(ee,"respawnUnhealthy");const I=[];function J(e){const t=path.dirname(path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.resolve(BUNDLE_PATH)),l=path.join(t,`${e}.js`);if(!fs.existsSync(l))return console.error(`[parent] Worker "${e}" bundle not found: ${l}`),null;const n=["--enable-source-maps"];__filename.endsWith(".ts")&&n.unshift("--require","@swc-node/register");try{n.push("--require",require.resolve("@lensmcp/node-instrumentation/register"))}catch{}const c=(m||9229)+H+Math.max(0,WORKER_NAMES.indexOf(e));n.push(m?`--inspect=127.0.0.1:${c}`:`--inspect-port=127.0.0.1:${c}`);const r=(0,node_child_process_1.fork)(l,{env:process.env,stdio:["inherit","pipe","pipe","ipc"],execArgv:n}),S={name:e,proc:r,debugPort:c};return I.push(S),Z(r,`\x1B[35m[worker:${e}] \x1B[0m`),r.on("exit",(s,R)=>{R==="SIGINT"||R==="SIGTERM"||s===0||console.error(`[parent] Worker "${e}" crashed (code=${s}, signal=${R??"none"})`);const N=I.indexOf(S);N>=0&&I.splice(N,1)}),console.log(`[parent] Worker "${e}" started (pid=${r.pid})`),S}h(J,"q"),a(J,"spawnWorkerProcess");function te(){for(const e of[...I])try{e.proc.kill("SIGTERM")}catch{}I.length=0;for(const e of WORKER_NAMES)J(e)}h(te,"ne"),a(te,"restartWorkers");const ae=debounce(async()=>{const e=K();if(e.length>0){console.log(`[parent] Forwarding reload to ${e.length} child(ren)`);for(const t of e)t.proc.send?.({type:"reload"})}await ee(),WORKER_NAMES.length>0&&te()},200),W=a(async(e,t)=>{if(e.method==="POST"&&e.url==="/webpack/reload"){t.writeHead(200,{"content-type":"application/json"}),t.end(JSON.stringify({ok:!0})),ae();return}if(e.method==="POST"&&e.url==="/webpack/scale"){let c="";e.on("data",r=>{c+=r}),e.on("end",async()=>{let r=0;try{r=Number(JSON.parse(c||"{}").pods)||0}catch{}r=Math.max(1,Math.min(r,16)),await V(r),t.writeHead(200,{"content-type":"application/json"}),t.end(JSON.stringify({ok:!0,pods:r}))});return}if(e.method==="GET"&&e.url?.startsWith("/webpack/logs")){const c=new URL(e.url,"http://localhost").searchParams,r=Math.min(Math.max(Number(c.get("tail")??"100")||0,0),_),S=c.get("follow")!=="0",s=c.get("plain")==="1";t.writeHead(200,{"content-type":"text/plain; charset=utf-8","cache-control":"no-cache"});const R=r===0?"":x.slice(-r).join("");if(t.write(s?R.replace(C,""):R),!S){t.end();return}const N={res:t,plain:s};p.add(N),e.on("close",()=>p.delete(N));return}if(e.method==="POST"&&e.url?.startsWith("/webpack/debug")){const c=Number(new URL(e.url,"http://localhost").searchParams.get("port")||"");Number.isInteger(c)&&c>1024&&(m=c),m||(m=9229);const r=E.filter(s=>s.proc.exitCode===null&&s.proc.signalCode===null);for(const s of r){s.debugSlot<0&&(s.debugSlot=G());try{s.proc.send?.({type:"debug-open",port:m+s.debugSlot})}catch{}}for(const s of I)try{s.proc.kill("SIGUSR1")}catch{}const S=Date.now()+2e3;for(;Date.now()<S&&r.some(s=>!s.inspectorUrl);)await new Promise(s=>setTimeout(s,50));t.writeHead(200,{"content-type":"application/json"}),t.end(JSON.stringify({ok:!0,basePort:m,pods:r.map(s=>({id:s.id,inspectorUrl:s.inspectorUrl??null})),workers:I.map(s=>({name:s.name,port:s.debugPort}))},null,2)+`
+`);return}const l=matchGatewayRoute(e);if(l?.prependPrefix&&!e.url?.startsWith(l.prependPrefix)&&(e.url=l.prependPrefix+(e.url??"/")),l?.target){applyGatewayMiddleware(e),i.web(e,t,{target:l.target,autoRewrite:typeof l.target=="string",changeOrigin:!0},c=>{console.error(`[parent] proxy error to ${l.target}:`,c),t.statusCode=502,t.setHeader("content-type","text/plain; charset=utf-8"),t.end(`Upstream error from ${l.target}.`)});return}if(SERVICE_PREFIX){if(!e.url?.startsWith(SERVICE_PREFIX)){t.writeHead(404,{"content-type":"text/plain; charset=utf-8"}),t.end(`Not found. This service is mounted at ${SERVICE_PREFIX}/`);return}e.url=e.url.slice(SERVICE_PREFIX.length)||"/"}applyGatewayMiddleware(e);const n=M();if(!n){t.statusCode=503,t.setHeader("content-type","text/plain; charset=utf-8");const c=E.map(r=>`#${r.id}: ${r.lastError??"no error recorded"}`).join(`
+`);t.end(`No healthy children available. POST /webpack/reload to recover.
+
+Last errors:
+${c}`);return}i.web(e,t,{target:{socketPath:n.socketPath},headers:{"x-proxy-child-id":String(n.id)}},c=>{console.error(`[parent] proxy error to Child#${n.id}:`,c),n.healthy=!1,n.lastError=String(c?.stack||c),t.statusCode=502,t.setHeader("content-type","text/plain; charset=utf-8"),t.end(`Upstream error from Child#${n.id}. Try /webpack/reload.
+${n.lastError}`)})},"requestHandler");let D,L,X;const Y=[];if(GATEWAY_HTTPS){const e=require("./basic-ssl"),t=GATEWAY_ROUTES.map(n=>n.host).filter(n=>!!n),l=path.join(process.cwd(),"node_modules",".cache","davnx-webpack");L=e.getCertificateSync(l,SERVICE_NAME||"lensmcp.dev",t),X=e.caCertPath(),D=require("node:https").createServer({key:L,cert:L},W)}else D=http.createServer(W);const re=a((e,t,l)=>{const n=matchGatewayRoute(e);if(n?.prependPrefix&&!e.url?.startsWith(n.prependPrefix)&&(e.url=n.prependPrefix+(e.url??"/")),n?.target){i.ws(e,t,l,{target:n.target,changeOrigin:!0},()=>t.destroy());return}const c=M();if(!c){t.destroy();return}i.ws(e,t,l,{target:{socketPath:c.socketPath}},()=>t.destroy())},"upgradeHandler");D.on("upgrade",re),D.on("error",e=>{if(e.code==="EADDRINUSE"){console.warn(`[parent] public port ${y} already in use \u2014 continuing on the unix-socket pool only (gateway routing is unaffected). Give this service a distinct cluster.port to silence this.`);return}console.error("[parent] public server error:",e)}),await V(f);for(const e of WORKER_NAMES)J(e);D.listen(y,()=>{const e=GATEWAY_HTTPS?"https":"http";console.log(`[parent] Listening on ${e}://localhost:${y}`),SERVICE_PREFIX&&console.log(`[parent] Service prefix: "${SERVICE_PREFIX}" (enforced \u2014 requests without it will get 404)`),gatewayMiddleware&&console.log(`[parent] Gateway middleware: ACTIVE (${GATEWAY_MIDDLEWARE_PATH})`),GATEWAY_ROUTES.length>0&&console.log(`[parent] Gateway routes: ${GATEWAY_ROUTES.map(t=>`${t.host??"*"}${t.prefix??"/"}\u2192${t.target??"children"}`).join("  ")}`),X&&(console.log("[parent] HTTPS dev CA (trust ONCE, then rotations/new hostnames stay green):"),console.log(`[parent]   sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${X}`)),console.log(`POST ${e}://localhost:${y}/webpack/reload to trigger rolling swap/respawn`)});const j=Number(process.env.INTERNAL_PORT||0);if(j>0){const e=a((l,n)=>{const c=M();if(!c){n.statusCode=503,n.setHeader("content-type","text/plain; charset=utf-8"),n.end("No healthy children available.");return}i.web(l,n,{target:{socketPath:c.socketPath}},r=>{c.healthy=!1,c.lastError=String(r?.stack||r),n.statusCode=502,n.end(`Upstream error from Child#${c.id}.`)})},"internalHandler"),t=http.createServer(e);t.on("upgrade",(l,n,c)=>{const r=M();if(!r){n.destroy();return}i.ws(l,n,c,{target:{socketPath:r.socketPath}},()=>n.destroy())}),t.on("error",l=>{console.warn(`[parent] internal port ${j} unavailable (${l.code}).`)}),t.listen(j,()=>{console.log(`[parent] Internal (service-to-service, no gateway middleware) on http://localhost:${j}`)}),Y.push(t)}const ce=(()=>{try{return JSON.parse(process.env.GATEWAY_EXTRA_PORTS||"[]")}catch{return[]}})();for(const e of ce){if(!Number.isInteger(e)||e===Number(y))continue;const t=GATEWAY_HTTPS?require("node:https").createServer({key:L,cert:L},W):http.createServer(W);t.on("upgrade",re),t.on("error",l=>{console.warn(`[parent] extra port ${e} unavailable (${l.code}) \u2014 main port still up.`)}),t.listen(e,()=>{console.log(`[parent] Also listening on ${GATEWAY_HTTPS?"https":"http"}://localhost:${e}`)}),Y.push(t)}const z=path.join(SOCK_DIR,"parent.sock");claimSock(z);const Q=http.createServer(W);Q.on("error",e=>{console.warn(`[parent] control socket unavailable (${e.code}) \u2014 lensmcp logs/debug attach disabled.`)}),Q.listen(z),Y.push(Q);const oe=a(async e=>{v=!0,console.log(`[${e}] [parent] shutting down\u2026`),cleanupSock(z);for(const t of Y)try{t.close()}catch{}for(const t of I)try{t.proc.kill("SIGTERM")}catch{}for(const t of E){try{t.proc.kill("SIGTERM")}catch{}t.socketPath&&cleanupSock(t.socketPath,t.proc.pid)}try{fs.rmdirSync(SOCK_DIR)}catch{}setTimeout(()=>process.exit(0),700).unref()},"shutdown");["SIGINT","SIGTERM","SIGHUP","SIGQUIT","SIGUSR2"].forEach(e=>process.on(e,()=>{oe(e)}));const F=Number(process.env.LENSMCP_GATEWAY_PID??0);if(Number.isInteger(F)&&F>0){const e=setInterval(()=>{try{process.kill(F,0)}catch(t){if(t.code==="EPERM")return;clearInterval(e),console.error(`[parent] gateway (pid ${F}) is gone \u2014 shutting the pod down to avoid an orphan tree.`),oe("gateway-gone")}},5e3);e.unref()}})()}