@lensmcp/cluster 1.19.0 → 1.20.0

package/executors/gateway/runtime/lifecycle.d.ts

@@ -1,4 +1,4 @@
-import type { GatewayRuntime, ServiceCtl, SockPool } from './types';
+import type { GatewayRuntime, LensWatcherHealth, ServiceCtl, SockPool, SourceSetChange } from './types';
 import type { Observability } from './observability';
 /** Bounded, async, non-blocking walk of the workspace source tree → a signature of the file SET
  *  (`<count>:<xor-of-path-hashes>`). Skips node_modules/dist/build/dotdirs + `*-devserver` sock dirs + every
@@ -9,7 +9,15 @@ import type { Observability } from './observability';
  *  actually resolve, instead of the whole monorepo — see that function for WHY. Omitted ⇒ the whole root
  *  (the original workspace-wide behavior, still used when a child's project root is unknown). Root-level
  *  loose files are always counted, so a `package.json`/`tsconfig.base.json` add reaches every scope. */
+export interface SourceSetSnapshot {
+    signature: string;
+    paths: Set<string>;
+    truncated: boolean;
+}
+export declare function sourceSetSnapshot(root: string, scopeDirs?: readonly string[], extraExclude?: ReadonlySet<string>): Promise<SourceSetSnapshot>;
 export declare function sourceSetSignature(root: string, scopeDirs?: readonly string[], extraExclude?: ReadonlySet<string>): Promise<string>;
+/** Exact, bounded evidence for a source-file-set transition. */
+export declare function diffSourceSets(previous: SourceSetSnapshot, next: SourceSetSnapshot, changedAt: number): SourceSetChange | null;
 /**
  * PURE: which subtrees a child of `projectRoot` must watch for a "file set changed" verdict.
  *
@@ -77,9 +85,9 @@ export type LensWatcherVerdict = 'heard' | 'missed' | 'unknown';
  * one — accepted: the failure mode is exactly the pre-sweeper world for one scan cycle, the next set change
  * re-arms the check, and the alternative (kill-first) taxes every healthy add to cover it.
  */
-export declare function lensWatcherVerdict(probe: {
+export declare function lensWatcherVerdict(probe: Pick<LensWatcherHealth, 'schemaVersion' | 'lastFsSetEventAt' | 'recentEvents'> | {
     lastFsSetEventAt: number;
-} | null, changedAt: number, windowMs: number): LensWatcherVerdict;
+} | null, changedAt: number, windowMs: number, changedPaths?: readonly string[]): LensWatcherVerdict;
 /** Config for the lens-child LIVENESS decision ({@link lensChildWedged}). */
 export interface LensChildProbeConfig {
     /** Spawn grace: no verdict until the child has had this long to BIND its port (a cold vite boot). */

package/executors/gateway/runtime/lifecycle.js

@@ -1,3 +1,3 @@
-"use strict";var W=Object.defineProperty;var E=(t,n)=>W(t,"name",{value:n,configurable:!0});var I=Object.defineProperty,i=E((t,n)=>I(t,"name",{value:n,configurable:!0}),"i");Object.defineProperty(exports,"__esModule",{value:!0}),exports.sourceSetSignature=sourceSetSignature,exports.sourceScopeDirs=sourceScopeDirs,exports.podRecycleReason=podRecycleReason,exports.lensFrontendStale=lensFrontendStale,exports.lensWatcherVerdict=lensWatcherVerdict,exports.lensChildWedged=lensChildWedged,exports.isPortConflictExit=isPortConflictExit,exports.createServiceLayer=createServiceLayer;const tslib_1=require("tslib"),node_child_process_1=require("node:child_process"),fs=tslib_1.__importStar(require("node:fs")),http=tslib_1.__importStar(require("node:http")),path=tslib_1.__importStar(require("node:path")),node_util_1=require("node:util"),discovery_1=require("./discovery"),scope_1=require("./scope"),pod_env_1=require("./pod-env"),types_1=require("./types");function eastWestEnv(t,n){const l={},p=t.serviceKeys[n];if(p&&(l.LENSMCP_SERVICE_KEY=p),t.https){const a=require("../../../basic-ssl").caCertPath();fs.existsSync(a)&&(l.NODE_EXTRA_CA_CERTS=a)}return l}E(eastWestEnv,"eastWestEnv"),i(eastWestEnv,"eastWestEnv");const sleep=i(t=>new Promise(n=>setTimeout(n,t)),"sleep"),SRC_EXCLUDE=new Set(["node_modules","dist","tmp","coverage","build","out","target"]),SRC_EXT=new Set([".ts",".tsx",".js",".jsx",".mjs",".cjs",".css",".scss",".sass",".less",".json",".html",".htm",".vue",".svelte",".mdx"]),SCAN_FILE_CAP=1e5;function fnv1a(t){let n=2166136261;for(let l=0;l<t.length;l+=1)n^=t.charCodeAt(l),n=Math.imul(n,16777619);return n>>>0}E(fnv1a,"fnv1a"),i(fnv1a,"fnv1a");const execFileP=(0,node_util_1.promisify)(node_child_process_1.execFile);async function gitIgnoredPaths(t){try{const{stdout:n}=await execFileP("git",["ls-files","--others","--directory","--ignored","--exclude-standard","-z"],{cwd:t,maxBuffer:33554432,timeout:1e4,windowsHide:!0});return new Set(n.split("\0").filter(Boolean))}catch{return new Set}}E(gitIgnoredPaths,"gitIgnoredPaths"),i(gitIgnoredPaths,"gitIgnoredPaths");async function sourceSetSignature(t,n,l){let p=0,a=0;const v=await gitIgnoredPaths(t),_=i(f=>path.relative(t,f).split(path.sep).join("/"),"rel"),S=i(async(f,k=!0)=>{if(p>SCAN_FILE_CAP)return;let M;try{M=await fs.promises.readdir(f,{withFileTypes:!0})}catch{return}for(const y of M){if(p>SCAN_FILE_CAP)return;const m=y.name,A=path.join(f,m);if(y.isDirectory()){if(!k||m.startsWith(".")||SRC_EXCLUDE.has(m)||l?.has(m)||m.endsWith("-devserver")||v.has(`${_(A)}/`))continue;await S(A)}else if(y.isFile()){const R=m.lastIndexOf(".");if(R<=0||!SRC_EXT.has(m.slice(R))||v.has(_(A)))continue;p+=1,a^=fnv1a(A)}}},"walk");if(n&&n.length>0){await S(t,!1);for(const f of n)await S(f)}else await S(t);return`${p}:${(a>>>0).toString(36)}`}E(sourceSetSignature,"sourceSetSignature"),i(sourceSetSignature,"sourceSetSignature");function sourceScopeDirs(t,n,l,p,a){const v=i(f=>{const k=path.relative(t,f).split(path.sep).filter(Boolean);return k.length===0||k[0].startsWith("..")?"":k[0]},"bucketOf")(n);if(!v)return[];const _=new Set(l.filter(Boolean)),S=new Set([v]);for(const f of p)f.startsWith(".")||SRC_EXCLUDE.has(f)||a?.has(f)||f.endsWith("-devserver")||_.has(f)||S.add(f);return[...S].sort().map(f=>path.join(t,f))}E(sourceScopeDirs,"sourceScopeDirs"),i(sourceScopeDirs,"sourceScopeDirs");function podRecycleReason(t,n,l,p){return!t.proc||t.state!=="up"||t.spawnAt==null||t.inflight>0||n-t.lastUsed<p.settleMs||t.lastStaleRecycleAt!=null&&n-t.lastStaleRecycleAt<p.cooldownMs?null:l>0&&l-t.spawnAt>p.graceMs?"stale-source-set":p.maxAgeMs>0&&n-t.spawnAt>p.maxAgeMs?"max-age":null}E(podRecycleReason,"podRecycleReason"),i(podRecycleReason,"podRecycleReason");function lensFrontendStale(t,n,l,p,a){return!(p-n<a.cooldownMs||l<=0||l-t<=a.graceMs||p-l<a.settleMs)}E(lensFrontendStale,"lensFrontendStale"),i(lensFrontendStale,"lensFrontendStale");function lensWatcherVerdict(t,n,l){return t?t.lastFsSetEventAt>=n-l?"heard":"missed":"unknown"}E(lensWatcherVerdict,"lensWatcherVerdict"),i(lensWatcherVerdict,"lensWatcherVerdict");function lensChildWedged(t,n,l,p){const a=t.hasListened?p.graceMs:Math.max(p.graceMs,p.neverListenedGraceMs);return l-t.spawnedAt<a||l-n<p.cooldownMs||t.probeFails<Math.max(2,p.failureThreshold)?null:"wedged-no-listener"}E(lensChildWedged,"lensChildWedged"),i(lensChildWedged,"lensChildWedged");function isPortConflictExit(t,n){return t.signal||t.code===null||t.code===0||t.ranMs>n.fastFailMs?!1:t.portHeld}E(isPortConflictExit,"isPortConflictExit"),i(isPortConflictExit,"isPortConflictExit");function createServiceLayer(t,n){const{emit:l}=n,p=i(e=>e.wsKey===t.wsKey?void 0:path.join(e.root,".lensmcp","events.jsonl"),"serviceBus"),a=i((e,o,r,s,c)=>l(o,r,s,{wsKey:e.wsKey,...c},void 0,p(e)),"emitSvc"),v=i(e=>(e.scannedAt=0,(0,discovery_1.pickSock)(e,t.scanTtlMs)?e.socks.length:0),"scanNow"),_=i((e,o)=>{let r;try{r=(0,node_child_process_1.execFileSync)("ps",["ax","-ww","-o","pid=,pgid=,command="],{encoding:"utf8",timeout:5e3})}catch{return 0}const s=e.proc?.pid;let c=0;for(const d of r.split(`
-`)){const w=d.match(/^\s*(\d+)\s+(\d+)\s+(.*)$/);if(!w)continue;const g=Number(w[1]),u=Number(w[2]),h=w[3];if(h.includes(`run ${o}`)&&/\bnx(\.js)?\b/.test(h)&&!(h.includes("/node_modules/nx/")&&!h.includes(e.root))&&!(g===process.pid||g===s)&&!(s!==void 0&&u===s)){try{process.kill(-u,"SIGKILL")}catch{try{process.kill(g,"SIGKILL")}catch{}}c+=1}}return c>0&&(console.log(`[gateway] ${o}: reaped ${c} stale runner tree(s) \u2014 a foreign generation held the nx task lock`),a(e,"warning",`stale-runner reap: ${e.project} (${c} foreign tree(s))`,`cluster-service:${e.project}`,{kind:"stale-runner-reap",project:e.project,reaped:c})),c},"reapForeignRunners"),S=i(e=>{if(t.stopped())return;const o=`${e.project}:${e.decl.serveTarget??"serve-hmr"}`,r=Math.max(1,e.decl.minPods??1);_(e,o),e.lockBlockedAt=void 0,console.log(`[gateway] starting ${o} (pods=${r})\u2026`),a(e,"info",`service starting: ${e.project} (${r} pod${r>1?"s":""})`,`cluster-service:${e.project}`,{kind:"service-starting",project:e.project,pods:r}),e.state="starting",e.spawnAt=Date.now();const s=path.join(e.root,"node_modules","nx","dist","bin","nx.js"),[c,d]=fs.existsSync(s)?[process.execPath,[s,"run",o,`--childCount=${r}`]]:["yarn",["nx","run",o,`--childCount=${r}`]],w=(0,node_child_process_1.spawn)(c,d,{cwd:e.root,detached:!0,env:{...(0,pod_env_1.podBaseEnv)(process.env,t.root,e.root),NX_DAEMON:"false",NX_ISOLATE_PLUGINS:"false",...e.wsKey?{LENSMCP_WS_KEY:e.wsKey}:{},LENSMCP_EVENT_FILE:e.wsKey===t.wsKey?t.eventFile:path.join(e.root,".lensmcp","events.jsonl"),LENSMCP_GATEWAY_PID:String(process.pid),...eastWestEnv(t,e.project)},stdio:["ignore","pipe","pipe"]});e.lastErrors=[],e.buildFailed=!1;const g=i(u=>{const h=u.toString();for(const j of h.split(`
-`)){if(/ERROR in |error TS\d+|Found \d+ error|Unhandled 'error' event|EADDRINUSE/.test(j)){const $=j.replace(/\x1b\[[0-9;]*m/g,"").trim();e.lastErrors.push($),e.lastErrors.length>12&&e.lastErrors.shift(),e.buildFailed=!0;const x=Date.now();($!==e.lastErrorEmitSig||x-(e.lastErrorEmitAt??0)>=types_1.SERVICE_ERROR_THROTTLE_MS)&&(e.lastErrorEmitSig=$,e.lastErrorEmitAt=x,a(e,"error",`service error: ${e.project}`,`cluster-service:${e.project}`,{kind:"service-error",project:e.project,line:$}))}/No typescript errors found|webpack compiled successfully|Child#\d+ ready/.test(j)&&(e.buildFailed=!1),!e.lockBlockedAt&&/Waiting for .+ in another nx process/.test(j)&&(e.lockBlockedAt=Date.now(),console.log(`[gateway] ${o}: spawn blocked by a stale nx runner \u2014 breaking the lock + respawning`),a(e,"warning",`nx task lock: ${e.project} blocked by a stale runner \u2014 auto-breaking`,`cluster-service:${e.project}`,{kind:"nx-lock-break",project:e.project}),setTimeout(()=>{t.stopped()||!e.lockBlockedAt||(y(e,"parked on a foreign nx task lock \u2014 recycling",{announce:!1}),_(e,o),setTimeout(()=>{!t.stopped()&&!e.proc&&e.state==="down"&&S(e)},1500).unref?.())},250).unref?.())}},"sniff");w.stdout?.on("data",u=>{t.stopped()||(g(u),process.stdout.write(`[${e.project}] ${u}`))}),w.stderr?.on("data",u=>{t.stopped()||(g(u),process.stderr.write(`[${e.project}] ${u}`))}),w.on("exit",u=>{if(e.proc=void 0,e.state="down",t.stopped()||(console.log(`[gateway] ${o} exited (${u})`),a(e,u===0?"info":"warning",`service down: ${e.project} (exit ${u})`,`cluster-service:${e.project}`,{kind:"service-down",project:e.project,code:u}),u===0||e.buildFailed))return;const h=Date.now();if(e.restarts=(e.restarts??[]).filter($=>h-$<types_1.SERVICE_RESTART_WINDOW_MS),e.restarts.length>=types_1.SERVICE_MAX_RESTARTS){a(e,"error",`service crash-looping: ${e.project} \u2014 ${types_1.SERVICE_MAX_RESTARTS}+ restarts/min, not auto-respawning (the next request retries)`,`cluster-service:${e.project}`,{kind:"service-crash-loop",project:e.project});return}e.restarts.push(h);const j=Math.min(8e3,500*2**(e.restarts.length-1));setTimeout(()=>{t.stopped()||e.proc||e.state!=="down"||(console.log(`[gateway] self-heal: respawning ${e.project} (restart ${e.restarts.length}/${types_1.SERVICE_MAX_RESTARTS})`),a(e,"info",`self-heal: respawning ${e.project}`,`cluster-service:${e.project}`,{kind:"service-respawn",project:e.project,attempt:e.restarts.length}),S(e))},j)}),e.proc=w},"spawnService"),f=i((e,o)=>{if(e.state==="up")return!1;e.state="up";const r=e.pool.socks.length;return a(e,"info",`service up: ${e.project} (${r} pods, ${o})`,`cluster-service:${e.project}`,{kind:"service-up",project:e.project,pods:r,adopted:o==="adopted"}),!0},"markUp"),k=i(async e=>{if(v(e.pool)>0)return f(e,"adopted"),!0;if(t.stopped())return!1;e.state!=="starting"&&!e.proc&&S(e);const o=Date.now()+t.startupTimeoutMs,r=Date.now()+12e3;for(;!t.stopped()&&Date.now()<o;){if(await sleep(Math.min(700,t.startupTimeoutMs/4)),e.buildFailed&&Date.now()>r)return!1;if(v(e.pool)>0){e.state="up",e.buildFailed=!1;const s=e.spawnAt?Date.now()-e.spawnAt:void 0;return console.log(`[gateway] ${e.project} up (${e.pool.socks.length} pods${s?`, cold start ${s}ms`:""})`),a(e,"info",`cold start: ${e.project} (${e.pool.socks.length} pods, ${s??"?"}ms)`,`cluster-service:${e.project}`,{kind:"cold-start",project:e.project,pods:e.pool.socks.length,durationMs:s}),!0}if(e.state==="down")return!1}return!1},"ensureUp"),M=i(e=>{const o=e.decl.maxPods??e.decl.minPods??1,r=e.pool.socks.length,s=e.decl.adminUrl??(e.decl.port?`http://localhost:${e.decl.port}`:void 0);if(!s||r===0||r>=o||e.inflight<=r||Date.now()-e.lastScaleAt<5e3)return;e.lastScaleAt=Date.now();const c=(s.startsWith("https")?require("node:https"):http).request(`${s}/webpack/scale`,{method:"POST",rejectUnauthorized:!1},d=>d.resume());c.on("error",()=>{}),c.end(JSON.stringify({pods:r+1})),console.log(`[gateway] autoscale ${e.project}: ${r} \u2192 ${r+1} pods (inflight ${e.inflight})`),a(e,"info",`autoscale: ${e.project} ${r} \u2192 ${r+1} pods`,`cluster-service:${e.project}`,{kind:"autoscale",project:e.project,from:r,to:r+1,inflight:e.inflight})},"scaleUp"),y=i((e,o,r)=>{if(!e.proc)return;console.log(`[gateway] ${e.project} ${o} \u2014 scaling to zero.`),r?.announce!==!1&&a(e,"info",`idle kill: ${e.project} (${o})`,`cluster-service:${e.project}`,{kind:"idle-kill",project:e.project,why:o});const s=e.proc;try{s.stdout?.removeAllListeners("data"),s.stderr?.removeAllListeners("data"),s.removeAllListeners("exit")}catch{}try{process.kill(-s.pid,"SIGTERM")}catch{try{s.kill("SIGTERM")}catch{}}e.proc=void 0,e.state="down",setTimeout(()=>{try{for(const c of fs.readdirSync(e.pool.dir)){if(!c.endsWith(".sock"))continue;const d=path.join(e.pool.dir,c);try{const w=Number(fs.readFileSync(`${d}.owner`,"utf8").trim());if(Number.isFinite(w)&&w>0)try{process.kill(w,0);continue}catch{}}catch{}try{fs.unlinkSync(d)}catch{}try{fs.unlinkSync(`${d}.owner`)}catch{}}}catch{}e.pool.socks=[],e.pool.scannedAt=0},1200).unref?.()},"killSpawned"),m=i(e=>{const o=Date.now();if(e.restarts=(e.restarts??[]).filter(r=>o-r<types_1.SERVICE_RESTART_WINDOW_MS),e.restarts.length>=types_1.SERVICE_MAX_RESTARTS){a(e,"error",`service crash-looping: ${e.project} \u2014 wedged ${types_1.SERVICE_MAX_RESTARTS}+\xD7/min, not auto-recycling (the next request retries)`,`cluster-service:${e.project}`,{kind:"service-crash-loop",project:e.project}),y(e,"wedged (crash-loop cap) \u2014 leaving down for the next request",{announce:!1});return}e.restarts.push(o),console.log(`[gateway] self-heal: recycling WEDGED ${e.project} (live parent, 0 live pods; ${e.restarts.length}/${types_1.SERVICE_MAX_RESTARTS})`),a(e,"warning",`self-heal: recycling wedged ${e.project} (0 live pods)`,`cluster-service:${e.project}`,{kind:"service-recycle",project:e.project,attempt:e.restarts.length}),y(e,"wedged: 0 live pods \u2014 recycling",{announce:!1}),setTimeout(()=>{!t.stopped()&&!e.proc&&e.state==="down"&&S(e)},1500).unref?.()},"recycleWedged"),A={maxAgeMs:types_1.POD_MAX_AGE_MS,graceMs:types_1.POD_STALE_GRACE_MS,settleMs:types_1.POD_RECYCLE_SETTLE_MS,cooldownMs:types_1.POD_STALE_RECYCLE_COOLDOWN_MS};let R;const D=new Map;let C=!1,T=0;const b=i(()=>{const e=t.projectRoots??{},o=new Set(t.services.map(s=>s.project));for(const s of t.routes)s.lens&&o.add(s.lens.project);const r=new Set;for(const s of o){const c=e[s];if(!c)continue;const d=path.relative(t.root,c).split(path.sep).filter(Boolean)[0];d&&!d.startsWith("..")&&r.add(d)}return[...r]},"managedBuckets"),L=i((e,o,r,s)=>{const c=t.projectRoots?.[e];if(!c)return;const d=sourceScopeDirs(t.root,c,r,o,s);return d.length>0?d:void 0},"scopeFor"),P=i(()=>{C||Date.now()-T<types_1.POD_STALE_SCAN_MS||(C=!0,T=Date.now(),(async()=>{const e=(0,scope_1.readSourceSetExclude)(t.root),o=await sourceSetSignature(t.root,void 0,e);if(R!==void 0&&o!==R&&(t.sourceSetChangedAt=Date.now(),l("info","source file set changed \u2014 stale pods recycle when idle","cluster-gateway",{kind:"source-set-changed"})),R=o,!t.projectRoots)return;let r;try{r=(await fs.promises.readdir(t.root,{withFileTypes:!0})).filter(g=>g.isDirectory()).map(g=>g.name)}catch{return}const s=b(),c=new Set(t.services.map(g=>g.project));for(const g of t.routes)g.lens&&c.add(g.lens.project);const d=new Map;for(const g of c){const u=L(g,r,s,e);if(!u)continue;const h=u.join("|"),j=d.get(h)??{dirs:u,projects:[]};j.projects.push(g),d.set(h,j)}const w=Date.now();for(const[g,{dirs:u,projects:h}]of d){const j=await sourceSetSignature(t.root,u,e),$=D.get(g);if(D.set(g,j),!($===void 0||j===$)){t.sourceSetChangedFor??=new Map;for(const x of h)t.sourceSetChangedFor.set(x,w);l("info",`source file set changed in ${h.join(", ")}'s scope`,"cluster-gateway",{kind:"source-set-changed",scoped:!0,projects:h})}}})().catch(()=>{}).finally(()=>{C=!1}))},"maybeScanSourceSet"),F=i((e,o)=>{e.lastStaleRecycleAt=Date.now(),console.log(`[gateway] zombie recycle: ${e.project} (${o}) \u2014 stale fs view; fresh pod incoming`),a(e,"warning",`zombie recycle: ${e.project} (${o})`,`cluster-service:${e.project}`,{kind:"pod-recycle",project:e.project,reason:o});const r=!!e.decl.eager;y(e,`${o} \u2014 recycling stale pod`,{announce:!1}),r&&setTimeout(()=>{!t.stopped()&&!e.proc&&e.state==="down"&&S(e)},1500).unref?.()},"recyclePod");return{scanNow:v,spawnService:S,ensureUp:k,scaleUp:M,killSpawned:y,markUp:f,startSweeper:i(()=>{const e=setInterval(()=>{if(!t.stopped()){types_1.POD_RECYCLE_ENABLED&&P();for(const o of t.services){if(t.stopped()||!o.proc){o.wedgedSince=void 0;continue}const r=o.decl.idleKillSec;if(r&&o.inflight===0&&Date.now()-o.lastUsed>r*1e3){y(o,`idle ${r}s`),o.wedgedSince=void 0;continue}const s=o.state==="starting"&&o.spawnAt!==void 0&&Date.now()-o.spawnAt<t.startupTimeoutMs,c=v(o.pool)>0;if(c||s){if(o.wedgedSince=void 0,c&&f(o,"observed"),c&&!s&&types_1.POD_RECYCLE_ENABLED){const d=t.sourceSetChangedFor?.get(o.project)??t.sourceSetChangedAt??0,w=podRecycleReason(o,Date.now(),d,A);w&&F(o,w)}continue}o.wedgedSince??=Date.now(),Date.now()-o.wedgedSince>types_1.WEDGE_RECYCLE_GRACE_MS&&(o.wedgedSince=void 0,m(o))}}},t.sweepMs);return e.unref(),e},"startSweeper")}}E(createServiceLayer,"createServiceLayer"),i(createServiceLayer,"createServiceLayer");
+"use strict";var U=Object.defineProperty;var E=(t,o)=>U(t,"name",{value:o,configurable:!0});var q=Object.defineProperty,v=E((t,o)=>q(t,"name",{value:o,configurable:!0}),"v"),W=Object.defineProperty,a=v((t,o)=>W(t,"name",{value:o,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0}),exports.sourceSetSnapshot=sourceSetSnapshot,exports.sourceSetSignature=sourceSetSignature,exports.diffSourceSets=diffSourceSets,exports.sourceScopeDirs=sourceScopeDirs,exports.podRecycleReason=podRecycleReason,exports.lensFrontendStale=lensFrontendStale,exports.lensWatcherVerdict=lensWatcherVerdict,exports.lensChildWedged=lensChildWedged,exports.isPortConflictExit=isPortConflictExit,exports.createServiceLayer=createServiceLayer;const tslib_1=require("tslib"),node_child_process_1=require("node:child_process"),fs=tslib_1.__importStar(require("node:fs")),http=tslib_1.__importStar(require("node:http")),path=tslib_1.__importStar(require("node:path")),node_util_1=require("node:util"),discovery_1=require("./discovery"),scope_1=require("./scope"),pod_env_1=require("./pod-env"),types_1=require("./types");function eastWestEnv(t,o){const l={},i=t.serviceKeys[o];if(i&&(l.LENSMCP_SERVICE_KEY=i),t.https){const c=require("../../../basic-ssl").caCertPath();fs.existsSync(c)&&(l.NODE_EXTRA_CA_CERTS=c)}return l}E(eastWestEnv,"eastWestEnv"),v(eastWestEnv,"eastWestEnv"),a(eastWestEnv,"eastWestEnv");const sleep=a(t=>new Promise(o=>setTimeout(o,t)),"sleep"),SRC_EXCLUDE=new Set(["node_modules","dist","tmp","coverage","build","out","target"]),SRC_EXT=new Set([".ts",".tsx",".js",".jsx",".mjs",".cjs",".css",".scss",".sass",".less",".json",".html",".htm",".vue",".svelte",".mdx"]),SCAN_FILE_CAP=1e5;function fnv1a(t){let o=2166136261;for(let l=0;l<t.length;l+=1)o^=t.charCodeAt(l),o=Math.imul(o,16777619);return o>>>0}E(fnv1a,"fnv1a"),v(fnv1a,"fnv1a"),a(fnv1a,"fnv1a");const execFileP=(0,node_util_1.promisify)(node_child_process_1.execFile);async function gitIgnoredPaths(t){try{const{stdout:o}=await execFileP("git",["ls-files","--others","--directory","--ignored","--exclude-standard","-z"],{cwd:t,maxBuffer:33554432,timeout:1e4,windowsHide:!0});return new Set(o.split("\0").filter(Boolean))}catch{return new Set}}E(gitIgnoredPaths,"gitIgnoredPaths"),v(gitIgnoredPaths,"gitIgnoredPaths"),a(gitIgnoredPaths,"gitIgnoredPaths");async function sourceSetSnapshot(t,o,l){let i=0,c=0,w=!1;const u=new Set,j=await gitIgnoredPaths(t),g=a(A=>path.relative(t,A).split(path.sep).join("/"),"rel"),$=a(async(A,R=!0)=>{if(i>=SCAN_FILE_CAP){w=!0;return}let L;try{L=await fs.promises.readdir(A,{withFileTypes:!0})}catch{return}for(const T of L){if(i>=SCAN_FILE_CAP){w=!0;return}const _=T.name,M=path.join(A,_);if(T.isDirectory()){if(!R||_.startsWith(".")||SRC_EXCLUDE.has(_)||l?.has(_)||_.endsWith("-devserver")||j.has(`${g(M)}/`))continue;await $(M)}else if(T.isFile()){const x=_.lastIndexOf(".");if(x<=0||!SRC_EXT.has(_.slice(x))||j.has(g(M)))continue;const D=g(M);if(u.has(D))continue;u.add(D),i+=1,c^=fnv1a(D)}}},"walk");if(o&&o.length>0){await $(t,!1);for(const A of o)await $(A)}else await $(t);return{signature:`${i}:${(c>>>0).toString(36)}`,paths:u,truncated:w}}E(sourceSetSnapshot,"sourceSetSnapshot"),v(sourceSetSnapshot,"sourceSetSnapshot"),a(sourceSetSnapshot,"sourceSetSnapshot");async function sourceSetSignature(t,o,l){return(await sourceSetSnapshot(t,o,l)).signature}E(sourceSetSignature,"sourceSetSignature"),v(sourceSetSignature,"sourceSetSignature"),a(sourceSetSignature,"sourceSetSignature");const SOURCE_DIFF_PATH_CAP=128;function diffSourceSets(t,o,l){if(t.paths.size===o.paths.size){let u=!0;for(const j of t.paths)if(!o.paths.has(j)){u=!1;break}if(u)return null}const i=[],c=[];let w=t.truncated||o.truncated;for(const u of o.paths)t.paths.has(u)||(i.length+c.length<SOURCE_DIFF_PATH_CAP?i.push(u):w=!0);for(const u of t.paths)o.paths.has(u)||(i.length+c.length<SOURCE_DIFF_PATH_CAP?c.push(u):w=!0);return{changedAt:l,added:i,removed:c,truncated:w}}E(diffSourceSets,"diffSourceSets"),v(diffSourceSets,"diffSourceSets"),a(diffSourceSets,"diffSourceSets");function sourceScopeDirs(t,o,l,i,c){const w=a(g=>{const $=path.relative(t,g).split(path.sep).filter(Boolean);return $.length===0||$[0].startsWith("..")?"":$[0]},"bucketOf")(o);if(!w)return[];const u=new Set(l.filter(Boolean)),j=new Set([w]);for(const g of i)g.startsWith(".")||SRC_EXCLUDE.has(g)||c?.has(g)||g.endsWith("-devserver")||u.has(g)||j.add(g);return[...j].sort().map(g=>path.join(t,g))}E(sourceScopeDirs,"sourceScopeDirs"),v(sourceScopeDirs,"sourceScopeDirs"),a(sourceScopeDirs,"sourceScopeDirs");function podRecycleReason(t,o,l,i){return!t.proc||t.state!=="up"||t.spawnAt==null||t.inflight>0||o-t.lastUsed<i.settleMs||t.lastStaleRecycleAt!=null&&o-t.lastStaleRecycleAt<i.cooldownMs?null:l>0&&l-t.spawnAt>i.graceMs?"stale-source-set":i.maxAgeMs>0&&o-t.spawnAt>i.maxAgeMs?"max-age":null}E(podRecycleReason,"podRecycleReason"),v(podRecycleReason,"podRecycleReason"),a(podRecycleReason,"podRecycleReason");function lensFrontendStale(t,o,l,i,c){return!(i-o<c.cooldownMs||l<=0||l-t<=c.graceMs||i-l<c.settleMs)}E(lensFrontendStale,"lensFrontendStale"),v(lensFrontendStale,"lensFrontendStale"),a(lensFrontendStale,"lensFrontendStale");function lensWatcherVerdict(t,o,l,i=[]){if(!t)return"unknown";if("schemaVersion"in t&&t.schemaVersion>=2&&i.length>0){const c=o-l,w=new Set(t.recentEvents.filter(u=>u.at>=c).map(u=>path.resolve(u.path)));return i.every(u=>w.has(path.resolve(u)))?"heard":"missed"}return t.lastFsSetEventAt>=o-l?"heard":"missed"}E(lensWatcherVerdict,"lensWatcherVerdict"),v(lensWatcherVerdict,"lensWatcherVerdict"),a(lensWatcherVerdict,"lensWatcherVerdict");function lensChildWedged(t,o,l,i){const c=t.hasListened?i.graceMs:Math.max(i.graceMs,i.neverListenedGraceMs);return l-t.spawnedAt<c||l-o<i.cooldownMs||t.probeFails<Math.max(2,i.failureThreshold)?null:"wedged-no-listener"}E(lensChildWedged,"lensChildWedged"),v(lensChildWedged,"lensChildWedged"),a(lensChildWedged,"lensChildWedged");function isPortConflictExit(t,o){return t.signal||t.code===null||t.code===0||t.ranMs>o.fastFailMs?!1:t.portHeld}E(isPortConflictExit,"isPortConflictExit"),v(isPortConflictExit,"isPortConflictExit"),a(isPortConflictExit,"isPortConflictExit");function createServiceLayer(t,o){const{emit:l}=o,i=a(e=>e.wsKey===t.wsKey?void 0:path.join(e.root,".lensmcp","events.jsonl"),"serviceBus"),c=a((e,r,s,n,d)=>l(r,s,n,{wsKey:e.wsKey,...d},void 0,i(e)),"emitSvc"),w=a(e=>(e.scannedAt=0,(0,discovery_1.pickSock)(e,t.scanTtlMs)?e.socks.length:0),"scanNow"),u=a((e,r)=>{let s;try{s=(0,node_child_process_1.execFileSync)("ps",["ax","-ww","-o","pid=,pgid=,command="],{encoding:"utf8",timeout:5e3})}catch{return 0}const n=e.proc?.pid;let d=0;for(const h of s.split(`
+`)){const f=h.match(/^\s*(\d+)\s+(\d+)\s+(.*)$/);if(!f)continue;const k=Number(f[1]),S=Number(f[2]),p=f[3];if(p.includes(`run ${r}`)&&/\bnx(\.js)?\b/.test(p)&&!(p.includes("/node_modules/nx/")&&!p.includes(e.root))&&!(k===process.pid||k===n)&&!(n!==void 0&&S===n)){try{process.kill(-S,"SIGKILL")}catch{try{process.kill(k,"SIGKILL")}catch{}}d+=1}}return d>0&&(console.log(`[gateway] ${r}: reaped ${d} stale runner tree(s) \u2014 a foreign generation held the nx task lock`),c(e,"warning",`stale-runner reap: ${e.project} (${d} foreign tree(s))`,`cluster-service:${e.project}`,{kind:"stale-runner-reap",project:e.project,reaped:d})),d},"reapForeignRunners"),j=a(e=>{if(t.stopped())return;const r=`${e.project}:${e.decl.serveTarget??"serve-hmr"}`,s=Math.max(1,e.decl.minPods??1);u(e,r),e.lockBlockedAt=void 0,console.log(`[gateway] starting ${r} (pods=${s})\u2026`),c(e,"info",`service starting: ${e.project} (${s} pod${s>1?"s":""})`,`cluster-service:${e.project}`,{kind:"service-starting",project:e.project,pods:s}),e.state="starting",e.spawnAt=Date.now();const n=path.join(e.root,"node_modules","nx","dist","bin","nx.js"),[d,h]=fs.existsSync(n)?[process.execPath,[n,"run",r,`--childCount=${s}`]]:["yarn",["nx","run",r,`--childCount=${s}`]],f=(0,node_child_process_1.spawn)(d,h,{cwd:e.root,detached:!0,env:{...(0,pod_env_1.podBaseEnv)(process.env,t.root,e.root),NX_DAEMON:"false",NX_ISOLATE_PLUGINS:"false",...e.wsKey?{LENSMCP_WS_KEY:e.wsKey}:{},LENSMCP_EVENT_FILE:e.wsKey===t.wsKey?t.eventFile:path.join(e.root,".lensmcp","events.jsonl"),LENSMCP_GATEWAY_PID:String(process.pid),...eastWestEnv(t,e.project)},stdio:["ignore","pipe","pipe"]});e.lastErrors=[],e.buildFailed=!1;const k=a(S=>{const p=S.toString();for(const y of p.split(`
+`)){if(/ERROR in |error TS\d+|Found \d+ error|Unhandled 'error' event|EADDRINUSE/.test(y)){const m=y.replace(/\x1b\[[0-9;]*m/g,"").trim();e.lastErrors.push(m),e.lastErrors.length>12&&e.lastErrors.shift(),e.buildFailed=!0;const C=Date.now();(m!==e.lastErrorEmitSig||C-(e.lastErrorEmitAt??0)>=types_1.SERVICE_ERROR_THROTTLE_MS)&&(e.lastErrorEmitSig=m,e.lastErrorEmitAt=C,c(e,"error",`service error: ${e.project}`,`cluster-service:${e.project}`,{kind:"service-error",project:e.project,line:m}))}/No typescript errors found|webpack compiled successfully|Child#\d+ ready/.test(y)&&(e.buildFailed=!1),!e.lockBlockedAt&&/Waiting for .+ in another nx process/.test(y)&&(e.lockBlockedAt=Date.now(),console.log(`[gateway] ${r}: spawn blocked by a stale nx runner \u2014 breaking the lock + respawning`),c(e,"warning",`nx task lock: ${e.project} blocked by a stale runner \u2014 auto-breaking`,`cluster-service:${e.project}`,{kind:"nx-lock-break",project:e.project}),setTimeout(()=>{t.stopped()||!e.lockBlockedAt||(R(e,"parked on a foreign nx task lock \u2014 recycling",{announce:!1}),u(e,r),setTimeout(()=>{!t.stopped()&&!e.proc&&e.state==="down"&&j(e)},1500).unref?.())},250).unref?.())}},"sniff");f.stdout?.on("data",S=>{t.stopped()||(k(S),process.stdout.write(`[${e.project}] ${S}`))}),f.stderr?.on("data",S=>{t.stopped()||(k(S),process.stderr.write(`[${e.project}] ${S}`))}),f.on("exit",S=>{if(e.proc=void 0,e.state="down",t.stopped()||(console.log(`[gateway] ${r} exited (${S})`),c(e,S===0?"info":"warning",`service down: ${e.project} (exit ${S})`,`cluster-service:${e.project}`,{kind:"service-down",project:e.project,code:S}),S===0||e.buildFailed))return;const p=Date.now();if(e.restarts=(e.restarts??[]).filter(m=>p-m<types_1.SERVICE_RESTART_WINDOW_MS),e.restarts.length>=types_1.SERVICE_MAX_RESTARTS){c(e,"error",`service crash-looping: ${e.project} \u2014 ${types_1.SERVICE_MAX_RESTARTS}+ restarts/min, not auto-respawning (the next request retries)`,`cluster-service:${e.project}`,{kind:"service-crash-loop",project:e.project});return}e.restarts.push(p);const y=Math.min(8e3,500*2**(e.restarts.length-1));setTimeout(()=>{t.stopped()||e.proc||e.state!=="down"||(console.log(`[gateway] self-heal: respawning ${e.project} (restart ${e.restarts.length}/${types_1.SERVICE_MAX_RESTARTS})`),c(e,"info",`self-heal: respawning ${e.project}`,`cluster-service:${e.project}`,{kind:"service-respawn",project:e.project,attempt:e.restarts.length}),j(e))},y)}),e.proc=f},"spawnService"),g=a((e,r)=>{if(e.state==="up")return!1;e.state="up";const s=e.pool.socks.length;return c(e,"info",`service up: ${e.project} (${s} pods, ${r})`,`cluster-service:${e.project}`,{kind:"service-up",project:e.project,pods:s,adopted:r==="adopted"}),!0},"markUp"),$=a(async e=>{if(w(e.pool)>0)return g(e,"adopted"),!0;if(t.stopped())return!1;e.state!=="starting"&&!e.proc&&j(e);const r=Date.now()+t.startupTimeoutMs,s=Date.now()+12e3;for(;!t.stopped()&&Date.now()<r;){if(await sleep(Math.min(700,t.startupTimeoutMs/4)),e.buildFailed&&Date.now()>s)return!1;if(w(e.pool)>0){e.state="up",e.buildFailed=!1;const n=e.spawnAt?Date.now()-e.spawnAt:void 0;return console.log(`[gateway] ${e.project} up (${e.pool.socks.length} pods${n?`, cold start ${n}ms`:""})`),c(e,"info",`cold start: ${e.project} (${e.pool.socks.length} pods, ${n??"?"}ms)`,`cluster-service:${e.project}`,{kind:"cold-start",project:e.project,pods:e.pool.socks.length,durationMs:n}),!0}if(e.state==="down")return!1}return!1},"ensureUp"),A=a(e=>{const r=e.decl.maxPods??e.decl.minPods??1,s=e.pool.socks.length,n=e.decl.adminUrl??(e.decl.port?`http://localhost:${e.decl.port}`:void 0);if(!n||s===0||s>=r||e.inflight<=s||Date.now()-e.lastScaleAt<5e3)return;e.lastScaleAt=Date.now();const d=(n.startsWith("https")?require("node:https"):http).request(`${n}/webpack/scale`,{method:"POST",rejectUnauthorized:!1},h=>h.resume());d.on("error",()=>{}),d.end(JSON.stringify({pods:s+1})),console.log(`[gateway] autoscale ${e.project}: ${s} \u2192 ${s+1} pods (inflight ${e.inflight})`),c(e,"info",`autoscale: ${e.project} ${s} \u2192 ${s+1} pods`,`cluster-service:${e.project}`,{kind:"autoscale",project:e.project,from:s,to:s+1,inflight:e.inflight})},"scaleUp"),R=a((e,r,s)=>{if(!e.proc)return;console.log(`[gateway] ${e.project} ${r} \u2014 scaling to zero.`),s?.announce!==!1&&c(e,"info",`idle kill: ${e.project} (${r})`,`cluster-service:${e.project}`,{kind:"idle-kill",project:e.project,why:r});const n=e.proc;try{n.stdout?.removeAllListeners("data"),n.stderr?.removeAllListeners("data"),n.removeAllListeners("exit")}catch{}try{process.kill(-n.pid,"SIGTERM")}catch{try{n.kill("SIGTERM")}catch{}}e.proc=void 0,e.state="down",setTimeout(()=>{try{for(const d of fs.readdirSync(e.pool.dir)){if(!d.endsWith(".sock"))continue;const h=path.join(e.pool.dir,d);try{const f=Number(fs.readFileSync(`${h}.owner`,"utf8").trim());if(Number.isFinite(f)&&f>0)try{process.kill(f,0);continue}catch{}}catch{}try{fs.unlinkSync(h)}catch{}try{fs.unlinkSync(`${h}.owner`)}catch{}}}catch{}e.pool.socks=[],e.pool.scannedAt=0},1200).unref?.()},"killSpawned"),L=a(e=>{const r=Date.now();if(e.restarts=(e.restarts??[]).filter(s=>r-s<types_1.SERVICE_RESTART_WINDOW_MS),e.restarts.length>=types_1.SERVICE_MAX_RESTARTS){c(e,"error",`service crash-looping: ${e.project} \u2014 wedged ${types_1.SERVICE_MAX_RESTARTS}+\xD7/min, not auto-recycling (the next request retries)`,`cluster-service:${e.project}`,{kind:"service-crash-loop",project:e.project}),R(e,"wedged (crash-loop cap) \u2014 leaving down for the next request",{announce:!1});return}e.restarts.push(r),console.log(`[gateway] self-heal: recycling WEDGED ${e.project} (live parent, 0 live pods; ${e.restarts.length}/${types_1.SERVICE_MAX_RESTARTS})`),c(e,"warning",`self-heal: recycling wedged ${e.project} (0 live pods)`,`cluster-service:${e.project}`,{kind:"service-recycle",project:e.project,attempt:e.restarts.length}),R(e,"wedged: 0 live pods \u2014 recycling",{announce:!1}),setTimeout(()=>{!t.stopped()&&!e.proc&&e.state==="down"&&j(e)},1500).unref?.()},"recycleWedged"),T={maxAgeMs:types_1.POD_MAX_AGE_MS,graceMs:types_1.POD_STALE_GRACE_MS,settleMs:types_1.POD_RECYCLE_SETTLE_MS,cooldownMs:types_1.POD_STALE_RECYCLE_COOLDOWN_MS};let _;const M=new Map;let x=!1,D=0;const I=a(()=>{const e=t.projectRoots??{},r=new Set(t.services.map(n=>n.project));for(const n of t.routes)n.lens&&r.add(n.lens.project);const s=new Set;for(const n of r){const d=e[n];if(!d)continue;const h=path.relative(t.root,d).split(path.sep).filter(Boolean)[0];h&&!h.startsWith("..")&&s.add(h)}return[...s]},"managedBuckets"),N=a((e,r,s,n)=>{const d=t.projectSourceRoots?.[e];if(d?.length)return d;const h=t.projectRoots?.[e];if(!h)return;const f=sourceScopeDirs(t.root,h,s,r,n);return f.length>0?f:void 0},"scopeFor"),O=a(()=>{x||Date.now()-D<types_1.POD_STALE_SCAN_MS||(x=!0,D=Date.now(),(async()=>{const e=(0,scope_1.readSourceSetExclude)(t.root),r=await sourceSetSnapshot(t.root,void 0,e),s=Date.now(),n=_?diffSourceSets(_,r,s):null;if(n&&(t.sourceSetChangedAt=s,t.sourceSetChange=n,l("info","source file set changed \u2014 stale pods recycle when idle","cluster-gateway",{kind:"source-set-changed",added:n.added,removed:n.removed,truncated:n.truncated})),_=r,!t.projectRoots)return;let d;try{d=(await fs.promises.readdir(t.root,{withFileTypes:!0})).filter(p=>p.isDirectory()).map(p=>p.name)}catch{return}const h=I(),f=new Set(t.services.map(p=>p.project));for(const p of t.routes)p.lens&&f.add(p.lens.project);const k=new Map;for(const p of f){const y=N(p,d,h,e);if(!y)continue;const m=y.join("|"),C=k.get(m)??{dirs:y,projects:[]};C.projects.push(p),k.set(m,C)}const S=Date.now();for(const[p,{dirs:y,projects:m}]of k){const C=await sourceSetSnapshot(t.root,y,e),P=M.get(p);if(M.set(p,C),!P)continue;const b=diffSourceSets(P,C,S);if(b){t.sourceSetChangedFor??=new Map,t.sourceSetChangesFor??=new Map;for(const F of m)t.sourceSetChangedFor.set(F,S),t.sourceSetChangesFor.set(F,b);l("info",`source file set changed in ${m.join(", ")}'s scope`,"cluster-gateway",{kind:"source-set-changed",scoped:!0,projects:m,added:b.added,removed:b.removed,truncated:b.truncated})}}})().catch(()=>{}).finally(()=>{x=!1}))},"maybeScanSourceSet"),V=a((e,r)=>{e.lastStaleRecycleAt=Date.now(),console.log(`[gateway] zombie recycle: ${e.project} (${r}) \u2014 stale fs view; fresh pod incoming`),c(e,"warning",`zombie recycle: ${e.project} (${r})`,`cluster-service:${e.project}`,{kind:"pod-recycle",project:e.project,reason:r});const s=!!e.decl.eager;R(e,`${r} \u2014 recycling stale pod`,{announce:!1}),s&&setTimeout(()=>{!t.stopped()&&!e.proc&&e.state==="down"&&j(e)},1500).unref?.()},"recyclePod");return{scanNow:w,spawnService:j,ensureUp:$,scaleUp:A,killSpawned:R,markUp:g,startSweeper:a(()=>{const e=setInterval(()=>{if(!t.stopped()){types_1.POD_RECYCLE_ENABLED&&O();for(const r of t.services){if(t.stopped()||!r.proc){r.wedgedSince=void 0;continue}const s=r.decl.idleKillSec;if(s&&r.inflight===0&&Date.now()-r.lastUsed>s*1e3){R(r,`idle ${s}s`),r.wedgedSince=void 0;continue}const n=r.state==="starting"&&r.spawnAt!==void 0&&Date.now()-r.spawnAt<t.startupTimeoutMs,d=w(r.pool)>0;if(d||n){if(r.wedgedSince=void 0,d&&g(r,"observed"),d&&!n&&types_1.POD_RECYCLE_ENABLED){const h=t.sourceSetChangedFor?.get(r.project)??t.sourceSetChangedAt??0,f=podRecycleReason(r,Date.now(),h,T);f&&V(r,f)}continue}r.wedgedSince??=Date.now(),Date.now()-r.wedgedSince>types_1.WEDGE_RECYCLE_GRACE_MS&&(r.wedgedSince=void 0,L(r))}}},t.sweepMs);return e.unref(),e},"startSweeper")}}E(createServiceLayer,"createServiceLayer"),v(createServiceLayer,"createServiceLayer"),a(createServiceLayer,"createServiceLayer");

package/executors/gateway/runtime/observability.js

@@ -1,2 +1,2 @@
-"use strict";var v=Object.defineProperty;var f=(o,d)=>v(o,"name",{value:d,configurable:!0});var _=Object.defineProperty,s=f((o,d)=>_(o,"name",{value:d,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.LENS_DASHBOARD_PROJECT=void 0,exports.createObservability=createObservability;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path")),redact_1=require("@lensmcp/core/redact"),busHygiene=(()=>{try{return require("@lensmcp/node-instrumentation")}catch{return}})();exports.LENS_DASHBOARD_PROJECT="(lens-dashboard)";const hdr=s(o=>typeof o=="string"&&o!==""?o:Array.isArray(o)?o[0]:void 0,"hdr");function createObservability(o,d){const p=s(()=>Date.now().toString(36)+Math.random().toString(36).slice(2,12),"eid"),g=busHygiene?.createEventFloodGuard({burst:30,perSec:5}),l=s((e,t,r,a,i,u)=>{const n=u??o;try{const h=g?g.admit(r):{ok:!0,suppressed:0};if(!h.ok)return;fs.mkdirSync(path.dirname(n),{recursive:!0});const m=a&&(0,redact_1.redactDeep)(a),y=JSON.stringify({id:p(),sessionId:"pending",timestamp:Date.now(),source:"gateway",category:"cluster",severity:e,context:(0,redact_1.redactDeep)({sessionId:"pending",...i}),fingerprint:r,title:(0,redact_1.safeTitle)(t),raw:h.suppressed>0?{...m,floodSuppressed:h.suppressed}:m})+`
-`;busHygiene?.maybeRotateEventFile(n,y.length),fs.appendFileSync(n,y)}catch{}},"emit"),w=s(e=>{const t=hdr(e.headers["x-lensmcp-flow-id"]);let r=hdr(e.headers["x-request-id"]);if(!(!t&&!r&&!hdr(e.headers.traceparent)))return r||(r=p(),e.headers["x-request-id"]=r),{startedAt:Date.now(),method:(e.method??"GET").toUpperCase(),host:(e.headers.host||"").split(":")[0],url:e.url??"/",steps:[],...t?{flowId:t}:{},...r?{requestId:r}:{},...hdr(e.headers["x-lensmcp-origin-node-id"])?{originNodeId:hdr(e.headers["x-lensmcp-origin-node-id"])}:{}}},"beginTrace"),S=s((e,t,r)=>{e&&e.steps.push({step:t,atMs:Date.now()-e.startedAt,...r})},"traceStep"),b=s((e,t,r,a)=>{if(!e||e.done||(e.done=!0,t===exports.LENS_DASHBOARD_PROJECT&&r<500))return;const i=Date.now()-e.startedAt;l(r>=500?"error":"info",`gateway ${e.method} ${e.host}${e.url} \u2192 ${r} (${i}ms)`,`gateway-request:${t}`,{kind:"gateway-request",project:t,host:e.host,method:e.method,url:e.url,status:r,durationMs:i,startedAt:e.startedAt,steps:e.steps,...a},{...e.flowId?{flowId:e.flowId}:{},...e.requestId?{requestId:e.requestId}:{},...e.originNodeId?{originNodeId:e.originNodeId}:{}})},"finishTrace"),c=new Map;return{emit:l,eid:p,beginTrace:w,traceStep:S,finishTrace:b,recordEdge:s((e,t,r,a)=>{if(e.project===exports.LENS_DASHBOARD_PROJECT&&r<500&&r!==0)return;const i=e.host??"(default)",u=(a?a+"\u21D2":"")+i+"\u2192"+e.project,n=c.get(u)??{host:i,project:e.project,caller:a,count:0,totalMs:0,errors:0};n.count+=1,n.totalMs+=t,(r>=500||r===0)&&(n.errors+=1),c.set(u,n)},"recordEdge"),startEdgeFlusher:s(()=>{const e=setInterval(()=>{for(const t of c.values()){const r=Math.round(t.totalMs/t.count);l(t.errors?"warning":"info",`traffic ${t.host} \u2192 ${t.project}: ${t.count} req, ~${r}ms${t.errors?`, ${t.errors} errors`:""}`,`gateway-traffic:${t.host}->${t.project}`,{kind:"gateway-traffic",host:t.host,project:t.project,caller:t.caller,count:t.count,avgMs:r,errors:t.errors})}c.clear()},d.trafficFlushMs);return e.unref(),e},"startEdgeFlusher")}}f(createObservability,"createObservability"),s(createObservability,"createObservability");
+"use strict";var O=Object.defineProperty;var g=(o,i)=>O(o,"name",{value:i,configurable:!0});var v=Object.defineProperty,f=g((o,i)=>v(o,"name",{value:i,configurable:!0}),"f"),_=Object.defineProperty,s=f((o,i)=>_(o,"name",{value:i,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.LENS_DASHBOARD_PROJECT=void 0,exports.createObservability=createObservability;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path")),redact_1=require("@lensmcp/core/redact"),busHygiene=(()=>{try{return require("@lensmcp/node-instrumentation")}catch{return}})();exports.LENS_DASHBOARD_PROJECT="(lens-dashboard)";const hdr=s(o=>typeof o=="string"&&o!==""?o:Array.isArray(o)?o[0]:void 0,"hdr");function createObservability(o,i){const p=s(()=>Date.now().toString(36)+Math.random().toString(36).slice(2,12),"eid"),m=busHygiene?.createEventFloodGuard({burst:30,perSec:5}),l=s((e,t,r,a,d,u)=>{const n=u??o;try{const h=m?m.admit(r):{ok:!0,suppressed:0};if(!h.ok)return;fs.mkdirSync(path.dirname(n),{recursive:!0});const y=a&&(0,redact_1.redactDeep)(a),b=JSON.stringify({id:p(),sessionId:"pending",timestamp:Date.now(),source:"gateway",category:"cluster",severity:e,context:(0,redact_1.redactDeep)({sessionId:"pending",...d}),fingerprint:r,title:(0,redact_1.safeTitle)(t),raw:h.suppressed>0?{...y,floodSuppressed:h.suppressed}:y})+`
+`;busHygiene?.maybeRotateEventFile(n,b.length),fs.appendFileSync(n,b)}catch{}},"emit"),w=s(e=>{const t=hdr(e.headers["x-lensmcp-flow-id"]);let r=hdr(e.headers["x-request-id"]);if(!(!t&&!r&&!hdr(e.headers.traceparent)))return r||(r=p(),e.headers["x-request-id"]=r),{startedAt:Date.now(),method:(e.method??"GET").toUpperCase(),host:(e.headers.host||"").split(":")[0],url:e.url??"/",steps:[],...t?{flowId:t}:{},...r?{requestId:r}:{},...hdr(e.headers["x-lensmcp-origin-node-id"])?{originNodeId:hdr(e.headers["x-lensmcp-origin-node-id"])}:{}}},"beginTrace"),S=s((e,t,r)=>{e&&e.steps.push({step:t,atMs:Date.now()-e.startedAt,...r})},"traceStep"),D=s((e,t,r,a)=>{if(!e||e.done||(e.done=!0,t===exports.LENS_DASHBOARD_PROJECT&&r<500))return;const d=Date.now()-e.startedAt;l(r>=500?"error":"info",`gateway ${e.method} ${e.host}${e.url} \u2192 ${r} (${d}ms)`,`gateway-request:${t}`,{kind:"gateway-request",project:t,host:e.host,method:e.method,url:e.url,status:r,durationMs:d,startedAt:e.startedAt,steps:e.steps,...a},{...e.flowId?{flowId:e.flowId}:{},...e.requestId?{requestId:e.requestId}:{},...e.originNodeId?{originNodeId:e.originNodeId}:{}})},"finishTrace"),c=new Map;return{emit:l,eid:p,beginTrace:w,traceStep:S,finishTrace:D,recordEdge:s((e,t,r,a)=>{if(e.project===exports.LENS_DASHBOARD_PROJECT&&r<500&&r!==0)return;const d=e.host??"(default)",u=(a?a+"\u21D2":"")+d+"\u2192"+e.project,n=c.get(u)??{host:d,project:e.project,caller:a,count:0,totalMs:0,errors:0};n.count+=1,n.totalMs+=t,(r>=500||r===0)&&(n.errors+=1),c.set(u,n)},"recordEdge"),startEdgeFlusher:s(()=>{const e=setInterval(()=>{for(const t of c.values()){const r=Math.round(t.totalMs/t.count);l(t.errors?"warning":"info",`traffic ${t.host} \u2192 ${t.project}: ${t.count} req, ~${r}ms${t.errors?`, ${t.errors} errors`:""}`,`gateway-traffic:${t.host}->${t.project}`,{kind:"gateway-traffic",host:t.host,project:t.project,caller:t.caller,count:t.count,avgMs:r,errors:t.errors})}c.clear()},i.trafficFlushMs);return e.unref(),e},"startEdgeFlusher")}}g(createObservability,"createObservability"),f(createObservability,"createObservability"),s(createObservability,"createObservability");

package/executors/gateway/runtime/pod-env.js

@@ -1,2 +1,2 @@
-"use strict";var p=Object.defineProperty;var a=(o,e)=>p(o,"name",{value:e,configurable:!0});var c=Object.defineProperty,s=a((o,e)=>c(o,"name",{value:e,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.FOREIGN_POD_ENV_DENYLIST=exports.WORKSPACE_DOTENV_FILES=void 0,exports.parseDotenvKeys=parseDotenvKeys,exports.workspaceDotenvKeys=workspaceDotenvKeys,exports.scrubEnv=scrubEnv,exports.podBaseEnv=podBaseEnv;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path"));exports.WORKSPACE_DOTENV_FILES=[".env",".env.local",".local.env"],exports.FOREIGN_POD_ENV_DENYLIST=["PG_URL","REDIS_URL","DATABASE_URL","POSTGRES_URL"];function parseDotenvKeys(o){const e=new Set;for(const r of o.split(`
-`)){const t=r.trim();if(!t||t.startsWith("#"))continue;const n=t.match(/^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/);n&&e.add(n[1])}return e}a(parseDotenvKeys,"parseDotenvKeys"),s(parseDotenvKeys,"parseDotenvKeys");function workspaceDotenvKeys(o){const e=new Set;for(const r of exports.WORKSPACE_DOTENV_FILES){let t;try{t=fs.readFileSync(path.join(o,r),"utf8")}catch{continue}for(const n of parseDotenvKeys(t))e.add(n)}return e}a(workspaceDotenvKeys,"workspaceDotenvKeys"),s(workspaceDotenvKeys,"workspaceDotenvKeys");function scrubEnv(o,e){const r={};for(const[t,n]of Object.entries(o))e.has(t)||exports.FOREIGN_POD_ENV_DENYLIST.includes(t)||(r[t]=n);return r}a(scrubEnv,"scrubEnv"),s(scrubEnv,"scrubEnv");function podBaseEnv(o,e,r){return path.resolve(r)===path.resolve(e)?o:scrubEnv(o,workspaceDotenvKeys(e))}a(podBaseEnv,"podBaseEnv"),s(podBaseEnv,"podBaseEnv");
+"use strict";var i=Object.defineProperty;var E=(t,e)=>i(t,"name",{value:e,configurable:!0});var p=Object.defineProperty,a=E((t,e)=>p(t,"name",{value:e,configurable:!0}),"a"),c=Object.defineProperty,s=a((t,e)=>c(t,"name",{value:e,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.FOREIGN_POD_ENV_DENYLIST=exports.WORKSPACE_DOTENV_FILES=void 0,exports.parseDotenvKeys=parseDotenvKeys,exports.workspaceDotenvKeys=workspaceDotenvKeys,exports.scrubEnv=scrubEnv,exports.podBaseEnv=podBaseEnv;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path"));exports.WORKSPACE_DOTENV_FILES=[".env",".env.local",".local.env"],exports.FOREIGN_POD_ENV_DENYLIST=["PG_URL","REDIS_URL","DATABASE_URL","POSTGRES_URL"];function parseDotenvKeys(t){const e=new Set;for(const o of t.split(`
+`)){const r=o.trim();if(!r||r.startsWith("#"))continue;const n=r.match(/^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/);n&&e.add(n[1])}return e}E(parseDotenvKeys,"parseDotenvKeys"),a(parseDotenvKeys,"parseDotenvKeys"),s(parseDotenvKeys,"parseDotenvKeys");function workspaceDotenvKeys(t){const e=new Set;for(const o of exports.WORKSPACE_DOTENV_FILES){let r;try{r=fs.readFileSync(path.join(t,o),"utf8")}catch{continue}for(const n of parseDotenvKeys(r))e.add(n)}return e}E(workspaceDotenvKeys,"workspaceDotenvKeys"),a(workspaceDotenvKeys,"workspaceDotenvKeys"),s(workspaceDotenvKeys,"workspaceDotenvKeys");function scrubEnv(t,e){const o={};for(const[r,n]of Object.entries(t))e.has(r)||exports.FOREIGN_POD_ENV_DENYLIST.includes(r)||(o[r]=n);return o}E(scrubEnv,"scrubEnv"),a(scrubEnv,"scrubEnv"),s(scrubEnv,"scrubEnv");function podBaseEnv(t,e,o){return path.resolve(o)===path.resolve(e)?t:scrubEnv(t,workspaceDotenvKeys(e))}E(podBaseEnv,"podBaseEnv"),a(podBaseEnv,"podBaseEnv"),s(podBaseEnv,"podBaseEnv");

package/executors/gateway/runtime/proxy.js

@@ -1 +1 @@
-"use strict";var q=Object.defineProperty;var b=(E,u)=>q(E,"name",{value:u,configurable:!0});var C=Object.defineProperty,s=b((E,u)=>C(E,"name",{value:u,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createProxy=createProxy;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),http=tslib_1.__importStar(require("node:http")),path=tslib_1.__importStar(require("node:path")),discovery_1=require("./discovery"),edge_1=require("./edge"),types_1=require("./types");function isConnError(E){const u=E.code??"";return u==="ECONNREFUSED"||u==="ECONNRESET"||u==="ETIMEDOUT"||u==="EPIPE"||u==="EHOSTUNREACH"||u==="ENOENT"||/ECONNREFUSED|ECONNRESET|socket hang up|EPIPE/i.test(E.message)}b(isConnError,"isConnError"),s(isConnError,"isConnError");const HOP_BY_HOP=new Set(["connection","keep-alive","proxy-connection","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade"]),httpProxy=require("http-proxy");function createProxy(E,u,S){const{recordEdge:D,finishTrace:N,traceStep:T}=u,k={keepAlive:!0,keepAliveMsecs:3e4,maxSockets:1024,maxFreeSockets:256},w=new http.Agent(k),$=new(require("node:https")).Agent(k),x=s(r=>typeof r=="string"&&r.startsWith("https:")?$:w,"agentForTarget"),P=httpProxy.createProxyServer({xfwd:!0,secure:!1,proxyTimeout:12e4,agent:w}),O=s((r,o,e)=>{const i=s(()=>{e()||r.destroyed||r.destroy()},"onEdgeClose");o.once("close",i),r.once("close",()=>o.removeListener("close",i))},"propagateEdgeCancel");P.on("proxyReq",(r,o,e)=>{O(r,e,()=>e.writableEnded)}),P.on("proxyRes",(r,o,e)=>{const i=o.__lensmcpPod;i&&(r.headers["x-lensmcp-pod"]=i),delete r.headers["x-powered-by"],r.headers.server="LensMCP",e&&O(r,e,()=>e.writableEnded)});const M=s((r,o,e,i)=>{const d={};for(const[t,p]of Object.entries(o.headers))p===void 0||t.startsWith(":")||HOP_BY_HOP.has(t)||(d[t]=p);const m=o.socket?.remoteAddress??"",f=o.headers["x-forwarded-for"];d["x-forwarded-for"]=f?`${String(f)}, ${m}`:m,d["x-forwarded-proto"]="https",d["x-forwarded-host"]||(d["x-forwarded-host"]=o.headers.host??"");let a=http,l;if(typeof r=="object")l={socketPath:r.socketPath,path:o.url,method:o.method,headers:d,agent:w};else{const t=new URL(r),p=t.protocol==="https:";a=p?require("node:https"):http,d.host=t.host,l={protocol:t.protocol,hostname:t.hostname,port:t.port||(p?443:80),path:o.url,method:o.method,headers:d,agent:x(r)}}const n=e;n.__lensmcpErrContained||(n.__lensmcpErrContained=!0,e.on("error",()=>{}));let c;const y=s(()=>{g.destroy()},"onReqError"),h=s(()=>{c&&!c.destroyed&&c.destroy()},"onEdgeClose"),_=s(()=>{o.removeListener("error",y),e.removeListener("close",h)},"detach"),g=a.request(l,t=>{if(c=t,i.onResponse(),e.headersSent||e.writableEnded||e.destroyed){t.destroy();return}const p={};for(const[v,R]of Object.entries(t.headers))R===void 0||HOP_BY_HOP.has(v)||(p[v]=R);delete p["x-powered-by"],p.server="LensMCP";const U=o.__lensmcpPod;U&&(p["x-lensmcp-pod"]=U);try{e.writeHead(t.statusCode??502,p)}catch(v){console.error("[gateway] h2 relay: bad response header, resetting stream:",v.message),t.destroy(),e.destroyed||e.destroy(v);return}t.pipe(e);const j=s(()=>{!e.writableEnded&&!e.destroyed&&e.destroy()},"abortEdge");t.once("error",j),t.once("close",j),e.on("close",h)});g.once("error",t=>i.onError(t)),g.once("close",_),o.on("error",y),o.method==="GET"||o.method==="HEAD"||o.method==="OPTIONS"?g.end():o.pipe(g)},"pipeUpstream"),A=s(async(r,o,e)=>{const i=o.__lensmcpTrace;if(r.pool){const a=r.svc;a&&(a.lastUsed=Date.now(),a.inflight+=1,e.on("close",()=>{a.inflight-=1,a.lastUsed=Date.now()}));let l=(0,discovery_1.pickSock)(r.pool,E.scanTtlMs);if(!l&&a&&(T(i,"cold-start",{project:r.project}),await S.ensureUp(a)&&(l=(0,discovery_1.pickSock)(r.pool,E.scanTtlMs))),a&&l&&S.markUp(a,"observed"),a&&S.scaleUp(a),!l){const _=a?.lastErrors?.length?` Service errors: ${a.lastErrors.join("; ")}`:"";(0,edge_1.sendError)(e,o,503,"unavailable",`Service ${r.project} is not reachable (no pods in ${r.pool.dir}).${_} The watcher recovers and the next request retries automatically.`);return}const n=path.basename(l,".sock");o.__lensmcpPod=n,T(i,"pod-select",{pod:n,pods:r.pool.socks.length,strategy:"round-robin"});let c=!1;const y=s(_=>{r.pool.socks=r.pool.socks.filter(g=>g!==l),r.pool.idx=-1;try{fs.unlinkSync(l)}catch{}console.error(`[gateway] pod ${n} of ${r.project}: ${_}`)},"evictPod"),h=setTimeout(()=>{c||e.headersSent||e.writableEnded||(c=!0,y(`no response within ${types_1.POD_RESPONSE_TIMEOUT_MS}ms (wedged socket) \u2014 evicted + respawning`),(0,edge_1.sendError)(e,o,502,"unavailable",`Pod ${n} of ${r.project} was unresponsive \u2014 evicted, retry.`))},types_1.POD_RESPONSE_TIMEOUT_MS);h.unref?.(),e.on("close",()=>clearTimeout(h)),M({socketPath:l},o,e,{onResponse:s(()=>{clearTimeout(h),c=!0},"onResponse"),onError:s(_=>{clearTimeout(h),!c&&(c=!0,y(_.message),(0,edge_1.sendError)(e,o,502,"unavailable",`Pod ${n} of ${r.project} unavailable \u2014 retry.`))},"onError")});return}const d=r.target,m=Date.now()+types_1.UPSTREAM_HEAL_WINDOW_MS,f=s(()=>{M(d,o,e,{onResponse:s(()=>{},"onResponse"),onError:s(a=>{if(isConnError(a)&&Date.now()<m&&!e.headersSent&&!e.writableEnded&&!e.destroyed){setTimeout(f,types_1.UPSTREAM_HEAL_STEP_MS).unref?.();return}if(e.headersSent||e.writableEnded||e.destroyed){e.destroyed||e.destroy();return}console.error(`[gateway] upstream ${r.project} (${String(d)}):`,a.message),(0,edge_1.sendError)(e,o,502,"unavailable",`Upstream ${r.project} unavailable.`)},"onError")})},"tryTcp");f()},"forwardNative");return{proxy:P,forward:s(async(r,o,e)=>{const i=Date.now(),d=o.__lensmcpTrace;if(e.on("close",()=>{D(r,Date.now()-i,e.statusCode??0,o.__lensmcpCaller),N(d,r.project,e.statusCode??0,{...o.__lensmcpPod?{pod:o.__lensmcpPod}:{},...o.__lensmcpCaller?{caller:o.__lensmcpCaller}:{}})}),r.prependPrefix&&!o.url?.startsWith(r.prependPrefix)&&(o.url=r.prependPrefix+(o.url??"/")),(o.httpVersionMajor??1)>=2){await A(r,o,e);return}if(r.pool){const n=r.svc;n&&(n.lastUsed=Date.now(),n.inflight+=1,e.on("close",()=>{n.inflight-=1,n.lastUsed=Date.now()}));let c=(0,discovery_1.pickSock)(r.pool,E.scanTtlMs);if(!c&&n&&(T(d,"cold-start",{project:r.project}),await S.ensureUp(n)&&(c=(0,discovery_1.pickSock)(r.pool,E.scanTtlMs))),n&&c&&S.markUp(n,"observed"),n&&S.scaleUp(n),!c){const t=n?.lastErrors?.length?` Service errors: ${n.lastErrors.join("; ")}`:"";(0,edge_1.sendError)(e,o,503,"unavailable",`Service ${r.project} is not reachable (no pods in ${r.pool.dir}).${t} The watcher recovers and the next request retries automatically.`);return}const y=path.basename(c,".sock");o.__lensmcpPod=y,T(d,"pod-select",{pod:y,pods:r.pool.socks.length,strategy:"round-robin"});let h=!1;const _=s(t=>{r.pool.socks=r.pool.socks.filter(p=>p!==c),r.pool.idx=-1;try{fs.unlinkSync(c)}catch{}console.error(`[gateway] pod ${y} of ${r.project}: ${t}`)},"evictPod"),g=setTimeout(()=>{h||e.headersSent||e.writableEnded||(h=!0,_(`no response within ${types_1.POD_RESPONSE_TIMEOUT_MS}ms (wedged socket) \u2014 evicted + respawning`),(0,edge_1.sendError)(e,o,502,"unavailable",`Pod ${y} of ${r.project} was unresponsive \u2014 evicted, retry.`))},types_1.POD_RESPONSE_TIMEOUT_MS);g.unref?.(),e.on("close",()=>clearTimeout(g)),P.web(o,e,{target:{socketPath:c},agent:w},t=>{clearTimeout(g),!h&&(h=!0,_(t.message),(0,edge_1.sendError)(e,o,502,"unavailable",`Pod ${y} of ${r.project} unavailable \u2014 retry.`))});return}const m=r.target,f={target:m,autoRewrite:typeof m=="string",changeOrigin:!0,agent:x(m)},a=Date.now()+types_1.UPSTREAM_HEAL_WINDOW_MS,l=s(()=>{P.web(o,e,f,n=>{if(isConnError(n)&&Date.now()<a&&!e.headersSent&&!e.writableEnded&&!e.destroyed){setTimeout(l,types_1.UPSTREAM_HEAL_STEP_MS).unref?.();return}e.destroyed||(console.error(`[gateway] upstream ${r.project} (${String(m)}):`,n.message),(0,edge_1.sendError)(e,o,502,"unavailable",`Upstream ${r.project} unavailable.`))})},"tryTcp");l()},"forward"),agentForTarget:x,destroyAgents:s(()=>{w.destroy(),$.destroy()},"destroyAgents"),closeProxy:s(()=>{try{P.close?.()}catch{}},"closeProxy")}}b(createProxy,"createProxy"),s(createProxy,"createProxy");
+"use strict";var F=Object.defineProperty;var $=(u,E)=>F(u,"name",{value:E,configurable:!0});var L=Object.defineProperty,x=$((u,E)=>L(u,"name",{value:E,configurable:!0}),"x"),H=Object.defineProperty,c=x((u,E)=>H(u,"name",{value:E,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createProxy=createProxy;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),http=tslib_1.__importStar(require("node:http")),path=tslib_1.__importStar(require("node:path")),discovery_1=require("./discovery"),edge_1=require("./edge"),gateway_errors_1=require("../gateway-errors"),types_1=require("./types");function isConnError(u){const E=u.code??"";return E==="ECONNREFUSED"||E==="ECONNRESET"||E==="ETIMEDOUT"||E==="EPIPE"||E==="EHOSTUNREACH"||E==="ENOENT"||/ECONNREFUSED|ECONNRESET|socket hang up|EPIPE/i.test(u.message)}$(isConnError,"isConnError"),x(isConnError,"isConnError"),c(isConnError,"isConnError");const HOP_BY_HOP=new Set(["connection","keep-alive","proxy-connection","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade"]),httpProxy=require("http-proxy");function createProxy(u,E,S){const{recordEdge:N,finishTrace:q,traceStep:T,emit:I}=E,M=c(async r=>{if(!r.lens||!u.lensSupervisor)return"unsupported";let o;const e=new Promise(l=>{o=setTimeout(()=>l("timeout"),types_1.LENS_REQUEST_RECOVERY_WAIT_MS),o.unref?.()}),p=u.lensSupervisor.recover(r.lens,"proxy-connection").then(l=>l?"ready":"failed").catch(()=>"failed"),i=await Promise.race([p,e]);o&&clearTimeout(o);const m=u.lensSupervisor.status(r.lens);return i==="failed"&&(!m||m.state==="ready")?"unsupported":i},"waitForManagedRecovery"),b=c((r,o,e,p,i,m)=>{if(e.headersSent||e.writableEnded||e.destroyed){e.destroyed||e.destroy();return}const l=r.lens?u.lensSupervisor?.status(r.lens):void 0,h=m==="timeout"||l?.state==="starting"||l?.state==="replacing",s=(0,gateway_errors_1.ensureRequestId)(o),t=r.lens?{project:r.project,reason:l?.reason??"connection-failure",generation:l?.generation??0,...h?{retryAfterMs:2e3}:{}}:void 0,a=h?503:502,d=h?"starting":"unavailable";console.error(`[gateway] ${new Date().toISOString()} upstream-error traceId=${s} project=${r.project} target=${String(p)} state=${l?.state??"unmanaged"} generation=${l?.generation??0}: ${i.message}`),I("warning",`upstream unavailable: ${r.project}`,`cluster-upstream:${r.project}`,{kind:"upstream-error",traceId:s,project:r.project,target:String(p),state:l?.state??"unmanaged",generation:l?.generation,error:i.message}),(0,edge_1.sendError)(e,o,a,d,h?`Upstream ${r.project} is restarting.`:`Upstream ${r.project} unavailable.`,t,h?{"retry-after":"2"}:void 0)},"sendTerminalUpstreamError"),O={keepAlive:!0,keepAliveMsecs:3e4,maxSockets:1024,maxFreeSockets:256},v=new http.Agent(O),j=new(require("node:https")).Agent(O),k=c(r=>typeof r=="string"&&r.startsWith("https:")?j:v,"agentForTarget"),w=httpProxy.createProxyServer({xfwd:!0,secure:!1,proxyTimeout:12e4,agent:v}),R=c((r,o,e)=>{const p=c(()=>{e()||r.destroyed||r.destroy()},"onEdgeClose");o.once("close",p),r.once("close",()=>o.removeListener("close",p))},"propagateEdgeCancel");w.on("proxyReq",(r,o,e)=>{R(r,e,()=>e.writableEnded)}),w.on("proxyRes",(r,o,e)=>{const p=o.__lensmcpPod;p&&(r.headers["x-lensmcp-pod"]=p),delete r.headers["x-powered-by"],r.headers.server="LensMCP",e&&R(r,e,()=>e.writableEnded)});const U=c((r,o,e,p)=>{const i={};for(const[n,_]of Object.entries(o.headers))_===void 0||n.startsWith(":")||HOP_BY_HOP.has(n)||(i[n]=_);const m=o.socket?.remoteAddress??"",l=o.headers["x-forwarded-for"];i["x-forwarded-for"]=l?`${String(l)}, ${m}`:m,i["x-forwarded-proto"]="https",i["x-forwarded-host"]||(i["x-forwarded-host"]=o.headers.host??"");let h=http,s;if(typeof r=="object")s={socketPath:r.socketPath,path:o.url,method:o.method,headers:i,agent:v};else{const n=new URL(r),_=n.protocol==="https:";h=_?require("node:https"):http,i.host=n.host,s={protocol:n.protocol,hostname:n.hostname,port:n.port||(_?443:80),path:o.url,method:o.method,headers:i,agent:k(r)}}const t=e;t.__lensmcpErrContained||(t.__lensmcpErrContained=!0,e.on("error",()=>{}));let a;const d=c(()=>{y.destroy()},"onReqError"),g=c(()=>{a&&!a.destroyed&&a.destroy()},"onEdgeClose"),f=c(()=>{o.removeListener("error",d),e.removeListener("close",g)},"detach"),y=h.request(s,n=>{if(a=n,p.onResponse(),e.headersSent||e.writableEnded||e.destroyed){n.destroy();return}const _={};for(const[P,C]of Object.entries(n.headers))C===void 0||HOP_BY_HOP.has(P)||(_[P]=C);delete _["x-powered-by"],_.server="LensMCP";const A=o.__lensmcpPod;A&&(_["x-lensmcp-pod"]=A);try{e.writeHead(n.statusCode??502,_)}catch(P){console.error("[gateway] h2 relay: bad response header, resetting stream:",P.message),n.destroy(),e.destroyed||e.destroy(P);return}n.pipe(e);const D=c(()=>{!e.writableEnded&&!e.destroyed&&e.destroy()},"abortEdge");n.once("error",D),n.once("close",D),e.on("close",g)});y.once("error",n=>p.onError(n)),y.once("close",f),o.on("error",d),o.method==="GET"||o.method==="HEAD"||o.method==="OPTIONS"?y.end():o.pipe(y)},"pipeUpstream"),W=c(async(r,o,e)=>{const p=o.__lensmcpTrace;if(r.pool){const s=r.svc;s&&(s.lastUsed=Date.now(),s.inflight+=1,e.on("close",()=>{s.inflight-=1,s.lastUsed=Date.now()}));let t=(0,discovery_1.pickSock)(r.pool,u.scanTtlMs);if(!t&&s&&(T(p,"cold-start",{project:r.project}),await S.ensureUp(s)&&(t=(0,discovery_1.pickSock)(r.pool,u.scanTtlMs))),s&&t&&S.markUp(s,"observed"),s&&S.scaleUp(s),!t){const y=s?.lastErrors?.length?` Service errors: ${s.lastErrors.join("; ")}`:"";(0,edge_1.sendError)(e,o,503,"unavailable",`Service ${r.project} is not reachable (no pods in ${r.pool.dir}).${y} The watcher recovers and the next request retries automatically.`);return}const a=path.basename(t,".sock");o.__lensmcpPod=a,T(p,"pod-select",{pod:a,pods:r.pool.socks.length,strategy:"round-robin"});let d=!1;const g=c(y=>{r.pool.socks=r.pool.socks.filter(n=>n!==t),r.pool.idx=-1;try{fs.unlinkSync(t)}catch{}console.error(`[gateway] pod ${a} of ${r.project}: ${y}`)},"evictPod"),f=setTimeout(()=>{d||e.headersSent||e.writableEnded||(d=!0,g(`no response within ${types_1.POD_RESPONSE_TIMEOUT_MS}ms (wedged socket) \u2014 evicted + respawning`),(0,edge_1.sendError)(e,o,502,"unavailable",`Pod ${a} of ${r.project} was unresponsive \u2014 evicted, retry.`))},types_1.POD_RESPONSE_TIMEOUT_MS);f.unref?.(),e.on("close",()=>clearTimeout(f)),U({socketPath:t},o,e,{onResponse:c(()=>{clearTimeout(f),d=!0},"onResponse"),onError:c(y=>{clearTimeout(f),!d&&(d=!0,g(y.message),(0,edge_1.sendError)(e,o,502,"unavailable",`Pod ${a} of ${r.project} unavailable \u2014 retry.`))},"onError")});return}const i=Date.now()+types_1.UPSTREAM_HEAL_WINDOW_MS;let m=0,l=!1;const h=c(()=>{const s=r.target;U(s,o,e,{onResponse:c(()=>{},"onResponse"),onError:c(t=>{if(isConnError(t)&&(m+=1),r.lens&&isConnError(t)&&m>=2&&!l&&!e.headersSent&&!e.writableEnded&&!e.destroyed){l=!0,M(r).then(a=>{if(!(e.headersSent||e.writableEnded||e.destroyed)){if(a==="ready"){h();return}if(a==="unsupported"&&Date.now()<i){setTimeout(h,types_1.UPSTREAM_HEAL_STEP_MS).unref?.();return}b(r,o,e,r.target,t,a)}});return}if(isConnError(t)&&Date.now()<i&&!e.headersSent&&!e.writableEnded&&!e.destroyed){setTimeout(h,types_1.UPSTREAM_HEAL_STEP_MS).unref?.();return}if(e.headersSent||e.writableEnded||e.destroyed){e.destroyed||e.destroy();return}b(r,o,e,s,t)},"onError")})},"tryTcp");h()},"forwardNative");return{proxy:w,forward:c(async(r,o,e)=>{const p=Date.now(),i=o.__lensmcpTrace;if(e.on("close",()=>{N(r,Date.now()-p,e.statusCode??0,o.__lensmcpCaller),q(i,r.project,e.statusCode??0,{...o.__lensmcpPod?{pod:o.__lensmcpPod}:{},...o.__lensmcpCaller?{caller:o.__lensmcpCaller}:{}})}),r.prependPrefix&&!o.url?.startsWith(r.prependPrefix)&&(o.url=r.prependPrefix+(o.url??"/")),(o.httpVersionMajor??1)>=2){await W(r,o,e);return}if(r.pool){const t=r.svc;t&&(t.lastUsed=Date.now(),t.inflight+=1,e.on("close",()=>{t.inflight-=1,t.lastUsed=Date.now()}));let a=(0,discovery_1.pickSock)(r.pool,u.scanTtlMs);if(!a&&t&&(T(i,"cold-start",{project:r.project}),await S.ensureUp(t)&&(a=(0,discovery_1.pickSock)(r.pool,u.scanTtlMs))),t&&a&&S.markUp(t,"observed"),t&&S.scaleUp(t),!a){const n=t?.lastErrors?.length?` Service errors: ${t.lastErrors.join("; ")}`:"";(0,edge_1.sendError)(e,o,503,"unavailable",`Service ${r.project} is not reachable (no pods in ${r.pool.dir}).${n} The watcher recovers and the next request retries automatically.`);return}const d=path.basename(a,".sock");o.__lensmcpPod=d,T(i,"pod-select",{pod:d,pods:r.pool.socks.length,strategy:"round-robin"});let g=!1;const f=c(n=>{r.pool.socks=r.pool.socks.filter(_=>_!==a),r.pool.idx=-1;try{fs.unlinkSync(a)}catch{}console.error(`[gateway] pod ${d} of ${r.project}: ${n}`)},"evictPod"),y=setTimeout(()=>{g||e.headersSent||e.writableEnded||(g=!0,f(`no response within ${types_1.POD_RESPONSE_TIMEOUT_MS}ms (wedged socket) \u2014 evicted + respawning`),(0,edge_1.sendError)(e,o,502,"unavailable",`Pod ${d} of ${r.project} was unresponsive \u2014 evicted, retry.`))},types_1.POD_RESPONSE_TIMEOUT_MS);y.unref?.(),e.on("close",()=>clearTimeout(y)),w.web(o,e,{target:{socketPath:a},agent:v},n=>{clearTimeout(y),!g&&(g=!0,f(n.message),(0,edge_1.sendError)(e,o,502,"unavailable",`Pod ${d} of ${r.project} unavailable \u2014 retry.`))});return}const m=Date.now()+types_1.UPSTREAM_HEAL_WINDOW_MS;let l=0,h=!1;const s=c(()=>{const t=r.target,a={target:t,autoRewrite:typeof t=="string",changeOrigin:!0,agent:k(t)};w.web(o,e,a,d=>{if(isConnError(d)&&(l+=1),r.lens&&isConnError(d)&&l>=2&&!h&&!e.headersSent&&!e.writableEnded&&!e.destroyed){h=!0,M(r).then(g=>{if(!(e.headersSent||e.writableEnded||e.destroyed)){if(g==="ready"){s();return}if(g==="unsupported"&&Date.now()<m){setTimeout(s,types_1.UPSTREAM_HEAL_STEP_MS).unref?.();return}b(r,o,e,r.target,d,g)}});return}if(isConnError(d)&&Date.now()<m&&!e.headersSent&&!e.writableEnded&&!e.destroyed){setTimeout(s,types_1.UPSTREAM_HEAL_STEP_MS).unref?.();return}e.destroyed||b(r,o,e,t,d)})},"tryTcp");s()},"forward"),agentForTarget:k,destroyAgents:c(()=>{v.destroy(),j.destroy()},"destroyAgents"),closeProxy:c(()=>{try{w.close?.()}catch{}},"closeProxy")}}$(createProxy,"createProxy"),x(createProxy,"createProxy"),c(createProxy,"createProxy");

package/executors/gateway/runtime/route-registry.js

@@ -1 +1 @@
-"use strict";var u=Object.defineProperty;var n=(t,e)=>u(t,"name",{value:e,configurable:!0});var i=Object.defineProperty,r=n((t,e)=>i(t,"name",{value:e,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.RouteRegistry=void 0,exports.rebuildRoutesInPlace=rebuildRoutesInPlace;const manifest_1=require("../manifest");class RouteRegistry{static{n(this,"RouteRegistry")}static{r(this,"RouteRegistry")}constructor(){this.fragments=new Map}register(e){this.fragments.set(e.wsKey,e)}unregister(e){const s=this.fragments.get(e);return this.fragments.delete(e),s}has(e){return this.fragments.has(e)}get(e){return this.fragments.get(e)}keys(){return[...this.fragments.keys()]}size(){return this.fragments.size}appendRoutes(e,s){const a=this.fragments.get(e);a&&a.routes.push(...s)}allServices(){return[...this.fragments.values()].flatMap(e=>e.services)}merged(){const e=[...this.fragments.values()].flatMap(s=>s.routes);return(0,manifest_1.sortBySpecificity)(e),e}}exports.RouteRegistry=RouteRegistry;function rebuildRoutesInPlace(t,e){const s=e.merged();t.length=0,t.push(...s)}n(rebuildRoutesInPlace,"rebuildRoutesInPlace"),r(rebuildRoutesInPlace,"rebuildRoutesInPlace");
+"use strict";var g=Object.defineProperty;var a=(t,e)=>g(t,"name",{value:e,configurable:!0});var u=Object.defineProperty,n=a((t,e)=>u(t,"name",{value:e,configurable:!0}),"n"),i=Object.defineProperty,r=n((t,e)=>i(t,"name",{value:e,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.RouteRegistry=void 0,exports.rebuildRoutesInPlace=rebuildRoutesInPlace;const manifest_1=require("../manifest");class RouteRegistry{static{a(this,"RouteRegistry")}static{n(this,"RouteRegistry")}static{r(this,"RouteRegistry")}constructor(){this.fragments=new Map}register(e){this.fragments.set(e.wsKey,e)}unregister(e){const s=this.fragments.get(e);return this.fragments.delete(e),s}has(e){return this.fragments.has(e)}get(e){return this.fragments.get(e)}keys(){return[...this.fragments.keys()]}size(){return this.fragments.size}appendRoutes(e,s){const o=this.fragments.get(e);o&&o.routes.push(...s)}allServices(){return[...this.fragments.values()].flatMap(e=>e.services)}merged(){const e=[...this.fragments.values()].flatMap(s=>s.routes);return(0,manifest_1.sortBySpecificity)(e),e}}exports.RouteRegistry=RouteRegistry;function rebuildRoutesInPlace(t,e){const s=e.merged();t.length=0,t.push(...s)}a(rebuildRoutesInPlace,"rebuildRoutesInPlace"),n(rebuildRoutesInPlace,"rebuildRoutesInPlace"),r(rebuildRoutesInPlace,"rebuildRoutesInPlace");

package/executors/gateway/runtime/scope.js

@@ -1 +1 @@
-"use strict";var p=Object.defineProperty;var n=(t,r)=>p(t,"name",{value:r,configurable:!0});var c=Object.defineProperty,s=n((t,r)=>c(t,"name",{value:r,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.baseDomainOf=baseDomainOf,exports.readLensScope=readLensScope,exports.deriveMcpHttpPort=deriveMcpHttpPort,exports.readSourceSetExclude=readSourceSetExclude,exports.lensKeyFrom=lensKeyFrom,exports.lensSlug=lensSlug;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path"));function baseDomainOf(t){const r=t.filter(o=>!!o&&!o.startsWith("*."));if(r.length===0)return"local";const e=r.reduce((o,i)=>i.length<o.length?i:o);if(r.every(o=>o===e||o.endsWith("."+e)))return e;const a=e.split(".");return a.slice(-Math.min(a.length,3)).join(".")}n(baseDomainOf,"baseDomainOf"),s(baseDomainOf,"baseDomainOf");const BASE_PORTS={dashboard:4321,mcpHttp:4500};function hashToRange(t,r){let e=2166136261;for(let a=0;a<t.length;a++)e^=t.charCodeAt(a),e=Math.imul(e,16777619);return Math.abs(e|0)%r}n(hashToRange,"hashToRange"),s(hashToRange,"hashToRange");function readLensScope(t){try{const e=JSON.parse(fs.readFileSync(path.join(t,".lensmcp","config.json"),"utf8"));if(e&&typeof e.key=="string")return{key:e.key,dashboardPort:e.ports?.dashboard??BASE_PORTS.dashboard,mcpHttpPort:e.ports?.mcpHttp??deriveMcpHttpPort(e.key),basePath:e.dashboardBasePath??"/"+e.key}}catch{}const r=lensKeyFrom(t);return{key:r,dashboardPort:BASE_PORTS.dashboard,mcpHttpPort:deriveMcpHttpPort(r),basePath:"/"+r}}n(readLensScope,"readLensScope"),s(readLensScope,"readLensScope");function deriveMcpHttpPort(t){return BASE_PORTS.mcpHttp+hashToRange(t,200)}n(deriveMcpHttpPort,"deriveMcpHttpPort"),s(deriveMcpHttpPort,"deriveMcpHttpPort");function readSourceSetExclude(t){try{const r=JSON.parse(fs.readFileSync(path.join(t,".lensmcp","config.json"),"utf8"))?.sourceSet?.exclude;if(Array.isArray(r))return new Set(r.filter(e=>typeof e=="string"&&e.length>0&&!e.includes("/")))}catch{}return new Set}n(readSourceSetExclude,"readSourceSetExclude"),s(readSourceSetExclude,"readSourceSetExclude");function lensKeyFrom(t){try{const r=JSON.parse(fs.readFileSync(path.join(t,"package.json"),"utf8"));if(r?.name)return lensSlug(r.name)}catch{}return lensSlug(path.basename(t))}n(lensKeyFrom,"lensKeyFrom"),s(lensKeyFrom,"lensKeyFrom");function lensSlug(t){return t.toLowerCase().replace(/^@[^/]+\//,"").replace(/[^a-z0-9]+/g,"-").replace(/(^-|-$)/g,"")||"workspace"}n(lensSlug,"lensSlug"),s(lensSlug,"lensSlug");
+"use strict";var u=Object.defineProperty;var a=(e,t)=>u(e,"name",{value:t,configurable:!0});var p=Object.defineProperty,n=a((e,t)=>p(e,"name",{value:t,configurable:!0}),"n"),c=Object.defineProperty,s=n((e,t)=>c(e,"name",{value:t,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.baseDomainOf=baseDomainOf,exports.readLensScope=readLensScope,exports.deriveMcpHttpPort=deriveMcpHttpPort,exports.readSourceSetExclude=readSourceSetExclude,exports.lensKeyFrom=lensKeyFrom,exports.lensSlug=lensSlug;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path"));function baseDomainOf(e){const t=e.filter(o=>!!o&&!o.startsWith("*."));if(t.length===0)return"local";const r=t.reduce((o,l)=>l.length<o.length?l:o);if(t.every(o=>o===r||o.endsWith("."+r)))return r;const i=r.split(".");return i.slice(-Math.min(i.length,3)).join(".")}a(baseDomainOf,"baseDomainOf"),n(baseDomainOf,"baseDomainOf"),s(baseDomainOf,"baseDomainOf");const BASE_PORTS={dashboard:4321,mcpHttp:4500};function hashToRange(e,t){let r=2166136261;for(let i=0;i<e.length;i++)r^=e.charCodeAt(i),r=Math.imul(r,16777619);return Math.abs(r|0)%t}a(hashToRange,"hashToRange"),n(hashToRange,"hashToRange"),s(hashToRange,"hashToRange");function readLensScope(e){try{const r=JSON.parse(fs.readFileSync(path.join(e,".lensmcp","config.json"),"utf8"));if(r&&typeof r.key=="string")return{key:r.key,dashboardPort:r.ports?.dashboard??BASE_PORTS.dashboard,mcpHttpPort:r.ports?.mcpHttp??deriveMcpHttpPort(r.key),basePath:r.dashboardBasePath??"/"+r.key}}catch{}const t=lensKeyFrom(e);return{key:t,dashboardPort:BASE_PORTS.dashboard,mcpHttpPort:deriveMcpHttpPort(t),basePath:"/"+t}}a(readLensScope,"readLensScope"),n(readLensScope,"readLensScope"),s(readLensScope,"readLensScope");function deriveMcpHttpPort(e){return BASE_PORTS.mcpHttp+hashToRange(e,200)}a(deriveMcpHttpPort,"deriveMcpHttpPort"),n(deriveMcpHttpPort,"deriveMcpHttpPort"),s(deriveMcpHttpPort,"deriveMcpHttpPort");function readSourceSetExclude(e){try{const t=JSON.parse(fs.readFileSync(path.join(e,".lensmcp","config.json"),"utf8"))?.sourceSet?.exclude;if(Array.isArray(t))return new Set(t.filter(r=>typeof r=="string"&&r.length>0&&!r.includes("/")))}catch{}return new Set}a(readSourceSetExclude,"readSourceSetExclude"),n(readSourceSetExclude,"readSourceSetExclude"),s(readSourceSetExclude,"readSourceSetExclude");function lensKeyFrom(e){try{const t=JSON.parse(fs.readFileSync(path.join(e,"package.json"),"utf8"));if(t?.name)return lensSlug(t.name)}catch{}return lensSlug(path.basename(e))}a(lensKeyFrom,"lensKeyFrom"),n(lensKeyFrom,"lensKeyFrom"),s(lensKeyFrom,"lensKeyFrom");function lensSlug(e){return e.toLowerCase().replace(/^@[^/]+\//,"").replace(/[^a-z0-9]+/g,"-").replace(/(^-|-$)/g,"")||"workspace"}a(lensSlug,"lensSlug"),n(lensSlug,"lensSlug"),s(lensSlug,"lensSlug");

package/executors/gateway/runtime/server.js

@@ -1,3 +1,3 @@
-"use strict";var Z=Object.defineProperty;var m=(r,o)=>Z(r,"name",{value:o,configurable:!0});var X=Object.defineProperty,n=m((r,o)=>X(r,"name",{value:o,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.BENIGN_SOCKET_ERRNOS=void 0,exports.buildEdgeVerifierPool=buildEdgeVerifierPool,exports.classifyClientError=classifyClientError,exports.createClientErrorLogGate=createClientErrorLogGate,exports.startGateway=startGateway;const tslib_1=require("tslib"),http=tslib_1.__importStar(require("node:http")),path=tslib_1.__importStar(require("node:path")),discovery_1=require("./discovery"),scope_1=require("./scope"),route_registry_1=require("./route-registry"),control_1=require("./control"),workspace_registry_1=require("./workspace-registry"),service_keys_1=require("./service-keys"),observability_1=require("./observability"),lifecycle_1=require("./lifecycle"),lens_children_1=require("./lens-children"),proxy_1=require("./proxy"),auth_1=require("./auth"),hooks_1=require("./hooks"),handler_1=require("./handler"),upgrade_1=require("./upgrade"),jwks_verify_1=require("../jwks-verify"),types_1=require("./types");function insecureLocalFetch(r,o){return new Promise((g,h)=>{const w=(r.startsWith("https:")?require("node:https"):require("node:http")).request(r,{method:"GET",headers:o?.headers,rejectUnauthorized:!1},_=>{const l=[];_.on("data",u=>l.push(u)),_.on("end",()=>{const u=_.statusCode??0,a=Buffer.concat(l).toString("utf8");g({ok:u>=200&&u<300,status:u,json:n(async()=>JSON.parse(a),"json")})})});w.on("error",h),w.end()})}m(insecureLocalFetch,"insecureLocalFetch"),n(insecureLocalFetch,"insecureLocalFetch");function buildEdgeVerifierPool(r){const o=process.env.LENSMCP_GW_JWKS_URL,g=process.env.LENSMCP_GW_JWT_ISS,h=new Map;let w;const _=n((l,u)=>{console.log(`[gateway] edge JWT: verifying via JWKS ${l}${u}`);const a=(0,jwks_verify_1.createJwksVerifier)({jwksUrl:l,...g?{issuer:g}:{},fetchImpl:insecureLocalFetch});return a.refresh().catch(E=>console.warn("[gateway] edge JWKS warm failed (will retry):",E.message)),a},"make");return{for(l){if(o)return w??=_(o,"");const u=l.split(":")[0].toLowerCase();let a;for(const v of r()){const S=v.host;if(typeof S!="string"||!/^auth\./.test(S)||S.startsWith("internal."))continue;const d=S.slice(5);(u===d||u.endsWith(`.${d}`))&&(!a||d.length>a.length)&&(a=d)}if(!a)return;let E=h.get(a);return E||(E=_(`https://auth.${a}/jwks.json`,` (auto-derived for apex ${a})`),h.set(a,E)),E},stop(){w?.stop();for(const l of h.values())l.stop()}}}m(buildEdgeVerifierPool,"buildEdgeVerifierPool"),n(buildEdgeVerifierPool,"buildEdgeVerifierPool"),exports.BENIGN_SOCKET_ERRNOS=new Set(["ECONNRESET","EPIPE","ETIMEDOUT","ECONNABORTED","ECANCELED"]);function classifyClientError(r,o){return r&&exports.BENIGN_SOCKET_ERRNOS.has(r)?{status:null,report:!1,cause:"client-abort"}:r==="HPE_INVALID_EOF_STATE"?{status:null,report:!1,cause:"truncated-at-eof"}:r==="ERR_HTTP_REQUEST_TIMEOUT"?{status:408,report:!0,cause:"request-timeout"}:r==="HPE_HEADER_OVERFLOW"?{status:431,report:!0,cause:"header-overflow"}:r?.startsWith("HPE_")?{status:400,report:!0,cause:"parse-error"}:{status:400,report:!0,cause:r??o??"unknown"}}m(classifyClientError,"classifyClientError"),n(classifyClientError,"classifyClientError");const CLIENT_ERROR_REASON={400:"Bad Request",408:"Request Timeout",431:"Request Header Fields Too Large"};function createClientErrorLogGate(r=1e4){const o=new Map;return g=>{const h=Date.now(),w=o.get(g)??0;return h-w<r?!1:(o.set(g,h),!0)}}m(createClientErrorLogGate,"createClientErrorLogGate"),n(createClientErrorLogGate,"createClientErrorLogGate");function guardInboundSocket(r){r.on("error",o=>{exports.BENIGN_SOCKET_ERRNOS.has(o.code??"")||console.warn(`[gateway] inbound socket error (${o.code??o.message}) \u2014 dropping this connection only`),r.destroy()})}m(guardInboundSocket,"guardInboundSocket"),n(guardInboundSocket,"guardInboundSocket");async function startGateway(r,o){const g=r.https!==!1,h=r.ports?.length?r.ports:[443],w=r.scanTtlMs??1500,_=r.startupTimeoutMs??12e4,l=r.sweepMs??1e4,u=r.trafficFlushMs??5e3;let a=!1;const E=process.env.LENSMCP_EVENT_FILE??path.join(o.root,".lensmcp","events.jsonl"),v=(0,scope_1.readLensScope)(o.root).key,{routes:S,services:d}=(0,discovery_1.discoverRoutes)(o.root,o.projectsConfigurations?.projects??{},void 0,v);if(S.length===0)throw new Error("[gateway] no project declares a `cluster` field \u2014 nothing to route.");const q=new route_registry_1.RouteRegistry;q.register({wsKey:v,root:o.root,routes:S,services:d});const T=[];let x=n(()=>{},"refreshCert");const N=n(()=>{(0,route_registry_1.rebuildRoutesInPlace)(T,q),x()},"rebuildRoutes");N();const{serviceKeys:V,keyToProject:D}=(0,service_keys_1.loadServiceKeys)(o.root,d),f={root:o.root,wsKey:v,eventFile:E,routes:T,registry:q,rebuildRoutes:N,services:d,serviceKeys:V,keyToProject:D,scanTtlMs:w,startupTimeoutMs:_,sweepMs:l,trafficFlushMs:u,https:g,projectRoots:Object.fromEntries(Object.entries(o.projectsConfigurations?.projects??{}).map(([e,t])=>[e,path.resolve(o.root,t.root)])),stopped:n(()=>a,"stopped")},p=(0,observability_1.createObservability)(E,{trafficFlushMs:u}),B=createClientErrorLogGate(),P=(0,lifecycle_1.createServiceLayer)(f,p),b=(0,lens_children_1.createLensChildren)(f,p,r),j=new Map;let I;try{I=(0,control_1.startControlServer)({rt:f,killService:n((e,t)=>P.killSpawned(e,t),"killService"),onRegister:n(async e=>{const t=await b.hostWorkspaceDashboard(e),i=await b.hostWorkspaceApps(e);j.set(e.wsKey,()=>{t?.(),i()})},"onRegister"),onUnregister:n(e=>{j.get(e.wsKey)?.(),j.delete(e.wsKey)},"onUnregister")})}catch(e){console.warn("[gateway] control plane failed to start (multi-workspace register disabled):",e.message)}const C=(0,proxy_1.createProxy)(f,p,P),L=buildEdgeVerifierPool(()=>f.routes),W=(0,auth_1.createEdgeAuth)(f,p,L);let A;if(r.middleware){const e=require(path.resolve(o.root,r.middleware));A=e.default??e}const J=n(e=>{if(A)try{A(e.req)}catch(t){p.traceStep(e.trace,"auth",{mode:"middleware",ok:!1,reason:t.message}),e.route&&p.finishTrace(e.trace,e.route.project,401),e.sendError(401,"unauthorized",`Gateway middleware rejected the request: ${t.message}`)}},"builtinMiddleware"),G=r.hooks??{},K=(0,hooks_1.createHooks)({...G,afterAuth:[J,...G.afterAuth??[]]}),U=(0,handler_1.createHandler)({rt:f,obs:p,auth:W,proxy:C,hooks:K}),Y=(0,upgrade_1.createUpgrade)({rt:f,auth:W,proxy:C,hooks:K}),z=p.startEdgeFlusher(),Q=P.startSweeper();await b.bootSingletonsAndApps();for(const e of d)e.decl.eager&&P.ensureUp(e);let k,M,$;if(g){const e=require("../../../basic-ssl"),t=(0,service_keys_1.gatewayCacheDir)(o.root);$=n(()=>e.getCertificateSync(t,"gateway",f.routes.map(i=>i.host).filter(i=>!!i)),"mintCert"),k=$(),M=e.caCertPath()}const O=[],R=[];for(const e of h){const t=k?require("node:http2").createSecureServer({key:k,cert:k,allowHTTP1:!0,maxSessionMemory:512,settings:{maxConcurrentStreams:512},peerMaxConcurrentStreams:512},(i,s)=>U(i,s)):http.createServer(U);if(t.on("upgrade",Y),t.on("error",i=>console.error(`[gateway] port ${e}: ${i.code}`)),t.on("connection",guardInboundSocket),t.on("secureConnection",guardInboundSocket),t.on("tlsClientError",(i,s)=>s.destroy()),t.on("clientError",(i,s)=>{const y=i,c=classifyClientError(y.code,y.message);if(c.report&&B(c.cause)){const F=s.remoteAddress??"unknown",H=c.status===null?"dropped":String(c.status);console.warn(`[gateway] inbound H1 clientError from ${F}: ${c.cause} (${y.code??y.message}${y.bytesParsed!==void 0?`, bytesParsed=${y.bytesParsed}`:""}) \u2192 ${H}. This status is the GATEWAY's, not the upstream service's.`),p.emit("warning",`inbound clientError: ${c.cause} \u2192 ${H}`,`gateway-client-error:${c.cause}`,{kind:"gateway-client-error",cause:c.cause,code:y.code??null,status:c.status,peer:F,bytesParsed:y.bytesParsed??null})}c.status!==null&&s.writable&&s.end(`HTTP/1.1 ${c.status} ${CLIENT_ERROR_REASON[c.status]}\r
+"use strict";var oe=Object.defineProperty;var m=(t,r)=>oe(t,"name",{value:r,configurable:!0});var re=Object.defineProperty,_=m((t,r)=>re(t,"name",{value:r,configurable:!0}),"_"),ee=Object.defineProperty,n=_((t,r)=>ee(t,"name",{value:r,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.BENIGN_SOCKET_ERRNOS=void 0,exports.buildEdgeVerifierPool=buildEdgeVerifierPool,exports.classifyClientError=classifyClientError,exports.createClientErrorLogGate=createClientErrorLogGate,exports.startGateway=startGateway;const tslib_1=require("tslib"),http=tslib_1.__importStar(require("node:http")),path=tslib_1.__importStar(require("node:path")),discovery_1=require("./discovery"),scope_1=require("./scope"),route_registry_1=require("./route-registry"),control_1=require("./control"),workspace_registry_1=require("./workspace-registry"),service_keys_1=require("./service-keys"),observability_1=require("./observability"),lifecycle_1=require("./lifecycle"),lens_children_1=require("./lens-children"),proxy_1=require("./proxy"),auth_1=require("./auth"),hooks_1=require("./hooks"),handler_1=require("./handler"),upgrade_1=require("./upgrade"),jwks_verify_1=require("../jwks-verify"),types_1=require("./types");function insecureLocalFetch(t,r){return new Promise((g,y)=>{const h=(t.startsWith("https:")?require("node:https"):require("node:http")).request(t,{method:"GET",headers:r?.headers,rejectUnauthorized:!1},E=>{const l=[];E.on("data",u=>l.push(u)),E.on("end",()=>{const u=E.statusCode??0,a=Buffer.concat(l).toString("utf8");g({ok:u>=200&&u<300,status:u,json:n(async()=>JSON.parse(a),"json")})})});h.on("error",y),h.end()})}m(insecureLocalFetch,"insecureLocalFetch"),_(insecureLocalFetch,"insecureLocalFetch"),n(insecureLocalFetch,"insecureLocalFetch");function buildEdgeVerifierPool(t){const r=process.env.LENSMCP_GW_JWKS_URL,g=process.env.LENSMCP_GW_JWT_ISS,y=new Map;let h;const E=n((l,u)=>{console.log(`[gateway] edge JWT: verifying via JWKS ${l}${u}`);const a=(0,jwks_verify_1.createJwksVerifier)({jwksUrl:l,...g?{issuer:g}:{},fetchImpl:insecureLocalFetch});return a.refresh().catch(w=>console.warn("[gateway] edge JWKS warm failed (will retry):",w.message)),a},"make");return{for(l){if(r)return h??=E(r,"");const u=l.split(":")[0].toLowerCase();let a;for(const T of t()){const S=T.host;if(typeof S!="string"||!/^auth\./.test(S)||S.startsWith("internal."))continue;const v=S.slice(5);(u===v||u.endsWith(`.${v}`))&&(!a||v.length>a.length)&&(a=v)}if(!a)return;let w=y.get(a);return w||(w=E(`https://auth.${a}/jwks.json`,` (auto-derived for apex ${a})`),y.set(a,w)),w},stop(){h?.stop();for(const l of y.values())l.stop()}}}m(buildEdgeVerifierPool,"buildEdgeVerifierPool"),_(buildEdgeVerifierPool,"buildEdgeVerifierPool"),n(buildEdgeVerifierPool,"buildEdgeVerifierPool"),exports.BENIGN_SOCKET_ERRNOS=new Set(["ECONNRESET","EPIPE","ETIMEDOUT","ECONNABORTED","ECANCELED"]);function classifyClientError(t,r){return t&&exports.BENIGN_SOCKET_ERRNOS.has(t)?{status:null,report:!1,cause:"client-abort"}:t==="HPE_INVALID_EOF_STATE"?{status:null,report:!1,cause:"truncated-at-eof"}:t==="ERR_HTTP_REQUEST_TIMEOUT"?{status:408,report:!0,cause:"request-timeout"}:t==="HPE_HEADER_OVERFLOW"?{status:431,report:!0,cause:"header-overflow"}:t?.startsWith("HPE_")?{status:400,report:!0,cause:"parse-error"}:{status:400,report:!0,cause:t??r??"unknown"}}m(classifyClientError,"classifyClientError"),_(classifyClientError,"classifyClientError"),n(classifyClientError,"classifyClientError");const CLIENT_ERROR_REASON={400:"Bad Request",408:"Request Timeout",431:"Request Header Fields Too Large"};function createClientErrorLogGate(t=1e4){const r=new Map;return g=>{const y=Date.now(),h=r.get(g)??0;return y-h<t?!1:(r.set(g,y),!0)}}m(createClientErrorLogGate,"createClientErrorLogGate"),_(createClientErrorLogGate,"createClientErrorLogGate"),n(createClientErrorLogGate,"createClientErrorLogGate");function guardInboundSocket(t){t.on("error",r=>{exports.BENIGN_SOCKET_ERRNOS.has(r.code??"")||console.warn(`[gateway] inbound socket error (${r.code??r.message}) \u2014 dropping this connection only`),t.destroy()})}m(guardInboundSocket,"guardInboundSocket"),_(guardInboundSocket,"guardInboundSocket"),n(guardInboundSocket,"guardInboundSocket");async function startGateway(t,r){const g=t.https!==!1,y=t.ports?.length?t.ports:[443],h=t.scanTtlMs??1500,E=t.startupTimeoutMs??12e4,l=t.sweepMs??1e4,u=t.trafficFlushMs??5e3;let a=!1;const w=process.env.LENSMCP_EVENT_FILE??path.join(r.root,".lensmcp","events.jsonl"),T=(0,scope_1.readLensScope)(r.root).key,S=r.projectsConfigurations?.projects??{},v=(0,discovery_1.projectSourceRoots)(r.root,S,r.projectDependencies),{routes:L,services:b}=(0,discovery_1.discoverRoutes)(r.root,S,void 0,T,v);if(L.length===0)throw new Error("[gateway] no project declares a `cluster` field \u2014 nothing to route.");const A=new route_registry_1.RouteRegistry;A.register({wsKey:T,root:r.root,routes:L,services:b});const k=[];let N=n(()=>{},"refreshCert");const G=n(()=>{(0,route_registry_1.rebuildRoutesInPlace)(k,A),N()},"rebuildRoutes");G();const{serviceKeys:J,keyToProject:Y}=(0,service_keys_1.loadServiceKeys)(r.root,b),f={root:r.root,wsKey:T,eventFile:w,routes:k,registry:A,rebuildRoutes:G,services:b,serviceKeys:J,keyToProject:Y,scanTtlMs:h,startupTimeoutMs:E,sweepMs:l,trafficFlushMs:u,https:g,projectRoots:Object.fromEntries(Object.entries(r.projectsConfigurations?.projects??{}).map(([e,o])=>[e,path.resolve(r.root,o.root)])),projectSourceRoots:v,stopped:n(()=>a,"stopped")},p=(0,observability_1.createObservability)(w,{trafficFlushMs:u}),z=createClientErrorLogGate(),C=(0,lifecycle_1.createServiceLayer)(f,p),R=(0,lens_children_1.createLensChildren)(f,p,t),O=new Map;let W;try{W=(0,control_1.startControlServer)({rt:f,killService:n((e,o)=>C.killSpawned(e,o),"killService"),onRegister:n(async e=>{const o=await R.hostWorkspaceDashboard(e),i=await R.hostWorkspaceApps(e);O.set(e.wsKey,()=>{o?.(),i()})},"onRegister"),onUnregister:n(e=>{O.get(e.wsKey)?.(),O.delete(e.wsKey)},"onUnregister")})}catch(e){console.warn("[gateway] control plane failed to start (multi-workspace register disabled):",e.message)}const j=(0,proxy_1.createProxy)(f,p,C),K=buildEdgeVerifierPool(()=>f.routes),U=(0,auth_1.createEdgeAuth)(f,p,K);let M;if(t.middleware){const e=require(path.resolve(r.root,t.middleware));M=e.default??e}const Q=n(e=>{if(M)try{M(e.req)}catch(o){p.traceStep(e.trace,"auth",{mode:"middleware",ok:!1,reason:o.message}),e.route&&p.finishTrace(e.trace,e.route.project,401),e.sendError(401,"unauthorized",`Gateway middleware rejected the request: ${o.message}`)}},"builtinMiddleware"),F=t.hooks??{},H=(0,hooks_1.createHooks)({...F,afterAuth:[Q,...F.afterAuth??[]]}),V=(0,handler_1.createHandler)({rt:f,obs:p,auth:U,proxy:j,hooks:H}),X=(0,upgrade_1.createUpgrade)({rt:f,auth:U,proxy:j,hooks:H}),Z=p.startEdgeFlusher(),te=C.startSweeper();await R.bootSingletonsAndApps();for(const e of b)e.decl.eager&&C.ensureUp(e);let P,x,$;if(g){const e=require("../../../basic-ssl"),o=(0,service_keys_1.gatewayCacheDir)(r.root);$=n(()=>e.getCertificateSync(o,"gateway",f.routes.map(i=>i.host).filter(i=>!!i)),"mintCert"),P=$(),x=e.caCertPath()}const I=[],q=[];for(const e of y){const o=P?require("node:http2").createSecureServer({key:P,cert:P,allowHTTP1:!0,maxSessionMemory:512,settings:{maxConcurrentStreams:512},peerMaxConcurrentStreams:512},(i,s)=>V(i,s)):http.createServer(V);if(o.on("upgrade",X),o.on("error",i=>console.error(`[gateway] port ${e}: ${i.code}`)),o.on("connection",guardInboundSocket),o.on("secureConnection",guardInboundSocket),o.on("tlsClientError",(i,s)=>s.destroy()),o.on("clientError",(i,s)=>{const d=i,c=classifyClientError(d.code,d.message);if(c.report&&z(c.cause)){const D=s.remoteAddress??"unknown",B=c.status===null?"dropped":String(c.status);console.warn(`[gateway] inbound H1 clientError from ${D}: ${c.cause} (${d.code??d.message}${d.bytesParsed!==void 0?`, bytesParsed=${d.bytesParsed}`:""}) \u2192 ${B}. This status is the GATEWAY's, not the upstream service's.`),p.emit("warning",`inbound clientError: ${c.cause} \u2192 ${B}`,`gateway-client-error:${c.cause}`,{kind:"gateway-client-error",cause:c.cause,code:d.code??null,status:c.status,peer:D,bytesParsed:d.bytesParsed??null})}c.status!==null&&s.writable&&s.end(`HTTP/1.1 ${c.status} ${CLIENT_ERROR_REASON[c.status]}\r
 \r
-`),s.destroy()}),t.keepAliveTimeout=types_1.GATEWAY_KEEPALIVE_TIMEOUT_MS,t.headersTimeout<types_1.GATEWAY_KEEPALIVE_TIMEOUT_MS+5e3&&(t.headersTimeout=types_1.GATEWAY_KEEPALIVE_TIMEOUT_MS+5e3),k!=null){const i=t;i.on("session",s=>{s.on("error",y=>{const c=y.code??y.message;console.warn(`[gateway] h2 session error (${c}) \u2014 dropping this session only`),s.destroyed||s.destroy()})}),i.on("sessionError",s=>{console.warn(`[gateway] h2 sessionError: ${s.code??s.message}`)})}await new Promise(i=>{t.listen(e,()=>{const s=t.address()?.port??e;R.push(s),console.log(`[gateway] Listening on ${k?"https":"http"}://localhost:${s}`),i()})}),O.push(t)}$&&(x=n(()=>{const e=$();for(const t of O)t.setSecureContext?.({key:e,cert:e})},"refreshCert")),console.log("[gateway] Routes:");for(const e of T){const t=e.pool?`pods@${e.pool.dir}`:e.target;console.log(`[gateway]   ${e.host??"(default)"} \u2192 ${t}${e.prependPrefix?`  (+${e.prependPrefix})`:""}${e.internal?"  [internal: no middleware]":""}  [${e.project}]`)}return M&&console.log(`[gateway] CA: ${M} \u2014 one-time setup via the trust executor.`),p.emit("info",`gateway up: ${T.length} routes on ${R.join("/")}`,"cluster-gateway",{kind:"gateway-up",ports:R,routes:T.map(e=>({host:e.host??"(default)",project:e.project,mode:e.pool?"pods":"tcp",internal:!!e.internal,prependPrefix:e.prependPrefix}))}),{ports:R,routes:T,services:d,stop:n(async()=>{if(!a){a=!0,clearInterval(z),clearInterval(Q),p.emit("info","gateway down","cluster-gateway",{kind:"gateway-down"}),L.stop(),I?.close(),(0,workspace_registry_1.unregisterWorkspace)(v);for(const e of d)P.killSpawned(e,"gateway shutdown");await b.reapAll(),await Promise.all(O.map(e=>new Promise(t=>e.close(()=>t())))),C.closeProxy(),C.destroyAgents()}},"stop")}}m(startGateway,"startGateway"),n(startGateway,"startGateway");
+`),s.destroy()}),o.keepAliveTimeout=types_1.GATEWAY_KEEPALIVE_TIMEOUT_MS,o.headersTimeout<types_1.GATEWAY_KEEPALIVE_TIMEOUT_MS+5e3&&(o.headersTimeout=types_1.GATEWAY_KEEPALIVE_TIMEOUT_MS+5e3),P!=null){const i=o;i.on("session",s=>{s.on("error",d=>{const c=d.code??d.message;console.warn(`[gateway] h2 session error (${c}) \u2014 dropping this session only`),s.destroyed||s.destroy()})}),i.on("sessionError",s=>{console.warn(`[gateway] h2 sessionError: ${s.code??s.message}`)})}await new Promise(i=>{o.listen(e,()=>{const s=o.address()?.port??e;q.push(s),console.log(`[gateway] Listening on ${P?"https":"http"}://localhost:${s}`),i()})}),I.push(o)}$&&(N=n(()=>{const e=$();for(const o of I)o.setSecureContext?.({key:e,cert:e})},"refreshCert")),console.log("[gateway] Routes:");for(const e of k){const o=e.pool?`pods@${e.pool.dir}`:e.target;console.log(`[gateway]   ${e.host??"(default)"} \u2192 ${o}${e.prependPrefix?`  (+${e.prependPrefix})`:""}${e.internal?"  [internal: no middleware]":""}  [${e.project}]`)}return x&&console.log(`[gateway] CA: ${x} \u2014 one-time setup via the trust executor.`),p.emit("info",`gateway up: ${k.length} routes on ${q.join("/")}`,"cluster-gateway",{kind:"gateway-up",project:"gateway",ports:q,routes:k.map(e=>({host:e.host??"(default)",project:e.project,mode:e.pool?"pods":"tcp",internal:!!e.internal,prependPrefix:e.prependPrefix}))}),{ports:q,routes:k,services:b,stop:n(async()=>{if(!a){a=!0,clearInterval(Z),clearInterval(te),p.emit("info","gateway down","cluster-gateway",{kind:"gateway-down",project:"gateway"}),K.stop(),W?.close(),(0,workspace_registry_1.unregisterWorkspace)(T);for(const e of b)C.killSpawned(e,"gateway shutdown");await R.reapAll(),await Promise.all(I.map(e=>new Promise(o=>e.close(()=>o())))),j.closeProxy(),j.destroyAgents()}},"stop")}}m(startGateway,"startGateway"),_(startGateway,"startGateway"),n(startGateway,"startGateway");

package/executors/gateway/runtime/service-keys.js

@@ -1 +1 @@
-"use strict";var d=Object.defineProperty;var i=(e,t)=>d(e,"name",{value:t,configurable:!0});var u=Object.defineProperty,c=i((e,t)=>u(e,"name",{value:t,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.gatewayCacheDir=gatewayCacheDir,exports.loadServiceKeys=loadServiceKeys;const tslib_1=require("tslib"),node_crypto_1=require("node:crypto"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path"));function gatewayCacheDir(e){return path.join(e,"node_modules",".cache","davnx-webpack")}i(gatewayCacheDir,"gatewayCacheDir"),c(gatewayCacheDir,"gatewayCacheDir");function loadServiceKeys(e,t){const a=gatewayCacheDir(e),n=path.join(a,"service-keys.json");let r={};try{r=JSON.parse(fs.readFileSync(n,"utf8"))}catch{}let s=!1;for(const o of t)r[o.project]||(r[o.project]=(0,node_crypto_1.randomBytes)(16).toString("hex"),s=!0);if(s)try{fs.mkdirSync(a,{recursive:!0}),fs.writeFileSync(n,JSON.stringify(r,null,2))}catch{}const y=new Map(Object.entries(r).map(([o,p])=>[p,o]));return{serviceKeys:r,keyToProject:y}}i(loadServiceKeys,"loadServiceKeys"),c(loadServiceKeys,"loadServiceKeys");
+"use strict";var f=Object.defineProperty;var o=(e,r)=>f(e,"name",{value:r,configurable:!0});var d=Object.defineProperty,i=o((e,r)=>d(e,"name",{value:r,configurable:!0}),"i"),u=Object.defineProperty,c=i((e,r)=>u(e,"name",{value:r,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0}),exports.gatewayCacheDir=gatewayCacheDir,exports.loadServiceKeys=loadServiceKeys;const tslib_1=require("tslib"),node_crypto_1=require("node:crypto"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path"));function gatewayCacheDir(e){return path.join(e,"node_modules",".cache","davnx-webpack")}o(gatewayCacheDir,"gatewayCacheDir"),i(gatewayCacheDir,"gatewayCacheDir"),c(gatewayCacheDir,"gatewayCacheDir");function loadServiceKeys(e,r){const n=gatewayCacheDir(e),s=path.join(n,"service-keys.json");let t={};try{t=JSON.parse(fs.readFileSync(s,"utf8"))}catch{}let y=!1;for(const a of r)t[a.project]||(t[a.project]=(0,node_crypto_1.randomBytes)(16).toString("hex"),y=!0);if(y)try{fs.mkdirSync(n,{recursive:!0}),fs.writeFileSync(s,JSON.stringify(t,null,2))}catch{}const l=new Map(Object.entries(t).map(([a,p])=>[p,a]));return{serviceKeys:t,keyToProject:l}}o(loadServiceKeys,"loadServiceKeys"),i(loadServiceKeys,"loadServiceKeys"),c(loadServiceKeys,"loadServiceKeys");

package/executors/gateway/runtime/types.d.ts

@@ -21,6 +21,8 @@ export interface GatewayContext {
             root: string;
         }>;
     };
+    /** Nx project-graph adjacency, populated by the executor wrapper when available. */
+    projectDependencies?: Record<string, string[]>;
 }
 /** Per-project declaration: top-level `cluster` field in project.json (`davnx` legacy). */
 export interface ClusterProjectDecl {
@@ -102,13 +104,51 @@ export interface Route {
  *  the gateway owns). */
 export interface LensFrontend {
     project: string;
+    /** Owning workspace, used to isolate same-named frontends in the shared daemon. */
+    workspaceKey?: string;
     /** Absolute project root (holds vite.config.*). */
     projectRoot: string;
     /** The pinned Vite dev port (also the upstream target's port). */
     port: number;
+    /** Project root plus transitive Nx dependency roots used for source-set health checks. */
+    sourceRoots?: string[];
     /** Set once the Vite child has been spawned (idempotency guard). */
     started?: boolean;
 }
+export interface SourceSetChange {
+    changedAt: number;
+    /** Repository-relative, slash-normalized source paths. */
+    added: string[];
+    removed: string[];
+    /** More paths changed than the diagnostic payload retains. */
+    truncated: boolean;
+}
+export interface LensWatcherEvent {
+    sequence: number;
+    kind: 'add' | 'addDir' | 'unlink' | 'unlinkDir';
+    /** Absolute, normalized path reported by Vite's watcher. */
+    path: string;
+    at: number;
+}
+export interface LensWatcherHealth {
+    schemaVersion: 1 | 2;
+    ready: boolean;
+    sequence: number;
+    lastFsSetEventAt: number;
+    fsSetEvents: number;
+    recentEvents: LensWatcherEvent[];
+}
+export interface LensFrontendRecoveryStatus {
+    state: 'starting' | 'ready' | 'replacing' | 'failed';
+    generation: number;
+    reason?: string;
+    startedAt?: number;
+}
+export interface LensFrontendSupervisor {
+    status(frontend: LensFrontend): LensFrontendRecoveryStatus | undefined;
+    /** Ensure a replacement is running and resolve when its route is ready. */
+    recover(frontend: LensFrontend, reason: string): Promise<boolean>;
+}
 export interface ServiceCtl {
     project: string;
     decl: ClusterProjectDecl;
@@ -317,6 +357,14 @@ export declare const LENS_PARKED_PORT_REPROBE_MS: number;
  *  does honor SIGTERM exits first and the escalation no-ops. Override
  *  `LENSMCP_RECYCLE_KILL_GRACE_MS`. Default 5s. */
 export declare const LENS_RECYCLE_KILL_GRACE_MS: number;
+/** Rolling is the safe default. `in-place` is an emergency compatibility escape hatch. */
+export declare const LENS_RESTART_MODE: 'rolling' | 'in-place';
+/** Maximum cold-start allowance for a standby Vite while the active generation keeps serving. */
+export declare const LENS_REPLACEMENT_READY_MS: number;
+/** Grace for requests already forwarded to the old generation after the route flips. */
+export declare const LENS_REPLACEMENT_DRAIN_MS: number;
+/** Per-request wait for an unplanned managed-frontend recovery. */
+export declare const LENS_REQUEST_RECOVERY_WAIT_MS: number;
 /** Inbound keep-alive idle window for the front door. MUST exceed every client's pooled-socket idle timeout
  *  so the SERVER never closes a keep-alive socket a client is about to reuse — otherwise both sides race the
  *  same deadline and the truncated request surfaces as a spurious front-door `400` (see
@@ -402,11 +450,19 @@ export interface GatewayRuntime {
      *  consumer prefers its own entry and falls back to the wide clock when absent (project root unknown, or
      *  the scan not yet warmed). Mutable, written only by the scanner. */
     sourceSetChangedFor?: Map<string, number>;
+    /** Exact path evidence paired with `sourceSetChangedFor`. */
+    sourceSetChangesFor?: Map<string, SourceSetChange>;
+    /** Workspace-wide fallback evidence when a project scope is unavailable. */
+    sourceSetChange?: SourceSetChange;
     /** Absolute project root per project name (from `projectsConfigurations`) — lets the scanner derive each
      *  child's watch scope, and tells it which top-level buckets are OWNED by a managed project. Absent ⇒
      *  every consumer falls back to the workspace-wide clock (previous behavior). */
     readonly projectRoots?: Readonly<Record<string, string>>;
-    /** project → the live HMR sockets of its open browser tabs, registered by the WS upgrade pipeline. A
+    /** Project root plus transitive Nx dependency roots. */
+    readonly projectSourceRoots?: Readonly<Record<string, string[]>>;
+    /** Managed lens frontend handoff state, installed by the child supervisor. */
+    lensSupervisor?: LensFrontendSupervisor;
+    /** frontend identity (`workspace:project`) → live HMR sockets, registered by the WS upgrade pipeline. A
      *  recycle pushes `full-reload` to these before killing the child ({@link ./hmr-reload}): the dying vite
      *  cannot announce its own death and its replacement never knew these tabs, so the gateway — which owns
      *  the decision AND proxied the sockets — is the only place the handoff can happen. Without it every open

package/executors/gateway/runtime/types.js

@@ -1 +1 @@
-"use strict";var M=Object.defineProperty;var R=(_,E)=>M(_,"name",{value:E,configurable:!0});var O=Object.defineProperty,L=R((_,E)=>O(_,"name",{value:E,configurable:!0}),"L");Object.defineProperty(exports,"__esModule",{value:!0}),exports.GATEWAY_KEEPALIVE_TIMEOUT_MS=exports.LENS_RECYCLE_KILL_GRACE_MS=exports.LENS_PARKED_PORT_REPROBE_MS=exports.MAX_PORT_CONFLICT_RETRIES=exports.CHILD_START_FAIL_MS=exports.PORT_FREE_POLL_MS=exports.PORT_FREE_WAIT_MS=exports.LENS_PROBE_BOOT_GRACE_MS=exports.LENS_PROBE_COOLDOWN_MS=exports.LENS_PROBE_TIMEOUT_MS=exports.LENS_PROBE_FAILS=exports.LENS_PROBE_GRACE_MS=exports.LENS_WATCHER_PROBE_ENABLED=exports.LENS_PROBE_ENABLED=exports.POD_STALE_RECYCLE_COOLDOWN_MS=exports.POD_STALE_SCAN_MS=exports.POD_RECYCLE_SETTLE_MS=exports.POD_STALE_GRACE_MS=exports.POD_MAX_AGE_MS=exports.POD_RECYCLE_ENABLED=exports.WEDGE_RECYCLE_GRACE_MS=exports.POD_RESPONSE_TIMEOUT_MS=exports.UPSTREAM_HEAL_STEP_MS=exports.UPSTREAM_HEAL_WINDOW_MS=exports.SERVICE_RESTART_WINDOW_MS=exports.SERVICE_MAX_RESTARTS=exports.SERVICE_ERROR_THROTTLE_MS=void 0;function envInt(_,E,e=!1){const S=Number(process.env[_]);return!Number.isFinite(S)||S<0?E:S===0?e?0:E:S}R(envInt,"envInt"),L(envInt,"envInt"),exports.SERVICE_ERROR_THROTTLE_MS=5e3,exports.SERVICE_MAX_RESTARTS=5,exports.SERVICE_RESTART_WINDOW_MS=6e4,exports.UPSTREAM_HEAL_WINDOW_MS=8e3,exports.UPSTREAM_HEAL_STEP_MS=300,exports.POD_RESPONSE_TIMEOUT_MS=(()=>{const _=Number(process.env.LENSMCP_POD_RESPONSE_TIMEOUT_MS);return Number.isFinite(_)&&_>0?_:3e4})(),exports.WEDGE_RECYCLE_GRACE_MS=(()=>{const _=Number(process.env.LENSMCP_WEDGE_RECYCLE_GRACE_MS);return Number.isFinite(_)&&_>0?_:15e3})(),exports.POD_RECYCLE_ENABLED=process.env.LENSMCP_POD_RECYCLE!=="0",exports.POD_MAX_AGE_MS=envInt("LENSMCP_POD_MAX_AGE_MS",240*6e4,!0),exports.POD_STALE_GRACE_MS=envInt("LENSMCP_POD_STALE_GRACE_MS",1e4),exports.POD_RECYCLE_SETTLE_MS=envInt("LENSMCP_POD_RECYCLE_SETTLE_MS",8e3),exports.POD_STALE_SCAN_MS=envInt("LENSMCP_POD_STALE_SCAN_MS",3e4),exports.POD_STALE_RECYCLE_COOLDOWN_MS=envInt("LENSMCP_POD_STALE_RECYCLE_COOLDOWN_MS",6e4),exports.LENS_PROBE_ENABLED=process.env.LENSMCP_LENS_PROBE!=="0",exports.LENS_WATCHER_PROBE_ENABLED=process.env.LENSMCP_LENS_WATCHER_PROBE!=="0",exports.LENS_PROBE_GRACE_MS=envInt("LENSMCP_LENS_PROBE_GRACE_MS",45e3),exports.LENS_PROBE_FAILS=envInt("LENSMCP_LENS_PROBE_FAILS",2),exports.LENS_PROBE_TIMEOUT_MS=envInt("LENSMCP_LENS_PROBE_TIMEOUT_MS",1e3),exports.LENS_PROBE_COOLDOWN_MS=envInt("LENSMCP_LENS_PROBE_COOLDOWN_MS",3e4),exports.LENS_PROBE_BOOT_GRACE_MS=envInt("LENSMCP_LENS_PROBE_BOOT_GRACE_MS",24e4),exports.PORT_FREE_WAIT_MS=envInt("LENSMCP_PORT_FREE_WAIT_MS",1e4),exports.PORT_FREE_POLL_MS=envInt("LENSMCP_PORT_FREE_POLL_MS",250),exports.CHILD_START_FAIL_MS=envInt("LENSMCP_CHILD_START_FAIL_MS",1e4),exports.MAX_PORT_CONFLICT_RETRIES=envInt("LENSMCP_MAX_PORT_CONFLICT_RETRIES",5),exports.LENS_PARKED_PORT_REPROBE_MS=envInt("LENSMCP_PARKED_PORT_REPROBE_MS",3e5),exports.LENS_RECYCLE_KILL_GRACE_MS=envInt("LENSMCP_RECYCLE_KILL_GRACE_MS",5e3),exports.GATEWAY_KEEPALIVE_TIMEOUT_MS=envInt("LENSMCP_KEEPALIVE_TIMEOUT_MS",76e3);
+"use strict";var C=Object.defineProperty;var e=(E,_)=>C(E,"name",{value:_,configurable:!0});var O=Object.defineProperty,L=e((E,_)=>O(E,"name",{value:_,configurable:!0}),"L"),M=Object.defineProperty,R=L((E,_)=>M(E,"name",{value:_,configurable:!0}),"R");Object.defineProperty(exports,"__esModule",{value:!0}),exports.GATEWAY_KEEPALIVE_TIMEOUT_MS=exports.LENS_REQUEST_RECOVERY_WAIT_MS=exports.LENS_REPLACEMENT_DRAIN_MS=exports.LENS_REPLACEMENT_READY_MS=exports.LENS_RESTART_MODE=exports.LENS_RECYCLE_KILL_GRACE_MS=exports.LENS_PARKED_PORT_REPROBE_MS=exports.MAX_PORT_CONFLICT_RETRIES=exports.CHILD_START_FAIL_MS=exports.PORT_FREE_POLL_MS=exports.PORT_FREE_WAIT_MS=exports.LENS_PROBE_BOOT_GRACE_MS=exports.LENS_PROBE_COOLDOWN_MS=exports.LENS_PROBE_TIMEOUT_MS=exports.LENS_PROBE_FAILS=exports.LENS_PROBE_GRACE_MS=exports.LENS_WATCHER_PROBE_ENABLED=exports.LENS_PROBE_ENABLED=exports.POD_STALE_RECYCLE_COOLDOWN_MS=exports.POD_STALE_SCAN_MS=exports.POD_RECYCLE_SETTLE_MS=exports.POD_STALE_GRACE_MS=exports.POD_MAX_AGE_MS=exports.POD_RECYCLE_ENABLED=exports.WEDGE_RECYCLE_GRACE_MS=exports.POD_RESPONSE_TIMEOUT_MS=exports.UPSTREAM_HEAL_STEP_MS=exports.UPSTREAM_HEAL_WINDOW_MS=exports.SERVICE_RESTART_WINDOW_MS=exports.SERVICE_MAX_RESTARTS=exports.SERVICE_ERROR_THROTTLE_MS=void 0;function envInt(E,_,P=!1){const S=Number(process.env[E]);return!Number.isFinite(S)||S<0?_:S===0?P?0:_:S}e(envInt,"envInt"),L(envInt,"envInt"),R(envInt,"envInt"),exports.SERVICE_ERROR_THROTTLE_MS=5e3,exports.SERVICE_MAX_RESTARTS=5,exports.SERVICE_RESTART_WINDOW_MS=6e4,exports.UPSTREAM_HEAL_WINDOW_MS=8e3,exports.UPSTREAM_HEAL_STEP_MS=300,exports.POD_RESPONSE_TIMEOUT_MS=(()=>{const E=Number(process.env.LENSMCP_POD_RESPONSE_TIMEOUT_MS);return Number.isFinite(E)&&E>0?E:3e4})(),exports.WEDGE_RECYCLE_GRACE_MS=(()=>{const E=Number(process.env.LENSMCP_WEDGE_RECYCLE_GRACE_MS);return Number.isFinite(E)&&E>0?E:15e3})(),exports.POD_RECYCLE_ENABLED=process.env.LENSMCP_POD_RECYCLE!=="0",exports.POD_MAX_AGE_MS=envInt("LENSMCP_POD_MAX_AGE_MS",240*6e4,!0),exports.POD_STALE_GRACE_MS=envInt("LENSMCP_POD_STALE_GRACE_MS",1e4),exports.POD_RECYCLE_SETTLE_MS=envInt("LENSMCP_POD_RECYCLE_SETTLE_MS",8e3),exports.POD_STALE_SCAN_MS=envInt("LENSMCP_POD_STALE_SCAN_MS",3e4),exports.POD_STALE_RECYCLE_COOLDOWN_MS=envInt("LENSMCP_POD_STALE_RECYCLE_COOLDOWN_MS",6e4),exports.LENS_PROBE_ENABLED=process.env.LENSMCP_LENS_PROBE!=="0",exports.LENS_WATCHER_PROBE_ENABLED=process.env.LENSMCP_LENS_WATCHER_PROBE!=="0",exports.LENS_PROBE_GRACE_MS=envInt("LENSMCP_LENS_PROBE_GRACE_MS",45e3),exports.LENS_PROBE_FAILS=envInt("LENSMCP_LENS_PROBE_FAILS",2),exports.LENS_PROBE_TIMEOUT_MS=envInt("LENSMCP_LENS_PROBE_TIMEOUT_MS",1e3),exports.LENS_PROBE_COOLDOWN_MS=envInt("LENSMCP_LENS_PROBE_COOLDOWN_MS",3e4),exports.LENS_PROBE_BOOT_GRACE_MS=envInt("LENSMCP_LENS_PROBE_BOOT_GRACE_MS",24e4),exports.PORT_FREE_WAIT_MS=envInt("LENSMCP_PORT_FREE_WAIT_MS",1e4),exports.PORT_FREE_POLL_MS=envInt("LENSMCP_PORT_FREE_POLL_MS",250),exports.CHILD_START_FAIL_MS=envInt("LENSMCP_CHILD_START_FAIL_MS",1e4),exports.MAX_PORT_CONFLICT_RETRIES=envInt("LENSMCP_MAX_PORT_CONFLICT_RETRIES",5),exports.LENS_PARKED_PORT_REPROBE_MS=envInt("LENSMCP_PARKED_PORT_REPROBE_MS",3e5),exports.LENS_RECYCLE_KILL_GRACE_MS=envInt("LENSMCP_RECYCLE_KILL_GRACE_MS",5e3),exports.LENS_RESTART_MODE=process.env.LENSMCP_LENS_RESTART_MODE==="in-place"?"in-place":"rolling",exports.LENS_REPLACEMENT_READY_MS=envInt("LENSMCP_LENS_REPLACEMENT_READY_MS",3e4),exports.LENS_REPLACEMENT_DRAIN_MS=envInt("LENSMCP_LENS_REPLACEMENT_DRAIN_MS",2e3,!0),exports.LENS_REQUEST_RECOVERY_WAIT_MS=envInt("LENSMCP_LENS_REQUEST_RECOVERY_WAIT_MS",15e3),exports.GATEWAY_KEEPALIVE_TIMEOUT_MS=envInt("LENSMCP_KEEPALIVE_TIMEOUT_MS",76e3);

package/executors/gateway/runtime/upgrade.js

@@ -1 +1 @@
-"use strict";var m=Object.defineProperty;var u=(n,s)=>m(n,"name",{value:s,configurable:!0});var y=Object.defineProperty,a=u((n,s)=>y(n,"name",{value:s,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createUpgrade=createUpgrade;const manifest_1=require("../manifest"),discovery_1=require("./discovery"),edge_1=require("./edge"),hmr_reload_1=require("./hmr-reload");function createUpgrade(n){const{rt:s,auth:f,proxy:h,hooks:c}=n,g=a(r=>(0,manifest_1.matchRoute)(s.routes,(r.headers.host||"").split(":")[0],r.url??"/"),"match"),v=a(async(r,o,d)=>{for(const t of edge_1.GATEWAY_OWNED_HEADERS)delete r.headers[t];const e=g(r);if(!e){o.destroy();return}const i=c.upgradeContext(r,o,void 0);if(i.route=e,e.internal){const t=f.internal(r,e,void 0);if(!t.ok){o.destroy();return}i.caller=t.caller}else{const t=f.public(r,e,void 0);if(!t.ok){o.destroy();return}if(i.claims=t.claims,c.has("afterAuth")&&(await c.run("afterAuth",i),i.responded()))return}if(e.pool&&s.serviceKeys[e.project]&&(r.headers["x-internal-token"]=s.serviceKeys[e.project]),e.prependPrefix&&!r.url?.startsWith(e.prependPrefix)&&(r.url=e.prependPrefix+(r.url??"/")),c.has("onUpgrade")&&(await c.run("onUpgrade",i),i.responded()))return;const l=e.pool?(()=>{const t=(0,discovery_1.pickSock)(e.pool,s.scanTtlMs);return t?{socketPath:t}:void 0})():e.target;if(!l){o.destroy();return}if(e.lens){const t=String(r.headers["sec-websocket-protocol"]??"").split(",").map(p=>p.trim());(t.length===0||t.includes("vite-hmr")||t.every(p=>p===""))&&(0,hmr_reload_1.registerHmrClient)(s,e.lens.project,o)}h.proxy.ws(r,o,d,{target:l,changeOrigin:!e.pool,agent:h.agentForTarget(l)},()=>o.destroy())},"run");return(r,o,d)=>{o.on("error",()=>o.destroy()),v(r,o,d).catch(()=>o.destroy())}}u(createUpgrade,"createUpgrade"),a(createUpgrade,"createUpgrade");
+"use strict";var x=Object.defineProperty;var f=(n,s)=>x(n,"name",{value:s,configurable:!0});var m=Object.defineProperty,u=f((n,s)=>m(n,"name",{value:s,configurable:!0}),"u"),g=Object.defineProperty,d=u((n,s)=>g(n,"name",{value:s,configurable:!0}),"d");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createUpgrade=createUpgrade;const manifest_1=require("../manifest"),discovery_1=require("./discovery"),edge_1=require("./edge"),hmr_reload_1=require("./hmr-reload");function createUpgrade(n){const{rt:s,auth:h,proxy:y,hooks:i}=n,v=d(r=>(0,manifest_1.matchRoute)(s.routes,(r.headers.host||"").split(":")[0],r.url??"/"),"match"),k=d(async(r,o,l)=>{for(const t of edge_1.GATEWAY_OWNED_HEADERS)delete r.headers[t];const e=v(r);if(!e){o.destroy();return}const a=i.upgradeContext(r,o,void 0);if(a.route=e,e.internal){const t=h.internal(r,e,void 0);if(!t.ok){o.destroy();return}a.caller=t.caller}else{const t=h.public(r,e,void 0);if(!t.ok){o.destroy();return}if(a.claims=t.claims,i.has("afterAuth")&&(await i.run("afterAuth",a),a.responded()))return}if(e.pool&&s.serviceKeys[e.project]&&(r.headers["x-internal-token"]=s.serviceKeys[e.project]),e.prependPrefix&&!r.url?.startsWith(e.prependPrefix)&&(r.url=e.prependPrefix+(r.url??"/")),i.has("onUpgrade")&&(await i.run("onUpgrade",a),a.responded()))return;const p=e.pool?(()=>{const t=(0,discovery_1.pickSock)(e.pool,s.scanTtlMs);return t?{socketPath:t}:void 0})():e.target;if(!p){o.destroy();return}if(e.lens){const t=String(r.headers["sec-websocket-protocol"]??"").split(",").map(c=>c.trim());if(t.length===0||t.includes("vite-hmr")||t.every(c=>c==="")){const c=e.lens.workspaceKey?`${e.lens.workspaceKey}:${e.lens.project}`:e.lens.project;(0,hmr_reload_1.registerHmrClient)(s,c,o)}}y.proxy.ws(r,o,l,{target:p,changeOrigin:!e.pool,agent:y.agentForTarget(p)},()=>o.destroy())},"run");return(r,o,l)=>{o.on("error",()=>o.destroy()),k(r,o,l).catch(()=>o.destroy())}}f(createUpgrade,"createUpgrade"),u(createUpgrade,"createUpgrade"),d(createUpgrade,"createUpgrade");

package/executors/gateway/runtime/workspace-registry.js

@@ -1 +1 @@
-"use strict";var p=Object.defineProperty;var i=(e,r)=>p(e,"name",{value:r,configurable:!0});var c=Object.defineProperty,s=i((e,r)=>c(e,"name",{value:r,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.processStamp=processStamp,exports.registryPath=registryPath,exports.readWorkspaces=readWorkspaces,exports.registerWorkspace=registerWorkspace,exports.unregisterWorkspace=unregisterWorkspace,exports.isWorkspaceLive=isWorkspaceLive;const tslib_1=require("tslib"),node_child_process_1=require("node:child_process"),fs=tslib_1.__importStar(require("node:fs")),os=tslib_1.__importStar(require("node:os")),path=tslib_1.__importStar(require("node:path"));function processStamp(e){if(!e||e<=0||process.platform==="win32")return"";try{return(0,node_child_process_1.execFileSync)("ps",["-p",String(e),"-o","lstart="],{encoding:"utf8",timeout:2e3,stdio:["ignore","pipe","ignore"]}).trim()}catch{return""}}i(processStamp,"processStamp"),s(processStamp,"processStamp");function registryPath(){const e=process.env.LENSMCP_HOME||os.homedir();return path.join(e,".lensmcp","workspaces.json")}i(registryPath,"registryPath"),s(registryPath,"registryPath");function readWorkspaces(e=registryPath()){try{const r=JSON.parse(fs.readFileSync(e,"utf8"));return Array.isArray(r)?r.filter(t=>!!t&&typeof t.key=="string"&&typeof t.base=="string"):[]}catch{return[]}}i(readWorkspaces,"readWorkspaces"),s(readWorkspaces,"readWorkspaces");function writeWorkspaces(e,r=registryPath()){try{fs.mkdirSync(path.dirname(r),{recursive:!0}),fs.writeFileSync(r,JSON.stringify(e,null,2))}catch{}}i(writeWorkspaces,"writeWorkspaces"),s(writeWorkspaces,"writeWorkspaces");function registerWorkspace(e,r=registryPath()){const t=readWorkspaces(r).filter(o=>o.key!==e.key);t.push(e),t.sort((o,n)=>o.key.localeCompare(n.key)),writeWorkspaces(t,r)}i(registerWorkspace,"registerWorkspace"),s(registerWorkspace,"registerWorkspace");function unregisterWorkspace(e,r=registryPath()){writeWorkspaces(readWorkspaces(r).filter(t=>t.key!==e),r)}i(unregisterWorkspace,"unregisterWorkspace"),s(unregisterWorkspace,"unregisterWorkspace");function isWorkspaceLive(e){if(!e.pid||e.pid<=0)return!1;try{process.kill(e.pid,0)}catch(t){if(t.code!=="EPERM")return!1}if(!e.procStamp)return!0;const r=processStamp(e.pid);return r===""?!0:r===e.procStamp}i(isWorkspaceLive,"isWorkspaceLive"),s(isWorkspaceLive,"isWorkspaceLive");
+"use strict";var u=Object.defineProperty;var o=(r,e)=>u(r,"name",{value:e,configurable:!0});var p=Object.defineProperty,i=o((r,e)=>p(r,"name",{value:e,configurable:!0}),"i"),c=Object.defineProperty,s=i((r,e)=>c(r,"name",{value:e,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.processStamp=processStamp,exports.registryPath=registryPath,exports.readWorkspaces=readWorkspaces,exports.registerWorkspace=registerWorkspace,exports.unregisterWorkspace=unregisterWorkspace,exports.isWorkspaceLive=isWorkspaceLive;const tslib_1=require("tslib"),node_child_process_1=require("node:child_process"),fs=tslib_1.__importStar(require("node:fs")),os=tslib_1.__importStar(require("node:os")),path=tslib_1.__importStar(require("node:path"));function processStamp(r){if(!r||r<=0||process.platform==="win32")return"";try{return(0,node_child_process_1.execFileSync)("ps",["-p",String(r),"-o","lstart="],{encoding:"utf8",timeout:2e3,stdio:["ignore","pipe","ignore"]}).trim()}catch{return""}}o(processStamp,"processStamp"),i(processStamp,"processStamp"),s(processStamp,"processStamp");function registryPath(){const r=process.env.LENSMCP_HOME||os.homedir();return path.join(r,".lensmcp","workspaces.json")}o(registryPath,"registryPath"),i(registryPath,"registryPath"),s(registryPath,"registryPath");function readWorkspaces(r=registryPath()){try{const e=JSON.parse(fs.readFileSync(r,"utf8"));return Array.isArray(e)?e.filter(t=>!!t&&typeof t.key=="string"&&typeof t.base=="string"):[]}catch{return[]}}o(readWorkspaces,"readWorkspaces"),i(readWorkspaces,"readWorkspaces"),s(readWorkspaces,"readWorkspaces");function writeWorkspaces(r,e=registryPath()){try{fs.mkdirSync(path.dirname(e),{recursive:!0}),fs.writeFileSync(e,JSON.stringify(r,null,2))}catch{}}o(writeWorkspaces,"writeWorkspaces"),i(writeWorkspaces,"writeWorkspaces"),s(writeWorkspaces,"writeWorkspaces");function registerWorkspace(r,e=registryPath()){const t=readWorkspaces(e).filter(n=>n.key!==r.key);t.push(r),t.sort((n,a)=>n.key.localeCompare(a.key)),writeWorkspaces(t,e)}o(registerWorkspace,"registerWorkspace"),i(registerWorkspace,"registerWorkspace"),s(registerWorkspace,"registerWorkspace");function unregisterWorkspace(r,e=registryPath()){writeWorkspaces(readWorkspaces(e).filter(t=>t.key!==r),e)}o(unregisterWorkspace,"unregisterWorkspace"),i(unregisterWorkspace,"unregisterWorkspace"),s(unregisterWorkspace,"unregisterWorkspace");function isWorkspaceLive(r){if(!r.pid||r.pid<=0)return!1;try{process.kill(r.pid,0)}catch(t){if(t.code!=="EPERM")return!1}if(!r.procStamp)return!0;const e=processStamp(r.pid);return e===""?!0:e===r.procStamp}o(isWorkspaceLive,"isWorkspaceLive"),i(isWorkspaceLive,"isWorkspaceLive"),s(isWorkspaceLive,"isWorkspaceLive");

package/executors/gateway/ssrf-guard.js

@@ -1 +1 @@
-"use strict";var h=Object.defineProperty;var l=(e,t)=>h(e,"name",{value:t,configurable:!0});var u=Object.defineProperty,i=l((e,t)=>u(e,"name",{value:t,configurable:!0}),"i");Object.defineProperty(exports,"__esModule",{value:!0}),exports.SsrfBlockedError=void 0,exports.isBlockedAddress=isBlockedAddress,exports.assertFetchableUrl=assertFetchableUrl,exports.safeFetch=safeFetch,exports.pinnedLookup=pinnedLookup;const node_net_1=require("node:net"),promises_1=require("node:dns/promises");class SsrfBlockedError extends Error{static{l(this,"SsrfBlockedError")}static{i(this,"SsrfBlockedError")}constructor(t,o,s,r){super(`SSRF guard blocked ${o??"request"}: ${t}${s?` (${s})`:""}`,r!==void 0?{cause:r}:void 0),this.name="SsrfBlockedError",this.reason=t,this.url=o,this.address=s}}exports.SsrfBlockedError=SsrfBlockedError;function buildDefaultBlockList(){const e=new node_net_1.BlockList;return e.addSubnet("0.0.0.0",8,"ipv4"),e.addSubnet("10.0.0.0",8,"ipv4"),e.addSubnet("100.64.0.0",10,"ipv4"),e.addSubnet("127.0.0.0",8,"ipv4"),e.addSubnet("169.254.0.0",16,"ipv4"),e.addSubnet("172.16.0.0",12,"ipv4"),e.addSubnet("192.0.0.0",24,"ipv4"),e.addSubnet("192.168.0.0",16,"ipv4"),e.addSubnet("198.18.0.0",15,"ipv4"),e.addSubnet("240.0.0.0",4,"ipv4"),e.addAddress("::","ipv6"),e.addAddress("::1","ipv6"),e.addSubnet("fc00::",7,"ipv6"),e.addSubnet("fe80::",10,"ipv6"),e}l(buildDefaultBlockList,"buildDefaultBlockList"),i(buildDefaultBlockList,"buildDefaultBlockList");const DEFAULT_BLOCK_LIST=buildDefaultBlockList();function isBlockedAddress(e,t=DEFAULT_BLOCK_LIST){const o=(0,node_net_1.isIP)(e);return o===0?!0:t.check(e,o===6?"ipv6":"ipv4")}l(isBlockedAddress,"isBlockedAddress"),i(isBlockedAddress,"isBlockedAddress");const stripBrackets=i(e=>e.startsWith("[")&&e.endsWith("]")?e.slice(1,-1):e,"stripBrackets"),defaultResolve=i(async e=>(await(0,promises_1.lookup)(e,{all:!0,verbatim:!0})).map(t=>t.address),"defaultResolve");async function assertFetchableUrl(e,t={}){const o=t.allowedProtocols??["http:","https:"];let s;try{s=new URL(e)}catch{throw new SsrfBlockedError("malformed-url",String(e))}if(!o.includes(s.protocol))throw new SsrfBlockedError(`scheme-not-allowed:${s.protocol}`,s.href);if(s.username!==""||s.password!=="")throw new SsrfBlockedError("embedded-credentials",s.href);const r=stripBrackets(s.hostname);if(r==="")throw new SsrfBlockedError("missing-host",s.href);if(t.allowPrivate)return{url:s,hostname:r,addresses:(0,node_net_1.isIP)(r)?[r]:[]};const d=t.blockList??DEFAULT_BLOCK_LIST;if((0,node_net_1.isIP)(r)!==0){if(isBlockedAddress(r,d))throw new SsrfBlockedError("blocked-address",s.href,r);return{url:s,hostname:r,addresses:[r]}}const c=t.resolve??defaultResolve;let a;try{a=await c(r)}catch(n){throw new SsrfBlockedError("dns-resolution-failed",s.href,void 0,n)}if(a.length===0)throw new SsrfBlockedError("dns-no-records",s.href);for(const n of a)if(isBlockedAddress(n,d))throw new SsrfBlockedError("blocked-resolved-address",s.href,n);return{url:s,hostname:r,addresses:a}}l(assertFetchableUrl,"assertFetchableUrl"),i(assertFetchableUrl,"assertFetchableUrl");async function safeFetch(e,t={},o={}){const s=o.fetchImpl??globalThis.fetch,r=o.maxRedirects??5;let d=e;for(let c=0;;c++){const{url:a}=await assertFetchableUrl(d,o),n=await s(a,{...t,redirect:"manual"}),f=n.headers.get("location");if(n.status>=300&&n.status<400&&f){if(c>=r)throw new SsrfBlockedError("too-many-redirects",a.href);d=new URL(f,a).href;continue}return n}}l(safeFetch,"safeFetch"),i(safeFetch,"safeFetch");function pinnedLookup(e){const t=e.map(o=>({address:o,family:(0,node_net_1.isIP)(o)===6?6:4}));return(o,s,r)=>{const d=typeof s=="function"?s:r,c=typeof s=="object"&&s!==null&&s.all===!0;if(t.length===0){d(new Error(`SSRF guard: no pinned address for ${o}`));return}c?d(null,t):d(null,t[0].address,t[0].family)}}l(pinnedLookup,"pinnedLookup"),i(pinnedLookup,"pinnedLookup");
+"use strict";var b=Object.defineProperty;var c=(e,t)=>b(e,"name",{value:t,configurable:!0});var h=Object.defineProperty,l=c((e,t)=>h(e,"name",{value:t,configurable:!0}),"l"),u=Object.defineProperty,i=l((e,t)=>u(e,"name",{value:t,configurable:!0}),"i");Object.defineProperty(exports,"__esModule",{value:!0}),exports.SsrfBlockedError=void 0,exports.isBlockedAddress=isBlockedAddress,exports.assertFetchableUrl=assertFetchableUrl,exports.safeFetch=safeFetch,exports.pinnedLookup=pinnedLookup;const node_net_1=require("node:net"),promises_1=require("node:dns/promises");class SsrfBlockedError extends Error{static{c(this,"SsrfBlockedError")}static{l(this,"SsrfBlockedError")}static{i(this,"SsrfBlockedError")}constructor(t,o,r,s){super(`SSRF guard blocked ${o??"request"}: ${t}${r?` (${r})`:""}`,s!==void 0?{cause:s}:void 0),this.name="SsrfBlockedError",this.reason=t,this.url=o,this.address=r}}exports.SsrfBlockedError=SsrfBlockedError;function buildDefaultBlockList(){const e=new node_net_1.BlockList;return e.addSubnet("0.0.0.0",8,"ipv4"),e.addSubnet("10.0.0.0",8,"ipv4"),e.addSubnet("100.64.0.0",10,"ipv4"),e.addSubnet("127.0.0.0",8,"ipv4"),e.addSubnet("169.254.0.0",16,"ipv4"),e.addSubnet("172.16.0.0",12,"ipv4"),e.addSubnet("192.0.0.0",24,"ipv4"),e.addSubnet("192.168.0.0",16,"ipv4"),e.addSubnet("198.18.0.0",15,"ipv4"),e.addSubnet("240.0.0.0",4,"ipv4"),e.addAddress("::","ipv6"),e.addAddress("::1","ipv6"),e.addSubnet("fc00::",7,"ipv6"),e.addSubnet("fe80::",10,"ipv6"),e}c(buildDefaultBlockList,"buildDefaultBlockList"),l(buildDefaultBlockList,"buildDefaultBlockList"),i(buildDefaultBlockList,"buildDefaultBlockList");const DEFAULT_BLOCK_LIST=buildDefaultBlockList();function isBlockedAddress(e,t=DEFAULT_BLOCK_LIST){const o=(0,node_net_1.isIP)(e);return o===0?!0:t.check(e,o===6?"ipv6":"ipv4")}c(isBlockedAddress,"isBlockedAddress"),l(isBlockedAddress,"isBlockedAddress"),i(isBlockedAddress,"isBlockedAddress");const stripBrackets=i(e=>e.startsWith("[")&&e.endsWith("]")?e.slice(1,-1):e,"stripBrackets"),defaultResolve=i(async e=>(await(0,promises_1.lookup)(e,{all:!0,verbatim:!0})).map(t=>t.address),"defaultResolve");async function assertFetchableUrl(e,t={}){const o=t.allowedProtocols??["http:","https:"];let r;try{r=new URL(e)}catch{throw new SsrfBlockedError("malformed-url",String(e))}if(!o.includes(r.protocol))throw new SsrfBlockedError(`scheme-not-allowed:${r.protocol}`,r.href);if(r.username!==""||r.password!=="")throw new SsrfBlockedError("embedded-credentials",r.href);const s=stripBrackets(r.hostname);if(s==="")throw new SsrfBlockedError("missing-host",r.href);if(t.allowPrivate)return{url:r,hostname:s,addresses:(0,node_net_1.isIP)(s)?[s]:[]};const d=t.blockList??DEFAULT_BLOCK_LIST;if((0,node_net_1.isIP)(s)!==0){if(isBlockedAddress(s,d))throw new SsrfBlockedError("blocked-address",r.href,s);return{url:r,hostname:s,addresses:[s]}}const f=t.resolve??defaultResolve;let a;try{a=await f(s)}catch(n){throw new SsrfBlockedError("dns-resolution-failed",r.href,void 0,n)}if(a.length===0)throw new SsrfBlockedError("dns-no-records",r.href);for(const n of a)if(isBlockedAddress(n,d))throw new SsrfBlockedError("blocked-resolved-address",r.href,n);return{url:r,hostname:s,addresses:a}}c(assertFetchableUrl,"assertFetchableUrl"),l(assertFetchableUrl,"assertFetchableUrl"),i(assertFetchableUrl,"assertFetchableUrl");async function safeFetch(e,t={},o={}){const r=o.fetchImpl??globalThis.fetch,s=o.maxRedirects??5;let d=e;for(let f=0;;f++){const{url:a}=await assertFetchableUrl(d,o),n=await r(a,{...t,redirect:"manual"}),p=n.headers.get("location");if(n.status>=300&&n.status<400&&p){if(f>=s)throw new SsrfBlockedError("too-many-redirects",a.href);d=new URL(p,a).href;continue}return n}}c(safeFetch,"safeFetch"),l(safeFetch,"safeFetch"),i(safeFetch,"safeFetch");function pinnedLookup(e){const t=e.map(o=>({address:o,family:(0,node_net_1.isIP)(o)===6?6:4}));return(o,r,s)=>{const d=typeof r=="function"?r:s,f=typeof r=="object"&&r!==null&&r.all===!0;if(t.length===0){d(new Error(`SSRF guard: no pinned address for ${o}`));return}f?d(null,t):d(null,t[0].address,t[0].family)}}c(pinnedLookup,"pinnedLookup"),l(pinnedLookup,"pinnedLookup"),i(pinnedLookup,"pinnedLookup");