@lensmcp/cluster 1.23.12 → 1.24.0

package/main.devserver.d.ts

@@ -1,3 +1,5 @@
+import { type Serializable } from 'node:child_process';
+import { redactInspectorUrls } from './inspector-secret';
 export interface GatewayRoute {
     /** Hostname to match — exact (`api.tetros.localhost`) or wildcard (`*.tetros.localhost`). */
     host?: string;
@@ -17,10 +19,10 @@ export interface GatewayRoute {
  * Did this request arrive on the OWNER-ONLY control socket, rather than the public TCP port?
  *
  * `requestHandler` serves both: the Unix socket at `$TMPDIR/<ws>/<svc>-devserver/parent.sock`
- * (0700 dir, see issues/codex-security/23) and `server.listen(publicPort)`. Admin branches were
+ * (0700 dir, see issues/closed/codex-security-23) and `server.listen(publicPort)`. Admin branches were
  * reachable on both, so `POST /webpack/debug` — which opens a Node inspector in every pod and
  * returns the ws:// URLs, and whose UUID is the only thing guarding `Runtime.evaluate` — could be
- * called by anything that could reach the port (issues/codex-security/05).
+ * called by anything that could reach the port (issues/closed/codex-security-05).
  *
  * Node's `Server.address()` returns the PATH STRING for a pipe/Unix socket and an object
  * `{ address, family, port }` for TCP. That is the discriminator, and it needs no extra plumbing
@@ -29,10 +31,44 @@ export interface GatewayRoute {
 export declare function isOwnerOnlyTransport(req: {
     socket?: unknown;
 }): boolean;
+/** Either end of an IPC channel: a pod or worker as its parent holds it, or the pod's own `process`. */
+export interface IpcEndpoint {
+    connected?: boolean;
+    send?(message: Serializable, callback: (error: Error | null) => void): boolean;
+}
+/**
+ * Tell a pod (or the parent) something over IPC — if it can still hear it (issues/closed/dev-gateway-19).
+ *
+ * `send` on a channel that has closed does not throw: it emits `'error'` (`ERR_IPC_CHANNEL_CLOSED`) on the next
+ * tick, and nothing listened for it. A pod that had exited is still listed until it is replaced, so a file change
+ * relayed to "every pod" — or a reload forwarded mid-stop — crashed the devserver PARENT, and the serve executor
+ * then respawned one. Never on a closed channel, always with a callback (which takes the error the event would have
+ * carried: a close between the check and the write is what the exit handler is for), and `false` when the message
+ * did not go, for a caller that has something else to do then.
+ */
+export declare function tell(endpoint: IpcEndpoint, message: Serializable): boolean;
+/** A devserver the gateway started carries its pid; one run by hand (`nx run <svc>:serve-hmr`) does not. */
+export declare function gatewayManaged(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * May this request DRIVE THE POOL — `/webpack/reload`, `/webpack/watching`, `/webpack/scale`?
+ *
+ * Under a gateway, only the control socket may. The TCP port is not an identity: it comes from a
+ * tracked config file, so every checkout of a repo has the same number. A second checkout's FIRST
+ * build has no control socket yet, so its plugin fell back to `localhost:<port>` — and that port
+ * belonged to the first checkout, whose pods it hot-swapped (issues/closed/foodguard-35). Nothing checked
+ * who was asking. The gateway and the service's own build plugin both reach the control socket,
+ * which lives in the workspace's owner-only socket dir; nobody else has a reason to.
+ *
+ * A devserver run by hand has no gateway and no second checkout behind one door; its port stays
+ * its admin surface, as before.
+ */
+export declare function mayDriveThePool(req: {
+    socket?: unknown;
+}, managed?: boolean): boolean;
 /**
  * Opt-out that restores the pre-`06` PREDICTABLE inspector ports (`base+slot`, `base+20+i`).
  *
- * issues/codex-security/06: with `debugPort` (or `LENSMCP_DEBUG_PORT`) set, every pod and worker
+ * issues/closed/codex-security-06: with `debugPort` (or `LENSMCP_DEBUG_PORT`) set, every pod and worker
  * opened a Node inspector on a port derived from a configured, PRINTED base. Node's inspector has no
  * application authentication — `GET /json/list` on that port returns the session UUID, and the UUID is
  * the whole credential for `Runtime.evaluate`, i.e. arbitrary code execution inside the pod with the
@@ -60,6 +96,16 @@ export declare function usesFixedInspectorPorts(env?: NodeJS.ProcessEnv): boolea
  * degrades to `0` rather than throwing at `inspector.open`.
  */
 export declare function inspectorPortFor(basePort: number, offset: number, env?: NodeJS.ProcessEnv): number;
-export declare function redactInspectorUrls(text: string): string;
+/**
+ * Strip the inspector session UUID out of any `ws://host:port/<uuid>` in a log line (inspector-secret.ts).
+ *
+ * `GET /webpack/logs` is served on BOTH the owner-only control socket and the public TCP port, and
+ * the log hub mirrors the pod's own "Debugger listening on ws://…" line plus the parent's echo of it.
+ * So moving the inspector to a random port would have moved the credential rather than removed it:
+ * a public reader could simply read the full URL — port AND UUID — out of the log stream. The owner
+ * (control socket) still gets the attachable URL; everyone else gets the shape and no secret. What the
+ * devserver writes to its own stdout/stderr and to its log tee is redacted the same way (issues/closed/pod-memory-06).
+ */
+export { redactInspectorUrls };
 /** The TCP port out of a `ws://host:port/uuid` inspector URL, or `null`. */
 export declare function inspectorPortOf(url: string | undefined): number | null;

package/main.devserver.js

@@ -1,4 +1,4 @@
-"use strict";var Oe=Object.defineProperty;var u=(n,h)=>Oe(n,"name",{value:h,configurable:!0});var Ce=Object.defineProperty,i=u((n,h)=>Ce(n,"name",{value:h,configurable:!0}),"i");Object.defineProperty(exports,"__esModule",{value:!0}),exports.DEBUG_FIXED_PORTS_ENV=void 0,exports.isOwnerOnlyTransport=isOwnerOnlyTransport,exports.usesFixedInspectorPorts=usesFixedInspectorPorts,exports.inspectorPortFor=inspectorPortFor,exports.redactInspectorUrls=redactInspectorUrls,exports.inspectorPortOf=inspectorPortOf;const tslib_1=require("tslib"),path=tslib_1.__importStar(require("node:path")),fs=tslib_1.__importStar(require("node:fs")),os=tslib_1.__importStar(require("node:os")),node_child_process_1=require("node:child_process"),http=tslib_1.__importStar(require("node:http")),readline=tslib_1.__importStar(require("node:readline")),inspector=tslib_1.__importStar(require("node:inspector")),util=tslib_1.__importStar(require("node:util")),v8=tslib_1.__importStar(require("node:v8")),vm=tslib_1.__importStar(require("node:vm")),exit_reason_1=require("./exit-reason"),hot_swap_registries_1=require("./hot-swap-registries"),process_name_1=require("./process-name"),schema_first_instance_1=require("./schema-first-instance"),redis_disconnect_fix_1=require("./redis-disconnect-fix"),error_stack_release_1=require("./error-stack-release"),swap_recycle_1=require("./swap-recycle"),stdio_guard_1=require("./stdio-guard"),httpProxy=require("http-proxy"),{prettyFactory}=require("pino-pretty"),BUNDLE_PATH=process.env.BUNDLE_PATH?.trim()||"./main.js",SERVICE_NAME=process.env.SERVICE_NAME||"",SERVICE_PREFIX=process.env.SERVE_PREFIX?`/${process.env.SERVE_PREFIX}`:"",GATEWAY_MIDDLEWARE_PATH=process.env.GATEWAY_MIDDLEWARE||"",GATEWAY_CONFIG=(()=>{const n=process.env.GATEWAY_CONFIG;if(!n)return{};try{return JSON.parse(n)}catch{return{}}})();let gatewayMiddleware=null;if(GATEWAY_MIDDLEWARE_PATH)try{const n=require(GATEWAY_MIDDLEWARE_PATH);gatewayMiddleware=typeof n=="function"?n:typeof n.default=="function"?n.default:null,gatewayMiddleware||console.warn(`[gateway] ${GATEWAY_MIDDLEWARE_PATH} does not export a function, gateway disabled`)}catch(n){console.error(`[gateway] Failed to load middleware from ${GATEWAY_MIDDLEWARE_PATH}:`,n)}function applyGatewayMiddleware(n){if(gatewayMiddleware)try{gatewayMiddleware(n,GATEWAY_CONFIG)}catch(h){console.error("[gateway] Middleware error:",h)}}u(applyGatewayMiddleware,"applyGatewayMiddleware"),i(applyGatewayMiddleware,"applyGatewayMiddleware");const GATEWAY_ROUTES=(()=>{try{return JSON.parse(process.env.GATEWAY_ROUTES||"[]")}catch{return[]}})(),GATEWAY_HTTPS=process.env.GATEWAY_HTTPS==="1";function hostMatches(n,h){if(n.startsWith("*.")){const g=n.slice(1);return h.endsWith(g)||h===n.slice(2)}return h===n}u(hostMatches,"hostMatches"),i(hostMatches,"hostMatches");function matchGatewayRoute(n){if(GATEWAY_ROUTES.length===0)return;const h=(n.headers.host||"").split(":")[0],g=n.url||"/";for(const _ of GATEWAY_ROUTES)if(!(_.host&&!hostMatches(_.host,h))&&!(_.prefix&&!g.startsWith(_.prefix)))return _}u(matchGatewayRoute,"matchGatewayRoute"),i(matchGatewayRoute,"matchGatewayRoute");const WORKER_NAMES=(()=>{try{return JSON.parse(process.env.WORKERS||"[]")}catch{return[]}})(),LENSMCP_WS_KEY=process.env.LENSMCP_WS_KEY||"",SOCK_DIR=LENSMCP_WS_KEY?path.join(os.tmpdir(),LENSMCP_WS_KEY,`${SERVICE_NAME||"lensmcp-cluster"}-devserver`):path.join(os.tmpdir(),`${SERVICE_NAME||"lensmcp-cluster"}-devserver`),POD_GENERATION=(()=>{const n=Number(process.env.LENSMCP_POD_GENERATION);return Number.isFinite(n)&&n>1?Math.floor(n):1})();function childSockPath(n){return path.join(SOCK_DIR,POD_GENERATION>1?`child-${n}-g${POD_GENERATION}.sock`:`child-${n}.sock`)}u(childSockPath,"childSockPath"),i(childSockPath,"childSockPath");function sockOwnerPath(n){return`${n}.owner`}u(sockOwnerPath,"sockOwnerPath"),i(sockOwnerPath,"sockOwnerPath");function sockRetiringPath(n){return`${n}.retiring`}u(sockRetiringPath,"sockRetiringPath"),i(sockRetiringPath,"sockRetiringPath");function isOwnerOnlyTransport(n){try{return typeof n.socket?.server?.address?.()=="string"}catch{return!1}}u(isOwnerOnlyTransport,"isOwnerOnlyTransport"),i(isOwnerOnlyTransport,"isOwnerOnlyTransport"),exports.DEBUG_FIXED_PORTS_ENV="LENSMCP_DEBUG_FIXED_PORTS";function usesFixedInspectorPorts(n=process.env){const h=(n[exports.DEBUG_FIXED_PORTS_ENV]??"").trim().toLowerCase();return h==="1"||h==="true"||h==="yes"||h==="on"}u(usesFixedInspectorPorts,"usesFixedInspectorPorts"),i(usesFixedInspectorPorts,"usesFixedInspectorPorts");function inspectorPortFor(n,h,g=process.env){if(!usesFixedInspectorPorts(g))return 0;const _=Math.trunc(n)+Math.trunc(h);return Number.isInteger(_)&&_>1024&&_<=65535?_:0}u(inspectorPortFor,"inspectorPortFor"),i(inspectorPortFor,"inspectorPortFor");const INSPECTOR_TOKEN_RE=/((?:wss?:\/\/[^\s/]+\/|ws=[^\s/]+\/))([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/gi;function redactInspectorUrls(n){return n.replace(INSPECTOR_TOKEN_RE,"$1<inspector-token-redacted>")}u(redactInspectorUrls,"redactInspectorUrls"),i(redactInspectorUrls,"redactInspectorUrls");function inspectorPortOf(n){const h=/^wss?:\/\/[^/]*?:(\d+)\//.exec(n??""),g=h?Number(h[1]):NaN;return Number.isInteger(g)&&g>0?g:null}u(inspectorPortOf,"inspectorPortOf"),i(inspectorPortOf,"inspectorPortOf");function ensureOwnerOnlyDir(n){try{fs.mkdirSync(n,{recursive:!0,mode:448})}catch{}try{const h=fs.lstatSync(n);h.isDirectory()&&(h.mode&63)!==0&&fs.chmodSync(n,448)}catch{}}u(ensureOwnerOnlyDir,"ensureOwnerOnlyDir"),i(ensureOwnerOnlyDir,"ensureOwnerOnlyDir");function claimSock(n,h=process.pid){ensureOwnerOnlyDir(path.dirname(n));try{const g=sockOwnerPath(n);try{fs.unlinkSync(g)}catch{}fs.writeFileSync(g,String(h),{flag:"wx",mode:384})}catch{}try{fs.unlinkSync(n)}catch{}try{fs.unlinkSync(sockRetiringPath(n))}catch{}}u(claimSock,"claimSock"),i(claimSock,"claimSock");function cleanupSock(n,h=process.pid){if(n){try{const g=fs.readFileSync(sockOwnerPath(n),"utf8").trim();if(g&&g!==String(h))return}catch{}try{fs.unlinkSync(n)}catch{}try{fs.unlinkSync(sockOwnerPath(n))}catch{}try{fs.unlinkSync(sockRetiringPath(n))}catch{}}}u(cleanupSock,"cleanupSock"),i(cleanupSock,"cleanupSock");function serviceKeyFingerprint(){const n=process.env.LENSMCP_SERVICE_KEY;if(!n)return;const{createHash:h}=require("node:crypto");return h("sha256").update(n).digest("hex").slice(0,8)}u(serviceKeyFingerprint,"serviceKeyFingerprint"),i(serviceKeyFingerprint,"serviceKeyFingerprint");async function importFresh(spec){process.env.DEVSERVER_MODE="1";const requested=path.isAbsolute(spec)?spec:path.join(__dirname,spec);let resolved=requested;try{resolved=fs.realpathSync(requested)}catch{}return eval(`(() => {
+"use strict";var je=Object.defineProperty;var h=(s,u)=>je(s,"name",{value:u,configurable:!0});var Be=Object.defineProperty,n=h((s,u)=>Be(s,"name",{value:u,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.redactInspectorUrls=exports.DEBUG_FIXED_PORTS_ENV=void 0,exports.isOwnerOnlyTransport=isOwnerOnlyTransport,exports.tell=tell,exports.gatewayManaged=gatewayManaged,exports.mayDriveThePool=mayDriveThePool,exports.usesFixedInspectorPorts=usesFixedInspectorPorts,exports.inspectorPortFor=inspectorPortFor,exports.inspectorPortOf=inspectorPortOf;const tslib_1=require("tslib"),path=tslib_1.__importStar(require("node:path")),fs=tslib_1.__importStar(require("node:fs")),os=tslib_1.__importStar(require("node:os")),node_child_process_1=require("node:child_process"),http=tslib_1.__importStar(require("node:http")),readline=tslib_1.__importStar(require("node:readline")),inspector=tslib_1.__importStar(require("node:inspector")),util=tslib_1.__importStar(require("node:util")),v8=tslib_1.__importStar(require("node:v8")),exit_reason_1=require("./exit-reason"),hot_swap_registries_1=require("./hot-swap-registries"),process_name_1=require("./process-name"),inspector_secret_1=require("./inspector-secret");Object.defineProperty(exports,"redactInspectorUrls",{enumerable:!0,get:n(function(){return inspector_secret_1.redactInspectorUrls},"get")});const schema_first_instance_1=require("./schema-first-instance"),redis_disconnect_fix_1=require("./redis-disconnect-fix"),error_stack_release_1=require("./error-stack-release"),swap_recycle_1=require("./swap-recycle"),stdio_guard_1=require("./stdio-guard"),dev_devtool_1=require("./dev-devtool"),pod_memory_1=require("./pod-memory"),pod_memory_events_1=require("./pod-memory-events"),heap_snapshot_1=require("./heap-snapshot"),httpProxy=require("http-proxy"),{prettyFactory}=require("pino-pretty"),BUNDLE_PATH=process.env.BUNDLE_PATH?.trim()||"./main.js",SERVICE_NAME=process.env.SERVICE_NAME||"",SERVICE_PREFIX=process.env.SERVE_PREFIX?`/${process.env.SERVE_PREFIX}`:"",GATEWAY_MIDDLEWARE_PATH=process.env.GATEWAY_MIDDLEWARE||"",GATEWAY_CONFIG=(()=>{const s=process.env.GATEWAY_CONFIG;if(!s)return{};try{return JSON.parse(s)}catch{return{}}})();let gatewayMiddleware=null;if(GATEWAY_MIDDLEWARE_PATH)try{const s=require(GATEWAY_MIDDLEWARE_PATH);gatewayMiddleware=typeof s=="function"?s:typeof s.default=="function"?s.default:null,gatewayMiddleware||console.warn(`[gateway] ${GATEWAY_MIDDLEWARE_PATH} does not export a function, gateway disabled`)}catch(s){console.error(`[gateway] Failed to load middleware from ${GATEWAY_MIDDLEWARE_PATH}:`,s)}function applyGatewayMiddleware(s){if(gatewayMiddleware)try{gatewayMiddleware(s,GATEWAY_CONFIG)}catch(u){console.error("[gateway] Middleware error:",u)}}h(applyGatewayMiddleware,"applyGatewayMiddleware"),n(applyGatewayMiddleware,"applyGatewayMiddleware");const GATEWAY_ROUTES=(()=>{try{return JSON.parse(process.env.GATEWAY_ROUTES||"[]")}catch{return[]}})(),GATEWAY_HTTPS=process.env.GATEWAY_HTTPS==="1";function hostMatches(s,u){if(s.startsWith("*.")){const f=s.slice(1);return u.endsWith(f)||u===s.slice(2)}return u===s}h(hostMatches,"hostMatches"),n(hostMatches,"hostMatches");function matchGatewayRoute(s){if(GATEWAY_ROUTES.length===0)return;const u=(s.headers.host||"").split(":")[0],f=s.url||"/";for(const w of GATEWAY_ROUTES)if(!(w.host&&!hostMatches(w.host,u))&&!(w.prefix&&!f.startsWith(w.prefix)))return w}h(matchGatewayRoute,"matchGatewayRoute"),n(matchGatewayRoute,"matchGatewayRoute");const WORKER_NAMES=(()=>{try{return JSON.parse(process.env.WORKERS||"[]")}catch{return[]}})(),LENSMCP_WS_KEY=process.env.LENSMCP_WS_KEY||"",SOCK_DIR=LENSMCP_WS_KEY?path.join(os.tmpdir(),LENSMCP_WS_KEY,`${SERVICE_NAME||"lensmcp-cluster"}-devserver`):path.join(os.tmpdir(),`${SERVICE_NAME||"lensmcp-cluster"}-devserver`),POD_GENERATION=(()=>{const s=Number(process.env.LENSMCP_POD_GENERATION);return Number.isFinite(s)&&s>1?Math.floor(s):1})();function childSockPath(s){return path.join(SOCK_DIR,POD_GENERATION>1?`child-${s}-g${POD_GENERATION}.sock`:`child-${s}.sock`)}h(childSockPath,"childSockPath"),n(childSockPath,"childSockPath");function sockOwnerPath(s){return`${s}.owner`}h(sockOwnerPath,"sockOwnerPath"),n(sockOwnerPath,"sockOwnerPath");function sockRetiringPath(s){return`${s}.retiring`}h(sockRetiringPath,"sockRetiringPath"),n(sockRetiringPath,"sockRetiringPath");function isOwnerOnlyTransport(s){try{return typeof s.socket?.server?.address?.()=="string"}catch{return!1}}h(isOwnerOnlyTransport,"isOwnerOnlyTransport"),n(isOwnerOnlyTransport,"isOwnerOnlyTransport");function tell(s,u){if(!s.connected||typeof s.send!="function")return!1;try{return s.send(u,()=>{})}catch{return!1}}h(tell,"tell"),n(tell,"tell");function gatewayManaged(s=process.env){return Number(s.LENSMCP_GATEWAY_PID??0)>0}h(gatewayManaged,"gatewayManaged"),n(gatewayManaged,"gatewayManaged");function mayDriveThePool(s,u=gatewayManaged()){return!u||isOwnerOnlyTransport(s)}h(mayDriveThePool,"mayDriveThePool"),n(mayDriveThePool,"mayDriveThePool");function refusePoolCommand(s,u){console.warn(`[devserver] refused ${s.method} ${s.url} on the public port \u2014 under a gateway the pool is driven on the control socket only.`),u.writeHead(404,{"content-type":"application/json"}),u.end(JSON.stringify({error:"not found"}))}h(refusePoolCommand,"refusePoolCommand"),n(refusePoolCommand,"refusePoolCommand"),exports.DEBUG_FIXED_PORTS_ENV="LENSMCP_DEBUG_FIXED_PORTS";function usesFixedInspectorPorts(s=process.env){const u=(s[exports.DEBUG_FIXED_PORTS_ENV]??"").trim().toLowerCase();return u==="1"||u==="true"||u==="yes"||u==="on"}h(usesFixedInspectorPorts,"usesFixedInspectorPorts"),n(usesFixedInspectorPorts,"usesFixedInspectorPorts");function inspectorPortFor(s,u,f=process.env){if(!usesFixedInspectorPorts(f))return 0;const w=Math.trunc(s)+Math.trunc(u);return Number.isInteger(w)&&w>1024&&w<=65535?w:0}h(inspectorPortFor,"inspectorPortFor"),n(inspectorPortFor,"inspectorPortFor");function inspectorPortOf(s){const u=/^wss?:\/\/[^/]*?:(\d+)\//.exec(s??""),f=u?Number(u[1]):NaN;return Number.isInteger(f)&&f>0?f:null}h(inspectorPortOf,"inspectorPortOf"),n(inspectorPortOf,"inspectorPortOf");function ensureOwnerOnlyDir(s){try{fs.mkdirSync(s,{recursive:!0,mode:448})}catch{}try{const u=fs.lstatSync(s);u.isDirectory()&&(u.mode&63)!==0&&fs.chmodSync(s,448)}catch{}}h(ensureOwnerOnlyDir,"ensureOwnerOnlyDir"),n(ensureOwnerOnlyDir,"ensureOwnerOnlyDir");function claimSock(s,u=process.pid){ensureOwnerOnlyDir(path.dirname(s));try{const f=sockOwnerPath(s);try{fs.unlinkSync(f)}catch{}fs.writeFileSync(f,String(u),{flag:"wx",mode:384})}catch{}try{fs.unlinkSync(s)}catch{}try{fs.unlinkSync(sockRetiringPath(s))}catch{}}h(claimSock,"claimSock"),n(claimSock,"claimSock");function sockOwnedByAnother(s,u=process.pid){try{const f=fs.readFileSync(sockOwnerPath(s),"utf8").trim();return!!f&&f!==String(u)}catch{return!1}}h(sockOwnedByAnother,"sockOwnedByAnother"),n(sockOwnedByAnother,"sockOwnedByAnother");function cleanupSock(s,u=process.pid){if(s){try{const f=fs.readFileSync(sockOwnerPath(s),"utf8").trim();if(f&&f!==String(u))return}catch{}try{fs.unlinkSync(s)}catch{}try{fs.unlinkSync(sockOwnerPath(s))}catch{}try{fs.unlinkSync(sockRetiringPath(s))}catch{}}}h(cleanupSock,"cleanupSock"),n(cleanupSock,"cleanupSock");function serviceKeyFingerprint(){const s=process.env.LENSMCP_SERVICE_KEY;if(!s)return;const{createHash:u}=require("node:crypto");return u("sha256").update(s).digest("hex").slice(0,8)}h(serviceKeyFingerprint,"serviceKeyFingerprint"),n(serviceKeyFingerprint,"serviceKeyFingerprint");function rootModuleOf(s){let u;for(const f of s.getModules?.()?.values()??[])typeof f?.metatype!="function"||typeof f.distance!="number"||!Number.isFinite(f.distance)||(!u||f.distance<u.distance)&&(u=f);return u?.metatype}h(rootModuleOf,"rootModuleOf"),n(rootModuleOf,"rootModuleOf");let lastImportedModule;function takeImportedModule(){const s=lastImportedModule;return lastImportedModule=void 0,s}h(takeImportedModule,"takeImportedModule"),n(takeImportedModule,"takeImportedModule");async function importFresh(spec){process.env.DEVSERVER_MODE="1";const requested=path.isAbsolute(spec)?spec:path.join(__dirname,spec);let resolved=requested;try{resolved=fs.realpathSync(requested)}catch{}eval(`(() => {
     const key = ${JSON.stringify(resolved)};
     const previous = require.cache[key];
     delete require.cache[key]; // delete from CJS cache
@@ -9,13 +9,15 @@
       const at = owner && Array.isArray(owner.children) ? owner.children.indexOf(previous) : -1;
       if (at >= 0) owner.children.splice(at, 1);
     }
-  })()`),eval(`require(${JSON.stringify(resolved)})`)}u(importFresh,"importFresh"),i(importFresh,"importFresh");function debounce(n,h){let g=null;return(..._)=>{g&&clearTimeout(g),g=setTimeout(()=>n(..._),h)}}if(u(debounce,"debounce"),i(debounce,"debounce"),process.env.APP_RUNNER==="1"){(0,stdio_guard_1.guardBrokenStdio)();const n=i(g=>{if(!inspector.url())try{inspector.open(g,"127.0.0.1",!1)}catch(B){console.warn(`[child] inspector.open(${g}) failed (port taken by another devserver?) \u2014 falling back to a random port:`,B.message);try{inspector.open(0,"127.0.0.1",!1)}catch{}}const _=inspector.url();_&&process.send&&process.send({type:"inspector-url",url:_})},"openInspector"),h=process.env.CHILD_DEBUG_PORT;if(h!==void 0&&h!==""){const g=Number(h);Number.isInteger(g)&&(g===0||g>1024)&&n(g)}try{require("@lensmcp/node-instrumentation/register")}catch{}(async()=>{let g=null,_=!1,B,j=!1;const v=(0,hot_swap_registries_1.registryPruningEnabled)(),Z=i((t,s)=>{const f=(0,hot_swap_registries_1.describePrune)(t,s);f&&console.log(f)},"logPrune");let $={app:null,handler:i((t,s)=>{s.statusCode=503,s.end("starting")},"handler"),inflight:0};const ee=(()=>{const t=Number(process.env.LENSMCP_SWAP_DRAIN_MS);return Number.isFinite(t)&&t>=0?t:15*6e4})(),Y=i(t=>{const s=globalThis.__lensmcpActiveWork;if(typeof s!="function")return{count:0};try{const f=s(t);return{count:Number(f?.count??0),...f?.oldestStartedAt?{oldestStartedAt:f.oldestStartedAt}:{}}}catch{return{count:0}}},"activeWork"),te=(()=>{const t=Number(process.env.LENSMCP_SWAP_MAX_DRAINING);return Number.isFinite(t)&&t>=1?Math.floor(t):1})(),x=new Set,P=(0,swap_recycle_1.swapRecyclePolicy)();let oe,le=0;const ge=(()=>{const t=Number(process.env.LENSMCP_POD_RETIRE_NOTICE_MS);return Number.isFinite(t)&&t>=0?t:3500})();let K=!1,V=!1,p;const E=i(()=>{if(p===void 0)try{v8.setFlagsFromString("--expose-gc");const t=vm.runInNewContext("gc");p=typeof t=="function"?t:null}catch{p=null}try{p?.()}catch{}return process.memoryUsage().heapUsed},"liveHeap"),w=(()=>{if(!(0,error_stack_release_1.errorFrameReleaseEnabled)())return null;try{const t=path.dirname(path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.join(__dirname,BUNDLE_PATH))+path.sep,s=`${path.sep}node_modules${path.sep}`,f=new Set(Object.keys(require.cache));return(0,error_stack_release_1.createErrorFrameReleaser)(require.cache,{skip:i(y=>f.has(y)||y.startsWith(t)&&!y.slice(t.length).includes(s)&&!y.slice(t.length).startsWith(`node_modules${path.sep}`),"skip")})}catch{return null}})();let O=!1;function W(){if(!(!w||O))try{const t=w();t.errors>0&&console.log(`[child] read the stack of ${t.errors} Error object(s) that libraries created while loading and keep for good \u2014 unread, each held the functions that were on its stack, this bundle's included`)}catch(t){console.error("[child] could not release library error frames:",t),O=!0}}u(W,"z"),i(W,"releaseLibraryErrorFrames");const D=new Map;let b=Date.now();const T=i(()=>P.settleMs<=0||!_&&!j&&D.size===0&&Date.now()-b>=P.settleMs,"settled");let R;function A(t){if(!(!P.enabled||K||V)){if(P.settleMs<=0){F(t);return}R&&clearTimeout(R),R=setTimeout(()=>{R=void 0,T()?F(t):A(t)},P.settleMs),R.unref?.()}}u(A,"N"),i(A,"recycleCheckWhenSettled");const ne=i(()=>{if(P.stuckCloseMs<=0)return 0;const t=Date.now();let s=0;for(const f of D.values())t-f>=P.stuckCloseMs&&(s+=1);return s},"stuckCloses");function F(t){if(!P.enabled||K||V||!process.send)return;const s=v8.getHeapStatistics().heap_size_limit,f=i(m=>({swaps:le,usedBytes:m,limitBytes:s,stuckCloses:ne(),settled:T(),...oe===void 0?{}:{baselineBytes:oe}}),"state");if(!(0,swap_recycle_1.recycleReason)(P,f(process.memoryUsage().heapUsed)))return;const y=(0,swap_recycle_1.recycleReason)(P,f(E()));y&&(K=!0,console.log(`[child] asking for a fresh pod ${t} \u2014 ${y}. This pod keeps serving until its successor is ready. Size the bound with LENSMCP_SWAP_RECYCLE_HEAP_FACTOR / _HEAP_RATIO / _MIN_MB, or turn it off with LENSMCP_SWAP_RECYCLE=0.`),process.send({type:"recycle-request",reason:y}))}u(F,"K"),i(F,"considerRecycle");async function J(t,s){if(t.closed||(t.closed=!0,x.delete(t),s&&console.error(`[child] ${s}`),!t.app))return;D.set(t,Date.now());const f=P.enabled&&P.stuckCloseMs>0?setTimeout(()=>{D.has(t)&&(console.error(`[child] a previous app has been closing for ${Math.round(P.stuckCloseMs/1e3)}s and its close() has not returned \u2014 one of its shutdown hooks is waiting on something that does not end (a queue worker, a connection, a stream). It stays in memory until this pod is replaced.`),F("with a previous app stuck in close()"))},P.stuckCloseMs):void 0;f?.unref?.();try{await t.app.close()}catch(y){console.error("[child] error closing a previous app:",y)}finally{D.delete(t),b=Date.now(),f&&clearTimeout(f),t.app=null,t.handler=(y,m)=>{m.statusCode=503,m.end("closed")}}if(t.superseded){try{Z((0,hot_swap_registries_1.pruneRegistries)(t.superseded,"serve"),"after closing the previous app")}catch(y){console.error("[child] could not release the previous app's class registrations:",y)}t.superseded=void 0}A("after closing the previous app")}u(J,"Q"),i(J,"closeGeneration");async function de(t){for(;x.size>=te;){const m=x.values().next().value;if(!m)break;await J(m,`closing a still-draining generation early \u2014 ${x.size} were pending and the cap is ${te} (each holds a whole app: DI container, DB pool, queue workers). Raise LENSMCP_SWAP_MAX_DRAINING if this pod legitimately needs more.`)}x.add(t);const s=Date.now(),f=i(()=>({inflight:t.inflight,work:Y(t.workGen).count}),"busy");for(;ee>0&&Date.now()-s<ee;){if(t.closed)return;const m=f();if(m.inflight===0&&m.work===0)break;await new Promise(C=>{setTimeout(C,250).unref?.()})}if(t.closed)return;const y=f();y.inflight>0||y.work>0?console.error(`[child] swap drain expired after ${Date.now()-s}ms \u2014 closing the previous app with ${y.inflight} in-flight request(s) and ${y.work} background job(s) still running. A queue job killed here keeps its lock until the TTL lapses. Raise LENSMCP_SWAP_DRAIN_MS (currently ${ee}ms) if this is legitimate work.`):Date.now()-s>250&&console.log(`[child] previous app drained in ${Date.now()-s}ms \u2014 closing it`),await J(t)}u(de,"he"),i(de,"drainThenClose");async function M(){if(_)return j=!0,console.log("[child] Reload deferred \u2014 will re-swap after current swap completes"),g;_=!0,b=Date.now(),process.removeAllListeners("uncaughtException"),process.removeAllListeners("unhandledRejection"),process.on("uncaughtException",(S,L)=>{console.error(`[child] uncaughtException (${L}):`,S)}),process.on("unhandledRejection",S=>{const L=S instanceof Error?S.stack||S.message:String(S);L.includes("FronteggContextScope")||L.includes("populateLoggerMetadata")||console.error("[child] unhandledRejection:",S)});let t;if(v)try{t=(0,hot_swap_registries_1.captureRegistries)()}catch{t=void 0}try{try{await importFresh(BUNDLE_PATH)}catch(S){if(!(S instanceof SyntaxError))throw S;console.warn(`[child] bundle was unreadable mid-write (${S.message}) \u2014 retrying the swap once`),await new Promise(L=>setTimeout(L,400)),await importFresh(BUNDLE_PATH)}}catch(S){throw _=!1,b=Date.now(),S}if(typeof global.createChildApp!="function")throw _=!1,b=Date.now(),new Error(`Bundle '${BUNDLE_PATH}' does not export createChildApp() and the zero-touch bridge is not active. Either install @lensmcp/node-instrumentation (a plain NestFactory.create + app.listen main.ts then just works) or set global.createChildApp in main.ts when DEVSERVER_MODE === '1'.`);let s;if(t)try{s=(0,hot_swap_registries_1.supersededSince)(t),Z((0,hot_swap_registries_1.pruneRegistries)(s,"build"),"at the swap")}catch(S){console.error("[child] could not release superseded class registrations:",S)}const f=global.__lensmcpBeginWorkGeneration,y=typeof f=="function"?f():void 0;let m;try{m=await global.createChildApp()}catch(S){throw _=!1,b=Date.now(),S}const C=$;return s?.size&&(C.app?C.superseded=s:Z((0,hot_swap_registries_1.pruneRegistries)(s,"serve"),"at the swap")),g=m,$={app:m,handler:m.handler,inflight:0,...y===void 0?{}:{workGen:y}},console.log("[child] Swapped to fresh app (previous draining in background)"),W(),C.app&&(le+=1,de(C).catch(S=>console.error("[child] background close error:",S)),setTimeout(()=>F("30s after a hot swap"),3e4).unref?.()),_=!1,b=Date.now(),j?(j=!1,M()):m}u(M,"V"),i(M,"swapNow");const re=debounce(async()=>{try{console.log("[child] /webpack/reload"),await M()}catch(t){console.error("[child] reload failed:",t)}},250),G=http.createServer((t,s)=>{if(t.method==="POST"&&t.url==="/webpack/reload"){s.writeHead(200,{"content-type":"application/json"}),s.end(JSON.stringify({ok:!0})),re();return}if(t.method==="GET"&&t.url==="/__lensmcp/alive"){const y=t.headers["x-internal-token"],m=process.env.LENSMCP_SERVICE_KEY;if(m&&y!==m){s.writeHead(404,{"content-type":"text/plain"}),s.end("not found");return}const C=Y();s.writeHead(200,{"content-type":"application/json","cache-control":"no-store"}),s.end(JSON.stringify({ok:!0,pid:process.pid,swapping:_,inflight:$.inflight,oldestInflightAt:$.oldestAt,activeWork:C.count,oldestWorkAt:C.oldestStartedAt,keyFingerprint:serviceKeyFingerprint(),...B?{watcher:B}:{},...Number.isFinite(Number(process.env.LENSMCP_POD_GENERATION))&&process.env.LENSMCP_POD_GENERATION?{podGeneration:Number(process.env.LENSMCP_POD_GENERATION)}:{}}));return}const f=$;f.inflight+=1,f.oldestAt===void 0&&(f.oldestAt=Date.now()),s.on("close",()=>{f.inflight-=1,f.inflight===0&&(f.oldestAt=void 0)}),f.handler(t,s)});G.keepAliveTimeout=0;const I=process.env.CHILD_SOCK_PATH;process.on("disconnect",()=>{cleanupSock(I),process.exit(0)});try{const t=path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.join(__dirname,BUNDLE_PATH);if((0,schema_first_instance_1.schemaPrewarmEnabled)())try{const s=(0,schema_first_instance_1.prewarmZodFor)(t);s?.created&&console.log(`[child] zod${s.version?` ${s.version}`:""}: built ${s.created} throwaway schemas first, so none of the bundle's own is the first of its class`)}catch{}if((0,redis_disconnect_fix_1.redisDisconnectFixEnabled)())try{const s=(0,redis_disconnect_fix_1.finishStrandedDisconnectsFor)(t);s?.patched&&console.log(`[child] ioredis${s.versions.length?` ${s.versions.join(", ")}`:""}: a disconnect() between reconnect attempts now ends the client \u2014 it used to leave a queue worker's close() waiting for good`)}catch{}await M(),P.enabled&&P.heapFactor>0&&(oe=E()),console.log(`[child] Using bundle: ${t}`),claimSock(I),G.listen(I,()=>{console.log(`[child] Listening on ${I}`),process.send&&process.send({type:"ready",socketPath:I})})}catch(t){console.error("[child] Startup error:",t),process.send&&process.send({type:"boot-error",error:String(t?.stack||t)}),process.exitCode=1;return}process.on("message",async t=>{if(!(!t||typeof t!="object")){if(t.type==="debug-open"){const s=Number(t.port);n(Number.isInteger(s)&&s>1024?s:0);return}if(t.type==="watcher"){const s=t.testimony;s&&typeof s=="object"&&(B=s);return}if(t.type==="recycle-declined"){K=!1;return}if(t.type==="retire"){U();return}if(t.type==="reload"){if(V)return;try{await M(),process.send&&process.send({type:"reloaded",socketPath:I})}catch(s){console.error("[child] reload error:",s),process.send&&process.send({type:"reload-error",error:String(s?.stack||s)})}}}});async function U(){if(V)return;V=!0,console.log("[child] retiring \u2014 a fresh pod has taken over; finishing in-flight work, then exiting");try{fs.writeFileSync(sockRetiringPath(I),String(process.pid),{flag:"w",mode:384})}catch{}await new Promise(s=>{setTimeout(s,ge).unref?.()}),cleanupSock(I),G.close();const t=Date.now();for(;Date.now()-t<ee&&(G.closeIdleConnections?.(),!($.inflight===0&&Y().count===0));)await new Promise(s=>{setTimeout(s,250).unref?.()});setTimeout(()=>process.exit(0),3e4).unref?.();try{await g?.close()}catch(s){console.error("[child] close error while retiring:",s)}process.exit(0)}u(U,"ee"),i(U,"retire"),process.on("beforeExit",()=>{try{inspector?.close?.()}catch{}});const X=i(async t=>{console.log(`[child ${t}] shutting down\u2026`);const s=g?.close().catch(y=>console.error("[child] close error:",y)),f=new Promise(y=>G.close(()=>y()));cleanupSock(I),setTimeout(()=>process.exit(0),700).unref(),await Promise.all([s,f]),process.exit(0)},"shutdown");["SIGINT","SIGTERM","SIGHUP","SIGQUIT","SIGUSR2"].forEach(t=>{process.on(t,()=>{inspector?.close?.(),X(t)})})})()}else{let n=u(function(p){x.push(p),x.length>te&&x.splice(0,x.length-te),ee?.write(p.replace(Y,""));for(const E of P)try{const w=E.plain?p.replace(Y,""):p;E.res.write(E.redact?redactInspectorUrls(w):w)}catch{P.delete(E)}},"P");i(n,"emitLogLine");const h=["\x1B[36m","\x1B[33m","\x1B[35m","\x1B[32m","\x1B[34m","\x1B[31m"],g="\x1B[0m",_=Math.max(1,Number(process.env.CHILD_COUNT||1)),B=LENSMCP_WS_KEY||path.basename(process.cwd()),j=i(p=>(0,process_name_1.namedExecPath)((0,process_name_1.processName)(B,SERVICE_NAME||"service",p)),"execPathFor");let v=(()=>{const p=Number(process.env.LENSMCP_DEBUG_PORT||"");return Number.isInteger(p)&&p>1024?p:0})();const Z=20;v&&(console.warn("[parent] DEBUGGER ENABLED \u2014 pods and workers open a Node inspector. Node's inspector has NO authentication: the ws:// URL's UUID is the whole credential, and any account on this host that obtains it can run code as you. Do not enable this on a shared machine. (issues/codex-security/06)"),console.warn(usesFixedInspectorPorts()?`[parent] ${exports.DEBUG_FIXED_PORTS_ENV} is set \u2014 inspectors bind PREDICTABLE ports (${v}+slot, workers ${v}+${Z}+i). Any account on this host can connect to 127.0.0.1:${v} and read the session UUID from /json/list. Unset it to use ephemeral ports.`:`[parent] Inspectors bind an EPHEMERAL loopback port; attach via the printed "Debugger listening" URL, or \`lensmcp debug <service>\` (control socket). Set ${exports.DEBUG_FIXED_PORTS_ENV}=1 for fixed ports if your IDE needs a pre-configured attach port \u2014 any account on this host can then reach them.`));const $=process.env.LENSMCP_LOG_FILE||"",ee=$?(()=>{try{fs.mkdirSync(path.dirname($),{recursive:!0});const p=fs.createWriteStream($,{flags:"a",mode:384});try{fs.chmodSync($,384)}catch{}return p}catch(p){return console.warn(`[parent] cannot open log file ${$}:`,p.message),null}})():null,Y=/\x1b\[[0-9;]*m/g,te=2e3,x=[],P=new Set;for(const p of["log","info","warn","error"]){const E=console[p].bind(console);console[p]=(...w)=>{E(...w),n(w.map(O=>typeof O=="string"?O:util.inspect(O)).join(" ")+`
-`)}}const oe=i(p=>h[(p-1)%h.length],"colorFor"),le=i(p=>{if(_===1)return"";const E=`[child#${p}] `;return`${oe(p)}${E}${g}`},"tagFor"),ge=i(p=>p.startsWith("{")&&p.endsWith("}"),"isJsonLog"),K=i((p,E,w)=>{const O=prettyFactory({sync:!0,colorize:!0,crlf:!0,messageKey:"message",errorLikeObjectKeys:["err","error"],errorProps:"type,message,stack",ignore:["logContext","context","hostname","req","res","err.driverError","module","cloudEnvironment","frontegg-application-id","frontegg-tenant-id","frontegg-trace-id","frontegg-vendor-id","host","service","version","err","error"].join(","),messageFormat:"{if module}[{module}] {end}{if context}[{context}] {end}{if logContext}[{logContext}] {end}{message}",customPrettifiers:{stack:i(b=>`
-`+String(b),"stack")}}),W=i((b,T)=>{const R=b==="stdout"?process.stdout:process.stderr;try{w?.(T)}catch{}const A=ge(T)?O(T):`${T}
-`;R.write(`${E}${A}`),n(`${E}${A}`)},"write"),D=i((b,T)=>{if(!b)return;const R=readline.createInterface({input:b});R.on("line",A=>W(T,A)),R.on("close",()=>{})},"attach");D(p.stdout,"stdout"),D(p.stderr,"stderr")},"wireProcLogging"),V=i(p=>K(p.proc,le(p.id),E=>p.tail.push(E)),"wireChildLogging");(async()=>{ensureOwnerOnlyDir(SOCK_DIR);const p=httpProxy.createProxyServer({});let E=Number(process.env.PORT)||0;E||(E=9090);const w=[],O=new Set;function W(){let e=0;for(;O.has(e);)e++;return O.add(e),e}u(W,"z"),i(W,"allocDebugSlot");let D=1,b=0,T=!1,R=_,A=[],ne=0;const F=(()=>{const e=Number(process.env.LENSMCP_POD_BOOT_GRACE_MS);return Number.isFinite(e)&&e>=0?e:12e4})(),J=i(e=>e.proc.exitCode!==null||e.proc.signalCode!==null,"childExited"),de=i(e=>e.booting&&!J(e)&&Date.now()-e.spawnedAt<F,"stillBooting");function M(){return w.filter(e=>e.healthy&&typeof e.socketPath=="string")}u(M,"V"),i(M,"healthyChildren");let re;function G(e){if(!e||typeof e!="object")return;const r=e;if(r.schemaVersion===1){re=r;for(const d of w)try{d.proc.send?.({type:"watcher",testimony:r})}catch{}}}u(G,"U"),i(G,"recordWatcherTestimony");function I(e,r=256*1024){return new Promise(d=>{let a="",c=!1;e.on("data",o=>{c||(a+=o,a.length>r&&(c=!0))}),e.on("end",()=>{if(c||!a)return d(void 0);try{d(JSON.parse(a))}catch{d(void 0)}}),e.on("error",()=>d(void 0))})}u(I,"v"),i(I,"readJsonBody");function U(){const e=M();if(e.length===0)return null;const r=b%e.length;return b=(b+1)%e.length,e[r]}u(U,"ee"),i(U,"pickChild");async function X(){const e=D++,r=childSockPath(e);cleanupSock(r);const d=["--enable-source-maps"];__filename.endsWith(".ts")&&d.unshift("--require","@swc-node/register");const a=v?W():-1,c=(0,node_child_process_1.fork)(__filename,{env:{...process.env,APP_RUNNER:"1",CHILD_SOCK_PATH:r,...a>=0&&{CHILD_DEBUG_PORT:String(inspectorPortFor(v,a))}},stdio:["inherit","pipe","pipe","ipc"],execArgv:d,execPath:j("pod")}),o={id:e,proc:c,healthy:!1,lastError:null,debugSlot:a,tail:new exit_reason_1.TailBuffer,booting:!0,spawnedAt:Date.now(),bootReloadSeq:ne};return c.on("message",k=>{if(!k||typeof k!="object")return;const l=k;if(l.type==="ready"){if(o.socketPath=String(l.socketPath),o.healthy=!0,o.booting=!1,console.log(`[parent] Child#${o.id} ready on socket ${o.socketPath}`),re)try{c.send?.({type:"watcher",testimony:re})}catch{}if(ne!==o.bootReloadSeq)try{c.send?.({type:"reload"})}catch{}}else l.type==="recycle-request"?L(o,String(l.reason||"it has outgrown its bound")):l.type==="inspector-url"?(o.inspectorUrl=String(l.url),console.log(`[parent] Child#${o.id} Debugger listening on ${l.url}`)):l.type==="reloaded"?(o.socketPath=String(l.socketPath),o.healthy=!0,console.log(`[parent] Child#${o.id} hot-swapped on socket ${o.socketPath}`)):l.type==="reload-error"?(o.lastError=String(l.error||"unknown reload error"),console.error(`[parent] Child#${o.id} reload error: ${o.lastError}`),o.healthy=!1):l.type==="boot-error"&&(o.lastError=String(l.error||"unknown boot error"),console.error(`[parent] Child#${o.id} boot error: ${o.lastError}`),o.healthy=!1,o.booting=!1)}),c.on("exit",(k,l)=>{o.booting=!1,o.debugSlot>=0&&(O.delete(o.debugSlot),o.debugSlot=-1);const N=l==="SIGINT"||l==="SIGTERM"||k===0;if(N?console.log(`[parent] Child#${o.id} exited cleanly (code=${k}, signal=${l??"none"})`):(console.error((0,exit_reason_1.crashReport)(`[parent] Child#${o.id} crashed (code=${k}, signal=${l??"none"}, pid=${o.proc.pid}, ${o.healthy?"was serving":"was not ready"})`,k,l,o.tail.snapshot())),o.lastError||(o.lastError=`Child exited abnormally (code=${k}, signal=${l??"none"})`)),o.healthy=!1,cleanupSock(o.socketPath,o.proc.pid),o.socketPath=void 0,!N&&!T){const q=w.indexOf(o);q>=0&&w.splice(q,1);const ae=Date.now();if(A=A.filter(Q=>ae-Q<3e4),A.length>=5){console.error(`[parent] crash-loop detected (${A.length} respawns/30s) \u2014 pausing auto-respawn; POST /webpack/reload to retry`);return}A.push(ae),setTimeout(()=>{const Q=w.filter($e=>$e.proc.killed===!1).length;!T&&Q<R&&(console.log(`[parent] respawning a crashed pod (${Q}/${R} live)`),X().catch(()=>{}))},1500).unref?.()}}),w.push(o),V(o),o}u(X,"te"),i(X,"spawnChild");async function t(e){R=Math.max(R,e);const r=w.filter(a=>a.proc.killed===!1),d=e-r.length;for(let a=0;a<d;a++)await X()}u(t,"r"),i(t,"ensurePoolSize");async function s(){const e=w.filter(r=>(!r.healthy||typeof r.socketPath!="string")&&!de(r));await Promise.all(e.map(async r=>{try{r.proc.kill("SIGTERM")}catch{}cleanupSock(r.socketPath,r.proc.pid),r.socketPath=void 0;const d=w.indexOf(r);d>=0&&w.splice(d,1),await X()}))}u(s,"c"),i(s,"respawnUnhealthy");const f=new Set;let y=!1,m=0;const C=3e4,S=(()=>{const e=Number(process.env.LENSMCP_SWAP_DRAIN_MS);return(Number.isFinite(e)&&e>=0?e:15*6e4)+6e4})();async function L(e,r){const d=i(c=>{console.log(`[parent] Child#${e.id} asked for a fresh pod (${r}) \u2014 not now: ${c}`);try{e.proc.send?.({type:"recycle-declined"})}catch{}},"decline");if(T||!w.includes(e))return;if(y)return d("another pod is already being replaced");const a=Date.now()-m;if(a<C)return d(`a pod was replaced ${Math.round(a/1e3)}s ago`);y=!0,console.log(`[parent] Child#${e.id} asked for a fresh pod \u2014 ${r}. Starting one; Child#${e.id} keeps serving until it is ready.`);try{const c=await X(),o=Date.now()+F;for(;!c.healthy&&!c.lastError&&!J(c)&&Date.now()<o;)await new Promise(N=>{setTimeout(N,100).unref?.()});if(T)return;if(!c.healthy){const N=w.indexOf(c);N>=0&&w.splice(N,1);try{c.proc.kill("SIGTERM")}catch{}return d(`its successor Child#${c.id} did not come up (${c.lastError??"no answer in time"})`)}const k=w.indexOf(e);k>=0&&w.splice(k,1),e.healthy=!1,f.add(e);const l=setTimeout(()=>{if(!J(e)){console.error(`[parent] Child#${e.id} was still running ${S}ms after it was retired \u2014 killing it`);try{e.proc.kill("SIGKILL")}catch{}}},S);l.unref?.(),e.proc.once("exit",()=>{clearTimeout(l),f.delete(e)});try{e.proc.send?.({type:"retire"})}catch{try{e.proc.kill("SIGTERM")}catch{}}m=Date.now(),console.log(`[parent] Child#${c.id} took over from Child#${e.id} (pid ${e.proc.pid} \u2192 ${c.proc.pid})`)}catch(c){d(`could not start a successor: ${c?.message??String(c)}`)}finally{y=!1}}u(L,"x"),i(L,"recyclePod");const H=[];function ye(e){const r=path.dirname(path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.resolve(BUNDLE_PATH)),d=path.join(r,`${e}.js`);if(!fs.existsSync(d))return console.error(`[parent] Worker "${e}" bundle not found: ${d}`),null;const a=["--enable-source-maps"];__filename.endsWith(".ts")&&a.unshift("--require","@swc-node/register");try{a.push("--require",require.resolve("@lensmcp/node-instrumentation/register"))}catch{}const c=inspectorPortFor(v||9229,Z+Math.max(0,WORKER_NAMES.indexOf(e)));a.push(v?`--inspect=127.0.0.1:${c}`:`--inspect-port=127.0.0.1:${c}`);const o=(0,node_child_process_1.fork)(d,{env:process.env,stdio:["inherit","pipe","pipe","ipc"],execArgv:a,execPath:j(`w-${e}`)}),k={name:e,proc:o,debugPort:c};return H.push(k),K(o,`\x1B[35m[worker:${e}] \x1B[0m`,l=>{const N=/Debugger listening on (wss?:\/\/\S+)/.exec(l);N&&(k.inspectorUrl=N[1])}),o.on("exit",(l,N)=>{N==="SIGINT"||N==="SIGTERM"||l===0||console.error(`[parent] Worker "${e}" crashed (code=${l}, signal=${N??"none"})`);const q=H.indexOf(k);q>=0&&H.splice(q,1)}),console.log(`[parent] Worker "${e}" started (pid=${o.pid})`),k}u(ye,"we"),i(ye,"spawnWorkerProcess");const me=(()=>{const e=Number(process.env.LENSMCP_SWAP_DRAIN_MS);return Number.isFinite(e)&&e>=0?e:15*6e4})(),Se=(()=>{const e=Number(process.env.LENSMCP_SWAP_MAX_DRAINING);return Number.isFinite(e)&&e>=1?Math.floor(e):1})(),se=new Set,Pe=i(e=>e.proc.exitCode!==null||e.proc.signalCode!==null,"workerExited");function pe(e,r){if(se.delete(e),!Pe(e)){console.error(`[parent] Worker "${e.name}" (pid=${e.proc.pid}) ${r} \u2014 killing it. A worker that returns from its SIGTERM handler but leaves a handle open (a Redis client handed to BullMQ is not closed by worker.close()) never exits on its own: close what it opened, or call process.exit().`);try{e.proc.kill("SIGKILL")}catch{}}}u(pe,"fe"),i(pe,"killDrainingWorker");function ke(e){try{e.proc.kill("SIGTERM")}catch{}if(Pe(e))return;const r=[...se].filter(a=>a.name===e.name);for(;r.length>=Se;)pe(r.shift(),`was still running when a later reload replaced its successor (cap ${Se})`);se.add(e);const d=setTimeout(()=>pe(e,`was still running ${me}ms after SIGTERM`),me);d.unref?.(),e.proc.once("exit",()=>{clearTimeout(d),se.delete(e)})}u(ke,"Ae"),i(ke,"retireWorker");function be(){for(const e of[...H])ke(e);H.length=0;for(const e of WORKER_NAMES)ye(e)}u(be,"Te"),i(be,"restartWorkers");const Ae=debounce(async()=>{ne+=1;const e=M();if(e.length>0){console.log(`[parent] Forwarding reload to ${e.length} child(ren)`);for(const r of e)r.proc.send?.({type:"reload"})}await s(),WORKER_NAMES.length>0&&be()},200),ie=i(async(e,r)=>{if(e.method==="POST"&&e.url==="/webpack/reload"){r.writeHead(200,{"content-type":"application/json"}),r.end(JSON.stringify({ok:!0})),I(e).then(c=>G(c?.watcher)),Ae();return}if(e.method==="POST"&&e.url==="/webpack/watching"){const c=await I(e);G(c),r.writeHead(200,{"content-type":"application/json"}),r.end(JSON.stringify({ok:!0,relayed:re!==void 0}));return}if(e.method==="POST"&&e.url==="/webpack/scale"){let c="";e.on("data",o=>{c+=o}),e.on("end",async()=>{let o=0;try{o=Number(JSON.parse(c||"{}").pods)||0}catch{}o=Math.max(1,Math.min(o,16)),await t(o),r.writeHead(200,{"content-type":"application/json"}),r.end(JSON.stringify({ok:!0,pods:o}))});return}if(e.method==="GET"&&e.url?.startsWith("/webpack/logs")){const c=new URL(e.url,"http://localhost").searchParams,o=Math.min(Math.max(Number(c.get("tail")??"100")||0,0),te),k=c.get("follow")!=="0",l=c.get("plain")==="1",N=!isOwnerOnlyTransport(e);r.writeHead(200,{"content-type":"text/plain; charset=utf-8","cache-control":"no-cache"});const q=o===0?"":x.slice(-o).join(""),ae=l?q.replace(Y,""):q;if(r.write(N?redactInspectorUrls(ae):ae),!k){r.end();return}const Q={res:r,plain:l,redact:N};P.add(Q),e.on("close",()=>P.delete(Q));return}if(e.method==="POST"&&e.url?.startsWith("/webpack/debug")){if(!isOwnerOnlyTransport(e)){r.writeHead(404,{"content-type":"application/json"}),r.end(JSON.stringify({error:"not found"}));return}const c=Number(new URL(e.url,"http://localhost").searchParams.get("port")||"");Number.isInteger(c)&&c>1024&&(v=c),v||(v=9229);const o=w.filter(l=>l.proc.exitCode===null&&l.proc.signalCode===null);for(const l of o){l.debugSlot<0&&(l.debugSlot=W());try{l.proc.send?.({type:"debug-open",port:inspectorPortFor(v,l.debugSlot)})}catch{}}for(const l of H)try{l.proc.kill("SIGUSR1")}catch{}const k=Date.now()+2e3;for(;Date.now()<k&&o.some(l=>!l.inspectorUrl);)await new Promise(l=>setTimeout(l,50));r.writeHead(200,{"content-type":"application/json"}),r.end(JSON.stringify({ok:!0,basePort:v,fixedPorts:usesFixedInspectorPorts(),pods:o.map(l=>({id:l.id,inspectorUrl:l.inspectorUrl??null})),workers:H.map(l=>({name:l.name,port:l.debugPort||inspectorPortOf(l.inspectorUrl),inspectorUrl:l.inspectorUrl??null}))},null,2)+`
-`);return}const d=matchGatewayRoute(e);if(d?.prependPrefix&&!e.url?.startsWith(d.prependPrefix)&&(e.url=d.prependPrefix+(e.url??"/")),d?.target){applyGatewayMiddleware(e),p.web(e,r,{target:d.target,autoRewrite:typeof d.target=="string",changeOrigin:!0},c=>{console.error(`[parent] proxy error to ${d.target}:`,c),r.statusCode=502,r.setHeader("content-type","text/plain; charset=utf-8"),r.end(`Upstream error from ${d.target}.`)});return}if(SERVICE_PREFIX){if(!e.url?.startsWith(SERVICE_PREFIX)){r.writeHead(404,{"content-type":"text/plain; charset=utf-8"}),r.end(`Not found. This service is mounted at ${SERVICE_PREFIX}/`);return}e.url=e.url.slice(SERVICE_PREFIX.length)||"/"}applyGatewayMiddleware(e);const a=U();if(!a){r.statusCode=503,r.setHeader("content-type","text/plain; charset=utf-8");const c=w.map(o=>`#${o.id}: ${o.lastError??"no error recorded"}`).join(`
-`);r.end(`No healthy children available. POST /webpack/reload to recover.
+  })()`);const exports=eval(`require(${JSON.stringify(resolved)})`);try{const mod=eval("require.cache")[resolved];lastImportedModule=mod&&typeof mod=="object"?mod:void 0}catch{}return exports}h(importFresh,"importFresh"),n(importFresh,"importFresh");function debounce(s,u){let f=null;return(...w)=>{f&&clearTimeout(f),f=setTimeout(()=>s(...w),u)}}if(h(debounce,"debounce"),n(debounce,"debounce"),process.env.APP_RUNNER==="1"){(0,stdio_guard_1.guardBrokenStdio)();const s=n(f=>{if(!inspector.url())try{inspector.open(f,"127.0.0.1",!1)}catch(F){console.warn(`[child] inspector.open(${f}) failed (port taken by another devserver?) \u2014 falling back to a random port:`,F.message);try{inspector.open(0,"127.0.0.1",!1)}catch{}}const w=inspector.url();w&&tell(process,{type:"inspector-url",url:w})},"openInspector"),u=process.env.CHILD_DEBUG_PORT;if(u!==void 0&&u!==""){const f=Number(u);Number.isInteger(f)&&(f===0||f>1024)&&s(f)}try{require("@lensmcp/node-instrumentation/register")}catch{}(async()=>{let f=null,w=!1,F,Q=!1;const Re=(0,hot_swap_registries_1.registryPruningEnabled)(),oe=n((t,i)=>{const p=(0,hot_swap_registries_1.describePrune)(t,i);p&&console.log(p)},"logPrune");let j={app:null,handler:n((t,i)=>{i.statusCode=503,i.end("starting")},"handler"),inflight:0};const ne=(()=>{const t=Number(process.env.LENSMCP_SWAP_DRAIN_MS);return Number.isFinite(t)&&t>=0?t:15*6e4})(),I=n(t=>{const i=globalThis.__lensmcpActiveWork;if(typeof i!="function")return{count:0};try{const p=i(t);return{count:Number(p?.count??0),...p?.oldestStartedAt?{oldestStartedAt:p.oldestStartedAt}:{}}}catch{return{count:0}}},"activeWork"),ue=n(t=>{const i=globalThis.__lensmcpStopWorkIntake;if(typeof i=="function")try{return i(t)}catch{return}},"stopWorkIntake"),se=n(t=>{const i=globalThis.__lensmcpWorkIntakeReport;if(!(t===void 0||typeof i!="function"))try{return i(t)??void 0}catch{return}},"workIntakeReport"),we=(()=>{const t=Number(process.env.LENSMCP_SWAP_MAX_DRAINING);return Number.isFinite(t)&&t>=1?Math.floor(t):1})(),Y=new Set,A=(0,swap_recycle_1.swapRecyclePolicy)();let H,K=0;const Ee=(()=>{const t=Number(process.env.LENSMCP_POD_RETIRE_NOTICE_MS);return Number.isFinite(t)&&t>=0?t:3500})();let ie=!1,Z=!1;const $e=(0,pod_memory_1.podMemoryPolicy)();let Se=0;const C=(0,pod_memory_1.createPodMemoryMonitor)({policy:$e,state:n(()=>({gen:j.gen??0,swaps:K,...H===void 0?{}:{baseline:H},busy:w||Q||N.size>0,lastBusyAt:O}),"state"),send:n(t=>{tell(process,t)},"send"),counter:(0,pod_memory_1.createLiveObjectCounter)(path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.join(__dirname,BUNDLE_PATH)),onRetained:n(()=>ce(),"onRetained")}),g=n(()=>((0,pod_memory_1.fullGc)()&&C.tracker.noteGc(),process.memoryUsage().heapUsed),"liveHeap"),P=(()=>{if(!(0,error_stack_release_1.errorFrameReleaseEnabled)())return null;try{const t=path.dirname(path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.join(__dirname,BUNDLE_PATH))+path.sep,i=`${path.sep}node_modules${path.sep}`,p=new Set(Object.keys(require.cache));return(0,error_stack_release_1.createErrorFrameReleaser)(require.cache,{skip:n(m=>p.has(m)||m.startsWith(t)&&!m.slice(t.length).includes(i)&&!m.slice(t.length).startsWith(`node_modules${path.sep}`),"skip")})}catch{return null}})();let E=!1;function B(){if(!(!P||E))try{const t=P();t.errors>0&&console.log(`[child] read the stack of ${t.errors} Error object(s) that libraries created while loading and keep for good \u2014 unread, each held the functions that were on its stack, this bundle's included`)}catch(t){console.error("[child] could not release library error frames:",t),E=!0}}h(B,"B"),n(B,"releaseLibraryErrorFrames");const N=new Map;let O=Date.now();const D=n(()=>A.settleMs<=0||!w&&!Q&&N.size===0&&Date.now()-O>=A.settleMs,"settled");let T;function $(t){if(!(!A.enabled||ie||Z)){if(A.settleMs<=0){V(t);return}T&&clearTimeout(T),T=setTimeout(()=>{T=void 0,D()?V(t):$(t)},A.settleMs),T.unref?.()}}h($,"D"),n($,"recycleCheckWhenSettled");const x=n(()=>{if(A.stuckCloseMs<=0)return 0;const t=Date.now();let i=0;for(const p of N.values())t-p>=A.stuckCloseMs&&(i+=1);return i},"stuckCloses");function V(t){if(!A.enabled||ie||Z||!process.send)return;const i=v8.getHeapStatistics().heap_size_limit,p=n(_=>{const S=C.oldestRetained();return{swaps:K,usedBytes:_,limitBytes:i,stuckCloses:x(),settled:D(),...H===void 0?{}:{baselineBytes:H},...S?{retained:{generation:S.gen,ageMs:Date.now()-S.closedAt,gcs:S.gcs}}:{}}},"state");if(!(0,swap_recycle_1.recycleReason)(A,p(process.memoryUsage().heapUsed)))return;const m=(0,swap_recycle_1.recycleReason)(A,p(g()));m&&(ie=!0,console.log(`[child] asking for a fresh pod ${t} \u2014 ${m}. This pod keeps serving until its successor is ready. Size the bound with LENSMCP_SWAP_RECYCLE_HEAP_FACTOR / _HEAP_RATIO / _MIN_MB / _RETAINED_MS, or turn it off with LENSMCP_SWAP_RECYCLE=0.`),tell(process,{type:"recycle-request",reason:m}))}h(V,"V"),n(V,"considerRecycle");let ae;function ce(){if(!A.enabled||A.retainedMs<=0||ie||Z)return;const t=C.oldestRetained();if(!t)return;const i=t.closedAt+A.retainedMs-Date.now();if(i<=0){V("with a closed generation still in memory");return}ae||(ae=setTimeout(()=>{ae=void 0,C.measure("retention-check").catch(()=>{})},i),ae.unref?.())}h(ce,"ce"),n(ce,"retainedRecycleCheck");function Pe(t,i){const p={};i&&(p.module=i),t&&(p.app=t);try{const m=t?.app;if(m&&typeof m=="object"&&(p.nestApp=m,m.container&&typeof m.container=="object")){p.container=m.container;const _=rootModuleOf(m.container);_&&(p.rootModule=_)}}catch{}return p}h(Pe,"Te"),n(Pe,"generationTargets");async function ee(t,i){if(t.closed||(t.closed=!0,Y.delete(t),i&&console.error(`[child] ${i}`),!t.app))return;N.set(t,Date.now());const p=A.enabled&&A.stuckCloseMs>0?setTimeout(()=>{N.has(t)&&(console.error(`[child] a previous app has been closing for ${Math.round(A.stuckCloseMs/1e3)}s and its close() has not returned \u2014 one of its shutdown hooks is waiting on something that does not end (a queue worker, a connection, a stream). It stays in memory until this pod is replaced.`),V("with a previous app stuck in close()"))},A.stuckCloseMs):void 0;p?.unref?.();const m=t.app;try{await t.app.close()}catch(_){console.error("[child] error closing a previous app:",_)}finally{N.delete(t),O=Date.now(),p&&clearTimeout(p),t.app=null,t.handler=(_,S)=>{S.statusCode=503,S.end("closed")},t.gen!==void 0&&C.closed(t.gen,K,Pe(m,t.module)),t.module=void 0}if(t.superseded){try{oe((0,hot_swap_registries_1.pruneRegistries)(t.superseded,"serve"),"after closing the previous app")}catch(_){console.error("[child] could not release the previous app's class registrations:",_)}t.superseded=void 0}$("after closing the previous app")}h(ee,"ae"),n(ee,"closeGeneration");async function le(t){for(;Y.size>=we;){const S=Y.values().next().value;if(!S)break;await ee(S,`closing a still-draining generation early \u2014 ${Y.size} were pending and the cap is ${we} (each holds a whole app: DI container, DB pool, queue workers). Raise LENSMCP_SWAP_MAX_DRAINING if this pod legitimately needs more.`)}Y.add(t);const i=Date.now(),p=n(()=>({inflight:t.inflight,work:I(t.workGen).count}),"busy");for(;ne>0&&Date.now()-i<ne;){if(t.closed)return;const S=p();if(S.inflight===0&&S.work===0)break;await new Promise(X=>{setTimeout(X,250).unref?.()})}if(t.closed)return;const m=p(),_=se(t.workGen);m.inflight>0||m.work>0?console.error(`[child] swap drain expired after ${Date.now()-i}ms \u2014 closing the previous app with ${m.inflight} in-flight request(s) and ${m.work} background job(s) still running. `+(_?`Previous app still processing ${_.running} queue job(s); ${_.takenAfterStop} were taken after the swap. `:"")+`A queue job killed here keeps its lock until the TTL lapses. Raise LENSMCP_SWAP_DRAIN_MS (currently ${ne}ms) if this is legitimate work.`):(Date.now()-i>250||_?.runningAtStop||_?.takenAfterStop)&&console.log(`[child] previous app drained in ${Date.now()-i}ms \u2014 closing it`+(_?` (it finished ${_.finishedAfterStop} queue job(s) after the swap; ${_.takenAfterStop} were taken after the swap)`:"")),await ee(t)}h(le,"le"),n(le,"drainThenClose");async function J(){if(w)return Q=!0,console.log("[child] Reload deferred \u2014 will re-swap after current swap completes"),f;w=!0,O=Date.now(),process.removeAllListeners("uncaughtException"),process.removeAllListeners("unhandledRejection"),process.on("uncaughtException",(k,z)=>{console.error(`[child] uncaughtException (${z}):`,k)}),process.on("unhandledRejection",k=>{const z=k instanceof Error?k.stack||k.message:String(k);z.includes("FronteggContextScope")||z.includes("populateLoggerMetadata")||console.error("[child] unhandledRejection:",k)});let t;if(Re)try{t=(0,hot_swap_registries_1.captureRegistries)()}catch{t=void 0}const i=global.__lensmcpBeginWorkGeneration,p=typeof i=="function"?i():void 0;try{try{await importFresh(BUNDLE_PATH)}catch(k){if(!(k instanceof SyntaxError))throw k;console.warn(`[child] bundle was unreadable mid-write (${k.message}) \u2014 retrying the swap once`),await new Promise(z=>setTimeout(z,400)),await importFresh(BUNDLE_PATH)}}catch(k){throw w=!1,O=Date.now(),k}if(typeof global.createChildApp!="function")throw w=!1,O=Date.now(),new Error(`Bundle '${BUNDLE_PATH}' does not export createChildApp() and the zero-touch bridge is not active. Either install @lensmcp/node-instrumentation (a plain NestFactory.create + app.listen main.ts then just works) or set global.createChildApp in main.ts when DEVSERVER_MODE === '1'.`);let m;if(t)try{m=(0,hot_swap_registries_1.supersededSince)(t),oe((0,hot_swap_registries_1.pruneRegistries)(m,"build"),"at the swap")}catch(k){console.error("[child] could not release superseded class registrations:",k)}let _;try{_=await global.createChildApp()}catch(k){throw w=!1,O=Date.now(),takeImportedModule(),k}const S=j;m?.size&&(S.app?S.superseded=m:oe((0,hot_swap_registries_1.pruneRegistries)(m,"serve"),"at the swap")),f=_;const X=takeImportedModule();j={app:_,handler:_.handler,inflight:0,gen:++Se,...X?{module:X}:{},...p===void 0?{}:{workGen:p}};const L=S.app&&p!==void 0?ue(p):void 0;return console.log("[child] Swapped to fresh app (previous draining in background)"+(L?.workers?`; its ${L.workers} queue worker(s) stopped taking new jobs, previous app still processing ${L.runningAtStop} job(s)`:"")),B(),S.app&&(K+=1,le(S).catch(k=>console.error("[child] background close error:",k)),setTimeout(()=>V("30s after a hot swap"),3e4).unref?.(),C.swapped(S.gen,()=>S.closed===!0&&!N.has(S))),w=!1,O=Date.now(),Q?(Q=!1,J()):_}h(J,"re"),n(J,"swapNow");const he=debounce(async()=>{try{console.log("[child] /webpack/reload"),await J()}catch(t){console.error("[child] reload failed:",t)}},250),q=http.createServer((t,i)=>{if(t.method==="POST"&&t.url==="/webpack/reload"){i.writeHead(200,{"content-type":"application/json"}),i.end(JSON.stringify({ok:!0})),he();return}if(t.method==="GET"&&t.url==="/__lensmcp/alive"){const m=t.headers["x-internal-token"],_=process.env.LENSMCP_SERVICE_KEY;if(_&&m!==_){i.writeHead(404,{"content-type":"text/plain"}),i.end("not found");return}const S=I();i.writeHead(200,{"content-type":"application/json","cache-control":"no-store"}),i.end(JSON.stringify({ok:!0,pid:process.pid,swapping:w,inflight:j.inflight,oldestInflightAt:j.oldestAt,activeWork:S.count,oldestWorkAt:S.oldestStartedAt,keyFingerprint:serviceKeyFingerprint(),...F?{watcher:F}:{},...Number.isFinite(Number(process.env.LENSMCP_POD_GENERATION))&&process.env.LENSMCP_POD_GENERATION?{podGeneration:Number(process.env.LENSMCP_POD_GENERATION)}:{}}));return}const p=j;p.inflight+=1,p.oldestAt===void 0&&(p.oldestAt=Date.now()),i.on("close",()=>{p.inflight-=1,p.inflight===0&&(p.oldestAt=void 0),C.activity()}),p.handler(t,i)});q.keepAliveTimeout=0;const G=process.env.CHILD_SOCK_PATH;process.on("disconnect",()=>{cleanupSock(G),process.exit(0)});try{const t=path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.join(__dirname,BUNDLE_PATH);if((0,schema_first_instance_1.schemaPrewarmEnabled)())try{const i=(0,schema_first_instance_1.prewarmZodFor)(t);i?.created&&console.log(`[child] zod${i.version?` ${i.version}`:""}: built ${i.created} throwaway schemas first, so none of the bundle's own is the first of its class`)}catch{}if((0,redis_disconnect_fix_1.redisDisconnectFixEnabled)())try{const i=(0,redis_disconnect_fix_1.finishStrandedDisconnectsFor)(t);i?.patched&&console.log(`[child] ioredis${i.versions.length?` ${i.versions.join(", ")}`:""}: a disconnect() between reconnect attempts now ends the client \u2014 it used to leave a queue worker's close() waiting for good`)}catch{}await J(),H=(await C.booted()).live,console.log(`[child] Using bundle: ${t}`),claimSock(G),q.listen(G,()=>{console.log(`[child] Listening on ${G}`),tell(process,{type:"ready",socketPath:G})})}catch(t){console.error("[child] Startup error:",t),tell(process,{type:"boot-error",error:String(t?.stack||t)}),process.exitCode=1;return}process.on("message",async t=>{if(!(!t||typeof t!="object")){if(t.type==="debug-open"){const i=Number(t.port);s(Number.isInteger(i)&&i>1024?i:0);return}if(t.type==="watcher"){const i=t.testimony;i&&typeof i=="object"&&(F=i);return}if(t.type==="heap-snapshot"){ke(t);return}if(t.type==="recycle-declined"){ie=!1;return}if(t.type==="retire"){re();return}if(t.type==="reload"){if(Z)return;try{await J(),tell(process,{type:"reloaded",socketPath:G})}catch(i){console.error("[child] reload error:",i),tell(process,{type:"reload-error",error:String(i?.stack||i)})}}}});let te=!1;async function ke(t){const i=n(p=>{tell(process,{type:"heap-snapshot-result",id:t.id,...p})},"reply");if(te)return i({ok:!1,refused:"a snapshot of this pod is already being written"});te=!0;try{const p=g(),m=C.tracker.views().map(X=>X.gen),_=(0,heap_snapshot_1.heapSnapshotRefusal)((0,heap_snapshot_1.heapSnapshotPolicy)(),{live:p,...t.available?{available:t.available}:{}});if(_)return i({ok:!1,refused:_,live:p});console.log(`[child] writing a heap snapshot (${Math.round(p/1048576)} MB live) \u2014 the pod pauses while V8 serialises it`);const S=await(0,heap_snapshot_1.writeHeapSnapshot)(t.file);i({ok:!0,file:t.file,bytes:S.bytes,ms:S.ms,live:p,gen:j.gen??0,closedAlive:m})}catch(p){i({ok:!1,error:p?.message??String(p)})}finally{te=!1}}h(ke,"Ne"),n(ke,"takeHeapSnapshot");async function re(){if(Z)return;Z=!0,C.stop(),console.log("[child] retiring \u2014 a fresh pod has taken over; finishing in-flight work, then exiting");const t=ue(Number.POSITIVE_INFINITY);t?.workers&&console.log(`[child] its ${t.workers} queue worker(s) stopped taking new jobs, still processing ${t.runningAtStop} job(s)`);try{fs.writeFileSync(sockRetiringPath(G),String(process.pid),{flag:"w",mode:384})}catch{}await new Promise(p=>{setTimeout(p,Ee).unref?.()}),cleanupSock(G),q.close();const i=Date.now();for(;Date.now()-i<ne&&(q.closeIdleConnections?.(),!(j.inflight===0&&I().count===0));)await new Promise(p=>{setTimeout(p,250).unref?.()});setTimeout(()=>process.exit(0),3e4).unref?.();try{await f?.close()}catch(p){console.error("[child] close error while retiring:",p)}process.exit(0)}h(re,"de"),n(re,"retire"),process.on("beforeExit",()=>{try{inspector?.close?.()}catch{}});const fe=n(async t=>{console.log(`[child ${t}] shutting down\u2026`);const i=f?.close().catch(m=>console.error("[child] close error:",m)),p=new Promise(m=>q.close(()=>m()));cleanupSock(G),setTimeout(()=>process.exit(0),700).unref(),await Promise.all([i,p]),process.exit(0)},"shutdown");["SIGINT","SIGTERM","SIGHUP","SIGQUIT","SIGUSR2"].forEach(t=>{process.on(t,()=>{inspector?.close?.(),fe(t)})})})()}else{let s=h(function(g){H.push(g),H.length>A&&H.splice(0,H.length-A),we?.write((0,inspector_secret_1.redactInspectorUrls)(g.replace(Y,"")));for(const P of K)try{const E=P.plain?g.replace(Y,""):g;P.res.write(P.redact?(0,inspector_secret_1.redactInspectorUrls)(E):E)}catch{K.delete(P)}},"Z");n(s,"emitLogLine");const u=12,f=process.env.LENSMCP_PROJECT||SERVICE_NAME||"service",w=(0,pod_memory_events_1.createPodMemoryPublisher)(process.env.LENSMCP_EVENT_FILE),F=n(g=>({project:f,service:SERVICE_NAME||f,pod:g.id,pid:g.proc.pid??0,podGeneration:POD_GENERATION}),"podIdentity"),Q=["\x1B[36m","\x1B[33m","\x1B[35m","\x1B[32m","\x1B[34m","\x1B[31m"],Re="\x1B[0m",oe=Math.max(1,Number(process.env.CHILD_COUNT||1)),j=LENSMCP_WS_KEY||path.basename(process.cwd()),ne=n(g=>(0,process_name_1.namedExecPath)((0,process_name_1.processName)(j,SERVICE_NAME||"service",g)),"execPathFor");let I=(()=>{const g=Number(process.env.LENSMCP_DEBUG_PORT||"");return Number.isInteger(g)&&g>1024?g:0})();const ue=20;I&&(console.warn("[parent] DEBUGGER ENABLED \u2014 pods and workers open a Node inspector. Node's inspector has NO authentication: the ws:// URL's UUID is the whole credential, and any account on this host that obtains it can run code as you. Do not enable this on a shared machine. (issues/closed/codex-security-06)"),console.warn(usesFixedInspectorPorts()?`[parent] ${exports.DEBUG_FIXED_PORTS_ENV} is set \u2014 inspectors bind PREDICTABLE ports (${I}+slot, workers ${I}+${ue}+i). Any account on this host can connect to 127.0.0.1:${I} and read the session UUID from /json/list. Unset it to use ephemeral ports.`:`[parent] Inspectors bind an EPHEMERAL loopback port; attach via the printed "Debugger listening" URL, or \`lensmcp debug <service>\` (control socket). Set ${exports.DEBUG_FIXED_PORTS_ENV}=1 for fixed ports if your IDE needs a pre-configured attach port \u2014 any account on this host can then reach them.`));const se=process.env.LENSMCP_LOG_FILE||"",we=se?(()=>{try{fs.mkdirSync(path.dirname(se),{recursive:!0});const g=fs.createWriteStream(se,{flags:"a",mode:384});try{fs.chmodSync(se,384)}catch{}return g}catch(g){return console.warn(`[parent] cannot open log file ${se}:`,g.message),null}})():null,Y=/\x1b\[[0-9;]*m/g,A=2e3,H=[],K=new Set,Ee=gatewayManaged();for(const g of["log","info","warn","error"]){const P=console[g].bind(console),E=g==="log"||g==="info"?process.stdout:process.stderr;console[g]=(...B)=>{P(...B.map(N=>typeof N=="string"?(0,inspector_secret_1.forStream)(E,Ee,N):N)),s(B.map(N=>typeof N=="string"?N:util.inspect(N)).join(" ")+`
+`)}}const ie=n(g=>Q[(g-1)%Q.length],"colorFor"),Z=n(g=>{if(oe===1)return"";const P=`[child#${g}] `;return`${ie(g)}${P}${Re}`},"tagFor"),$e=n(g=>g.startsWith("{")&&g.endsWith("}"),"isJsonLog"),Se=n((g,P,E)=>{const B=prettyFactory({sync:!0,colorize:!0,crlf:!0,messageKey:"message",errorLikeObjectKeys:["err","error"],errorProps:"type,message,stack",ignore:["logContext","context","hostname","req","res","err.driverError","module","cloudEnvironment","frontegg-application-id","frontegg-tenant-id","frontegg-trace-id","frontegg-vendor-id","host","service","version","err","error"].join(","),messageFormat:"{if module}[{module}] {end}{if context}[{context}] {end}{if logContext}[{logContext}] {end}{message}",customPrettifiers:{stack:n(D=>`
+`+String(D),"stack")}}),N=n((D,T)=>{const $=D==="stdout"?process.stdout:process.stderr;try{E?.(T)}catch{}const x=$e(T)?B(T):`${T}
+`;$.write((0,inspector_secret_1.forStream)($,Ee,`${P}${x}`)),s(`${P}${x}`)},"write"),O=n((D,T)=>{if(!D)return;const $=readline.createInterface({input:D});$.on("line",x=>N(T,x)),$.on("close",()=>{})},"attach");O(g.stdout,"stdout"),O(g.stderr,"stderr")},"wireProcLogging"),C=n(g=>Se(g.proc,Z(g.id),P=>g.tail.push(P)),"wireChildLogging");(async()=>{ensureOwnerOnlyDir(SOCK_DIR);const g=httpProxy.createProxyServer({});let P=Number(process.env.PORT)||0;P||(P=9090);const E=[],B=new Set;function N(){let e=0;for(;B.has(e);)e++;return B.add(e),e}h(N,"R"),n(N,"allocDebugSlot");let O=1,D=0,T=!1,$=oe,x=[],V=0;const ae=(()=>{const e=Number(process.env.LENSMCP_POD_BOOT_GRACE_MS);return Number.isFinite(e)&&e>=0?e:12e4})(),ce=n(e=>e.proc.exitCode!==null||e.proc.signalCode!==null,"childExited"),Pe=n(e=>e.booting&&!ce(e)&&Date.now()-e.spawnedAt<ae,"stillBooting");function ee(){return E.filter(e=>e.healthy&&typeof e.socketPath=="string")}h(ee,"ae"),n(ee,"healthyChildren");let le;function J(e){if(!e||typeof e!="object")return;const o=e;if(o.schemaVersion===1){le=o;for(const c of E)tell(c.proc,{type:"watcher",testimony:o})}}h(J,"re"),n(J,"recordWatcherTestimony");function he(e,o=256*1024){return new Promise(c=>{let d="",a=!1;e.on("data",r=>{a||(d+=r,d.length>o&&(a=!0))}),e.on("end",()=>{if(a||!d)return c(void 0);try{c(JSON.parse(d))}catch{c(void 0)}}),e.on("error",()=>c(void 0))})}h(he,"we"),n(he,"readJsonBody");function q(){const e=ee();if(e.length===0)return null;const o=D%e.length;return D=(D+1)%e.length,e[o]}h(q,"j"),n(q,"pickChild");function G(e,o){const c=`Child#${e.id}`,d=SERVICE_NAME||f,a=Date.now();if(o.type==="pod-memory"){const r=o.report;if(!r||typeof r.live!="number")return;e.memory.latest=r,e.memory.history.push(r),e.memory.history.length>12&&e.memory.history.splice(0,e.memory.history.length-12),console.log(`[parent] ${(0,pod_memory_1.describePodMemory)(c,r)}`),w.publish((0,pod_memory_events_1.buildPodMemoryEvent)(F(e),r))}else if(o.type==="pod-memory-retained"){const r=o.retained;if(!r||typeof r.gen!="number")return;e.memory.retained.set(r.gen,{...r,at:a}),console.warn(`[parent] ${(0,pod_memory_1.describeRetained)(c,d,r)}`),w.publish((0,pod_memory_events_1.buildPodRetainedEvent)(F(e),r,a))}else{const r=o.released;if(!r||typeof r.gen!="number")return;e.memory.retained.delete(r.gen),console.log(`[parent] ${(0,pod_memory_1.describeReleased)(c,d,r)}`),w.publish((0,pod_memory_events_1.buildPodReleasedEvent)(F(e),r,a))}}h(G,"U"),n(G,"recordPodMemory");const te=new Map;let ke=0;async function re(){const e=O++,o=childSockPath(e);cleanupSock(o);const c=(0,dev_devtool_1.sourceMapExecArgv)();__filename.endsWith(".ts")&&c.unshift("--require","@swc-node/register"),c.push(...(0,inspector_secret_1.inspectorPublishExecArgv)(usesFixedInspectorPorts()));const d=I?N():-1,a=(0,node_child_process_1.fork)(__filename,{env:{...process.env,APP_RUNNER:"1",CHILD_SOCK_PATH:o,...d>=0&&{CHILD_DEBUG_PORT:String(inspectorPortFor(I,d))}},stdio:["inherit","pipe","pipe","ipc"],execArgv:c,execPath:ne("pod")}),r={id:e,proc:a,healthy:!1,lastError:null,debugSlot:d,tail:new exit_reason_1.TailBuffer,booting:!0,spawnedAt:Date.now(),bootReloadSeq:V,memory:{history:[],retained:new Map}};return a.on("error",y=>console.error(`[parent] Child#${e}: ${y.message}`)),a.on("message",y=>{if(!y||typeof y!="object")return;const l=y;l.type==="ready"?(r.socketPath=String(l.socketPath),r.healthy=!0,r.booting=!1,console.log(`[parent] Child#${r.id} ready on socket ${r.socketPath}`),le&&tell(a,{type:"watcher",testimony:le}),V!==r.bootReloadSeq&&tell(a,{type:"reload"})):l.type==="recycle-request"?X(r,String(l.reason||"it has outgrown its bound")):l.type==="inspector-url"?(r.inspectorUrl=String(l.url),console.log(`[parent] Child#${r.id} Debugger listening on ${l.url}`)):l.type==="reloaded"?(r.socketPath=String(l.socketPath),r.healthy=!0,console.log(`[parent] Child#${r.id} hot-swapped on socket ${r.socketPath}`)):l.type==="reload-error"?(r.lastError=String(l.error||"unknown reload error"),console.error(`[parent] Child#${r.id} reload error: ${r.lastError}`),r.healthy=!1):l.type==="boot-error"?(r.lastError=String(l.error||"unknown boot error"),console.error(`[parent] Child#${r.id} boot error: ${r.lastError}`),r.healthy=!1,r.booting=!1):l.type==="pod-memory"||l.type==="pod-memory-retained"||l.type==="pod-memory-released"?G(r,l):l.type==="heap-snapshot-result"&&te.get(Number(l.id))?.(l)}),a.on("exit",(y,l)=>{r.booting=!1;for(const R of r.memory.retained.values()){const W={gen:R.gen,closedAt:R.closedAt,ageMs:Date.now()-R.closedAt,reason:"pod-exited"};console.log(`[parent] ${(0,pod_memory_1.describeReleased)(`Child#${r.id}`,SERVICE_NAME||f,W)}`),w.publish((0,pod_memory_events_1.buildPodReleasedEvent)(F(r),W,Date.now()))}r.memory.retained.clear(),r.memory.latest&&w.publish((0,pod_memory_events_1.buildPodExitedEvent)(F(r),{code:y,signal:l},Date.now())),r.debugSlot>=0&&(B.delete(r.debugSlot),r.debugSlot=-1);const v=l==="SIGINT"||l==="SIGTERM"||y===0;if(v?console.log(`[parent] Child#${r.id} exited cleanly (code=${y}, signal=${l??"none"})`):(console.error((0,exit_reason_1.crashReport)(`[parent] Child#${r.id} crashed (code=${y}, signal=${l??"none"}, pid=${r.proc.pid}, ${r.healthy?"was serving":"was not ready"})`,y,l,r.tail.snapshot())),r.lastError||(r.lastError=`Child exited abnormally (code=${y}, signal=${l??"none"})`)),r.healthy=!1,cleanupSock(r.socketPath,r.proc.pid),r.socketPath=void 0,!v&&!T){const R=E.indexOf(r);R>=0&&E.splice(R,1);const W=Date.now();if(x=x.filter(U=>W-U<3e4),x.length>=5){console.error(`[parent] crash-loop detected (${x.length} respawns/30s) \u2014 pausing auto-respawn; POST /webpack/reload to retry`);return}x.push(W),setTimeout(()=>{const U=E.filter(de=>de.proc.killed===!1).length;!T&&U<$&&(console.log(`[parent] respawning a crashed pod (${U}/${$} live)`),re().catch(()=>{}))},1500).unref?.()}}),E.push(r),C(r),r}h(re,"de"),n(re,"spawnChild");async function fe(e){$=Math.max($,e);const o=E.filter(d=>d.proc.killed===!1),c=e-o.length;for(let d=0;d<c;d++)await re()}h(fe,"Ee"),n(fe,"ensurePoolSize");async function t(){const e=E.filter(o=>(!o.healthy||typeof o.socketPath!="string")&&!Pe(o));await Promise.all(e.map(async o=>{try{o.proc.kill("SIGTERM")}catch{}cleanupSock(o.socketPath,o.proc.pid),o.socketPath=void 0;const c=E.indexOf(o);c>=0&&E.splice(c,1),await re()}))}h(t,"t"),n(t,"respawnUnhealthy");const i=new Set;let p=!1,m=0;const _=3e4,S=(()=>{const e=Number(process.env.LENSMCP_SWAP_DRAIN_MS);return(Number.isFinite(e)&&e>=0?e:15*6e4)+6e4})();async function X(e,o){const c=n(a=>{console.log(`[parent] Child#${e.id} asked for a fresh pod (${o}) \u2014 not now: ${a}`),tell(e.proc,{type:"recycle-declined"})},"decline");if(T||!E.includes(e))return;if(p)return c("another pod is already being replaced");const d=Date.now()-m;if(d<_)return c(`a pod was replaced ${Math.round(d/1e3)}s ago`);p=!0,console.log(`[parent] Child#${e.id} asked for a fresh pod \u2014 ${o}. Starting one; Child#${e.id} keeps serving until it is ready.`);try{const a=await re(),r=Date.now()+ae;for(;!a.healthy&&!a.lastError&&!ce(a)&&Date.now()<r;)await new Promise(v=>{setTimeout(v,100).unref?.()});if(T)return;if(!a.healthy){const v=E.indexOf(a);v>=0&&E.splice(v,1);try{a.proc.kill("SIGTERM")}catch{}return c(`its successor Child#${a.id} did not come up (${a.lastError??"no answer in time"})`)}const y=E.indexOf(e);y>=0&&E.splice(y,1),e.healthy=!1,i.add(e);const l=setTimeout(()=>{if(!ce(e)){console.error(`[parent] Child#${e.id} was still running ${S}ms after it was retired \u2014 killing it`);try{e.proc.kill("SIGKILL")}catch{}}},S);if(l.unref?.(),e.proc.once("exit",()=>{clearTimeout(l),i.delete(e)}),!tell(e.proc,{type:"retire"}))try{e.proc.kill("SIGTERM")}catch{}m=Date.now(),console.log(`[parent] Child#${a.id} took over from Child#${e.id} (pid ${e.proc.pid} \u2192 ${a.proc.pid})`)}catch(a){c(`could not start a successor: ${a?.message??String(a)}`)}finally{p=!1}}h(X,"q"),n(X,"recyclePod");const L=[];function k(e){const o=path.dirname(path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.resolve(BUNDLE_PATH)),c=path.join(o,`${e}.js`);if(!fs.existsSync(c))return console.error(`[parent] Worker "${e}" bundle not found: ${c}`),null;const d=(0,dev_devtool_1.sourceMapExecArgv)();__filename.endsWith(".ts")&&d.unshift("--require","@swc-node/register");try{d.push("--require",require.resolve("@lensmcp/node-instrumentation/register"))}catch{}const a=inspectorPortFor(I||9229,ue+Math.max(0,WORKER_NAMES.indexOf(e)));d.push(I?`--inspect=127.0.0.1:${a}`:`--inspect-port=127.0.0.1:${a}`,...(0,inspector_secret_1.inspectorPublishExecArgv)(usesFixedInspectorPorts()));const r=(0,node_child_process_1.fork)(c,{env:process.env,stdio:["inherit","pipe","pipe","ipc"],execArgv:d,execPath:ne(`w-${e}`)}),y={name:e,proc:r,debugPort:a};return L.push(y),r.on("error",l=>console.error(`[parent] Worker "${e}": ${l.message}`)),Se(r,`\x1B[35m[worker:${e}] \x1B[0m`,l=>{const v=/Debugger listening on (wss?:\/\/\S+)/.exec(l);v&&(y.inspectorUrl=v[1])}),r.on("exit",(l,v)=>{v==="SIGINT"||v==="SIGTERM"||l===0||console.error(`[parent] Worker "${e}" crashed (code=${l}, signal=${v??"none"})`);const R=L.indexOf(y);R>=0&&L.splice(R,1)}),console.log(`[parent] Worker "${e}" started (pid=${r.pid})`),y}h(k,"A"),n(k,"spawnWorkerProcess");const z=(()=>{const e=Number(process.env.LENSMCP_SWAP_DRAIN_MS);return Number.isFinite(e)&&e>=0?e:15*6e4})(),Oe=(()=>{const e=Number(process.env.LENSMCP_SWAP_MAX_DRAINING);return Number.isFinite(e)&&e>=1?Math.floor(e):1})(),ge=new Set,De=n(e=>e.proc.exitCode!==null||e.proc.signalCode!==null,"workerExited");function ve(e,o){if(ge.delete(e),!De(e)){console.error(`[parent] Worker "${e.name}" (pid=${e.proc.pid}) ${o} \u2014 killing it. A worker that returns from its SIGTERM handler but leaves a handle open (a Redis client handed to BullMQ is not closed by worker.close()) never exits on its own: close what it opened, or call process.exit().`);try{e.proc.kill("SIGKILL")}catch{}}}h(ve,"Ie"),n(ve,"killDrainingWorker");function Ce(e){try{e.proc.kill("SIGTERM")}catch{}if(De(e))return;const o=[...ge].filter(d=>d.name===e.name);for(;o.length>=Oe;)ve(o.shift(),`was still running when a later reload replaced its successor (cap ${Oe})`);ge.add(e);const c=setTimeout(()=>ve(e,`was still running ${z}ms after SIGTERM`),z);c.unref?.(),e.proc.once("exit",()=>{clearTimeout(c),ge.delete(e)})}h(Ce,"Ge"),n(Ce,"retireWorker");function xe(){for(const e of[...L])Ce(e);L.length=0;for(const e of WORKER_NAMES)k(e)}h(xe,"We"),n(xe,"restartWorkers");const Fe=debounce(async()=>{V+=1;const e=ee();if(e.length>0){console.log(`[parent] Forwarding reload to ${e.length} child(ren)`);for(const o of e)tell(o.proc,{type:"reload"})}await t(),WORKER_NAMES.length>0&&xe()},200),ye=n(async(e,o)=>{if(e.method==="POST"&&e.url==="/webpack/reload"){if(!mayDriveThePool(e))return refusePoolCommand(e,o);o.writeHead(200,{"content-type":"application/json"}),o.end(JSON.stringify({ok:!0})),he(e).then(a=>J(a?.watcher)),Fe();return}if(e.method==="POST"&&e.url==="/webpack/watching"){if(!mayDriveThePool(e))return refusePoolCommand(e,o);const a=await he(e);J(a),o.writeHead(200,{"content-type":"application/json"}),o.end(JSON.stringify({ok:!0,relayed:le!==void 0}));return}if(e.method==="POST"&&e.url==="/webpack/scale"){if(!mayDriveThePool(e))return refusePoolCommand(e,o);let a="";e.on("data",r=>{a+=r}),e.on("end",async()=>{let r=0;try{r=Number(JSON.parse(a||"{}").pods)||0}catch{}r=Math.max(1,Math.min(r,16)),await fe(r),o.writeHead(200,{"content-type":"application/json"}),o.end(JSON.stringify({ok:!0,pods:r}))});return}if(e.method==="GET"&&e.url?.startsWith("/webpack/logs")){const a=new URL(e.url,"http://localhost").searchParams,r=Math.min(Math.max(Number(a.get("tail")??"100")||0,0),A),y=a.get("follow")!=="0",l=a.get("plain")==="1",v=!isOwnerOnlyTransport(e);o.writeHead(200,{"content-type":"text/plain; charset=utf-8","cache-control":"no-cache"});const R=r===0?"":H.slice(-r).join(""),W=l?R.replace(Y,""):R;if(o.write(v?(0,inspector_secret_1.redactInspectorUrls)(W):W),!y){o.end();return}const U={res:o,plain:l,redact:v};K.add(U),e.on("close",()=>K.delete(U));return}if(e.method==="POST"&&e.url?.startsWith("/webpack/debug")){if(!isOwnerOnlyTransport(e)){o.writeHead(404,{"content-type":"application/json"}),o.end(JSON.stringify({error:"not found"}));return}const a=Number(new URL(e.url,"http://localhost").searchParams.get("port")||"");Number.isInteger(a)&&a>1024&&(I=a),I||(I=9229);const r=E.filter(l=>l.proc.exitCode===null&&l.proc.signalCode===null);for(const l of r)l.debugSlot<0&&(l.debugSlot=N()),tell(l.proc,{type:"debug-open",port:inspectorPortFor(I,l.debugSlot)});for(const l of L)try{l.proc.kill("SIGUSR1")}catch{}const y=Date.now()+2e3;for(;Date.now()<y&&r.some(l=>!l.inspectorUrl);)await new Promise(l=>setTimeout(l,50));o.writeHead(200,{"content-type":"application/json"}),o.end(JSON.stringify({ok:!0,basePort:I,fixedPorts:usesFixedInspectorPorts(),pods:r.map(l=>({id:l.id,inspectorUrl:l.inspectorUrl??null})),workers:L.map(l=>({name:l.name,port:l.debugPort||inspectorPortOf(l.inspectorUrl),inspectorUrl:l.inspectorUrl??null}))},null,2)+`
+`);return}if(e.method==="GET"&&e.url==="/webpack/memory"){if(!isOwnerOnlyTransport(e)){o.writeHead(404,{"content-type":"application/json"}),o.end(JSON.stringify({error:"not found"}));return}const a=path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.resolve(BUNDLE_PATH),r=[...E,...i].map(y=>({id:y.id,pid:y.proc.pid??0,podGeneration:POD_GENERATION,healthy:y.healthy,retiring:i.has(y),latest:y.memory.latest??null,history:y.memory.history,retained:[...y.memory.retained.values()]}));o.writeHead(200,{"content-type":"application/json","cache-control":"no-store"}),o.end(JSON.stringify({ok:!0,service:SERVICE_NAME,project:f,bundle:{path:a},pods:r},null,2)+`
+`);return}if(e.method==="POST"&&e.url?.startsWith("/webpack/heap")){if(!isOwnerOnlyTransport(e)){o.writeHead(404,{"content-type":"application/json"}),o.end(JSON.stringify({error:"not found"}));return}const a=n((M,_e)=>{o.writeHead(M,{"content-type":"application/json"}),o.end(JSON.stringify(_e,null,2)+`
+`)},"reply"),r=Number(new URL(e.url,"http://localhost").searchParams.get("pod")||""),y=Number.isInteger(r)&&r>0?E.find(M=>M.id===r):ee()[0];if(!y||ce(y)){a(404,{ok:!1,error:r?`no pod #${r} \u2014 running: ${E.map(M=>`#${M.id}`).join(", ")||"none"}`:"no pod is serving"});return}if(te.size>0){a(409,{ok:!1,refused:"a heap snapshot is already being written for this service"});return}const l=(0,heap_snapshot_1.heapSnapshotPolicy)(),v=(0,heap_snapshot_1.heapSnapshotDir)();let R;try{(0,heap_snapshot_1.ensureHeapDir)(v);const M=(0,heap_snapshot_1.pruneHeapSnapshots)(v,l);M.length&&console.log(`[parent] removed ${M.length} older heap snapshot(s) from ${v}`),R=path.join(v,(0,heap_snapshot_1.heapSnapshotFileName)(SERVICE_NAME||f,y.id,y.proc.pid??0,y.memory.latest?.gen??0,Date.now()))}catch(M){a(500,{ok:!1,error:`cannot prepare ${v}: ${M.message}`});return}const W=++ke,U=(0,heap_snapshot_1.availableSystemMemory)();let de;const b=await new Promise(M=>{const _e=setTimeout(()=>M(void 0),6e5);_e.unref?.(),te.set(W,qe=>{clearTimeout(_e),M(qe)}),de=n(()=>{clearTimeout(_e),M(void 0)},"onExit"),y.proc.once("exit",de),tell(y.proc,{type:"heap-snapshot",id:W,file:R,...U?{available:U}:{}})||de()}).finally(()=>{te.delete(W),de&&y.proc.off("exit",de)});if(!b){a(504,{ok:!1,pod:y.id,error:"the pod did not finish the snapshot (it exited, or took longer than 10 minutes)"});return}b.ok?console.log(`[parent] Child#${y.id} wrote a ${Math.round((b.bytes??0)/1048576)} MB heap snapshot in ${b.ms} ms \u2192 ${b.file}`):console.warn(`[parent] Child#${y.id} heap snapshot not taken: ${b.refused??b.error}`),a(b.ok?200:b.refused?409:500,{ok:b.ok,pod:y.id,pid:y.proc.pid??0,service:SERVICE_NAME,bundle:path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.resolve(BUNDLE_PATH),...U?{available:U}:{},...b.file?{file:b.file,bytes:b.bytes,ms:b.ms}:{},...b.live!==void 0?{live:b.live}:{},...b.gen!==void 0?{gen:b.gen,closedAlive:b.closedAlive??[]}:{},...b.refused?{refused:b.refused}:{},...b.error?{error:b.error}:{}});return}const c=matchGatewayRoute(e);if(c?.prependPrefix&&!e.url?.startsWith(c.prependPrefix)&&(e.url=c.prependPrefix+(e.url??"/")),c?.target){applyGatewayMiddleware(e),g.web(e,o,{target:c.target,autoRewrite:typeof c.target=="string",changeOrigin:!0},a=>{console.error(`[parent] proxy error to ${c.target}:`,a),o.statusCode=502,o.setHeader("content-type","text/plain; charset=utf-8"),o.end(`Upstream error from ${c.target}.`)});return}if(SERVICE_PREFIX){if(!e.url?.startsWith(SERVICE_PREFIX)){o.writeHead(404,{"content-type":"text/plain; charset=utf-8"}),o.end(`Not found. This service is mounted at ${SERVICE_PREFIX}/`);return}e.url=e.url.slice(SERVICE_PREFIX.length)||"/"}applyGatewayMiddleware(e);const d=q();if(!d){o.statusCode=503,o.setHeader("content-type","text/plain; charset=utf-8");const a=E.map(r=>`#${r.id}: ${r.lastError??"no error recorded"}`).join(`
+`);o.end(`No healthy children available. POST /webpack/reload to recover.
 
 Last errors:
-${c}`);return}p.web(e,r,{target:{socketPath:a.socketPath},headers:{"x-proxy-child-id":String(a.id)}},c=>{console.error(`[parent] proxy error to Child#${a.id}:`,c),a.healthy=!1,a.lastError=String(c?.stack||c),r.statusCode=502,r.setHeader("content-type","text/plain; charset=utf-8"),r.end(`Upstream error from Child#${a.id}. Try /webpack/reload.
-${a.lastError}`)})},"requestHandler");let z,ce,we;const ue=[];if(GATEWAY_HTTPS){const e=require("./basic-ssl"),r=GATEWAY_ROUTES.map(a=>a.host).filter(a=>!!a),d=path.join(process.cwd(),"node_modules",".cache","davnx-webpack");ce=e.getCertificateSync(d,SERVICE_NAME||"lensmcp.dev",r),we=e.caCertPath(),z=require("node:https").createServer({key:ce,cert:ce},ie)}else z=http.createServer(ie);const Ne=i((e,r,d)=>{const a=matchGatewayRoute(e);if(a?.prependPrefix&&!e.url?.startsWith(a.prependPrefix)&&(e.url=a.prependPrefix+(e.url??"/")),a?.target){p.ws(e,r,d,{target:a.target,changeOrigin:!0},()=>r.destroy());return}const c=U();if(!c){r.destroy();return}p.ws(e,r,d,{target:{socketPath:c.socketPath}},()=>r.destroy())},"upgradeHandler");z.on("upgrade",Ne);const Te=2e3;let ve=!1;z.on("error",e=>{if(e.code==="EADDRINUSE"){ve||(ve=!0,console.warn(`[parent] public port ${E} already in use \u2014 continuing on the unix-socket pool only (gateway routing is unaffected) and retrying the bind every ${Te/1e3}s. Give this service a distinct cluster.port if this is not a rolling handoff.`)),setTimeout(()=>{!T&&!z.listening&&z.listen(E)},Te).unref?.();return}console.error("[parent] public server error:",e)}),await t(_);for(const e of WORKER_NAMES)ye(e);z.listen(E,()=>{const e=GATEWAY_HTTPS?"https":"http";console.log(`[parent] Listening on ${e}://localhost:${E}`),SERVICE_PREFIX&&console.log(`[parent] Service prefix: "${SERVICE_PREFIX}" (enforced \u2014 requests without it will get 404)`),gatewayMiddleware&&console.log(`[parent] Gateway middleware: ACTIVE (${GATEWAY_MIDDLEWARE_PATH})`),GATEWAY_ROUTES.length>0&&console.log(`[parent] Gateway routes: ${GATEWAY_ROUTES.map(r=>`${r.host??"*"}${r.prefix??"/"}\u2192${r.target??"children"}`).join("  ")}`),we&&(console.log("[parent] HTTPS dev CA (trust ONCE, then rotations/new hostnames stay green):"),console.log(`[parent]   sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${we}`)),console.log(`POST ${e}://localhost:${E}/webpack/reload to trigger rolling swap/respawn`)});const he=Number(process.env.INTERNAL_PORT||0);if(he>0){const e=i((d,a)=>{const c=U();if(!c){a.statusCode=503,a.setHeader("content-type","text/plain; charset=utf-8"),a.end("No healthy children available.");return}p.web(d,a,{target:{socketPath:c.socketPath}},o=>{c.healthy=!1,c.lastError=String(o?.stack||o),a.statusCode=502,a.end(`Upstream error from Child#${c.id}.`)})},"internalHandler"),r=http.createServer(e);r.on("upgrade",(d,a,c)=>{const o=U();if(!o){a.destroy();return}p.ws(d,a,c,{target:{socketPath:o.socketPath}},()=>a.destroy())}),r.on("error",d=>{console.warn(`[parent] internal port ${he} unavailable (${d.code}).`)}),r.listen(he,()=>{console.log(`[parent] Internal (service-to-service, no gateway middleware) on http://localhost:${he}`)}),ue.push(r)}const Ie=(()=>{try{return JSON.parse(process.env.GATEWAY_EXTRA_PORTS||"[]")}catch{return[]}})();for(const e of Ie){if(!Number.isInteger(e)||e===Number(E))continue;const r=GATEWAY_HTTPS?require("node:https").createServer({key:ce,cert:ce},ie):http.createServer(ie);r.on("upgrade",Ne),r.on("error",d=>{console.warn(`[parent] extra port ${e} unavailable (${d.code}) \u2014 main port still up.`)}),r.listen(e,()=>{console.log(`[parent] Also listening on ${GATEWAY_HTTPS?"https":"http"}://localhost:${e}`)}),ue.push(r)}const _e=path.join(SOCK_DIR,"parent.sock");claimSock(_e);const Ee=http.createServer(ie);Ee.on("error",e=>{console.warn(`[parent] control socket unavailable (${e.code}) \u2014 lensmcp logs/debug attach disabled.`)}),Ee.listen(_e),ue.push(Ee);const Re=i(async e=>{T=!0,console.log(`[${e}] [parent] shutting down\u2026`),cleanupSock(_e);for(const r of ue)try{r.close()}catch{}for(const r of H)try{r.proc.kill("SIGTERM")}catch{}for(const r of[...se])pe(r,"was still draining when its devserver shut down");for(const r of f)try{r.proc.kill("SIGTERM")}catch{}for(const r of w){try{r.proc.kill("SIGTERM")}catch{}r.socketPath&&cleanupSock(r.socketPath,r.proc.pid)}try{fs.rmdirSync(SOCK_DIR)}catch{}setTimeout(()=>process.exit(0),700).unref()},"shutdown");["SIGINT","SIGTERM","SIGHUP","SIGQUIT","SIGUSR2"].forEach(e=>process.on(e,()=>{Re(e)}));const fe=Number(process.env.LENSMCP_GATEWAY_PID??0);if(Number.isInteger(fe)&&fe>0){const e=setInterval(()=>{try{process.kill(fe,0)}catch(r){if(r.code==="EPERM")return;clearInterval(e),console.error(`[parent] gateway (pid ${fe}) is gone \u2014 shutting the pod down to avoid an orphan tree.`),Re("gateway-gone")}},5e3);e.unref()}})()}
+${a}`);return}g.web(e,o,{target:{socketPath:d.socketPath},headers:{"x-proxy-child-id":String(d.id)}},a=>{console.error(`[parent] proxy error to Child#${d.id}:`,a),d.healthy=!1,d.lastError=String(a?.stack||a),o.statusCode=502,o.setHeader("content-type","text/plain; charset=utf-8"),o.end(`Upstream error from Child#${d.id}. Try /webpack/reload.
+${d.lastError}`)})},"requestHandler");let pe,me,Me;const be=[];if(GATEWAY_HTTPS){const e=require("./basic-ssl"),o=GATEWAY_ROUTES.map(d=>d.host).filter(d=>!!d),c=path.join(process.cwd(),"node_modules",".cache","davnx-webpack");me=e.getCertificateSync(c,SERVICE_NAME||"lensmcp.dev",o),Me=e.caCertPath(),pe=require("node:https").createServer({key:me,cert:me},ye)}else pe=http.createServer(ye);const Ge=n((e,o,c)=>{const d=matchGatewayRoute(e);if(d?.prependPrefix&&!e.url?.startsWith(d.prependPrefix)&&(e.url=d.prependPrefix+(e.url??"/")),d?.target){g.ws(e,o,c,{target:d.target,changeOrigin:!0},()=>o.destroy());return}const a=q();if(!a){o.destroy();return}g.ws(e,o,c,{target:{socketPath:a.socketPath}},()=>o.destroy())},"upgradeHandler");pe.on("upgrade",Ge);const Le=2e3;let We=!1;pe.on("error",e=>{if(e.code==="EADDRINUSE"){We||(We=!0,console.warn(`[parent] public port ${P} already in use \u2014 continuing on the unix-socket pool only (gateway routing is unaffected) and retrying the bind every ${Le/1e3}s. Give this service a distinct cluster.port if this is not a rolling handoff.`)),setTimeout(()=>{!T&&!pe.listening&&pe.listen(P)},Le).unref?.();return}console.error("[parent] public server error:",e)}),await fe(oe);for(const e of WORKER_NAMES)k(e);pe.listen(P,()=>{const e=GATEWAY_HTTPS?"https":"http";console.log(`[parent] Listening on ${e}://localhost:${P}`),SERVICE_PREFIX&&console.log(`[parent] Service prefix: "${SERVICE_PREFIX}" (enforced \u2014 requests without it will get 404)`),gatewayMiddleware&&console.log(`[parent] Gateway middleware: ACTIVE (${GATEWAY_MIDDLEWARE_PATH})`),GATEWAY_ROUTES.length>0&&console.log(`[parent] Gateway routes: ${GATEWAY_ROUTES.map(o=>`${o.host??"*"}${o.prefix??"/"}\u2192${o.target??"children"}`).join("  ")}`),Me&&(console.log("[parent] HTTPS dev CA (trust ONCE, then rotations/new hostnames stay green):"),console.log(`[parent]   sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${Me}`)),console.log(`POST ${e}://localhost:${P}/webpack/reload to trigger rolling swap/respawn`)});const Ae=Number(process.env.INTERNAL_PORT||0);if(Ae>0){const e=n((c,d)=>{const a=q();if(!a){d.statusCode=503,d.setHeader("content-type","text/plain; charset=utf-8"),d.end("No healthy children available.");return}g.web(c,d,{target:{socketPath:a.socketPath}},r=>{a.healthy=!1,a.lastError=String(r?.stack||r),d.statusCode=502,d.end(`Upstream error from Child#${a.id}.`)})},"internalHandler"),o=http.createServer(e);o.on("upgrade",(c,d,a)=>{const r=q();if(!r){d.destroy();return}g.ws(c,d,a,{target:{socketPath:r.socketPath}},()=>d.destroy())}),o.on("error",c=>{console.warn(`[parent] internal port ${Ae} unavailable (${c.code}).`)}),o.listen(Ae,()=>{console.log(`[parent] Internal (service-to-service, no gateway middleware) on http://localhost:${Ae}`)}),be.push(o)}const He=(()=>{try{return JSON.parse(process.env.GATEWAY_EXTRA_PORTS||"[]")}catch{return[]}})();for(const e of He){if(!Number.isInteger(e)||e===Number(P))continue;const o=GATEWAY_HTTPS?require("node:https").createServer({key:me,cert:me},ye):http.createServer(ye);o.on("upgrade",Ge),o.on("error",c=>{console.warn(`[parent] extra port ${e} unavailable (${c.code}) \u2014 main port still up.`)}),o.listen(e,()=>{console.log(`[parent] Also listening on ${GATEWAY_HTTPS?"https":"http"}://localhost:${e}`)}),be.push(o)}const Ne=path.join(SOCK_DIR,"parent.sock");claimSock(Ne);const Te=http.createServer(ye);Te.on("error",e=>{console.warn(`[parent] control socket unavailable (${e.code}) \u2014 lensmcp logs/debug attach disabled.`)}),Te.listen(Ne),be.push(Te);const Ue=n(async e=>{T=!0,console.log(`[${e}] [parent] shutting down\u2026`);const o=sockOwnedByAnother(Ne);cleanupSock(Ne);for(const c of be)if(!(c===Te&&o))try{c.close()}catch{}for(const c of L)try{c.proc.kill("SIGTERM")}catch{}for(const c of[...ge])ve(c,"was still draining when its devserver shut down");for(const c of i)try{c.proc.kill("SIGTERM")}catch{}for(const c of E){try{c.proc.kill("SIGTERM")}catch{}c.socketPath&&cleanupSock(c.socketPath,c.proc.pid)}try{fs.rmdirSync(SOCK_DIR)}catch{}setTimeout(()=>process.exit(0),700).unref()},"shutdown");["SIGINT","SIGTERM","SIGHUP","SIGQUIT","SIGUSR2"].forEach(e=>process.on(e,()=>{Ue(e)}));const Ie=Number(process.env.LENSMCP_GATEWAY_PID??0);if(Number.isInteger(Ie)&&Ie>0){const e=setInterval(()=>{try{process.kill(Ie,0)}catch(o){if(o.code==="EPERM")return;clearInterval(e),console.error(`[parent] gateway (pid ${Ie}) is gone \u2014 shutting the pod down to avoid an orphan tree.`),Ue("gateway-gone")}},5e3);e.unref()}})()}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/cluster",
-  "version": "1.23.12",
+  "version": "1.24.0",
   "description": "Run your Nx workspace as a local production cluster: pods on unix sockets with true HMR, one https gateway with per-project domains, scale-from-zero, autoscale, idle-kill, local-CA TLS — observed by the LensMCP lens.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -57,9 +57,9 @@
     }
   },
   "dependencies": {
-    "@lensmcp/core": "1.23.12",
-    "@lensmcp/node-instrumentation": "1.23.12",
-    "@lensmcp/nx-plugin": "1.23.12",
+    "@lensmcp/core": "1.24.0",
+    "@lensmcp/node-instrumentation": "1.24.0",
+    "@lensmcp/nx-plugin": "1.24.0",
     "fastify": "^5.8.5",
     "@fastify/reply-from": "^12.6.2",
     "@typescript/native-preview": "^7.0.0-dev.20260707.2",

package/perf/heavy-barrel-import.d.ts

@@ -0,0 +1,135 @@
+import { type WorkspaceLibrary } from './workspace-libraries';
+export declare const HEAVY_BARREL_RULE = "bundle/heavy-barrel-import";
+/** One module of a compilation, as the rule needs it. */
+export interface CompiledModule {
+    /** Absolute path of its file (no loaders, no query). */
+    resource: string;
+    /** Bytes webpack attributes to it — its source after loaders. */
+    size: number;
+    /** Files it imports (absolute; externals left out). */
+    dependencies: string[];
+}
+/** How long the compilation that produced the module set took, for the compile-time estimate. */
+export interface CompileFacts {
+    durationMs: number;
+    /** Modules it actually built (a cached module costs nothing). */
+    builtModules: number;
+}
+/** Everything one project's code compiled to. */
+export interface ProjectCompilation {
+    project: string;
+    modules: CompiledModule[];
+    compile?: CompileFacts;
+}
+/** Source access — injected, so the rule stays a pure function in tests and bounded in the plugin. */
+export interface SourceReader {
+    read(file: string): string | undefined;
+    exists(file: string): boolean;
+}
+export interface HeavyBarrelThresholds {
+    /** The share of the library's files compiled into the project at or above which it may fire. */
+    minShare: number;
+    /** Modules compiled from the library at or above which it may fire … */
+    minModules: number;
+    /** … or their bytes. */
+    minBytes: number;
+    /** It fires only when what the importers need is at most this share of what is compiled ("few symbols"). */
+    maxNeededShare: number;
+}
+/**
+ * Calibrated on FoodGuard's seven real dev bundles: five services needed 6–39% of the contracts modules they
+ * compiled (fires), registry 50.2% — 33 symbols, 445 modules avoidable (fires at 0.6, a miss at 0.5) — and engine 87%
+ * with 1,727 symbols, a service that genuinely uses most of the library (quiet).
+ */
+export declare const DEFAULT_HEAVY_BARREL_THRESHOLDS: HeavyBarrelThresholds;
+/** One file that imports the root, and what it takes. */
+export interface RootImporter {
+    /** Workspace-relative. */
+    file: string;
+    /** Value symbols it takes from the root (capped). */
+    symbols: string[];
+    /** Type-only names it imports — erased, no cost. */
+    typeOnly: number;
+    /** Its use could not be read: it counts as needing the whole library. */
+    wholeModule: boolean;
+    /** The imports that would replace its root import. */
+    rewrite: string[];
+}
+/** An entry that would satisfy some symbols — existing, or one the library should add. */
+export interface SubpathSuggestion {
+    specifier: string;
+    /** Workspace-relative file the specifier should resolve to. */
+    entry: string;
+    symbols: string[];
+    /** False: the alias does not exist yet — add it (tsconfig `paths` + package `exports`). */
+    exists: boolean;
+}
+/** The rule's measurement of one (project, library) pair reached through its root. */
+export interface BarrelMeasurement {
+    project: string;
+    library: string;
+    /** Workspace-relative. */
+    libraryRoot: string;
+    rootEntry: string;
+    libraryFiles: number;
+    compiledModules: number;
+    compiledBytes: number;
+    /** compiled ÷ library files. */
+    share: number;
+    rootImporterCount: number;
+    /** The biggest takers first (capped). */
+    rootImporters: RootImporter[];
+    /** Files INSIDE the library that import its own root: they keep the barrel compiled after every importer moves. */
+    internalRootImporters: string[];
+    /** Distinct value symbols the importers take from the root. */
+    symbols: number;
+    /** Symbols the scan could not follow to a file. */
+    unresolvedSymbols: string[];
+    /** Symbols the barrel defines itself: importing one runs the whole barrel — they belong in a module of their own. */
+    barrelDefines: string[];
+    neededModules: number;
+    neededBytes: number;
+    avoidableModules: number;
+    avoidableBytes: number;
+    subpaths: SubpathSuggestion[];
+    fires: boolean;
+    /** Why it does not fire: the first condition it missed. */
+    quiet?: string;
+}
+export interface BarrelAnalysisInput {
+    workspaceRoot: string;
+    libraries: WorkspaceLibrary[];
+    projects: ProjectCompilation[];
+    thresholds: HeavyBarrelThresholds;
+    source: SourceReader;
+    /** True once the analysis is out of time: it stops and says it is incomplete. */
+    expired?: () => boolean;
+}
+export interface BarrelAnalysis {
+    /** False when it ran out of time — nothing may be concluded (least of all a retraction). */
+    complete: boolean;
+    measurements: BarrelMeasurement[];
+}
+/** Measure every (project, library) pair reached through a root barrel. */
+export declare function analyzeBarrelImports(input: BarrelAnalysisInput): BarrelAnalysis;
+/** Executor memory per compiled module, MB — the fit to FoodGuard's seven watchers (issues/open/pod-memory-05). */
+export declare const EXECUTOR_MB_PER_MODULE = 0.374;
+/** A finding's text, evidence and cost — the payload a finding event carries. */
+export interface HeavyBarrelFindingText {
+    subject: string;
+    severity: 'warning' | 'error';
+    title: string;
+    summary: string;
+    evidence: Record<string, unknown>;
+    cost: {
+        modules: number;
+        bytes: number;
+        compileMs?: number;
+        memoryMb: number;
+        basis: string;
+    };
+    fix: string[];
+    verify: string;
+}
+/** What an agent reads: the measurement, as a problem with a fix and a way to prove it. */
+export declare function describeHeavyBarrel(m: BarrelMeasurement, compile?: CompileFacts): HeavyBarrelFindingText;

package/perf/heavy-barrel-import.js

@@ -0,0 +1 @@
+"use strict";var H=Object.defineProperty;var M=(e,o)=>H(e,"name",{value:o,configurable:!0});var C=Object.defineProperty,y=M((e,o)=>C(e,"name",{value:o,configurable:!0}),"y");Object.defineProperty(exports,"__esModule",{value:!0}),exports.EXECUTOR_MB_PER_MODULE=exports.DEFAULT_HEAVY_BARREL_THRESHOLDS=exports.HEAVY_BARREL_RULE=void 0,exports.analyzeBarrelImports=analyzeBarrelImports,exports.describeHeavyBarrel=describeHeavyBarrel;const tslib_1=require("tslib"),path=tslib_1.__importStar(require("node:path")),workspace_libraries_1=require("./workspace-libraries"),source_scan_1=require("./source-scan");exports.HEAVY_BARREL_RULE="bundle/heavy-barrel-import",exports.DEFAULT_HEAVY_BARREL_THRESHOLDS={minShare:.5,minModules:100,minBytes:1024*1024,maxNeededShare:.6};const MAX_IMPORTERS_LISTED=8,MAX_SYMBOLS_LISTED=12,MAX_SUBPATHS_LISTED=12,MAX_INTERNAL_LISTED=6,MAX_EXPORT_DEPTH=24,MAX_UNRESOLVED_SHARE=.1;class AliasResolver{static{M(this,"AliasResolver")}static{y(this,"AliasResolver")}constructor(o,r){this.exists=r,this.exact=new Map,this.wildcards=[];for(const s of o){this.exact.set(s.name,s.rootEntry);for(const i of s.aliases)this.exact.set(i,s.rootEntry);for(const i of s.subpaths)this.exact.set(i.specifier,i.entry);for(const i of s.wildcards)this.wildcards.push(i)}this.wildcards.sort((s,i)=>i.prefix.length-s.prefix.length)}resolve(o,r){if(r.startsWith("."))return(0,workspace_libraries_1.resolveSourceFile)(path.resolve(path.dirname(o),r),this.exists);const s=this.exact.get(r);if(s)return s;const i=this.wildcards.find(u=>r.startsWith(u.prefix));return i?(0,workspace_libraries_1.resolveSourceFile)(path.join(i.dir,r.slice(i.prefix.length)),this.exists):void 0}}class ExportReader{static{M(this,"ExportReader")}static{y(this,"ExportReader")}constructor(o,r){this.source=o,this.aliases=r,this.cache=new Map,this.resolved=new Map}index(o){let r=this.cache.get(o);if(r===void 0){const s=this.source.read(o);r=s===void 0?null:(0,source_scan_1.scanExports)(s),this.cache.set(o,r)}return r}resolve(o,r){const s=`${o}\0${r}`;let i=this.resolved.get(s);return i===void 0&&(i=this.follow(o,r,0,new Set)??null,this.resolved.set(s,i)),i??void 0}follow(o,r,s,i){if(s>MAX_EXPORT_DEPTH)return;const u=`${o}\0${r}`;if(i.has(u))return;i.add(u);const a=this.index(o);if(!a)return;if(a.values.has(r))return{file:o,typeOnly:!1};if(a.types.has(r))return{file:o,typeOnly:!0};const l=a.namespaces.get(r);if(l!==void 0){const p=this.aliases.resolve(o,l);return p?{file:p,typeOnly:!1}:void 0}const d=a.reexports.get(r);if(d){const p=this.aliases.resolve(o,d.specifier);if(!p)return;const c=this.follow(p,d.name,s+1,i);return c?{...c,typeOnly:c.typeOnly||d.typeOnly}:void 0}if(r!=="default")for(const p of a.stars){const c=this.aliases.resolve(o,p);if(!c)continue;const h=this.follow(c,r,s+1,i);if(h)return h}}}const rel=y((e,o)=>path.relative(e,o)||o,"rel");function readRootUse(e,o,r,s){const i=y(a=>l=>s.resolve(a,l)===e.rootEntry,"toBarrel"),u=[];for(const a of o){const l=/\.(?:[cm]?[jt]sx?)$/.test(a)?r.source.read(a):void 0;if(l===void 0){u.push({file:a,values:[],typeOnly:0,wholeModule:!0});continue}const d=(0,source_scan_1.scanImports)(l,i(a));if(d.length===0){u.push({file:a,values:[],typeOnly:0,wholeModule:!0});continue}const p=new Set;let c=0,h=!1;for(const x of d){h||=x.wholeModule;for(const f of x.names)f.typeOnly?c++:p.add(f.imported)}u.push({file:a,values:[...p].sort(),typeOnly:c,wholeModule:h})}return{importers:u}}M(readRootUse,"readRootUse"),y(readRootUse,"readRootUse");function closureWithin(e,o,r,s,i){const u=new Set,a=[...o].filter(l=>l!==s&&r.has(l)&&i(l)===e);for(;a.length;){const l=a.pop();if(!u.has(l)){u.add(l);for(const d of r.get(l)?.dependencies??[])d!==s&&!u.has(d)&&i(d)===e&&r.has(d)&&a.push(d)}}return u}M(closureWithin,"closureWithin"),y(closureWithin,"closureWithin");function subpathFor(e,o,r,s,i,u,a=0){if(r===e.rootEntry)return;const l=u(r);if(l!==e)return l&&a<2?subpathFor(l,o,r,s,i,u,a+1):void 0;const d=e.subpaths.filter(f=>r.startsWith(path.dirname(f.entry)+path.sep)||r===f.entry).filter(f=>s.resolve(f.entry,o)?.file===r).sort((f,$)=>$.entry.length-f.entry.length);if(d[0])return{specifier:d[0].specifier,entry:d[0].entry,exists:!0};const p=path.dirname(e.rootEntry);for(const f of e.wildcards){if(!r.startsWith(f.dir))continue;const $=r.slice(f.dir.length).split(path.sep).join("/").replace(/\.(?:[cm]?[jt]sx?)$/,""),w=$.split("/")[0],v=(0,workspace_libraries_1.resolveSourceFile)(path.join(f.dir,w),i.exists);return v&&v!==r&&s.resolve(v,o)?.file===r?{specifier:`${f.prefix}${w}`,entry:v,exists:!0}:{specifier:`${f.prefix}${$.replace(/\/index$/,"")}`,entry:r,exists:!0}}const c=path.relative(p,r).split(path.sep),h=c.length>1?c[0]:c[0].replace(/\.(?:[cm]?[jt]sx?)$/,""),x=c.length>1?(0,workspace_libraries_1.resolveSourceFile)(path.join(p,h),i.exists)??path.join(p,h,"index.ts"):r;return{specifier:`${e.name}/${h}`,entry:x,exists:!1}}M(subpathFor,"subpathFor"),y(subpathFor,"subpathFor");function measure(e,o,r,s,i,u,a){if(!r.has(o.rootEntry))return;const l=y(t=>a(t)===o,"inLib"),d=e.modules.filter(t=>l(t.resource)),p=e.modules.filter(t=>!l(t.resource)&&t.dependencies.includes(o.rootEntry)).map(t=>t.resource).sort();if(p.length===0)return;const c=s.workspaceRoot,h=s.thresholds,x=d.filter(t=>t.resource!==o.rootEntry&&t.dependencies.includes(o.rootEntry)).map(t=>t.resource),f=new Set;for(const t of e.modules)if(!l(t.resource))for(const n of t.dependencies)n!==o.rootEntry&&l(n)&&f.add(n);const $=readRootUse(o,p,s,i),w=new Set(f),v=new Set,S=new Map,R=new Set,_=new Set;for(const t of $.importers)for(const n of t.values){if(_.add(n),S.has(n)||v.has(n)||R.has(n))continue;const m=u.resolve(o.rootEntry,n);m?m.file===o.rootEntry?R.add(n):m.typeOnly||(S.set(n,m.file),w.add(m.file)):v.add(n)}if(R.size>0)for(const t of u.index(o.rootEntry)?.valueImports??[]){const n=i.resolve(o.rootEntry,t);n&&w.add(n)}const L=$.importers.some(t=>t.wholeModule),B=L?new Set(d.map(t=>t.resource)):closureWithin(o,w,r,o.rootEntry,a),T=y(t=>{let n=0;for(const m of t)n+=r.get(m)?.size??0;return n},"sizeOf"),U=d.reduce((t,n)=>t+n.size,0),z=T(B),A=d.filter(t=>!B.has(t.resource)),I=o.files>0?Math.min(1,d.length/o.files):1,O=new Map,D=new Map,k=y((t,n)=>{let m=D.get(t);return m===void 0&&(m=subpathFor(o,t,n,u,s.source,a)??null,D.set(t,m)),m??void 0},"choose"),F=$.importers.map(t=>{const n=new Map;for(const m of t.values){const g=S.get(m);if(!g)continue;const E=k(m,g);if(!E)continue;const j=O.get(E.specifier)??{specifier:E.specifier,entry:rel(c,E.entry),symbols:[],exists:E.exists};j.symbols.includes(m)||j.symbols.push(m),O.set(E.specifier,j),n.set(E.specifier,[...n.get(E.specifier)??[],m])}return{file:rel(c,t.file),symbols:t.values.slice(0,MAX_SYMBOLS_LISTED),typeOnly:t.typeOnly,wholeModule:t.wholeModule,rewrite:[...n].sort((m,g)=>m[0].localeCompare(g[0])).map(([m,g])=>`import { ${g.join(", ")} } from '${m}';`)}}).sort((t,n)=>Number(n.wholeModule)-Number(t.wholeModule)||n.symbols.length-t.symbols.length||t.file.localeCompare(n.file)),b={project:e.project,library:o.name,libraryRoot:rel(c,o.root),rootEntry:rel(c,o.rootEntry),libraryFiles:o.files,compiledModules:d.length,compiledBytes:U,share:I,rootImporterCount:p.length,rootImporters:F.slice(0,MAX_IMPORTERS_LISTED),internalRootImporters:x.slice(0,MAX_INTERNAL_LISTED).map(t=>rel(c,t)),symbols:_.size,unresolvedSymbols:[...v].sort().slice(0,MAX_SYMBOLS_LISTED),barrelDefines:[...R].sort().slice(0,MAX_SYMBOLS_LISTED),neededModules:B.size,neededBytes:z,avoidableModules:A.length,avoidableBytes:A.reduce((t,n)=>t+n.size,0),subpaths:[...O.values()].map(t=>({...t,symbols:t.symbols.sort().slice(0,MAX_SYMBOLS_LISTED)})).sort((t,n)=>Number(t.exists)-Number(n.exists)||n.symbols.length-t.symbols.length).slice(0,MAX_SUBPATHS_LISTED),fires:!1};return I<h.minShare?b.quiet=`compiles ${pct(I)} of the library (below ${pct(h.minShare)})`:b.compiledModules<h.minModules&&b.compiledBytes<h.minBytes?b.quiet=`compiles ${b.compiledModules} modules / ${mb(b.compiledBytes)} (below ${h.minModules} modules and ${mb(h.minBytes)})`:L?b.quiet="an importer uses the whole module (a namespace passed on, require(), import(), export *) \u2014 it may need all of it":_.size>0&&v.size/_.size>MAX_UNRESOLVED_SHARE?b.quiet=`could not follow ${v.size} of ${_.size} symbols to their files`:b.neededModules>h.maxNeededShare*b.compiledModules?b.quiet=`its importers need ${b.neededModules} of the ${b.compiledModules} compiled modules (above ${pct(h.maxNeededShare)})`:b.fires=!0,b}M(measure,"measure"),y(measure,"measure");const pct=y(e=>`${Math.round(e*100)}%`,"pct"),mb=y(e=>`${(e/(1024*1024)).toFixed(1)} MB`,"mb");function analyzeBarrelImports(e){const o=y(l=>e.source.exists(l),"exists"),r=new AliasResolver(e.libraries,o),s=new ExportReader(e.source,r),i=new Map,u=y(l=>(i.has(l)||i.set(l,(0,workspace_libraries_1.libraryOf)(e.libraries,l)),i.get(l)),"owner"),a=[];for(const l of e.projects){const d=new Map(l.modules.map(p=>[p.resource,p]));for(const p of e.libraries){if(e.expired?.())return{complete:!1,measurements:a};const c=measure(l,p,d,e,r,s,u);c&&a.push(c)}}return{complete:!e.expired?.(),measurements:a}}M(analyzeBarrelImports,"analyzeBarrelImports"),y(analyzeBarrelImports,"analyzeBarrelImports"),exports.EXECUTOR_MB_PER_MODULE=.374;function describeHeavyBarrel(e,o){const r=o&&o.builtModules>=50?o.durationMs/o.builtModules:void 0,s=r!==void 0?Math.round(r*e.avoidableModules):void 0,i=Math.round(exports.EXECUTOR_MB_PER_MODULE*e.avoidableModules),u=e.rootImporters.slice(0,3),a=e.subpaths.filter(c=>!c.exists),l=u.map(c=>`${c.file}: replace its \`${e.library}\` import with ${c.rewrite.length?c.rewrite.join(" "):"imports from the subpaths that export what it uses"}`),d=[`Import ${e.library} by subpath, never by its root barrel (${e.rootEntry}). ${e.rootImporterCount} file(s) of ${e.project}'s build import the root; ${l.length?`start with \u2014 ${l.join(" | ")}`:"see evidence.rootImporters"}${e.rootImporterCount>u.length?` (+${e.rootImporterCount-u.length} more: evidence.rootImporters)`:""}.`];a.length&&d.push(`Add the missing subpath entr${a.length===1?"y":"ies"} to the library: ${a.slice(0,4).map(c=>`"${c.specifier}" \u2192 ${c.entry}`).join(", ")} \u2014 in tsconfig.base.json \`compilerOptions.paths\` and, if the library has a package.json, its \`exports\` ("./<domain>"). Add exact keys (plus "<domain>/*" for single files), never one library-wide "${e.library}/*": a bundler's resolver can rank it above the exact keys and re-route them at runtime while tsc and jest stay green.`),e.barrelDefines.length&&d.push(`${e.rootEntry} defines ${e.barrelDefines.slice(0,4).join(", ")} itself, so importing ${e.barrelDefines.length===1?"it":"them"} runs the whole barrel: move ${e.barrelDefines.length===1?"it":"them"} into a module of ${e.barrelDefines.length===1?"its":"their"} own and import that.`),e.internalRootImporters.length&&d.push(`${e.internalRootImporters.length} file(s) inside ${e.library} import its own root barrel (${e.internalRootImporters.slice(0,3).join(", ")}): make them import the module they need, or every subpath still pulls the whole library in.`),d.push(`Stop the root import from coming back: in ${e.project}'s ESLint config add \`'no-restricted-imports': ['error', { paths: [{ name: '${e.library}', message: 'Import from a domain subpath (${e.library}/<domain>), not the root barrel.' }] }]\`.`);const p=`Save a file of ${e.project} (or restart it) so its dev build recompiles: it should compile about ${e.neededModules} modules of ${e.library} instead of ${e.compiledModules}, and LensMCP retracts this finding \u2014 \`observe_current_status\` no longer lists bundle/heavy-barrel-import for ${e.project}. Then check its pods' live heap (\`memory.pods\`).`;return{subject:e.library,severity:"warning",title:`${e.project} compiles ${e.compiledModules} of the ${e.libraryFiles} files of ${e.library} through its root barrel; its imports need ${e.neededModules}`,summary:`${e.rootImporterCount} file(s) of ${e.project} import ${e.library} through its root entry and take ${e.symbols} symbol(s); those need ${e.neededModules} of the library's modules, but the barrel makes the dev build compile ${e.compiledModules} (${mb(e.compiledBytes)}) \u2014 ${e.avoidableModules} modules (${mb(e.avoidableBytes)}) nothing uses, compiled in every service that does the same and loaded into every pod.`,evidence:{library:e.library,libraryRoot:e.libraryRoot,rootEntry:e.rootEntry,libraryFiles:e.libraryFiles,compiledModules:e.compiledModules,compiledBytes:e.compiledBytes,share:Math.round(e.share*1e3)/1e3,neededModules:e.neededModules,neededBytes:e.neededBytes,avoidableModules:e.avoidableModules,avoidableBytes:e.avoidableBytes,symbols:e.symbols,unresolvedSymbols:e.unresolvedSymbols,barrelDefines:e.barrelDefines,rootImporterCount:e.rootImporterCount,rootImporters:e.rootImporters,internalRootImporters:e.internalRootImporters,subpaths:e.subpaths},cost:{modules:e.avoidableModules,bytes:e.avoidableBytes,...s!==void 0?{compileMs:s}:{},memoryMb:i,basis:`modules/bytes measured in this compilation; memoryMb = ${exports.EXECUTOR_MB_PER_MODULE} MB of webpack-executor heap per compiled module (fitted on FoodGuard's watchers)${s!==void 0?"; compileMs = the last full build's time per built module \xD7 the avoidable modules":""}. Each pod also loads them, at runtime cost the bundle cannot measure.`},fix:d,verify:p}}M(describeHeavyBarrel,"describeHeavyBarrel"),y(describeHeavyBarrel,"describeHeavyBarrel");

package/perf/perf-config.d.ts

@@ -0,0 +1,29 @@
+import { type HeavyBarrelThresholds } from './heavy-barrel-import';
+/** `LENSMCP_PERF_RULES=0` (or `off`/`false`/`no`) turns every performance rule off. */
+export declare const PERF_RULES_ENV = "LENSMCP_PERF_RULES";
+/** How long one analysis may run before it gives up (and concludes nothing). */
+export declare const PERF_RULES_BUDGET_ENV = "LENSMCP_PERF_RULES_BUDGET_MS";
+export declare const DEFAULT_PERF_RULES_BUDGET_MS = 5000;
+/** The env override of each heavy-barrel threshold. */
+export declare const HEAVY_BARREL_ENV: {
+    readonly minShare: "LENSMCP_BARREL_MIN_SHARE";
+    readonly minModules: "LENSMCP_BARREL_MIN_MODULES";
+    readonly minKb: "LENSMCP_BARREL_MIN_KB";
+    readonly maxNeededShare: "LENSMCP_BARREL_MAX_NEEDED_SHARE";
+};
+export interface BundleRuleSettings {
+    enabled: boolean;
+    thresholds: HeavyBarrelThresholds;
+    /** Time budget of one analysis, ms. */
+    budgetMs: number;
+}
+interface PerfRulesConfigJson {
+    enabled?: unknown;
+    budgetMs?: unknown;
+    [rule: string]: unknown;
+}
+/** `.lensmcp/config.json` `perfRules`, or nothing. */
+export declare function readPerfRulesConfig(workspaceRoot: string): PerfRulesConfigJson | undefined;
+/** The build-side rules' settings for this workspace. */
+export declare function resolveBundleRuleSettings(workspaceRoot: string, env?: NodeJS.ProcessEnv): BundleRuleSettings;
+export {};

package/perf/perf-config.js

@@ -0,0 +1 @@
+"use strict";var p=Object.defineProperty;var o=(r,e)=>p(r,"name",{value:e,configurable:!0});var u=Object.defineProperty,n=o((r,e)=>u(r,"name",{value:e,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.HEAVY_BARREL_ENV=exports.DEFAULT_PERF_RULES_BUDGET_MS=exports.PERF_RULES_BUDGET_ENV=exports.PERF_RULES_ENV=void 0,exports.readPerfRulesConfig=readPerfRulesConfig,exports.resolveBundleRuleSettings=resolveBundleRuleSettings;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path")),heavy_barrel_import_1=require("./heavy-barrel-import");exports.PERF_RULES_ENV="LENSMCP_PERF_RULES",exports.PERF_RULES_BUDGET_ENV="LENSMCP_PERF_RULES_BUDGET_MS",exports.DEFAULT_PERF_RULES_BUDGET_MS=5e3,exports.HEAVY_BARREL_ENV={minShare:"LENSMCP_BARREL_MIN_SHARE",minModules:"LENSMCP_BARREL_MIN_MODULES",minKb:"LENSMCP_BARREL_MIN_KB",maxNeededShare:"LENSMCP_BARREL_MAX_NEEDED_SHARE"};const OFF=/^(0|off|false|no)$/i;function bounded(r,e,t){const E=typeof r=="string"&&r.trim()!==""?Number(r):r;return typeof E=="number"&&Number.isFinite(E)&&E>=e&&E<=t?E:void 0}o(bounded,"bounded"),n(bounded,"bounded");function readPerfRulesConfig(r){try{const e=JSON.parse(fs.readFileSync(path.join(r,".lensmcp","config.json"),"utf8"))?.perfRules;return e&&typeof e=="object"&&!Array.isArray(e)?e:void 0}catch{return}}o(readPerfRulesConfig,"readPerfRulesConfig"),n(readPerfRulesConfig,"readPerfRulesConfig");function resolveBundleRuleSettings(r,e=process.env){const t=readPerfRulesConfig(r),E=t?.[heavy_barrel_import_1.HEAVY_BARREL_RULE]&&typeof t[heavy_barrel_import_1.HEAVY_BARREL_RULE]=="object"?t[heavy_barrel_import_1.HEAVY_BARREL_RULE]:{},S=!OFF.test((e[exports.PERF_RULES_ENV]??"").trim())&&t?.enabled!==!1&&E.enabled!==!1,_=n((a,d,s,i,L)=>bounded(e[a],s,i)??bounded(d,s,i)??L,"pick"),R=heavy_barrel_import_1.DEFAULT_HEAVY_BARREL_THRESHOLDS;return{enabled:S,thresholds:{minShare:_(exports.HEAVY_BARREL_ENV.minShare,E.minShare,0,1,R.minShare),minModules:_(exports.HEAVY_BARREL_ENV.minModules,E.minModules,0,1e6,R.minModules),minBytes:Math.round(_(exports.HEAVY_BARREL_ENV.minKb,E.minKb,0,1e7,R.minBytes/1024)*1024),maxNeededShare:_(exports.HEAVY_BARREL_ENV.maxNeededShare,E.maxNeededShare,0,1,R.maxNeededShare)},budgetMs:_(exports.PERF_RULES_BUDGET_ENV,t?.budgetMs,100,12e4,exports.DEFAULT_PERF_RULES_BUDGET_MS)}}o(resolveBundleRuleSettings,"resolveBundleRuleSettings"),n(resolveBundleRuleSettings,"resolveBundleRuleSettings");