@lensmcp/cluster 1.25.17 → 1.25.21

package/executors/gateway/jwks-verify.d.ts

@@ -9,8 +9,12 @@ export interface JwksVerifierOptions {
     algorithms?: string[];
     /** Periodic JWKS refresh interval (ms). Default 600000 (10 min). */
     cacheMaxAgeMs?: number;
-    /** Min interval between on-miss (unknown-kid) refreshes (ms). Default 30000. */
+    /** Min interval between on-miss (unknown-kid) refreshes (ms), counted from the moment the last one SETTLED. Default 30000. */
     missRefreshMs?: number;
+    /** How long `awaitKey` waits on the shared miss refresh before giving up (ms). Default 2000. */
+    missWaitMs?: number;
+    /** Bound on one JWKS fetch, body included (ms). Default 10000. */
+    fetchTimeoutMs?: number;
     /** Clock skew tolerance for exp/nbf (seconds). Default 60. */
     clockToleranceSec?: number;
     /** Injectable fetch (tests). Defaults to global fetch. */
@@ -24,4 +28,35 @@ export interface JwtVerifier {
     /** Stop the periodic refresh timer. */
     stop(): void;
 }
-export declare function createJwksVerifier(opts: JwksVerifierOptions): JwtVerifier;
+/** The retry schedule of {@link JwksVerifier.warm}. */
+export interface JwksWarmOptions {
+    /** Attempts before giving up — the miss and periodic refreshes take over from there. Default 8. */
+    attempts?: number;
+    /** The first retry delay (ms); it doubles on every attempt up to `maxDelayMs`. Default 1000. */
+    baseDelayMs?: number;
+    /** The ceiling on one retry delay (ms). Default 30000. */
+    maxDelayMs?: number;
+    /** Told about every failed attempt; `retryInMs` is undefined on the last one. Not called once stopped. */
+    onError?: (err: Error, attempt: number, retryInMs: number | undefined) => void;
+}
+/**
+ * What the JWKS verifier offers beyond the {@link JwtVerifier} an edge verifies with. A separate interface so a
+ * hand-built `JwtVerifier` (a spec's, an HS256 stand-in) stays one.
+ */
+export interface JwksVerifier extends JwtVerifier {
+    /**
+     * Resolve once `verify(token)` can be answered from the key cache: at once when the token's key is cached, or when
+     * `verify` would refuse the token before any key lookup (not a JWS, an `alg` we do not accept); on a `kid` miss,
+     * when the ONE refresh every missing request shares settles, and never later than `missWaitMs`. Inside the miss
+     * cooldown with nothing in flight it resolves at once — a stream of tokens with made-up `kid`s costs neither a
+     * fetch nor a wait. True when the token's key is now cached. Never rejects.
+     */
+    awaitKey(token: string): Promise<boolean>;
+    /**
+     * Load the key set in the background, retrying with a capped exponential backoff until it lands or the attempts run
+     * out. For a boot whose IdP may not be up yet: it never throws, the caller never waits on it, and `stop()` cancels
+     * it. Resolves true once the keys are loaded, false when it gave up or was stopped.
+     */
+    warm(opts?: JwksWarmOptions): Promise<boolean>;
+}
+export declare function createJwksVerifier(opts: JwksVerifierOptions): JwksVerifier;

package/executors/gateway/jwks-verify.js

@@ -1 +1 @@
-"use strict";var m=Object.defineProperty;var d=(e,c)=>m(e,"name",{value:c,configurable:!0});var j=Object.defineProperty,s=d((e,c)=>j(e,"name",{value:c,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createJwksVerifier=createJwksVerifier;const node_crypto_1=require("node:crypto"),jwt_claims_js_1=require("./jwt-claims.js"),ALG_TO_HASH={RS256:"sha256",RS384:"sha384",RS512:"sha512"},b64urlJsonSafe=s(e=>JSON.parse(Buffer.from(e,"base64url").toString("utf8")),"b64urlJsonSafe");function createJwksVerifier(e){const c=(e.algorithms??["RS256"]).filter(r=>r in ALG_TO_HASH),k=e.cacheMaxAgeMs??6e5,p=e.missRefreshMs??3e4,w=e.clockToleranceSec??60,g=e.fetchImpl??globalThis.fetch,h=e.audience===void 0?void 0:Array.isArray(e.audience)?e.audience:[e.audience];let n=new Map,o,y=0;const v=s(async()=>{const r=await g(e.jwksUrl,{headers:{accept:"application/json"}});if(!r.ok)throw new Error(`JWKS ${e.jwksUrl} \u2192 HTTP ${r.status}`);const i=await r.json(),t=new Map;for(const a of i.keys??[])if(!(a.kty!=="RSA"||!a.n||!a.e)&&!(a.use&&a.use!=="sig"))try{const l=(0,node_crypto_1.createPublicKey)({key:a,format:"jwk"});t.set(a.kid??"__single__",l)}catch{}t.size>0&&(n=t)},"load"),u=s(()=>(o||(o=v().finally(()=>{o=void 0})),o),"refresh"),S=s(r=>{r-y<p||(y=r,u().catch(()=>{}))},"refreshOnMiss"),_=setInterval(()=>{u().catch(()=>{})},k);return _.unref?.(),{verify:s(r=>{const i=r.split(".");if(i.length!==3)return;let t;try{t=b64urlJsonSafe(i[0])}catch{return}if(!t.alg||!c.includes(t.alg))return;const a=t.kid!==void 0?n.get(t.kid):n.get("__single__")??(n.size===1?[...n.values()][0]:void 0);if(!a){S(Date.now());return}let l;try{l=(0,node_crypto_1.verify)(ALG_TO_HASH[t.alg],Buffer.from(`${i[0]}.${i[1]}`),a,Buffer.from(i[2],"base64url"))}catch{return}if(!l)return;let f;try{f=b64urlJsonSafe(i[1])}catch{return}if((0,jwt_claims_js_1.checkStandardClaims)(f,{...e.issuer?{issuer:e.issuer}:{},...h?{audience:h}:{},clockToleranceS:w}))return f},"verify"),refresh:u,stop:s(()=>clearInterval(_),"stop")}}d(createJwksVerifier,"createJwksVerifier"),s(createJwksVerifier,"createJwksVerifier");
+"use strict";var K=Object.defineProperty;var p=(s,u)=>K(s,"name",{value:u,configurable:!0});var J=Object.defineProperty,a=p((s,u)=>J(s,"name",{value:u,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createJwksVerifier=createJwksVerifier;const node_crypto_1=require("node:crypto"),jwt_claims_js_1=require("./jwt-claims.js"),ALG_TO_HASH={RS256:"sha256",RS384:"sha384",RS512:"sha512"},b64urlJsonSafe=a(s=>JSON.parse(Buffer.from(s,"base64url").toString("utf8")),"b64urlJsonSafe");function createJwksVerifier(s){const u=(s.algorithms??["RS256"]).filter(e=>e in ALG_TO_HASH),T=s.cacheMaxAgeMs??6e5,b=s.missRefreshMs??3e4,j=s.missWaitMs??2e3,v=s.fetchTimeoutMs??1e4,P=s.clockToleranceSec??60,A=s.fetchImpl??globalThis.fetch,k=s.audience===void 0?void 0:Array.isArray(s.audience)?s.audience:[s.audience];let l=new Map,f,d,_=0,w=!1;const h=new Map,R=a(async e=>{const r=await A(s.jwksUrl,{headers:{accept:"application/json"},signal:e});if(!r.ok)throw new Error(`JWKS ${s.jwksUrl} \u2192 HTTP ${r.status}`);const t=await r.json(),n=new Map;for(const i of t.keys??[])if(!(i.kty!=="RSA"||!i.n||!i.e)&&!(i.use&&i.use!=="sig"))try{const c=(0,node_crypto_1.createPublicKey)({key:i,format:"jwk"});n.set(i.kid??"__single__",c)}catch{}n.size>0&&(l=n)},"load"),m=a(()=>{if(!f){const e=new AbortController;f=new Promise((r,t)=>{const n=setTimeout(()=>{e.abort(),t(new Error(`JWKS ${s.jwksUrl} \u2192 no answer in ${v} ms`))},v);n.unref?.(),R(e.signal).then(()=>{clearTimeout(n),r()},i=>{clearTimeout(n),t(i)})}).finally(()=>{f=void 0})}return f},"refresh"),g=a(()=>{if(d)return d;if(!(!f&&Date.now()<_))return d=m().catch(()=>{}).finally(()=>{d=void 0,_=Date.now()+b}),d},"refreshOnMiss"),S=setInterval(()=>{m().catch(()=>{})},T);S.unref?.();const M=a(e=>{const r=e.split(".");if(r.length!==3)return;let t;try{t=b64urlJsonSafe(r[0])}catch{return}if(!(!t.alg||!u.includes(t.alg)))return{parts:r,header:t}},"parse"),y=a(e=>e.kid!==void 0?l.get(e.kid):l.get("__single__")??(l.size===1?[...l.values()][0]:void 0),"keyFor"),x=a(e=>{const r=M(e);if(!r)return;const{parts:t,header:n}=r,i=y(n);if(!i){g();return}let c;try{c=(0,node_crypto_1.verify)(ALG_TO_HASH[n.alg],Buffer.from(`${t[0]}.${t[1]}`),i,Buffer.from(t[2],"base64url"))}catch{return}if(!c)return;let o;try{o=b64urlJsonSafe(t[1])}catch{return}if((0,jwt_claims_js_1.checkStandardClaims)(o,{...s.issuer?{issuer:s.issuer}:{},...k?{audience:k}:{},clockToleranceS:P}))return o},"verify"),$=a(async e=>{const r=M(e);if(!r)return!1;if(y(r.header))return!0;const t=g();if(!t)return!1;let n;return await Promise.race([t,new Promise(i=>{n=setTimeout(i,j),n.unref?.()})]),clearTimeout(n),y(r.header)!==void 0},"awaitKey"),D=a(e=>new Promise(r=>{const t=setTimeout(()=>{h.delete(t),r()},e);t.unref?.(),h.set(t,r)}),"sleep");return{verify:x,refresh:m,awaitKey:$,warm:a(async(e={})=>{const r=Math.max(1,e.attempts??8),t=e.baseDelayMs??1e3,n=e.maxDelayMs??3e4;for(let i=1;!w;i++)try{return await m(),!0}catch(c){if(w)return!1;const o=i<r?Math.min(n,t*2**(i-1)):void 0;try{e.onError?.(c,i,o)}catch{}if(o===void 0)return!1;await D(o)}return!1},"warm"),stop:a(()=>{w=!0,clearInterval(S);for(const[e,r]of h)clearTimeout(e),r();h.clear()},"stop")}}p(createJwksVerifier,"createJwksVerifier"),a(createJwksVerifier,"createJwksVerifier");

package/executors/gateway/runtime/edge.d.ts

@@ -104,6 +104,13 @@ export declare const cors: (req: http.IncomingMessage, res: http.ServerResponse,
  * requested headers echoed back. `methods` differs by caller — the no-route host-root uses the narrow
  * `GET,HEAD,OPTIONS`; a routed path uses the wide verb list.
  */
+/**
+ * How long a browser may reuse a preflight's answer: Chrome's cap (Firefox allows 24 h). Without it every preflighted
+ * request was preflighted again after Chrome's 5 s default — a page polling a URL with an `x-request-id` (session
+ * replay joins every request to its backend run: planning/replay/00-plan.md D5) paid an OPTIONS round trip per poll.
+ * The cache is per origin and URL, so a URL with an id in its path still asks once per id.
+ */
+export declare const PREFLIGHT_MAX_AGE = "7200";
 export declare const corsPreflight: (req: http.IncomingMessage, res: http.ServerResponse, methods: string, routes: readonly {
     host?: string;
 }[]) => void;

package/executors/gateway/runtime/edge.js

@@ -1 +1 @@
-"use strict";var d=Object.defineProperty;var c=(e,r)=>d(e,"name",{value:r,configurable:!0});var p=Object.defineProperty,o=c((e,r)=>p(e,"name",{value:r,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.PREFLIGHT_METHODS_ROUTED=exports.PREFLIGHT_METHODS_NOROUTE=exports.corsPreflight=exports.cors=exports.isRoutedOrigin=exports.callerContextOf=exports.claimedCallerIdOf=exports.CLAIMED_CALLER_ID=exports.CALLER_CONTEXT=exports.CALLER_CONTEXT_HEADERS=exports.GATEWAY_OWNED_HEADERS=exports.sendError=exports.stampForwardingHeaders=exports.clientIpOf=exports.resolveClientIp=exports.CLIENT_IP=exports.rememberRawTarget=exports.rawTargetOf=exports.RAW_TARGET=exports.canonicalPath=exports.canonicalize=exports.ENCODED_STRUCTURE=void 0,exports.stripOwnedHeaders=stripOwnedHeaders;const gateway_errors_1=require("../gateway-errors"),client_ip_1=require("../client-ip"),manifest_1=require("../manifest"),act_1=require("./act");var canonical_path_1=require("../canonical-path");Object.defineProperty(exports,"ENCODED_STRUCTURE",{enumerable:!0,get:o(function(){return canonical_path_1.ENCODED_STRUCTURE},"get")}),Object.defineProperty(exports,"canonicalize",{enumerable:!0,get:o(function(){return canonical_path_1.canonicalize},"get")}),Object.defineProperty(exports,"canonicalPath",{enumerable:!0,get:o(function(){return canonical_path_1.canonicalPath},"get")}),Object.defineProperty(exports,"RAW_TARGET",{enumerable:!0,get:o(function(){return canonical_path_1.RAW_TARGET},"get")}),Object.defineProperty(exports,"rawTargetOf",{enumerable:!0,get:o(function(){return canonical_path_1.rawTargetOf},"get")}),Object.defineProperty(exports,"rememberRawTarget",{enumerable:!0,get:o(function(){return canonical_path_1.rememberRawTarget},"get")}),exports.CLIENT_IP=Symbol.for("lensmcp.gateway.clientIp");const FORWARDED=Symbol.for("lensmcp.gateway.forwarded"),peerOnly=(0,client_ip_1.createClientIpResolver)({}),resolverOf=o(e=>e.clientIp??peerOnly,"resolverOf"),peerOf=o(e=>e.socket?.remoteAddress??"","peerOf"),resolveClientIp=o((e,r)=>{const t=resolverOf(e).clientIpOf(r,peerOf(r));return r[exports.CLIENT_IP]=t,t},"resolveClientIp");exports.resolveClientIp=resolveClientIp;const clientIpOf=o(e=>e[exports.CLIENT_IP]??peerOf(e),"clientIpOf");exports.clientIpOf=clientIpOf;const stampForwardingHeaders=o((e,r)=>{const t=r;if(t[FORWARDED])return;t[FORWARDED]=!0;const s=peerOf(r);r.headers["x-forwarded-for"]=resolverOf(e).forwardedFor(r,s),r.headers["x-forwarded-proto"]=e.https?"https":"http";const n=r.headers.host;(resolverOf(e).trustProxyHops===0||!r.headers["x-forwarded-host"])&&(n?r.headers["x-forwarded-host"]=n:delete r.headers["x-forwarded-host"])},"stampForwardingHeaders");exports.stampForwardingHeaders=stampForwardingHeaders;const sendError=o((e,r,t,s,n,i,l)=>{const a=(0,gateway_errors_1.ensureRequestId)(r);return e.headersSent||e.writeHead(t,{"content-type":gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE,"x-request-id":a,...l??{}}),e.end((0,gateway_errors_1.gatewayErrorBody)(t,s,a,n,i)),a},"sendError");exports.sendError=sendError,exports.GATEWAY_OWNED_HEADERS=["x-internal-token","x-api-key-id","x-api-key-workspace","x-user-id","x-tenant-id","x-user-roles","x-user-permissions",act_1.ACT_HEADER],exports.CALLER_CONTEXT_HEADERS=["x-tenant-id","x-user-id"],exports.CALLER_CONTEXT=Symbol.for("lensmcp.gateway.callerContext"),exports.CLAIMED_CALLER_ID=Symbol.for("lensmcp.gateway.claimedCallerId");const CALLER_ID_VALUE=/^[a-z0-9][a-z0-9._-]{0,63}$/i,CALLER_CONTEXT_VALUE=/^[\x21-\x2b\x2d-\x7e]{1,128}$/;function stripOwnedHeaders(e){const r={};for(const s of exports.CALLER_CONTEXT_HEADERS){const n=e.headers[s];typeof n=="string"&&CALLER_CONTEXT_VALUE.test(n)&&(r[s]=n)}e[exports.CALLER_CONTEXT]=r;const t=e.headers["x-api-key-id"];typeof t=="string"&&CALLER_ID_VALUE.test(t)&&(e[exports.CLAIMED_CALLER_ID]=t),(0,act_1.setActTicketAside)(e);for(const s of exports.GATEWAY_OWNED_HEADERS)delete e.headers[s]}c(stripOwnedHeaders,"stripOwnedHeaders"),o(stripOwnedHeaders,"stripOwnedHeaders");const claimedCallerIdOf=o(e=>e[exports.CLAIMED_CALLER_ID],"claimedCallerIdOf");exports.claimedCallerIdOf=claimedCallerIdOf;const callerContextOf=o(e=>e[exports.CALLER_CONTEXT]??{},"callerContextOf");exports.callerContextOf=callerContextOf;const isRoutedOrigin=o((e,r)=>{if(!e||e==="null")return!1;let t;try{t=new URL(e).hostname.toLowerCase()}catch{return!1}return t?t==="localhost"||t==="127.0.0.1"||t==="::1"?!0:r.some(s=>!!s.host&&(0,manifest_1.hostMatches)(s.host,t)):!1},"isRoutedOrigin");exports.isRoutedOrigin=isRoutedOrigin;const cors=o((e,r,t)=>{const s=e.headers.origin;typeof s!="string"||s===""||(r.setHeader("vary","Origin"),(0,exports.isRoutedOrigin)(s,t)&&(r.setHeader("access-control-allow-origin",s),r.setHeader("access-control-allow-credentials","true")))},"cors");exports.cors=cors;const corsPreflight=o((e,r,t,s)=>{(0,exports.cors)(e,r,s),r.writeHead(204,{"access-control-allow-methods":t,"access-control-allow-headers":String(e.headers["access-control-request-headers"]??"*")}),r.end()},"corsPreflight");exports.corsPreflight=corsPreflight,exports.PREFLIGHT_METHODS_NOROUTE="GET,HEAD,OPTIONS",exports.PREFLIGHT_METHODS_ROUTED="GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS";
+"use strict";var E=Object.defineProperty;var c=(e,r)=>E(e,"name",{value:r,configurable:!0});var p=Object.defineProperty,o=c((e,r)=>p(e,"name",{value:r,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.PREFLIGHT_METHODS_ROUTED=exports.PREFLIGHT_METHODS_NOROUTE=exports.corsPreflight=exports.PREFLIGHT_MAX_AGE=exports.cors=exports.isRoutedOrigin=exports.callerContextOf=exports.claimedCallerIdOf=exports.CLAIMED_CALLER_ID=exports.CALLER_CONTEXT=exports.CALLER_CONTEXT_HEADERS=exports.GATEWAY_OWNED_HEADERS=exports.sendError=exports.stampForwardingHeaders=exports.clientIpOf=exports.resolveClientIp=exports.CLIENT_IP=exports.rememberRawTarget=exports.rawTargetOf=exports.RAW_TARGET=exports.canonicalPath=exports.canonicalize=exports.ENCODED_STRUCTURE=void 0,exports.stripOwnedHeaders=stripOwnedHeaders;const gateway_errors_1=require("../gateway-errors"),client_ip_1=require("../client-ip"),manifest_1=require("../manifest"),act_1=require("./act");var canonical_path_1=require("../canonical-path");Object.defineProperty(exports,"ENCODED_STRUCTURE",{enumerable:!0,get:o(function(){return canonical_path_1.ENCODED_STRUCTURE},"get")}),Object.defineProperty(exports,"canonicalize",{enumerable:!0,get:o(function(){return canonical_path_1.canonicalize},"get")}),Object.defineProperty(exports,"canonicalPath",{enumerable:!0,get:o(function(){return canonical_path_1.canonicalPath},"get")}),Object.defineProperty(exports,"RAW_TARGET",{enumerable:!0,get:o(function(){return canonical_path_1.RAW_TARGET},"get")}),Object.defineProperty(exports,"rawTargetOf",{enumerable:!0,get:o(function(){return canonical_path_1.rawTargetOf},"get")}),Object.defineProperty(exports,"rememberRawTarget",{enumerable:!0,get:o(function(){return canonical_path_1.rememberRawTarget},"get")}),exports.CLIENT_IP=Symbol.for("lensmcp.gateway.clientIp");const FORWARDED=Symbol.for("lensmcp.gateway.forwarded"),peerOnly=(0,client_ip_1.createClientIpResolver)({}),resolverOf=o(e=>e.clientIp??peerOnly,"resolverOf"),peerOf=o(e=>e.socket?.remoteAddress??"","peerOf"),resolveClientIp=o((e,r)=>{const t=resolverOf(e).clientIpOf(r,peerOf(r));return r[exports.CLIENT_IP]=t,t},"resolveClientIp");exports.resolveClientIp=resolveClientIp;const clientIpOf=o(e=>e[exports.CLIENT_IP]??peerOf(e),"clientIpOf");exports.clientIpOf=clientIpOf;const stampForwardingHeaders=o((e,r)=>{const t=r;if(t[FORWARDED])return;t[FORWARDED]=!0;const s=peerOf(r);r.headers["x-forwarded-for"]=resolverOf(e).forwardedFor(r,s),r.headers["x-forwarded-proto"]=e.https?"https":"http";const n=r.headers.host;(resolverOf(e).trustProxyHops===0||!r.headers["x-forwarded-host"])&&(n?r.headers["x-forwarded-host"]=n:delete r.headers["x-forwarded-host"])},"stampForwardingHeaders");exports.stampForwardingHeaders=stampForwardingHeaders;const sendError=o((e,r,t,s,n,i,l)=>{const a=(0,gateway_errors_1.ensureRequestId)(r);return e.headersSent||e.writeHead(t,{"content-type":gateway_errors_1.GATEWAY_ERROR_CONTENT_TYPE,"x-request-id":a,...l??{}}),e.end((0,gateway_errors_1.gatewayErrorBody)(t,s,a,n,i)),a},"sendError");exports.sendError=sendError,exports.GATEWAY_OWNED_HEADERS=["x-internal-token","x-api-key-id","x-api-key-workspace","x-user-id","x-tenant-id","x-user-roles","x-user-permissions",act_1.ACT_HEADER],exports.CALLER_CONTEXT_HEADERS=["x-tenant-id","x-user-id"],exports.CALLER_CONTEXT=Symbol.for("lensmcp.gateway.callerContext"),exports.CLAIMED_CALLER_ID=Symbol.for("lensmcp.gateway.claimedCallerId");const CALLER_ID_VALUE=/^[a-z0-9][a-z0-9._-]{0,63}$/i,CALLER_CONTEXT_VALUE=/^[\x21-\x2b\x2d-\x7e]{1,128}$/;function stripOwnedHeaders(e){const r={};for(const s of exports.CALLER_CONTEXT_HEADERS){const n=e.headers[s];typeof n=="string"&&CALLER_CONTEXT_VALUE.test(n)&&(r[s]=n)}e[exports.CALLER_CONTEXT]=r;const t=e.headers["x-api-key-id"];typeof t=="string"&&CALLER_ID_VALUE.test(t)&&(e[exports.CLAIMED_CALLER_ID]=t),(0,act_1.setActTicketAside)(e);for(const s of exports.GATEWAY_OWNED_HEADERS)delete e.headers[s]}c(stripOwnedHeaders,"stripOwnedHeaders"),o(stripOwnedHeaders,"stripOwnedHeaders");const claimedCallerIdOf=o(e=>e[exports.CLAIMED_CALLER_ID],"claimedCallerIdOf");exports.claimedCallerIdOf=claimedCallerIdOf;const callerContextOf=o(e=>e[exports.CALLER_CONTEXT]??{},"callerContextOf");exports.callerContextOf=callerContextOf;const isRoutedOrigin=o((e,r)=>{if(!e||e==="null")return!1;let t;try{t=new URL(e).hostname.toLowerCase()}catch{return!1}return t?t==="localhost"||t==="127.0.0.1"||t==="::1"?!0:r.some(s=>!!s.host&&(0,manifest_1.hostMatches)(s.host,t)):!1},"isRoutedOrigin");exports.isRoutedOrigin=isRoutedOrigin;const cors=o((e,r,t)=>{const s=e.headers.origin;typeof s!="string"||s===""||(r.setHeader("vary","Origin"),(0,exports.isRoutedOrigin)(s,t)&&(r.setHeader("access-control-allow-origin",s),r.setHeader("access-control-allow-credentials","true")))},"cors");exports.cors=cors,exports.PREFLIGHT_MAX_AGE="7200";const corsPreflight=o((e,r,t,s)=>{(0,exports.cors)(e,r,s),r.writeHead(204,{"access-control-allow-methods":t,"access-control-allow-headers":String(e.headers["access-control-request-headers"]??"*"),"access-control-max-age":exports.PREFLIGHT_MAX_AGE}),r.end()},"corsPreflight");exports.corsPreflight=corsPreflight,exports.PREFLIGHT_METHODS_NOROUTE="GET,HEAD,OPTIONS",exports.PREFLIGHT_METHODS_ROUTED="GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS";

package/executors/gateway/runtime/handler.js

@@ -1 +1 @@
-"use strict";var q=Object.defineProperty;var y=(f,n)=>q(f,"name",{value:n,configurable:!0});var x=Object.defineProperty,p=y((f,n)=>x(f,"name",{value:n,configurable:!0}),"p");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHandler=createHandler;const manifest_1=require("../manifest"),service_keys_1=require("./service-keys"),gateway_errors_1=require("../gateway-errors"),discovery_1=require("./discovery"),edge_1=require("./edge"),observability_1=require("./observability"),chooser_1=require("./chooser");function createHandler(f){const{rt:n,obs:d,auth:v,proxy:_,hooks:i}=f,O=p(e=>(e.headers.host||"").split(":")[0],"hostOf"),S=p((e,t)=>{if((0,edge_1.cors)(e,t,n.routes),e.method==="OPTIONS"){t.writeHead(204,{"access-control-allow-methods":edge_1.PREFLIGHT_METHODS_NOROUTE,"access-control-allow-headers":String(e.headers["access-control-request-headers"]??"*")}),t.end();return}const o=(e.headers.host||"").split(":")[0],u=n.routes.filter(r=>r.host&&(0,manifest_1.hostMatches)(r.host,o)&&r.prefix),s=(e.url??"/").split("?")[0];if((s==="/"||s==="/index.html"||s==="")&&n.routes.some(r=>r.host&&(0,manifest_1.hostMatches)(r.host,o)&&r.project===observability_1.LENS_DASHBOARD_PROJECT)){(0,chooser_1.serveChooser)(t,n.wsKey,e);return}if(u.length>0&&(s==="/health"||s==="/healthz")){const r=u.map(l=>({project:l.project,prefix:l.prefix,pods:l.pool?((0,discovery_1.pickSock)(l.pool,0),l.pool.socks.length):void 0,state:l.svc?.state??(l.target?"up":"unknown")})),h=r.every(l=>l.state!=="down"||!0);t.writeHead(h?200:503,{"content-type":"application/json"}),t.end(JSON.stringify({status:"ok",host:o,services:r},null,2));return}if(u.length>0&&s==="/.well-known/services"){t.writeHead(200,{"content-type":"application/json"}),t.end(JSON.stringify({host:o,services:u.map(r=>({prefix:r.prefix,project:r.project,internal:!!r.internal}))},null,2));return}(0,edge_1.sendError)(t,e,404,"not_found",u.length>0?`No service mounted at ${s}. Mounted on ${o}: ${[...new Set(u.map(r=>r.prefix))].join(", ")} (+ /health, /.well-known/services)`:"No gateway route for this hostname.")},"handleNoRoute"),b=p(async(e,t)=>{if(!e.headers.host){const r=e.authority??e.headers[":authority"];r&&(e.headers.host=r)}(0,edge_1.stripOwnedHeaders)(e);let o=d.beginTrace(e);const u=Date.now();(0,gateway_errors_1.ensureRequestId)(e),o&&(d.traceStep(o,"received",{host:o.host,method:o.method,url:o.url}),e.__lensmcpTrace=o);const s=i.httpContext(e,t,o);try{const r=e.url??"/",h=(0,edge_1.canonicalize)(r);if(h===void 0){d.traceStep(o,"bad-path",{}),d.finishTrace(o,"gateway",400),(0,edge_1.sendError)(t,e,400,"bad_request","Bad Request");return}const l=h.policy,m=h.path+h.query;if(m!==r&&(0,edge_1.rememberRawTarget)(e,r),e.url=m,(0,edge_1.resolveClientIp)(n,e),i.has("onRequest")&&(await i.run("onRequest",s),s.responded()))return;const a=(0,manifest_1.matchRoute)(n.routes,O(e),l+h.query);if(!a){S(e,t);return}s.route=a;const w=d.startHeadlessFlow(e,a,o,u);if(w!==o&&(o=w,s.trace=w,e.__lensmcpTrace=w),d.traceStep(o,"route-match",{project:a.project,...a.prefix?{prefix:a.prefix}:{},...a.host?{routeHost:a.host}:{},...a.internal?{internal:!0}:{}}),e.method==="OPTIONS"){(0,edge_1.cors)(e,t,n.routes),t.writeHead(204,{"access-control-allow-methods":edge_1.PREFLIGHT_METHODS_ROUTED,"access-control-allow-headers":String(e.headers["access-control-request-headers"]??"*")}),t.end();return}if((0,edge_1.cors)(e,t,n.routes),i.has("beforeAuth")&&(await i.run("beforeAuth",s),s.responded()))return;if(a.internal){const c=v.internal(e,a,o);if(!c.ok){d.finishTrace(o,a.project,c.status,void 0,a),(0,edge_1.sendError)(t,e,c.status,c.reason,c.detail);return}s.caller=c.caller}else{const c=v.public(e,a,o,l);if(!c.ok){d.finishTrace(o,a.project,c.status,void 0,a),(0,edge_1.sendError)(t,e,c.status,c.reason,c.detail);return}if(s.claims=c.claims,i.has("afterAuth")&&(await i.run("afterAuth",s),s.responded()))return}const g=a.pool?n.serviceKeys[(0,service_keys_1.serviceKeyId)(a.svc?.wsKey,a.project)]:void 0;if(g&&(e.headers["x-internal-token"]=g),(0,edge_1.stampForwardingHeaders)(n,e),i.has("beforeForward")&&(await i.run("beforeForward",s),s.responded()))return;i.has("onResponse")&&t.on("close",()=>{s.status=t.statusCode??0,i.run("onResponse",s)}),_.forward(a,e,t)}catch(r){s.error=r,console.error(`[gateway] ${new Date().toISOString()} pipeline error traceId=${(0,gateway_errors_1.ensureRequestId)(e)}: ${r?.stack??String(r)}`),i.has("onError")&&await i.run("onError",s),s.responded()||(0,edge_1.sendError)(t,e,500,"internal","Internal gateway error.")}},"runPipeline");return(e,t)=>{b(e,t)}}y(createHandler,"createHandler"),p(createHandler,"createHandler");
+"use strict";var O=Object.defineProperty;var y=(f,n)=>O(f,"name",{value:n,configurable:!0});var R=Object.defineProperty,p=y((f,n)=>R(f,"name",{value:n,configurable:!0}),"p");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHandler=createHandler;const manifest_1=require("../manifest"),service_keys_1=require("./service-keys"),gateway_errors_1=require("../gateway-errors"),discovery_1=require("./discovery"),edge_1=require("./edge"),observability_1=require("./observability"),chooser_1=require("./chooser");function createHandler(f){const{rt:n,obs:d,auth:v,proxy:g,hooks:i}=f,E=p(e=>(e.headers.host||"").split(":")[0],"hostOf"),x=p((e,t)=>{if((0,edge_1.cors)(e,t,n.routes),e.method==="OPTIONS"){t.writeHead(204,{"access-control-allow-methods":edge_1.PREFLIGHT_METHODS_NOROUTE,"access-control-allow-headers":String(e.headers["access-control-request-headers"]??"*"),"access-control-max-age":edge_1.PREFLIGHT_MAX_AGE}),t.end();return}const o=(e.headers.host||"").split(":")[0],u=n.routes.filter(r=>r.host&&(0,manifest_1.hostMatches)(r.host,o)&&r.prefix),s=(e.url??"/").split("?")[0];if((s==="/"||s==="/index.html"||s==="")&&n.routes.some(r=>r.host&&(0,manifest_1.hostMatches)(r.host,o)&&r.project===observability_1.LENS_DASHBOARD_PROJECT)){(0,chooser_1.serveChooser)(t,n.wsKey,e);return}if(u.length>0&&(s==="/health"||s==="/healthz")){const r=u.map(l=>({project:l.project,prefix:l.prefix,pods:l.pool?((0,discovery_1.pickSock)(l.pool,0),l.pool.socks.length):void 0,state:l.svc?.state??(l.target?"up":"unknown")})),h=r.every(l=>l.state!=="down"||!0);t.writeHead(h?200:503,{"content-type":"application/json"}),t.end(JSON.stringify({status:"ok",host:o,services:r},null,2));return}if(u.length>0&&s==="/.well-known/services"){t.writeHead(200,{"content-type":"application/json"}),t.end(JSON.stringify({host:o,services:u.map(r=>({prefix:r.prefix,project:r.project,internal:!!r.internal}))},null,2));return}(0,edge_1.sendError)(t,e,404,"not_found",u.length>0?`No service mounted at ${s}. Mounted on ${o}: ${[...new Set(u.map(r=>r.prefix))].join(", ")} (+ /health, /.well-known/services)`:"No gateway route for this hostname.")},"handleNoRoute"),H=p(async(e,t)=>{if(!e.headers.host){const r=e.authority??e.headers[":authority"];r&&(e.headers.host=r)}(0,edge_1.stripOwnedHeaders)(e);let o=d.beginTrace(e);const u=Date.now();(0,gateway_errors_1.ensureRequestId)(e),o&&(d.traceStep(o,"received",{host:o.host,method:o.method,url:o.url}),e.__lensmcpTrace=o);const s=i.httpContext(e,t,o);try{const r=e.url??"/",h=(0,edge_1.canonicalize)(r);if(h===void 0){d.traceStep(o,"bad-path",{}),d.finishTrace(o,"gateway",400),(0,edge_1.sendError)(t,e,400,"bad_request","Bad Request");return}const l=h.policy,m=h.path+h.query;if(m!==r&&(0,edge_1.rememberRawTarget)(e,r),e.url=m,(0,edge_1.resolveClientIp)(n,e),i.has("onRequest")&&(await i.run("onRequest",s),s.responded()))return;const a=(0,manifest_1.matchRoute)(n.routes,E(e),l+h.query);if(!a){x(e,t);return}s.route=a;const w=d.startHeadlessFlow(e,a,o,u);if(w!==o&&(o=w,s.trace=w,e.__lensmcpTrace=w),d.traceStep(o,"route-match",{project:a.project,...a.prefix?{prefix:a.prefix}:{},...a.host?{routeHost:a.host}:{},...a.internal?{internal:!0}:{}}),e.method==="OPTIONS"){(0,edge_1.cors)(e,t,n.routes),t.writeHead(204,{"access-control-allow-methods":edge_1.PREFLIGHT_METHODS_ROUTED,"access-control-allow-headers":String(e.headers["access-control-request-headers"]??"*"),"access-control-max-age":edge_1.PREFLIGHT_MAX_AGE}),t.end();return}if((0,edge_1.cors)(e,t,n.routes),i.has("beforeAuth")&&(await i.run("beforeAuth",s),s.responded()))return;if(a.internal){const c=v.internal(e,a,o);if(!c.ok){d.finishTrace(o,a.project,c.status,void 0,a),(0,edge_1.sendError)(t,e,c.status,c.reason,c.detail);return}s.caller=c.caller}else{const c=v.public(e,a,o,l);if(!c.ok){d.finishTrace(o,a.project,c.status,void 0,a),(0,edge_1.sendError)(t,e,c.status,c.reason,c.detail);return}if(s.claims=c.claims,i.has("afterAuth")&&(await i.run("afterAuth",s),s.responded()))return}const _=a.pool?n.serviceKeys[(0,service_keys_1.serviceKeyId)(a.svc?.wsKey,a.project)]:void 0;if(_&&(e.headers["x-internal-token"]=_),(0,edge_1.stampForwardingHeaders)(n,e),i.has("beforeForward")&&(await i.run("beforeForward",s),s.responded()))return;i.has("onResponse")&&t.on("close",()=>{s.status=t.statusCode??0,i.run("onResponse",s)}),g.forward(a,e,t)}catch(r){s.error=r,console.error(`[gateway] ${new Date().toISOString()} pipeline error traceId=${(0,gateway_errors_1.ensureRequestId)(e)}: ${r?.stack??String(r)}`),i.has("onError")&&await i.run("onError",s),s.responded()||(0,edge_1.sendError)(t,e,500,"internal","Internal gateway error.")}},"runPipeline");return(e,t)=>{H(e,t)}}y(createHandler,"createHandler"),p(createHandler,"createHandler");

package/executors/gateway/runtime/lens-children.js

@@ -1 +1 @@
-"use strict";var Ce=Object.defineProperty;var v=(s,E)=>Ce(s,"name",{value:E,configurable:!0});var Pe=Object.defineProperty,d=v((s,E)=>Pe(s,"name",{value:E,configurable:!0}),"d");Object.defineProperty(exports,"__esModule",{value:!0}),exports.probePortFree=probePortFree,exports.probePortListening=probePortListening,exports.probeWatcherHealth=probeWatcherHealth,exports.waitForPortFree=waitForPortFree,exports.viteArgPort=viteArgPort,exports.describeChildExit=describeChildExit,exports.signalChild=signalChild,exports.claimPort=claimPort,exports.createLensChildren=createLensChildren;const tslib_1=require("tslib"),net=tslib_1.__importStar(require("node:net")),path=tslib_1.__importStar(require("node:path")),node_child_process_1=require("node:child_process"),lens_frontend_1=require("@lensmcp/nx-plugin/lens-frontend"),hmr_reload_1=require("./hmr-reload"),process_name_1=require("../../../process-name"),pod_env_1=require("./pod-env"),scope_1=require("./scope"),workspace_registry_1=require("./workspace-registry"),lifecycle_1=require("./lifecycle"),types_1=require("./types"),observability_1=require("./observability"),HEAL_BASE_MS=1500,HEAL_MAX_MS=3e4,HEAL_HEALTHY_MS=2e4;function tryBind(s,E){return new Promise(f=>{const _=net.createServer();_.unref(),_.once("error",p=>{const g=p.code??"";f(g==="EADDRINUSE"||g==="EACCES"?"in-use":"unavailable")}),_.listen(E===void 0?{port:s}:{port:s,host:E},()=>_.close(()=>f("free")))})}v(tryBind,"tryBind"),d(tryBind,"tryBind");async function probePortFree(s){for(const E of[void 0,"0.0.0.0","127.0.0.1","::1"])if(await tryBind(s,E)==="in-use")return!1;return!0}v(probePortFree,"probePortFree"),d(probePortFree,"probePortFree");function probeConnect(s,E,f){return new Promise(_=>{let p=!1;const g=net.createConnection({host:s,port:E});g.unref();const M=setTimeout(()=>L(!1),f);M.unref?.();function L(b){p||(p=!0,clearTimeout(M),g.destroy(),_(b))}v(L,"R"),d(L,"finish"),g.once("connect",()=>L(!0)),g.once("error",()=>L(!1))})}v(probeConnect,"probeConnect"),d(probeConnect,"probeConnect");async function probePortListening(s,E=1e3){return await probeConnect("127.0.0.1",s,E)?!0:probeConnect("::1",s,E)}v(probePortListening,"probePortListening"),d(probePortListening,"probePortListening");async function probeWatcherHealth(s,E=1500){try{const f=new AbortController,_=setTimeout(()=>f.abort(),E);_.unref?.();try{const p=await fetch(`http://127.0.0.1:${s}/__lensmcp/watcher-health`,{signal:f.signal});if(!p.ok)return null;const g=await p.json();if(typeof g?.lastFsSetEventAt!="number")return null;const M=Array.isArray(g.recentEvents)?g.recentEvents.filter(L=>L&&typeof L.path=="string"&&typeof L.at=="number"&&typeof L.sequence=="number"&&["add","addDir","unlink","unlinkDir"].includes(L.kind)):[];return{schemaVersion:g.schemaVersion===2?2:1,ready:g.ready!==!1,sequence:typeof g.sequence=="number"?g.sequence:0,lastFsSetEventAt:g.lastFsSetEventAt,fsSetEvents:typeof g.fsSetEvents=="number"?g.fsSetEvents:0,recentEvents:M}}finally{clearTimeout(_)}}catch{return null}}v(probeWatcherHealth,"probeWatcherHealth"),d(probeWatcherHealth,"probeWatcherHealth");const sleepUnref=d(s=>new Promise(E=>{setTimeout(E,s).unref?.()}),"sleepUnref");async function waitForPortFree(s,E,f={}){const _=f.isPortFree??probePortFree,p=Math.max(1,f.intervalMs??types_1.PORT_FREE_POLL_MS),g=Date.now()+Math.max(0,E);for(;;){if(await _(s))return!0;const M=g-Date.now();if(M<=0)return!1;await sleepUnref(Math.min(p,M))}}v(waitForPortFree,"waitForPortFree"),d(waitForPortFree,"waitForPortFree");function viteArgPort(s){const E=d(f=>Number.isInteger(f)&&f>0&&f<65536?f:void 0,"valid");for(let f=0;f<s.length;f+=1){const _=s[f];if(_==="--port")return E(Number(s[f+1]));if(_.startsWith("--port="))return E(Number(_.slice(7)))}}v(viteArgPort,"viteArgPort"),d(viteArgPort,"viteArgPort");function describeChildExit(s){return s.signalCode?`killed by ${s.signalCode}`:s.exitCode===null?"exit status unknown":`exit code ${s.exitCode}`}v(describeChildExit,"describeChildExit"),d(describeChildExit,"describeChildExit");function signalChild(s,E){if(s.pid===void 0)return!1;try{return s.kill(E)}catch{return!1}}v(signalChild,"signalChild"),d(signalChild,"signalChild");async function claimPort(s,E,f,_){let p=s;for(;E.has(p)||_?.has(p)||!await f(p);)p+=1;return E.add(p),p}v(claimPort,"claimPort"),d(claimPort,"claimPort");function createLensChildren(s,E,f,_){const{emit:p}=E,g=_?.isPortFree??probePortFree,M=(f.ports?.length?f.ports:[443]).join(","),L=_?.probeWatcherHealth??probeWatcherHealth,b=[],B=new Map,A=new Map,I=new Map,Y=new Map,W=new Set;let j;const m=new Map,$=new Set,q=new Set,V=new Set,T=new Set,C=new Map,F=new WeakMap,G=new Set,Q=d((e,r,o)=>{if(G.has(e))return;G.add(e);const t=setInterval(()=>{(async()=>{if(s.stopped()||$.has(e)){clearInterval(t),G.delete(e);return}await g(r)&&(clearInterval(t),G.delete(e),console.log(`[gateway] lens child ${e}: :${r} freed \u2014 respawning.`),o())})().catch(()=>{})},types_1.LENS_PARKED_PORT_REPROBE_MS);t.unref?.()},"parkUntilPortFree"),x=d(async(e,r,o)=>{const t=await claimPort(e,r,g,o?.reserved);return t!==e&&(o?.heldBy?console.log(`[gateway] handoff: :${e} is held by ${o.heldBy} \u2014 replacement on :${t}.`):console.warn(`[gateway] port ${e} is unavailable (another process holds it \u2014 an orphan from a crashed gateway?) \u2014 using ${t} instead.`)),t},"claimFreePort"),ce=d((e,r,o)=>{const t=o?.LENSMCP_FRONTEND_KEY,n=Number(o?.LENSMCP_FRONTEND_GENERATION);if(!t||!Number.isFinite(n))return;const a=[...C.get(t)?.generations??[]].find(l=>l.generation===n);a&&(e.endsWith(":vite")?a.vite=r:e.endsWith(":browser-capture")&&(a.capture=r))},"attachRespawnedGenerationChild"),H=d(e=>{e.exitCode!==null||e.signalCode!==null||e.pid===void 0||(q.add(e),signalChild(e,"SIGTERM"),setTimeout(()=>{e.exitCode===null&&e.signalCode===null&&signalChild(e,"SIGKILL")},types_1.LENS_RECYCLE_KILL_GRACE_MS).unref?.())},"retireChild"),de=d((e,r)=>{const o=m.get(e);!o||o===r||o.exitCode!==null||o.signalCode!==null||(console.warn(`[gateway] lens child ${e}: a replacement took the label \u2014 retiring the previous child (pid ${o.pid??"?"}).`),H(o))},"retireLabelHolder"),k=d((e,r,o,t,n=!1,a,l,c)=>{const u=Date.now(),i=(0,node_child_process_1.spawn)(r,o,{cwd:l??s.root,env:{...(0,pod_env_1.podBaseEnv)(process.env,s.root,l??s.root),...t??{},LENSMCP_PARENT_PID:String(process.pid)},stdio:"inherit"});b.push(i),de(e,i),m.set(e,i),ce(e,i,t);const S=e==="vite"||e.endsWith(":vite"),N=typeof t?.LENSMCP_EVENT_FILE=="string"?t.LENSMCP_EVENT_FILE:void 0,y=N&&N!==s.eventFile?N:void 0,w=S?viteArgPort(o):c;S&&A.set(i,{key:t?.LENSMCP_FRONTEND_KEY??`${l??s.root}:${t?.LENSMCP_PROJECT??"app"}`,project:t?.LENSMCP_PROJECT??"app",workspaceRoot:l??s.root,spawnedAt:u,port:w,probeFails:0,listening:!1,generation:Number(t?.LENSMCP_FRONTEND_GENERATION??0),role:t?.LENSMCP_FRONTEND_ROLE==="replacement"?"replacement":"active",...y?{bus:y}:{}});const h=e==="lens-mcp"?"lens-mcp":e==="lens-dashboard"||e.startsWith("lens-dashboard:")?"lens-dashboard":void 0;return h&&w!==void 0&&(p("info",`lens child starting: ${h} (:${w})`,`cluster-lens-child:${h}`,{kind:"lens-child-starting",project:h,label:e,pid:i.pid,port:w},void 0,y),(async()=>{const P=Date.now()+types_1.LENS_REPLACEMENT_READY_MS;for(;!s.stopped()&&Date.now()<P;){if(i.exitCode!==null||i.signalCode!==null||$.has(e))return;if(await probePortListening(w,Math.min(500,types_1.LENS_PROBE_TIMEOUT_MS))){p("info",`lens child up: ${h} (:${w})`,`cluster-lens-child:${h}`,{kind:"lens-child-up",project:h,label:e,pid:i.pid,port:w},void 0,y);return}await sleepUnref(150)}})().catch(()=>{})),i.on("error",P=>{if(i.pid!==void 0){console.warn(`[gateway] lens child ${e}: ${P.message}`);return}const D=b.indexOf(i);D>=0&&b.splice(D,1),m.get(e)===i&&m.delete(e),A.delete(i),q.delete(i),console.error(`[gateway] lens child ${e} failed to spawn (${P.message}) \u2014 not started, not retried.`)}),i.on("exit",(P,D)=>{const se=b.indexOf(i);se>=0&&b.splice(se,1),m.get(e)===i&&m.delete(e);const O=A.get(i);if(A.delete(i),q.delete(i))return;const ve=$.delete(e);if(s.stopped()||ve||(h?p("warning",`lens child exited: ${h}`,`cluster-lens-child:${h}`,{kind:"lens-child-exit",project:h,label:e,pid:i.pid,code:P,signal:D},void 0,y):O&&p("warning",`lens frontend exited: ${O.project}`,`cluster-lens-child:${O.project}`,{kind:"lens-child-exit",project:O.project,label:e,pid:i.pid,code:P,signal:D,generation:O.generation,port:O.port,ranMs:Date.now()-u},void 0,y),O&&fe(i,O)))return;const ae=Date.now()-u,R=B.get(e)??{attempts:0,portConflicts:0};(async()=>{const Le=w!==void 0&&!await g(w),ie=(0,lifecycle_1.isPortConflictExit)({code:P,signal:D,ranMs:ae,portHeld:Le},{fastFailMs:types_1.CHILD_START_FAIL_MS});if(ie&&R.portConflicts<types_1.MAX_PORT_CONFLICT_RETRIES)R.portConflicts+=1,B.set(e,R),console.warn(`[gateway] lens child ${e} lost the :${w} bind race (EADDRINUSE, code=${P}); waiting for the port, then retrying (port-retry ${R.portConflicts}/${types_1.MAX_PORT_CONFLICT_RETRIES}; crash budget untouched).`);else if(ie){R.portConflicts=0,B.set(e,R),console.warn(`[gateway] lens child ${e}: :${w} persistently held after ${types_1.MAX_PORT_CONFLICT_RETRIES} bind races \u2014 another server owns it (an external/shared daemon?). Parking; re-probing every ${Math.round(types_1.LENS_PARKED_PORT_REPROBE_MS/1e3)}s, will respawn if it frees.`),p("warning",`lens child parked: ${e} (:${w} held externally)`,`cluster-lens-child:${e}`,{kind:"lens-child-parked",label:e,port:w}),Q(e,w,()=>k(e,r,o,t,n,a,l,c));return}else{R.portConflicts=0,ae>=HEAL_HEALTHY_MS&&(R.attempts=0);const le=Math.min(HEAL_MAX_MS,HEAL_BASE_MS*2**R.attempts);R.attempts+=1,B.set(e,R),console.warn(`[gateway] lens child ${e} exited (code=${P} sig=${D}); auto-healing in ${Math.round(le/1e3)}s (attempt ${R.attempts}).`),await sleepUnref(le)}s.stopped()||$.has(e)||(w!==void 0&&!await waitForPortFree(w,types_1.PORT_FREE_WAIT_MS,{isPortFree:g,intervalMs:types_1.PORT_FREE_POLL_MS})&&console.warn(`[gateway] lens child ${e}: :${w} still held after ${Math.round(types_1.PORT_FREE_WAIT_MS/1e3)}s \u2014 spawning anyway.`),!(s.stopped()||$.has(e))&&k(e,r,o,t,n,a,l,c))})().catch(()=>{})}),i},"spawnManagedChild"),ee=d(e=>{const r=`${e.wsKey}:${e.project}`,o=C.get(r);if(o)return o;const t={key:r,...e,sourceDirs:e.frontend.sourceRoots?.length?e.frontend.sourceRoots:[e.projectRoot],generation:0,state:"starting",generations:new Set,disposed:!1};C.set(r,t);for(const n of e.routes)n.lens&&(n.lens.workspaceKey??=e.wsKey,F.set(n.lens,t));return e.frontend.workspaceKey??=e.wsKey,F.set(e.frontend,t),t},"registerFrontend"),pe=d(e=>{if(!types_1.LENS_WATCH_SCOPE_ENABLED)return{};const r=path.resolve(e.projectRoot),o=e.sourceDirs.map(t=>path.resolve(t)).filter(t=>t!==r);return o.length>0?{LENSMCP_WATCH_DIRS:o.join(path.delimiter)}:{}},"lensWatchScopeEnv"),te=d((e,r,o)=>{const t=++e.generation,n=`${e.key}:g${t}:`,a=`${n}vite`,l=`${n}browser-capture`;$.delete(a),$.delete(l);const c=d((S,N,y,w,h,P)=>k(S,N,y,w,h,P,e.workspaceRoot),"spawnInRoot"),u=(0,lens_frontend_1.spawnLensFrontend)({projectRoot:e.projectRoot,workspaceRoot:e.workspaceRoot,project:e.project,eventFile:e.eventFile,port:r,chrome:!0,headless:!0,viteEnv:{...e.frontend.env??{},...e.frontend.frozen?{LENSMCP_FREEZE:"1"}:{},LENSMCP_PROJECT:e.project,LENSMCP_FRONTEND_KEY:e.key,LENSMCP_FRONTEND_GENERATION:String(t),LENSMCP_FRONTEND_ROLE:o,...pe(e),NX_DAEMON:"false",NX_ISOLATE_PLUGINS:"false"},labelPrefix:n,log:d(S=>console.log(S),"log")},c),i={ownerKey:e.key,generation:t,port:r,labelPrefix:n,vite:u?.vite??m.get(a),capture:m.get(l)};return e.generations.add(i),i},"spawnFrontendGeneration"),K=d((e,r)=>{if(!e)return;C.get(e.ownerKey)?.generations.delete(e);const o=[[`${e.labelPrefix}browser-capture`,e.capture],[`${e.labelPrefix}vite`,e.vite]];for(const[t,n]of o)$.add(t),n&&H(n);r&&T.delete(e.port)},"terminateGeneration"),ue=d(async e=>{const r=Date.now()+types_1.LENS_REPLACEMENT_READY_MS;for(;!s.stopped()&&Date.now()<r;){const o=e.vite;if(!o||o.exitCode!==null||o.signalCode!==null)return!1;if(await probePortListening(e.port,Math.min(500,types_1.LENS_PROBE_TIMEOUT_MS))){const t=await L(e.port);if(!t||t.ready)return!0}await sleepUnref(150)}return!1},"waitForGenerationReady"),U=d(async e=>{const r=e?.vite;return!!(e&&r&&r.exitCode===null&&r.signalCode===null&&await probePortListening(e.port,Math.min(500,types_1.LENS_PROBE_TIMEOUT_MS)))},"generationIsServing"),z=d(e=>!e.disposed&&!s.stopped()&&C.get(e.key)===e,"frontendIsCurrent"),X=d((e,r)=>{if(!z(e))return Promise.resolve(!1);if(e.replacement)return e.replacement;const o=e.active;e.state=o?"replacing":"starting",e.reason=r,e.startedAt=Date.now();const t=(async()=>{let n,a;const l=Date.now();try{const c=new Set;for(const h of C.values())h!==e&&c.add(h.desiredPort);const u=o&&o.port===e.desiredPort?`g${o.generation}`:void 0,i=await x(e.desiredPort,T,{reserved:c,heldBy:u});if(a=i,!z(e))return T.delete(i),!1;n=te(e,i,"replacement"),e.candidate=n;const S=await U(o);console.log(`[gateway] lens handoff start: ${e.key} g${o?.generation??0}\u2192g${n.generation} :${o?.port??"down"}\u2192:${i} reason=${r}`),p("info",`lens handoff starting: ${e.project}`,`cluster-lens-app:${e.project}`,{kind:"lens-handoff-start",wsKey:e.wsKey,project:e.project,reason:r,generation:n.generation,oldPort:o?.port,newPort:i,oldServing:S},void 0,e.eventFile===s.eventFile?void 0:e.eventFile);const N=await ue(n);if(!z(e))return K(n,!0),e.candidate=void 0,!1;if(!N){K(n,!0),e.candidate=void 0;const h=await U(o);return e.state=h?"ready":"failed",h&&(e.reason=void 0,e.startedAt=void 0),console.error(`[gateway] lens handoff failed: ${e.key} g${n.generation} did not become ready within ${types_1.LENS_REPLACEMENT_READY_MS}ms; ${e.state==="ready"?"old generation kept serving":"no active generation"}.`),p("warning",`lens handoff failed: ${e.project}`,`cluster-lens-app:${e.project}`,{kind:"lens-handoff-failed",wsKey:e.wsKey,project:e.project,reason:r,generation:n.generation,port:i,durationMs:Date.now()-l,oldKept:h},void 0,e.eventFile===s.eventFile?void 0:e.eventFile),!1}for(const h of e.routes)h.target=`http://localhost:${n.port}`,h.lens&&(h.lens.port=n.port);e.frontend.port=n.port,e.active=n,e.candidate=void 0,e.state="ready",e.reason=void 0,e.startedAt=void 0;const y=n.vite?A.get(n.vite):void 0;y&&(y.role="active",y.listening=!0);const w=(0,hmr_reload_1.broadcastFullReload)(s,e.key);if(console.log(`[gateway] lens handoff ready: ${e.key} g${n.generation} :${n.port} in ${Date.now()-l}ms; draining g${o?.generation??0}${w>0?`; reloading ${w} tab(s)`:""}.`),p("info",`lens handoff complete: ${e.project}`,`cluster-lens-app:${e.project}`,{kind:"lens-handoff-complete",wsKey:e.wsKey,project:e.project,reason:r,generation:n.generation,oldPort:o?.port,newPort:n.port,durationMs:Date.now()-l,reloadedTabs:w},void 0,e.eventFile===s.eventFile?void 0:e.eventFile),o){const h=`${o.labelPrefix}browser-capture`;$.add(h),o.capture&&H(o.capture),setTimeout(()=>K(o,!0),types_1.LENS_REPLACEMENT_DRAIN_MS).unref?.()}return!0}catch(c){K(n,!0),!n&&a!==void 0&&T.delete(a),e.candidate=void 0;const u=await U(o);e.state=u?"ready":"failed",u&&(e.reason=void 0,e.startedAt=void 0);const i=c.message;return console.error(`[gateway] lens handoff failed: ${e.key}: ${i}`),p("warning",`lens handoff failed: ${e.project}`,`cluster-lens-app:${e.project}`,{kind:"lens-handoff-failed",wsKey:e.wsKey,project:e.project,reason:r,generation:n?.generation??e.generation,port:n?.port??a,durationMs:Date.now()-l,oldKept:u,error:i},void 0,e.eventFile===s.eventFile?void 0:e.eventFile),!1}finally{e.replacement=void 0}})();return e.replacement=t,t},"rollFrontend"),ne=d((e,r)=>{e.active=te(e,r,"active"),e.state="starting",e.startedAt=Date.now()},"spawnInitialFrontend"),fe=d((e,r)=>{const o=C.get(r.key);return!o||types_1.LENS_RESTART_MODE==="in-place"?!1:(o.candidate?.vite===e||o.active?.vite!==e||(o.state="starting",o.reason="child-exit",o.startedAt=Date.now(),console.warn(`[gateway] lens frontend exited: ${o.key} g${r.generation} :${r.port} (${describeChildExit(e)}); starting an alternate-port replacement.`),X(o,"child-exit")),!0)},"handleManagedViteExit");s.lensSupervisor=types_1.LENS_RESTART_MODE==="rolling"?{status(e){const r=F.get(e);return r?{state:r.state,generation:r.candidate?.generation??r.active?.generation??r.generation,reason:r.reason,startedAt:r.startedAt}:void 0},recover(e,r){const o=F.get(e);return o?X(o,r):Promise.resolve(!1)}}:void 0;let J=!1,oe=0;const Ee=d(()=>{J||Date.now()-oe<types_1.POD_STALE_SCAN_MS||(J=!0,oe=Date.now(),(async()=>{const e=new Map;for(const r of[...C.values()]){if(s.stopped())return;let o=e.get(r.workspaceRoot);if(!o){const i=(0,scope_1.readSourceSetOptions)(r.workspaceRoot);o={pass:(0,lifecycle_1.sourceScanPass)(r.workspaceRoot,i.exclude,{ignoreTests:i.ignoreTests}),startedAt:Date.now()},e.set(r.workspaceRoot,o)}const t=o.startedAt,n=await o.pass.snapshot(r.sourceDirs);if(C.get(r.key)!==r)continue;const a=r.sourceSnapshot,l=r.sourceScanStartedAt;if(r.sourceSnapshot=n,r.sourceScanStartedAt=t,!a)continue;const c=Date.now(),u=(0,lifecycle_1.diffSourceSets)(a,n,c,(0,lifecycle_1.sourceChangeWindowMs)(c,l,types_1.POD_STALE_SCAN_MS,types_1.POD_RECYCLE_SETTLE_MS));u&&(r.sourceChange=u,p("info",`source file set changed for ${r.key}`,`cluster-lens-app:${r.project}`,{kind:"source-set-changed",scoped:!0,wsKey:r.wsKey,project:r.project,added:u.added,removed:u.removed,truncated:u.truncated},void 0,r.eventFile===s.eventFile?void 0:r.eventFile))}})().catch(()=>{}).finally(()=>{J=!1}))},"scanFrontendSourceSets");let Z=!1;const ge=d(async(e,r)=>{if(!Z){Z=!0;try{for(const[o,t]of[...A]){if(s.stopped())return;if(t.port===void 0||o.exitCode!==null||o.signalCode!==null)continue;if(await probePortListening(t.port,types_1.LENS_PROBE_TIMEOUT_MS)){if(t.probeFails=0,!t.listening){t.listening=!0;const c=C.get(t.key);c?.active?.vite===o&&(c.state="ready",c.reason=void 0),p("info",`lens app up: ${t.project} (vite :${t.port} listening)`,`cluster-lens-app:${t.project}`,{kind:"service-up",project:t.project,port:t.port},void 0,t.bus)}continue}const n=t.listening?e.graceMs:Math.max(e.graceMs,e.neverListenedGraceMs);if(Date.now()-t.spawnedAt<n){t.probeFails=0;continue}if(!r)continue;t.probeFails+=1;const a=(0,lifecycle_1.lensChildWedged)({spawnedAt:t.spawnedAt,probeFails:t.probeFails,hasListened:t.listening},I.get(t.key)??0,Date.now(),e);if(!a)continue;const l=t.listening?"its listener VANISHED (was up, now refusing)":`it NEVER bound within the ${Math.round(n/1e3)}s boot allowance`;I.set(t.key,Date.now()),t.probeFails=0,t.listening=!1,console.error(`[gateway] wedge recycle: lens app ${t.project} is ALIVE but NOT LISTENING on :${t.port} after ${Math.max(2,e.failureThreshold)} probes \u2014 ${l} \u2014 SIGKILL; a fresh vite is coming.`),p("warning",`wedge recycle: ${t.project} (${a})`,`cluster-lens-app:${t.project}`,{kind:"pod-recycle",project:t.project,reason:a,port:t.port},void 0,t.bus),signalChild(o,"SIGKILL")}}finally{Z=!1}}},"probeLensChildren"),he=d(()=>{if(j||!types_1.POD_RECYCLE_ENABLED&&!types_1.LENS_PROBE_ENABLED)return;const e={graceMs:types_1.POD_STALE_GRACE_MS,settleMs:types_1.POD_RECYCLE_SETTLE_MS,cooldownMs:types_1.POD_STALE_RECYCLE_COOLDOWN_MS};j=setInterval(()=>{if(s.stopped()||A.size===0||(re(),!types_1.POD_RECYCLE_ENABLED))return;Ee();const r=Date.now();for(const[o,t]of A){const n=C.get(t.key);if(n?.frontend.frozen)continue;const a=n?.sourceChange?.changedAt??0,l=I.get(t.key)??0;(0,lifecycle_1.lensFrontendStale)(t.spawnedAt,l,a,r,e)&&((Y.get(t.key)??0)>=a||W.has(t.key)||(W.add(t.key),(async()=>{try{const c=n?.sourceChange,u=c&&!c.truncated?[...c.added,...c.removed].map(y=>path.resolve(t.workspaceRoot,y)):[],i=types_1.LENS_WATCHER_PROBE_ENABLED&&t.port!==void 0?(0,lifecycle_1.lensWatcherVerdict)(await L(t.port),a,c?.windowMs??types_1.POD_STALE_SCAN_MS+types_1.POD_RECYCLE_SETTLE_MS,u):"unknown";if(i==="heard"){Y.set(t.key,a),console.log(`[gateway] stale source set: lens app ${t.project} watcher CONFIRMED the change \u2014 no recycle, HMR intact.`),p("info",`stale check: ${t.project} watcher confirmed \u2014 no recycle`,`cluster-lens-app:${t.project}`,{kind:"pod-stale-verified",project:t.project},void 0,t.bus);return}if(i==="unknown"&&types_1.LENS_WATCHER_UNVERIFIED==="keep"){console.log(`[gateway] stale source set: lens app ${t.project} unverifiable (no watcher testimony) \u2014 keeping it (LENSMCP_LENS_WATCHER_UNVERIFIED=keep).`);return}if(o.exitCode!==null||o.signalCode!==null)return;I.set(t.key,Date.now());const S=C.get(t.key);if(types_1.LENS_RESTART_MODE==="rolling"&&S){console.log(`[gateway] stale refresh: lens app ${t.key} (stale-source-set) \u2014 watcher ${i==="missed"?"missed the exact path change":"unverifiable"}; preparing a standby without dropping traffic.`),p("warning",`stale refresh: ${t.project} (stale-source-set)`,`cluster-lens-app:${t.project}`,{kind:"pod-refresh",wsKey:S.wsKey,project:t.project,reason:"stale-source-set",watcher:i,added:c?.added,removed:c?.removed},void 0,t.bus),await X(S,"stale-source-set");return}t.listening=!1,console.log(`[gateway] zombie recycle: lens app ${t.project} (stale-source-set) \u2014 watcher ${i==="missed"?"SILENT across the change":"unverifiable"}; restarting it`),p("warning",`zombie recycle: ${t.project} (stale-source-set)`,`cluster-lens-app:${t.project}`,{kind:"pod-recycle",project:t.project,reason:"stale-source-set",watcher:i},void 0,t.bus);const N=(0,hmr_reload_1.broadcastFullReload)(s,t.key);N>0&&console.log(`[gateway]   \u2192 told ${N} open tab(s) to reload (stale optimize-dep generation)`),signalChild(o,"SIGTERM"),setTimeout(()=>{o.exitCode===null&&o.signalCode===null&&(console.log(`[gateway] zombie recycle: lens app ${t.project} ignored SIGTERM for ${Math.round(types_1.LENS_RECYCLE_KILL_GRACE_MS/1e3)}s \u2014 escalating to SIGKILL.`),signalChild(o,"SIGKILL"))},types_1.LENS_RECYCLE_KILL_GRACE_MS).unref?.()}finally{W.delete(t.key)}})()))}},Math.min(types_1.POD_STALE_SCAN_MS,15e3)),j.unref?.()},"startLensSweeper"),we=d(async()=>{const e=[...new Map(s.routes.filter(t=>t.lens).map(t=>[t.project,t.lens])).values()],r=f.dashboard!==!1,o=f.mcp!==!1&&e.length>0;if(r){const t=(0,lens_frontend_1.findDashboardBundle)(s.root);if(!t)console.warn("[gateway] lens dashboard bundle not found \u2014 skipping. Install the self-contained CLI: `npm i -D lensmcp` (it ships `bundled/dashboard.js`), or `yarn nx build @lensmcp/lensmcp-mcp` in-repo.");else{const n=(0,scope_1.readLensScope)(s.root),a=await x(f.dashboardPort??n.dashboardPort,V),l=f.lensHost??"lensmcp.local",c=n.basePath;s.registry.appendRoutes(s.wsKey,[{host:l,prefix:c,project:observability_1.LENS_DASHBOARD_PROJECT,target:`http://localhost:${a}`}]),s.rebuildRoutes(),(0,workspace_registry_1.registerWorkspace)({key:n.key,root:s.root,base:c,pid:process.pid,procStamp:(0,workspace_registry_1.processStamp)(process.pid),updatedAt:new Date().toISOString()}),console.log(`[gateway] starting lens dashboard \u2192 http://localhost:${a} (routed at https://${l}${c}/)`),p("info",`lens dashboard up: ${l}${c} \u2192 :${a}`,"cluster-lens-dashboard",{kind:"lens-dashboard-up",host:l,port:a,base:c}),k("lens-dashboard",(0,process_name_1.namedExecPath)((0,process_name_1.processName)("lensmcp",n.key,"dashboard")),[t],{LENSMCP_EVENT_FILE:s.eventFile,LENSMCP_PROCESS_ROLE:"dashboard",LENSMCP_DASHBOARD_PORT:String(a),LENSMCP_DASHBOARD_BASE:c,LENSMCP_GATEWAY_PORTS:M},!1,void 0,void 0,a)}}if(o){const t=(0,lens_frontend_1.findMcpBundle)(s.root);if(!t)console.warn("[gateway] MCP server bundle not found \u2014 skipping (lens apps will still publish to the bus; an external `lensmcp mcp` can read it). Install: `npm i -D lensmcp`.");else{const n=(0,scope_1.readLensScope)(s.root),a=Number(process.env.LENSMCP_PORT??n.mcpHttpPort),l=d(()=>{console.log(`[gateway] starting lens MCP server on 127.0.0.1:${a} (${t})`),k("lens-mcp",(0,process_name_1.namedExecPath)((0,process_name_1.processName)("lensmcp",n.key,"mcp")),[t],{LENSMCP_EVENT_FILE:s.eventFile,LENSMCP_PROCESS_ROLE:"mcp",LENSMCP_TRANSPORT:process.env.LENSMCP_TRANSPORT??"http",LENSMCP_PORT:String(a),LENSMCP_WORKSPACE_KEY:n.key,LENSMCP_WORKSPACE_ROOT:s.root},!1,void 0,void 0,a)},"spawnMcp");await g(a)?l():(console.warn(`[gateway] lens MCP port :${a} is already served \u2014 an external lensmcp server (a shared daemon?) owns this workspace's MCP; not spawning a second. Re-probing every ${Math.round(types_1.LENS_PARKED_PORT_REPROBE_MS/1e3)}s; will take over if it frees.`),p("info",`lens MCP served externally on :${a} \u2014 gateway parked its own`,"cluster-lens-child:lens-mcp",{kind:"lens-child-up",project:"lens-mcp",label:"lens-mcp",port:a,external:!0}),Q("lens-mcp",a,l))}}for(const t of e){if(t.started)continue;t.started=!0;const n=t.port,a=(s.registry.get(s.wsKey)?.routes??s.routes).filter(u=>u.lens?.project===t.project),l=await x(t.port,T);for(const u of a)u.lens&&(u.lens.port=l),u.target=`http://localhost:${l}`;t.port=l;const c=ee({wsKey:s.wsKey,project:t.project,workspaceRoot:s.root,projectRoot:t.projectRoot,eventFile:s.eventFile,routes:a,frontend:t,desiredPort:n});try{ne(c,l),p("info",`lens app started: ${t.project} (vite :${t.port})`,`cluster-lens-app:${t.project}`,{kind:"lens-app-up",project:t.project,port:t.port})}catch(u){T.delete(l),c.state="failed",console.error(`[gateway] lens app ${t.project}: ${u.message}`)}}he()},"bootSingletonsAndApps"),_e=d(async e=>{if(f.dashboard===!1)return;const r=(0,lens_frontend_1.findDashboardBundle)(s.root);if(!r)return;const o=(0,scope_1.readLensScope)(e.root),t=f.lensHost??"lensmcp.local",n=o.basePath,a=await x(o.dashboardPort,V),l=`lens-dashboard:${e.wsKey}`,c=path.join(e.root,".lensmcp","events.jsonl");return $.delete(l),s.registry.appendRoutes(e.wsKey,[{host:t,prefix:n,project:observability_1.LENS_DASHBOARD_PROJECT,target:`http://localhost:${a}`}]),(0,workspace_registry_1.registerWorkspace)({key:e.wsKey,root:e.root,base:n,pid:process.pid,procStamp:(0,workspace_registry_1.processStamp)(process.pid),updatedAt:new Date().toISOString(),...e.instance?{instance:{name:e.instance.name,baseKey:e.instance.baseKey,apex:e.instance.apex}}:{}}),console.log(`[gateway] hosting dashboard for workspace '${e.wsKey}' \u2192 http://localhost:${a} (routed at https://${t}${n}/)`),p("info",`lens dashboard up: ${t}${n} \u2192 :${a}`,"cluster-lens-dashboard",{kind:"lens-dashboard-up",host:t,port:a,base:n}),k(l,(0,process_name_1.namedExecPath)((0,process_name_1.processName)("lensmcp",e.wsKey,"dashboard")),[r],{LENSMCP_EVENT_FILE:c,LENSMCP_PROCESS_ROLE:"dashboard",LENSMCP_DASHBOARD_PORT:String(a),LENSMCP_DASHBOARD_BASE:n,LENSMCP_WS_KEY:e.wsKey,...e.sockNs?{LENSMCP_SOCK_NS:e.sockNs}:{},LENSMCP_GATEWAY_PORTS:M},!1,void 0,e.root,a),()=>{$.add(l),V.delete(a),(0,workspace_registry_1.unregisterWorkspace)(e.wsKey);const u=m.get(l);u&&H(u),m.delete(l)}},"hostWorkspaceDashboard"),Se=d(async e=>{const r=new Map;for(const n of e.routes){if(!n.lens)continue;const a=r.get(n.lens.project)??[];a.push(n),r.set(n.lens.project,a)}if(r.size===0)return()=>{};const o=path.join(e.root,".lensmcp","events.jsonl"),t=[];for(const[n,a]of r){const l=a[0].lens;if(l.started)continue;const c=await x(l.port,T),u=l.port;for(const S of a)S.lens.started=!0,S.lens.port=c,S.target=`http://localhost:${c}`;const i=ee({wsKey:e.wsKey,project:n,workspaceRoot:e.root,projectRoot:l.projectRoot,eventFile:o,routes:a,frontend:l,desiredPort:u});t.push(i),console.log(`[gateway] hosting lens app '${n}' of '${e.wsKey}' \u2192 vite :${c}`);try{ne(i,c),p("info",`lens app started: ${e.wsKey}/${n} (vite :${c})`,`cluster-lens-app:${e.wsKey}:${n}`,{kind:"lens-app-up",project:n,port:c},void 0,o)}catch(S){T.delete(c),i.state="failed",console.error(`[gateway] lens app ${e.wsKey}/${n}: ${S.message}`)}}return()=>{for(const n of t){n.disposed=!0;for(const a of[...n.generations])K(a,!0);for(const a of n.routes)a.lens&&F.delete(a.lens);F.delete(n.frontend),I.delete(n.key),Y.delete(n.key),W.delete(n.key),C.delete(n.key)}}},"hostWorkspaceApps"),ye=d(async(e=2500)=>{j&&(clearInterval(j),j=void 0);const r=[...b];for(const n of r)signalChild(n,"SIGTERM");const o=d(n=>n.exitCode===null&&n.signalCode===null,"alive"),t=Date.now()+e;for(;Date.now()<t&&r.some(o);)await new Promise(n=>setTimeout(n,100));for(const n of r)o(n)&&signalChild(n,"SIGKILL")},"reapAll"),re=d(()=>ge({graceMs:types_1.LENS_PROBE_GRACE_MS,failureThreshold:types_1.LENS_PROBE_FAILS,cooldownMs:types_1.LENS_PROBE_COOLDOWN_MS,neverListenedGraceMs:types_1.LENS_PROBE_BOOT_GRACE_MS},types_1.LENS_PROBE_ENABLED),"probeLensFrontends");return{spawnManagedChild:k,bootSingletonsAndApps:we,hostWorkspaceDashboard:_e,hostWorkspaceApps:Se,probeLensFrontends:re,reapAll:ye}}v(createLensChildren,"createLensChildren"),d(createLensChildren,"createLensChildren");
+"use strict";var Ce=Object.defineProperty;var v=(s,f)=>Ce(s,"name",{value:f,configurable:!0});var Le=Object.defineProperty,d=v((s,f)=>Le(s,"name",{value:f,configurable:!0}),"d");Object.defineProperty(exports,"__esModule",{value:!0}),exports.probePortFree=probePortFree,exports.probePortListening=probePortListening,exports.probeWatcherHealth=probeWatcherHealth,exports.waitForPortFree=waitForPortFree,exports.viteArgPort=viteArgPort,exports.describeChildExit=describeChildExit,exports.signalChild=signalChild,exports.claimPort=claimPort,exports.createLensChildren=createLensChildren;const tslib_1=require("tslib"),net=tslib_1.__importStar(require("node:net")),path=tslib_1.__importStar(require("node:path")),node_child_process_1=require("node:child_process"),lens_frontend_1=require("@lensmcp/nx-plugin/lens-frontend"),hmr_reload_1=require("./hmr-reload"),process_name_1=require("../../../process-name"),pod_env_1=require("./pod-env"),scope_1=require("./scope"),workspace_registry_1=require("./workspace-registry"),lifecycle_1=require("./lifecycle"),types_1=require("./types"),observability_1=require("./observability"),HEAL_BASE_MS=1500,HEAL_MAX_MS=3e4,HEAL_HEALTHY_MS=2e4;function tryBind(s,f){return new Promise(E=>{const _=net.createServer();_.unref(),_.once("error",p=>{const g=p.code??"";E(g==="EADDRINUSE"||g==="EACCES"?"in-use":"unavailable")}),_.listen(f===void 0?{port:s}:{port:s,host:f},()=>_.close(()=>E("free")))})}v(tryBind,"tryBind"),d(tryBind,"tryBind");async function probePortFree(s){for(const f of[void 0,"0.0.0.0","127.0.0.1","::1"])if(await tryBind(s,f)==="in-use")return!1;return!0}v(probePortFree,"probePortFree"),d(probePortFree,"probePortFree");function probeConnect(s,f,E){return new Promise(_=>{let p=!1;const g=net.createConnection({host:s,port:f});g.unref();const $=setTimeout(()=>P(!1),E);$.unref?.();function P(b){p||(p=!0,clearTimeout($),g.destroy(),_(b))}v(P,"R"),d(P,"finish"),g.once("connect",()=>P(!0)),g.once("error",()=>P(!1))})}v(probeConnect,"probeConnect"),d(probeConnect,"probeConnect");async function probePortListening(s,f=1e3){return await probeConnect("127.0.0.1",s,f)?!0:probeConnect("::1",s,f)}v(probePortListening,"probePortListening"),d(probePortListening,"probePortListening");async function probeWatcherHealth(s,f=1500){try{const E=new AbortController,_=setTimeout(()=>E.abort(),f);_.unref?.();try{const p=await fetch(`http://127.0.0.1:${s}/__lensmcp/watcher-health`,{signal:E.signal});if(!p.ok)return null;const g=await p.json();if(typeof g?.lastFsSetEventAt!="number")return null;const $=Array.isArray(g.recentEvents)?g.recentEvents.filter(P=>P&&typeof P.path=="string"&&typeof P.at=="number"&&typeof P.sequence=="number"&&["add","addDir","unlink","unlinkDir"].includes(P.kind)):[];return{schemaVersion:g.schemaVersion===2?2:1,ready:g.ready!==!1,sequence:typeof g.sequence=="number"?g.sequence:0,lastFsSetEventAt:g.lastFsSetEventAt,fsSetEvents:typeof g.fsSetEvents=="number"?g.fsSetEvents:0,recentEvents:$}}finally{clearTimeout(_)}}catch{return null}}v(probeWatcherHealth,"probeWatcherHealth"),d(probeWatcherHealth,"probeWatcherHealth");const sleepUnref=d(s=>new Promise(f=>{setTimeout(f,s).unref?.()}),"sleepUnref");async function waitForPortFree(s,f,E={}){const _=E.isPortFree??probePortFree,p=Math.max(1,E.intervalMs??types_1.PORT_FREE_POLL_MS),g=Date.now()+Math.max(0,f);for(;;){if(await _(s))return!0;const $=g-Date.now();if($<=0)return!1;await sleepUnref(Math.min(p,$))}}v(waitForPortFree,"waitForPortFree"),d(waitForPortFree,"waitForPortFree");function viteArgPort(s){const f=d(E=>Number.isInteger(E)&&E>0&&E<65536?E:void 0,"valid");for(let E=0;E<s.length;E+=1){const _=s[E];if(_==="--port")return f(Number(s[E+1]));if(_.startsWith("--port="))return f(Number(_.slice(7)))}}v(viteArgPort,"viteArgPort"),d(viteArgPort,"viteArgPort");function describeChildExit(s){return s.signalCode?`killed by ${s.signalCode}`:s.exitCode===null?"exit status unknown":`exit code ${s.exitCode}`}v(describeChildExit,"describeChildExit"),d(describeChildExit,"describeChildExit");function signalChild(s,f){if(s.pid===void 0)return!1;try{return s.kill(f)}catch{return!1}}v(signalChild,"signalChild"),d(signalChild,"signalChild");async function claimPort(s,f,E,_){let p=s;for(;f.has(p)||_?.has(p)||!await E(p);)p+=1;return f.add(p),p}v(claimPort,"claimPort"),d(claimPort,"claimPort");function createLensChildren(s,f,E,_){const{emit:p}=f,g=_?.isPortFree??probePortFree,$=(E.ports?.length?E.ports:[443]).join(","),P=_?.probeWatcherHealth??probeWatcherHealth,b=[],W=new Map,A=new Map,I=new Map,Y=new Map,B=new Set;let j;const N=new Map,M=new Set,q=new Set,V=new Set,T=new Set,C=new Map,F=new WeakMap,G=new Set,Q=d((e,r,o)=>{if(G.has(e))return;G.add(e);const t=setInterval(()=>{(async()=>{if(s.stopped()||M.has(e)){clearInterval(t),G.delete(e);return}await g(r)&&(clearInterval(t),G.delete(e),console.log(`[gateway] lens child ${e}: :${r} freed \u2014 respawning.`),o())})().catch(()=>{})},types_1.LENS_PARKED_PORT_REPROBE_MS);t.unref?.()},"parkUntilPortFree"),K=d(async(e,r,o)=>{const t=await claimPort(e,r,g,o?.reserved);return t!==e&&(o?.heldBy?console.log(`[gateway] handoff: :${e} is held by ${o.heldBy} \u2014 replacement on :${t}.`):console.warn(`[gateway] port ${e} is unavailable (another process holds it \u2014 an orphan from a crashed gateway?) \u2014 using ${t} instead.`)),t},"claimFreePort"),ce=d((e,r,o)=>{const t=o?.LENSMCP_FRONTEND_KEY,n=Number(o?.LENSMCP_FRONTEND_GENERATION);if(!t||!Number.isFinite(n))return;const a=[...C.get(t)?.generations??[]].find(l=>l.generation===n);a&&(e.endsWith(":vite")?a.vite=r:e.endsWith(":browser-capture")&&(a.capture=r))},"attachRespawnedGenerationChild"),H=d(e=>{e.exitCode!==null||e.signalCode!==null||e.pid===void 0||(q.add(e),signalChild(e,"SIGTERM"),setTimeout(()=>{e.exitCode===null&&e.signalCode===null&&signalChild(e,"SIGKILL")},types_1.LENS_RECYCLE_KILL_GRACE_MS).unref?.())},"retireChild"),de=d((e,r)=>{const o=N.get(e);!o||o===r||o.exitCode!==null||o.signalCode!==null||(console.warn(`[gateway] lens child ${e}: a replacement took the label \u2014 retiring the previous child (pid ${o.pid??"?"}).`),H(o))},"retireLabelHolder"),O=d((e,r,o,t,n=!1,a,l,c)=>{const u=Date.now(),i=(0,node_child_process_1.spawn)(r,o,{cwd:l??s.root,env:{...(0,pod_env_1.podBaseEnv)(process.env,s.root,l??s.root),...t??{},LENSMCP_PARENT_PID:String(process.pid)},stdio:"inherit"});b.push(i),de(e,i),N.set(e,i),ce(e,i,t);const S=e==="vite"||e.endsWith(":vite"),m=typeof t?.LENSMCP_EVENT_FILE=="string"?t.LENSMCP_EVENT_FILE:void 0,y=m&&m!==s.eventFile?m:void 0,w=S?viteArgPort(o):c;S&&A.set(i,{key:t?.LENSMCP_FRONTEND_KEY??`${l??s.root}:${t?.LENSMCP_PROJECT??"app"}`,project:t?.LENSMCP_PROJECT??"app",workspaceRoot:l??s.root,spawnedAt:u,port:w,probeFails:0,listening:!1,generation:Number(t?.LENSMCP_FRONTEND_GENERATION??0),role:t?.LENSMCP_FRONTEND_ROLE==="replacement"?"replacement":"active",...y?{bus:y}:{}});const h=e==="lens-mcp"?"lens-mcp":e==="lens-dashboard"||e.startsWith("lens-dashboard:")?"lens-dashboard":void 0;return h&&w!==void 0&&(p("info",`lens child starting: ${h} (:${w})`,`cluster-lens-child:${h}`,{kind:"lens-child-starting",project:h,label:e,pid:i.pid,port:w},void 0,y),(async()=>{const L=Date.now()+types_1.LENS_REPLACEMENT_READY_MS;for(;!s.stopped()&&Date.now()<L;){if(i.exitCode!==null||i.signalCode!==null||M.has(e))return;if(await probePortListening(w,Math.min(500,types_1.LENS_PROBE_TIMEOUT_MS))){p("info",`lens child up: ${h} (:${w})`,`cluster-lens-child:${h}`,{kind:"lens-child-up",project:h,label:e,pid:i.pid,port:w},void 0,y);return}await sleepUnref(150)}})().catch(()=>{})),i.on("error",L=>{if(i.pid!==void 0){console.warn(`[gateway] lens child ${e}: ${L.message}`);return}const D=b.indexOf(i);D>=0&&b.splice(D,1),N.get(e)===i&&N.delete(e),A.delete(i),q.delete(i),console.error(`[gateway] lens child ${e} failed to spawn (${L.message}) \u2014 not started, not retried.`)}),i.on("exit",(L,D)=>{const se=b.indexOf(i);se>=0&&b.splice(se,1),N.get(e)===i&&N.delete(e);const k=A.get(i);if(A.delete(i),q.delete(i))return;const ve=M.delete(e);if(s.stopped()||ve||(h?p("warning",`lens child exited: ${h}`,`cluster-lens-child:${h}`,{kind:"lens-child-exit",project:h,label:e,pid:i.pid,code:L,signal:D},void 0,y):k&&p("warning",`lens frontend exited: ${k.project}`,`cluster-lens-child:${k.project}`,{kind:"lens-child-exit",project:k.project,label:e,pid:i.pid,code:L,signal:D,generation:k.generation,port:k.port,ranMs:Date.now()-u},void 0,y),k&&Ee(i,k)))return;const ae=Date.now()-u,R=W.get(e)??{attempts:0,portConflicts:0};(async()=>{const Pe=w!==void 0&&!await g(w),ie=(0,lifecycle_1.isPortConflictExit)({code:L,signal:D,ranMs:ae,portHeld:Pe},{fastFailMs:types_1.CHILD_START_FAIL_MS});if(ie&&R.portConflicts<types_1.MAX_PORT_CONFLICT_RETRIES)R.portConflicts+=1,W.set(e,R),console.warn(`[gateway] lens child ${e} lost the :${w} bind race (EADDRINUSE, code=${L}); waiting for the port, then retrying (port-retry ${R.portConflicts}/${types_1.MAX_PORT_CONFLICT_RETRIES}; crash budget untouched).`);else if(ie){R.portConflicts=0,W.set(e,R),console.warn(`[gateway] lens child ${e}: :${w} persistently held after ${types_1.MAX_PORT_CONFLICT_RETRIES} bind races \u2014 another server owns it (an external/shared daemon?). Parking; re-probing every ${Math.round(types_1.LENS_PARKED_PORT_REPROBE_MS/1e3)}s, will respawn if it frees.`),p("warning",`lens child parked: ${e} (:${w} held externally)`,`cluster-lens-child:${e}`,{kind:"lens-child-parked",label:e,port:w}),Q(e,w,()=>O(e,r,o,t,n,a,l,c));return}else{R.portConflicts=0,ae>=HEAL_HEALTHY_MS&&(R.attempts=0);const le=Math.min(HEAL_MAX_MS,HEAL_BASE_MS*2**R.attempts);R.attempts+=1,W.set(e,R),console.warn(`[gateway] lens child ${e} exited (code=${L} sig=${D}); auto-healing in ${Math.round(le/1e3)}s (attempt ${R.attempts}).`),await sleepUnref(le)}s.stopped()||M.has(e)||(w!==void 0&&!await waitForPortFree(w,types_1.PORT_FREE_WAIT_MS,{isPortFree:g,intervalMs:types_1.PORT_FREE_POLL_MS})&&console.warn(`[gateway] lens child ${e}: :${w} still held after ${Math.round(types_1.PORT_FREE_WAIT_MS/1e3)}s \u2014 spawning anyway.`),!(s.stopped()||M.has(e))&&O(e,r,o,t,n,a,l,c))})().catch(()=>{})}),i},"spawnManagedChild"),ee=d(e=>{const r=`${e.wsKey}:${e.project}`,o=C.get(r);if(o)return o;const t={key:r,...e,sourceDirs:e.frontend.sourceRoots?.length?e.frontend.sourceRoots:[e.projectRoot],generation:0,state:"starting",generations:new Set,disposed:!1};C.set(r,t);for(const n of e.routes)n.lens&&(n.lens.workspaceKey??=e.wsKey,F.set(n.lens,t));return e.frontend.workspaceKey??=e.wsKey,F.set(e.frontend,t),t},"registerFrontend"),pe=d(e=>{if(!types_1.LENS_WATCH_SCOPE_ENABLED)return{};const r=path.resolve(e.projectRoot),o=e.sourceDirs.map(t=>path.resolve(t)).filter(t=>t!==r);return o.length>0?{LENSMCP_WATCH_DIRS:o.join(path.delimiter)}:{}},"lensWatchScopeEnv"),te=d((e,r,o)=>{const t=++e.generation,n=`${e.key}:g${t}:`,a=`${n}vite`,l=`${n}browser-capture`;M.delete(a),M.delete(l);const c=d((S,m,y,w,h,L)=>O(S,m,y,w,h,L,e.workspaceRoot),"spawnInRoot"),u=(0,lens_frontend_1.spawnLensFrontend)({projectRoot:e.projectRoot,workspaceRoot:e.workspaceRoot,project:e.project,eventFile:e.eventFile,port:r,chrome:!0,headless:!0,viteEnv:{...e.frontend.env??{},...e.frontend.frozen?{LENSMCP_FREEZE:"1"}:{},LENSMCP_PROJECT:e.project,...e.replayWorkspace?{LENSMCP_REPLAY_WORKSPACE:e.replayWorkspace}:{},LENSMCP_FRONTEND_KEY:e.key,LENSMCP_FRONTEND_GENERATION:String(t),LENSMCP_FRONTEND_ROLE:o,...pe(e),NX_DAEMON:"false",NX_ISOLATE_PLUGINS:"false"},labelPrefix:n,log:d(S=>console.log(S),"log")},c),i={ownerKey:e.key,generation:t,port:r,labelPrefix:n,vite:u?.vite??N.get(a),capture:N.get(l)};return e.generations.add(i),i},"spawnFrontendGeneration"),x=d((e,r)=>{if(!e)return;C.get(e.ownerKey)?.generations.delete(e);const o=[[`${e.labelPrefix}browser-capture`,e.capture],[`${e.labelPrefix}vite`,e.vite]];for(const[t,n]of o)M.add(t),n&&H(n);r&&T.delete(e.port)},"terminateGeneration"),ue=d(async e=>{const r=Date.now()+types_1.LENS_REPLACEMENT_READY_MS;for(;!s.stopped()&&Date.now()<r;){const o=e.vite;if(!o||o.exitCode!==null||o.signalCode!==null)return!1;if(await probePortListening(e.port,Math.min(500,types_1.LENS_PROBE_TIMEOUT_MS))){const t=await P(e.port);if(!t||t.ready)return!0}await sleepUnref(150)}return!1},"waitForGenerationReady"),U=d(async e=>{const r=e?.vite;return!!(e&&r&&r.exitCode===null&&r.signalCode===null&&await probePortListening(e.port,Math.min(500,types_1.LENS_PROBE_TIMEOUT_MS)))},"generationIsServing"),z=d(e=>!e.disposed&&!s.stopped()&&C.get(e.key)===e,"frontendIsCurrent"),X=d((e,r)=>{if(!z(e))return Promise.resolve(!1);if(e.replacement)return e.replacement;const o=e.active;e.state=o?"replacing":"starting",e.reason=r,e.startedAt=Date.now();const t=(async()=>{let n,a;const l=Date.now();try{const c=new Set;for(const h of C.values())h!==e&&c.add(h.desiredPort);const u=o&&o.port===e.desiredPort?`g${o.generation}`:void 0,i=await K(e.desiredPort,T,{reserved:c,heldBy:u});if(a=i,!z(e))return T.delete(i),!1;n=te(e,i,"replacement"),e.candidate=n;const S=await U(o);console.log(`[gateway] lens handoff start: ${e.key} g${o?.generation??0}\u2192g${n.generation} :${o?.port??"down"}\u2192:${i} reason=${r}`),p("info",`lens handoff starting: ${e.project}`,`cluster-lens-app:${e.project}`,{kind:"lens-handoff-start",wsKey:e.wsKey,project:e.project,reason:r,generation:n.generation,oldPort:o?.port,newPort:i,oldServing:S},void 0,e.eventFile===s.eventFile?void 0:e.eventFile);const m=await ue(n);if(!z(e))return x(n,!0),e.candidate=void 0,!1;if(!m){x(n,!0),e.candidate=void 0;const h=await U(o);return e.state=h?"ready":"failed",h&&(e.reason=void 0,e.startedAt=void 0),console.error(`[gateway] lens handoff failed: ${e.key} g${n.generation} did not become ready within ${types_1.LENS_REPLACEMENT_READY_MS}ms; ${e.state==="ready"?"old generation kept serving":"no active generation"}.`),p("warning",`lens handoff failed: ${e.project}`,`cluster-lens-app:${e.project}`,{kind:"lens-handoff-failed",wsKey:e.wsKey,project:e.project,reason:r,generation:n.generation,port:i,durationMs:Date.now()-l,oldKept:h},void 0,e.eventFile===s.eventFile?void 0:e.eventFile),!1}for(const h of e.routes)h.target=`http://localhost:${n.port}`,h.lens&&(h.lens.port=n.port);e.frontend.port=n.port,e.active=n,e.candidate=void 0,e.state="ready",e.reason=void 0,e.startedAt=void 0;const y=n.vite?A.get(n.vite):void 0;y&&(y.role="active",y.listening=!0);const w=(0,hmr_reload_1.broadcastFullReload)(s,e.key);if(console.log(`[gateway] lens handoff ready: ${e.key} g${n.generation} :${n.port} in ${Date.now()-l}ms; draining g${o?.generation??0}${w>0?`; reloading ${w} tab(s)`:""}.`),p("info",`lens handoff complete: ${e.project}`,`cluster-lens-app:${e.project}`,{kind:"lens-handoff-complete",wsKey:e.wsKey,project:e.project,reason:r,generation:n.generation,oldPort:o?.port,newPort:n.port,durationMs:Date.now()-l,reloadedTabs:w},void 0,e.eventFile===s.eventFile?void 0:e.eventFile),o){const h=`${o.labelPrefix}browser-capture`;M.add(h),o.capture&&H(o.capture),setTimeout(()=>x(o,!0),types_1.LENS_REPLACEMENT_DRAIN_MS).unref?.()}return!0}catch(c){x(n,!0),!n&&a!==void 0&&T.delete(a),e.candidate=void 0;const u=await U(o);e.state=u?"ready":"failed",u&&(e.reason=void 0,e.startedAt=void 0);const i=c.message;return console.error(`[gateway] lens handoff failed: ${e.key}: ${i}`),p("warning",`lens handoff failed: ${e.project}`,`cluster-lens-app:${e.project}`,{kind:"lens-handoff-failed",wsKey:e.wsKey,project:e.project,reason:r,generation:n?.generation??e.generation,port:n?.port??a,durationMs:Date.now()-l,oldKept:u,error:i},void 0,e.eventFile===s.eventFile?void 0:e.eventFile),!1}finally{e.replacement=void 0}})();return e.replacement=t,t},"rollFrontend"),ne=d((e,r)=>{e.active=te(e,r,"active"),e.state="starting",e.startedAt=Date.now()},"spawnInitialFrontend"),Ee=d((e,r)=>{const o=C.get(r.key);return!o||types_1.LENS_RESTART_MODE==="in-place"?!1:(o.candidate?.vite===e||o.active?.vite!==e||(o.state="starting",o.reason="child-exit",o.startedAt=Date.now(),console.warn(`[gateway] lens frontend exited: ${o.key} g${r.generation} :${r.port} (${describeChildExit(e)}); starting an alternate-port replacement.`),X(o,"child-exit")),!0)},"handleManagedViteExit");s.lensSupervisor=types_1.LENS_RESTART_MODE==="rolling"?{status(e){const r=F.get(e);return r?{state:r.state,generation:r.candidate?.generation??r.active?.generation??r.generation,reason:r.reason,startedAt:r.startedAt}:void 0},recover(e,r){const o=F.get(e);return o?X(o,r):Promise.resolve(!1)}}:void 0;let J=!1,oe=0;const fe=d(()=>{J||Date.now()-oe<types_1.POD_STALE_SCAN_MS||(J=!0,oe=Date.now(),(async()=>{const e=new Map;for(const r of[...C.values()]){if(s.stopped())return;let o=e.get(r.workspaceRoot);if(!o){const i=(0,scope_1.readSourceSetOptions)(r.workspaceRoot);o={pass:(0,lifecycle_1.sourceScanPass)(r.workspaceRoot,i.exclude,{ignoreTests:i.ignoreTests}),startedAt:Date.now()},e.set(r.workspaceRoot,o)}const t=o.startedAt,n=await o.pass.snapshot(r.sourceDirs);if(C.get(r.key)!==r)continue;const a=r.sourceSnapshot,l=r.sourceScanStartedAt;if(r.sourceSnapshot=n,r.sourceScanStartedAt=t,!a)continue;const c=Date.now(),u=(0,lifecycle_1.diffSourceSets)(a,n,c,(0,lifecycle_1.sourceChangeWindowMs)(c,l,types_1.POD_STALE_SCAN_MS,types_1.POD_RECYCLE_SETTLE_MS));u&&(r.sourceChange=u,p("info",`source file set changed for ${r.key}`,`cluster-lens-app:${r.project}`,{kind:"source-set-changed",scoped:!0,wsKey:r.wsKey,project:r.project,added:u.added,removed:u.removed,truncated:u.truncated},void 0,r.eventFile===s.eventFile?void 0:r.eventFile))}})().catch(()=>{}).finally(()=>{J=!1}))},"scanFrontendSourceSets");let Z=!1;const ge=d(async(e,r)=>{if(!Z){Z=!0;try{for(const[o,t]of[...A]){if(s.stopped())return;if(t.port===void 0||o.exitCode!==null||o.signalCode!==null)continue;if(await probePortListening(t.port,types_1.LENS_PROBE_TIMEOUT_MS)){if(t.probeFails=0,!t.listening){t.listening=!0;const c=C.get(t.key);c?.active?.vite===o&&(c.state="ready",c.reason=void 0),p("info",`lens app up: ${t.project} (vite :${t.port} listening)`,`cluster-lens-app:${t.project}`,{kind:"service-up",project:t.project,port:t.port},void 0,t.bus)}continue}const n=t.listening?e.graceMs:Math.max(e.graceMs,e.neverListenedGraceMs);if(Date.now()-t.spawnedAt<n){t.probeFails=0;continue}if(!r)continue;t.probeFails+=1;const a=(0,lifecycle_1.lensChildWedged)({spawnedAt:t.spawnedAt,probeFails:t.probeFails,hasListened:t.listening},I.get(t.key)??0,Date.now(),e);if(!a)continue;const l=t.listening?"its listener VANISHED (was up, now refusing)":`it NEVER bound within the ${Math.round(n/1e3)}s boot allowance`;I.set(t.key,Date.now()),t.probeFails=0,t.listening=!1,console.error(`[gateway] wedge recycle: lens app ${t.project} is ALIVE but NOT LISTENING on :${t.port} after ${Math.max(2,e.failureThreshold)} probes \u2014 ${l} \u2014 SIGKILL; a fresh vite is coming.`),p("warning",`wedge recycle: ${t.project} (${a})`,`cluster-lens-app:${t.project}`,{kind:"pod-recycle",project:t.project,reason:a,port:t.port},void 0,t.bus),signalChild(o,"SIGKILL")}}finally{Z=!1}}},"probeLensChildren"),he=d(()=>{if(j||!types_1.POD_RECYCLE_ENABLED&&!types_1.LENS_PROBE_ENABLED)return;const e={graceMs:types_1.POD_STALE_GRACE_MS,settleMs:types_1.POD_RECYCLE_SETTLE_MS,cooldownMs:types_1.POD_STALE_RECYCLE_COOLDOWN_MS};j=setInterval(()=>{if(s.stopped()||A.size===0||(re(),!types_1.POD_RECYCLE_ENABLED))return;fe();const r=Date.now();for(const[o,t]of A){const n=C.get(t.key);if(n?.frontend.frozen)continue;const a=n?.sourceChange?.changedAt??0,l=I.get(t.key)??0;(0,lifecycle_1.lensFrontendStale)(t.spawnedAt,l,a,r,e)&&((Y.get(t.key)??0)>=a||B.has(t.key)||(B.add(t.key),(async()=>{try{const c=n?.sourceChange,u=c&&!c.truncated?[...c.added,...c.removed].map(y=>path.resolve(t.workspaceRoot,y)):[],i=types_1.LENS_WATCHER_PROBE_ENABLED&&t.port!==void 0?(0,lifecycle_1.lensWatcherVerdict)(await P(t.port),a,c?.windowMs??types_1.POD_STALE_SCAN_MS+types_1.POD_RECYCLE_SETTLE_MS,u):"unknown";if(i==="heard"){Y.set(t.key,a),console.log(`[gateway] stale source set: lens app ${t.project} watcher CONFIRMED the change \u2014 no recycle, HMR intact.`),p("info",`stale check: ${t.project} watcher confirmed \u2014 no recycle`,`cluster-lens-app:${t.project}`,{kind:"pod-stale-verified",project:t.project},void 0,t.bus);return}if(i==="unknown"&&types_1.LENS_WATCHER_UNVERIFIED==="keep"){console.log(`[gateway] stale source set: lens app ${t.project} unverifiable (no watcher testimony) \u2014 keeping it (LENSMCP_LENS_WATCHER_UNVERIFIED=keep).`);return}if(o.exitCode!==null||o.signalCode!==null)return;I.set(t.key,Date.now());const S=C.get(t.key);if(types_1.LENS_RESTART_MODE==="rolling"&&S){console.log(`[gateway] stale refresh: lens app ${t.key} (stale-source-set) \u2014 watcher ${i==="missed"?"missed the exact path change":"unverifiable"}; preparing a standby without dropping traffic.`),p("warning",`stale refresh: ${t.project} (stale-source-set)`,`cluster-lens-app:${t.project}`,{kind:"pod-refresh",wsKey:S.wsKey,project:t.project,reason:"stale-source-set",watcher:i,added:c?.added,removed:c?.removed},void 0,t.bus),await X(S,"stale-source-set");return}t.listening=!1,console.log(`[gateway] zombie recycle: lens app ${t.project} (stale-source-set) \u2014 watcher ${i==="missed"?"SILENT across the change":"unverifiable"}; restarting it`),p("warning",`zombie recycle: ${t.project} (stale-source-set)`,`cluster-lens-app:${t.project}`,{kind:"pod-recycle",project:t.project,reason:"stale-source-set",watcher:i},void 0,t.bus);const m=(0,hmr_reload_1.broadcastFullReload)(s,t.key);m>0&&console.log(`[gateway]   \u2192 told ${m} open tab(s) to reload (stale optimize-dep generation)`),signalChild(o,"SIGTERM"),setTimeout(()=>{o.exitCode===null&&o.signalCode===null&&(console.log(`[gateway] zombie recycle: lens app ${t.project} ignored SIGTERM for ${Math.round(types_1.LENS_RECYCLE_KILL_GRACE_MS/1e3)}s \u2014 escalating to SIGKILL.`),signalChild(o,"SIGKILL"))},types_1.LENS_RECYCLE_KILL_GRACE_MS).unref?.()}finally{B.delete(t.key)}})()))}},Math.min(types_1.POD_STALE_SCAN_MS,15e3)),j.unref?.()},"startLensSweeper"),we=d(async()=>{const e=[...new Map(s.routes.filter(t=>t.lens).map(t=>[t.project,t.lens])).values()],r=E.dashboard!==!1,o=E.mcp!==!1&&e.length>0;if(r){const t=(0,lens_frontend_1.findDashboardBundle)(s.root);if(!t)console.warn("[gateway] lens dashboard bundle not found \u2014 skipping. Install the self-contained CLI: `npm i -D lensmcp` (it ships `bundled/dashboard.js`), or `yarn nx build @lensmcp/lensmcp-mcp` in-repo.");else{const n=(0,scope_1.readLensScope)(s.root),a=await K(E.dashboardPort??n.dashboardPort,V),l=E.lensHost??"lensmcp.local",c=n.basePath;s.registry.appendRoutes(s.wsKey,[{host:l,prefix:c,project:observability_1.LENS_DASHBOARD_PROJECT,target:`http://localhost:${a}`}]),s.rebuildRoutes(),(0,workspace_registry_1.registerWorkspace)({key:n.key,root:s.root,base:c,pid:process.pid,procStamp:(0,workspace_registry_1.processStamp)(process.pid),updatedAt:new Date().toISOString()}),console.log(`[gateway] starting lens dashboard \u2192 http://localhost:${a} (routed at https://${l}${c}/)`),p("info",`lens dashboard up: ${l}${c} \u2192 :${a}`,"cluster-lens-dashboard",{kind:"lens-dashboard-up",host:l,port:a,base:c}),O("lens-dashboard",(0,process_name_1.namedExecPath)((0,process_name_1.processName)("lensmcp",n.key,"dashboard")),[t],{LENSMCP_EVENT_FILE:s.eventFile,LENSMCP_PROCESS_ROLE:"dashboard",LENSMCP_DASHBOARD_PORT:String(a),LENSMCP_DASHBOARD_BASE:c,LENSMCP_REPLAY_WORKSPACE:n.key,LENSMCP_GATEWAY_PORTS:$},!1,void 0,void 0,a)}}if(o){const t=(0,lens_frontend_1.findMcpBundle)(s.root);if(!t)console.warn("[gateway] MCP server bundle not found \u2014 skipping (lens apps will still publish to the bus; an external `lensmcp mcp` can read it). Install: `npm i -D lensmcp`.");else{const n=(0,scope_1.readLensScope)(s.root),a=Number(process.env.LENSMCP_PORT??n.mcpHttpPort),l=d(()=>{console.log(`[gateway] starting lens MCP server on 127.0.0.1:${a} (${t})`),O("lens-mcp",(0,process_name_1.namedExecPath)((0,process_name_1.processName)("lensmcp",n.key,"mcp")),[t],{LENSMCP_EVENT_FILE:s.eventFile,LENSMCP_PROCESS_ROLE:"mcp",LENSMCP_TRANSPORT:process.env.LENSMCP_TRANSPORT??"http",LENSMCP_PORT:String(a),LENSMCP_WORKSPACE_KEY:n.key,LENSMCP_REPLAY_WORKSPACE:n.key,LENSMCP_WORKSPACE_ROOT:s.root},!1,void 0,void 0,a)},"spawnMcp");await g(a)?l():(console.warn(`[gateway] lens MCP port :${a} is already served \u2014 an external lensmcp server (a shared daemon?) owns this workspace's MCP; not spawning a second. Re-probing every ${Math.round(types_1.LENS_PARKED_PORT_REPROBE_MS/1e3)}s; will take over if it frees.`),p("info",`lens MCP served externally on :${a} \u2014 gateway parked its own`,"cluster-lens-child:lens-mcp",{kind:"lens-child-up",project:"lens-mcp",label:"lens-mcp",port:a,external:!0}),Q("lens-mcp",a,l))}}for(const t of e){if(t.started)continue;t.started=!0;const n=t.port,a=(s.registry.get(s.wsKey)?.routes??s.routes).filter(u=>u.lens?.project===t.project),l=await K(t.port,T);for(const u of a)u.lens&&(u.lens.port=l),u.target=`http://localhost:${l}`;t.port=l;const c=ee({wsKey:s.wsKey,replayWorkspace:s.wsKey,project:t.project,workspaceRoot:s.root,projectRoot:t.projectRoot,eventFile:s.eventFile,routes:a,frontend:t,desiredPort:n});try{ne(c,l),p("info",`lens app started: ${t.project} (vite :${t.port})`,`cluster-lens-app:${t.project}`,{kind:"lens-app-up",project:t.project,port:t.port})}catch(u){T.delete(l),c.state="failed",console.error(`[gateway] lens app ${t.project}: ${u.message}`)}}he()},"bootSingletonsAndApps"),_e=d(async e=>{if(E.dashboard===!1)return;const r=(0,lens_frontend_1.findDashboardBundle)(s.root);if(!r)return;const o=(0,scope_1.readLensScope)(e.root),t=E.lensHost??"lensmcp.local",n=o.basePath,a=await K(o.dashboardPort,V),l=`lens-dashboard:${e.wsKey}`,c=path.join(e.root,".lensmcp","events.jsonl");return M.delete(l),s.registry.appendRoutes(e.wsKey,[{host:t,prefix:n,project:observability_1.LENS_DASHBOARD_PROJECT,target:`http://localhost:${a}`}]),(0,workspace_registry_1.registerWorkspace)({key:e.wsKey,root:e.root,base:n,pid:process.pid,procStamp:(0,workspace_registry_1.processStamp)(process.pid),updatedAt:new Date().toISOString(),...e.instance?{instance:{name:e.instance.name,baseKey:e.instance.baseKey,apex:e.instance.apex}}:{}}),console.log(`[gateway] hosting dashboard for workspace '${e.wsKey}' \u2192 http://localhost:${a} (routed at https://${t}${n}/)`),p("info",`lens dashboard up: ${t}${n} \u2192 :${a}`,"cluster-lens-dashboard",{kind:"lens-dashboard-up",host:t,port:a,base:n}),O(l,(0,process_name_1.namedExecPath)((0,process_name_1.processName)("lensmcp",e.wsKey,"dashboard")),[r],{LENSMCP_EVENT_FILE:c,LENSMCP_PROCESS_ROLE:"dashboard",LENSMCP_DASHBOARD_PORT:String(a),LENSMCP_DASHBOARD_BASE:n,LENSMCP_WS_KEY:e.wsKey,LENSMCP_HOSTED_GUEST:"1",LENSMCP_REPLAY_WORKSPACE:e.instance?.baseKey??e.wsKey,...e.sockNs?{LENSMCP_SOCK_NS:e.sockNs}:{},LENSMCP_GATEWAY_PORTS:$},!1,void 0,e.root,a),()=>{M.add(l),V.delete(a),(0,workspace_registry_1.unregisterWorkspace)(e.wsKey);const u=N.get(l);u&&H(u),N.delete(l)}},"hostWorkspaceDashboard"),Se=d(async e=>{const r=new Map;for(const n of e.routes){if(!n.lens)continue;const a=r.get(n.lens.project)??[];a.push(n),r.set(n.lens.project,a)}if(r.size===0)return()=>{};const o=path.join(e.root,".lensmcp","events.jsonl"),t=[];for(const[n,a]of r){const l=a[0].lens;if(l.started)continue;const c=await K(l.port,T),u=l.port;for(const S of a)S.lens.started=!0,S.lens.port=c,S.target=`http://localhost:${c}`;const i=ee({wsKey:e.wsKey,replayWorkspace:e.instance?.baseKey??e.wsKey,project:n,workspaceRoot:e.root,projectRoot:l.projectRoot,eventFile:o,routes:a,frontend:l,desiredPort:u});t.push(i),console.log(`[gateway] hosting lens app '${n}' of '${e.wsKey}' \u2192 vite :${c}`);try{ne(i,c),p("info",`lens app started: ${e.wsKey}/${n} (vite :${c})`,`cluster-lens-app:${e.wsKey}:${n}`,{kind:"lens-app-up",project:n,port:c},void 0,o)}catch(S){T.delete(c),i.state="failed",console.error(`[gateway] lens app ${e.wsKey}/${n}: ${S.message}`)}}return()=>{for(const n of t){n.disposed=!0;for(const a of[...n.generations])x(a,!0);for(const a of n.routes)a.lens&&F.delete(a.lens);F.delete(n.frontend),I.delete(n.key),Y.delete(n.key),B.delete(n.key),C.delete(n.key)}}},"hostWorkspaceApps"),ye=d(async(e=2500)=>{j&&(clearInterval(j),j=void 0);const r=[...b];for(const n of r)signalChild(n,"SIGTERM");const o=d(n=>n.exitCode===null&&n.signalCode===null,"alive"),t=Date.now()+e;for(;Date.now()<t&&r.some(o);)await new Promise(n=>setTimeout(n,100));for(const n of r)o(n)&&signalChild(n,"SIGKILL")},"reapAll"),re=d(()=>ge({graceMs:types_1.LENS_PROBE_GRACE_MS,failureThreshold:types_1.LENS_PROBE_FAILS,cooldownMs:types_1.LENS_PROBE_COOLDOWN_MS,neverListenedGraceMs:types_1.LENS_PROBE_BOOT_GRACE_MS},types_1.LENS_PROBE_ENABLED),"probeLensFrontends");return{spawnManagedChild:O,bootSingletonsAndApps:we,hostWorkspaceDashboard:_e,hostWorkspaceApps:Se,probeLensFrontends:re,reapAll:ye}}v(createLensChildren,"createLensChildren"),d(createLensChildren,"createLensChildren");

package/executors/gateway/runtime/lifecycle.js

@@ -1,3 +1,3 @@
-"use strict";var Ue=Object.defineProperty;var v=(t,a)=>Ue(t,"name",{value:a,configurable:!0});var Ve=Object.defineProperty,s=v((t,a)=>Ve(t,"name",{value:a,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.scaleTarget=scaleTarget,exports.isLoopbackHostname=isLoopbackHostname,exports.isOwnRunnerCommand=isOwnRunnerCommand,exports.isRunnerOf=isRunnerOf,exports.isTestSourcePath=isTestSourcePath,exports.sourceScanPass=sourceScanPass,exports.sourceSetSnapshot=sourceSetSnapshot,exports.sourceSetSignature=sourceSetSignature,exports.diffSourceSets=diffSourceSets,exports.sourceChangeWindowMs=sourceChangeWindowMs,exports.sourceScopeDirs=sourceScopeDirs,exports.podRecycleReason=podRecycleReason,exports.lensFrontendStale=lensFrontendStale,exports.lensWatcherVerdict=lensWatcherVerdict,exports.podWatcherVerdict=podWatcherVerdict,exports.lensChildWedged=lensChildWedged,exports.isPortConflictExit=isPortConflictExit,exports.podChangeClock=podChangeClock,exports.createServiceLayer=createServiceLayer,exports.chooseStalePodKillTarget=chooseStalePodKillTarget;const tslib_1=require("tslib"),node_child_process_1=require("node:child_process"),node_crypto_1=require("node:crypto"),fs=tslib_1.__importStar(require("node:fs")),http=tslib_1.__importStar(require("node:http")),net=tslib_1.__importStar(require("node:net")),path=tslib_1.__importStar(require("node:path")),node_util_1=require("node:util"),discovery_1=require("./discovery"),pod_sock_1=require("../../../pod-sock"),scope_1=require("./scope"),pod_env_1=require("./pod-env"),pod_probe_1=require("./pod-probe"),service_keys_1=require("./service-keys"),workspace_log_1=require("./workspace-log"),own_log_1=require("./own-log"),inspector_secret_1=require("../../../inspector-secret"),pod_output_1=require("./pod-output"),serve_launch_1=require("./serve-launch"),shared_build_1=require("./shared-build"),protocol_1=require("../../../shared-build/protocol"),types_1=require("./types"),exit_reason_1=require("../../../exit-reason"),handoff_retire_1=require("../../../handoff-retire"),process_name_1=require("../../../process-name");function eastWestEnv(t,a){const c={},d=t.serviceKeys[(0,service_keys_1.serviceKeyId)(a.wsKey,a.project)];if(d&&(c.LENSMCP_SERVICE_KEY=d),t.https){const g=require("../../../basic-ssl").caCertPath();fs.existsSync(g)&&(c.NODE_EXTRA_CA_CERTS=g)}return c}v(eastWestEnv,"eastWestEnv"),s(eastWestEnv,"eastWestEnv");const sleep=s(t=>new Promise(a=>setTimeout(a,t)),"sleep"),SRC_EXCLUDE=new Set(["node_modules","dist","tmp","coverage","build","out","target"]),SRC_EXT=new Set([".ts",".tsx",".js",".jsx",".mjs",".cjs",".css",".scss",".sass",".less",".json",".html",".htm",".vue",".svelte",".mdx"]),SCAN_FILE_CAP=1e5;function fnv1a(t){let a=2166136261;for(let c=0;c<t.length;c+=1)a^=t.charCodeAt(c),a=Math.imul(a,16777619);return a>>>0}v(fnv1a,"fnv1a"),s(fnv1a,"fnv1a");const execFileP=(0,node_util_1.promisify)(node_child_process_1.execFile);async function gitIgnoredPaths(t){try{const{stdout:a}=await execFileP("git",["ls-files","--others","--directory","--ignored","--exclude-standard","-z"],{cwd:t,maxBuffer:33554432,timeout:1e4,windowsHide:!0});return new Set(a.split("\0").filter(Boolean))}catch{return new Set}}v(gitIgnoredPaths,"gitIgnoredPaths"),s(gitIgnoredPaths,"gitIgnoredPaths");function scaleTarget(t,a=fs.existsSync){if(t.decl.adminUrl)return{url:t.decl.adminUrl};const c=path.join(t.pool.dir,"parent.sock");return a(c)?{socketPath:c}:t.decl.port?{url:`http://localhost:${t.decl.port}`}:void 0}v(scaleTarget,"scaleTarget"),s(scaleTarget,"scaleTarget");function isLoopbackHostname(t){const a=t.toLowerCase().replace(/^\[(.*)\]$/,"$1").replace(/\.$/,"");return a==="localhost"||a.endsWith(".localhost")?!0:net.isIPv4(a)?a.split(".")[0]==="127":net.isIPv6(a)&&new URL(`http://[${a}]/`).hostname==="[::1]"}v(isLoopbackHostname,"isLoopbackHostname"),s(isLoopbackHostname,"isLoopbackHostname");function postScale(t,a,c){let d;if("socketPath"in t)d=http.request({socketPath:t.socketPath,path:"/webpack/scale",method:"POST",headers:{"content-type":"application/json"}},g=>g.resume());else{const g=t.url.startsWith("https"),M=g?require("node:https"):http,m={method:"POST"};g&&isLoopbackHostname(new URL(t.url).hostname)&&(m.rejectUnauthorized=!1),c&&(m.lookup=c),d=M.request(`${t.url}/webpack/scale`,m,E=>E.resume())}return d.on("error",()=>{}),d.end(JSON.stringify({pods:a})),d}v(postScale,"postScale"),s(postScale,"postScale");function isOwnRunnerCommand(t,a){return(0,serve_launch_1.isServeRunnerCommand)(t)?(0,serve_launch_1.isServeRunnerCommandOf)(t,a):t.includes("/node_modules/nx/")?t.includes(`${a.replace(/\/+$/,"")}/node_modules/nx/`):!0}v(isOwnRunnerCommand,"isOwnRunnerCommand"),s(isOwnRunnerCommand,"isOwnRunnerCommand");function isRunnerOf(t,a,c){const d=a.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");return!new RegExp(`(^|\\s)run ${d}(:|\\s|$)`).test(t)||!(0,serve_launch_1.isServeRunnerCommand)(t)&&!/\bnx(\.js)?\b/.test(t)?!1:isOwnRunnerCommand(t,c)}v(isRunnerOf,"isRunnerOf"),s(isRunnerOf,"isRunnerOf");const TEST_FILE_RE=/\.(spec|test|e2e|e2e-spec|stories)\.[cm]?[jt]sx?$/,TEST_DIR_SEGMENTS=new Set(["__tests__","__mocks__","__snapshots__"]);function isTestSourcePath(t){const a=t.split("/"),c=a[a.length-1]??"";if(TEST_FILE_RE.test(c))return!0;for(let d=0;d<a.length-1;d+=1)if(TEST_DIR_SEGMENTS.has(a[d]))return!0;return!1}v(isTestSourcePath,"isTestSourcePath"),s(isTestSourcePath,"isTestSourcePath");function sourceScanPass(t,a,c){const d=c?.ignoreTests??!0;let g;const M=new Map,m=`tree:${path.resolve(t)}`,E=s(w=>path.relative(t,w).split(path.sep).join("/"),"rel"),C=s(async(w,y)=>{const _=await(g??=gitIgnoredPaths(t)),D=[],O=new Set;let P=!1;const V=s(async(Q,S)=>{if(D.length>=SCAN_FILE_CAP){P=!0;return}let N;try{N=await fs.promises.readdir(Q,{withFileTypes:!0})}catch{return}S&&O.add(E(Q));for(const X of N){if(D.length>=SCAN_FILE_CAP){P=!0;return}const F=X.name,Z=path.join(Q,F);if(X.isDirectory()){if(!S||F.startsWith(".")||SRC_EXCLUDE.has(F)||a?.has(F)||F.endsWith("-devserver")||_.has(`${E(Z)}/`))continue;await V(Z,!0)}else if(X.isFile()){const ee=F.lastIndexOf(".");if(ee<=0||!SRC_EXT.has(F.slice(ee)))continue;const H=E(Z);if(_.has(H)||d&&isTestSourcePath(H))continue;D.push(H)}}},"walk");return await V(w,y),{paths:D,entered:O,truncated:P}},"walkDir"),I=s((w,y)=>{let _=M.get(w);return _||(_=y(),M.set(w,_)),_},"memo"),se=s(async()=>{const w=M.get(m);if(!w)return;const y=await w;return y.truncated?void 0:y},"wideWalk"),J=new Set,ne=s(()=>I(`files:${path.resolve(t)}`,async()=>{const w=await se();return w?{paths:w.paths.filter(y=>!y.includes("/")),entered:J,truncated:!1}:C(t,!1)}),"rootFiles"),ae=s(w=>I(`tree:${path.resolve(w)}`,async()=>{const y=await se(),_=E(w);if(y?.entered.has(_)){const D=`${_}/`;return{paths:_===""?y.paths:y.paths.filter(O=>O.startsWith(D)),entered:J,truncated:!1}}return C(w,!0)}),"subtree"),B=s(w=>{const y=new Set;let _=0,D=w.some(P=>P.truncated);const O=s(P=>y.has(P)?!0:y.size>=SCAN_FILE_CAP?(D=!0,!1):(y.add(P),_^=fnv1a(P),!0),"add");for(const P of w)if(!P.paths.every(O))break;return{signature:`${y.size}:${(_>>>0).toString(36)}`,paths:y,truncated:D}},"compose");return{async snapshot(w){if(!w||w.length===0)return B([await I(m,()=>C(t,!0))]);const y=[await ne()];for(const _ of w)y.push(await ae(_));return B(y)}}}v(sourceScanPass,"sourceScanPass"),s(sourceScanPass,"sourceScanPass");async function sourceSetSnapshot(t,a,c,d){return sourceScanPass(t,c,d).snapshot(a)}v(sourceSetSnapshot,"sourceSetSnapshot"),s(sourceSetSnapshot,"sourceSetSnapshot");async function sourceSetSignature(t,a,c,d){return(await sourceSetSnapshot(t,a,c,d)).signature}v(sourceSetSignature,"sourceSetSignature"),s(sourceSetSignature,"sourceSetSignature");const SOURCE_DIFF_PATH_CAP=128;function diffSourceSets(t,a,c,d){if(t.paths.size===a.paths.size){let E=!0;for(const C of t.paths)if(!a.paths.has(C)){E=!1;break}if(E)return null}const g=[],M=[];let m=t.truncated||a.truncated;for(const E of a.paths)t.paths.has(E)||(g.length+M.length<SOURCE_DIFF_PATH_CAP?g.push(E):m=!0);for(const E of t.paths)a.paths.has(E)||(g.length+M.length<SOURCE_DIFF_PATH_CAP?M.push(E):m=!0);return{changedAt:c,added:g,removed:M,truncated:m,...d!==void 0?{windowMs:d}:{}}}v(diffSourceSets,"diffSourceSets"),s(diffSourceSets,"diffSourceSets");function sourceChangeWindowMs(t,a,c,d){const g=a&&a>0?t-a:c;return Math.max(g,c)+d}v(sourceChangeWindowMs,"sourceChangeWindowMs"),s(sourceChangeWindowMs,"sourceChangeWindowMs");function sourceScopeDirs(t,a,c,d,g){const M=s(C=>{const I=path.relative(t,C).split(path.sep).filter(Boolean);return I.length===0||I[0].startsWith("..")?"":I[0]},"bucketOf")(a);if(!M)return[];const m=new Set(c.filter(Boolean)),E=new Set([M]);for(const C of d)C.startsWith(".")||SRC_EXCLUDE.has(C)||g?.has(C)||C.endsWith("-devserver")||m.has(C)||E.add(C);return[...E].sort().map(C=>path.join(t,C))}v(sourceScopeDirs,"sourceScopeDirs"),s(sourceScopeDirs,"sourceScopeDirs");function podRecycleReason(t,a,c,d){return!t.proc||t.state!=="up"||t.spawnAt==null||t.inflight>0||(t.activeWork??0)>0||a-t.lastUsed<d.settleMs||t.lastStaleRecycleAt!=null&&a-t.lastStaleRecycleAt<d.cooldownMs?null:c>0&&c-t.spawnAt>d.graceMs?"stale-source-set":d.maxAgeMs>0&&a-t.spawnAt>d.maxAgeMs?"max-age":null}v(podRecycleReason,"podRecycleReason"),s(podRecycleReason,"podRecycleReason");function lensFrontendStale(t,a,c,d,g){return!(d-a<g.cooldownMs||c<=0||c-t<=g.graceMs||d-c<g.settleMs)}v(lensFrontendStale,"lensFrontendStale"),s(lensFrontendStale,"lensFrontendStale");function lensWatcherVerdict(t,a,c,d=[]){if(!t)return"unknown";if("schemaVersion"in t&&t.schemaVersion>=2&&d.length>0){const g=a-c,M=new Set(t.recentEvents.filter(m=>m.at>=g).map(m=>path.resolve(m.path)));return d.every(m=>M.has(path.resolve(m)))?"heard":"missed"}return t.lastFsSetEventAt>=a-c?"heard":"missed"}v(lensWatcherVerdict,"lensWatcherVerdict"),s(lensWatcherVerdict,"lensWatcherVerdict");function podWatcherVerdict(t,a,c){if(!t)return"unknown";if(t.degraded)return"degraded";const d=a-c;return t.lastWatchRunAt>=d||t.lastBuildAt>=d?"heard":"silent"}v(podWatcherVerdict,"podWatcherVerdict"),s(podWatcherVerdict,"podWatcherVerdict");function lensChildWedged(t,a,c,d){const g=t.hasListened?d.graceMs:Math.max(d.graceMs,d.neverListenedGraceMs);return c-t.spawnedAt<g||c-a<d.cooldownMs||t.probeFails<Math.max(2,d.failureThreshold)?null:"wedged-no-listener"}v(lensChildWedged,"lensChildWedged"),s(lensChildWedged,"lensChildWedged");function isPortConflictExit(t,a){return t.signal||t.code===null||t.code===0||t.ranMs>a.fastFailMs?!1:t.portHeld}v(isPortConflictExit,"isPortConflictExit"),s(isPortConflictExit,"isPortConflictExit");function podChangeClock(t,a){const c=t.sourceSetChangedFor?.get(a);if(c!==void 0){const d=t.sourceSetChangesFor?.get(a);return{at:c,...d?{change:d}:{},scope:"project"}}return t.sourceSetScoped?.has(a)?{at:0,scope:"none"}:{at:t.sourceSetChangedAt??0,...t.sourceSetChange?{change:t.sourceSetChange}:{},scope:"workspace"}}v(podChangeClock,"podChangeClock"),s(podChangeClock,"podChangeClock");const changeEvidence=s(t=>{if(!t)return"no path evidence";const a=[...t.added.map(c=>`+${c}`),...t.removed.map(c=>`-${c}`)];return a.length?`${a.slice(0,3).join(", ")}${a.length>3?` (+${a.length-3} more)`:""}`:"no path evidence"},"changeEvidence");function createServiceLayer(t,a,c={}){const d=c.spawnProcess??node_child_process_1.spawn,g=c.probeAlive??pod_probe_1.probePodAlive,M=c.killTree??((e,r="SIGTERM")=>{try{process.kill(-e.pid,r)}catch{try{e.kill(r)}catch{}}}),m=c.sharedBuild??(0,shared_build_1.createSharedBuildRelay)(t),E=s((e,r="SIGTERM")=>{m.detach(e),M(e,r)},"killTree"),C=c.handoffDrainMs??(0,handoff_retire_1.handoffDrainBoundMs)(),I=c.treeAlive??(e=>{if(!e.pid)return!1;try{return process.kill(-e.pid,0),!0}catch(r){return r.code==="EPERM"}}),se=c.retirePollMs??1e3,J=c.rollReadyMs??types_1.POD_ROLL_READY_MS,ne=c.rollPollMs??750,ae=c.maxConcurrentRolls??types_1.POD_MAX_CONCURRENT_ROLLS,B=ae>0?ae:Number.POSITIVE_INFINITY,w=c.maxConcurrentColdStarts??types_1.MAX_COLD_STARTS,y=w>0?w:Number.POSITIVE_INFINITY;let _=0;const D=[],O=s(()=>_<y?(_+=1,Promise.resolve()):new Promise(e=>{D.push(()=>{_+=1,e()})}),"acquireColdSlot"),P=s(()=>{_-=1,D.shift()?.()},"releaseColdSlot"),{emit:V}=a,Q=s(e=>e.wsKey===t.wsKey?void 0:path.join(e.root,".lensmcp","events.jsonl"),"serviceBus"),S=s((e,r,n,o,i)=>V(r,n,o,{wsKey:e.wsKey,...i},void 0,Q(e)),"emitSvc"),N=s(e=>(e.scannedAt=0,(0,discovery_1.pickSock)(e,t.scanTtlMs)?e.socks.length:0),"scanNow"),X=s((e,r)=>{let n;try{n=(0,node_child_process_1.execFileSync)("ps",["ax","-ww","-o","pid=,pgid=,command="],{encoding:"utf8",timeout:5e3})}catch{return 0}const o=e.proc?.pid;let i=0;for(const l of n.split(`
+"use strict";var Ue=Object.defineProperty;var v=(t,a)=>Ue(t,"name",{value:a,configurable:!0});var Ve=Object.defineProperty,s=v((t,a)=>Ve(t,"name",{value:a,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.scaleTarget=scaleTarget,exports.isLoopbackHostname=isLoopbackHostname,exports.isOwnRunnerCommand=isOwnRunnerCommand,exports.isRunnerOf=isRunnerOf,exports.isTestSourcePath=isTestSourcePath,exports.sourceScanPass=sourceScanPass,exports.sourceSetSnapshot=sourceSetSnapshot,exports.sourceSetSignature=sourceSetSignature,exports.diffSourceSets=diffSourceSets,exports.sourceChangeWindowMs=sourceChangeWindowMs,exports.sourceScopeDirs=sourceScopeDirs,exports.podRecycleReason=podRecycleReason,exports.lensFrontendStale=lensFrontendStale,exports.lensWatcherVerdict=lensWatcherVerdict,exports.podWatcherVerdict=podWatcherVerdict,exports.lensChildWedged=lensChildWedged,exports.isPortConflictExit=isPortConflictExit,exports.podChangeClock=podChangeClock,exports.createServiceLayer=createServiceLayer,exports.chooseStalePodKillTarget=chooseStalePodKillTarget;const tslib_1=require("tslib"),node_child_process_1=require("node:child_process"),node_crypto_1=require("node:crypto"),fs=tslib_1.__importStar(require("node:fs")),http=tslib_1.__importStar(require("node:http")),net=tslib_1.__importStar(require("node:net")),path=tslib_1.__importStar(require("node:path")),node_util_1=require("node:util"),discovery_1=require("./discovery"),pod_sock_1=require("../../../pod-sock"),scope_1=require("./scope"),pod_env_1=require("./pod-env"),pod_probe_1=require("./pod-probe"),service_keys_1=require("./service-keys"),workspace_log_1=require("./workspace-log"),own_log_1=require("./own-log"),inspector_secret_1=require("../../../inspector-secret"),pod_output_1=require("./pod-output"),serve_launch_1=require("./serve-launch"),shared_build_1=require("./shared-build"),warm_start_1=require("./warm-start"),protocol_1=require("../../../shared-build/protocol"),types_1=require("./types"),exit_reason_1=require("../../../exit-reason"),handoff_retire_1=require("../../../handoff-retire"),process_name_1=require("../../../process-name");function eastWestEnv(t,a){const c={},d=t.serviceKeys[(0,service_keys_1.serviceKeyId)(a.wsKey,a.project)];if(d&&(c.LENSMCP_SERVICE_KEY=d),t.https){const g=require("../../../basic-ssl").caCertPath();fs.existsSync(g)&&(c.NODE_EXTRA_CA_CERTS=g)}return c}v(eastWestEnv,"eastWestEnv"),s(eastWestEnv,"eastWestEnv");const sleep=s(t=>new Promise(a=>setTimeout(a,t)),"sleep"),SRC_EXCLUDE=new Set(["node_modules","dist","tmp","coverage","build","out","target"]),SRC_EXT=new Set([".ts",".tsx",".js",".jsx",".mjs",".cjs",".css",".scss",".sass",".less",".json",".html",".htm",".vue",".svelte",".mdx"]),SCAN_FILE_CAP=1e5;function fnv1a(t){let a=2166136261;for(let c=0;c<t.length;c+=1)a^=t.charCodeAt(c),a=Math.imul(a,16777619);return a>>>0}v(fnv1a,"fnv1a"),s(fnv1a,"fnv1a");const execFileP=(0,node_util_1.promisify)(node_child_process_1.execFile);async function gitIgnoredPaths(t){try{const{stdout:a}=await execFileP("git",["ls-files","--others","--directory","--ignored","--exclude-standard","-z"],{cwd:t,maxBuffer:33554432,timeout:1e4,windowsHide:!0});return new Set(a.split("\0").filter(Boolean))}catch{return new Set}}v(gitIgnoredPaths,"gitIgnoredPaths"),s(gitIgnoredPaths,"gitIgnoredPaths");function scaleTarget(t,a=fs.existsSync){if(t.decl.adminUrl)return{url:t.decl.adminUrl};const c=path.join(t.pool.dir,"parent.sock");return a(c)?{socketPath:c}:t.decl.port?{url:`http://localhost:${t.decl.port}`}:void 0}v(scaleTarget,"scaleTarget"),s(scaleTarget,"scaleTarget");function isLoopbackHostname(t){const a=t.toLowerCase().replace(/^\[(.*)\]$/,"$1").replace(/\.$/,"");return a==="localhost"||a.endsWith(".localhost")?!0:net.isIPv4(a)?a.split(".")[0]==="127":net.isIPv6(a)&&new URL(`http://[${a}]/`).hostname==="[::1]"}v(isLoopbackHostname,"isLoopbackHostname"),s(isLoopbackHostname,"isLoopbackHostname");function postScale(t,a,c){let d;if("socketPath"in t)d=http.request({socketPath:t.socketPath,path:"/webpack/scale",method:"POST",headers:{"content-type":"application/json"}},g=>g.resume());else{const g=t.url.startsWith("https"),M=g?require("node:https"):http,m={method:"POST"};g&&isLoopbackHostname(new URL(t.url).hostname)&&(m.rejectUnauthorized=!1),c&&(m.lookup=c),d=M.request(`${t.url}/webpack/scale`,m,E=>E.resume())}return d.on("error",()=>{}),d.end(JSON.stringify({pods:a})),d}v(postScale,"postScale"),s(postScale,"postScale");function isOwnRunnerCommand(t,a){return(0,serve_launch_1.isServeRunnerCommand)(t)?(0,serve_launch_1.isServeRunnerCommandOf)(t,a):t.includes("/node_modules/nx/")?t.includes(`${a.replace(/\/+$/,"")}/node_modules/nx/`):!0}v(isOwnRunnerCommand,"isOwnRunnerCommand"),s(isOwnRunnerCommand,"isOwnRunnerCommand");function isRunnerOf(t,a,c){const d=a.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");return!new RegExp(`(^|\\s)run ${d}(:|\\s|$)`).test(t)||!(0,serve_launch_1.isServeRunnerCommand)(t)&&!/\bnx(\.js)?\b/.test(t)?!1:isOwnRunnerCommand(t,c)}v(isRunnerOf,"isRunnerOf"),s(isRunnerOf,"isRunnerOf");const TEST_FILE_RE=/\.(spec|test|e2e|e2e-spec|stories)\.[cm]?[jt]sx?$/,TEST_DIR_SEGMENTS=new Set(["__tests__","__mocks__","__snapshots__"]);function isTestSourcePath(t){const a=t.split("/"),c=a[a.length-1]??"";if(TEST_FILE_RE.test(c))return!0;for(let d=0;d<a.length-1;d+=1)if(TEST_DIR_SEGMENTS.has(a[d]))return!0;return!1}v(isTestSourcePath,"isTestSourcePath"),s(isTestSourcePath,"isTestSourcePath");function sourceScanPass(t,a,c){const d=c?.ignoreTests??!0;let g;const M=new Map,m=`tree:${path.resolve(t)}`,E=s(w=>path.relative(t,w).split(path.sep).join("/"),"rel"),C=s(async(w,y)=>{const _=await(g??=gitIgnoredPaths(t)),D=[],O=new Set;let P=!1;const V=s(async(Q,S)=>{if(D.length>=SCAN_FILE_CAP){P=!0;return}let N;try{N=await fs.promises.readdir(Q,{withFileTypes:!0})}catch{return}S&&O.add(E(Q));for(const X of N){if(D.length>=SCAN_FILE_CAP){P=!0;return}const F=X.name,Z=path.join(Q,F);if(X.isDirectory()){if(!S||F.startsWith(".")||SRC_EXCLUDE.has(F)||a?.has(F)||F.endsWith("-devserver")||_.has(`${E(Z)}/`))continue;await V(Z,!0)}else if(X.isFile()){const ee=F.lastIndexOf(".");if(ee<=0||!SRC_EXT.has(F.slice(ee)))continue;const H=E(Z);if(_.has(H)||d&&isTestSourcePath(H))continue;D.push(H)}}},"walk");return await V(w,y),{paths:D,entered:O,truncated:P}},"walkDir"),I=s((w,y)=>{let _=M.get(w);return _||(_=y(),M.set(w,_)),_},"memo"),se=s(async()=>{const w=M.get(m);if(!w)return;const y=await w;return y.truncated?void 0:y},"wideWalk"),J=new Set,ne=s(()=>I(`files:${path.resolve(t)}`,async()=>{const w=await se();return w?{paths:w.paths.filter(y=>!y.includes("/")),entered:J,truncated:!1}:C(t,!1)}),"rootFiles"),ae=s(w=>I(`tree:${path.resolve(w)}`,async()=>{const y=await se(),_=E(w);if(y?.entered.has(_)){const D=`${_}/`;return{paths:_===""?y.paths:y.paths.filter(O=>O.startsWith(D)),entered:J,truncated:!1}}return C(w,!0)}),"subtree"),B=s(w=>{const y=new Set;let _=0,D=w.some(P=>P.truncated);const O=s(P=>y.has(P)?!0:y.size>=SCAN_FILE_CAP?(D=!0,!1):(y.add(P),_^=fnv1a(P),!0),"add");for(const P of w)if(!P.paths.every(O))break;return{signature:`${y.size}:${(_>>>0).toString(36)}`,paths:y,truncated:D}},"compose");return{async snapshot(w){if(!w||w.length===0)return B([await I(m,()=>C(t,!0))]);const y=[await ne()];for(const _ of w)y.push(await ae(_));return B(y)}}}v(sourceScanPass,"sourceScanPass"),s(sourceScanPass,"sourceScanPass");async function sourceSetSnapshot(t,a,c,d){return sourceScanPass(t,c,d).snapshot(a)}v(sourceSetSnapshot,"sourceSetSnapshot"),s(sourceSetSnapshot,"sourceSetSnapshot");async function sourceSetSignature(t,a,c,d){return(await sourceSetSnapshot(t,a,c,d)).signature}v(sourceSetSignature,"sourceSetSignature"),s(sourceSetSignature,"sourceSetSignature");const SOURCE_DIFF_PATH_CAP=128;function diffSourceSets(t,a,c,d){if(t.paths.size===a.paths.size){let E=!0;for(const C of t.paths)if(!a.paths.has(C)){E=!1;break}if(E)return null}const g=[],M=[];let m=t.truncated||a.truncated;for(const E of a.paths)t.paths.has(E)||(g.length+M.length<SOURCE_DIFF_PATH_CAP?g.push(E):m=!0);for(const E of t.paths)a.paths.has(E)||(g.length+M.length<SOURCE_DIFF_PATH_CAP?M.push(E):m=!0);return{changedAt:c,added:g,removed:M,truncated:m,...d!==void 0?{windowMs:d}:{}}}v(diffSourceSets,"diffSourceSets"),s(diffSourceSets,"diffSourceSets");function sourceChangeWindowMs(t,a,c,d){const g=a&&a>0?t-a:c;return Math.max(g,c)+d}v(sourceChangeWindowMs,"sourceChangeWindowMs"),s(sourceChangeWindowMs,"sourceChangeWindowMs");function sourceScopeDirs(t,a,c,d,g){const M=s(C=>{const I=path.relative(t,C).split(path.sep).filter(Boolean);return I.length===0||I[0].startsWith("..")?"":I[0]},"bucketOf")(a);if(!M)return[];const m=new Set(c.filter(Boolean)),E=new Set([M]);for(const C of d)C.startsWith(".")||SRC_EXCLUDE.has(C)||g?.has(C)||C.endsWith("-devserver")||m.has(C)||E.add(C);return[...E].sort().map(C=>path.join(t,C))}v(sourceScopeDirs,"sourceScopeDirs"),s(sourceScopeDirs,"sourceScopeDirs");function podRecycleReason(t,a,c,d){return!t.proc||t.state!=="up"||t.spawnAt==null||t.inflight>0||(t.activeWork??0)>0||a-t.lastUsed<d.settleMs||t.lastStaleRecycleAt!=null&&a-t.lastStaleRecycleAt<d.cooldownMs?null:c>0&&c-t.spawnAt>d.graceMs?"stale-source-set":d.maxAgeMs>0&&a-t.spawnAt>d.maxAgeMs?"max-age":null}v(podRecycleReason,"podRecycleReason"),s(podRecycleReason,"podRecycleReason");function lensFrontendStale(t,a,c,d,g){return!(d-a<g.cooldownMs||c<=0||c-t<=g.graceMs||d-c<g.settleMs)}v(lensFrontendStale,"lensFrontendStale"),s(lensFrontendStale,"lensFrontendStale");function lensWatcherVerdict(t,a,c,d=[]){if(!t)return"unknown";if("schemaVersion"in t&&t.schemaVersion>=2&&d.length>0){const g=a-c,M=new Set(t.recentEvents.filter(m=>m.at>=g).map(m=>path.resolve(m.path)));return d.every(m=>M.has(path.resolve(m)))?"heard":"missed"}return t.lastFsSetEventAt>=a-c?"heard":"missed"}v(lensWatcherVerdict,"lensWatcherVerdict"),s(lensWatcherVerdict,"lensWatcherVerdict");function podWatcherVerdict(t,a,c){if(!t)return"unknown";if(t.degraded)return"degraded";const d=a-c;return t.lastWatchRunAt>=d||t.lastBuildAt>=d?"heard":"silent"}v(podWatcherVerdict,"podWatcherVerdict"),s(podWatcherVerdict,"podWatcherVerdict");function lensChildWedged(t,a,c,d){const g=t.hasListened?d.graceMs:Math.max(d.graceMs,d.neverListenedGraceMs);return c-t.spawnedAt<g||c-a<d.cooldownMs||t.probeFails<Math.max(2,d.failureThreshold)?null:"wedged-no-listener"}v(lensChildWedged,"lensChildWedged"),s(lensChildWedged,"lensChildWedged");function isPortConflictExit(t,a){return t.signal||t.code===null||t.code===0||t.ranMs>a.fastFailMs?!1:t.portHeld}v(isPortConflictExit,"isPortConflictExit"),s(isPortConflictExit,"isPortConflictExit");function podChangeClock(t,a){const c=t.sourceSetChangedFor?.get(a);if(c!==void 0){const d=t.sourceSetChangesFor?.get(a);return{at:c,...d?{change:d}:{},scope:"project"}}return t.sourceSetScoped?.has(a)?{at:0,scope:"none"}:{at:t.sourceSetChangedAt??0,...t.sourceSetChange?{change:t.sourceSetChange}:{},scope:"workspace"}}v(podChangeClock,"podChangeClock"),s(podChangeClock,"podChangeClock");const changeEvidence=s(t=>{if(!t)return"no path evidence";const a=[...t.added.map(c=>`+${c}`),...t.removed.map(c=>`-${c}`)];return a.length?`${a.slice(0,3).join(", ")}${a.length>3?` (+${a.length-3} more)`:""}`:"no path evidence"},"changeEvidence");function createServiceLayer(t,a,c={}){const d=c.spawnProcess??node_child_process_1.spawn,g=c.probeAlive??pod_probe_1.probePodAlive,M=c.killTree??((e,r="SIGTERM")=>{try{process.kill(-e.pid,r)}catch{try{e.kill(r)}catch{}}}),m=c.sharedBuild??(0,shared_build_1.createSharedBuildRelay)(t),E=s((e,r="SIGTERM")=>{m.detach(e),M(e,r)},"killTree"),C=c.handoffDrainMs??(0,handoff_retire_1.handoffDrainBoundMs)(),I=c.treeAlive??(e=>{if(!e.pid)return!1;try{return process.kill(-e.pid,0),!0}catch(r){return r.code==="EPERM"}}),se=c.retirePollMs??1e3,J=c.rollReadyMs??types_1.POD_ROLL_READY_MS,ne=c.rollPollMs??750,ae=c.maxConcurrentRolls??types_1.POD_MAX_CONCURRENT_ROLLS,B=ae>0?ae:Number.POSITIVE_INFINITY,w=c.maxConcurrentColdStarts??types_1.MAX_COLD_STARTS,y=w>0?w:Number.POSITIVE_INFINITY;let _=0;const D=[],O=s(()=>_<y?(_+=1,Promise.resolve()):new Promise(e=>{D.push(()=>{_+=1,e()})}),"acquireColdSlot"),P=s(()=>{_-=1,D.shift()?.()},"releaseColdSlot"),{emit:V}=a,Q=s(e=>e.wsKey===t.wsKey?void 0:path.join(e.root,".lensmcp","events.jsonl"),"serviceBus"),S=s((e,r,n,o,i)=>V(r,n,o,{wsKey:e.wsKey,...i},void 0,Q(e)),"emitSvc"),N=s(e=>(e.scannedAt=0,(0,discovery_1.pickSock)(e,t.scanTtlMs)?e.socks.length:0),"scanNow"),X=s((e,r)=>{let n;try{n=(0,node_child_process_1.execFileSync)("ps",["ax","-ww","-o","pid=,pgid=,command="],{encoding:"utf8",timeout:5e3})}catch{return 0}const o=e.proc?.pid;let i=0;for(const l of n.split(`
 `)){const p=l.match(/^\s*(\d+)\s+(\d+)\s+(.*)$/);if(!p)continue;const u=Number(p[1]),$=Number(p[2]);if(isRunnerOf(p[3],r,e.root)&&!(u===process.pid||u===o)&&!(o!==void 0&&$===o)){try{process.kill(-$,"SIGKILL")}catch{try{process.kill(u,"SIGKILL")}catch{}}i+=1}}return i>0&&(console.log(`[gateway] ${r}: reaped ${i} stale runner tree(s) \u2014 a foreign generation of this service (holding nx's task lock, or its pool)`),S(e,"warning",`stale-runner reap: ${e.project} (${i} foreign tree(s))`,`cluster-service:${e.project}`,{kind:"stale-runner-reap",project:e.project,reaped:i})),i},"reapForeignRunners"),F=s((e,r)=>({...(0,pod_env_1.podBaseEnv)(process.env,t.root,e.root),...e.instanceEnv?{...e.instanceEnv,LENSMCP_SOCKET_ONLY:"1"}:{},...e.frozen?{LENSMCP_FREEZE:"1",LENSMCP_TYPECHECK:"off"}:{},NX_DAEMON:"false",NX_ISOLATE_PLUGINS:"false",...e.wsKey?{LENSMCP_WS_KEY:e.wsKey}:{},...e.sockNs?{LENSMCP_SOCK_NS:e.sockNs}:{},LENSMCP_EVENT_FILE:e.wsKey===t.wsKey?t.eventFile:path.join(e.root,".lensmcp","events.jsonl"),LENSMCP_GATEWAY_PID:String(process.pid),LENSMCP_POD_GENERATION:String(r),...eastWestEnv(t,e)}),"serviceEnv"),Z=s((e,r,n,o)=>{const i=F(e,r),l=e.wsKey||path.basename(e.root),p=(0,serve_launch_1.planServeLaunch)({stores:t.graphStores,root:e.root,project:e.project,target:e.decl.serveTarget??"serve-hmr",childCount:o,baseEnv:i});if(p.kind==="runner"){const h=m.offeredTo(e),j=d((0,process_name_1.namedExecPath)((0,process_name_1.processName)(l,e.project,serve_launch_1.SERVE_RUNNER_ROLE)),[...p.script.execArgv,p.script.path,...(0,serve_launch_1.serveRunnerArgs)(n,o,e.root)],{cwd:e.root,detached:!0,env:h?{...p.env,[protocol_1.SHARED_BUILD_ENV]:"1"}:p.env,stdio:["ignore","pipe","pipe","ipc"]});return h&&m.attach(e,r,j),j.send?.(p.message,R=>{R&&console.error(`[gateway] ${n}: could not hand the task to its runner (${R.message})`)}),{proc:j,launcher:"runner"}}console.log(`[gateway] ${n}: starting through nx run \u2014 ${p.reason}`);const u=path.join(e.root,"node_modules","nx","dist","bin","nx.js"),$=(0,process_name_1.namedExecPath)((0,process_name_1.processName)(l,e.project,"nx")),[A,k]=fs.existsSync(u)?[$,[u,"run",n,`--childCount=${o}`]]:["yarn",["nx","run",n,`--childCount=${o}`]];return{proc:d(A,k,{cwd:e.root,detached:!0,env:i,stdio:["ignore","pipe","pipe"]}),launcher:"nx"}},"startServiceTree"),ee=new WeakMap,H=s((e,r,n)=>{const o=`${e.project}:${e.decl.serveTarget??"serve-hmr"}`,i=Math.max(1,e.decl.minPods??1),{proc:l,launcher:p}=Z(e,r,o,i);ee.set(l,p),n==="active"&&(e.launcher=p),n==="active"&&(e.lastErrors=[],e.buildFailed=!1,e.faults=new pod_output_1.PodFaults);const u=s(k=>{const h=k.toString();for(const j of h.split(`
-`)){const R=(0,pod_output_1.classifyPodLine)(j),{clean:T,broken:K,healthy:ye}=R,f=T;if(K){e.lastErrors.push(T),e.lastErrors.length>12&&e.lastErrors.shift(),e.buildFailed=!0;const x=Date.now();(T!==e.lastErrorEmitSig||x-(e.lastErrorEmitAt??0)>=types_1.SERVICE_ERROR_THROTTLE_MS)&&(e.lastErrorEmitSig=T,e.lastErrorEmitAt=x,S(e,"error",`service error: ${e.project}`,`cluster-service:${e.project}`,{kind:"service-error",project:e.project,line:T,fault:R.fault}))}ye&&(e.buildFailed=!1);const L=(e.faults??=new pod_output_1.PodFaults).observe(R);if(L){e.lastErrorEmitSig=void 0;const x=L.open.length===0;S(e,"info",`${x?"service recovered":`${L.closed.join(" + ")} recovered`}: ${e.project}`,`cluster-service:${e.project}`,{kind:x?"service-recovered":"service-fault-closed",project:e.project,line:T,closed:L.closed,open:L.open})}!e.lockBlockedAt&&/Waiting for .+ in another nx process/.test(f)&&(e.lockBlockedAt=Date.now(),console.log(`[gateway] ${o}: spawn blocked by a stale nx runner \u2014 breaking the lock + respawning`),S(e,"warning",`nx task lock: ${e.project} blocked by a stale runner \u2014 auto-breaking`,`cluster-service:${e.project}`,{kind:"nx-lock-break",project:e.project}),setTimeout(()=>{t.stopped()||!e.lockBlockedAt||(q(e,"parked on a foreign nx task lock \u2014 recycling",{announce:!1}),X(e,o),setTimeout(()=>{!t.stopped()&&!e.proc&&e.state==="down"&&U(e)},1500).unref?.())},250).unref?.())}},"sniff"),$=e.wsKey&&e.wsKey!==t.wsKey&&e.root?(0,workspace_log_1.workspaceLogWriter)(e.root):void 0,A=s(k=>{const h=(0,own_log_1.linePrefixer)(e.project);return j=>{if(t.stopped())return;const R=(0,inspector_secret_1.redactInspectorUrls)(j.toString());u(R);const T=h(R);k.write(T),$?.(T)}},"relay");return l.stdout?.on("data",A(process.stdout)),l.stderr?.on("data",A(process.stderr)),l.on("exit",(k,h)=>{if(e.proc!==l||(e.proc=void 0,e.state="down",t.stopped()))return;const j=(0,exit_reason_1.describeExit)(k,h);if(console.log(`[gateway] ${o} exited (${k??"no code"}${h?`, ${h}`:""}${e.inflight?`, ${e.inflight} request(s) in flight`:""})${j?` \u2014 ${j}`:""}`),S(e,k===0?"info":"warning",`service down: ${e.project} (exit ${k})`,`cluster-service:${e.project}`,{kind:"service-down",project:e.project,code:k,...h?{signal:h}:{}}),k===0||e.buildFailed)return;const R=Date.now();if(e.restarts=(e.restarts??[]).filter(K=>R-K<types_1.SERVICE_RESTART_WINDOW_MS),e.restarts.length>=types_1.SERVICE_MAX_RESTARTS){S(e,"error",`service crash-looping: ${e.project} \u2014 ${types_1.SERVICE_MAX_RESTARTS}+ restarts/min, not auto-respawning (the next request retries)`,`cluster-service:${e.project}`,{kind:"service-crash-loop",project:e.project});return}e.restarts.push(R);const T=Math.min(8e3,500*2**(e.restarts.length-1));setTimeout(()=>{t.stopped()||e.proc||e.state!=="down"||(console.log(`[gateway] self-heal: respawning ${e.project} (restart ${e.restarts.length}/${types_1.SERVICE_MAX_RESTARTS})`),S(e,"info",`self-heal: respawning ${e.project}`,`cluster-service:${e.project}`,{kind:"service-respawn",project:e.project,attempt:e.restarts.length}),U(e))},T)}),l},"launchServiceProcess"),U=s(e=>{if(t.stopped())return;const r=`${e.project}:${e.decl.serveTarget??"serve-hmr"}`,n=Math.max(1,e.decl.minPods??1);c.reapForeign!==!1&&X(e,r),e.lockBlockedAt=void 0,console.log(`[gateway] starting ${r} (pods=${n})\u2026`),S(e,"info",`service starting: ${e.project} (${n} pod${n>1?"s":""})`,`cluster-service:${e.project}`,{kind:"service-starting",project:e.project,pods:n}),e.state="starting",e.spawnAt=Date.now(),e.generation=(e.generation??0)+1,e.proc=H(e,e.generation,"active")},"spawnService"),ke=s(async e=>{const r=e.pool.socks[0];if(!r)return;const n=await(0,pod_probe_1.probePodAlive)(r,void 0,t.serviceKeys[(0,service_keys_1.serviceKeyId)(e.wsKey,e.project)]);n&&(e.activeWork=n.activeWork,n.watcher&&(e.watcher=n.watcher))},"refreshActiveWork"),je=s(e=>{try{const r=Number(fs.readFileSync(`${e}.owner`,"utf8").trim());return Number.isInteger(r)&&r>1?r:void 0}catch{return}},"readOwnerSidecar"),Re=s(async e=>{const r=t.serviceKeys[(0,service_keys_1.serviceKeyId)(e.wsKey,e.project)];if(!r)return[];const n=(0,node_crypto_1.createHash)("sha256").update(r).digest("hex").slice(0,8),o=[];for(const i of e.pool.socks){const l=await(0,pod_probe_1.probePodAlive)(i,void 0,r);l&&(!l.keyFingerprint||l.keyFingerprint!==n)&&o.push({sock:i,pid:l.pid})}return o},"staleAdoptedSocks"),Ce=s((e,r)=>{const n=r.map(o=>o.sock);for(const{sock:o,pid:i}of r){const l=chooseStalePodKillTarget(i,je(o),process.pid);if(l!==void 0)try{process.kill(l,"SIGTERM")}catch{}try{fs.unlinkSync(o)}catch{}try{fs.unlinkSync(`${o}.owner`)}catch{}}e.pool.socks=e.pool.socks.filter(o=>!n.includes(o)),e.pool.idx=-1,e.pool.scannedAt=0},"evictStaleAdopted"),ce=s((e,r)=>{if(e.state==="up")return!1;e.state="up",e.wedgeRecycles=0;const n=e.pool.socks.length;return S(e,"info",`service up: ${e.project} (${n} pods, ${r})`,`cluster-service:${e.project}`,{kind:"service-up",project:e.project,pods:n,adopted:r==="adopted"}),!0},"markUp"),de=s(async e=>{if(N(e.pool)>0){const o=await Re(e);if(o.length>0&&(console.error(`[gateway] ${e.project}: ${o.length} adopted pod(s) hold a foreign east-west key \u2014 evicting instead of adopting.`),S(e,"warning",`stale adoption: ${e.project} (foreign east-west key)`,`cluster-service:${e.project}`,{kind:"pod-recycle",project:e.project,reason:"stale-adoption",pods:o.length}),e.proc&&q(e,"stale adoption (foreign east-west key)"),Ce(e,o)),e.pool.socks.length>0)return ce(e,"adopted"),!0}if(t.stopped())return!1;let r=!1;const n=s(()=>e.state!=="starting"&&!e.proc,"notStarted");if(n())if(e.coldWait)await e.coldWait;else{_>=y&&(console.log(`[gateway] cold start queued: ${e.project}${e.wsKey&&e.wsKey!==t.wsKey?` (${e.wsKey})`:""} \u2014 ${_} starting, ${D.length} ahead (LENSMCP_MAX_COLD_STARTS=${y}).`),S(e,"info",`cold start queued: ${e.project}`,`cluster-service:${e.project}`,{kind:"cold-start-queued",project:e.project,inFlight:_,ahead:D.length}));const o=O();if(e.coldWait=o,await o,e.coldWait=void 0,r=!0,t.stopped())return P(),!1;n()&&U(e)}try{return await Ae(e)}finally{r&&P()}},"ensureUp"),Ae=s(async e=>{const r=Date.now()+t.startupTimeoutMs,n=Date.now()+12e3;for(;!t.stopped()&&Date.now()<r;){if(await sleep(Math.min(700,t.startupTimeoutMs/4)),e.buildFailed&&Date.now()>n)return!1;if(N(e.pool)>0){e.state="up",e.buildFailed=!1;const o=e.spawnAt?Date.now()-e.spawnAt:void 0;return console.log(`[gateway] ${e.project} up (${e.pool.socks.length} pods${o?`, cold start ${o}ms`:""})`),S(e,"info",`cold start: ${e.project} (${e.pool.socks.length} pods, ${o??"?"}ms)`,`cluster-service:${e.project}`,{kind:"cold-start",project:e.project,pods:e.pool.socks.length,durationMs:o}),!0}if(e.state==="down")return!1}return!1},"waitForPods"),Te=s(e=>{const r=e.decl.maxPods??e.decl.minPods??1,n=e.pool.socks.length,o=scaleTarget(e);!o||n===0||n>=r||e.inflight<=n||Date.now()-e.lastScaleAt<5e3||(e.lastScaleAt=Date.now(),postScale(o,n+1,c.scaleLookup),console.log(`[gateway] autoscale ${e.project}: ${n} \u2192 ${n+1} pods (inflight ${e.inflight})`),S(e,"info",`autoscale: ${e.project} ${n} \u2192 ${n+1} pods`,`cluster-service:${e.project}`,{kind:"autoscale",project:e.project,from:n,to:n+1,inflight:e.inflight}))},"scaleUp"),q=s((e,r,n)=>{if(!e.proc)return;console.log(`[gateway] ${e.project} ${r} \u2014 scaling to zero.`),n?.announce!==!1&&S(e,"info",`idle kill: ${e.project} (${r})`,`cluster-service:${e.project}`,{kind:"idle-kill",project:e.project,why:r});const o=e.proc;try{o.stdout?.removeAllListeners("data"),o.stderr?.removeAllListeners("data"),o.removeAllListeners("exit")}catch{}(0,discovery_1.stopRoutingTo)(e.pool),E(o,"SIGTERM"),e.proc=void 0,e.state="down",setTimeout(()=>{ie(e),e.pool.socks=[],e.pool.scannedAt=0},1200).unref?.()},"killSpawned"),ie=s(e=>{try{for(const r of fs.readdirSync(e.pool.dir)){if(!r.endsWith(".sock"))continue;const n=path.join(e.pool.dir,r);try{const o=Number(fs.readFileSync(`${n}.owner`,"utf8").trim());if(Number.isFinite(o)&&o>0)try{process.kill(o,0);continue}catch{}}catch{}try{fs.unlinkSync(n)}catch{}try{fs.unlinkSync(`${n}.owner`)}catch{}}}catch{}},"sweepDeadOwnerSocks");let Y=0;const pe=[],Me=s(()=>Y<B?(Y+=1,Promise.resolve()):new Promise(e=>{pe.push(()=>{Y+=1,e()})}),"acquireRollSlot"),xe=s(()=>{Y-=1,pe.shift()?.()},"releaseRollSlot"),_e=s(async(e,r,n)=>{N(e.pool);for(const o of e.pool.socks){const i=await g(o,void 0,n);if(i&&r(i.podGeneration))return!0}return!1},"anyPodAnswers"),ue=new Map,Pe=s((e,r,n)=>{const o=C>0&&(0,handoff_retire_1.requestHandoffRetire)(e.pool.dir,n);if(E(r,"SIGTERM"),!o)return;const i=e.wsKey&&e.wsKey!==t.wsKey&&e.root?(0,workspace_log_1.workspaceLogWriter)(e.root):void 0,l=s(R=>T=>{if(t.stopped())return;const K=(0,inspector_secret_1.redactInspectorUrls)(T.toString()).replace(/^(?=.)/gm,`[${e.project} g${n} retiring] `);R.write(K),i?.(K)},"say"),p=l(process.stdout),u=l(process.stderr);r.stdout?.on("data",p),r.stderr?.on("data",u);let $=!1;const A=s(()=>{$||($=!0,clearTimeout(k),clearInterval(j),r.stdout?.removeListener("data",p),r.stderr?.removeListener("data",u),ue.delete(r),(0,handoff_retire_1.clearHandoffRetire)(e.pool.dir,n),ie(e),e.pool.scannedAt=0)},"end"),k=setTimeout(()=>{console.error(`[gateway] pod handoff: ${e.project} g${n} was still running ${C}ms after it was retired \u2014 killing it.`),M(r,"SIGKILL"),A()},C);k.unref?.();const h=s(()=>{if(!$){if(t.stopped()){A();return}I(r)||(console.log(`[gateway] pod handoff: ${e.project} g${n} finished its in-flight work and exited.`),A())}},"look"),j=setInterval(h,se);j.unref?.(),r.once("exit",h),ue.set(r,()=>{M(r,"SIGTERM"),A()})},"retireReplacedTree"),De=s(()=>{for(const e of[...ue.values()])e()},"stopRetiringTrees"),he=s((e,r)=>{if(e.rolling)return e.rolling;const n=e.proc;if(!n||t.stopped())return Promise.resolve(!1);if(e.launcher==="nx")return console.log(`[gateway] pod handoff skipped: ${e.project} runs through nx run, which starts one instance of a target at a time \u2014 no standby can overlap it (reason=${r}).`),Promise.resolve(!1);Y>=B&&console.log(`[gateway] pod handoff queued: ${e.project} reason=${r} \u2014 ${Y} roll(s) in flight, ${pe.length} ahead (LENSMCP_POD_MAX_CONCURRENT_ROLLS=${B}).`);const o=(async()=>{await Me();try{return await Le(e,n,r)}finally{xe()}})().finally(()=>{e.rolling=void 0});return e.rolling=o,o},"rollPod"),Le=s(async(e,r,n)=>{const o=e.proc;if(o!==r||t.stopped())return!1;const i=e.generation??0,l=i+1,p=Date.now();e.lastStaleRecycleAt=p,console.log(`[gateway] pod handoff start: ${e.project} g${i}\u2192g${l} reason=${n} \u2014 standby spawning, old generation keeps serving.`),S(e,"info",`pod handoff starting: ${e.project} (${n})`,`cluster-service:${e.project}`,{kind:"pod-handoff-start",project:e.project,reason:n,generation:l,fromGeneration:i});const u=H(e,l,"standby"),$=t.serviceKeys[(0,service_keys_1.serviceKeyId)(e.wsKey,e.project)],A=p+J;let k;for(;!t.stopped()&&Date.now()<A&&!(u.exitCode!==null||u.signalCode!==null);){N(e.pool);for(const h of e.pool.socks)if((await g(h,void 0,$))?.podGeneration===l){k=h;break}if(k)break;await sleep(ne)}if(!k||t.stopped()){const h=t.stopped()?"gateway stopping":u.exitCode!==null||u.signalCode!==null?`standby exited (${u.exitCode??u.signalCode})`:`standby not ready within ${Math.round(J/1e3)}s`;try{u.stdout?.removeAllListeners("data"),u.stderr?.removeAllListeners("data")}catch{}(0,discovery_1.stopRoutingTo)(e.pool,T=>(0,pod_sock_1.podSockGeneration)(T)===l),E(u,"SIGTERM");const j=!t.stopped()&&e.proc===o&&o.exitCode===null&&o.signalCode===null&&await _e(e,T=>T!==l,$),R=j?`old generation g${i} kept serving`:`and the old generation g${i} is NOT serving (${e.proc!==o||o.exitCode!==null||o.signalCode!==null?"its tree is gone":"none of its pods answers"}) \u2014 the service is down until it recovers`;return console.error(`[gateway] pod handoff failed: ${e.project} g${l}: ${h} \u2014 ${R}.`),e.rollFailure=`${h} \u2014 ${R}`,S(e,j?"warning":"error",`pod handoff failed: ${e.project}`,`cluster-service:${e.project}`,{kind:"pod-handoff-failed",project:e.project,reason:n,generation:l,error:h,durationMs:Date.now()-p,oldServing:j}),setTimeout(()=>ie(e),1200).unref?.(),!1}if(e.proc!==o)return(0,discovery_1.stopRoutingTo)(e.pool,h=>(0,pod_sock_1.podSockGeneration)(h)===l),E(u,"SIGTERM"),!1;e.proc=u,e.launcher=ee.get(u),e.generation=l,e.spawnAt=p,e.state="up",e.watcher=void 0,e.staleVerifiedAt=void 0,e.staleKeptAt=void 0,e.buildFailed=!1,e.lastErrors=[];try{o.stdout?.removeAllListeners("data"),o.stderr?.removeAllListeners("data"),o.removeAllListeners("exit")}catch{}return(0,discovery_1.stopRoutingTo)(e.pool,h=>(0,pod_sock_1.podSockGeneration)(h)!==l&&path.join(e.pool.dir,h)!==k),Pe(e,o,i),setTimeout(()=>{ie(e),e.pool.scannedAt=0},1200).unref?.(),console.log(`[gateway] pod handoff ready: ${e.project} g${l} answered on ${path.basename(k)} in ${Date.now()-p}ms; retiring g${i}.`),S(e,"info",`pod handoff complete: ${e.project}`,`cluster-service:${e.project}`,{kind:"pod-handoff-complete",project:e.project,reason:n,generation:l,fromGeneration:i,durationMs:Date.now()-p}),!0},"runRoll"),be=s((e,r)=>{if(t.stopped())return{refused:"the gateway is stopping"};if(e.restart&&!e.restart.done)return{restart:e.restart,already:!0};if(!e.proc&&e.state!=="down")return{refused:`${e.project} is served by pods this gateway adopted from an earlier one \u2014 it has no tree of its own to replace. \`lensmcp gateway restart\` starts every service under this gateway.`};const n=e.proc?r.hard||e.launcher==="nx"||e.state!=="up"?"hard":"rolling":"start",o={how:n,reason:r.reason,startedAt:Date.now(),...e.proc&&e.generation!==void 0?{fromGeneration:e.generation}:{}};return e.restart=o,console.log(`[gateway] restart asked: ${e.project}${e.wsKey!==t.wsKey?` (${e.wsKey})`:""} \u2014 ${n} (${r.reason}).`),S(e,"info",`restart asked: ${e.project} (${n})`,`cluster-service:${e.project}`,{kind:"service-restart",phase:"started",project:e.project,how:n,reason:r.reason,...o.fromGeneration!==void 0?{fromGeneration:o.fromGeneration}:{}}),s(async()=>{if(n==="start")return await de(e)?{ok:!0}:{ok:!1,error:ge(e)};if(n==="rolling")return e.rolling&&await e.rolling,e.proc?(e.rollFailure=void 0,await he(e,r.reason)?{ok:!0}:{ok:!1,error:e.rollFailure??"the new tree did not take over"}):await de(e)?{ok:!0}:{ok:!1,error:ge(e)};if(q(e,`restart asked (${r.reason})`,{announce:!1}),await sleep(1500),t.stopped())return{ok:!1,error:"the gateway is stopping"};let i=!1;e.proc||(await O(),i=!0,!e.proc&&e.state!=="starting"&&U(e));try{const l=e.proc,p=e.generation,u=t.serviceKeys[(0,service_keys_1.serviceKeyId)(e.wsKey,e.project)],$=Date.now()+t.startupTimeoutMs;for(;!t.stopped()&&Date.now()<$;){if(!l||e.proc!==l||l.exitCode!==null||l.signalCode!==null)return{ok:!1,error:ge(e)};if(await _e(e,A=>A===p,u))return ce(e,"observed"),e.buildFailed=!1,{ok:!0};await sleep(ne)}return{ok:!1,error:t.stopped()?"the gateway is stopping":`no pod of the new tree answered within ${Math.round(t.startupTimeoutMs/1e3)}s`}}finally{i&&P()}},"run")().catch(i=>({ok:!1,error:i.message})).then(i=>{o.done={ok:i.ok,at:Date.now(),...e.generation!==void 0?{generation:e.generation}:{},...i.error?{error:i.error}:{}};const l=Math.round((o.done.at-o.startedAt)/100)/10;i.ok?console.log(`[gateway] restarted: ${e.project} \u2014 g${o.done.generation??"?"} serving after ${l}s (${n}).`):console.error(`[gateway] restart failed: ${e.project} \u2014 ${i.error} (${n}, after ${l}s).`),S(e,i.ok?"info":"error",i.ok?`restarted: ${e.project}`:`restart failed: ${e.project}`,`cluster-service:${e.project}`,{kind:"service-restart",phase:i.ok?"done":"failed",project:e.project,how:n,reason:r.reason,...o.fromGeneration!==void 0?{fromGeneration:o.fromGeneration}:{},...o.done.generation!==void 0?{generation:o.done.generation}:{},durationMs:o.done.at-o.startedAt,...i.error?{error:i.error}:{}})}),{restart:o,already:!1}},"restartService"),ge=s(e=>e.buildFailed?`its build failed${e.lastErrors?.length?`: ${e.lastErrors[e.lastErrors.length-1]}`:""}`:e.proc&&(e.proc.exitCode!==null||e.proc.signalCode!==null)?`its tree exited (${e.proc.exitCode??e.proc.signalCode})`:!e.proc&&e.state==="down"?"its tree exited before a pod answered":`no pod answered within ${Math.round(t.startupTimeoutMs/1e3)}s`,"startFailure"),Ee=s(e=>{const r=Date.now();e.restarts=(e.restarts??[]).filter(o=>r-o<types_1.SERVICE_RESTART_WINDOW_MS);const n=(e.wedgeRecycles??0)+1;if(e.restarts.length>=types_1.SERVICE_MAX_RESTARTS||n>types_1.SERVICE_MAX_RESTARTS){const o=e.restarts.length>=types_1.SERVICE_MAX_RESTARTS?`wedged ${types_1.SERVICE_MAX_RESTARTS}+\xD7/min`:`recycled ${types_1.SERVICE_MAX_RESTARTS}\xD7 in a row and no pod came up`;S(e,"error",`service crash-looping: ${e.project} \u2014 ${o}, not auto-recycling (the next request retries)`,`cluster-service:${e.project}`,{kind:"service-crash-loop",project:e.project,recycles:n-1}),q(e,"wedged (crash-loop cap) \u2014 leaving down for the next request",{announce:!1});return}e.wedgeRecycles=n,e.restarts.push(r),console.log(`[gateway] self-heal: recycling WEDGED ${e.project} (live parent, 0 live pods; attempt ${n}/${types_1.SERVICE_MAX_RESTARTS} with no pod up since the first, ${e.restarts.length} in the last minute; ${e.inflight??0} request(s) in flight \u2014 jobs held by the dead pod keep their locks until they expire)`),S(e,"warning",`self-heal: recycling wedged ${e.project} (0 live pods)`,`cluster-service:${e.project}`,{kind:"service-recycle",project:e.project,attempt:n,inWindow:e.restarts.length}),q(e,"wedged: 0 live pods \u2014 recycling",{announce:!1}),setTimeout(()=>{!t.stopped()&&!e.proc&&e.state==="down"&&U(e)},1500).unref?.()},"recycleWedged"),Ie={maxAgeMs:types_1.POD_MAX_AGE_MS,graceMs:types_1.POD_STALE_GRACE_MS,settleMs:types_1.POD_RECYCLE_SETTLE_MS,cooldownMs:types_1.POD_STALE_RECYCLE_COOLDOWN_MS};let fe;const te=new Map,we=new Map;let Se=!1,ve=0,le=0;const Oe=s(()=>{const e=t.projectRoots??{},r=new Set(t.services.map(o=>o.project));for(const o of t.routes)o.lens&&r.add(o.lens.project);const n=new Set;for(const o of r){const i=e[o];if(!i)continue;const l=path.relative(t.root,i).split(path.sep).filter(Boolean)[0];l&&!l.startsWith("..")&&n.add(l)}return[...n]},"managedBuckets"),Ne=s((e,r,n,o)=>{const i=t.projectSourceRoots?.[e];if(i?.length)return i;const l=t.projectRoots?.[e];if(!l)return;const p=sourceScopeDirs(t.root,l,n,r,o);return p.length>0?p:void 0},"scopeFor"),Fe=s(()=>{if(Se||Date.now()-ve<types_1.POD_STALE_SCAN_MS)return;Se=!0,ve=Date.now();const e=ve;(async()=>{const r=(0,scope_1.readSourceSetOptions)(t.root),n=r.exclude,o={ignoreTests:r.ignoreTests},i=sourceScanPass(t.root,n,o),l=await i.snapshot(),p=Date.now(),u=sourceChangeWindowMs(p,le,types_1.POD_STALE_SCAN_MS,types_1.POD_RECYCLE_SETTLE_MS),$=fe?diffSourceSets(fe,l,p,u):null;if($&&(t.sourceSetChangedAt=p,t.sourceSetChange=$,V("info","source file set changed \u2014 stale pods recycle when idle","cluster-gateway",{kind:"source-set-changed",added:$.added,removed:$.removed,truncated:$.truncated})),fe=l,!t.projectRoots){le=e;return}let A;try{A=(await fs.promises.readdir(t.root,{withFileTypes:!0})).filter(f=>f.isDirectory()).map(f=>f.name)}catch{return}const k=Oe(),h=new Set(t.services.map(f=>f.project));for(const f of t.routes)f.lens&&h.add(f.lens.project);const j=new Map;for(const f of h){const L=Ne(f,A,k,n);if(!L)continue;const x=L.join("|"),W=j.get(x)??{dirs:L,projects:[]};W.projects.push(f),j.set(x,W)}const R=Date.now(),T=sourceChangeWindowMs(R,le,types_1.POD_STALE_SCAN_MS,types_1.POD_RECYCLE_SETTLE_MS);le=e;const K=s((f,L,x)=>{t.sourceSetChangedFor??=new Map,t.sourceSetChangesFor??=new Map;for(const W of f)t.sourceSetChangedFor.set(W,L),t.sourceSetChangesFor.set(W,x)},"stampScoped"),ye=new Set([...j.values()].flatMap(f=>f.projects));for(const f of[...t.sourceSetScoped??[]])ye.has(f)||t.sourceSetScoped.delete(f);for(const[f,{dirs:L,projects:x}]of j){const W=await i.snapshot(L),$e=te.get(f);if($e||x.some(b=>we.has(b))){t.sourceSetScoped??=new Set;for(const b of x)t.sourceSetScoped.add(b)}te.set(f,W);const me=new Map;for(const b of x){const G=we.get(b);if(G===void 0||G===f)continue;const z=me.get(G)??[];z.push(b),me.set(G,z)}for(const b of x)we.set(b,f);for(const[b,G]of me){const z=te.get(b),oe=z?diffSourceSets(z,W,R,T):$;oe&&(K(G,z?R:p,oe),V("info",`source file set changed \u2014 ${G.join(", ")}'s watch scope was re-keyed`,"cluster-gateway",{kind:"source-set-changed",scoped:!0,rescoped:!0,projects:G,added:oe.added,removed:oe.removed,truncated:oe.truncated}))}if(!$e)continue;const re=diffSourceSets($e,W,R,T);re&&(K(x,R,re),V("info",`source file set changed in ${x.join(", ")}'s scope`,"cluster-gateway",{kind:"source-set-changed",scoped:!0,projects:x,added:re.added,removed:re.removed,truncated:re.truncated}))}for(const f of[...te.keys()])j.has(f)||te.delete(f)})().catch(()=>{}).finally(()=>{Se=!1})},"maybeScanSourceSet"),Ke=s((e,r)=>{const n=podChangeClock(t,e.project),o=n.change,i=`${n.scope==="project"?"in its scope":"in the workspace (its scope is not known)"}: ${changeEvidence(o)}`,l=o?.windowMs??types_1.POD_STALE_SCAN_MS+types_1.POD_RECYCLE_SETTLE_MS,p=podWatcherVerdict(e.watcher,r,l),u=s(A=>(e.staleKeptAt!==r&&(e.staleKeptAt=r,console.log(`[gateway] stale source set: pod ${e.project} ${A} \u2014 no recycle.`)),!1),"keep");if(p==="heard")return e.staleVerifiedAt=r,S(e,"info",`stale check: ${e.project} watcher confirmed \u2014 no recycle`,`cluster-service:${e.project}`,{kind:"pod-stale-verified",project:e.project,watcher:p}),u(`watcher CONFIRMED alive across the change (last build ${new Date(e.watcher?.lastBuildAt??0).toISOString()})`);if(p==="degraded")return console.log(`[gateway] stale source set: pod ${e.project} watcher DEGRADED (${e.watcher?.degraded}) \u2014 recycling.`),!0;const $=s(A=>(e.staleKeptAt!==r&&(e.staleKeptAt=r,console.log(`[gateway] stale source set: pod ${e.project} ${A}; the change ${i} \u2014 recycling.`)),!0),"recycling");return p==="silent"?types_1.POD_WATCHER_SILENT==="keep"?u("watcher alive but quiet across the change \u2014 keeping it (LENSMCP_POD_WATCHER_SILENT=keep; a live watcher cannot miss an add it will need)"):$("watcher alive but quiet across the change"):types_1.POD_WATCHER_UNVERIFIED==="keep"?u("unverifiable (no watcher testimony \u2014 older devserver bundle?) \u2014 keeping it (LENSMCP_POD_WATCHER_UNVERIFIED=keep)"):$("watcher unverifiable (no testimony yet \u2014 a pod that never rebuilt, or an older devserver bundle)")},"podStaleRecycleAllowed"),We=s((e,r)=>{if(e.lastStaleRecycleAt=Date.now(),types_1.POD_RECYCLE_MODE==="rolling"&&e.proc&&e.launcher!=="nx"){he(e,r);return}console.log(`[gateway] zombie recycle: ${e.project} (${r}) \u2014 stale fs view; fresh pod incoming`),S(e,"warning",`zombie recycle: ${e.project} (${r})`,`cluster-service:${e.project}`,{kind:"pod-recycle",project:e.project,reason:r});const n=!!e.decl.eager;q(e,`${r} \u2014 recycling stale pod`,{announce:!1}),n&&setTimeout(()=>{!t.stopped()&&!e.proc&&e.state==="down"&&U(e)},1500).unref?.()},"recyclePod"),qe=s(()=>{const e=setInterval(()=>{Ge().catch(r=>console.error("[gateway] sweep error:",r))},t.sweepMs);return e.unref(),e},"startSweeper"),Ge=s(async()=>{{if(t.stopped())return;for(const e of t.graphStores?.all()??[])e.refreshIfStale();types_1.POD_RECYCLE_ENABLED&&Fe();for(const e of t.registry?t.registry.allServices():t.services){if(t.stopped()||!e.proc){e.wedgedSince=void 0;continue}const r=path.resolve(e.root)===path.resolve(t.root),n=e.decl.idleKillSec;if(n&&e.inflight===0&&Date.now()-e.lastUsed>n*1e3){q(e,`idle ${n}s`),e.wedgedSince=void 0;continue}const o=e.state==="starting"&&e.spawnAt!==void 0&&Date.now()-e.spawnAt<t.startupTimeoutMs,i=N(e.pool)>0;if(i||o){if(e.wedgedSince=void 0,i&&ce(e,"observed"),i&&!o&&types_1.POD_RECYCLE_ENABLED&&r){const l=podChangeClock(t,e.project).at;await ke(e);const p=(e.staleVerifiedAt??0)>=l&&l>0,u=podRecycleReason(e,Date.now(),p?0:l,Ie);if(u==="stale-source-set"&&!Ke(e,l))continue;u&&We(e,u)}continue}e.wedgedSince??=Date.now(),Date.now()-e.wedgedSince>types_1.WEDGE_RECYCLE_GRACE_MS&&(e.wedgedSince=void 0,Ee(e))}}},"sweepOnce");return{scanNow:N,spawnService:U,ensureUp:de,scaleUp:Te,killSpawned:q,markUp:ce,startSweeper:qe,rollPod:he,restartService:be,recycleWedged:Ee,stopRetiringTrees:De,stopBuildHost:s(e=>e===void 0?m.stop():m.release(e),"stopBuildHost")}}v(createServiceLayer,"createServiceLayer"),s(createServiceLayer,"createServiceLayer");function chooseStalePodKillTarget(t,a,c){if(!(t===void 0||!Number.isInteger(t)||t<=1)&&!(a!==void 0&&a!==t)&&t!==c)return t}v(chooseStalePodKillTarget,"chooseStalePodKillTarget"),s(chooseStalePodKillTarget,"chooseStalePodKillTarget");
+`)){const R=(0,pod_output_1.classifyPodLine)(j),{clean:T,broken:K,healthy:ye}=R,f=T;if(K){e.lastErrors.push(T),e.lastErrors.length>12&&e.lastErrors.shift(),e.buildFailed=!0;const x=Date.now();(T!==e.lastErrorEmitSig||x-(e.lastErrorEmitAt??0)>=types_1.SERVICE_ERROR_THROTTLE_MS)&&(e.lastErrorEmitSig=T,e.lastErrorEmitAt=x,S(e,"error",`service error: ${e.project}`,`cluster-service:${e.project}`,{kind:"service-error",project:e.project,line:T,fault:R.fault}))}ye&&(e.buildFailed=!1);const L=(e.faults??=new pod_output_1.PodFaults).observe(R);if(L){e.lastErrorEmitSig=void 0;const x=L.open.length===0;S(e,"info",`${x?"service recovered":`${L.closed.join(" + ")} recovered`}: ${e.project}`,`cluster-service:${e.project}`,{kind:x?"service-recovered":"service-fault-closed",project:e.project,line:T,closed:L.closed,open:L.open})}!e.lockBlockedAt&&/Waiting for .+ in another nx process/.test(f)&&(e.lockBlockedAt=Date.now(),console.log(`[gateway] ${o}: spawn blocked by a stale nx runner \u2014 breaking the lock + respawning`),S(e,"warning",`nx task lock: ${e.project} blocked by a stale runner \u2014 auto-breaking`,`cluster-service:${e.project}`,{kind:"nx-lock-break",project:e.project}),setTimeout(()=>{t.stopped()||!e.lockBlockedAt||(q(e,"parked on a foreign nx task lock \u2014 recycling",{announce:!1}),X(e,o),setTimeout(()=>{!t.stopped()&&!e.proc&&e.state==="down"&&U(e)},1500).unref?.())},250).unref?.())}},"sniff"),$=e.wsKey&&e.wsKey!==t.wsKey&&e.root?(0,workspace_log_1.workspaceLogWriter)(e.root):void 0,A=s(k=>{const h=(0,own_log_1.linePrefixer)(e.project);return j=>{if(t.stopped())return;const R=(0,inspector_secret_1.redactInspectorUrls)(j.toString());u(R);const T=h(R);k.write(T),$?.(T)}},"relay");return l.stdout?.on("data",A(process.stdout)),l.stderr?.on("data",A(process.stderr)),l.on("exit",(k,h)=>{if(e.proc!==l||(e.proc=void 0,e.state="down",t.stopped()))return;const j=(0,exit_reason_1.describeExit)(k,h);if(console.log(`[gateway] ${o} exited (${k??"no code"}${h?`, ${h}`:""}${e.inflight?`, ${e.inflight} request(s) in flight`:""})${j?` \u2014 ${j}`:""}`),S(e,k===0?"info":"warning",`service down: ${e.project} (exit ${k})`,`cluster-service:${e.project}`,{kind:"service-down",project:e.project,code:k,...h?{signal:h}:{}}),k===0||e.buildFailed)return;const R=Date.now();if(e.restarts=(e.restarts??[]).filter(K=>R-K<types_1.SERVICE_RESTART_WINDOW_MS),e.restarts.length>=types_1.SERVICE_MAX_RESTARTS){S(e,"error",`service crash-looping: ${e.project} \u2014 ${types_1.SERVICE_MAX_RESTARTS}+ restarts/min, not auto-respawning (the next request retries)`,`cluster-service:${e.project}`,{kind:"service-crash-loop",project:e.project});return}e.restarts.push(R);const T=Math.min(8e3,500*2**(e.restarts.length-1));setTimeout(()=>{t.stopped()||e.proc||e.state!=="down"||(console.log(`[gateway] self-heal: respawning ${e.project} (restart ${e.restarts.length}/${types_1.SERVICE_MAX_RESTARTS})`),S(e,"info",`self-heal: respawning ${e.project}`,`cluster-service:${e.project}`,{kind:"service-respawn",project:e.project,attempt:e.restarts.length}),U(e))},T)}),l},"launchServiceProcess"),U=s(e=>{if(t.stopped())return;const r=`${e.project}:${e.decl.serveTarget??"serve-hmr"}`,n=Math.max(1,e.decl.minPods??1);c.reapForeign!==!1&&X(e,r),e.lockBlockedAt=void 0,console.log(`[gateway] starting ${r} (pods=${n})\u2026`),S(e,"info",`service starting: ${e.project} (${n} pod${n>1?"s":""})`,`cluster-service:${e.project}`,{kind:"service-starting",project:e.project,pods:n}),e.state="starting",e.spawnAt=Date.now(),e.generation=(e.generation??0)+1,e.proc=H(e,e.generation,"active")},"spawnService"),ke=s(async e=>{const r=e.pool.socks[0];if(!r)return;const n=await(0,pod_probe_1.probePodAlive)(r,void 0,t.serviceKeys[(0,service_keys_1.serviceKeyId)(e.wsKey,e.project)]);n&&(e.activeWork=n.activeWork,n.watcher&&(e.watcher=n.watcher))},"refreshActiveWork"),je=s(e=>{try{const r=Number(fs.readFileSync(`${e}.owner`,"utf8").trim());return Number.isInteger(r)&&r>1?r:void 0}catch{return}},"readOwnerSidecar"),Re=s(async e=>{const r=t.serviceKeys[(0,service_keys_1.serviceKeyId)(e.wsKey,e.project)];if(!r)return[];const n=(0,node_crypto_1.createHash)("sha256").update(r).digest("hex").slice(0,8),o=[];for(const i of e.pool.socks){const l=await(0,pod_probe_1.probePodAlive)(i,void 0,r);l&&(!l.keyFingerprint||l.keyFingerprint!==n)&&o.push({sock:i,pid:l.pid})}return o},"staleAdoptedSocks"),Ce=s((e,r)=>{const n=r.map(o=>o.sock);for(const{sock:o,pid:i}of r){const l=chooseStalePodKillTarget(i,je(o),process.pid);if(l!==void 0)try{process.kill(l,"SIGTERM")}catch{}try{fs.unlinkSync(o)}catch{}try{fs.unlinkSync(`${o}.owner`)}catch{}}e.pool.socks=e.pool.socks.filter(o=>!n.includes(o)),e.pool.idx=-1,e.pool.scannedAt=0},"evictStaleAdopted"),ce=s((e,r)=>{if(e.state==="up")return!1;e.state="up",e.wedgeRecycles=0;const n=e.pool.socks.length;return S(e,"info",`service up: ${e.project} (${n} pods, ${r})`,`cluster-service:${e.project}`,{kind:"service-up",project:e.project,pods:n,adopted:r==="adopted"}),!0},"markUp"),de=s(async e=>{if(N(e.pool)>0){const o=await Re(e);if(o.length>0&&(console.error(`[gateway] ${e.project}: ${o.length} adopted pod(s) hold a foreign east-west key \u2014 evicting instead of adopting.`),S(e,"warning",`stale adoption: ${e.project} (foreign east-west key)`,`cluster-service:${e.project}`,{kind:"pod-recycle",project:e.project,reason:"stale-adoption",pods:o.length}),e.proc&&q(e,"stale adoption (foreign east-west key)"),Ce(e,o)),e.pool.socks.length>0)return ce(e,"adopted"),!0}if(t.stopped())return!1;let r=!1;const n=s(()=>e.state!=="starting"&&!e.proc,"notStarted");if(n())if(e.coldWait)await e.coldWait;else{_>=y&&(console.log(`[gateway] cold start queued: ${e.project}${e.wsKey&&e.wsKey!==t.wsKey?` (${e.wsKey})`:""} \u2014 ${_} starting, ${D.length} ahead (LENSMCP_MAX_COLD_STARTS=${y}).`),S(e,"info",`cold start queued: ${e.project}`,`cluster-service:${e.project}`,{kind:"cold-start-queued",project:e.project,inFlight:_,ahead:D.length}));const o=O();if(e.coldWait=o,await o,e.coldWait=void 0,r=!0,t.stopped())return P(),!1;n()&&U(e)}try{return await Ae(e)}finally{r&&P()}},"ensureUp"),Ae=s(async e=>{const r=Date.now()+t.startupTimeoutMs,n=Date.now()+12e3;for(;!t.stopped()&&Date.now()<r;){if(await sleep(Math.min(700,t.startupTimeoutMs/4)),e.buildFailed&&Date.now()>n)return!1;if(N(e.pool)>0){e.state="up",e.buildFailed=!1;const o=e.spawnAt?Date.now()-e.spawnAt:void 0;return console.log(`[gateway] ${e.project} up (${e.pool.socks.length} pods${o?`, cold start ${o}ms`:""})`),S(e,"info",`cold start: ${e.project} (${e.pool.socks.length} pods, ${o??"?"}ms)`,`cluster-service:${e.project}`,{kind:"cold-start",project:e.project,pods:e.pool.socks.length,durationMs:o}),!0}if(e.state==="down")return!1}return!1},"waitForPods"),Te=s(e=>{const r=e.decl.maxPods??e.decl.minPods??1,n=e.pool.socks.length,o=scaleTarget(e);!o||n===0||n>=r||e.inflight<=n||Date.now()-e.lastScaleAt<5e3||(e.lastScaleAt=Date.now(),postScale(o,n+1,c.scaleLookup),console.log(`[gateway] autoscale ${e.project}: ${n} \u2192 ${n+1} pods (inflight ${e.inflight})`),S(e,"info",`autoscale: ${e.project} ${n} \u2192 ${n+1} pods`,`cluster-service:${e.project}`,{kind:"autoscale",project:e.project,from:n,to:n+1,inflight:e.inflight}))},"scaleUp"),q=s((e,r,n)=>{if(!e.proc)return;console.log(`[gateway] ${e.project} ${r} \u2014 scaling to zero.`),n?.announce!==!1&&S(e,"info",`idle kill: ${e.project} (${r})`,`cluster-service:${e.project}`,{kind:"idle-kill",project:e.project,why:r});const o=e.proc;try{o.stdout?.removeAllListeners("data"),o.stderr?.removeAllListeners("data"),o.removeAllListeners("exit")}catch{}(0,discovery_1.stopRoutingTo)(e.pool),E(o,"SIGTERM"),e.proc=void 0,e.state="down",setTimeout(()=>{ie(e),e.pool.socks=[],e.pool.scannedAt=0},1200).unref?.()},"killSpawned"),ie=s(e=>{try{for(const r of fs.readdirSync(e.pool.dir)){if(!r.endsWith(".sock"))continue;const n=path.join(e.pool.dir,r);try{const o=Number(fs.readFileSync(`${n}.owner`,"utf8").trim());if(Number.isFinite(o)&&o>0)try{process.kill(o,0);continue}catch{}}catch{}try{fs.unlinkSync(n)}catch{}try{fs.unlinkSync(`${n}.owner`)}catch{}}}catch{}},"sweepDeadOwnerSocks");let Y=0;const pe=[],Me=s(()=>Y<B?(Y+=1,Promise.resolve()):new Promise(e=>{pe.push(()=>{Y+=1,e()})}),"acquireRollSlot"),xe=s(()=>{Y-=1,pe.shift()?.()},"releaseRollSlot"),_e=s(async(e,r,n)=>{N(e.pool);for(const o of e.pool.socks){const i=await g(o,void 0,n);if(i&&r(i.podGeneration))return!0}return!1},"anyPodAnswers"),ue=new Map,Pe=s((e,r,n)=>{const o=C>0&&(0,handoff_retire_1.requestHandoffRetire)(e.pool.dir,n);if(E(r,"SIGTERM"),!o)return;const i=e.wsKey&&e.wsKey!==t.wsKey&&e.root?(0,workspace_log_1.workspaceLogWriter)(e.root):void 0,l=s(R=>T=>{if(t.stopped())return;const K=(0,inspector_secret_1.redactInspectorUrls)(T.toString()).replace(/^(?=.)/gm,`[${e.project} g${n} retiring] `);R.write(K),i?.(K)},"say"),p=l(process.stdout),u=l(process.stderr);r.stdout?.on("data",p),r.stderr?.on("data",u);let $=!1;const A=s(()=>{$||($=!0,clearTimeout(k),clearInterval(j),r.stdout?.removeListener("data",p),r.stderr?.removeListener("data",u),ue.delete(r),(0,handoff_retire_1.clearHandoffRetire)(e.pool.dir,n),ie(e),e.pool.scannedAt=0)},"end"),k=setTimeout(()=>{console.error(`[gateway] pod handoff: ${e.project} g${n} was still running ${C}ms after it was retired \u2014 killing it.`),M(r,"SIGKILL"),A()},C);k.unref?.();const h=s(()=>{if(!$){if(t.stopped()){A();return}I(r)||(console.log(`[gateway] pod handoff: ${e.project} g${n} finished its in-flight work and exited.`),A())}},"look"),j=setInterval(h,se);j.unref?.(),r.once("exit",h),ue.set(r,()=>{M(r,"SIGTERM"),A()})},"retireReplacedTree"),De=s(()=>{for(const e of[...ue.values()])e()},"stopRetiringTrees"),he=s((e,r)=>{if(e.rolling)return e.rolling;const n=e.proc;if(!n||t.stopped())return Promise.resolve(!1);if(e.launcher==="nx")return console.log(`[gateway] pod handoff skipped: ${e.project} runs through nx run, which starts one instance of a target at a time \u2014 no standby can overlap it (reason=${r}).`),Promise.resolve(!1);Y>=B&&console.log(`[gateway] pod handoff queued: ${e.project} reason=${r} \u2014 ${Y} roll(s) in flight, ${pe.length} ahead (LENSMCP_POD_MAX_CONCURRENT_ROLLS=${B}).`);const o=(async()=>{await Me();try{return await Le(e,n,r)}finally{xe()}})().finally(()=>{e.rolling=void 0});return e.rolling=o,o},"rollPod"),Le=s(async(e,r,n)=>{const o=e.proc;if(o!==r||t.stopped())return!1;const i=e.generation??0,l=i+1,p=Date.now();e.lastStaleRecycleAt=p,console.log(`[gateway] pod handoff start: ${e.project} g${i}\u2192g${l} reason=${n} \u2014 standby spawning, old generation keeps serving.`),S(e,"info",`pod handoff starting: ${e.project} (${n})`,`cluster-service:${e.project}`,{kind:"pod-handoff-start",project:e.project,reason:n,generation:l,fromGeneration:i});const u=H(e,l,"standby"),$=t.serviceKeys[(0,service_keys_1.serviceKeyId)(e.wsKey,e.project)],A=p+J;let k;for(;!t.stopped()&&Date.now()<A&&!(u.exitCode!==null||u.signalCode!==null);){N(e.pool);for(const h of e.pool.socks)if((await g(h,void 0,$))?.podGeneration===l){k=h;break}if(k)break;await sleep(ne)}if(!k||t.stopped()){const h=t.stopped()?"gateway stopping":u.exitCode!==null||u.signalCode!==null?`standby exited (${u.exitCode??u.signalCode})`:`standby not ready within ${Math.round(J/1e3)}s`;try{u.stdout?.removeAllListeners("data"),u.stderr?.removeAllListeners("data")}catch{}(0,discovery_1.stopRoutingTo)(e.pool,T=>(0,pod_sock_1.podSockGeneration)(T)===l),E(u,"SIGTERM");const j=!t.stopped()&&e.proc===o&&o.exitCode===null&&o.signalCode===null&&await _e(e,T=>T!==l,$),R=j?`old generation g${i} kept serving`:`and the old generation g${i} is NOT serving (${e.proc!==o||o.exitCode!==null||o.signalCode!==null?"its tree is gone":"none of its pods answers"}) \u2014 the service is down until it recovers`;return console.error(`[gateway] pod handoff failed: ${e.project} g${l}: ${h} \u2014 ${R}.`),e.rollFailure=`${h} \u2014 ${R}`,S(e,j?"warning":"error",`pod handoff failed: ${e.project}`,`cluster-service:${e.project}`,{kind:"pod-handoff-failed",project:e.project,reason:n,generation:l,error:h,durationMs:Date.now()-p,oldServing:j}),setTimeout(()=>ie(e),1200).unref?.(),!1}if(e.proc!==o)return(0,discovery_1.stopRoutingTo)(e.pool,h=>(0,pod_sock_1.podSockGeneration)(h)===l),E(u,"SIGTERM"),!1;e.proc=u,e.launcher=ee.get(u),e.generation=l,e.spawnAt=p,e.state="up",e.watcher=void 0,e.staleVerifiedAt=void 0,e.staleKeptAt=void 0,e.buildFailed=!1,e.lastErrors=[];try{o.stdout?.removeAllListeners("data"),o.stderr?.removeAllListeners("data"),o.removeAllListeners("exit")}catch{}return(0,discovery_1.stopRoutingTo)(e.pool,h=>(0,pod_sock_1.podSockGeneration)(h)!==l&&path.join(e.pool.dir,h)!==k),Pe(e,o,i),setTimeout(()=>{ie(e),e.pool.scannedAt=0},1200).unref?.(),console.log(`[gateway] pod handoff ready: ${e.project} g${l} answered on ${path.basename(k)} in ${Date.now()-p}ms; retiring g${i}.`),S(e,"info",`pod handoff complete: ${e.project}`,`cluster-service:${e.project}`,{kind:"pod-handoff-complete",project:e.project,reason:n,generation:l,fromGeneration:i,durationMs:Date.now()-p}),!0},"runRoll"),be=s((e,r)=>{if(t.stopped())return{refused:"the gateway is stopping"};if(e.restart&&!e.restart.done)return{restart:e.restart,already:!0};if(!e.proc&&e.state!=="down")return{refused:`${e.project} is served by pods this gateway adopted from an earlier one \u2014 it has no tree of its own to replace. \`lensmcp gateway restart\` starts every service under this gateway.`};const n=e.proc?r.hard||e.launcher==="nx"||e.state!=="up"?"hard":"rolling":"start",o={how:n,reason:r.reason,startedAt:Date.now(),...e.proc&&e.generation!==void 0?{fromGeneration:e.generation}:{}};return e.restart=o,console.log(`[gateway] restart asked: ${e.project}${e.wsKey!==t.wsKey?` (${e.wsKey})`:""} \u2014 ${n} (${r.reason}).`),S(e,"info",`restart asked: ${e.project} (${n})`,`cluster-service:${e.project}`,{kind:"service-restart",phase:"started",project:e.project,how:n,reason:r.reason,...o.fromGeneration!==void 0?{fromGeneration:o.fromGeneration}:{}}),s(async()=>{if(n==="start")return await de(e)?{ok:!0}:{ok:!1,error:ge(e)};if(n==="rolling")return e.rolling&&await e.rolling,e.proc?(e.rollFailure=void 0,await he(e,r.reason)?{ok:!0}:{ok:!1,error:e.rollFailure??"the new tree did not take over"}):await de(e)?{ok:!0}:{ok:!1,error:ge(e)};if(q(e,`restart asked (${r.reason})`,{announce:!1}),await sleep(1500),t.stopped())return{ok:!1,error:"the gateway is stopping"};let i=!1;e.proc||(await O(),i=!0,!e.proc&&e.state!=="starting"&&U(e));try{const l=e.proc,p=e.generation,u=t.serviceKeys[(0,service_keys_1.serviceKeyId)(e.wsKey,e.project)],$=Date.now()+t.startupTimeoutMs;for(;!t.stopped()&&Date.now()<$;){if(!l||e.proc!==l||l.exitCode!==null||l.signalCode!==null)return{ok:!1,error:ge(e)};if(await _e(e,A=>A===p,u))return ce(e,"observed"),e.buildFailed=!1,{ok:!0};await sleep(ne)}return{ok:!1,error:t.stopped()?"the gateway is stopping":`no pod of the new tree answered within ${Math.round(t.startupTimeoutMs/1e3)}s`}}finally{i&&P()}},"run")().catch(i=>({ok:!1,error:i.message})).then(i=>{o.done={ok:i.ok,at:Date.now(),...e.generation!==void 0?{generation:e.generation}:{},...i.error?{error:i.error}:{}};const l=Math.round((o.done.at-o.startedAt)/100)/10;i.ok?console.log(`[gateway] restarted: ${e.project} \u2014 g${o.done.generation??"?"} serving after ${l}s (${n}).`):console.error(`[gateway] restart failed: ${e.project} \u2014 ${i.error} (${n}, after ${l}s).`),S(e,i.ok?"info":"error",i.ok?`restarted: ${e.project}`:`restart failed: ${e.project}`,`cluster-service:${e.project}`,{kind:"service-restart",phase:i.ok?"done":"failed",project:e.project,how:n,reason:r.reason,...o.fromGeneration!==void 0?{fromGeneration:o.fromGeneration}:{},...o.done.generation!==void 0?{generation:o.done.generation}:{},durationMs:o.done.at-o.startedAt,...i.error?{error:i.error}:{}})}),{restart:o,already:!1}},"restartService"),ge=s(e=>e.buildFailed?`its build failed${e.lastErrors?.length?`: ${e.lastErrors[e.lastErrors.length-1]}`:""}`:e.proc&&(e.proc.exitCode!==null||e.proc.signalCode!==null)?`its tree exited (${e.proc.exitCode??e.proc.signalCode})`:!e.proc&&e.state==="down"?"its tree exited before a pod answered":`no pod answered within ${Math.round(t.startupTimeoutMs/1e3)}s`,"startFailure"),Ee=s(e=>{const r=Date.now();e.restarts=(e.restarts??[]).filter(o=>r-o<types_1.SERVICE_RESTART_WINDOW_MS);const n=(e.wedgeRecycles??0)+1;if(e.restarts.length>=types_1.SERVICE_MAX_RESTARTS||n>types_1.SERVICE_MAX_RESTARTS){const o=e.restarts.length>=types_1.SERVICE_MAX_RESTARTS?`wedged ${types_1.SERVICE_MAX_RESTARTS}+\xD7/min`:`recycled ${types_1.SERVICE_MAX_RESTARTS}\xD7 in a row and no pod came up`;S(e,"error",`service crash-looping: ${e.project} \u2014 ${o}, not auto-recycling (the next request retries)`,`cluster-service:${e.project}`,{kind:"service-crash-loop",project:e.project,recycles:n-1}),q(e,"wedged (crash-loop cap) \u2014 leaving down for the next request",{announce:!1});return}e.wedgeRecycles=n,e.restarts.push(r),console.log(`[gateway] self-heal: recycling WEDGED ${e.project} (live parent, 0 live pods; attempt ${n}/${types_1.SERVICE_MAX_RESTARTS} with no pod up since the first, ${e.restarts.length} in the last minute; ${e.inflight??0} request(s) in flight \u2014 jobs held by the dead pod keep their locks until they expire)`),S(e,"warning",`self-heal: recycling wedged ${e.project} (0 live pods)`,`cluster-service:${e.project}`,{kind:"service-recycle",project:e.project,attempt:n,inWindow:e.restarts.length}),q(e,"wedged: 0 live pods \u2014 recycling",{announce:!1}),setTimeout(()=>{!t.stopped()&&!e.proc&&e.state==="down"&&U(e)},1500).unref?.()},"recycleWedged"),Ie={maxAgeMs:types_1.POD_MAX_AGE_MS,graceMs:types_1.POD_STALE_GRACE_MS,settleMs:types_1.POD_RECYCLE_SETTLE_MS,cooldownMs:types_1.POD_STALE_RECYCLE_COOLDOWN_MS};let fe;const te=new Map,we=new Map;let Se=!1,ve=0,le=0;const Oe=s(()=>{const e=t.projectRoots??{},r=new Set(t.services.map(o=>o.project));for(const o of t.routes)o.lens&&r.add(o.lens.project);const n=new Set;for(const o of r){const i=e[o];if(!i)continue;const l=path.relative(t.root,i).split(path.sep).filter(Boolean)[0];l&&!l.startsWith("..")&&n.add(l)}return[...n]},"managedBuckets"),Ne=s((e,r,n,o)=>{const i=t.projectSourceRoots?.[e];if(i?.length)return i;const l=t.projectRoots?.[e];if(!l)return;const p=sourceScopeDirs(t.root,l,n,r,o);return p.length>0?p:void 0},"scopeFor"),Fe=s(()=>{if(Se||Date.now()-ve<types_1.POD_STALE_SCAN_MS)return;Se=!0,ve=Date.now();const e=ve;(async()=>{const r=(0,scope_1.readSourceSetOptions)(t.root),n=r.exclude,o={ignoreTests:r.ignoreTests},i=sourceScanPass(t.root,n,o),l=await i.snapshot(),p=Date.now(),u=sourceChangeWindowMs(p,le,types_1.POD_STALE_SCAN_MS,types_1.POD_RECYCLE_SETTLE_MS),$=fe?diffSourceSets(fe,l,p,u):null;if($&&(t.sourceSetChangedAt=p,t.sourceSetChange=$,V("info","source file set changed \u2014 stale pods recycle when idle","cluster-gateway",{kind:"source-set-changed",added:$.added,removed:$.removed,truncated:$.truncated})),fe=l,!t.projectRoots){le=e;return}let A;try{A=(await fs.promises.readdir(t.root,{withFileTypes:!0})).filter(f=>f.isDirectory()).map(f=>f.name)}catch{return}const k=Oe(),h=new Set(t.services.map(f=>f.project));for(const f of t.routes)f.lens&&h.add(f.lens.project);const j=new Map;for(const f of h){const L=Ne(f,A,k,n);if(!L)continue;const x=L.join("|"),W=j.get(x)??{dirs:L,projects:[]};W.projects.push(f),j.set(x,W)}const R=Date.now(),T=sourceChangeWindowMs(R,le,types_1.POD_STALE_SCAN_MS,types_1.POD_RECYCLE_SETTLE_MS);le=e;const K=s((f,L,x)=>{t.sourceSetChangedFor??=new Map,t.sourceSetChangesFor??=new Map;for(const W of f)t.sourceSetChangedFor.set(W,L),t.sourceSetChangesFor.set(W,x)},"stampScoped"),ye=new Set([...j.values()].flatMap(f=>f.projects));for(const f of[...t.sourceSetScoped??[]])ye.has(f)||t.sourceSetScoped.delete(f);for(const[f,{dirs:L,projects:x}]of j){const W=await i.snapshot(L),$e=te.get(f);if($e||x.some(b=>we.has(b))){t.sourceSetScoped??=new Set;for(const b of x)t.sourceSetScoped.add(b)}te.set(f,W);const me=new Map;for(const b of x){const G=we.get(b);if(G===void 0||G===f)continue;const z=me.get(G)??[];z.push(b),me.set(G,z)}for(const b of x)we.set(b,f);for(const[b,G]of me){const z=te.get(b),oe=z?diffSourceSets(z,W,R,T):$;oe&&(K(G,z?R:p,oe),V("info",`source file set changed \u2014 ${G.join(", ")}'s watch scope was re-keyed`,"cluster-gateway",{kind:"source-set-changed",scoped:!0,rescoped:!0,projects:G,added:oe.added,removed:oe.removed,truncated:oe.truncated}))}if(!$e)continue;const re=diffSourceSets($e,W,R,T);re&&(K(x,R,re),V("info",`source file set changed in ${x.join(", ")}'s scope`,"cluster-gateway",{kind:"source-set-changed",scoped:!0,projects:x,added:re.added,removed:re.removed,truncated:re.truncated}))}for(const f of[...te.keys()])j.has(f)||te.delete(f)})().catch(()=>{}).finally(()=>{Se=!1})},"maybeScanSourceSet"),Ke=s((e,r)=>{const n=podChangeClock(t,e.project),o=n.change,i=`${n.scope==="project"?"in its scope":"in the workspace (its scope is not known)"}: ${changeEvidence(o)}`,l=o?.windowMs??types_1.POD_STALE_SCAN_MS+types_1.POD_RECYCLE_SETTLE_MS,p=podWatcherVerdict(e.watcher,r,l),u=s(A=>(e.staleKeptAt!==r&&(e.staleKeptAt=r,console.log(`[gateway] stale source set: pod ${e.project} ${A} \u2014 no recycle.`)),!1),"keep");if(p==="heard")return e.staleVerifiedAt=r,S(e,"info",`stale check: ${e.project} watcher confirmed \u2014 no recycle`,`cluster-service:${e.project}`,{kind:"pod-stale-verified",project:e.project,watcher:p}),u(`watcher CONFIRMED alive across the change (last build ${new Date(e.watcher?.lastBuildAt??0).toISOString()})`);if(p==="degraded")return console.log(`[gateway] stale source set: pod ${e.project} watcher DEGRADED (${e.watcher?.degraded}) \u2014 recycling.`),!0;const $=s(A=>(e.staleKeptAt!==r&&(e.staleKeptAt=r,console.log(`[gateway] stale source set: pod ${e.project} ${A}; the change ${i} \u2014 recycling.`)),!0),"recycling");return p==="silent"?types_1.POD_WATCHER_SILENT==="keep"?u("watcher alive but quiet across the change \u2014 keeping it (LENSMCP_POD_WATCHER_SILENT=keep; a live watcher cannot miss an add it will need)"):$("watcher alive but quiet across the change"):types_1.POD_WATCHER_UNVERIFIED==="keep"?u("unverifiable (no watcher testimony \u2014 older devserver bundle?) \u2014 keeping it (LENSMCP_POD_WATCHER_UNVERIFIED=keep)"):$("watcher unverifiable (no testimony yet \u2014 a pod that never rebuilt, or an older devserver bundle)")},"podStaleRecycleAllowed"),We=s((e,r)=>{if(e.lastStaleRecycleAt=Date.now(),types_1.POD_RECYCLE_MODE==="rolling"&&e.proc&&e.launcher!=="nx"){he(e,r);return}console.log(`[gateway] zombie recycle: ${e.project} (${r}) \u2014 stale fs view; fresh pod incoming`),S(e,"warning",`zombie recycle: ${e.project} (${r})`,`cluster-service:${e.project}`,{kind:"pod-recycle",project:e.project,reason:r});const n=!!e.decl.eager;q(e,`${r} \u2014 recycling stale pod`,{announce:!1}),n&&setTimeout(()=>{!t.stopped()&&!e.proc&&e.state==="down"&&U(e)},1500).unref?.()},"recyclePod"),qe=s(()=>{const e=setInterval(()=>{Ge().catch(r=>console.error("[gateway] sweep error:",r))},t.sweepMs);return e.unref(),e},"startSweeper"),Ge=s(async()=>{{if(t.stopped())return;for(const e of t.graphStores?.all()??[])e.refreshIfStale();types_1.POD_RECYCLE_ENABLED&&Fe();for(const e of t.registry?t.registry.allServices():t.services){if(t.stopped()||!e.proc){e.wedgedSince=void 0;continue}const r=path.resolve(e.root)===path.resolve(t.root),n=(0,warm_start_1.instanceIdleSec)(e,!r&&!!t.registry?.get(e.wsKey)?.instance);if(n&&e.inflight===0&&Date.now()-e.lastUsed>n*1e3){q(e,`idle ${n}s`),e.wedgedSince=void 0;continue}const o=e.state==="starting"&&e.spawnAt!==void 0&&Date.now()-e.spawnAt<t.startupTimeoutMs,i=N(e.pool)>0;if(i||o){if(e.wedgedSince=void 0,i&&ce(e,"observed"),i&&!o&&types_1.POD_RECYCLE_ENABLED&&r){const l=podChangeClock(t,e.project).at;await ke(e);const p=(e.staleVerifiedAt??0)>=l&&l>0,u=podRecycleReason(e,Date.now(),p?0:l,Ie);if(u==="stale-source-set"&&!Ke(e,l))continue;u&&We(e,u)}continue}e.wedgedSince??=Date.now(),Date.now()-e.wedgedSince>types_1.WEDGE_RECYCLE_GRACE_MS&&(e.wedgedSince=void 0,Ee(e))}}},"sweepOnce");return{scanNow:N,spawnService:U,ensureUp:de,scaleUp:Te,killSpawned:q,markUp:ce,startSweeper:qe,rollPod:he,restartService:be,recycleWedged:Ee,stopRetiringTrees:De,stopBuildHost:s(e=>e===void 0?m.stop():m.release(e),"stopBuildHost")}}v(createServiceLayer,"createServiceLayer"),s(createServiceLayer,"createServiceLayer");function chooseStalePodKillTarget(t,a,c){if(!(t===void 0||!Number.isInteger(t)||t<=1)&&!(a!==void 0&&a!==t)&&t!==c)return t}v(chooseStalePodKillTarget,"chooseStalePodKillTarget"),s(chooseStalePodKillTarget,"chooseStalePodKillTarget");

package/executors/gateway/runtime/server.d.ts

@@ -1,5 +1,6 @@
 import { type EdgeVerifierPool } from './auth';
-import type { GatewayContext, GatewayHandle, GatewayRuntimeOptions, Route } from './types';
+import { type JwksVerifier, type JwksWarmOptions } from '../jwks-verify';
+import type { GatewayContext, GatewayHandle, GatewayHooks, GatewayRuntimeOptions, HookHandler, Route } from './types';
 /**
  * The dev edge's JWT verifiers — matching the prod gateway's RS256/JWKS posture so the LOCAL edge rejects
  * forged tokens instead of decode-accepting them, and MULTI-ISSUER for the shared daemon: every
@@ -11,7 +12,43 @@ import type { GatewayContext, GatewayHandle, GatewayRuntimeOptions, Route } from
  * JWKS. `for()` returns undefined when the host matches no IdP apex (→ non-HS256 tokens fail closed
  * unless the insecure opt-in is set).
  */
-export declare function buildEdgeVerifierPool(getRoutes: () => Route[]): EdgeVerifierPool;
+export declare function buildEdgeVerifierPool(getRoutes: () => Route[], poolOpts?: EdgeVerifierPoolOptions): DevEdgeVerifierPool;
+/**
+ * The dev pool's own surface beyond {@link EdgeVerifierPool}: `for()` hands out the JWKS verifiers themselves (their
+ * `awaitKey` is what {@link edgeKeyWait} waits on), and `warm()` starts loading every configured key set ahead of the
+ * first request.
+ */
+export interface DevEdgeVerifierPool extends EdgeVerifierPool {
+    for(host: string): JwksVerifier | undefined;
+    /** Create — and so start loading — the verifier of every IdP the live table names. Never blocks, never throws. */
+    warm(): void;
+}
+export interface EdgeVerifierPoolOptions {
+    /** The JWKS fetch (specs). Defaults to {@link insecureLocalFetch}. */
+    fetchImpl?: typeof fetch;
+    /** The background load's retry schedule (specs shorten it). */
+    warm?: Omit<JwksWarmOptions, 'onError'>;
+}
+/**
+ * The miss wait (issues/closed/foodguard-85). Edge auth is synchronous end to end — `auth.public` → `verifyDevJwt` →
+ * `verify()` — so on a `kid` the cache does not hold yet, `verify()` can only start the shared refresh and refuse.
+ * Right after a restart that refused the first page load's JWT requests, while the same token passed 40 ms later.
+ * This built-in `beforeAuth` hook is the async seam ahead of it: for a jwt-mode public route carrying a bearer, it
+ * waits until the token's key is cached — bounded, on the ONE refresh every missing request shares, and not at all
+ * inside the miss cooldown. A no-op for everything else: no bearer (which also means the gateway's own JWKS fetch,
+ * routed through this front door, never waits on itself), internal routes, non-jwt paths, hosts with no IdP. The WS
+ * upgrade runs no `beforeAuth`, so a header JWT on an upgrade still refuses on a miss and verifies on a retry.
+ */
+export declare function edgeKeyWait(verifiers: DevEdgeVerifierPool): HookHandler;
+/**
+ * The pipeline's hook lists: the user's, with the built-ins in their places. The miss wait runs LAST in `beforeAuth`,
+ * after the user's handlers, so it waits for the Authorization header auth will actually read; the workspace
+ * middleware runs FIRST in `afterAuth`, so "custom middleware runs AFTER core auth" holds.
+ */
+export declare function withBuiltinHooks(user: GatewayHooks, builtin: {
+    keyWait: HookHandler;
+    middleware: HookHandler;
+}): GatewayHooks;
 /** Client-abort errnos that are NORMAL front-door traffic (a closed tab, a sleeping laptop, a canceled
  *  HMR socket) — dropped quietly. Anything else on an inbound socket is logged before the drop. */
 export declare const BENIGN_SOCKET_ERRNOS: ReadonlySet<string>;

package/executors/gateway/runtime/server.js

@@ -1,3 +1,3 @@
-"use strict";var ge=Object.defineProperty;var A=(s,r)=>ge(s,"name",{value:r,configurable:!0});var he=Object.defineProperty,n=A((s,r)=>he(s,"name",{value:r,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.GATEWAY_H2_IDLE_SESSION_MS_DEFAULT=exports.GATEWAY_MAX_H2_STREAMS_DEFAULT=exports.GATEWAY_MAX_H2_SESSIONS_DEFAULT=exports.GATEWAY_MAX_CONNECTIONS_DEFAULT=exports.BENIGN_SOCKET_ERRNOS=void 0,exports.buildEdgeVerifierPool=buildEdgeVerifierPool,exports.classifyClientError=classifyClientError,exports.createClientErrorLogGate=createClientErrorLogGate,exports.retirePreviousWorkspace=retirePreviousWorkspace,exports.resolveMaxConnections=resolveMaxConnections,exports.h2BudgetFromEnv=h2BudgetFromEnv,exports.createH2Governor=createH2Governor,exports.startGateway=startGateway;const tslib_1=require("tslib"),http=tslib_1.__importStar(require("node:http")),path=tslib_1.__importStar(require("node:path")),discovery_1=require("./discovery"),scope_1=require("./scope"),route_registry_1=require("./route-registry"),act_1=require("./act"),control_1=require("./control"),workspace_middleware_1=require("./workspace-middleware"),workspace_registry_1=require("./workspace-registry"),service_keys_1=require("./service-keys"),source_poller_1=require("./source-poller"),client_ip_1=require("../client-ip"),workspace_log_1=require("./workspace-log"),own_log_1=require("./own-log"),observability_1=require("./observability"),lifecycle_1=require("./lifecycle"),process_names_1=require("./process-names"),project_graph_store_1=require("./project-graph-store"),serve_launch_1=require("./serve-launch"),process_name_1=require("../../../process-name"),protocol_1=require("../../../shared-build/protocol"),lens_children_1=require("./lens-children"),proxy_1=require("./proxy"),auth_1=require("./auth"),hooks_1=require("./hooks"),handler_1=require("./handler"),upgrade_1=require("./upgrade"),jwks_verify_1=require("../jwks-verify"),types_1=require("./types");function insecureLocalFetch(s,r){return new Promise((u,m)=>{const a=(s.startsWith("https:")?require("node:https"):require("node:http")).request(s,{method:"GET",headers:r?.headers,rejectUnauthorized:!1},w=>{const _=[];w.on("data",g=>_.push(g)),w.on("end",()=>{const g=w.statusCode??0,l=Buffer.concat(_).toString("utf8");u({ok:g>=200&&g<300,status:g,json:n(async()=>JSON.parse(l),"json")})})});a.on("error",m),a.end()})}A(insecureLocalFetch,"insecureLocalFetch"),n(insecureLocalFetch,"insecureLocalFetch");function buildEdgeVerifierPool(s){const r=process.env.LENSMCP_GW_JWKS_URL,u=process.env.LENSMCP_GW_JWT_ISS,m=new Map;let a;const w=n((_,g)=>{console.log(`[gateway] edge JWT: verifying via JWKS ${_}${g}`);const l=(0,jwks_verify_1.createJwksVerifier)({jwksUrl:_,...u?{issuer:u}:{},fetchImpl:insecureLocalFetch});return l.refresh().catch(o=>console.warn("[gateway] edge JWKS warm failed (will retry):",o.message)),l},"make");return{for(_){if(r)return a??=w(r,"");const g=_.split(":")[0].toLowerCase();let l;for(const d of s()){const S=d.host;if(typeof S!="string"||!/^auth\./.test(S)||S.startsWith("internal."))continue;const T=S.slice(5);(g===T||g.endsWith(`.${T}`))&&(!l||T.length>l.length)&&(l=T)}if(!l)return;let o=m.get(l);return o||(o=w(`https://auth.${l}/jwks.json`,` (auto-derived for apex ${l})`),m.set(l,o)),o},stop(){a?.stop();for(const _ of m.values())_.stop()}}}A(buildEdgeVerifierPool,"buildEdgeVerifierPool"),n(buildEdgeVerifierPool,"buildEdgeVerifierPool"),exports.BENIGN_SOCKET_ERRNOS=new Set(["ECONNRESET","EPIPE","ETIMEDOUT","ECONNABORTED","ECANCELED"]);function classifyClientError(s,r){return s&&exports.BENIGN_SOCKET_ERRNOS.has(s)?{status:null,report:!1,cause:"client-abort"}:s==="HPE_INVALID_EOF_STATE"?{status:null,report:!1,cause:"truncated-at-eof"}:s==="ERR_HTTP_REQUEST_TIMEOUT"?{status:408,report:!0,cause:"request-timeout"}:s==="HPE_HEADER_OVERFLOW"?{status:431,report:!0,cause:"header-overflow"}:s?.startsWith("HPE_")?{status:400,report:!0,cause:"parse-error"}:{status:400,report:!0,cause:s??r??"unknown"}}A(classifyClientError,"classifyClientError"),n(classifyClientError,"classifyClientError");const CLIENT_ERROR_REASON={400:"Bad Request",408:"Request Timeout",431:"Request Header Fields Too Large"};function createClientErrorLogGate(s=1e4){const r=new Map;return u=>{const m=Date.now(),a=r.get(u)??0;return m-a<s?!1:(r.set(u,m),!0)}}A(createClientErrorLogGate,"createClientErrorLogGate"),n(createClientErrorLogGate,"createClientErrorLogGate");function guardInboundSocket(s){s.on("error",r=>{exports.BENIGN_SOCKET_ERRNOS.has(r.code??"")||console.warn(`[gateway] inbound socket error (${r.code??r.message}) \u2014 dropping this connection only`),s.destroy()})}A(guardInboundSocket,"guardInboundSocket"),n(guardInboundSocket,"guardInboundSocket");function retirePreviousWorkspace(s,r,u){const m=s.get(r);if(!m)return!1;s.delete(r),u==="re-registered"&&console.log(`[gateway] workspace '${r}' re-registered \u2014 retiring the children of its previous registration first.`);try{m()}catch(a){console.warn(`[gateway] could not fully retire the previous registration of '${r}' (${u}): ${a.message}`)}return!0}A(retirePreviousWorkspace,"retirePreviousWorkspace"),n(retirePreviousWorkspace,"retirePreviousWorkspace"),exports.GATEWAY_MAX_CONNECTIONS_DEFAULT=512,exports.GATEWAY_MAX_H2_SESSIONS_DEFAULT=64,exports.GATEWAY_MAX_H2_STREAMS_DEFAULT=4096,exports.GATEWAY_H2_IDLE_SESSION_MS_DEFAULT=3e5;function parseBudget(s,r){if(s===void 0||s.trim()==="")return r;const u=Number(s);return!Number.isFinite(u)||u<0?r:Math.floor(u)}A(parseBudget,"parseBudget"),n(parseBudget,"parseBudget");function resolveMaxConnections(s){return parseBudget(s,exports.GATEWAY_MAX_CONNECTIONS_DEFAULT)}A(resolveMaxConnections,"resolveMaxConnections"),n(resolveMaxConnections,"resolveMaxConnections");function h2BudgetFromEnv(s=process.env){return{maxSessions:parseBudget(s.LENSMCP_MAX_H2_SESSIONS,exports.GATEWAY_MAX_H2_SESSIONS_DEFAULT),maxStreams:parseBudget(s.LENSMCP_MAX_H2_STREAMS,exports.GATEWAY_MAX_H2_STREAMS_DEFAULT),idleSessionMs:parseBudget(s.LENSMCP_H2_IDLE_MS,exports.GATEWAY_H2_IDLE_SESSION_MS_DEFAULT)}}A(h2BudgetFromEnv,"h2BudgetFromEnv"),n(h2BudgetFromEnv,"h2BudgetFromEnv");function createH2Governor(s,r){const{NGHTTP2_ENHANCE_YOUR_CALM:u,NGHTTP2_REFUSED_STREAM:m}=require("node:http2").constants,a=new Map;let w=0;const _=n(o=>{o.idle&&(clearTimeout(o.idle),o.idle=void 0)},"disarm"),g=n((o,d)=>{_(d),!(s.idleSessionMs<=0||d.open>0)&&(d.idle=setTimeout(()=>{o.destroyed||o.closed||(r("session-reclaimed",{idleMs:s.idleSessionMs,sessions:a.size}),a.delete(o),o.close())},s.idleSessionMs),d.idle.unref?.())},"arm"),l=n(()=>{for(const[o,d]of a)if(!(d.open>0||o.destroyed))return _(d),a.delete(o),r("session-reclaimed",{reason:"cap",sessions:a.size+1,maxSessions:s.maxSessions}),o.close(),!0;return!1},"reclaimOldestIdle");return{admitSession(o){if(s.maxSessions>0&&a.size>=s.maxSessions&&!l()){r("session-refused",{sessions:a.size,maxSessions:s.maxSessions,streams:w});try{o.goaway(u)}catch{}try{o.close()}catch{}return!1}const d={open:0};return a.set(o,d),g(o,d),o.once("close",()=>{_(d),a.delete(o)}),!0},admitStream(o,d){const S=a.get(o);if(!S)return!0;if(s.maxStreams>0&&w>=s.maxStreams){r("stream-refused",{streams:w,maxStreams:s.maxStreams,sessions:a.size});try{d.close(m)}catch{}return!1}return w+=1,S.open+=1,_(S),d.once("close",()=>{w=Math.max(0,w-1),S.open=Math.max(0,S.open-1),S.open===0&&a.has(o)&&g(o,S)}),!0},dispose(){for(const o of a.values())_(o);a.clear()}}}A(createH2Governor,"createH2Governor"),n(createH2Governor,"createH2Governor");async function startGateway(s,r){const u=s.https!==!1,m=s.ports?.length?s.ports:[443],a=s.scanTtlMs??1500,w=s.startupTimeoutMs??12e4,_=s.sweepMs??1e4,g=s.trafficFlushMs??5e3;let l=!1;const o=process.env.LENSMCP_EVENT_FILE??path.join(r.root,".lensmcp","events.jsonl"),d=(0,own_log_1.startOwnLogRotation)(r.root),S=(0,scope_1.readLensScope)(r.root),T=S.key,x=S.sockNs!==T?S.sockNs:void 0,X=r.projectsConfigurations?.projects??{},J=(0,discovery_1.projectSourceRoots)(r.root,X,r.projectDependencies),{routes:G,services:N,instance:V}=(0,discovery_1.discoverRoutes)(r.root,X,void 0,T,J,x,S.instance);if(G.length===0)throw new Error("[gateway] no project declares a `cluster` field \u2014 nothing to route.");const j=new route_registry_1.RouteRegistry;j.register({wsKey:T,...x?{sockNs:x}:{},root:r.root,routes:G,services:N,...V?{instance:V}:{}});const R=[];let z=n(()=>{},"refreshCert");const Q=n(()=>{(0,route_registry_1.rebuildRoutesInPlace)(R,j),z()},"rebuildRoutes");Q();const{serviceKeys:ae,keyToProject:ie,keyToWorkspace:ce}=(0,service_keys_1.loadServiceKeys)(r.root,N,T),le=(0,client_ip_1.createClientIpResolver)({...(0,client_ip_1.clientIpOptionsFromEnv)(),...s.trustProxyHops!==void 0?{trustProxyHops:s.trustProxyHops}:{},...s.clientIpHeader?{clientIpHeader:s.clientIpHeader}:{},...s.clientIpTrustedProxies?{clientIpTrustedProxies:s.clientIpTrustedProxies}:{}}),E={root:r.root,wsKey:T,...x?{sockNs:x}:{},eventFile:o,routes:R,registry:j,rebuildRoutes:Q,services:N,serviceKeys:ae,keyToProject:ie,keyToWorkspace:ce,clientIp:le,bodyStallMs:s.bodyStallMs??types_1.BODY_STALL_MS,scanTtlMs:a,startupTimeoutMs:w,sweepMs:_,trafficFlushMs:g,https:u,projectRoots:Object.fromEntries(Object.entries(r.projectsConfigurations?.projects??{}).map(([e,t])=>[e,path.resolve(r.root,t.root)])),projectSourceRoots:J,...r.projectGraphStore?{graphStores:(0,project_graph_store_1.createProjectGraphStores)(r.projectGraphStore)}:{},...s.sharedCompiler!==void 0?{sharedCompiler:s.sharedCompiler}:{},stopped:n(()=>l,"stopped")};(0,process_name_1.prelinkProcessNames)((0,process_names_1.gatewayProcessNames)(N,{runner:(0,serve_launch_1.serveRunnerEnabled)()&&!!r.projectGraphStore,sharedBuild:(0,protocol_1.sharedCompilerEnabled)(process.env,s.sharedCompiler),label:T||path.basename(r.root),lens:{key:T,dashboard:s.dashboard!==!1,mcp:s.mcp!==!1&&G.some(e=>!!e.lens)}}));const f=(0,observability_1.createObservability)(o,{trafficFlushMs:g}),ue=createClientErrorLogGate(),k=h2BudgetFromEnv(),de=createClientErrorLogGate(3e4),q=createH2Governor(k,(e,t)=>{de(e)&&console.warn(`[gateway] h2 aggregate budget: ${e} (${JSON.stringify(t)}). These are the FRONT DOOR's ceilings, not an upstream's \u2014 raise/disable with LENSMCP_MAX_H2_SESSIONS / LENSMCP_MAX_H2_STREAMS / LENSMCP_H2_IDLE_MS / LENSMCP_MAX_CONNECTIONS (0 = unbounded).`),f.emit(e==="session-reclaimed"?"info":"warning",`h2 aggregate budget: ${e}`,`gateway-h2-budget:${e}`,{kind:"h2-aggregate-budget",event:e,project:"gateway",...t})}),v=(0,lifecycle_1.createServiceLayer)(E,f),L=(0,lens_children_1.createLensChildren)(E,f,s),W=new Map;let D;if(s.middleware){const e=require(path.resolve(r.root,s.middleware));D=e.default??e}const K=(0,workspace_middleware_1.createWorkspaceMiddleware)({ownerKey:T,...D?{owner:D}:{},policy:(0,workspace_middleware_1.guestMiddlewarePolicy)()}),O=process.env.LENSMCP_GW_ACT==="0"?void 0:(0,act_1.createActStore)({dir:path.join(path.dirname((0,control_1.controlSocketPath)()),"identities")});let b;try{b=(0,control_1.startControlServer)({rt:E,killService:n((e,t)=>v.killSpawned(e,t),"killService"),restartService:n((e,t)=>v.restartService(e,t),"restartService"),...O?{act:O}:{},onRegister:n(async e=>{retirePreviousWorkspace(W,e.wsKey,"re-registered"),K.set(e.wsKey,e.root,e.middleware);const t=await L.hostWorkspaceDashboard(e),h=await L.hostWorkspaceApps(e);W.set(e.wsKey,()=>{try{t?.()}finally{h()}})},"onRegister"),onUnregister:n(e=>{retirePreviousWorkspace(W,e.wsKey,"unregistered"),K.drop(e.wsKey),v.stopBuildHost(e.root)},"onUnregister")})}catch(e){console.warn("[gateway] control plane failed to start (multi-workspace register disabled):",e.message)}const I=(0,proxy_1.createProxy)(E,f,v),Z=buildEdgeVerifierPool(()=>E.routes),ee=(0,auth_1.createEdgeAuth)(E,f,Z,O),pe=n(e=>{const t=e.route?.wsKey,h=K.for(t);if(h)try{const i=t?E.registry.get(t):void 0;h(e.req,{...t?{wsKey:t}:{},...i?{root:i.root}:{},env:i?.instance?.env??{}})}catch(i){f.traceStep(e.trace,"auth",{mode:"middleware",ok:!1,reason:i.message}),e.route&&f.finishTrace(e.trace,e.route.project,401),e.sendError(401,"unauthorized",`Gateway middleware rejected the request: ${i.message}`)}},"builtinMiddleware"),se=s.hooks??{},re=(0,hooks_1.createHooks)({...se,afterAuth:[pe,...se.afterAuth??[]]}),te=(0,handler_1.createHandler)({rt:E,obs:f,auth:ee,proxy:I,hooks:re}),oe=(0,upgrade_1.createUpgrade)({rt:E,auth:ee,proxy:I,hooks:re,obs:f}),_e=f.startEdgeFlusher(),Se=v.startSweeper(),ne=(0,source_poller_1.createSourcePoller)({services:n(()=>E.registry.allServices(),"services"),serviceKey:n(e=>E.serviceKeys[(0,service_keys_1.serviceKeyId)(e.wsKey,e.project)],"serviceKey"),emit:n((e,t,h,i,p)=>f.emit(t,h,i,{wsKey:e.wsKey,...p},void 0,e.wsKey===E.wsKey?void 0:path.join(e.root,".lensmcp","events.jsonl")),"emit"),scanTtlMs:a,stopped:n(()=>l,"stopped")});(0,source_poller_1.sourcesEnabled)()&&ne.start(),await L.bootSingletonsAndApps();for(const e of N)e.decl.eager&&v.ensureUp(e);let P,F,H;if(u){const e=require("../../../basic-ssl"),t=(0,service_keys_1.gatewayCacheDir)(r.root);H=n(()=>e.getCertificateSync(t,"gateway",E.routes.map(h=>h.host).filter(h=>!!h)),"mintCert"),P=H(),F=e.caCertPath()}const U=[],$=[],Y=s.maxConnections??resolveMaxConnections(process.env.LENSMCP_MAX_CONNECTIONS);for(const e of m){const t=P?require("node:http2").createSecureServer({key:P,cert:P,allowHTTP1:!0,maxSessionMemory:512,settings:{maxConcurrentStreams:512},peerMaxConcurrentStreams:512,streamResetBurst:s.h2ResetBurst??types_1.GATEWAY_H2_RESET_BURST,streamResetRate:s.h2ResetRate??types_1.GATEWAY_H2_RESET_RATE},(i,p)=>te(i,p)):http.createServer(te);t.on("upgrade",oe),t.on("error",i=>console.error(`[gateway] port ${e}: ${i.code}`)),t.on("connection",guardInboundSocket),t.on("secureConnection",guardInboundSocket),t.on("tlsClientError",(i,p)=>p.destroy()),t.on("clientError",(i,p)=>{const c=i,y=classifyClientError(c.code,c.message);if(y.report&&ue(y.cause)){const C=p.remoteAddress??"unknown",M=y.status===null?"dropped":String(y.status);console.warn(`[gateway] inbound H1 clientError from ${C}: ${y.cause} (${c.code??c.message}${c.bytesParsed!==void 0?`, bytesParsed=${c.bytesParsed}`:""}) \u2192 ${M}. This status is the GATEWAY's, not the upstream service's.`),f.emit("warning",`inbound clientError: ${y.cause} \u2192 ${M}`,`gateway-client-error:${y.cause}`,{kind:"gateway-client-error",cause:y.cause,code:c.code??null,status:y.status,peer:C,bytesParsed:c.bytesParsed??null})}y.status!==null&&p.writable&&p.end(`HTTP/1.1 ${y.status} ${CLIENT_ERROR_REASON[y.status]}\r
+"use strict";var fe=Object.defineProperty;var T=(r,t)=>fe(r,"name",{value:t,configurable:!0});var ye=Object.defineProperty,o=T((r,t)=>ye(r,"name",{value:t,configurable:!0}),"o");Object.defineProperty(exports,"__esModule",{value:!0}),exports.GATEWAY_H2_IDLE_SESSION_MS_DEFAULT=exports.GATEWAY_MAX_H2_STREAMS_DEFAULT=exports.GATEWAY_MAX_H2_SESSIONS_DEFAULT=exports.GATEWAY_MAX_CONNECTIONS_DEFAULT=exports.BENIGN_SOCKET_ERRNOS=void 0,exports.buildEdgeVerifierPool=buildEdgeVerifierPool,exports.edgeKeyWait=edgeKeyWait,exports.withBuiltinHooks=withBuiltinHooks,exports.classifyClientError=classifyClientError,exports.createClientErrorLogGate=createClientErrorLogGate,exports.retirePreviousWorkspace=retirePreviousWorkspace,exports.resolveMaxConnections=resolveMaxConnections,exports.h2BudgetFromEnv=h2BudgetFromEnv,exports.createH2Governor=createH2Governor,exports.startGateway=startGateway;const tslib_1=require("tslib"),http=tslib_1.__importStar(require("node:http")),path=tslib_1.__importStar(require("node:path")),discovery_1=require("./discovery"),scope_1=require("./scope"),route_registry_1=require("./route-registry"),act_1=require("./act"),control_1=require("./control"),workspace_middleware_1=require("./workspace-middleware"),workspace_registry_1=require("./workspace-registry"),service_keys_1=require("./service-keys"),source_poller_1=require("./source-poller"),client_ip_1=require("../client-ip"),workspace_log_1=require("./workspace-log"),own_log_1=require("./own-log"),observability_1=require("./observability"),lifecycle_1=require("./lifecycle"),process_names_1=require("./process-names"),project_graph_store_1=require("./project-graph-store"),serve_launch_1=require("./serve-launch"),process_name_1=require("../../../process-name"),protocol_1=require("../../../shared-build/protocol"),lens_children_1=require("./lens-children"),proxy_1=require("./proxy"),auth_1=require("./auth"),hooks_1=require("./hooks"),handler_1=require("./handler"),upgrade_1=require("./upgrade"),jwks_verify_1=require("../jwks-verify"),manifest_1=require("../manifest"),edge_1=require("./edge"),warm_start_1=require("./warm-start"),types_1=require("./types");function insecureLocalFetch(r,t){return new Promise((i,c)=>{const a=(r.startsWith("https:")?require("node:https"):require("node:http")).request(r,{method:"GET",headers:t?.headers,rejectUnauthorized:!1},_=>{const y=[];_.on("data",h=>y.push(h)),_.on("error",c),_.on("end",()=>{const h=_.statusCode??0,A=Buffer.concat(y).toString("utf8");i({ok:h>=200&&h<300,status:h,json:o(async()=>JSON.parse(A),"json")})})});a.on("error",c),t?.signal?.addEventListener("abort",()=>a.destroy(new Error(`JWKS ${r} \u2192 aborted`)),{once:!0}),a.end()})}T(insecureLocalFetch,"insecureLocalFetch"),o(insecureLocalFetch,"insecureLocalFetch");function buildEdgeVerifierPool(r,t={}){const i=process.env.LENSMCP_GW_JWKS_URL,c=process.env.LENSMCP_GW_JWT_ISS,a=new Map;let _,y=!1;const h=o((s,l)=>{console.log(`[gateway] edge JWT: verifying via JWKS ${s}${l}`);const d=(0,jwks_verify_1.createJwksVerifier)({jwksUrl:s,...c?{issuer:c}:{},fetchImpl:t.fetchImpl??insecureLocalFetch});let E=!1;return d.warm({...t.warm,onError:o((v,x,b)=>{E=!0,x===1&&b!==void 0&&console.warn(`[gateway] edge JWKS ${s} not loaded yet (${v.message}) \u2014 retrying in the background`),b===void 0&&console.warn(`[gateway] edge JWKS ${s} still not loaded after ${x} attempts (${v.message}) \u2014 the first token that needs it fetches it`)},"onError")}).then(v=>{v&&E&&console.log(`[gateway] edge JWKS ${s} loaded`)}),d},"make"),A=o(s=>{let l=a.get(s);return l||(l=h(`https://auth.${s}/jwks.json`,` (auto-derived for apex ${s})`),a.set(s,l)),l},"forApex");return{for(s){if(i)return _??=h(i,"");const l=s.split(":")[0].toLowerCase();let d;for(const E of idpApexes(r()))(l===E||l.endsWith(`.${E}`))&&(!d||E.length>d.length)&&(d=E);return d?A(d):void 0},warm(){if(!y){if(i){_??=h(i,"");return}for(const s of idpApexes(r()))A(s)}},stop(){y=!0,_?.stop();for(const s of a.values())s.stop()}}}T(buildEdgeVerifierPool,"buildEdgeVerifierPool"),o(buildEdgeVerifierPool,"buildEdgeVerifierPool");function idpApexes(r){const t=new Set;for(const i of r){const c=i.host;typeof c!="string"||!/^auth\./.test(c)||c.startsWith("internal.")||t.add(c.slice(5))}return t}T(idpApexes,"idpApexes"),o(idpApexes,"idpApexes");function edgeKeyWait(r){return async t=>{const i=t.route;if(!i?.auth||i.internal)return;const{req:c}=t,a=Array.isArray(c.headers.authorization)?c.headers.authorization[0]:c.headers.authorization,_=String(a??"");if(!_.startsWith("Bearer "))return;const y=c.url??"/";if((0,manifest_1.authRuleFor)(i.auth,(0,edge_1.canonicalPath)(y)??y.split("?")[0],(c.method??"GET").toUpperCase()).mode!=="jwt")return;const h=String(c.headers.host??"").split(":")[0].toLowerCase();await r.for(h)?.awaitKey(_.slice(7))}}T(edgeKeyWait,"edgeKeyWait"),o(edgeKeyWait,"edgeKeyWait");function withBuiltinHooks(r,t){return{...r,beforeAuth:[...r.beforeAuth??[],t.keyWait],afterAuth:[t.middleware,...r.afterAuth??[]]}}T(withBuiltinHooks,"withBuiltinHooks"),o(withBuiltinHooks,"withBuiltinHooks"),exports.BENIGN_SOCKET_ERRNOS=new Set(["ECONNRESET","EPIPE","ETIMEDOUT","ECONNABORTED","ECANCELED"]);function classifyClientError(r,t){return r&&exports.BENIGN_SOCKET_ERRNOS.has(r)?{status:null,report:!1,cause:"client-abort"}:r==="HPE_INVALID_EOF_STATE"?{status:null,report:!1,cause:"truncated-at-eof"}:r==="ERR_HTTP_REQUEST_TIMEOUT"?{status:408,report:!0,cause:"request-timeout"}:r==="HPE_HEADER_OVERFLOW"?{status:431,report:!0,cause:"header-overflow"}:r?.startsWith("HPE_")?{status:400,report:!0,cause:"parse-error"}:{status:400,report:!0,cause:r??t??"unknown"}}T(classifyClientError,"classifyClientError"),o(classifyClientError,"classifyClientError");const CLIENT_ERROR_REASON={400:"Bad Request",408:"Request Timeout",431:"Request Header Fields Too Large"};function createClientErrorLogGate(r=1e4){const t=new Map;return i=>{const c=Date.now(),a=t.get(i)??0;return c-a<r?!1:(t.set(i,c),!0)}}T(createClientErrorLogGate,"createClientErrorLogGate"),o(createClientErrorLogGate,"createClientErrorLogGate");function guardInboundSocket(r){r.on("error",t=>{exports.BENIGN_SOCKET_ERRNOS.has(t.code??"")||console.warn(`[gateway] inbound socket error (${t.code??t.message}) \u2014 dropping this connection only`),r.destroy()})}T(guardInboundSocket,"guardInboundSocket"),o(guardInboundSocket,"guardInboundSocket");function retirePreviousWorkspace(r,t,i){const c=r.get(t);if(!c)return!1;r.delete(t),i==="re-registered"&&console.log(`[gateway] workspace '${t}' re-registered \u2014 retiring the children of its previous registration first.`);try{c()}catch(a){console.warn(`[gateway] could not fully retire the previous registration of '${t}' (${i}): ${a.message}`)}return!0}T(retirePreviousWorkspace,"retirePreviousWorkspace"),o(retirePreviousWorkspace,"retirePreviousWorkspace"),exports.GATEWAY_MAX_CONNECTIONS_DEFAULT=512,exports.GATEWAY_MAX_H2_SESSIONS_DEFAULT=64,exports.GATEWAY_MAX_H2_STREAMS_DEFAULT=4096,exports.GATEWAY_H2_IDLE_SESSION_MS_DEFAULT=3e5;function parseBudget(r,t){if(r===void 0||r.trim()==="")return t;const i=Number(r);return!Number.isFinite(i)||i<0?t:Math.floor(i)}T(parseBudget,"parseBudget"),o(parseBudget,"parseBudget");function resolveMaxConnections(r){return parseBudget(r,exports.GATEWAY_MAX_CONNECTIONS_DEFAULT)}T(resolveMaxConnections,"resolveMaxConnections"),o(resolveMaxConnections,"resolveMaxConnections");function h2BudgetFromEnv(r=process.env){return{maxSessions:parseBudget(r.LENSMCP_MAX_H2_SESSIONS,exports.GATEWAY_MAX_H2_SESSIONS_DEFAULT),maxStreams:parseBudget(r.LENSMCP_MAX_H2_STREAMS,exports.GATEWAY_MAX_H2_STREAMS_DEFAULT),idleSessionMs:parseBudget(r.LENSMCP_H2_IDLE_MS,exports.GATEWAY_H2_IDLE_SESSION_MS_DEFAULT)}}T(h2BudgetFromEnv,"h2BudgetFromEnv"),o(h2BudgetFromEnv,"h2BudgetFromEnv");function createH2Governor(r,t){const{NGHTTP2_ENHANCE_YOUR_CALM:i,NGHTTP2_REFUSED_STREAM:c}=require("node:http2").constants,a=new Map;let _=0;const y=o(s=>{s.idle&&(clearTimeout(s.idle),s.idle=void 0)},"disarm"),h=o((s,l)=>{y(l),!(r.idleSessionMs<=0||l.open>0)&&(l.idle=setTimeout(()=>{s.destroyed||s.closed||(t("session-reclaimed",{idleMs:r.idleSessionMs,sessions:a.size}),a.delete(s),s.close())},r.idleSessionMs),l.idle.unref?.())},"arm"),A=o(()=>{for(const[s,l]of a)if(!(l.open>0||s.destroyed))return y(l),a.delete(s),t("session-reclaimed",{reason:"cap",sessions:a.size+1,maxSessions:r.maxSessions}),s.close(),!0;return!1},"reclaimOldestIdle");return{admitSession(s){if(r.maxSessions>0&&a.size>=r.maxSessions&&!A()){t("session-refused",{sessions:a.size,maxSessions:r.maxSessions,streams:_});try{s.goaway(i)}catch{}try{s.close()}catch{}return!1}const l={open:0};return a.set(s,l),h(s,l),s.once("close",()=>{y(l),a.delete(s)}),!0},admitStream(s,l){const d=a.get(s);if(!d)return!0;if(r.maxStreams>0&&_>=r.maxStreams){t("stream-refused",{streams:_,maxStreams:r.maxStreams,sessions:a.size});try{l.close(c)}catch{}return!1}return _+=1,d.open+=1,y(d),l.once("close",()=>{_=Math.max(0,_-1),d.open=Math.max(0,d.open-1),d.open===0&&a.has(s)&&h(s,d)}),!0},dispose(){for(const s of a.values())y(s);a.clear()}}}T(createH2Governor,"createH2Governor"),o(createH2Governor,"createH2Governor");async function startGateway(r,t){const i=r.https!==!1,c=r.ports?.length?r.ports:[443],a=r.scanTtlMs??1500,_=r.startupTimeoutMs??12e4,y=r.sweepMs??1e4,h=r.trafficFlushMs??5e3;let A=!1;const s=process.env.LENSMCP_EVENT_FILE??path.join(t.root,".lensmcp","events.jsonl"),l=(0,own_log_1.startOwnLogRotation)(t.root),d=(0,scope_1.readLensScope)(t.root),E=d.key,v=d.sockNs!==E?d.sockNs:void 0,x=t.projectsConfigurations?.projects??{},b=(0,discovery_1.projectSourceRoots)(t.root,x,t.projectDependencies),{routes:j,services:P,instance:Q}=(0,discovery_1.discoverRoutes)(t.root,x,void 0,E,b,v,d.instance);if(j.length===0)throw new Error("[gateway] no project declares a `cluster` field \u2014 nothing to route.");const K=new route_registry_1.RouteRegistry;K.register({wsKey:E,...v?{sockNs:v}:{},root:t.root,routes:j,services:P,...Q?{instance:Q}:{}});const R=[];let Z=o(()=>{},"refreshCert"),U=o(()=>{},"warmEdgeVerifiers");const ee=o(()=>{(0,route_registry_1.rebuildRoutesInPlace)(R,K),Z(),U()},"rebuildRoutes");ee();const{serviceKeys:le,keyToProject:ue,keyToWorkspace:de}=(0,service_keys_1.loadServiceKeys)(t.root,P,E),pe=(0,client_ip_1.createClientIpResolver)({...(0,client_ip_1.clientIpOptionsFromEnv)(),...r.trustProxyHops!==void 0?{trustProxyHops:r.trustProxyHops}:{},...r.clientIpHeader?{clientIpHeader:r.clientIpHeader}:{},...r.clientIpTrustedProxies?{clientIpTrustedProxies:r.clientIpTrustedProxies}:{}}),g={root:t.root,wsKey:E,...v?{sockNs:v}:{},eventFile:s,routes:R,registry:K,rebuildRoutes:ee,services:P,serviceKeys:le,keyToProject:ue,keyToWorkspace:de,clientIp:pe,bodyStallMs:r.bodyStallMs??types_1.BODY_STALL_MS,scanTtlMs:a,startupTimeoutMs:_,sweepMs:y,trafficFlushMs:h,https:i,projectRoots:Object.fromEntries(Object.entries(t.projectsConfigurations?.projects??{}).map(([e,n])=>[e,path.resolve(t.root,n.root)])),projectSourceRoots:b,...t.projectGraphStore?{graphStores:(0,project_graph_store_1.createProjectGraphStores)(t.projectGraphStore)}:{},...r.sharedCompiler!==void 0?{sharedCompiler:r.sharedCompiler}:{},stopped:o(()=>A,"stopped")};(0,process_name_1.prelinkProcessNames)((0,process_names_1.gatewayProcessNames)(P,{runner:(0,serve_launch_1.serveRunnerEnabled)()&&!!t.projectGraphStore,sharedBuild:(0,protocol_1.sharedCompilerEnabled)(process.env,r.sharedCompiler),label:E||path.basename(t.root),lens:{key:E,dashboard:r.dashboard!==!1,mcp:r.mcp!==!1&&j.some(e=>!!e.lens)}}));const m=(0,observability_1.createObservability)(s,{trafficFlushMs:h}),_e=createClientErrorLogGate(),L=h2BudgetFromEnv(),ge=createClientErrorLogGate(3e4),D=createH2Governor(L,(e,n)=>{ge(e)&&console.warn(`[gateway] h2 aggregate budget: ${e} (${JSON.stringify(n)}). These are the FRONT DOOR's ceilings, not an upstream's \u2014 raise/disable with LENSMCP_MAX_H2_SESSIONS / LENSMCP_MAX_H2_STREAMS / LENSMCP_H2_IDLE_MS / LENSMCP_MAX_CONNECTIONS (0 = unbounded).`),m.emit(e==="session-reclaimed"?"info":"warning",`h2 aggregate budget: ${e}`,`gateway-h2-budget:${e}`,{kind:"h2-aggregate-budget",event:e,project:"gateway",...n})}),M=(0,lifecycle_1.createServiceLayer)(g,m),O=(0,lens_children_1.createLensChildren)(g,m,r),F=new Map;let re=o(()=>{},"ownBooted");const Se=new Promise(e=>re=e),te=(0,warm_start_1.createWorktreeWarmer)({rt:g,obs:m,ready:Se,ensureUp:o(e=>M.ensureUp(e),"ensureUp")});let B;if(r.middleware){const e=require(path.resolve(t.root,r.middleware));B=e.default??e}const Y=(0,workspace_middleware_1.createWorkspaceMiddleware)({ownerKey:E,...B?{owner:B}:{},policy:(0,workspace_middleware_1.guestMiddlewarePolicy)()}),I=process.env.LENSMCP_GW_ACT==="0"?void 0:(0,act_1.createActStore)({dir:path.join(path.dirname((0,control_1.controlSocketPath)()),"identities")});let $;try{$=(0,control_1.startControlServer)({rt:g,killService:o((e,n)=>M.killSpawned(e,n),"killService"),restartService:o((e,n)=>M.restartService(e,n),"restartService"),...I?{act:I}:{},onRegister:o(async e=>{retirePreviousWorkspace(F,e.wsKey,"re-registered"),Y.set(e.wsKey,e.root,e.middleware);const n=await O.hostWorkspaceDashboard(e),w=await O.hostWorkspaceApps(e);F.set(e.wsKey,()=>{try{n?.()}finally{w()}}),te.onRegister(e)},"onRegister"),onUnregister:o(e=>{te.onUnregister(e.wsKey),retirePreviousWorkspace(F,e.wsKey,"unregistered"),Y.drop(e.wsKey),M.stopBuildHost(e.root)},"onUnregister")})}catch(e){console.warn("[gateway] control plane failed to start (multi-workspace register disabled):",e.message)}const H=(0,proxy_1.createProxy)(g,m,M),W=buildEdgeVerifierPool(()=>g.routes),se=(0,auth_1.createEdgeAuth)(g,m,W,I),he=o(e=>{const n=e.route?.wsKey,w=Y.for(n);if(w)try{const u=n?g.registry.get(n):void 0;w(e.req,{...n?{wsKey:n}:{},...u?{root:u.root}:{},env:u?.instance?.env??{}})}catch(u){m.traceStep(e.trace,"auth",{mode:"middleware",ok:!1,reason:u.message}),e.route&&m.finishTrace(e.trace,e.route.project,401),e.sendError(401,"unauthorized",`Gateway middleware rejected the request: ${u.message}`)}},"builtinMiddleware"),oe=(0,hooks_1.createHooks)(withBuiltinHooks(r.hooks??{},{keyWait:edgeKeyWait(W),middleware:he})),ne=(0,handler_1.createHandler)({rt:g,obs:m,auth:se,proxy:H,hooks:oe}),ae=(0,upgrade_1.createUpgrade)({rt:g,auth:se,proxy:H,hooks:oe,obs:m}),Ee=m.startEdgeFlusher(),me=M.startSweeper(),ie=(0,source_poller_1.createSourcePoller)({services:o(()=>g.registry.allServices(),"services"),serviceKey:o(e=>g.serviceKeys[(0,service_keys_1.serviceKeyId)(e.wsKey,e.project)],"serviceKey"),emit:o((e,n,w,u,S)=>m.emit(n,w,u,{wsKey:e.wsKey,...S},void 0,e.wsKey===g.wsKey?void 0:path.join(e.root,".lensmcp","events.jsonl")),"emit"),scanTtlMs:a,stopped:o(()=>A,"stopped")});(0,source_poller_1.sourcesEnabled)()&&ie.start(),await O.bootSingletonsAndApps();const ce=P.filter(e=>e.decl.eager).map(e=>M.ensureUp(e));Promise.allSettled(ce).then(()=>setTimeout(re,ce.length?2e4:0).unref());let k,X,q;if(i){const e=require("../../../basic-ssl"),n=(0,service_keys_1.gatewayCacheDir)(t.root);q=o(()=>e.getCertificateSync(n,"gateway",g.routes.map(w=>w.host).filter(w=>!!w)),"mintCert"),k=q(),X=e.caCertPath()}const J=[],G=[],z=r.maxConnections??resolveMaxConnections(process.env.LENSMCP_MAX_CONNECTIONS);for(const e of c){const n=k?require("node:http2").createSecureServer({key:k,cert:k,allowHTTP1:!0,maxSessionMemory:512,settings:{maxConcurrentStreams:512},peerMaxConcurrentStreams:512,streamResetBurst:r.h2ResetBurst??types_1.GATEWAY_H2_RESET_BURST,streamResetRate:r.h2ResetRate??types_1.GATEWAY_H2_RESET_RATE},(u,S)=>ne(u,S)):http.createServer(ne);n.on("upgrade",ae),n.on("error",u=>console.error(`[gateway] port ${e}: ${u.code}`)),n.on("connection",guardInboundSocket),n.on("secureConnection",guardInboundSocket),n.on("tlsClientError",(u,S)=>S.destroy()),n.on("clientError",(u,S)=>{const p=u,f=classifyClientError(p.code,p.message);if(f.report&&_e(f.cause)){const N=S.remoteAddress??"unknown",C=f.status===null?"dropped":String(f.status);console.warn(`[gateway] inbound H1 clientError from ${N}: ${f.cause} (${p.code??p.message}${p.bytesParsed!==void 0?`, bytesParsed=${p.bytesParsed}`:""}) \u2192 ${C}. This status is the GATEWAY's, not the upstream service's.`),m.emit("warning",`inbound clientError: ${f.cause} \u2192 ${C}`,`gateway-client-error:${f.cause}`,{kind:"gateway-client-error",cause:f.cause,code:p.code??null,status:f.status,peer:N,bytesParsed:p.bytesParsed??null})}f.status!==null&&S.writable&&S.end(`HTTP/1.1 ${f.status} ${CLIENT_ERROR_REASON[f.status]}\r
 \r
-`),p.destroy()}),t.keepAliveTimeout=types_1.GATEWAY_KEEPALIVE_TIMEOUT_MS,t.headersTimeout=s.headersTimeoutMs??types_1.GATEWAY_HEADERS_TIMEOUT_MS,Y>0&&(t.maxConnections=Y);const h=s.connectionsCheckingIntervalMs??types_1.GATEWAY_CONN_CHECK_MS;if(h>0&&(t.connectionsCheckingInterval=h),P!=null){const i=t,{NGHTTP2_CANCEL:p}=require("node:http2").constants;i.on("session",c=>{if(!q.admitSession(c)){c.on("error",()=>{});return}let y=0,C=0;c.on("stream",M=>{q.admitStream(c,M)&&M.once("close",()=>{c.destroyed?C+=1:M.rstCode===p&&(y+=1)})}),c.once("close",()=>{C!==0&&(console.warn(`[gateway] h2 session closed with ${C} stream(s) in flight after ${y} client reset(s) \u2014 every in-flight fetch on that connection failed at once (ERR_HTTP2_PROTOCOL_ERROR in the browser). Reset budget: LENSMCP_H2_RESET_BURST/LENSMCP_H2_RESET_RATE (issues/closed/foodguard-14).`),f.emit("warning",`h2 session lost with ${C} stream(s) in flight`,"gateway-h2-session-lost",{kind:"h2-session-lost",project:"gateway",inflight:C,clientResets:y}))}),c.on("error",M=>{const Ee=M.code??M.message;console.warn(`[gateway] h2 session error (${Ee}) \u2014 dropping this session only`),c.destroyed||c.destroy()})}),i.on("sessionError",c=>{console.warn(`[gateway] h2 sessionError: ${c.code??c.message}`)})}await new Promise(i=>{t.listen(e,()=>{const p=t.address()?.port??e;$.push(p),console.log(`[gateway] Listening on ${P?"https":"http"}://localhost:${p}`),i()})}),U.push(t)}H&&(z=n(()=>{const e=H();for(const t of U)t.setSecureContext?.({key:e,cert:e})},"refreshCert")),console.log("[gateway] Routes:");for(const e of R){const t=e.pool?`pods@${e.pool.dir}`:e.target;console.log(`[gateway]   ${e.host??"(default)"} \u2192 ${t}${e.prependPrefix?`  (+${e.prependPrefix})`:""}${e.internal?"  [internal: no middleware]":""}  [${e.project}]`)}F&&console.log(`[gateway] CA: ${F} \u2014 one-time setup via the trust executor.`);const B=n(e=>e>0?String(e):"unbounded","unbounded");return console.log(`[gateway] front-door budget: \u2264${B(Y)} connections, \u2264${B(k.maxSessions)} h2 sessions (each \u2264512 MB session memory, \u2264512 streams), \u2264${B(k.maxStreams)} open streams in total, idle h2 session reclaimed after ${k.idleSessionMs>0?`${Math.round(k.idleSessionMs/1e3)}s`:"never"}. Override: LENSMCP_MAX_CONNECTIONS / LENSMCP_MAX_H2_SESSIONS / LENSMCP_MAX_H2_STREAMS / LENSMCP_H2_IDLE_MS (0 = unbounded).`),f.emit("info",`gateway up: ${R.length} routes on ${$.join("/")}`,"cluster-gateway",{kind:"gateway-up",project:"gateway",ports:$,routes:R.map(e=>({host:e.host??"(default)",project:e.project,mode:e.pool?"pods":"tcp",internal:!!e.internal,prependPrefix:e.prependPrefix}))}),b&&process.env.LENSMCP_GUEST_REPLAY!=="0"&&b.replay().catch(e=>console.warn("[gateway] guest replay failed:",e.message)),{ports:$,routes:R,services:N,stop:n(async()=>{if(!l){l=!0,clearInterval(_e),clearInterval(Se),ne.stop(),f.emit("info","gateway down","cluster-gateway",{kind:"gateway-down",project:"gateway"}),Z.stop(),b?.close(),O?.flush(),(0,workspace_registry_1.unregisterWorkspace)(T);for(const e of N)v.killSpawned(e,"gateway shutdown");v.stopRetiringTrees(),await v.stopBuildHost(),await L.reapAll(),oe.closeTunnels(),await Promise.all(U.map(e=>new Promise(t=>{let h=!1;const i=n(()=>{h||(h=!0,t())},"done"),p=e;e.close(()=>i());try{p.closeIdleConnections?.()}catch{}setTimeout(()=>{try{p.closeAllConnections?.()}catch{}i()},types_1.GATEWAY_STOP_GRACE_MS).unref?.()}))),I.closeProxy(),I.destroyAgents(),q.dispose(),(0,workspace_log_1.closeWorkspaceLogs)(),d()}},"stop"),...E.lensSupervisor?{lensSupervisor:E.lensSupervisor}:{},...E.graphStores?{graphStores:E.graphStores}:{}}}A(startGateway,"startGateway"),n(startGateway,"startGateway");
+`),S.destroy()}),n.keepAliveTimeout=types_1.GATEWAY_KEEPALIVE_TIMEOUT_MS,n.headersTimeout=r.headersTimeoutMs??types_1.GATEWAY_HEADERS_TIMEOUT_MS,z>0&&(n.maxConnections=z);const w=r.connectionsCheckingIntervalMs??types_1.GATEWAY_CONN_CHECK_MS;if(w>0&&(n.connectionsCheckingInterval=w),k!=null){const u=n,{NGHTTP2_CANCEL:S}=require("node:http2").constants;u.on("session",p=>{if(!D.admitSession(p)){p.on("error",()=>{});return}let f=0,N=0;p.on("stream",C=>{D.admitStream(p,C)&&C.once("close",()=>{p.destroyed?N+=1:C.rstCode===S&&(f+=1)})}),p.once("close",()=>{N!==0&&(console.warn(`[gateway] h2 session closed with ${N} stream(s) in flight after ${f} client reset(s) \u2014 every in-flight fetch on that connection failed at once (ERR_HTTP2_PROTOCOL_ERROR in the browser). Reset budget: LENSMCP_H2_RESET_BURST/LENSMCP_H2_RESET_RATE (issues/closed/foodguard-14).`),m.emit("warning",`h2 session lost with ${N} stream(s) in flight`,"gateway-h2-session-lost",{kind:"h2-session-lost",project:"gateway",inflight:N,clientResets:f}))}),p.on("error",C=>{const we=C.code??C.message;console.warn(`[gateway] h2 session error (${we}) \u2014 dropping this session only`),p.destroyed||p.destroy()})}),u.on("sessionError",p=>{console.warn(`[gateway] h2 sessionError: ${p.code??p.message}`)})}await new Promise(u=>{n.listen(e,()=>{const S=n.address()?.port??e;G.push(S),console.log(`[gateway] Listening on ${k?"https":"http"}://localhost:${S}`),u()})}),J.push(n)}q&&(Z=o(()=>{const e=q();for(const n of J)n.setSecureContext?.({key:e,cert:e})},"refreshCert")),console.log("[gateway] Routes:");for(const e of R){const n=e.pool?`pods@${e.pool.dir}`:e.target;console.log(`[gateway]   ${e.host??"(default)"} \u2192 ${n}${e.prependPrefix?`  (+${e.prependPrefix})`:""}${e.internal?"  [internal: no middleware]":""}  [${e.project}]`)}X&&console.log(`[gateway] CA: ${X} \u2014 one-time setup via the trust executor.`),U=o(()=>W.warm(),"warmEdgeVerifiers"),U();const V=o(e=>e>0?String(e):"unbounded","unbounded");return console.log(`[gateway] front-door budget: \u2264${V(z)} connections, \u2264${V(L.maxSessions)} h2 sessions (each \u2264512 MB session memory, \u2264512 streams), \u2264${V(L.maxStreams)} open streams in total, idle h2 session reclaimed after ${L.idleSessionMs>0?`${Math.round(L.idleSessionMs/1e3)}s`:"never"}. Override: LENSMCP_MAX_CONNECTIONS / LENSMCP_MAX_H2_SESSIONS / LENSMCP_MAX_H2_STREAMS / LENSMCP_H2_IDLE_MS (0 = unbounded).`),m.emit("info",`gateway up: ${R.length} routes on ${G.join("/")}`,"cluster-gateway",{kind:"gateway-up",project:"gateway",ports:G,routes:R.map(e=>({host:e.host??"(default)",project:e.project,mode:e.pool?"pods":"tcp",internal:!!e.internal,prependPrefix:e.prependPrefix}))}),$&&process.env.LENSMCP_GUEST_REPLAY!=="0"&&$.replay().catch(e=>console.warn("[gateway] guest replay failed:",e.message)),{ports:G,routes:R,services:P,stop:o(async()=>{if(!A){A=!0,clearInterval(Ee),clearInterval(me),ie.stop(),m.emit("info","gateway down","cluster-gateway",{kind:"gateway-down",project:"gateway"}),W.stop(),$?.close(),I?.flush(),(0,workspace_registry_1.unregisterWorkspace)(E);for(const e of P)M.killSpawned(e,"gateway shutdown");M.stopRetiringTrees(),await M.stopBuildHost(),await O.reapAll(),ae.closeTunnels(),await Promise.all(J.map(e=>new Promise(n=>{let w=!1;const u=o(()=>{w||(w=!0,n())},"done"),S=e;e.close(()=>u());try{S.closeIdleConnections?.()}catch{}setTimeout(()=>{try{S.closeAllConnections?.()}catch{}u()},types_1.GATEWAY_STOP_GRACE_MS).unref?.()}))),H.closeProxy(),H.destroyAgents(),D.dispose(),(0,workspace_log_1.closeWorkspaceLogs)(),l()}},"stop"),...g.lensSupervisor?{lensSupervisor:g.lensSupervisor}:{},...g.graphStores?{graphStores:g.graphStores}:{}}}T(startGateway,"startGateway"),o(startGateway,"startGateway");

package/executors/gateway/runtime/warm-start.d.ts

@@ -0,0 +1,64 @@
+import type { Observability } from './observability';
+import type { WorkspaceFragment } from './route-registry';
+import type { GatewayRuntime, ServiceCtl } from './types';
+export declare const WARM_MIN_FREE_ENV = "LENSMCP_WARM_MIN_FREE_MB";
+export declare const DEFAULT_WARM_MIN_FREE_MB = 4096;
+export declare const WORKTREE_IDLE_ENV = "LENSMCP_WORKTREE_IDLE_SEC";
+export declare const DEFAULT_WORKTREE_IDLE_SEC = 1800;
+/** The floor a warm start keeps, in bytes. */
+export declare function warmMinFreeBytes(env?: NodeJS.ProcessEnv): number;
+/**
+ * How long a worktree instance's service may sit without a request: its own `idleKillSec`, else the worktree default.
+ * `undefined` — never idle-stopped — for the daemon's own and other registered workspaces' services, as before.
+ */
+export declare function instanceIdleSec(svc: Pick<ServiceCtl, 'decl'>, isInstance: boolean, env?: NodeJS.ProcessEnv): number | undefined;
+export interface MemoryProbe {
+    platform?: NodeJS.Platform;
+    /** `sysctl -n <name>`. */
+    sysctl?: (name: string) => string;
+    readFile?: (path: string) => string;
+    totalmem?: () => number;
+}
+/** Memory the system can still give out, in bytes — or `undefined` where it does not say (no floor is then applied). */
+export declare function availableMemory(probe?: MemoryProbe): number | undefined;
+export interface WarmStartDeps {
+    /** Start the service and wait for its pods (lifecycle.ts `ensureUp`): `true` once it answers. */
+    ensureUp(svc: ServiceCtl): Promise<boolean>;
+    /** {@link availableMemory}. */
+    available(): number | undefined;
+    /** {@link warmMinFreeBytes}. */
+    minFreeBytes: number;
+    /** Is this service still the registered workspace's — not unregistered, not replaced by a newer registration? */
+    current(svc: ServiceCtl): boolean;
+    /** Onto the service's own bus. */
+    emit(svc: ServiceCtl, severity: 'info' | 'warning', title: string, raw: Record<string, unknown>): void;
+    log(line: string): void;
+}
+export interface WarmOutcome {
+    project: string;
+    outcome: 'up' | 'failed' | 'deferred' | 'already';
+    reason?: string;
+}
+/** Start `services`' always-warm ones, one at a time, while the floor holds. Never throws. */
+export declare function warmStart(services: readonly ServiceCtl[], deps: WarmStartDeps): Promise<WarmOutcome[]>;
+export interface WorktreeWarmerDeps {
+    rt: Pick<GatewayRuntime, 'registry' | 'stopped'>;
+    ensureUp(svc: ServiceCtl): Promise<boolean>;
+    obs: Pick<Observability, 'emit'>;
+    available?: () => number | undefined;
+    env?: NodeJS.ProcessEnv;
+    /** How long after a registration the first start waits — the registration's answer and its dashboard go first. */
+    delayMs?: number;
+    /** Settles once the daemon's own warm services are up and have settled: a reading before it does not yet hold them. */
+    ready?: Promise<unknown>;
+    log?: (line: string) => void;
+}
+/**
+ * The daemon's side (server.ts): on a worktree instance's registration, warm its services ({@link warmStart}); on a
+ * newer registration or an unregistration, the older run stops at its next service. Returns the run's promise, for
+ * the spec.
+ */
+export declare function createWorktreeWarmer(deps: WorktreeWarmerDeps): {
+    onRegister(fragment: WorkspaceFragment): Promise<WarmOutcome[]> | undefined;
+    onUnregister(wsKey: string): void;
+};

package/executors/gateway/runtime/warm-start.js

@@ -0,0 +1 @@
+"use strict";var _=Object.defineProperty;var p=(e,r)=>_(e,"name",{value:r,configurable:!0});var f=Object.defineProperty,u=p((e,r)=>f(e,"name",{value:r,configurable:!0}),"u");Object.defineProperty(exports,"__esModule",{value:!0}),exports.DEFAULT_WORKTREE_IDLE_SEC=exports.WORKTREE_IDLE_ENV=exports.DEFAULT_WARM_MIN_FREE_MB=exports.WARM_MIN_FREE_ENV=void 0,exports.warmMinFreeBytes=warmMinFreeBytes,exports.instanceIdleSec=instanceIdleSec,exports.availableMemory=availableMemory,exports.warmStart=warmStart,exports.createWorktreeWarmer=createWorktreeWarmer;const tslib_1=require("tslib"),node_child_process_1=require("node:child_process"),fs=tslib_1.__importStar(require("node:fs")),os=tslib_1.__importStar(require("node:os")),path=tslib_1.__importStar(require("node:path"));exports.WARM_MIN_FREE_ENV="LENSMCP_WARM_MIN_FREE_MB",exports.DEFAULT_WARM_MIN_FREE_MB=4096,exports.WORKTREE_IDLE_ENV="LENSMCP_WORKTREE_IDLE_SEC",exports.DEFAULT_WORKTREE_IDLE_SEC=1800;function warmMinFreeBytes(e=process.env){const r=Number(e[exports.WARM_MIN_FREE_ENV]);return(Number.isFinite(r)&&r>=0?r:exports.DEFAULT_WARM_MIN_FREE_MB)*1024*1024}p(warmMinFreeBytes,"warmMinFreeBytes"),u(warmMinFreeBytes,"warmMinFreeBytes");function instanceIdleSec(e,r,i=process.env){if(e.decl.idleKillSec)return e.decl.idleKillSec;if(!r)return;const o=Number(i[exports.WORKTREE_IDLE_ENV]?.trim()||NaN);return!Number.isFinite(o)||o<0?exports.DEFAULT_WORKTREE_IDLE_SEC:o>0?o:void 0}p(instanceIdleSec,"instanceIdleSec"),u(instanceIdleSec,"instanceIdleSec");function availableMemory(e={}){const r=e.platform??process.platform;try{if(r==="darwin"){const i=e.sysctl??(t=>(0,node_child_process_1.execFileSync)("sysctl",["-n",t],{encoding:"utf8",timeout:2e3})),o=Number(i("kern.memorystatus_level").trim());return!Number.isFinite(o)||o<0||o>100?void 0:Math.round(o/100*(e.totalmem??os.totalmem)())}if(r==="linux"){const i=(e.readFile??(t=>fs.readFileSync(t,"utf8")))("/proc/meminfo"),o=/^MemAvailable:\s+(\d+)\s+kB/m.exec(i)?.[1];return o===void 0?void 0:Number(o)*1024}}catch{}}p(availableMemory,"availableMemory"),u(availableMemory,"availableMemory");const gb=u(e=>`${(e/1024**3).toFixed(1)} GB`,"gb");async function warmStart(e,r){const i=[],o=e.filter(t=>t.decl.eager&&!t.frozen);for(let t=0;t<o.length;t++){const c=o[t];if(!r.current(c))break;if(c.proc||c.state!=="down"){i.push({project:c.project,outcome:"already"});continue}const l=r.available();if(l!==void 0&&l<r.minFreeBytes){const a=`${gb(l)} of memory free, under the ${gb(r.minFreeBytes)} a warm start keeps (${exports.WARM_MIN_FREE_ENV})`,m=o.slice(t).filter(n=>!n.proc&&n.state==="down");r.log(`[gateway] warm start stopped for ${c.wsKey}: ${a} \u2014 ${m.map(n=>n.project).join(", ")} start on their first request.`);for(const n of m)r.emit(n,"info",`warm start deferred: ${n.project} \u2014 ${a}`,{kind:"service-warm-deferred",project:n.project,reason:a,availableBytes:l,minFreeBytes:r.minFreeBytes}),i.push({project:n.project,outcome:"deferred",reason:a});return i}const s=await r.ensureUp(c).catch(()=>!1);s&&(c.lastUsed=Date.now()),i.push({project:c.project,outcome:s?"up":"failed"})}return i}p(warmStart,"warmStart"),u(warmStart,"warmStart");function createWorktreeWarmer(e){const r=new Map,i=e.log??(t=>console.log(t));let o=(e.ready??Promise.resolve()).catch(()=>{});return{onRegister(t){if(!t.instance||t.instance.frozen)return;const c=Symbol(t.wsKey);r.set(t.wsKey,c);const l=o.then(()=>new Promise(s=>setTimeout(s,e.delayMs??1e3).unref?.())).then(()=>warmStart(t.services,{ensureUp:e.ensureUp,available:e.available??(()=>availableMemory()),minFreeBytes:warmMinFreeBytes(e.env),current:u(s=>!e.rt.stopped()&&r.get(s.wsKey)===c&&!!e.rt.registry.get(s.wsKey)?.services.includes(s),"current"),emit:u((s,a,m,n)=>e.obs.emit(a,m,`cluster-service:${s.project}`,{wsKey:s.wsKey,...n},void 0,path.join(s.root,".lensmcp","events.jsonl")),"emit"),log:i})).then(s=>{const a=u(m=>s.filter(n=>n.outcome===m).map(n=>n.project),"by");return s.length&&i(`[gateway] warm start of ${t.wsKey}: up ${a("up").join(", ")||"\u2014"}${a("failed").length?`; failed ${a("failed").join(", ")}`:""}${a("deferred").length?`; on first request ${a("deferred").join(", ")}`:""}`),s});return o=l.catch(()=>{}),l},onUnregister(t){r.delete(t)}}}p(createWorktreeWarmer,"createWorktreeWarmer"),u(createWorktreeWarmer,"createWorktreeWarmer");

package/executors/gateway/schema.d.ts

@@ -17,6 +17,6 @@ export interface GatewayExecutorSchema {
   /** Override the dashboard hostname. Default lens.<baseDomain>. */
   lensHost?: string;
   /** Compile every service of this workspace in ONE webpack compilation (a build host) instead of one watcher per
-   *  service. `LENSMCP_SHARED_COMPILER=1|0` wins over it. */
+   *  service. Default on; `false` gives each service its own watcher. `LENSMCP_SHARED_COMPILER=1|0` wins over it. */
   sharedCompiler?: boolean;
 }

package/executors/gateway/schema.json

@@ -45,7 +45,7 @@
     },
     "sharedCompiler": {
       "type": "boolean",
-      "description": "Compile every service of this workspace in ONE webpack compilation (a build host) instead of one watcher per service: shared libraries are compiled once. LENSMCP_SHARED_COMPILER=1|0 wins over it."
+      "description": "Compile every service of this workspace in ONE webpack compilation (a build host) instead of one watcher per service: shared libraries are compiled once. Default on; false gives each service its own watcher. LENSMCP_SHARED_COMPILER=1|0 wins over it."
     }
   },
   "additionalProperties": false

package/executors/trust/trust.impl.d.ts

@@ -39,5 +39,16 @@ interface ExecutorContext {
 export default function trustExecutor(options: TrustExecutorSchema, context: ExecutorContext): Promise<{
     success: boolean;
 }>;
+/** What the OS resolver makes of a host: does it reach loopback over IPv4, over IPv6. */
+export interface HostResolution {
+    v4: boolean;
+    v6: boolean;
+}
+/**
+ * The `/etc/hosts` lines still owed: a family neither a line nor the OS resolver maps to loopback. macOS (and
+ * systemd-resolved) map every `*.localhost` name with no line at all — a worktree's hosts need none, and writing them
+ * cost a sudo prompt for nothing (issues/closed/foodguard-87).
+ */
+export declare function missingHostLines(hosts: string[], etcHosts: string, resolved: ReadonlyMap<string, HostResolution>): string[];
 export declare function collectHosts(options: TrustExecutorSchema, context: ExecutorContext): string[];
 export {};

package/executors/trust/trust.impl.js

@@ -1,6 +1,6 @@
-"use strict";var v=Object.defineProperty;var h=(o,t)=>v(o,"name",{value:t,configurable:!0});var m=Object.defineProperty,d=h((o,t)=>m(o,"name",{value:t,configurable:!0}),"d");Object.defineProperty(exports,"__esModule",{value:!0}),exports.default=trustExecutor,exports.collectHosts=collectHosts;const tslib_1=require("tslib"),node_child_process_1=require("node:child_process"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path")),basic_ssl_1=require("../../basic-ssl"),checkout_cache_1=require("../../checkout-cache"),hostname_1=require("./hostname");async function trustExecutor(o,t){const r=(0,checkout_cache_1.checkoutCacheDir)(t.root,"davnx-webpack"),c=(0,basic_ssl_1.ensureCaSync)(r),a=process.env.LENSMCP_TRUST_HOSTS_ONLY==="1",u=collectHosts(o,t);if(u.length===0&&console.log("[trust] no concrete hostnames found (only wildcards?) \u2014 keychain step only."),process.platform!=="darwin"){console.log("[trust] non-macOS platform \u2014 do these manually:"),console.log(`  \u2022 trust ${c} in your OS/browser store (Linux: update-ca-certificates / certutil)`);for(const e of u)console.log(`  \u2022 /etc/hosts: "127.0.0.1 ${e}" and "::1 ${e}"`);return{success:!0}}const s=caSha256Fingerprint(c),p=a||s!==void 0&&(0,node_child_process_1.spawnSync)("security",["find-certificate","-a","-c","lensmcp local dev CA","-Z","/Library/Keychains/System.keychain"],{encoding:"utf8"}).stdout?.includes(s)===!0;if(a)console.log("[trust] hosts-only: a shared daemon serves TLS with its own CA \u2014 skipping the keychain step.");else if(p)console.log("[trust] CA already in the System keychain \u2014 skipping.");else{if(console.log(`[trust] adding CA to the System keychain (sudo will prompt): ${c}`),(0,node_child_process_1.spawnSync)("sudo",["security","add-trusted-cert","-d","-r","trustRoot","-k","/Library/Keychains/System.keychain",c],{stdio:"inherit"}).status!==0)return console.error("[trust] add-trusted-cert failed \u2014 rerun in a terminal so sudo can prompt."),{success:!1};console.log("[trust] CA trusted. Restart your browser once (it caches certificate verdicts).")}const i=fs.readFileSync("/etc/hosts","utf8"),n=d((e,g)=>i.split(`
-`).some(S=>{const f=S.trim();if(f.startsWith("#"))return!1;const y=f.split(/\s+/);return y[0]===e&&y.slice(1).includes(g)}),"hasEntry"),l=[];for(const e of u)n("127.0.0.1",e)||l.push(`127.0.0.1 ${e}`),n("::1",e)||l.push(`::1 ${e}`);if(l.length===0)console.log("[trust] /etc/hosts already complete (both families for every hostname).");else{if(console.log(`[trust] appending to /etc/hosts (sudo):
-  ${l.join(`
-  `)}`),(0,node_child_process_1.spawnSync)("sudo",["tee","-a","/etc/hosts"],{input:l.join(`
+"use strict";var f=Object.defineProperty;var l=(r,t)=>f(r,"name",{value:t,configurable:!0});var h=Object.defineProperty,d=l((r,t)=>h(r,"name",{value:t,configurable:!0}),"d");Object.defineProperty(exports,"__esModule",{value:!0}),exports.default=trustExecutor,exports.missingHostLines=missingHostLines,exports.collectHosts=collectHosts;const tslib_1=require("tslib"),node_child_process_1=require("node:child_process"),node_dns_1=require("node:dns"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path")),basic_ssl_1=require("../../basic-ssl"),checkout_cache_1=require("../../checkout-cache"),hostname_1=require("./hostname");async function trustExecutor(r,t){const e=(0,checkout_cache_1.checkoutCacheDir)(t.root,"davnx-webpack"),n=(0,basic_ssl_1.ensureCaSync)(e),c=process.env.LENSMCP_TRUST_HOSTS_ONLY==="1",s=collectHosts(r,t);if(s.length===0&&console.log("[trust] no concrete hostnames found (only wildcards?) \u2014 keychain step only."),process.platform!=="darwin"){console.log("[trust] non-macOS platform \u2014 do these manually:"),console.log(`  \u2022 trust ${n} in your OS/browser store (Linux: update-ca-certificates / certutil)`);for(const p of s)console.log(`  \u2022 /etc/hosts: "127.0.0.1 ${p}" and "::1 ${p}"`);return{success:!0}}const o=caSha256Fingerprint(n),a=c||o!==void 0&&(0,node_child_process_1.spawnSync)("security",["find-certificate","-a","-c","lensmcp local dev CA","-Z","/Library/Keychains/System.keychain"],{encoding:"utf8"}).stdout?.includes(o)===!0;if(c)console.log("[trust] hosts-only: a shared daemon serves TLS with its own CA \u2014 skipping the keychain step.");else if(a)console.log("[trust] CA already in the System keychain \u2014 skipping.");else{if(console.log(`[trust] adding CA to the System keychain (sudo will prompt): ${n}`),(0,node_child_process_1.spawnSync)("sudo",["security","add-trusted-cert","-d","-r","trustRoot","-k","/Library/Keychains/System.keychain",n],{stdio:"inherit"}).status!==0)return console.error("[trust] add-trusted-cert failed \u2014 rerun in a terminal so sudo can prompt."),{success:!1};console.log("[trust] CA trusted. Restart your browser once (it caches certificate verdicts).")}const u=fs.readFileSync("/etc/hosts","utf8"),i=missingHostLines(s,u,await resolveAll(s));if(i.length===0)console.log("[trust] /etc/hosts already complete (both families for every hostname, by a line or by the OS resolver).");else{if(console.log(`[trust] appending to /etc/hosts (sudo):
+  ${i.join(`
+  `)}`),(0,node_child_process_1.spawnSync)("sudo",["tee","-a","/etc/hosts"],{input:i.join(`
 `)+`
-`,stdio:["pipe","ignore","inherit"]}).status!==0)return console.error("[trust] /etc/hosts update failed."),{success:!1};(0,node_child_process_1.spawnSync)("sudo",["dscacheutil","-flushcache"],{stdio:"inherit"}),(0,node_child_process_1.spawnSync)("sudo",["killall","-HUP","mDNSResponder"],{stdio:"inherit"})}if(!a){const e=(0,node_child_process_1.spawnSync)("security",["verify-cert","-c",c,"-p","basic"],{stdio:"ignore"});console.log(`[trust] CA trust check: ${e.status===0?"OK":"NOT TRUSTED YET (browser restart may be needed)"}`)}for(const e of u)console.log(`[trust] ${e} \u2192 https ready (hosts + cert SAN ride the gateway config)`);return{success:!0}}h(trustExecutor,"trustExecutor"),d(trustExecutor,"trustExecutor");function caSha256Fingerprint(o){const t=(0,node_child_process_1.spawnSync)("openssl",["x509","-in",o,"-noout","-fingerprint","-sha256"],{encoding:"utf8"});if(t.status!==0||!t.stdout)return;const r=t.stdout.split("=")[1]?.replaceAll(":","").trim().toUpperCase();return r&&/^[0-9A-F]{64}$/.test(r)?r:void 0}h(caSha256Fingerprint,"caSha256Fingerprint"),d(caSha256Fingerprint,"caSha256Fingerprint");function collectHosts(o,t){const r=[],c=t.projectName?t.projectsConfigurations?.projects[t.projectName]:void 0,a=o.serveTarget??"serve-hmr",u=c?.targets?.[a]?.options?.gateway?.routes??[];for(const s of u)s.host&&(0,hostname_1.isValidHostname)(s.host)?r.push(s.host):s.host&&console.warn(`[trust] ignoring invalid hostname in ${a} routes: ${JSON.stringify(s.host)}`);for(const s of Object.values(t.projectsConfigurations?.projects??{}))try{const p=JSON.parse(fs.readFileSync(path.join(t.root,s.root,"project.json"),"utf8")),i=p.cluster??p.davnx,n=i?.host;n&&!(0,hostname_1.isValidHostname)(n)&&console.warn(`[trust] ignoring invalid hostname in ${s.root}/project.json: ${JSON.stringify(n)}`),n&&(0,hostname_1.isValidHostname)(n)&&(r.push(n),i?.service&&i.internalHost!==!1&&r.push(typeof i.internalHost=="string"?i.internalHost:`internal.${n}`))}catch{}return[...new Set([...r,"lensmcp.local",...o.hosts??[]])]}h(collectHosts,"collectHosts"),d(collectHosts,"collectHosts");
+`,stdio:["pipe","ignore","inherit"]}).status!==0)return console.error("[trust] /etc/hosts update failed."),{success:!1};(0,node_child_process_1.spawnSync)("sudo",["dscacheutil","-flushcache"],{stdio:"inherit"}),(0,node_child_process_1.spawnSync)("sudo",["killall","-HUP","mDNSResponder"],{stdio:"inherit"})}if(!c){const p=(0,node_child_process_1.spawnSync)("security",["verify-cert","-c",n,"-p","basic"],{stdio:"ignore"});console.log(`[trust] CA trust check: ${p.status===0?"OK":"NOT TRUSTED YET (browser restart may be needed)"}`)}for(const p of s)console.log(`[trust] ${p} \u2192 https ready (hosts + cert SAN ride the gateway config)`);return{success:!0}}l(trustExecutor,"trustExecutor"),d(trustExecutor,"trustExecutor");function caSha256Fingerprint(r){const t=(0,node_child_process_1.spawnSync)("openssl",["x509","-in",r,"-noout","-fingerprint","-sha256"],{encoding:"utf8"});if(t.status!==0||!t.stdout)return;const e=t.stdout.split("=")[1]?.replaceAll(":","").trim().toUpperCase();return e&&/^[0-9A-F]{64}$/.test(e)?e:void 0}l(caSha256Fingerprint,"caSha256Fingerprint"),d(caSha256Fingerprint,"caSha256Fingerprint");function missingHostLines(r,t,e){const n=d((s,o)=>t.split(`
+`).some(a=>{const u=a.trim();if(u.startsWith("#"))return!1;const i=u.split(/\s+/);return i[0]===s&&i.slice(1).includes(o)}),"hasEntry"),c=[];for(const s of r)!n("127.0.0.1",s)&&!e.get(s)?.v4&&c.push(`127.0.0.1 ${s}`),!n("::1",s)&&!e.get(s)?.v6&&c.push(`::1 ${s}`);return c}l(missingHostLines,"missingHostLines"),d(missingHostLines,"missingHostLines");async function resolveAll(r){const t=d(e=>new Promise(n=>{const c=setTimeout(()=>n({v4:!1,v6:!1}),2e3);(0,node_dns_1.lookup)(e,{all:!0},(s,o)=>{if(clearTimeout(c),s||!Array.isArray(o))return n({v4:!1,v6:!1});n({v4:o.some(a=>a.family===4&&a.address.startsWith("127.")),v6:o.some(a=>a.family===6&&a.address==="::1")})})}),"one");return new Map(await Promise.all(r.map(async e=>[e,await t(e)])))}l(resolveAll,"resolveAll"),d(resolveAll,"resolveAll");function collectHosts(r,t){const e=[],n=t.projectName?t.projectsConfigurations?.projects[t.projectName]:void 0,c=r.serveTarget??"serve-hmr",s=n?.targets?.[c]?.options?.gateway?.routes??[];for(const o of s)o.host&&(0,hostname_1.isValidHostname)(o.host)?e.push(o.host):o.host&&console.warn(`[trust] ignoring invalid hostname in ${c} routes: ${JSON.stringify(o.host)}`);for(const o of Object.values(t.projectsConfigurations?.projects??{}))try{const a=JSON.parse(fs.readFileSync(path.join(t.root,o.root,"project.json"),"utf8")),u=a.cluster??a.davnx,i=u?.host;i&&!(0,hostname_1.isValidHostname)(i)&&console.warn(`[trust] ignoring invalid hostname in ${o.root}/project.json: ${JSON.stringify(i)}`),i&&(0,hostname_1.isValidHostname)(i)&&(e.push(i),u?.service&&u.internalHost!==!1&&e.push(typeof u.internalHost=="string"?u.internalHost:`internal.${i}`))}catch{}return[...new Set([...e,"lensmcp.local",...r.hosts??[]])]}l(collectHosts,"collectHosts"),d(collectHosts,"collectHosts");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/cluster",
-  "version": "1.25.17",
+  "version": "1.25.21",
   "description": "Run your Nx workspace as a local production cluster: pods on unix sockets with true HMR, one https gateway with per-project domains, scale-from-zero, autoscale, idle-kill, local-CA TLS — observed by the LensMCP lens.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -58,9 +58,9 @@
     }
   },
   "dependencies": {
-    "@lensmcp/core": "1.25.17",
-    "@lensmcp/node-instrumentation": "1.25.17",
-    "@lensmcp/nx-plugin": "1.25.17",
+    "@lensmcp/core": "1.25.21",
+    "@lensmcp/node-instrumentation": "1.25.21",
+    "@lensmcp/nx-plugin": "1.25.21",
     "fastify": "^5.8.5",
     "@fastify/reply-from": "^12.6.2",
     "@typescript/native-preview": "^7.0.0-dev.20260707.2",

package/shared-build/protocol.d.ts

@@ -9,7 +9,7 @@
  * account to connect to. These are the messages; nothing here touches a process.
  */
 import type { DevWebpackOptions } from '../create-webpack-dev';
-/** The gateway's switch: `LENSMCP_SHARED_COMPILER=1` turns the shared compiler on, `0` off. */
+/** The gateway's switch: `LENSMCP_SHARED_COMPILER=0` turns the shared compiler off, `1` on. */
 export declare const SHARED_COMPILER_ENV = "LENSMCP_SHARED_COMPILER";
 /** Set by the gateway on a runner whose build-host messages it relays — the serve executor attaches only then. */
 export declare const SHARED_BUILD_ENV = "LENSMCP_SHARED_BUILD";
@@ -19,8 +19,14 @@ export declare const SHARED_BUILD_CHANNEL = "lensmcp-shared-build";
 export declare const BUILD_HOST_ROLE = "build";
 /** The argument that names the build host's workspace on its command line — always the LAST one (the reaper matches it exactly). */
 export declare const BUILD_HOST_ROOT_FLAG = "--workspace-root=";
-/** Default when the variable is unset. */
-export declare const SHARED_COMPILER_DEFAULT = false;
+/**
+ * Default when the variable is unset: ON since 2026-10-22. The owner, starting a worktree's services beside the main
+ * checkout's: «we need a way to share the builder so it will not oom». FoodGuard's main checkout ran nine watchers of
+ * 150–763 MB (3.1 GB, footprint); a worktree that starts its services would add as many again. One compilation per
+ * checkout is the projected ~1.2 GB. A checkout's modules are its own paths, so main and a worktree cannot share one
+ * compilation: each checkout keeps its own build host.
+ */
+export declare const SHARED_COMPILER_DEFAULT = true;
 /** Is the shared compiler on? The variable wins; else the gateway option; else {@link SHARED_COMPILER_DEFAULT}. */
 export declare function sharedCompilerEnabled(env?: NodeJS.ProcessEnv, option?: boolean): boolean;
 /** What a runner hands the build host: everything the host needs to build this service's config itself. */

package/shared-build/protocol.js

@@ -1 +1 @@
-"use strict";var _=Object.defineProperty;var r=(t,e)=>_(t,"name",{value:e,configurable:!0});var o=Object.defineProperty,s=r((t,e)=>o(t,"name",{value:e,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.SHARED_COMPILER_DEFAULT=exports.BUILD_HOST_ROOT_FLAG=exports.BUILD_HOST_ROLE=exports.SHARED_BUILD_CHANNEL=exports.SHARED_BUILD_ENV=exports.SHARED_COMPILER_ENV=void 0,exports.sharedCompilerEnabled=sharedCompilerEnabled,exports.isRunnerJoinMessage=isRunnerJoinMessage,exports.isRunnerInbound=isRunnerInbound,exports.buildHostArgs=buildHostArgs,exports.isBuildHostCommandOf=isBuildHostCommandOf,exports.SHARED_COMPILER_ENV="LENSMCP_SHARED_COMPILER",exports.SHARED_BUILD_ENV="LENSMCP_SHARED_BUILD",exports.SHARED_BUILD_CHANNEL="lensmcp-shared-build",exports.BUILD_HOST_ROLE="build",exports.BUILD_HOST_ROOT_FLAG="--workspace-root=";const ON=/^(1|on|true|yes)$/i,OFF=/^(0|off|false|no)$/i;exports.SHARED_COMPILER_DEFAULT=!1;function sharedCompilerEnabled(t=process.env,e){const n=(t[exports.SHARED_COMPILER_ENV]??"").trim();return ON.test(n)?!0:OFF.test(n)?!1:e??exports.SHARED_COMPILER_DEFAULT}r(sharedCompilerEnabled,"sharedCompilerEnabled"),s(sharedCompilerEnabled,"sharedCompilerEnabled");function isRunnerJoinMessage(t){const e=t;return!!e&&e.channel===exports.SHARED_BUILD_CHANNEL&&e.type==="join"&&typeof e.join?.project=="string"}r(isRunnerJoinMessage,"isRunnerJoinMessage"),s(isRunnerJoinMessage,"isRunnerJoinMessage");function isRunnerInbound(t){const e=t;return!!e&&e.channel===exports.SHARED_BUILD_CHANNEL&&typeof e.event?.type=="string"}r(isRunnerInbound,"isRunnerInbound"),s(isRunnerInbound,"isRunnerInbound");function buildHostArgs(t){return["host",`${exports.BUILD_HOST_ROOT_FLAG}${t.replace(/\/+$/,"")}`]}r(buildHostArgs,"buildHostArgs"),s(buildHostArgs,"buildHostArgs");function isBuildHostCommandOf(t,e){return/\bbuild-host\.(js|ts)\b/.test(t)&&t.trimEnd().endsWith(` ${exports.BUILD_HOST_ROOT_FLAG}${e.replace(/\/+$/,"")}`)}r(isBuildHostCommandOf,"isBuildHostCommandOf"),s(isBuildHostCommandOf,"isBuildHostCommandOf");
+"use strict";var _=Object.defineProperty;var r=(t,e)=>_(t,"name",{value:e,configurable:!0});var o=Object.defineProperty,s=r((t,e)=>o(t,"name",{value:e,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.SHARED_COMPILER_DEFAULT=exports.BUILD_HOST_ROOT_FLAG=exports.BUILD_HOST_ROLE=exports.SHARED_BUILD_CHANNEL=exports.SHARED_BUILD_ENV=exports.SHARED_COMPILER_ENV=void 0,exports.sharedCompilerEnabled=sharedCompilerEnabled,exports.isRunnerJoinMessage=isRunnerJoinMessage,exports.isRunnerInbound=isRunnerInbound,exports.buildHostArgs=buildHostArgs,exports.isBuildHostCommandOf=isBuildHostCommandOf,exports.SHARED_COMPILER_ENV="LENSMCP_SHARED_COMPILER",exports.SHARED_BUILD_ENV="LENSMCP_SHARED_BUILD",exports.SHARED_BUILD_CHANNEL="lensmcp-shared-build",exports.BUILD_HOST_ROLE="build",exports.BUILD_HOST_ROOT_FLAG="--workspace-root=";const ON=/^(1|on|true|yes)$/i,OFF=/^(0|off|false|no)$/i;exports.SHARED_COMPILER_DEFAULT=!0;function sharedCompilerEnabled(t=process.env,e){const n=(t[exports.SHARED_COMPILER_ENV]??"").trim();return ON.test(n)?!0:OFF.test(n)?!1:e??exports.SHARED_COMPILER_DEFAULT}r(sharedCompilerEnabled,"sharedCompilerEnabled"),s(sharedCompilerEnabled,"sharedCompilerEnabled");function isRunnerJoinMessage(t){const e=t;return!!e&&e.channel===exports.SHARED_BUILD_CHANNEL&&e.type==="join"&&typeof e.join?.project=="string"}r(isRunnerJoinMessage,"isRunnerJoinMessage"),s(isRunnerJoinMessage,"isRunnerJoinMessage");function isRunnerInbound(t){const e=t;return!!e&&e.channel===exports.SHARED_BUILD_CHANNEL&&typeof e.event?.type=="string"}r(isRunnerInbound,"isRunnerInbound"),s(isRunnerInbound,"isRunnerInbound");function buildHostArgs(t){return["host",`${exports.BUILD_HOST_ROOT_FLAG}${t.replace(/\/+$/,"")}`]}r(buildHostArgs,"buildHostArgs"),s(buildHostArgs,"buildHostArgs");function isBuildHostCommandOf(t,e){return/\bbuild-host\.(js|ts)\b/.test(t)&&t.trimEnd().endsWith(` ${exports.BUILD_HOST_ROOT_FLAG}${e.replace(/\/+$/,"")}`)}r(isBuildHostCommandOf,"isBuildHostCommandOf"),s(isBuildHostCommandOf,"isBuildHostCommandOf");