@lensmcp/cluster 1.25.2 → 1.25.3

package/executors/gateway/runtime/lifecycle.d.ts

@@ -328,6 +328,18 @@ export interface ServiceLayerDeps {
     /** The shared compiler's relay. Default one for this runtime ({@link createSharedBuildRelay}). */
     sharedBuild?: SharedBuildRelay;
 }
+/**
+ * The source-set change a pod is judged by (issues/closed/foodguard-76): its own scope's — and, once its scope has been
+ * diffed, NONE when nothing changed in it. The workspace-wide clock is the fallback only for a project the scanner
+ * could not scope (no project root) or has not diffed yet. It used to be the fallback for any project without a scoped
+ * stamp — and a project gets one only when ITS scope changes — so one file added in engine's scope recycled six
+ * unrelated FoodGuard services (knowledge, processor, audit, auth, plan, iam) whose scopes had never changed.
+ */
+export declare function podChangeClock(rt: Pick<GatewayRuntime, 'sourceSetChangedFor' | 'sourceSetChangesFor' | 'sourceSetScoped' | 'sourceSetChangedAt' | 'sourceSetChange'>, project: string): {
+    at: number;
+    change?: SourceSetChange;
+    scope: 'project' | 'workspace' | 'none';
+};
 export declare function createServiceLayer(rt: GatewayRuntime, obs: Observability, deps?: ServiceLayerDeps): ServiceLayer;
 /**
  * Which pid — if any — may be signalled to evict a stale adopted pod.

package/executors/gateway/runtime/lifecycle.js

@@ -1,3 +1,3 @@
-"use strict";var Ve=Object.defineProperty;var v=(t,a)=>Ve(t,"name",{value:a,configurable:!0});var Ge=Object.defineProperty,s=v((t,a)=>Ge(t,"name",{value:a,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.scaleTarget=scaleTarget,exports.isLoopbackHostname=isLoopbackHostname,exports.isOwnRunnerCommand=isOwnRunnerCommand,exports.isRunnerOf=isRunnerOf,exports.isTestSourcePath=isTestSourcePath,exports.sourceScanPass=sourceScanPass,exports.sourceSetSnapshot=sourceSetSnapshot,exports.sourceSetSignature=sourceSetSignature,exports.diffSourceSets=diffSourceSets,exports.sourceChangeWindowMs=sourceChangeWindowMs,exports.sourceScopeDirs=sourceScopeDirs,exports.podRecycleReason=podRecycleReason,exports.lensFrontendStale=lensFrontendStale,exports.lensWatcherVerdict=lensWatcherVerdict,exports.podWatcherVerdict=podWatcherVerdict,exports.lensChildWedged=lensChildWedged,exports.isPortConflictExit=isPortConflictExit,exports.createServiceLayer=createServiceLayer,exports.chooseStalePodKillTarget=chooseStalePodKillTarget;const tslib_1=require("tslib"),node_child_process_1=require("node:child_process"),node_crypto_1=require("node:crypto"),fs=tslib_1.__importStar(require("node:fs")),http=tslib_1.__importStar(require("node:http")),net=tslib_1.__importStar(require("node:net")),path=tslib_1.__importStar(require("node:path")),node_util_1=require("node:util"),discovery_1=require("./discovery"),pod_sock_1=require("../../../pod-sock"),scope_1=require("./scope"),pod_env_1=require("./pod-env"),pod_probe_1=require("./pod-probe"),service_keys_1=require("./service-keys"),workspace_log_1=require("./workspace-log"),inspector_secret_1=require("../../../inspector-secret"),pod_output_1=require("./pod-output"),serve_launch_1=require("./serve-launch"),shared_build_1=require("./shared-build"),protocol_1=require("../../../shared-build/protocol"),types_1=require("./types"),exit_reason_1=require("../../../exit-reason"),handoff_retire_1=require("../../../handoff-retire"),process_name_1=require("../../../process-name");function eastWestEnv(t,a){const i={},d=t.serviceKeys[(0,service_keys_1.serviceKeyId)(a.wsKey,a.project)];if(d&&(i.LENSMCP_SERVICE_KEY=d),t.https){const f=require("../../../basic-ssl").caCertPath();fs.existsSync(f)&&(i.NODE_EXTRA_CA_CERTS=f)}return i}v(eastWestEnv,"eastWestEnv"),s(eastWestEnv,"eastWestEnv");const sleep=s(t=>new Promise(a=>setTimeout(a,t)),"sleep"),SRC_EXCLUDE=new Set(["node_modules","dist","tmp","coverage","build","out","target"]),SRC_EXT=new Set([".ts",".tsx",".js",".jsx",".mjs",".cjs",".css",".scss",".sass",".less",".json",".html",".htm",".vue",".svelte",".mdx"]),SCAN_FILE_CAP=1e5;function fnv1a(t){let a=2166136261;for(let i=0;i<t.length;i+=1)a^=t.charCodeAt(i),a=Math.imul(a,16777619);return a>>>0}v(fnv1a,"fnv1a"),s(fnv1a,"fnv1a");const execFileP=(0,node_util_1.promisify)(node_child_process_1.execFile);async function gitIgnoredPaths(t){try{const{stdout:a}=await execFileP("git",["ls-files","--others","--directory","--ignored","--exclude-standard","-z"],{cwd:t,maxBuffer:33554432,timeout:1e4,windowsHide:!0});return new Set(a.split("\0").filter(Boolean))}catch{return new Set}}v(gitIgnoredPaths,"gitIgnoredPaths"),s(gitIgnoredPaths,"gitIgnoredPaths");function scaleTarget(t,a=fs.existsSync){if(t.decl.adminUrl)return{url:t.decl.adminUrl};const i=path.join(t.pool.dir,"parent.sock");return a(i)?{socketPath:i}:t.decl.port?{url:`http://localhost:${t.decl.port}`}:void 0}v(scaleTarget,"scaleTarget"),s(scaleTarget,"scaleTarget");function isLoopbackHostname(t){const a=t.toLowerCase().replace(/^\[(.*)\]$/,"$1").replace(/\.$/,"");return a==="localhost"||a.endsWith(".localhost")?!0:net.isIPv4(a)?a.split(".")[0]==="127":net.isIPv6(a)&&new URL(`http://[${a}]/`).hostname==="[::1]"}v(isLoopbackHostname,"isLoopbackHostname"),s(isLoopbackHostname,"isLoopbackHostname");function postScale(t,a,i){let d;if("socketPath"in t)d=http.request({socketPath:t.socketPath,path:"/webpack/scale",method:"POST",headers:{"content-type":"application/json"}},f=>f.resume());else{const f=t.url.startsWith("https"),T=f?require("node:https"):http,y={method:"POST"};f&&isLoopbackHostname(new URL(t.url).hostname)&&(y.rejectUnauthorized=!1),i&&(y.lookup=i),d=T.request(`${t.url}/webpack/scale`,y,_=>_.resume())}return d.on("error",()=>{}),d.end(JSON.stringify({pods:a})),d}v(postScale,"postScale"),s(postScale,"postScale");function isOwnRunnerCommand(t,a){return(0,serve_launch_1.isServeRunnerCommand)(t)?(0,serve_launch_1.isServeRunnerCommandOf)(t,a):t.includes("/node_modules/nx/")?t.includes(`${a.replace(/\/+$/,"")}/node_modules/nx/`):!0}v(isOwnRunnerCommand,"isOwnRunnerCommand"),s(isOwnRunnerCommand,"isOwnRunnerCommand");function isRunnerOf(t,a,i){const d=a.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");return!new RegExp(`(^|\\s)run ${d}(:|\\s|$)`).test(t)||!(0,serve_launch_1.isServeRunnerCommand)(t)&&!/\bnx(\.js)?\b/.test(t)?!1:isOwnRunnerCommand(t,i)}v(isRunnerOf,"isRunnerOf"),s(isRunnerOf,"isRunnerOf");const TEST_FILE_RE=/\.(spec|test|e2e|e2e-spec|stories)\.[cm]?[jt]sx?$/,TEST_DIR_SEGMENTS=new Set(["__tests__","__mocks__","__snapshots__"]);function isTestSourcePath(t){const a=t.split("/"),i=a[a.length-1]??"";if(TEST_FILE_RE.test(i))return!0;for(let d=0;d<a.length-1;d+=1)if(TEST_DIR_SEGMENTS.has(a[d]))return!0;return!1}v(isTestSourcePath,"isTestSourcePath"),s(isTestSourcePath,"isTestSourcePath");function sourceScanPass(t,a,i){const d=i?.ignoreTests??!0;let f;const T=new Map,y=`tree:${path.resolve(t)}`,_=s(g=>path.relative(t,g).split(path.sep).join("/"),"rel"),C=s(async(g,S)=>{const $=await(f??=gitIgnoredPaths(t)),L=[],I=new Set;let P=!1;const G=s(async(Q,w)=>{if(L.length>=SCAN_FILE_CAP){P=!0;return}let O;try{O=await fs.promises.readdir(Q,{withFileTypes:!0})}catch{return}w&&I.add(_(Q));for(const B of O){if(L.length>=SCAN_FILE_CAP){P=!0;return}const N=B.name,Z=path.join(Q,N);if(B.isDirectory()){if(!w||N.startsWith(".")||SRC_EXCLUDE.has(N)||a?.has(N)||N.endsWith("-devserver")||$.has(`${_(Z)}/`))continue;await G(Z,!0)}else if(B.isFile()){const ee=N.lastIndexOf(".");if(ee<=0||!SRC_EXT.has(N.slice(ee)))continue;const X=_(Z);if($.has(X)||d&&isTestSourcePath(X))continue;L.push(X)}}},"walk");return await G(g,S),{paths:L,entered:I,truncated:P}},"walkDir"),b=s((g,S)=>{let $=T.get(g);return $||($=S(),T.set(g,$)),$},"memo"),se=s(async()=>{const g=T.get(y);if(!g)return;const S=await g;return S.truncated?void 0:S},"wideWalk"),J=new Set,ne=s(()=>b(`files:${path.resolve(t)}`,async()=>{const g=await se();return g?{paths:g.paths.filter(S=>!S.includes("/")),entered:J,truncated:!1}:C(t,!1)}),"rootFiles"),ae=s(g=>b(`tree:${path.resolve(g)}`,async()=>{const S=await se(),$=_(g);if(S?.entered.has($)){const L=`${$}/`;return{paths:$===""?S.paths:S.paths.filter(I=>I.startsWith(L)),entered:J,truncated:!1}}return C(g,!0)}),"subtree"),U=s(g=>{const S=new Set;let $=0,L=g.some(P=>P.truncated);const I=s(P=>S.has(P)?!0:S.size>=SCAN_FILE_CAP?(L=!0,!1):(S.add(P),$^=fnv1a(P),!0),"add");for(const P of g)if(!P.paths.every(I))break;return{signature:`${S.size}:${($>>>0).toString(36)}`,paths:S,truncated:L}},"compose");return{async snapshot(g){if(!g||g.length===0)return U([await b(y,()=>C(t,!0))]);const S=[await ne()];for(const $ of g)S.push(await ae($));return U(S)}}}v(sourceScanPass,"sourceScanPass"),s(sourceScanPass,"sourceScanPass");async function sourceSetSnapshot(t,a,i,d){return sourceScanPass(t,i,d).snapshot(a)}v(sourceSetSnapshot,"sourceSetSnapshot"),s(sourceSetSnapshot,"sourceSetSnapshot");async function sourceSetSignature(t,a,i,d){return(await sourceSetSnapshot(t,a,i,d)).signature}v(sourceSetSignature,"sourceSetSignature"),s(sourceSetSignature,"sourceSetSignature");const SOURCE_DIFF_PATH_CAP=128;function diffSourceSets(t,a,i,d){if(t.paths.size===a.paths.size){let _=!0;for(const C of t.paths)if(!a.paths.has(C)){_=!1;break}if(_)return null}const f=[],T=[];let y=t.truncated||a.truncated;for(const _ of a.paths)t.paths.has(_)||(f.length+T.length<SOURCE_DIFF_PATH_CAP?f.push(_):y=!0);for(const _ of t.paths)a.paths.has(_)||(f.length+T.length<SOURCE_DIFF_PATH_CAP?T.push(_):y=!0);return{changedAt:i,added:f,removed:T,truncated:y,...d!==void 0?{windowMs:d}:{}}}v(diffSourceSets,"diffSourceSets"),s(diffSourceSets,"diffSourceSets");function sourceChangeWindowMs(t,a,i,d){const f=a&&a>0?t-a:i;return Math.max(f,i)+d}v(sourceChangeWindowMs,"sourceChangeWindowMs"),s(sourceChangeWindowMs,"sourceChangeWindowMs");function sourceScopeDirs(t,a,i,d,f){const T=s(C=>{const b=path.relative(t,C).split(path.sep).filter(Boolean);return b.length===0||b[0].startsWith("..")?"":b[0]},"bucketOf")(a);if(!T)return[];const y=new Set(i.filter(Boolean)),_=new Set([T]);for(const C of d)C.startsWith(".")||SRC_EXCLUDE.has(C)||f?.has(C)||C.endsWith("-devserver")||y.has(C)||_.add(C);return[..._].sort().map(C=>path.join(t,C))}v(sourceScopeDirs,"sourceScopeDirs"),s(sourceScopeDirs,"sourceScopeDirs");function podRecycleReason(t,a,i,d){return!t.proc||t.state!=="up"||t.spawnAt==null||t.inflight>0||(t.activeWork??0)>0||a-t.lastUsed<d.settleMs||t.lastStaleRecycleAt!=null&&a-t.lastStaleRecycleAt<d.cooldownMs?null:i>0&&i-t.spawnAt>d.graceMs?"stale-source-set":d.maxAgeMs>0&&a-t.spawnAt>d.maxAgeMs?"max-age":null}v(podRecycleReason,"podRecycleReason"),s(podRecycleReason,"podRecycleReason");function lensFrontendStale(t,a,i,d,f){return!(d-a<f.cooldownMs||i<=0||i-t<=f.graceMs||d-i<f.settleMs)}v(lensFrontendStale,"lensFrontendStale"),s(lensFrontendStale,"lensFrontendStale");function lensWatcherVerdict(t,a,i,d=[]){if(!t)return"unknown";if("schemaVersion"in t&&t.schemaVersion>=2&&d.length>0){const f=a-i,T=new Set(t.recentEvents.filter(y=>y.at>=f).map(y=>path.resolve(y.path)));return d.every(y=>T.has(path.resolve(y)))?"heard":"missed"}return t.lastFsSetEventAt>=a-i?"heard":"missed"}v(lensWatcherVerdict,"lensWatcherVerdict"),s(lensWatcherVerdict,"lensWatcherVerdict");function podWatcherVerdict(t,a,i){if(!t)return"unknown";if(t.degraded)return"degraded";const d=a-i;return t.lastWatchRunAt>=d||t.lastBuildAt>=d?"heard":"silent"}v(podWatcherVerdict,"podWatcherVerdict"),s(podWatcherVerdict,"podWatcherVerdict");function lensChildWedged(t,a,i,d){const f=t.hasListened?d.graceMs:Math.max(d.graceMs,d.neverListenedGraceMs);return i-t.spawnedAt<f||i-a<d.cooldownMs||t.probeFails<Math.max(2,d.failureThreshold)?null:"wedged-no-listener"}v(lensChildWedged,"lensChildWedged"),s(lensChildWedged,"lensChildWedged");function isPortConflictExit(t,a){return t.signal||t.code===null||t.code===0||t.ranMs>a.fastFailMs?!1:t.portHeld}v(isPortConflictExit,"isPortConflictExit"),s(isPortConflictExit,"isPortConflictExit");function createServiceLayer(t,a,i={}){const d=i.spawnProcess??node_child_process_1.spawn,f=i.probeAlive??pod_probe_1.probePodAlive,T=i.killTree??((e,o="SIGTERM")=>{try{process.kill(-e.pid,o)}catch{try{e.kill(o)}catch{}}}),y=i.sharedBuild??(0,shared_build_1.createSharedBuildRelay)(t),_=s((e,o="SIGTERM")=>{y.detach(e),T(e,o)},"killTree"),C=i.handoffDrainMs??(0,handoff_retire_1.handoffDrainBoundMs)(),b=i.treeAlive??(e=>{if(!e.pid)return!1;try{return process.kill(-e.pid,0),!0}catch(o){return o.code==="EPERM"}}),se=i.retirePollMs??1e3,J=i.rollReadyMs??types_1.POD_ROLL_READY_MS,ne=i.rollPollMs??750,ae=i.maxConcurrentRolls??types_1.POD_MAX_CONCURRENT_ROLLS,U=ae>0?ae:Number.POSITIVE_INFINITY,g=i.maxConcurrentColdStarts??types_1.MAX_COLD_STARTS,S=g>0?g:Number.POSITIVE_INFINITY;let $=0;const L=[],I=s(()=>$<S?($+=1,Promise.resolve()):new Promise(e=>{L.push(()=>{$+=1,e()})}),"acquireColdSlot"),P=s(()=>{$-=1,L.shift()?.()},"releaseColdSlot"),{emit:G}=a,Q=s(e=>e.wsKey===t.wsKey?void 0:path.join(e.root,".lensmcp","events.jsonl"),"serviceBus"),w=s((e,o,n,r,c)=>G(o,n,r,{wsKey:e.wsKey,...c},void 0,Q(e)),"emitSvc"),O=s(e=>(e.scannedAt=0,(0,discovery_1.pickSock)(e,t.scanTtlMs)?e.socks.length:0),"scanNow"),B=s((e,o)=>{let n;try{n=(0,node_child_process_1.execFileSync)("ps",["ax","-ww","-o","pid=,pgid=,command="],{encoding:"utf8",timeout:5e3})}catch{return 0}const r=e.proc?.pid;let c=0;for(const l of n.split(`
-`)){const p=l.match(/^\s*(\d+)\s+(\d+)\s+(.*)$/);if(!p)continue;const u=Number(p[1]),R=Number(p[2]);if(isRunnerOf(p[3],o,e.root)&&!(u===process.pid||u===r)&&!(r!==void 0&&R===r)){try{process.kill(-R,"SIGKILL")}catch{try{process.kill(u,"SIGKILL")}catch{}}c+=1}}return c>0&&(console.log(`[gateway] ${o}: reaped ${c} stale runner tree(s) \u2014 a foreign generation of this service (holding nx's task lock, or its pool)`),w(e,"warning",`stale-runner reap: ${e.project} (${c} foreign tree(s))`,`cluster-service:${e.project}`,{kind:"stale-runner-reap",project:e.project,reaped:c})),c},"reapForeignRunners"),N=s((e,o)=>({...(0,pod_env_1.podBaseEnv)(process.env,t.root,e.root),...e.instanceEnv?{...e.instanceEnv,LENSMCP_SOCKET_ONLY:"1"}:{},...e.frozen?{LENSMCP_FREEZE:"1",LENSMCP_TYPECHECK:"off"}:{},NX_DAEMON:"false",NX_ISOLATE_PLUGINS:"false",...e.wsKey?{LENSMCP_WS_KEY:e.wsKey}:{},...e.sockNs?{LENSMCP_SOCK_NS:e.sockNs}:{},LENSMCP_EVENT_FILE:e.wsKey===t.wsKey?t.eventFile:path.join(e.root,".lensmcp","events.jsonl"),LENSMCP_GATEWAY_PID:String(process.pid),LENSMCP_POD_GENERATION:String(o),...eastWestEnv(t,e)}),"serviceEnv"),Z=s((e,o,n,r)=>{const c=N(e,o),l=e.wsKey||path.basename(e.root),p=(0,serve_launch_1.planServeLaunch)({stores:t.graphStores,root:e.root,project:e.project,target:e.decl.serveTarget??"serve-hmr",childCount:r,baseEnv:c});if(p.kind==="runner"){const h=y.offeredTo(e),E=d((0,process_name_1.namedExecPath)((0,process_name_1.processName)(l,e.project,serve_launch_1.SERVE_RUNNER_ROLE)),[...p.script.execArgv,p.script.path,...(0,serve_launch_1.serveRunnerArgs)(n,r,e.root)],{cwd:e.root,detached:!0,env:h?{...p.env,[protocol_1.SHARED_BUILD_ENV]:"1"}:p.env,stdio:["ignore","pipe","pipe","ipc"]});return h&&y.attach(e,o,E),E.send?.(p.message,k=>{k&&console.error(`[gateway] ${n}: could not hand the task to its runner (${k.message})`)}),{proc:E,launcher:"runner"}}console.log(`[gateway] ${n}: starting through nx run \u2014 ${p.reason}`);const u=path.join(e.root,"node_modules","nx","dist","bin","nx.js"),R=(0,process_name_1.namedExecPath)((0,process_name_1.processName)(l,e.project,"nx")),[M,m]=fs.existsSync(u)?[R,[u,"run",n,`--childCount=${r}`]]:["yarn",["nx","run",n,`--childCount=${r}`]];return{proc:d(M,m,{cwd:e.root,detached:!0,env:c,stdio:["ignore","pipe","pipe"]}),launcher:"nx"}},"startServiceTree"),ee=new WeakMap,X=s((e,o,n)=>{const r=`${e.project}:${e.decl.serveTarget??"serve-hmr"}`,c=Math.max(1,e.decl.minPods??1),{proc:l,launcher:p}=Z(e,o,r,c);ee.set(l,p),n==="active"&&(e.launcher=p),n==="active"&&(e.lastErrors=[],e.buildFailed=!1,e.faults=new pod_output_1.PodFaults);const u=s(m=>{const h=m.toString();for(const E of h.split(`
-`)){const k=(0,pod_output_1.classifyPodLine)(E),{clean:A,broken:F,healthy:j}=k,W=A;if(F){e.lastErrors.push(A),e.lastErrors.length>12&&e.lastErrors.shift(),e.buildFailed=!0;const D=Date.now();(A!==e.lastErrorEmitSig||D-(e.lastErrorEmitAt??0)>=types_1.SERVICE_ERROR_THROTTLE_MS)&&(e.lastErrorEmitSig=A,e.lastErrorEmitAt=D,w(e,"error",`service error: ${e.project}`,`cluster-service:${e.project}`,{kind:"service-error",project:e.project,line:A,fault:k.fault}))}j&&(e.buildFailed=!1);const x=(e.faults??=new pod_output_1.PodFaults).observe(k);if(x){e.lastErrorEmitSig=void 0;const D=x.open.length===0;w(e,"info",`${D?"service recovered":`${x.closed.join(" + ")} recovered`}: ${e.project}`,`cluster-service:${e.project}`,{kind:D?"service-recovered":"service-fault-closed",project:e.project,line:A,closed:x.closed,open:x.open})}!e.lockBlockedAt&&/Waiting for .+ in another nx process/.test(W)&&(e.lockBlockedAt=Date.now(),console.log(`[gateway] ${r}: spawn blocked by a stale nx runner \u2014 breaking the lock + respawning`),w(e,"warning",`nx task lock: ${e.project} blocked by a stale runner \u2014 auto-breaking`,`cluster-service:${e.project}`,{kind:"nx-lock-break",project:e.project}),setTimeout(()=>{t.stopped()||!e.lockBlockedAt||(K(e,"parked on a foreign nx task lock \u2014 recycling",{announce:!1}),B(e,r),setTimeout(()=>{!t.stopped()&&!e.proc&&e.state==="down"&&V(e)},1500).unref?.())},250).unref?.())}},"sniff"),R=e.wsKey&&e.wsKey!==t.wsKey&&e.root?(0,workspace_log_1.workspaceLogWriter)(e.root):void 0,M=s(m=>h=>{if(t.stopped())return;const E=(0,inspector_secret_1.redactInspectorUrls)(h.toString());u(E);const k=`[${e.project}] ${E}`;m.write(k),R?.(k)},"relay");return l.stdout?.on("data",M(process.stdout)),l.stderr?.on("data",M(process.stderr)),l.on("exit",(m,h)=>{if(e.proc!==l||(e.proc=void 0,e.state="down",t.stopped()))return;const E=(0,exit_reason_1.describeExit)(m,h);if(console.log(`[gateway] ${r} exited (${m??"no code"}${h?`, ${h}`:""}${e.inflight?`, ${e.inflight} request(s) in flight`:""})${E?` \u2014 ${E}`:""}`),w(e,m===0?"info":"warning",`service down: ${e.project} (exit ${m})`,`cluster-service:${e.project}`,{kind:"service-down",project:e.project,code:m,...h?{signal:h}:{}}),m===0||e.buildFailed)return;const k=Date.now();if(e.restarts=(e.restarts??[]).filter(F=>k-F<types_1.SERVICE_RESTART_WINDOW_MS),e.restarts.length>=types_1.SERVICE_MAX_RESTARTS){w(e,"error",`service crash-looping: ${e.project} \u2014 ${types_1.SERVICE_MAX_RESTARTS}+ restarts/min, not auto-respawning (the next request retries)`,`cluster-service:${e.project}`,{kind:"service-crash-loop",project:e.project});return}e.restarts.push(k);const A=Math.min(8e3,500*2**(e.restarts.length-1));setTimeout(()=>{t.stopped()||e.proc||e.state!=="down"||(console.log(`[gateway] self-heal: respawning ${e.project} (restart ${e.restarts.length}/${types_1.SERVICE_MAX_RESTARTS})`),w(e,"info",`self-heal: respawning ${e.project}`,`cluster-service:${e.project}`,{kind:"service-respawn",project:e.project,attempt:e.restarts.length}),V(e))},A)}),l},"launchServiceProcess"),V=s(e=>{if(t.stopped())return;const o=`${e.project}:${e.decl.serveTarget??"serve-hmr"}`,n=Math.max(1,e.decl.minPods??1);i.reapForeign!==!1&&B(e,o),e.lockBlockedAt=void 0,console.log(`[gateway] starting ${o} (pods=${n})\u2026`),w(e,"info",`service starting: ${e.project} (${n} pod${n>1?"s":""})`,`cluster-service:${e.project}`,{kind:"service-starting",project:e.project,pods:n}),e.state="starting",e.spawnAt=Date.now(),e.generation=(e.generation??0)+1,e.proc=X(e,e.generation,"active")},"spawnService"),Ee=s(async e=>{const o=e.pool.socks[0];if(!o)return;const n=await(0,pod_probe_1.probePodAlive)(o,void 0,t.serviceKeys[(0,service_keys_1.serviceKeyId)(e.wsKey,e.project)]);n&&(e.activeWork=n.activeWork,n.watcher&&(e.watcher=n.watcher))},"refreshActiveWork"),ke=s(e=>{try{const o=Number(fs.readFileSync(`${e}.owner`,"utf8").trim());return Number.isInteger(o)&&o>1?o:void 0}catch{return}},"readOwnerSidecar"),je=s(async e=>{const o=t.serviceKeys[(0,service_keys_1.serviceKeyId)(e.wsKey,e.project)];if(!o)return[];const n=(0,node_crypto_1.createHash)("sha256").update(o).digest("hex").slice(0,8),r=[];for(const c of e.pool.socks){const l=await(0,pod_probe_1.probePodAlive)(c,void 0,o);l&&(!l.keyFingerprint||l.keyFingerprint!==n)&&r.push({sock:c,pid:l.pid})}return r},"staleAdoptedSocks"),Re=s((e,o)=>{const n=o.map(r=>r.sock);for(const{sock:r,pid:c}of o){const l=chooseStalePodKillTarget(c,ke(r),process.pid);if(l!==void 0)try{process.kill(l,"SIGTERM")}catch{}try{fs.unlinkSync(r)}catch{}try{fs.unlinkSync(`${r}.owner`)}catch{}}e.pool.socks=e.pool.socks.filter(r=>!n.includes(r)),e.pool.idx=-1,e.pool.scannedAt=0},"evictStaleAdopted"),ce=s((e,o)=>{if(e.state==="up")return!1;e.state="up",e.wedgeRecycles=0;const n=e.pool.socks.length;return w(e,"info",`service up: ${e.project} (${n} pods, ${o})`,`cluster-service:${e.project}`,{kind:"service-up",project:e.project,pods:n,adopted:o==="adopted"}),!0},"markUp"),de=s(async e=>{if(O(e.pool)>0){const r=await je(e);if(r.length>0&&(console.error(`[gateway] ${e.project}: ${r.length} adopted pod(s) hold a foreign east-west key \u2014 evicting instead of adopting.`),w(e,"warning",`stale adoption: ${e.project} (foreign east-west key)`,`cluster-service:${e.project}`,{kind:"pod-recycle",project:e.project,reason:"stale-adoption",pods:r.length}),e.proc&&K(e,"stale adoption (foreign east-west key)"),Re(e,r)),e.pool.socks.length>0)return ce(e,"adopted"),!0}if(t.stopped())return!1;let o=!1;const n=s(()=>e.state!=="starting"&&!e.proc,"notStarted");if(n())if(e.coldWait)await e.coldWait;else{$>=S&&(console.log(`[gateway] cold start queued: ${e.project}${e.wsKey&&e.wsKey!==t.wsKey?` (${e.wsKey})`:""} \u2014 ${$} starting, ${L.length} ahead (LENSMCP_MAX_COLD_STARTS=${S}).`),w(e,"info",`cold start queued: ${e.project}`,`cluster-service:${e.project}`,{kind:"cold-start-queued",project:e.project,inFlight:$,ahead:L.length}));const r=I();if(e.coldWait=r,await r,e.coldWait=void 0,o=!0,t.stopped())return P(),!1;n()&&V(e)}try{return await Ce(e)}finally{o&&P()}},"ensureUp"),Ce=s(async e=>{const o=Date.now()+t.startupTimeoutMs,n=Date.now()+12e3;for(;!t.stopped()&&Date.now()<o;){if(await sleep(Math.min(700,t.startupTimeoutMs/4)),e.buildFailed&&Date.now()>n)return!1;if(O(e.pool)>0){e.state="up",e.buildFailed=!1;const r=e.spawnAt?Date.now()-e.spawnAt:void 0;return console.log(`[gateway] ${e.project} up (${e.pool.socks.length} pods${r?`, cold start ${r}ms`:""})`),w(e,"info",`cold start: ${e.project} (${e.pool.socks.length} pods, ${r??"?"}ms)`,`cluster-service:${e.project}`,{kind:"cold-start",project:e.project,pods:e.pool.socks.length,durationMs:r}),!0}if(e.state==="down")return!1}return!1},"waitForPods"),Te=s(e=>{const o=e.decl.maxPods??e.decl.minPods??1,n=e.pool.socks.length,r=scaleTarget(e);!r||n===0||n>=o||e.inflight<=n||Date.now()-e.lastScaleAt<5e3||(e.lastScaleAt=Date.now(),postScale(r,n+1,i.scaleLookup),console.log(`[gateway] autoscale ${e.project}: ${n} \u2192 ${n+1} pods (inflight ${e.inflight})`),w(e,"info",`autoscale: ${e.project} ${n} \u2192 ${n+1} pods`,`cluster-service:${e.project}`,{kind:"autoscale",project:e.project,from:n,to:n+1,inflight:e.inflight}))},"scaleUp"),K=s((e,o,n)=>{if(!e.proc)return;console.log(`[gateway] ${e.project} ${o} \u2014 scaling to zero.`),n?.announce!==!1&&w(e,"info",`idle kill: ${e.project} (${o})`,`cluster-service:${e.project}`,{kind:"idle-kill",project:e.project,why:o});const r=e.proc;try{r.stdout?.removeAllListeners("data"),r.stderr?.removeAllListeners("data"),r.removeAllListeners("exit")}catch{}(0,discovery_1.stopRoutingTo)(e.pool),_(r,"SIGTERM"),e.proc=void 0,e.state="down",setTimeout(()=>{ie(e),e.pool.socks=[],e.pool.scannedAt=0},1200).unref?.()},"killSpawned"),ie=s(e=>{try{for(const o of fs.readdirSync(e.pool.dir)){if(!o.endsWith(".sock"))continue;const n=path.join(e.pool.dir,o);try{const r=Number(fs.readFileSync(`${n}.owner`,"utf8").trim());if(Number.isFinite(r)&&r>0)try{process.kill(r,0);continue}catch{}}catch{}try{fs.unlinkSync(n)}catch{}try{fs.unlinkSync(`${n}.owner`)}catch{}}}catch{}},"sweepDeadOwnerSocks");let H=0;const pe=[],Ae=s(()=>H<U?(H+=1,Promise.resolve()):new Promise(e=>{pe.push(()=>{H+=1,e()})}),"acquireRollSlot"),Me=s(()=>{H-=1,pe.shift()?.()},"releaseRollSlot"),ye=s(async(e,o,n)=>{O(e.pool);for(const r of e.pool.socks){const c=await f(r,void 0,n);if(c&&o(c.podGeneration))return!0}return!1},"anyPodAnswers"),ue=new Map,xe=s((e,o,n)=>{const r=C>0&&(0,handoff_retire_1.requestHandoffRetire)(e.pool.dir,n);if(_(o,"SIGTERM"),!r)return;const c=e.wsKey&&e.wsKey!==t.wsKey&&e.root?(0,workspace_log_1.workspaceLogWriter)(e.root):void 0,l=s(k=>A=>{if(t.stopped())return;const F=(0,inspector_secret_1.redactInspectorUrls)(A.toString()).replace(/^(?=.)/gm,`[${e.project} g${n} retiring] `);k.write(F),c?.(F)},"say"),p=l(process.stdout),u=l(process.stderr);o.stdout?.on("data",p),o.stderr?.on("data",u);let R=!1;const M=s(()=>{R||(R=!0,clearTimeout(m),clearInterval(E),o.stdout?.removeListener("data",p),o.stderr?.removeListener("data",u),ue.delete(o),(0,handoff_retire_1.clearHandoffRetire)(e.pool.dir,n),ie(e),e.pool.scannedAt=0)},"end"),m=setTimeout(()=>{console.error(`[gateway] pod handoff: ${e.project} g${n} was still running ${C}ms after it was retired \u2014 killing it.`),T(o,"SIGKILL"),M()},C);m.unref?.();const h=s(()=>{if(!R){if(t.stopped()){M();return}b(o)||(console.log(`[gateway] pod handoff: ${e.project} g${n} finished its in-flight work and exited.`),M())}},"look"),E=setInterval(h,se);E.unref?.(),o.once("exit",h),ue.set(o,()=>{T(o,"SIGTERM"),M()})},"retireReplacedTree"),Pe=s(()=>{for(const e of[...ue.values()])e()},"stopRetiringTrees"),he=s((e,o)=>{if(e.rolling)return e.rolling;const n=e.proc;if(!n||t.stopped())return Promise.resolve(!1);if(e.launcher==="nx")return console.log(`[gateway] pod handoff skipped: ${e.project} runs through nx run, which starts one instance of a target at a time \u2014 no standby can overlap it (reason=${o}).`),Promise.resolve(!1);H>=U&&console.log(`[gateway] pod handoff queued: ${e.project} reason=${o} \u2014 ${H} roll(s) in flight, ${pe.length} ahead (LENSMCP_POD_MAX_CONCURRENT_ROLLS=${U}).`);const r=(async()=>{await Ae();try{return await De(e,n,o)}finally{Me()}})().finally(()=>{e.rolling=void 0});return e.rolling=r,r},"rollPod"),De=s(async(e,o,n)=>{const r=e.proc;if(r!==o||t.stopped())return!1;const c=e.generation??0,l=c+1,p=Date.now();e.lastStaleRecycleAt=p,console.log(`[gateway] pod handoff start: ${e.project} g${c}\u2192g${l} reason=${n} \u2014 standby spawning, old generation keeps serving.`),w(e,"info",`pod handoff starting: ${e.project} (${n})`,`cluster-service:${e.project}`,{kind:"pod-handoff-start",project:e.project,reason:n,generation:l,fromGeneration:c});const u=X(e,l,"standby"),R=t.serviceKeys[(0,service_keys_1.serviceKeyId)(e.wsKey,e.project)],M=p+J;let m;for(;!t.stopped()&&Date.now()<M&&!(u.exitCode!==null||u.signalCode!==null);){O(e.pool);for(const h of e.pool.socks)if((await f(h,void 0,R))?.podGeneration===l){m=h;break}if(m)break;await sleep(ne)}if(!m||t.stopped()){const h=t.stopped()?"gateway stopping":u.exitCode!==null||u.signalCode!==null?`standby exited (${u.exitCode??u.signalCode})`:`standby not ready within ${Math.round(J/1e3)}s`;try{u.stdout?.removeAllListeners("data"),u.stderr?.removeAllListeners("data")}catch{}(0,discovery_1.stopRoutingTo)(e.pool,A=>(0,pod_sock_1.podSockGeneration)(A)===l),_(u,"SIGTERM");const E=!t.stopped()&&e.proc===r&&r.exitCode===null&&r.signalCode===null&&await ye(e,A=>A!==l,R),k=E?`old generation g${c} kept serving`:`and the old generation g${c} is NOT serving (${e.proc!==r||r.exitCode!==null||r.signalCode!==null?"its tree is gone":"none of its pods answers"}) \u2014 the service is down until it recovers`;return console.error(`[gateway] pod handoff failed: ${e.project} g${l}: ${h} \u2014 ${k}.`),e.rollFailure=`${h} \u2014 ${k}`,w(e,E?"warning":"error",`pod handoff failed: ${e.project}`,`cluster-service:${e.project}`,{kind:"pod-handoff-failed",project:e.project,reason:n,generation:l,error:h,durationMs:Date.now()-p,oldServing:E}),setTimeout(()=>ie(e),1200).unref?.(),!1}if(e.proc!==r)return(0,discovery_1.stopRoutingTo)(e.pool,h=>(0,pod_sock_1.podSockGeneration)(h)===l),_(u,"SIGTERM"),!1;e.proc=u,e.launcher=ee.get(u),e.generation=l,e.spawnAt=p,e.state="up",e.watcher=void 0,e.staleVerifiedAt=void 0,e.staleKeptAt=void 0,e.buildFailed=!1,e.lastErrors=[];try{r.stdout?.removeAllListeners("data"),r.stderr?.removeAllListeners("data"),r.removeAllListeners("exit")}catch{}return(0,discovery_1.stopRoutingTo)(e.pool,h=>(0,pod_sock_1.podSockGeneration)(h)!==l&&path.join(e.pool.dir,h)!==m),xe(e,r,c),setTimeout(()=>{ie(e),e.pool.scannedAt=0},1200).unref?.(),console.log(`[gateway] pod handoff ready: ${e.project} g${l} answered on ${path.basename(m)} in ${Date.now()-p}ms; retiring g${c}.`),w(e,"info",`pod handoff complete: ${e.project}`,`cluster-service:${e.project}`,{kind:"pod-handoff-complete",project:e.project,reason:n,generation:l,fromGeneration:c,durationMs:Date.now()-p}),!0},"runRoll"),Le=s((e,o)=>{if(t.stopped())return{refused:"the gateway is stopping"};if(e.restart&&!e.restart.done)return{restart:e.restart,already:!0};if(!e.proc&&e.state!=="down")return{refused:`${e.project} is served by pods this gateway adopted from an earlier one \u2014 it has no tree of its own to replace. \`lensmcp gateway restart\` starts every service under this gateway.`};const n=e.proc?o.hard||e.launcher==="nx"||e.state!=="up"?"hard":"rolling":"start",r={how:n,reason:o.reason,startedAt:Date.now(),...e.proc&&e.generation!==void 0?{fromGeneration:e.generation}:{}};return e.restart=r,console.log(`[gateway] restart asked: ${e.project}${e.wsKey!==t.wsKey?` (${e.wsKey})`:""} \u2014 ${n} (${o.reason}).`),w(e,"info",`restart asked: ${e.project} (${n})`,`cluster-service:${e.project}`,{kind:"service-restart",phase:"started",project:e.project,how:n,reason:o.reason,...r.fromGeneration!==void 0?{fromGeneration:r.fromGeneration}:{}}),s(async()=>{if(n==="start")return await de(e)?{ok:!0}:{ok:!1,error:fe(e)};if(n==="rolling")return e.rolling&&await e.rolling,e.proc?(e.rollFailure=void 0,await he(e,o.reason)?{ok:!0}:{ok:!1,error:e.rollFailure??"the new tree did not take over"}):await de(e)?{ok:!0}:{ok:!1,error:fe(e)};if(K(e,`restart asked (${o.reason})`,{announce:!1}),await sleep(1500),t.stopped())return{ok:!1,error:"the gateway is stopping"};let c=!1;e.proc||(await I(),c=!0,!e.proc&&e.state!=="starting"&&V(e));try{const l=e.proc,p=e.generation,u=t.serviceKeys[(0,service_keys_1.serviceKeyId)(e.wsKey,e.project)],R=Date.now()+t.startupTimeoutMs;for(;!t.stopped()&&Date.now()<R;){if(!l||e.proc!==l||l.exitCode!==null||l.signalCode!==null)return{ok:!1,error:fe(e)};if(await ye(e,M=>M===p,u))return ce(e,"observed"),e.buildFailed=!1,{ok:!0};await sleep(ne)}return{ok:!1,error:t.stopped()?"the gateway is stopping":`no pod of the new tree answered within ${Math.round(t.startupTimeoutMs/1e3)}s`}}finally{c&&P()}},"run")().catch(c=>({ok:!1,error:c.message})).then(c=>{r.done={ok:c.ok,at:Date.now(),...e.generation!==void 0?{generation:e.generation}:{},...c.error?{error:c.error}:{}};const l=Math.round((r.done.at-r.startedAt)/100)/10;c.ok?console.log(`[gateway] restarted: ${e.project} \u2014 g${r.done.generation??"?"} serving after ${l}s (${n}).`):console.error(`[gateway] restart failed: ${e.project} \u2014 ${c.error} (${n}, after ${l}s).`),w(e,c.ok?"info":"error",c.ok?`restarted: ${e.project}`:`restart failed: ${e.project}`,`cluster-service:${e.project}`,{kind:"service-restart",phase:c.ok?"done":"failed",project:e.project,how:n,reason:o.reason,...r.fromGeneration!==void 0?{fromGeneration:r.fromGeneration}:{},...r.done.generation!==void 0?{generation:r.done.generation}:{},durationMs:r.done.at-r.startedAt,...c.error?{error:c.error}:{}})}),{restart:r,already:!1}},"restartService"),fe=s(e=>e.buildFailed?`its build failed${e.lastErrors?.length?`: ${e.lastErrors[e.lastErrors.length-1]}`:""}`:e.proc&&(e.proc.exitCode!==null||e.proc.signalCode!==null)?`its tree exited (${e.proc.exitCode??e.proc.signalCode})`:!e.proc&&e.state==="down"?"its tree exited before a pod answered":`no pod answered within ${Math.round(t.startupTimeoutMs/1e3)}s`,"startFailure"),$e=s(e=>{const o=Date.now();e.restarts=(e.restarts??[]).filter(r=>o-r<types_1.SERVICE_RESTART_WINDOW_MS);const n=(e.wedgeRecycles??0)+1;if(e.restarts.length>=types_1.SERVICE_MAX_RESTARTS||n>types_1.SERVICE_MAX_RESTARTS){const r=e.restarts.length>=types_1.SERVICE_MAX_RESTARTS?`wedged ${types_1.SERVICE_MAX_RESTARTS}+\xD7/min`:`recycled ${types_1.SERVICE_MAX_RESTARTS}\xD7 in a row and no pod came up`;w(e,"error",`service crash-looping: ${e.project} \u2014 ${r}, not auto-recycling (the next request retries)`,`cluster-service:${e.project}`,{kind:"service-crash-loop",project:e.project,recycles:n-1}),K(e,"wedged (crash-loop cap) \u2014 leaving down for the next request",{announce:!1});return}e.wedgeRecycles=n,e.restarts.push(o),console.log(`[gateway] self-heal: recycling WEDGED ${e.project} (live parent, 0 live pods; attempt ${n}/${types_1.SERVICE_MAX_RESTARTS} with no pod up since the first, ${e.restarts.length} in the last minute; ${e.inflight??0} request(s) in flight \u2014 jobs held by the dead pod keep their locks until they expire)`),w(e,"warning",`self-heal: recycling wedged ${e.project} (0 live pods)`,`cluster-service:${e.project}`,{kind:"service-recycle",project:e.project,attempt:n,inWindow:e.restarts.length}),K(e,"wedged: 0 live pods \u2014 recycling",{announce:!1}),setTimeout(()=>{!t.stopped()&&!e.proc&&e.state==="down"&&V(e)},1500).unref?.()},"recycleWedged"),be={maxAgeMs:types_1.POD_MAX_AGE_MS,graceMs:types_1.POD_STALE_GRACE_MS,settleMs:types_1.POD_RECYCLE_SETTLE_MS,cooldownMs:types_1.POD_STALE_RECYCLE_COOLDOWN_MS};let ge;const te=new Map,_e=new Map;let we=!1,Se=0,le=0;const Ie=s(()=>{const e=t.projectRoots??{},o=new Set(t.services.map(r=>r.project));for(const r of t.routes)r.lens&&o.add(r.lens.project);const n=new Set;for(const r of o){const c=e[r];if(!c)continue;const l=path.relative(t.root,c).split(path.sep).filter(Boolean)[0];l&&!l.startsWith("..")&&n.add(l)}return[...n]},"managedBuckets"),Oe=s((e,o,n,r)=>{const c=t.projectSourceRoots?.[e];if(c?.length)return c;const l=t.projectRoots?.[e];if(!l)return;const p=sourceScopeDirs(t.root,l,n,o,r);return p.length>0?p:void 0},"scopeFor"),Ne=s(()=>{if(we||Date.now()-Se<types_1.POD_STALE_SCAN_MS)return;we=!0,Se=Date.now();const e=Se;(async()=>{const o=(0,scope_1.readSourceSetOptions)(t.root),n=o.exclude,r={ignoreTests:o.ignoreTests},c=sourceScanPass(t.root,n,r),l=await c.snapshot(),p=Date.now(),u=sourceChangeWindowMs(p,le,types_1.POD_STALE_SCAN_MS,types_1.POD_RECYCLE_SETTLE_MS),R=ge?diffSourceSets(ge,l,p,u):null;if(R&&(t.sourceSetChangedAt=p,t.sourceSetChange=R,G("info","source file set changed \u2014 stale pods recycle when idle","cluster-gateway",{kind:"source-set-changed",added:R.added,removed:R.removed,truncated:R.truncated})),ge=l,!t.projectRoots){le=e;return}let M;try{M=(await fs.promises.readdir(t.root,{withFileTypes:!0})).filter(j=>j.isDirectory()).map(j=>j.name)}catch{return}const m=Ie(),h=new Set(t.services.map(j=>j.project));for(const j of t.routes)j.lens&&h.add(j.lens.project);const E=new Map;for(const j of h){const W=Oe(j,M,m,n);if(!W)continue;const x=W.join("|"),D=E.get(x)??{dirs:W,projects:[]};D.projects.push(j),E.set(x,D)}const k=Date.now(),A=sourceChangeWindowMs(k,le,types_1.POD_STALE_SCAN_MS,types_1.POD_RECYCLE_SETTLE_MS);le=e;const F=s((j,W,x)=>{t.sourceSetChangedFor??=new Map,t.sourceSetChangesFor??=new Map;for(const D of j)t.sourceSetChangedFor.set(D,W),t.sourceSetChangesFor.set(D,x)},"stampScoped");for(const[j,{dirs:W,projects:x}]of E){const D=await c.snapshot(W),me=te.get(j);te.set(j,D);const ve=new Map;for(const Y of x){const q=_e.get(Y);if(q===void 0||q===j)continue;const z=ve.get(q)??[];z.push(Y),ve.set(q,z)}for(const Y of x)_e.set(Y,j);for(const[Y,q]of ve){const z=te.get(Y),oe=z?diffSourceSets(z,D,k,A):R;oe&&(F(q,z?k:p,oe),G("info",`source file set changed \u2014 ${q.join(", ")}'s watch scope was re-keyed`,"cluster-gateway",{kind:"source-set-changed",scoped:!0,rescoped:!0,projects:q,added:oe.added,removed:oe.removed,truncated:oe.truncated}))}if(!me)continue;const re=diffSourceSets(me,D,k,A);re&&(F(x,k,re),G("info",`source file set changed in ${x.join(", ")}'s scope`,"cluster-gateway",{kind:"source-set-changed",scoped:!0,projects:x,added:re.added,removed:re.removed,truncated:re.truncated}))}for(const j of[...te.keys()])E.has(j)||te.delete(j)})().catch(()=>{}).finally(()=>{we=!1})},"maybeScanSourceSet"),Fe=s((e,o)=>{const n=(t.sourceSetChangesFor?.get(e.project)??t.sourceSetChange)?.windowMs??types_1.POD_STALE_SCAN_MS+types_1.POD_RECYCLE_SETTLE_MS,r=podWatcherVerdict(e.watcher,o,n),c=s(l=>(e.staleKeptAt!==o&&(e.staleKeptAt=o,console.log(`[gateway] stale source set: pod ${e.project} ${l} \u2014 no recycle.`)),!1),"keep");return r==="heard"?(e.staleVerifiedAt=o,w(e,"info",`stale check: ${e.project} watcher confirmed \u2014 no recycle`,`cluster-service:${e.project}`,{kind:"pod-stale-verified",project:e.project,watcher:r}),c(`watcher CONFIRMED alive across the change (last build ${new Date(e.watcher?.lastBuildAt??0).toISOString()})`)):r==="degraded"?(console.log(`[gateway] stale source set: pod ${e.project} watcher DEGRADED (${e.watcher?.degraded}) \u2014 recycling.`),!0):r==="silent"?types_1.POD_WATCHER_SILENT==="keep"?c("watcher alive but quiet across the change \u2014 keeping it (LENSMCP_POD_WATCHER_SILENT=keep; a live watcher cannot miss an add it will need)"):!0:types_1.POD_WATCHER_UNVERIFIED==="keep"?c("unverifiable (no watcher testimony \u2014 older devserver bundle?) \u2014 keeping it (LENSMCP_POD_WATCHER_UNVERIFIED=keep)"):!0},"podStaleRecycleAllowed"),We=s((e,o)=>{if(e.lastStaleRecycleAt=Date.now(),types_1.POD_RECYCLE_MODE==="rolling"&&e.proc&&e.launcher!=="nx"){he(e,o);return}console.log(`[gateway] zombie recycle: ${e.project} (${o}) \u2014 stale fs view; fresh pod incoming`),w(e,"warning",`zombie recycle: ${e.project} (${o})`,`cluster-service:${e.project}`,{kind:"pod-recycle",project:e.project,reason:o});const n=!!e.decl.eager;K(e,`${o} \u2014 recycling stale pod`,{announce:!1}),n&&setTimeout(()=>{!t.stopped()&&!e.proc&&e.state==="down"&&V(e)},1500).unref?.()},"recyclePod"),Ke=s(()=>{const e=setInterval(()=>{qe().catch(o=>console.error("[gateway] sweep error:",o))},t.sweepMs);return e.unref(),e},"startSweeper"),qe=s(async()=>{{if(t.stopped())return;for(const e of t.graphStores?.all()??[])e.refreshIfStale();types_1.POD_RECYCLE_ENABLED&&Ne();for(const e of t.registry?t.registry.allServices():t.services){if(t.stopped()||!e.proc){e.wedgedSince=void 0;continue}const o=path.resolve(e.root)===path.resolve(t.root),n=e.decl.idleKillSec;if(n&&e.inflight===0&&Date.now()-e.lastUsed>n*1e3){K(e,`idle ${n}s`),e.wedgedSince=void 0;continue}const r=e.state==="starting"&&e.spawnAt!==void 0&&Date.now()-e.spawnAt<t.startupTimeoutMs,c=O(e.pool)>0;if(c||r){if(e.wedgedSince=void 0,c&&ce(e,"observed"),c&&!r&&types_1.POD_RECYCLE_ENABLED&&o){const l=t.sourceSetChangedFor?.get(e.project)??t.sourceSetChangedAt??0;await Ee(e);const p=(e.staleVerifiedAt??0)>=l&&l>0,u=podRecycleReason(e,Date.now(),p?0:l,be);if(u==="stale-source-set"&&!Fe(e,l))continue;u&&We(e,u)}continue}e.wedgedSince??=Date.now(),Date.now()-e.wedgedSince>types_1.WEDGE_RECYCLE_GRACE_MS&&(e.wedgedSince=void 0,$e(e))}}},"sweepOnce");return{scanNow:O,spawnService:V,ensureUp:de,scaleUp:Te,killSpawned:K,markUp:ce,startSweeper:Ke,rollPod:he,restartService:Le,recycleWedged:$e,stopRetiringTrees:Pe,stopBuildHost:s(e=>e===void 0?y.stop():y.release(e),"stopBuildHost")}}v(createServiceLayer,"createServiceLayer"),s(createServiceLayer,"createServiceLayer");function chooseStalePodKillTarget(t,a,i){if(!(t===void 0||!Number.isInteger(t)||t<=1)&&!(a!==void 0&&a!==t)&&t!==i)return t}v(chooseStalePodKillTarget,"chooseStalePodKillTarget"),s(chooseStalePodKillTarget,"chooseStalePodKillTarget");
+"use strict";var Ue=Object.defineProperty;var v=(t,a)=>Ue(t,"name",{value:a,configurable:!0});var Ve=Object.defineProperty,s=v((t,a)=>Ve(t,"name",{value:a,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.scaleTarget=scaleTarget,exports.isLoopbackHostname=isLoopbackHostname,exports.isOwnRunnerCommand=isOwnRunnerCommand,exports.isRunnerOf=isRunnerOf,exports.isTestSourcePath=isTestSourcePath,exports.sourceScanPass=sourceScanPass,exports.sourceSetSnapshot=sourceSetSnapshot,exports.sourceSetSignature=sourceSetSignature,exports.diffSourceSets=diffSourceSets,exports.sourceChangeWindowMs=sourceChangeWindowMs,exports.sourceScopeDirs=sourceScopeDirs,exports.podRecycleReason=podRecycleReason,exports.lensFrontendStale=lensFrontendStale,exports.lensWatcherVerdict=lensWatcherVerdict,exports.podWatcherVerdict=podWatcherVerdict,exports.lensChildWedged=lensChildWedged,exports.isPortConflictExit=isPortConflictExit,exports.podChangeClock=podChangeClock,exports.createServiceLayer=createServiceLayer,exports.chooseStalePodKillTarget=chooseStalePodKillTarget;const tslib_1=require("tslib"),node_child_process_1=require("node:child_process"),node_crypto_1=require("node:crypto"),fs=tslib_1.__importStar(require("node:fs")),http=tslib_1.__importStar(require("node:http")),net=tslib_1.__importStar(require("node:net")),path=tslib_1.__importStar(require("node:path")),node_util_1=require("node:util"),discovery_1=require("./discovery"),pod_sock_1=require("../../../pod-sock"),scope_1=require("./scope"),pod_env_1=require("./pod-env"),pod_probe_1=require("./pod-probe"),service_keys_1=require("./service-keys"),workspace_log_1=require("./workspace-log"),own_log_1=require("./own-log"),inspector_secret_1=require("../../../inspector-secret"),pod_output_1=require("./pod-output"),serve_launch_1=require("./serve-launch"),shared_build_1=require("./shared-build"),protocol_1=require("../../../shared-build/protocol"),types_1=require("./types"),exit_reason_1=require("../../../exit-reason"),handoff_retire_1=require("../../../handoff-retire"),process_name_1=require("../../../process-name");function eastWestEnv(t,a){const c={},d=t.serviceKeys[(0,service_keys_1.serviceKeyId)(a.wsKey,a.project)];if(d&&(c.LENSMCP_SERVICE_KEY=d),t.https){const g=require("../../../basic-ssl").caCertPath();fs.existsSync(g)&&(c.NODE_EXTRA_CA_CERTS=g)}return c}v(eastWestEnv,"eastWestEnv"),s(eastWestEnv,"eastWestEnv");const sleep=s(t=>new Promise(a=>setTimeout(a,t)),"sleep"),SRC_EXCLUDE=new Set(["node_modules","dist","tmp","coverage","build","out","target"]),SRC_EXT=new Set([".ts",".tsx",".js",".jsx",".mjs",".cjs",".css",".scss",".sass",".less",".json",".html",".htm",".vue",".svelte",".mdx"]),SCAN_FILE_CAP=1e5;function fnv1a(t){let a=2166136261;for(let c=0;c<t.length;c+=1)a^=t.charCodeAt(c),a=Math.imul(a,16777619);return a>>>0}v(fnv1a,"fnv1a"),s(fnv1a,"fnv1a");const execFileP=(0,node_util_1.promisify)(node_child_process_1.execFile);async function gitIgnoredPaths(t){try{const{stdout:a}=await execFileP("git",["ls-files","--others","--directory","--ignored","--exclude-standard","-z"],{cwd:t,maxBuffer:33554432,timeout:1e4,windowsHide:!0});return new Set(a.split("\0").filter(Boolean))}catch{return new Set}}v(gitIgnoredPaths,"gitIgnoredPaths"),s(gitIgnoredPaths,"gitIgnoredPaths");function scaleTarget(t,a=fs.existsSync){if(t.decl.adminUrl)return{url:t.decl.adminUrl};const c=path.join(t.pool.dir,"parent.sock");return a(c)?{socketPath:c}:t.decl.port?{url:`http://localhost:${t.decl.port}`}:void 0}v(scaleTarget,"scaleTarget"),s(scaleTarget,"scaleTarget");function isLoopbackHostname(t){const a=t.toLowerCase().replace(/^\[(.*)\]$/,"$1").replace(/\.$/,"");return a==="localhost"||a.endsWith(".localhost")?!0:net.isIPv4(a)?a.split(".")[0]==="127":net.isIPv6(a)&&new URL(`http://[${a}]/`).hostname==="[::1]"}v(isLoopbackHostname,"isLoopbackHostname"),s(isLoopbackHostname,"isLoopbackHostname");function postScale(t,a,c){let d;if("socketPath"in t)d=http.request({socketPath:t.socketPath,path:"/webpack/scale",method:"POST",headers:{"content-type":"application/json"}},g=>g.resume());else{const g=t.url.startsWith("https"),M=g?require("node:https"):http,m={method:"POST"};g&&isLoopbackHostname(new URL(t.url).hostname)&&(m.rejectUnauthorized=!1),c&&(m.lookup=c),d=M.request(`${t.url}/webpack/scale`,m,E=>E.resume())}return d.on("error",()=>{}),d.end(JSON.stringify({pods:a})),d}v(postScale,"postScale"),s(postScale,"postScale");function isOwnRunnerCommand(t,a){return(0,serve_launch_1.isServeRunnerCommand)(t)?(0,serve_launch_1.isServeRunnerCommandOf)(t,a):t.includes("/node_modules/nx/")?t.includes(`${a.replace(/\/+$/,"")}/node_modules/nx/`):!0}v(isOwnRunnerCommand,"isOwnRunnerCommand"),s(isOwnRunnerCommand,"isOwnRunnerCommand");function isRunnerOf(t,a,c){const d=a.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");return!new RegExp(`(^|\\s)run ${d}(:|\\s|$)`).test(t)||!(0,serve_launch_1.isServeRunnerCommand)(t)&&!/\bnx(\.js)?\b/.test(t)?!1:isOwnRunnerCommand(t,c)}v(isRunnerOf,"isRunnerOf"),s(isRunnerOf,"isRunnerOf");const TEST_FILE_RE=/\.(spec|test|e2e|e2e-spec|stories)\.[cm]?[jt]sx?$/,TEST_DIR_SEGMENTS=new Set(["__tests__","__mocks__","__snapshots__"]);function isTestSourcePath(t){const a=t.split("/"),c=a[a.length-1]??"";if(TEST_FILE_RE.test(c))return!0;for(let d=0;d<a.length-1;d+=1)if(TEST_DIR_SEGMENTS.has(a[d]))return!0;return!1}v(isTestSourcePath,"isTestSourcePath"),s(isTestSourcePath,"isTestSourcePath");function sourceScanPass(t,a,c){const d=c?.ignoreTests??!0;let g;const M=new Map,m=`tree:${path.resolve(t)}`,E=s(w=>path.relative(t,w).split(path.sep).join("/"),"rel"),C=s(async(w,y)=>{const _=await(g??=gitIgnoredPaths(t)),D=[],O=new Set;let P=!1;const V=s(async(Q,S)=>{if(D.length>=SCAN_FILE_CAP){P=!0;return}let N;try{N=await fs.promises.readdir(Q,{withFileTypes:!0})}catch{return}S&&O.add(E(Q));for(const X of N){if(D.length>=SCAN_FILE_CAP){P=!0;return}const F=X.name,Z=path.join(Q,F);if(X.isDirectory()){if(!S||F.startsWith(".")||SRC_EXCLUDE.has(F)||a?.has(F)||F.endsWith("-devserver")||_.has(`${E(Z)}/`))continue;await V(Z,!0)}else if(X.isFile()){const ee=F.lastIndexOf(".");if(ee<=0||!SRC_EXT.has(F.slice(ee)))continue;const H=E(Z);if(_.has(H)||d&&isTestSourcePath(H))continue;D.push(H)}}},"walk");return await V(w,y),{paths:D,entered:O,truncated:P}},"walkDir"),I=s((w,y)=>{let _=M.get(w);return _||(_=y(),M.set(w,_)),_},"memo"),se=s(async()=>{const w=M.get(m);if(!w)return;const y=await w;return y.truncated?void 0:y},"wideWalk"),J=new Set,ne=s(()=>I(`files:${path.resolve(t)}`,async()=>{const w=await se();return w?{paths:w.paths.filter(y=>!y.includes("/")),entered:J,truncated:!1}:C(t,!1)}),"rootFiles"),ae=s(w=>I(`tree:${path.resolve(w)}`,async()=>{const y=await se(),_=E(w);if(y?.entered.has(_)){const D=`${_}/`;return{paths:_===""?y.paths:y.paths.filter(O=>O.startsWith(D)),entered:J,truncated:!1}}return C(w,!0)}),"subtree"),B=s(w=>{const y=new Set;let _=0,D=w.some(P=>P.truncated);const O=s(P=>y.has(P)?!0:y.size>=SCAN_FILE_CAP?(D=!0,!1):(y.add(P),_^=fnv1a(P),!0),"add");for(const P of w)if(!P.paths.every(O))break;return{signature:`${y.size}:${(_>>>0).toString(36)}`,paths:y,truncated:D}},"compose");return{async snapshot(w){if(!w||w.length===0)return B([await I(m,()=>C(t,!0))]);const y=[await ne()];for(const _ of w)y.push(await ae(_));return B(y)}}}v(sourceScanPass,"sourceScanPass"),s(sourceScanPass,"sourceScanPass");async function sourceSetSnapshot(t,a,c,d){return sourceScanPass(t,c,d).snapshot(a)}v(sourceSetSnapshot,"sourceSetSnapshot"),s(sourceSetSnapshot,"sourceSetSnapshot");async function sourceSetSignature(t,a,c,d){return(await sourceSetSnapshot(t,a,c,d)).signature}v(sourceSetSignature,"sourceSetSignature"),s(sourceSetSignature,"sourceSetSignature");const SOURCE_DIFF_PATH_CAP=128;function diffSourceSets(t,a,c,d){if(t.paths.size===a.paths.size){let E=!0;for(const C of t.paths)if(!a.paths.has(C)){E=!1;break}if(E)return null}const g=[],M=[];let m=t.truncated||a.truncated;for(const E of a.paths)t.paths.has(E)||(g.length+M.length<SOURCE_DIFF_PATH_CAP?g.push(E):m=!0);for(const E of t.paths)a.paths.has(E)||(g.length+M.length<SOURCE_DIFF_PATH_CAP?M.push(E):m=!0);return{changedAt:c,added:g,removed:M,truncated:m,...d!==void 0?{windowMs:d}:{}}}v(diffSourceSets,"diffSourceSets"),s(diffSourceSets,"diffSourceSets");function sourceChangeWindowMs(t,a,c,d){const g=a&&a>0?t-a:c;return Math.max(g,c)+d}v(sourceChangeWindowMs,"sourceChangeWindowMs"),s(sourceChangeWindowMs,"sourceChangeWindowMs");function sourceScopeDirs(t,a,c,d,g){const M=s(C=>{const I=path.relative(t,C).split(path.sep).filter(Boolean);return I.length===0||I[0].startsWith("..")?"":I[0]},"bucketOf")(a);if(!M)return[];const m=new Set(c.filter(Boolean)),E=new Set([M]);for(const C of d)C.startsWith(".")||SRC_EXCLUDE.has(C)||g?.has(C)||C.endsWith("-devserver")||m.has(C)||E.add(C);return[...E].sort().map(C=>path.join(t,C))}v(sourceScopeDirs,"sourceScopeDirs"),s(sourceScopeDirs,"sourceScopeDirs");function podRecycleReason(t,a,c,d){return!t.proc||t.state!=="up"||t.spawnAt==null||t.inflight>0||(t.activeWork??0)>0||a-t.lastUsed<d.settleMs||t.lastStaleRecycleAt!=null&&a-t.lastStaleRecycleAt<d.cooldownMs?null:c>0&&c-t.spawnAt>d.graceMs?"stale-source-set":d.maxAgeMs>0&&a-t.spawnAt>d.maxAgeMs?"max-age":null}v(podRecycleReason,"podRecycleReason"),s(podRecycleReason,"podRecycleReason");function lensFrontendStale(t,a,c,d,g){return!(d-a<g.cooldownMs||c<=0||c-t<=g.graceMs||d-c<g.settleMs)}v(lensFrontendStale,"lensFrontendStale"),s(lensFrontendStale,"lensFrontendStale");function lensWatcherVerdict(t,a,c,d=[]){if(!t)return"unknown";if("schemaVersion"in t&&t.schemaVersion>=2&&d.length>0){const g=a-c,M=new Set(t.recentEvents.filter(m=>m.at>=g).map(m=>path.resolve(m.path)));return d.every(m=>M.has(path.resolve(m)))?"heard":"missed"}return t.lastFsSetEventAt>=a-c?"heard":"missed"}v(lensWatcherVerdict,"lensWatcherVerdict"),s(lensWatcherVerdict,"lensWatcherVerdict");function podWatcherVerdict(t,a,c){if(!t)return"unknown";if(t.degraded)return"degraded";const d=a-c;return t.lastWatchRunAt>=d||t.lastBuildAt>=d?"heard":"silent"}v(podWatcherVerdict,"podWatcherVerdict"),s(podWatcherVerdict,"podWatcherVerdict");function lensChildWedged(t,a,c,d){const g=t.hasListened?d.graceMs:Math.max(d.graceMs,d.neverListenedGraceMs);return c-t.spawnedAt<g||c-a<d.cooldownMs||t.probeFails<Math.max(2,d.failureThreshold)?null:"wedged-no-listener"}v(lensChildWedged,"lensChildWedged"),s(lensChildWedged,"lensChildWedged");function isPortConflictExit(t,a){return t.signal||t.code===null||t.code===0||t.ranMs>a.fastFailMs?!1:t.portHeld}v(isPortConflictExit,"isPortConflictExit"),s(isPortConflictExit,"isPortConflictExit");function podChangeClock(t,a){const c=t.sourceSetChangedFor?.get(a);if(c!==void 0){const d=t.sourceSetChangesFor?.get(a);return{at:c,...d?{change:d}:{},scope:"project"}}return t.sourceSetScoped?.has(a)?{at:0,scope:"none"}:{at:t.sourceSetChangedAt??0,...t.sourceSetChange?{change:t.sourceSetChange}:{},scope:"workspace"}}v(podChangeClock,"podChangeClock"),s(podChangeClock,"podChangeClock");const changeEvidence=s(t=>{if(!t)return"no path evidence";const a=[...t.added.map(c=>`+${c}`),...t.removed.map(c=>`-${c}`)];return a.length?`${a.slice(0,3).join(", ")}${a.length>3?` (+${a.length-3} more)`:""}`:"no path evidence"},"changeEvidence");function createServiceLayer(t,a,c={}){const d=c.spawnProcess??node_child_process_1.spawn,g=c.probeAlive??pod_probe_1.probePodAlive,M=c.killTree??((e,r="SIGTERM")=>{try{process.kill(-e.pid,r)}catch{try{e.kill(r)}catch{}}}),m=c.sharedBuild??(0,shared_build_1.createSharedBuildRelay)(t),E=s((e,r="SIGTERM")=>{m.detach(e),M(e,r)},"killTree"),C=c.handoffDrainMs??(0,handoff_retire_1.handoffDrainBoundMs)(),I=c.treeAlive??(e=>{if(!e.pid)return!1;try{return process.kill(-e.pid,0),!0}catch(r){return r.code==="EPERM"}}),se=c.retirePollMs??1e3,J=c.rollReadyMs??types_1.POD_ROLL_READY_MS,ne=c.rollPollMs??750,ae=c.maxConcurrentRolls??types_1.POD_MAX_CONCURRENT_ROLLS,B=ae>0?ae:Number.POSITIVE_INFINITY,w=c.maxConcurrentColdStarts??types_1.MAX_COLD_STARTS,y=w>0?w:Number.POSITIVE_INFINITY;let _=0;const D=[],O=s(()=>_<y?(_+=1,Promise.resolve()):new Promise(e=>{D.push(()=>{_+=1,e()})}),"acquireColdSlot"),P=s(()=>{_-=1,D.shift()?.()},"releaseColdSlot"),{emit:V}=a,Q=s(e=>e.wsKey===t.wsKey?void 0:path.join(e.root,".lensmcp","events.jsonl"),"serviceBus"),S=s((e,r,n,o,i)=>V(r,n,o,{wsKey:e.wsKey,...i},void 0,Q(e)),"emitSvc"),N=s(e=>(e.scannedAt=0,(0,discovery_1.pickSock)(e,t.scanTtlMs)?e.socks.length:0),"scanNow"),X=s((e,r)=>{let n;try{n=(0,node_child_process_1.execFileSync)("ps",["ax","-ww","-o","pid=,pgid=,command="],{encoding:"utf8",timeout:5e3})}catch{return 0}const o=e.proc?.pid;let i=0;for(const l of n.split(`
+`)){const p=l.match(/^\s*(\d+)\s+(\d+)\s+(.*)$/);if(!p)continue;const u=Number(p[1]),$=Number(p[2]);if(isRunnerOf(p[3],r,e.root)&&!(u===process.pid||u===o)&&!(o!==void 0&&$===o)){try{process.kill(-$,"SIGKILL")}catch{try{process.kill(u,"SIGKILL")}catch{}}i+=1}}return i>0&&(console.log(`[gateway] ${r}: reaped ${i} stale runner tree(s) \u2014 a foreign generation of this service (holding nx's task lock, or its pool)`),S(e,"warning",`stale-runner reap: ${e.project} (${i} foreign tree(s))`,`cluster-service:${e.project}`,{kind:"stale-runner-reap",project:e.project,reaped:i})),i},"reapForeignRunners"),F=s((e,r)=>({...(0,pod_env_1.podBaseEnv)(process.env,t.root,e.root),...e.instanceEnv?{...e.instanceEnv,LENSMCP_SOCKET_ONLY:"1"}:{},...e.frozen?{LENSMCP_FREEZE:"1",LENSMCP_TYPECHECK:"off"}:{},NX_DAEMON:"false",NX_ISOLATE_PLUGINS:"false",...e.wsKey?{LENSMCP_WS_KEY:e.wsKey}:{},...e.sockNs?{LENSMCP_SOCK_NS:e.sockNs}:{},LENSMCP_EVENT_FILE:e.wsKey===t.wsKey?t.eventFile:path.join(e.root,".lensmcp","events.jsonl"),LENSMCP_GATEWAY_PID:String(process.pid),LENSMCP_POD_GENERATION:String(r),...eastWestEnv(t,e)}),"serviceEnv"),Z=s((e,r,n,o)=>{const i=F(e,r),l=e.wsKey||path.basename(e.root),p=(0,serve_launch_1.planServeLaunch)({stores:t.graphStores,root:e.root,project:e.project,target:e.decl.serveTarget??"serve-hmr",childCount:o,baseEnv:i});if(p.kind==="runner"){const h=m.offeredTo(e),j=d((0,process_name_1.namedExecPath)((0,process_name_1.processName)(l,e.project,serve_launch_1.SERVE_RUNNER_ROLE)),[...p.script.execArgv,p.script.path,...(0,serve_launch_1.serveRunnerArgs)(n,o,e.root)],{cwd:e.root,detached:!0,env:h?{...p.env,[protocol_1.SHARED_BUILD_ENV]:"1"}:p.env,stdio:["ignore","pipe","pipe","ipc"]});return h&&m.attach(e,r,j),j.send?.(p.message,R=>{R&&console.error(`[gateway] ${n}: could not hand the task to its runner (${R.message})`)}),{proc:j,launcher:"runner"}}console.log(`[gateway] ${n}: starting through nx run \u2014 ${p.reason}`);const u=path.join(e.root,"node_modules","nx","dist","bin","nx.js"),$=(0,process_name_1.namedExecPath)((0,process_name_1.processName)(l,e.project,"nx")),[A,k]=fs.existsSync(u)?[$,[u,"run",n,`--childCount=${o}`]]:["yarn",["nx","run",n,`--childCount=${o}`]];return{proc:d(A,k,{cwd:e.root,detached:!0,env:i,stdio:["ignore","pipe","pipe"]}),launcher:"nx"}},"startServiceTree"),ee=new WeakMap,H=s((e,r,n)=>{const o=`${e.project}:${e.decl.serveTarget??"serve-hmr"}`,i=Math.max(1,e.decl.minPods??1),{proc:l,launcher:p}=Z(e,r,o,i);ee.set(l,p),n==="active"&&(e.launcher=p),n==="active"&&(e.lastErrors=[],e.buildFailed=!1,e.faults=new pod_output_1.PodFaults);const u=s(k=>{const h=k.toString();for(const j of h.split(`
+`)){const R=(0,pod_output_1.classifyPodLine)(j),{clean:T,broken:K,healthy:ye}=R,f=T;if(K){e.lastErrors.push(T),e.lastErrors.length>12&&e.lastErrors.shift(),e.buildFailed=!0;const x=Date.now();(T!==e.lastErrorEmitSig||x-(e.lastErrorEmitAt??0)>=types_1.SERVICE_ERROR_THROTTLE_MS)&&(e.lastErrorEmitSig=T,e.lastErrorEmitAt=x,S(e,"error",`service error: ${e.project}`,`cluster-service:${e.project}`,{kind:"service-error",project:e.project,line:T,fault:R.fault}))}ye&&(e.buildFailed=!1);const L=(e.faults??=new pod_output_1.PodFaults).observe(R);if(L){e.lastErrorEmitSig=void 0;const x=L.open.length===0;S(e,"info",`${x?"service recovered":`${L.closed.join(" + ")} recovered`}: ${e.project}`,`cluster-service:${e.project}`,{kind:x?"service-recovered":"service-fault-closed",project:e.project,line:T,closed:L.closed,open:L.open})}!e.lockBlockedAt&&/Waiting for .+ in another nx process/.test(f)&&(e.lockBlockedAt=Date.now(),console.log(`[gateway] ${o}: spawn blocked by a stale nx runner \u2014 breaking the lock + respawning`),S(e,"warning",`nx task lock: ${e.project} blocked by a stale runner \u2014 auto-breaking`,`cluster-service:${e.project}`,{kind:"nx-lock-break",project:e.project}),setTimeout(()=>{t.stopped()||!e.lockBlockedAt||(q(e,"parked on a foreign nx task lock \u2014 recycling",{announce:!1}),X(e,o),setTimeout(()=>{!t.stopped()&&!e.proc&&e.state==="down"&&U(e)},1500).unref?.())},250).unref?.())}},"sniff"),$=e.wsKey&&e.wsKey!==t.wsKey&&e.root?(0,workspace_log_1.workspaceLogWriter)(e.root):void 0,A=s(k=>{const h=(0,own_log_1.linePrefixer)(e.project);return j=>{if(t.stopped())return;const R=(0,inspector_secret_1.redactInspectorUrls)(j.toString());u(R);const T=h(R);k.write(T),$?.(T)}},"relay");return l.stdout?.on("data",A(process.stdout)),l.stderr?.on("data",A(process.stderr)),l.on("exit",(k,h)=>{if(e.proc!==l||(e.proc=void 0,e.state="down",t.stopped()))return;const j=(0,exit_reason_1.describeExit)(k,h);if(console.log(`[gateway] ${o} exited (${k??"no code"}${h?`, ${h}`:""}${e.inflight?`, ${e.inflight} request(s) in flight`:""})${j?` \u2014 ${j}`:""}`),S(e,k===0?"info":"warning",`service down: ${e.project} (exit ${k})`,`cluster-service:${e.project}`,{kind:"service-down",project:e.project,code:k,...h?{signal:h}:{}}),k===0||e.buildFailed)return;const R=Date.now();if(e.restarts=(e.restarts??[]).filter(K=>R-K<types_1.SERVICE_RESTART_WINDOW_MS),e.restarts.length>=types_1.SERVICE_MAX_RESTARTS){S(e,"error",`service crash-looping: ${e.project} \u2014 ${types_1.SERVICE_MAX_RESTARTS}+ restarts/min, not auto-respawning (the next request retries)`,`cluster-service:${e.project}`,{kind:"service-crash-loop",project:e.project});return}e.restarts.push(R);const T=Math.min(8e3,500*2**(e.restarts.length-1));setTimeout(()=>{t.stopped()||e.proc||e.state!=="down"||(console.log(`[gateway] self-heal: respawning ${e.project} (restart ${e.restarts.length}/${types_1.SERVICE_MAX_RESTARTS})`),S(e,"info",`self-heal: respawning ${e.project}`,`cluster-service:${e.project}`,{kind:"service-respawn",project:e.project,attempt:e.restarts.length}),U(e))},T)}),l},"launchServiceProcess"),U=s(e=>{if(t.stopped())return;const r=`${e.project}:${e.decl.serveTarget??"serve-hmr"}`,n=Math.max(1,e.decl.minPods??1);c.reapForeign!==!1&&X(e,r),e.lockBlockedAt=void 0,console.log(`[gateway] starting ${r} (pods=${n})\u2026`),S(e,"info",`service starting: ${e.project} (${n} pod${n>1?"s":""})`,`cluster-service:${e.project}`,{kind:"service-starting",project:e.project,pods:n}),e.state="starting",e.spawnAt=Date.now(),e.generation=(e.generation??0)+1,e.proc=H(e,e.generation,"active")},"spawnService"),ke=s(async e=>{const r=e.pool.socks[0];if(!r)return;const n=await(0,pod_probe_1.probePodAlive)(r,void 0,t.serviceKeys[(0,service_keys_1.serviceKeyId)(e.wsKey,e.project)]);n&&(e.activeWork=n.activeWork,n.watcher&&(e.watcher=n.watcher))},"refreshActiveWork"),je=s(e=>{try{const r=Number(fs.readFileSync(`${e}.owner`,"utf8").trim());return Number.isInteger(r)&&r>1?r:void 0}catch{return}},"readOwnerSidecar"),Re=s(async e=>{const r=t.serviceKeys[(0,service_keys_1.serviceKeyId)(e.wsKey,e.project)];if(!r)return[];const n=(0,node_crypto_1.createHash)("sha256").update(r).digest("hex").slice(0,8),o=[];for(const i of e.pool.socks){const l=await(0,pod_probe_1.probePodAlive)(i,void 0,r);l&&(!l.keyFingerprint||l.keyFingerprint!==n)&&o.push({sock:i,pid:l.pid})}return o},"staleAdoptedSocks"),Ce=s((e,r)=>{const n=r.map(o=>o.sock);for(const{sock:o,pid:i}of r){const l=chooseStalePodKillTarget(i,je(o),process.pid);if(l!==void 0)try{process.kill(l,"SIGTERM")}catch{}try{fs.unlinkSync(o)}catch{}try{fs.unlinkSync(`${o}.owner`)}catch{}}e.pool.socks=e.pool.socks.filter(o=>!n.includes(o)),e.pool.idx=-1,e.pool.scannedAt=0},"evictStaleAdopted"),ce=s((e,r)=>{if(e.state==="up")return!1;e.state="up",e.wedgeRecycles=0;const n=e.pool.socks.length;return S(e,"info",`service up: ${e.project} (${n} pods, ${r})`,`cluster-service:${e.project}`,{kind:"service-up",project:e.project,pods:n,adopted:r==="adopted"}),!0},"markUp"),de=s(async e=>{if(N(e.pool)>0){const o=await Re(e);if(o.length>0&&(console.error(`[gateway] ${e.project}: ${o.length} adopted pod(s) hold a foreign east-west key \u2014 evicting instead of adopting.`),S(e,"warning",`stale adoption: ${e.project} (foreign east-west key)`,`cluster-service:${e.project}`,{kind:"pod-recycle",project:e.project,reason:"stale-adoption",pods:o.length}),e.proc&&q(e,"stale adoption (foreign east-west key)"),Ce(e,o)),e.pool.socks.length>0)return ce(e,"adopted"),!0}if(t.stopped())return!1;let r=!1;const n=s(()=>e.state!=="starting"&&!e.proc,"notStarted");if(n())if(e.coldWait)await e.coldWait;else{_>=y&&(console.log(`[gateway] cold start queued: ${e.project}${e.wsKey&&e.wsKey!==t.wsKey?` (${e.wsKey})`:""} \u2014 ${_} starting, ${D.length} ahead (LENSMCP_MAX_COLD_STARTS=${y}).`),S(e,"info",`cold start queued: ${e.project}`,`cluster-service:${e.project}`,{kind:"cold-start-queued",project:e.project,inFlight:_,ahead:D.length}));const o=O();if(e.coldWait=o,await o,e.coldWait=void 0,r=!0,t.stopped())return P(),!1;n()&&U(e)}try{return await Ae(e)}finally{r&&P()}},"ensureUp"),Ae=s(async e=>{const r=Date.now()+t.startupTimeoutMs,n=Date.now()+12e3;for(;!t.stopped()&&Date.now()<r;){if(await sleep(Math.min(700,t.startupTimeoutMs/4)),e.buildFailed&&Date.now()>n)return!1;if(N(e.pool)>0){e.state="up",e.buildFailed=!1;const o=e.spawnAt?Date.now()-e.spawnAt:void 0;return console.log(`[gateway] ${e.project} up (${e.pool.socks.length} pods${o?`, cold start ${o}ms`:""})`),S(e,"info",`cold start: ${e.project} (${e.pool.socks.length} pods, ${o??"?"}ms)`,`cluster-service:${e.project}`,{kind:"cold-start",project:e.project,pods:e.pool.socks.length,durationMs:o}),!0}if(e.state==="down")return!1}return!1},"waitForPods"),Te=s(e=>{const r=e.decl.maxPods??e.decl.minPods??1,n=e.pool.socks.length,o=scaleTarget(e);!o||n===0||n>=r||e.inflight<=n||Date.now()-e.lastScaleAt<5e3||(e.lastScaleAt=Date.now(),postScale(o,n+1,c.scaleLookup),console.log(`[gateway] autoscale ${e.project}: ${n} \u2192 ${n+1} pods (inflight ${e.inflight})`),S(e,"info",`autoscale: ${e.project} ${n} \u2192 ${n+1} pods`,`cluster-service:${e.project}`,{kind:"autoscale",project:e.project,from:n,to:n+1,inflight:e.inflight}))},"scaleUp"),q=s((e,r,n)=>{if(!e.proc)return;console.log(`[gateway] ${e.project} ${r} \u2014 scaling to zero.`),n?.announce!==!1&&S(e,"info",`idle kill: ${e.project} (${r})`,`cluster-service:${e.project}`,{kind:"idle-kill",project:e.project,why:r});const o=e.proc;try{o.stdout?.removeAllListeners("data"),o.stderr?.removeAllListeners("data"),o.removeAllListeners("exit")}catch{}(0,discovery_1.stopRoutingTo)(e.pool),E(o,"SIGTERM"),e.proc=void 0,e.state="down",setTimeout(()=>{ie(e),e.pool.socks=[],e.pool.scannedAt=0},1200).unref?.()},"killSpawned"),ie=s(e=>{try{for(const r of fs.readdirSync(e.pool.dir)){if(!r.endsWith(".sock"))continue;const n=path.join(e.pool.dir,r);try{const o=Number(fs.readFileSync(`${n}.owner`,"utf8").trim());if(Number.isFinite(o)&&o>0)try{process.kill(o,0);continue}catch{}}catch{}try{fs.unlinkSync(n)}catch{}try{fs.unlinkSync(`${n}.owner`)}catch{}}}catch{}},"sweepDeadOwnerSocks");let Y=0;const pe=[],Me=s(()=>Y<B?(Y+=1,Promise.resolve()):new Promise(e=>{pe.push(()=>{Y+=1,e()})}),"acquireRollSlot"),xe=s(()=>{Y-=1,pe.shift()?.()},"releaseRollSlot"),_e=s(async(e,r,n)=>{N(e.pool);for(const o of e.pool.socks){const i=await g(o,void 0,n);if(i&&r(i.podGeneration))return!0}return!1},"anyPodAnswers"),ue=new Map,Pe=s((e,r,n)=>{const o=C>0&&(0,handoff_retire_1.requestHandoffRetire)(e.pool.dir,n);if(E(r,"SIGTERM"),!o)return;const i=e.wsKey&&e.wsKey!==t.wsKey&&e.root?(0,workspace_log_1.workspaceLogWriter)(e.root):void 0,l=s(R=>T=>{if(t.stopped())return;const K=(0,inspector_secret_1.redactInspectorUrls)(T.toString()).replace(/^(?=.)/gm,`[${e.project} g${n} retiring] `);R.write(K),i?.(K)},"say"),p=l(process.stdout),u=l(process.stderr);r.stdout?.on("data",p),r.stderr?.on("data",u);let $=!1;const A=s(()=>{$||($=!0,clearTimeout(k),clearInterval(j),r.stdout?.removeListener("data",p),r.stderr?.removeListener("data",u),ue.delete(r),(0,handoff_retire_1.clearHandoffRetire)(e.pool.dir,n),ie(e),e.pool.scannedAt=0)},"end"),k=setTimeout(()=>{console.error(`[gateway] pod handoff: ${e.project} g${n} was still running ${C}ms after it was retired \u2014 killing it.`),M(r,"SIGKILL"),A()},C);k.unref?.();const h=s(()=>{if(!$){if(t.stopped()){A();return}I(r)||(console.log(`[gateway] pod handoff: ${e.project} g${n} finished its in-flight work and exited.`),A())}},"look"),j=setInterval(h,se);j.unref?.(),r.once("exit",h),ue.set(r,()=>{M(r,"SIGTERM"),A()})},"retireReplacedTree"),De=s(()=>{for(const e of[...ue.values()])e()},"stopRetiringTrees"),he=s((e,r)=>{if(e.rolling)return e.rolling;const n=e.proc;if(!n||t.stopped())return Promise.resolve(!1);if(e.launcher==="nx")return console.log(`[gateway] pod handoff skipped: ${e.project} runs through nx run, which starts one instance of a target at a time \u2014 no standby can overlap it (reason=${r}).`),Promise.resolve(!1);Y>=B&&console.log(`[gateway] pod handoff queued: ${e.project} reason=${r} \u2014 ${Y} roll(s) in flight, ${pe.length} ahead (LENSMCP_POD_MAX_CONCURRENT_ROLLS=${B}).`);const o=(async()=>{await Me();try{return await Le(e,n,r)}finally{xe()}})().finally(()=>{e.rolling=void 0});return e.rolling=o,o},"rollPod"),Le=s(async(e,r,n)=>{const o=e.proc;if(o!==r||t.stopped())return!1;const i=e.generation??0,l=i+1,p=Date.now();e.lastStaleRecycleAt=p,console.log(`[gateway] pod handoff start: ${e.project} g${i}\u2192g${l} reason=${n} \u2014 standby spawning, old generation keeps serving.`),S(e,"info",`pod handoff starting: ${e.project} (${n})`,`cluster-service:${e.project}`,{kind:"pod-handoff-start",project:e.project,reason:n,generation:l,fromGeneration:i});const u=H(e,l,"standby"),$=t.serviceKeys[(0,service_keys_1.serviceKeyId)(e.wsKey,e.project)],A=p+J;let k;for(;!t.stopped()&&Date.now()<A&&!(u.exitCode!==null||u.signalCode!==null);){N(e.pool);for(const h of e.pool.socks)if((await g(h,void 0,$))?.podGeneration===l){k=h;break}if(k)break;await sleep(ne)}if(!k||t.stopped()){const h=t.stopped()?"gateway stopping":u.exitCode!==null||u.signalCode!==null?`standby exited (${u.exitCode??u.signalCode})`:`standby not ready within ${Math.round(J/1e3)}s`;try{u.stdout?.removeAllListeners("data"),u.stderr?.removeAllListeners("data")}catch{}(0,discovery_1.stopRoutingTo)(e.pool,T=>(0,pod_sock_1.podSockGeneration)(T)===l),E(u,"SIGTERM");const j=!t.stopped()&&e.proc===o&&o.exitCode===null&&o.signalCode===null&&await _e(e,T=>T!==l,$),R=j?`old generation g${i} kept serving`:`and the old generation g${i} is NOT serving (${e.proc!==o||o.exitCode!==null||o.signalCode!==null?"its tree is gone":"none of its pods answers"}) \u2014 the service is down until it recovers`;return console.error(`[gateway] pod handoff failed: ${e.project} g${l}: ${h} \u2014 ${R}.`),e.rollFailure=`${h} \u2014 ${R}`,S(e,j?"warning":"error",`pod handoff failed: ${e.project}`,`cluster-service:${e.project}`,{kind:"pod-handoff-failed",project:e.project,reason:n,generation:l,error:h,durationMs:Date.now()-p,oldServing:j}),setTimeout(()=>ie(e),1200).unref?.(),!1}if(e.proc!==o)return(0,discovery_1.stopRoutingTo)(e.pool,h=>(0,pod_sock_1.podSockGeneration)(h)===l),E(u,"SIGTERM"),!1;e.proc=u,e.launcher=ee.get(u),e.generation=l,e.spawnAt=p,e.state="up",e.watcher=void 0,e.staleVerifiedAt=void 0,e.staleKeptAt=void 0,e.buildFailed=!1,e.lastErrors=[];try{o.stdout?.removeAllListeners("data"),o.stderr?.removeAllListeners("data"),o.removeAllListeners("exit")}catch{}return(0,discovery_1.stopRoutingTo)(e.pool,h=>(0,pod_sock_1.podSockGeneration)(h)!==l&&path.join(e.pool.dir,h)!==k),Pe(e,o,i),setTimeout(()=>{ie(e),e.pool.scannedAt=0},1200).unref?.(),console.log(`[gateway] pod handoff ready: ${e.project} g${l} answered on ${path.basename(k)} in ${Date.now()-p}ms; retiring g${i}.`),S(e,"info",`pod handoff complete: ${e.project}`,`cluster-service:${e.project}`,{kind:"pod-handoff-complete",project:e.project,reason:n,generation:l,fromGeneration:i,durationMs:Date.now()-p}),!0},"runRoll"),be=s((e,r)=>{if(t.stopped())return{refused:"the gateway is stopping"};if(e.restart&&!e.restart.done)return{restart:e.restart,already:!0};if(!e.proc&&e.state!=="down")return{refused:`${e.project} is served by pods this gateway adopted from an earlier one \u2014 it has no tree of its own to replace. \`lensmcp gateway restart\` starts every service under this gateway.`};const n=e.proc?r.hard||e.launcher==="nx"||e.state!=="up"?"hard":"rolling":"start",o={how:n,reason:r.reason,startedAt:Date.now(),...e.proc&&e.generation!==void 0?{fromGeneration:e.generation}:{}};return e.restart=o,console.log(`[gateway] restart asked: ${e.project}${e.wsKey!==t.wsKey?` (${e.wsKey})`:""} \u2014 ${n} (${r.reason}).`),S(e,"info",`restart asked: ${e.project} (${n})`,`cluster-service:${e.project}`,{kind:"service-restart",phase:"started",project:e.project,how:n,reason:r.reason,...o.fromGeneration!==void 0?{fromGeneration:o.fromGeneration}:{}}),s(async()=>{if(n==="start")return await de(e)?{ok:!0}:{ok:!1,error:ge(e)};if(n==="rolling")return e.rolling&&await e.rolling,e.proc?(e.rollFailure=void 0,await he(e,r.reason)?{ok:!0}:{ok:!1,error:e.rollFailure??"the new tree did not take over"}):await de(e)?{ok:!0}:{ok:!1,error:ge(e)};if(q(e,`restart asked (${r.reason})`,{announce:!1}),await sleep(1500),t.stopped())return{ok:!1,error:"the gateway is stopping"};let i=!1;e.proc||(await O(),i=!0,!e.proc&&e.state!=="starting"&&U(e));try{const l=e.proc,p=e.generation,u=t.serviceKeys[(0,service_keys_1.serviceKeyId)(e.wsKey,e.project)],$=Date.now()+t.startupTimeoutMs;for(;!t.stopped()&&Date.now()<$;){if(!l||e.proc!==l||l.exitCode!==null||l.signalCode!==null)return{ok:!1,error:ge(e)};if(await _e(e,A=>A===p,u))return ce(e,"observed"),e.buildFailed=!1,{ok:!0};await sleep(ne)}return{ok:!1,error:t.stopped()?"the gateway is stopping":`no pod of the new tree answered within ${Math.round(t.startupTimeoutMs/1e3)}s`}}finally{i&&P()}},"run")().catch(i=>({ok:!1,error:i.message})).then(i=>{o.done={ok:i.ok,at:Date.now(),...e.generation!==void 0?{generation:e.generation}:{},...i.error?{error:i.error}:{}};const l=Math.round((o.done.at-o.startedAt)/100)/10;i.ok?console.log(`[gateway] restarted: ${e.project} \u2014 g${o.done.generation??"?"} serving after ${l}s (${n}).`):console.error(`[gateway] restart failed: ${e.project} \u2014 ${i.error} (${n}, after ${l}s).`),S(e,i.ok?"info":"error",i.ok?`restarted: ${e.project}`:`restart failed: ${e.project}`,`cluster-service:${e.project}`,{kind:"service-restart",phase:i.ok?"done":"failed",project:e.project,how:n,reason:r.reason,...o.fromGeneration!==void 0?{fromGeneration:o.fromGeneration}:{},...o.done.generation!==void 0?{generation:o.done.generation}:{},durationMs:o.done.at-o.startedAt,...i.error?{error:i.error}:{}})}),{restart:o,already:!1}},"restartService"),ge=s(e=>e.buildFailed?`its build failed${e.lastErrors?.length?`: ${e.lastErrors[e.lastErrors.length-1]}`:""}`:e.proc&&(e.proc.exitCode!==null||e.proc.signalCode!==null)?`its tree exited (${e.proc.exitCode??e.proc.signalCode})`:!e.proc&&e.state==="down"?"its tree exited before a pod answered":`no pod answered within ${Math.round(t.startupTimeoutMs/1e3)}s`,"startFailure"),Ee=s(e=>{const r=Date.now();e.restarts=(e.restarts??[]).filter(o=>r-o<types_1.SERVICE_RESTART_WINDOW_MS);const n=(e.wedgeRecycles??0)+1;if(e.restarts.length>=types_1.SERVICE_MAX_RESTARTS||n>types_1.SERVICE_MAX_RESTARTS){const o=e.restarts.length>=types_1.SERVICE_MAX_RESTARTS?`wedged ${types_1.SERVICE_MAX_RESTARTS}+\xD7/min`:`recycled ${types_1.SERVICE_MAX_RESTARTS}\xD7 in a row and no pod came up`;S(e,"error",`service crash-looping: ${e.project} \u2014 ${o}, not auto-recycling (the next request retries)`,`cluster-service:${e.project}`,{kind:"service-crash-loop",project:e.project,recycles:n-1}),q(e,"wedged (crash-loop cap) \u2014 leaving down for the next request",{announce:!1});return}e.wedgeRecycles=n,e.restarts.push(r),console.log(`[gateway] self-heal: recycling WEDGED ${e.project} (live parent, 0 live pods; attempt ${n}/${types_1.SERVICE_MAX_RESTARTS} with no pod up since the first, ${e.restarts.length} in the last minute; ${e.inflight??0} request(s) in flight \u2014 jobs held by the dead pod keep their locks until they expire)`),S(e,"warning",`self-heal: recycling wedged ${e.project} (0 live pods)`,`cluster-service:${e.project}`,{kind:"service-recycle",project:e.project,attempt:n,inWindow:e.restarts.length}),q(e,"wedged: 0 live pods \u2014 recycling",{announce:!1}),setTimeout(()=>{!t.stopped()&&!e.proc&&e.state==="down"&&U(e)},1500).unref?.()},"recycleWedged"),Ie={maxAgeMs:types_1.POD_MAX_AGE_MS,graceMs:types_1.POD_STALE_GRACE_MS,settleMs:types_1.POD_RECYCLE_SETTLE_MS,cooldownMs:types_1.POD_STALE_RECYCLE_COOLDOWN_MS};let fe;const te=new Map,we=new Map;let Se=!1,ve=0,le=0;const Oe=s(()=>{const e=t.projectRoots??{},r=new Set(t.services.map(o=>o.project));for(const o of t.routes)o.lens&&r.add(o.lens.project);const n=new Set;for(const o of r){const i=e[o];if(!i)continue;const l=path.relative(t.root,i).split(path.sep).filter(Boolean)[0];l&&!l.startsWith("..")&&n.add(l)}return[...n]},"managedBuckets"),Ne=s((e,r,n,o)=>{const i=t.projectSourceRoots?.[e];if(i?.length)return i;const l=t.projectRoots?.[e];if(!l)return;const p=sourceScopeDirs(t.root,l,n,r,o);return p.length>0?p:void 0},"scopeFor"),Fe=s(()=>{if(Se||Date.now()-ve<types_1.POD_STALE_SCAN_MS)return;Se=!0,ve=Date.now();const e=ve;(async()=>{const r=(0,scope_1.readSourceSetOptions)(t.root),n=r.exclude,o={ignoreTests:r.ignoreTests},i=sourceScanPass(t.root,n,o),l=await i.snapshot(),p=Date.now(),u=sourceChangeWindowMs(p,le,types_1.POD_STALE_SCAN_MS,types_1.POD_RECYCLE_SETTLE_MS),$=fe?diffSourceSets(fe,l,p,u):null;if($&&(t.sourceSetChangedAt=p,t.sourceSetChange=$,V("info","source file set changed \u2014 stale pods recycle when idle","cluster-gateway",{kind:"source-set-changed",added:$.added,removed:$.removed,truncated:$.truncated})),fe=l,!t.projectRoots){le=e;return}let A;try{A=(await fs.promises.readdir(t.root,{withFileTypes:!0})).filter(f=>f.isDirectory()).map(f=>f.name)}catch{return}const k=Oe(),h=new Set(t.services.map(f=>f.project));for(const f of t.routes)f.lens&&h.add(f.lens.project);const j=new Map;for(const f of h){const L=Ne(f,A,k,n);if(!L)continue;const x=L.join("|"),W=j.get(x)??{dirs:L,projects:[]};W.projects.push(f),j.set(x,W)}const R=Date.now(),T=sourceChangeWindowMs(R,le,types_1.POD_STALE_SCAN_MS,types_1.POD_RECYCLE_SETTLE_MS);le=e;const K=s((f,L,x)=>{t.sourceSetChangedFor??=new Map,t.sourceSetChangesFor??=new Map;for(const W of f)t.sourceSetChangedFor.set(W,L),t.sourceSetChangesFor.set(W,x)},"stampScoped"),ye=new Set([...j.values()].flatMap(f=>f.projects));for(const f of[...t.sourceSetScoped??[]])ye.has(f)||t.sourceSetScoped.delete(f);for(const[f,{dirs:L,projects:x}]of j){const W=await i.snapshot(L),$e=te.get(f);if($e||x.some(b=>we.has(b))){t.sourceSetScoped??=new Set;for(const b of x)t.sourceSetScoped.add(b)}te.set(f,W);const me=new Map;for(const b of x){const G=we.get(b);if(G===void 0||G===f)continue;const z=me.get(G)??[];z.push(b),me.set(G,z)}for(const b of x)we.set(b,f);for(const[b,G]of me){const z=te.get(b),oe=z?diffSourceSets(z,W,R,T):$;oe&&(K(G,z?R:p,oe),V("info",`source file set changed \u2014 ${G.join(", ")}'s watch scope was re-keyed`,"cluster-gateway",{kind:"source-set-changed",scoped:!0,rescoped:!0,projects:G,added:oe.added,removed:oe.removed,truncated:oe.truncated}))}if(!$e)continue;const re=diffSourceSets($e,W,R,T);re&&(K(x,R,re),V("info",`source file set changed in ${x.join(", ")}'s scope`,"cluster-gateway",{kind:"source-set-changed",scoped:!0,projects:x,added:re.added,removed:re.removed,truncated:re.truncated}))}for(const f of[...te.keys()])j.has(f)||te.delete(f)})().catch(()=>{}).finally(()=>{Se=!1})},"maybeScanSourceSet"),Ke=s((e,r)=>{const n=podChangeClock(t,e.project),o=n.change,i=`${n.scope==="project"?"in its scope":"in the workspace (its scope is not known)"}: ${changeEvidence(o)}`,l=o?.windowMs??types_1.POD_STALE_SCAN_MS+types_1.POD_RECYCLE_SETTLE_MS,p=podWatcherVerdict(e.watcher,r,l),u=s(A=>(e.staleKeptAt!==r&&(e.staleKeptAt=r,console.log(`[gateway] stale source set: pod ${e.project} ${A} \u2014 no recycle.`)),!1),"keep");if(p==="heard")return e.staleVerifiedAt=r,S(e,"info",`stale check: ${e.project} watcher confirmed \u2014 no recycle`,`cluster-service:${e.project}`,{kind:"pod-stale-verified",project:e.project,watcher:p}),u(`watcher CONFIRMED alive across the change (last build ${new Date(e.watcher?.lastBuildAt??0).toISOString()})`);if(p==="degraded")return console.log(`[gateway] stale source set: pod ${e.project} watcher DEGRADED (${e.watcher?.degraded}) \u2014 recycling.`),!0;const $=s(A=>(e.staleKeptAt!==r&&(e.staleKeptAt=r,console.log(`[gateway] stale source set: pod ${e.project} ${A}; the change ${i} \u2014 recycling.`)),!0),"recycling");return p==="silent"?types_1.POD_WATCHER_SILENT==="keep"?u("watcher alive but quiet across the change \u2014 keeping it (LENSMCP_POD_WATCHER_SILENT=keep; a live watcher cannot miss an add it will need)"):$("watcher alive but quiet across the change"):types_1.POD_WATCHER_UNVERIFIED==="keep"?u("unverifiable (no watcher testimony \u2014 older devserver bundle?) \u2014 keeping it (LENSMCP_POD_WATCHER_UNVERIFIED=keep)"):$("watcher unverifiable (no testimony yet \u2014 a pod that never rebuilt, or an older devserver bundle)")},"podStaleRecycleAllowed"),We=s((e,r)=>{if(e.lastStaleRecycleAt=Date.now(),types_1.POD_RECYCLE_MODE==="rolling"&&e.proc&&e.launcher!=="nx"){he(e,r);return}console.log(`[gateway] zombie recycle: ${e.project} (${r}) \u2014 stale fs view; fresh pod incoming`),S(e,"warning",`zombie recycle: ${e.project} (${r})`,`cluster-service:${e.project}`,{kind:"pod-recycle",project:e.project,reason:r});const n=!!e.decl.eager;q(e,`${r} \u2014 recycling stale pod`,{announce:!1}),n&&setTimeout(()=>{!t.stopped()&&!e.proc&&e.state==="down"&&U(e)},1500).unref?.()},"recyclePod"),qe=s(()=>{const e=setInterval(()=>{Ge().catch(r=>console.error("[gateway] sweep error:",r))},t.sweepMs);return e.unref(),e},"startSweeper"),Ge=s(async()=>{{if(t.stopped())return;for(const e of t.graphStores?.all()??[])e.refreshIfStale();types_1.POD_RECYCLE_ENABLED&&Fe();for(const e of t.registry?t.registry.allServices():t.services){if(t.stopped()||!e.proc){e.wedgedSince=void 0;continue}const r=path.resolve(e.root)===path.resolve(t.root),n=e.decl.idleKillSec;if(n&&e.inflight===0&&Date.now()-e.lastUsed>n*1e3){q(e,`idle ${n}s`),e.wedgedSince=void 0;continue}const o=e.state==="starting"&&e.spawnAt!==void 0&&Date.now()-e.spawnAt<t.startupTimeoutMs,i=N(e.pool)>0;if(i||o){if(e.wedgedSince=void 0,i&&ce(e,"observed"),i&&!o&&types_1.POD_RECYCLE_ENABLED&&r){const l=podChangeClock(t,e.project).at;await ke(e);const p=(e.staleVerifiedAt??0)>=l&&l>0,u=podRecycleReason(e,Date.now(),p?0:l,Ie);if(u==="stale-source-set"&&!Ke(e,l))continue;u&&We(e,u)}continue}e.wedgedSince??=Date.now(),Date.now()-e.wedgedSince>types_1.WEDGE_RECYCLE_GRACE_MS&&(e.wedgedSince=void 0,Ee(e))}}},"sweepOnce");return{scanNow:N,spawnService:U,ensureUp:de,scaleUp:Te,killSpawned:q,markUp:ce,startSweeper:qe,rollPod:he,restartService:be,recycleWedged:Ee,stopRetiringTrees:De,stopBuildHost:s(e=>e===void 0?m.stop():m.release(e),"stopBuildHost")}}v(createServiceLayer,"createServiceLayer"),s(createServiceLayer,"createServiceLayer");function chooseStalePodKillTarget(t,a,c){if(!(t===void 0||!Number.isInteger(t)||t<=1)&&!(a!==void 0&&a!==t)&&t!==c)return t}v(chooseStalePodKillTarget,"chooseStalePodKillTarget"),s(chooseStalePodKillTarget,"chooseStalePodKillTarget");

package/executors/gateway/runtime/own-log.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Keep the daemon's own `gateway.log` bounded while it runs (issues/closed/foodguard-77).
+ *
+ * `gateway.log` is not a file the gateway opens: `lensmcp gateway start` opens it for append and hands it to the daemon
+ * as stdout and stderr (`cli.ts`), and the nx wrapper, the gateway and every service line relayed through it write
+ * there. The CLI rotated it only at start, so a long run grew without bound — FoodGuard's 1.25.0 run left 410 MB in
+ * 19 hours, its 1.25.2 run ~108 MB an hour (TypeORM's slow-query SQL, ~40 KB a statement), and the next start
+ * overwrote the one generation it kept.
+ *
+ * A rename would not do — every writer's descriptor would follow the renamed file. So: copy, then truncate. The
+ * descriptor is opened for append, so every writer goes on at the new end. Generations shift `.1` → `.2` → … → `.N`,
+ * the oldest dropped (the CLI's start-time sweep shifts the same way). Lines written between the copy and the
+ * truncate — a few milliseconds of a 50 MB file — are lost; that is the price of not owning the descriptor.
+ *
+ * Only when this process's stdout IS `<root>/.lensmcp/gateway.log` (same device and inode): a gateway run in a
+ * terminal, or under a test, has nothing to rotate.
+ */
+export declare const OWN_LOG_MAX_BYTES: number;
+export declare const OWN_LOG_GENERATIONS = 3;
+/** `<file>.1` … `.N-1` move up one; the oldest goes. */
+export declare function shiftGenerations(file: string, keep: number): void;
+export interface OwnLogOptions {
+    /** The descriptor to watch and truncate — this process's stdout unless a spec hands another. */
+    fd?: number;
+    maxBytes?: number;
+    keep?: number;
+    /** A line in the new file saying where the old lines went. */
+    note?: (line: string) => void;
+}
+/** One look: rotates when `fd` is `file` and over the cap. Returns whether it rotated. */
+export declare function rotateOwnLog(file: string, opts?: OwnLogOptions): boolean;
+/** Look every 30 s while the gateway runs; the returned function stops it. */
+export declare function startOwnLogRotation(root: string, opts?: OwnLogOptions & {
+    everyMs?: number;
+}): () => void;
+/**
+ * A service's output, every line tagged with it. The relay used to tag a chunk — so a multi-line record (TypeORM's
+ * «query is slow» with its SQL and parameters, a stack) had one `[engine]` on its first line and nothing on the rest,
+ * and a chunk that began mid-line put the tag in the middle of one. Per stream: whether the next byte starts a line.
+ */
+export declare function linePrefixer(project: string): (text: string) => string;

package/executors/gateway/runtime/own-log.js

@@ -0,0 +1,3 @@
+"use strict";var _=Object.defineProperty;var s=(e,t)=>_(e,"name",{value:t,configurable:!0});var u=Object.defineProperty,a=s((e,t)=>u(e,"name",{value:t,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0}),exports.OWN_LOG_GENERATIONS=exports.OWN_LOG_MAX_BYTES=void 0,exports.shiftGenerations=shiftGenerations,exports.rotateOwnLog=rotateOwnLog,exports.startOwnLogRotation=startOwnLogRotation,exports.linePrefixer=linePrefixer;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path"));exports.OWN_LOG_MAX_BYTES=50*1024*1024,exports.OWN_LOG_GENERATIONS=3;const CHECK_EVERY_MS=3e4;function shiftGenerations(e,t){try{fs.unlinkSync(`${e}.${t}`)}catch{}for(let r=t-1;r>=1;r--)try{fs.renameSync(`${e}.${r}`,`${e}.${r+1}`)}catch{}}s(shiftGenerations,"shiftGenerations"),a(shiftGenerations,"shiftGenerations");function rotateOwnLog(e,t={}){const r=t.fd??1,o=t.maxBytes??exports.OWN_LOG_MAX_BYTES,i=t.keep??exports.OWN_LOG_GENERATIONS;let n,c;try{n=fs.fstatSync(r),c=fs.statSync(e)}catch{return!1}if(!n.isFile()||n.dev!==c.dev||n.ino!==c.ino||n.size<=o)return!1;try{shiftGenerations(e,i),fs.copyFileSync(e,`${e}.1`);try{fs.chmodSync(`${e}.1`,384)}catch{}fs.ftruncateSync(r,0)}catch{return!1}return(t.note??(f=>{try{fs.writeSync(r,`${f}
+`)}catch{}}))(`[gateway] ${path.basename(e)} passed ${Math.round(o/1048576)} MB \u2014 rotated; the lines before are in ${path.basename(e)}.1 (\u2026${i} kept)`),!0}s(rotateOwnLog,"rotateOwnLog"),a(rotateOwnLog,"rotateOwnLog");function startOwnLogRotation(e,t={}){const r=path.join(e,".lensmcp","gateway.log"),o=setInterval(()=>rotateOwnLog(r,t),t.everyMs??CHECK_EVERY_MS);return o.unref?.(),()=>clearInterval(o)}s(startOwnLogRotation,"startOwnLogRotation"),a(startOwnLogRotation,"startOwnLogRotation");function linePrefixer(e){let t=!0;const r=`[${e}] `;return o=>{let i="";for(const n of o.split(/(?<=\n)/))n&&(i+=(t?r:"")+n,t=n.endsWith(`
+`));return i}}s(linePrefixer,"linePrefixer"),a(linePrefixer,"linePrefixer");

package/executors/gateway/runtime/proxy.d.ts

@@ -56,6 +56,7 @@ export interface WedgeDetail {
     /** Why the last probe found none — `deadline` when no probe is configured (`LENSMCP_POD_SLOW_FIRST_BYTE_MS=0`). */
     failure: PodProbeFailure | 'deadline';
 }
+export declare function upstreamOpen(req: http.IncomingMessage): boolean;
 /** What the client reads in the 502 — what happened, and what it means for the call (issues/closed/foodguard-54). */
 export declare function wedgedMessage(podName: string, project: string, d: WedgeDetail): string;
 export declare function createProxy(rt: GatewayRuntime, obs: Observability, svcLayer: ServiceLayer): ProxyLayer;

package/executors/gateway/runtime/proxy.js

@@ -1 +1 @@
-"use strict";var ee=Object.defineProperty;var D=(t,d)=>ee(t,"name",{value:d,configurable:!0});var Z=Object.defineProperty,s=D((t,d)=>Z(t,"name",{value:d,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.isReplayableRequest=isReplayableRequest,exports.wedgedMessage=wedgedMessage,exports.createProxy=createProxy;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),http=tslib_1.__importStar(require("node:http")),path=tslib_1.__importStar(require("node:path")),discovery_1=require("./discovery"),edge_1=require("./edge"),gateway_errors_1=require("../gateway-errors"),body_stall_1=require("../body-stall"),types_1=require("./types"),pod_probe_1=require("./pod-probe"),gc_notice_1=require("../../../gc-notice"),service_keys_1=require("./service-keys");function isConnError(t){const d=t.code??"";return d==="ECONNREFUSED"||d==="ECONNRESET"||d==="ETIMEDOUT"||d==="EPIPE"||d==="EHOSTUNREACH"||d==="ENOENT"||/ECONNREFUSED|ECONNRESET|socket hang up|EPIPE/i.test(t.message)}D(isConnError,"isConnError"),s(isConnError,"isConnError");const IDEMPOTENT_METHODS=new Set(["GET","HEAD","OPTIONS","PUT","DELETE","TRACE"]);function isReplayableRequest(t){if(!IDEMPOTENT_METHODS.has((t.method??"GET").toUpperCase())||t.headers["transfer-encoding"]!==void 0)return!1;const d=t.headers["content-length"];return!(d!==void 0&&String(d).trim()!=="0")}D(isReplayableRequest,"isReplayableRequest"),s(isReplayableRequest,"isReplayableRequest");function edgeGone(t,d){return d.headersSent||d.writableEnded||d.destroyed===!0||t.aborted===!0}D(edgeGone,"edgeGone"),s(edgeGone,"edgeGone");const HOP_BY_HOP=new Set(["connection","keep-alive","proxy-connection","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade"]),UPSTREAM_CONNECTION_HEADERS=["connection","keep-alive","proxy-connection"];function returnRequestId(t,d){if(t["x-request-id"]!==void 0)return;const f=d.headers["x-request-id"],O=Array.isArray(f)?f[0]:f;typeof O=="string"&&O!==""&&(t["x-request-id"]=O)}D(returnRequestId,"returnRequestId"),s(returnRequestId,"returnRequestId");const httpProxy=require("http-proxy");function declaredFirstByteMs(t){const d=Number(t);return Number.isFinite(d)&&d>0?d:types_1.POD_RESPONSE_TIMEOUT_MS}D(declaredFirstByteMs,"declaredFirstByteMs"),s(declaredFirstByteMs,"declaredFirstByteMs");const secs=s(t=>`${(t/1e3).toFixed(1)}s`,"secs");function wedgedMessage(t,d,f){const O=f.failure==="gone"?"its process is gone":f.failure==="silent"?`it did not answer its liveness check for ${secs(f.silentMs)}`:"it gave no liveness answer";return`Pod ${t} of ${d} sent no response for ${secs(f.heldMs)} and ${O} \u2014 taken out of rotation, and the service is being restarted, so work it was still doing for this request may have been cut short. Retry if the call is safe to repeat.`}D(wedgedMessage,"wedgedMessage"),s(wedgedMessage,"wedgedMessage");function armFirstByteGuard(t){let d,f=!1,O=!1,x,R=0,$=(0,body_stall_1.requestBodyArriving)(t.req)?void 0:Date.now();const q=s(()=>{$??=Date.now()},"onBodyEnd");$===void 0&&t.req.once("end",q);const L=s(()=>($===void 0&&!(0,body_stall_1.requestBodyArriving)(t.req)&&($=Date.now()),$===void 0?0:Date.now()-$),"heldMs"),U=s(b=>{d=setTimeout(V,b),d.unref?.()},"arm"),V=s(()=>{if(f||!t.pending())return;const b=L();if(t.ceilingMs<=0){if($!==void 0&&b>=t.firstByteMs){t.onWedged(`no response within ${b}ms (wedged socket) \u2014 evicted + respawning`,{heldMs:b,silentMs:0,probes:0,failure:"deadline"});return}U($===void 0?t.firstByteMs:t.firstByteMs-b);return}(0,pod_probe_1.probePodAliveVerdict)(t.socketPath,void 0,t.serviceKey).then(({alive:A,failure:C})=>{if(f||!t.pending())return;const T=L();if(!A){if(R+=1,C==="silent"&&(0,gc_notice_1.inAnnouncedGc)(t.socketPath)){x=void 0,U(types_1.POD_ALIVE_PROBE_TIMEOUT_MS);return}if(C==="silent"&&types_1.POD_WEDGE_CONFIRM_MS>0&&(x??=Date.now(),Date.now()-x<types_1.POD_WEDGE_CONFIRM_MS)){U(types_1.POD_ALIVE_PROBE_TIMEOUT_MS);return}const N=x===void 0?0:Date.now()-x,H=C==="gone"?"its socket no longer accepts (the pod process is gone)":C==="silent"?`nothing answered on ${types_1.POD_ALIVE_PATH} for ${N}ms (${R} probe${R===1?"":"s"})`:`no liveness answer on ${types_1.POD_ALIVE_PATH}`;t.onWedged(`no response within ${T}ms and ${H} (wedged socket) \u2014 evicted + respawning`,{heldMs:T,silentMs:N,probes:R,failure:C??"no-route"});return}if(x=void 0,T>=t.ceilingMs){t.onCeiling(`alive on ${types_1.POD_ALIVE_PATH} but no response within ${T}ms (ceiling ${t.ceilingMs}ms) \u2014 giving up on this request, pod kept`,A);return}!O&&$!==void 0&&(O=!0,t.onSlow(T,A)),U(Math.max(t.firstByteMs,types_1.POD_ALIVE_PROBE_TIMEOUT_MS))})},"onDeadline");return U(t.firstByteMs),{clear:s(()=>{f=!0,d&&clearTimeout(d),t.req.removeListener("end",q)},"clear")}}D(armFirstByteGuard,"armFirstByteGuard"),s(armFirstByteGuard,"armFirstByteGuard");function createProxy(t,d,f){const{recordEdge:O,finishTrace:x,traceStep:R,emit:$}=d,q=s((e,r,o,c)=>{const p=c.kind==="pod-evicted";$(p?"error":"warning",`${p?"pod evicted":"request given up"}: ${e.project} (${o}) \u2014 ${c.status}`,`cluster-pod-incident:${e.project}`,{kind:c.kind,project:e.project,pod:o,status:c.status,reason:c.reason,traceId:(0,gateway_errors_1.ensureRequestId)(r),method:r.method,path:(r.url??"").split("?")[0],...c.detail??{}})},"reportPodIncident"),L=s(async(e,r)=>{const o=e.pool;if(!o)return;o.scannedAt=0;let c=(0,discovery_1.pickSock)(o,t.scanTtlMs);return!c&&e.svc&&(R(r,"cold-start",{project:e.project}),await f.ensureUp(e.svc)&&(o.scannedAt=0,c=(0,discovery_1.pickSock)(o,t.scanTtlMs))),c},"anotherPod"),U=s((e,r,o,c,p)=>{console.log(`[gateway] pod ${o} of ${e.project} is gone \u2014 its ${r.method} was not answered, sending it to ${c}`),$("info",`request moved to another pod: ${e.project} (${o} \u2192 ${c})`,`cluster-pod-moved:${e.project}`,{kind:"pod-gone-rerouted",project:e.project,pod:o,to:c,reason:p,traceId:(0,gateway_errors_1.ensureRequestId)(r),method:r.method,path:(r.url??"").split("?")[0]})},"reportPodMoved"),V=s(async e=>{if(!e.lens||!t.lensSupervisor)return"unsupported";let r;const o=new Promise(g=>{r=setTimeout(()=>g("timeout"),types_1.LENS_REQUEST_RECOVERY_WAIT_MS),r.unref?.()}),c=t.lensSupervisor.recover(e.lens,"proxy-connection").then(g=>g?"ready":"failed").catch(()=>"failed"),p=await Promise.race([c,o]);r&&clearTimeout(r);const S=t.lensSupervisor.status(e.lens);return p==="failed"&&(!S||S.state==="ready")?"unsupported":p},"waitForManagedRecovery"),b=s((e,r,o,c,p,S)=>{if(o.headersSent||o.writableEnded||o.destroyed){o.destroyed||o.destroy();return}const g=e.lens?t.lensSupervisor?.status(e.lens):void 0,_=S==="timeout"||g?.state==="starting"||g?.state==="replacing",P=(0,gateway_errors_1.ensureRequestId)(r),l=e.lens?{project:e.project,reason:g?.reason??"connection-failure",generation:g?.generation??0,..._?{retryAfterMs:2e3}:{}}:void 0,a=_?503:502,y=_?"starting":"unavailable";console.error(`[gateway] ${new Date().toISOString()} upstream-error traceId=${P} project=${e.project} target=${String(c)} state=${g?.state??"unmanaged"} generation=${g?.generation??0}: ${p.message}`),$("warning",`upstream unavailable: ${e.project}`,`cluster-upstream:${e.project}`,{kind:"upstream-error",traceId:P,project:e.project,target:String(c),state:g?.state??"unmanaged",generation:g?.generation,error:p.message}),(0,edge_1.sendError)(o,r,a,y,_?`Upstream ${e.project} is restarting.`:`Upstream ${e.project} unavailable.`,l,_?{"retry-after":"2"}:void 0)},"sendTerminalUpstreamError"),A=(0,body_stall_1.createBodyStallGuard)(t.bodyStallMs??types_1.BODY_STALL_MS),C={keepAlive:!0,keepAliveMsecs:3e4,maxSockets:1024,maxFreeSockets:256},T=new http.Agent(C),N=new(require("node:https")).Agent(C),H=s(e=>typeof e=="string"&&e.startsWith("https:")?N:T,"agentForTarget"),B=httpProxy.createProxyServer({xfwd:!1,secure:!1,proxyTimeout:12e4,agent:T}),Y=s((e,r,o)=>{const c=s(()=>{o()||e.destroyed||e.destroy()},"onEdgeClose");r.once("close",c),e.once("close",()=>r.removeListener("close",c))},"propagateEdgeCancel");B.on("proxyReq",(e,r,o)=>{for(const c of UPSTREAM_CONNECTION_HEADERS)e.removeHeader(c);e.setHeader("connection","keep-alive"),Y(e,o,()=>o.writableEnded)}),B.on("proxyRes",(e,r,o)=>{const c=r.__lensmcpPod;c&&(e.headers["x-lensmcp-pod"]=c),delete e.headers["x-powered-by"],e.headers.server="LensMCP",returnRequestId(e.headers,r),o&&Y(e,o,()=>o.writableEnded),o&&A.armResponse(o)});const Q=s((e,r,o,c)=>{(0,edge_1.stampForwardingHeaders)(t,r),A.arm(r);const p={},S=r.method==="GET"||r.method==="HEAD"||r.method==="OPTIONS";for(const[n,i]of Object.entries(r.headers))i===void 0||n.startsWith(":")||HOP_BY_HOP.has(n)||S&&(n==="content-length"||n==="transfer-encoding")||(p[n]=i);let g=http,_;if(typeof e=="object")_={socketPath:e.socketPath,path:r.url,method:r.method,headers:p,agent:T};else{const n=new URL(e),i=n.protocol==="https:";g=i?require("node:https"):http,p.host=n.host,_={protocol:n.protocol,hostname:n.hostname,port:n.port||(i?443:80),path:r.url,method:r.method,headers:p,agent:H(e)}}const P=o;P.__lensmcpErrContained||(P.__lensmcpErrContained=!0,o.on("error",()=>{}));let l;const a=s(()=>{o.writableEnded||u.destroy()},"onReqGone"),y=s(()=>{l&&!l.destroyed&&l.destroy()},"onEdgeClose"),v=s(()=>{r.removeListener("error",a),r.removeListener("aborted",a),r.removeListener("close",a),o.removeListener("close",y)},"detach"),u=g.request(_,n=>{if(l=n,c.onResponse(),o.headersSent||o.writableEnded||o.destroyed){n.destroy();return}const i={};for(const[k,I]of Object.entries(n.headers))I===void 0||HOP_BY_HOP.has(k)||(i[k]=I);delete i["x-powered-by"],i.server="LensMCP",returnRequestId(i,r);const w=r.__lensmcpPod;w&&(i["x-lensmcp-pod"]=w);try{o.writeHead(n.statusCode??502,i)}catch(k){console.error("[gateway] h2 relay: bad response header, resetting stream:",k.message),n.destroy(),o.destroyed||o.destroy(k);return}n.pipe(o),A.armResponse(o);const j=s(()=>{!o.writableEnded&&!o.destroyed&&o.destroy()},"abortEdge");n.once("error",j),n.once("close",j),o.on("close",y)});u.once("error",n=>c.onError(n)),u.once("close",v),r.on("error",a),r.on("aborted",a),r.on("close",a),S?u.end():r.pipe(u)},"pipeUpstream"),X=s(async(e,r,o)=>{const c=r.__lensmcpTrace;if(e.pool){const l=e.svc;l&&(l.lastUsed=Date.now(),l.inflight+=1,o.on("close",()=>{l.inflight-=1,l.lastUsed=Date.now()}));let a=(0,discovery_1.pickSock)(e.pool,t.scanTtlMs);if(!a&&l&&(R(c,"cold-start",{project:e.project}),await f.ensureUp(l)&&(a=(0,discovery_1.pickSock)(e.pool,t.scanTtlMs))),l&&a&&f.markUp(l,"observed"),l&&f.scaleUp(l),!a){const v=l?.lastErrors?.length?` Service errors: ${l.lastErrors.join("; ")}`:"";(0,edge_1.sendError)(o,r,503,"unavailable",`Service ${e.project} is not reachable (no pods in ${e.pool.dir}).${v} The watcher recovers and the next request retries automatically.`);return}const y=s((v,u)=>{const n=path.basename(v,".sock");r.__lensmcpPod=n,R(c,"pod-select",{pod:n,pods:e.pool.socks.length,strategy:"round-robin",...u?{movedFrom:u}:{}});let i=!1;const w=s((h,M="unlink")=>{if(e.pool.socks=e.pool.socks.filter(E=>E!==v),e.pool.idx=-1,M==="unlink")try{fs.unlinkSync(v)}catch{}console.error(`[gateway] pod ${n} of ${e.project}: ${h}`)},"evictPod"),j=armFirstByteGuard({socketPath:v,serviceKey:t.serviceKeys[(0,service_keys_1.serviceKeyId)(e.svc?.wsKey,e.project)],req:r,firstByteMs:declaredFirstByteMs(e.svc?.decl?.firstByteMs),ceilingMs:types_1.POD_SLOW_FIRST_BYTE_MS,pending:s(()=>!i&&!o.headersSent&&!o.writableEnded,"pending"),onWedged:s((h,M)=>{i=!0,w(h),q(e,r,n,{kind:"pod-evicted",status:502,reason:h,detail:M}),(0,edge_1.sendError)(o,r,502,"unavailable",wedgedMessage(n,e.project,M))},"onWedged"),onCeiling:s(h=>{i=!0,w(h,"keep"),q(e,r,n,{kind:"request-gave-up",status:504,reason:h}),(0,edge_1.sendError)(o,r,504,"unavailable",`Pod ${n} of ${e.project} did not answer in time \u2014 retry, or raise cluster.firstByteMs. The pod was kept: the request may still complete there.`)},"onCeiling"),onSlow:s((h,M)=>{console.log(`[gateway] pod ${n} of ${e.project}: slow first byte, pod alive (${h}ms, ${M.inflight} in-flight, ${M.activeWork} background) \u2014 waiting, not evicting. Set cluster.firstByteMs on ${e.project} to size this route's budget.`)},"onSlow")});o.on("close",()=>j.clear());const k=v,I=isReplayableRequest(r);let F=0;const W=s(()=>{F+=1,Q({socketPath:k},r,o,{onResponse:s(()=>{j.clear(),i=!0},"onResponse"),onError:s(h=>{if(!i){if(edgeGone(r,o)){j.clear(),i=!0;return}(0,pod_probe_1.podConnectionVerdict)(k,h).then(M=>{if(!i){if(M==="alive"&&F<2&&I&&!edgeGone(r,o)){console.log(`[gateway] pod ${n} of ${e.project}: ${h.message} on one connection, the pod still accepts \u2014 sending the ${r.method} again on a fresh one`),W();return}if(j.clear(),i=!0,M==="gone"){w(h.message);const E=s(()=>{q(e,r,n,{kind:"pod-evicted",status:502,reason:`${h.message} \u2014 its socket no longer accepts (the pod process is gone)${u?`; the request had already been moved here from ${u}`:""}`}),(0,edge_1.sendError)(o,r,502,"unavailable",`Pod ${n} of ${e.project} is gone (${h.message}) \u2014 retry.`)},"giveUp");if(u||!I){E();return}L(e,c).then(m=>{if(!edgeGone(r,o)){if(!m){E();return}U(e,r,n,path.basename(m,".sock"),h.message),y(m,n)}},E);return}console.error(`[gateway] pod ${n} of ${e.project}: ${h.message} on one connection \u2014 the pod still accepts connections, so it stays in the pool`),(0,edge_1.sendError)(o,r,502,"unavailable",`Pod ${n} of ${e.project} dropped the connection \u2014 retry.`)}})}},"onError")})},"sendToPod");W()},"onPod");y(a);return}const p=Date.now()+types_1.UPSTREAM_HEAL_WINDOW_MS;let S=0,g=!1;const _=isReplayableRequest(r),P=s(()=>{if(edgeGone(r,o))return;const l=e.target;Q(l,r,o,{onResponse:s(()=>{},"onResponse"),onError:s(a=>{if(isConnError(a)&&(S+=1),e.lens&&isConnError(a)&&_&&S>=2&&!g&&!edgeGone(r,o)){g=!0,V(e).then(y=>{if(!edgeGone(r,o)){if(y==="ready"){P();return}if(y==="unsupported"&&Date.now()<p){setTimeout(P,types_1.UPSTREAM_HEAL_STEP_MS).unref?.();return}b(e,r,o,e.target,a,y)}});return}if(isConnError(a)&&_&&Date.now()<p&&!edgeGone(r,o)){setTimeout(P,types_1.UPSTREAM_HEAL_STEP_MS).unref?.();return}if(o.headersSent||o.writableEnded||o.destroyed){o.destroyed||o.destroy();return}b(e,r,o,l,a)},"onError")})},"tryTcp");P()},"forwardNative");return{proxy:B,forward:s(async(e,r,o)=>{const c=Date.now(),p=r.__lensmcpTrace;if(o.on("close",()=>{O(e,Date.now()-c,o.statusCode??0,r.__lensmcpCaller),x(p,e.project,o.statusCode??0,{...r.__lensmcpPod?{pod:r.__lensmcpPod}:{},...r.__lensmcpCaller?{caller:r.__lensmcpCaller}:{}},e)}),e.prependPrefix&&!r.url?.startsWith(e.prependPrefix)&&(r.url=e.prependPrefix+(r.url??"/")),(0,edge_1.stampForwardingHeaders)(t,r),A.arm(r),(r.httpVersionMajor??1)>=2){await X(e,r,o);return}if(e.pool){const a=e.svc;a&&(a.lastUsed=Date.now(),a.inflight+=1,o.on("close",()=>{a.inflight-=1,a.lastUsed=Date.now()}));let y=(0,discovery_1.pickSock)(e.pool,t.scanTtlMs);if(!y&&a&&(R(p,"cold-start",{project:e.project}),await f.ensureUp(a)&&(y=(0,discovery_1.pickSock)(e.pool,t.scanTtlMs))),a&&y&&f.markUp(a,"observed"),a&&f.scaleUp(a),!y){const u=a?.lastErrors?.length?` Service errors: ${a.lastErrors.join("; ")}`:"";(0,edge_1.sendError)(o,r,503,"unavailable",`Service ${e.project} is not reachable (no pods in ${e.pool.dir}).${u} The watcher recovers and the next request retries automatically.`);return}const v=s((u,n)=>{const i=path.basename(u,".sock");r.__lensmcpPod=i,R(p,"pod-select",{pod:i,pods:e.pool.socks.length,strategy:"round-robin",...n?{movedFrom:n}:{}});let w=!1;const j=s((E,m="unlink")=>{if(e.pool.socks=e.pool.socks.filter(G=>G!==u),e.pool.idx=-1,m==="unlink")try{fs.unlinkSync(u)}catch{}console.error(`[gateway] pod ${i} of ${e.project}: ${E}`)},"evictPod"),k=armFirstByteGuard({socketPath:u,serviceKey:t.serviceKeys[(0,service_keys_1.serviceKeyId)(e.svc?.wsKey,e.project)],req:r,firstByteMs:declaredFirstByteMs(e.svc?.decl?.firstByteMs),ceilingMs:types_1.POD_SLOW_FIRST_BYTE_MS,pending:s(()=>!w&&!o.headersSent&&!o.writableEnded,"pending"),onWedged:s((E,m)=>{w=!0,j(E),q(e,r,i,{kind:"pod-evicted",status:502,reason:E,detail:m}),(0,edge_1.sendError)(o,r,502,"unavailable",wedgedMessage(i,e.project,m))},"onWedged"),onCeiling:s(E=>{w=!0,j(E,"keep"),q(e,r,i,{kind:"request-gave-up",status:504,reason:E}),(0,edge_1.sendError)(o,r,504,"unavailable",`Pod ${i} of ${e.project} did not answer in time \u2014 retry, or raise cluster.firstByteMs. The pod was kept: the request may still complete there.`)},"onCeiling"),onSlow:s((E,m)=>{console.log(`[gateway] pod ${i} of ${e.project}: slow first byte, pod alive (${E}ms, ${m.inflight} in-flight, ${m.activeWork} background) \u2014 waiting, not evicting. Set cluster.firstByteMs on ${e.project} to size this route's budget.`)},"onSlow")});o.on("close",()=>k.clear());const I=Math.max(12e4,types_1.POD_SLOW_FIRST_BYTE_MS+6e4),F=u,W=isReplayableRequest(r);let h=0;const M=s(()=>{h+=1;const E=Date.now();B.web(r,o,{target:{socketPath:F},agent:T,proxyTimeout:I},m=>{if(!w){if(edgeGone(r,o)){k.clear(),w=!0;return}(0,pod_probe_1.podConnectionVerdict)(F,m).then(G=>{if(w)return;const J=Date.now()-E>=I-250;if(G==="alive"&&h<2&&W&&!J&&!edgeGone(r,o)){console.log(`[gateway] pod ${i} of ${e.project}: ${m.message} on one connection, the pod still accepts \u2014 sending the ${r.method} again on a fresh one`),M();return}if(k.clear(),w=!0,G==="gone"){j(m.message);const K=s(()=>{q(e,r,i,{kind:"pod-evicted",status:502,reason:`${m.message} \u2014 its socket no longer accepts (the pod process is gone)${n?`; the request had already been moved here from ${n}`:""}`}),(0,edge_1.sendError)(o,r,502,"unavailable",`Pod ${i} of ${e.project} is gone (${m.message}) \u2014 retry.`)},"giveUp");if(n||!W||J){K();return}L(e,p).then(z=>{if(!edgeGone(r,o)){if(!z){K();return}U(e,r,i,path.basename(z,".sock"),m.message),v(z,i)}},K);return}console.error(`[gateway] pod ${i} of ${e.project}: ${m.message} on one connection \u2014 the pod still accepts connections, so it stays in the pool`),(0,edge_1.sendError)(o,r,502,"unavailable",`Pod ${i} of ${e.project} dropped the connection \u2014 retry.`)})}})},"sendToPod");M()},"onPod");v(y);return}const S=Date.now()+types_1.UPSTREAM_HEAL_WINDOW_MS;let g=0,_=!1;const P=isReplayableRequest(r),l=s(()=>{if(edgeGone(r,o))return;const a=e.target,y={target:a,autoRewrite:typeof a=="string",changeOrigin:!0,agent:H(a)};B.web(r,o,y,v=>{if(isConnError(v)&&(g+=1),e.lens&&isConnError(v)&&P&&g>=2&&!_&&!edgeGone(r,o)){_=!0,V(e).then(u=>{if(!edgeGone(r,o)){if(u==="ready"){l();return}if(u==="unsupported"&&Date.now()<S){setTimeout(l,types_1.UPSTREAM_HEAL_STEP_MS).unref?.();return}b(e,r,o,e.target,v,u)}});return}if(isConnError(v)&&P&&Date.now()<S&&!edgeGone(r,o)){setTimeout(l,types_1.UPSTREAM_HEAL_STEP_MS).unref?.();return}o.destroyed||b(e,r,o,a,v)})},"tryTcp");l()},"forward"),agentForTarget:H,destroyAgents:s(()=>{A.stop(),T.destroy(),N.destroy()},"destroyAgents"),closeProxy:s(()=>{try{B.close?.()}catch{}},"closeProxy")}}D(createProxy,"createProxy"),s(createProxy,"createProxy");
+"use strict";var ee=Object.defineProperty;var D=(o,c)=>ee(o,"name",{value:c,configurable:!0});var Z=Object.defineProperty,s=D((o,c)=>Z(o,"name",{value:c,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.isReplayableRequest=isReplayableRequest,exports.upstreamOpen=upstreamOpen,exports.wedgedMessage=wedgedMessage,exports.createProxy=createProxy;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),http=tslib_1.__importStar(require("node:http")),path=tslib_1.__importStar(require("node:path")),discovery_1=require("./discovery"),edge_1=require("./edge"),gateway_errors_1=require("../gateway-errors"),body_stall_1=require("../body-stall"),types_1=require("./types"),pod_probe_1=require("./pod-probe"),gc_notice_1=require("../../../gc-notice"),service_keys_1=require("./service-keys");function isConnError(o){const c=o.code??"";return c==="ECONNREFUSED"||c==="ECONNRESET"||c==="ETIMEDOUT"||c==="EPIPE"||c==="EHOSTUNREACH"||c==="ENOENT"||/ECONNREFUSED|ECONNRESET|socket hang up|EPIPE/i.test(o.message)}D(isConnError,"isConnError"),s(isConnError,"isConnError");const IDEMPOTENT_METHODS=new Set(["GET","HEAD","OPTIONS","PUT","DELETE","TRACE"]);function isReplayableRequest(o){if(!IDEMPOTENT_METHODS.has((o.method??"GET").toUpperCase())||o.headers["transfer-encoding"]!==void 0)return!1;const c=o.headers["content-length"];return!(c!==void 0&&String(c).trim()!=="0")}D(isReplayableRequest,"isReplayableRequest"),s(isReplayableRequest,"isReplayableRequest");function edgeGone(o,c){return c.headersSent||c.writableEnded||c.destroyed===!0||o.aborted===!0}D(edgeGone,"edgeGone"),s(edgeGone,"edgeGone");const HOP_BY_HOP=new Set(["connection","keep-alive","proxy-connection","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade"]),UPSTREAM_CONNECTION_HEADERS=["connection","keep-alive","proxy-connection"];function returnRequestId(o,c){if(o["x-request-id"]!==void 0)return;const u=c.headers["x-request-id"],q=Array.isArray(u)?u[0]:u;typeof q=="string"&&q!==""&&(o["x-request-id"]=q)}D(returnRequestId,"returnRequestId"),s(returnRequestId,"returnRequestId");const httpProxy=require("http-proxy");function declaredFirstByteMs(o){const c=Number(o);return Number.isFinite(c)&&c>0?c:types_1.POD_RESPONSE_TIMEOUT_MS}D(declaredFirstByteMs,"declaredFirstByteMs"),s(declaredFirstByteMs,"declaredFirstByteMs");const secs=s(o=>`${(o/1e3).toFixed(1)}s`,"secs"),upstreams=new WeakMap;function upstreamOpen(o){const c=upstreams.get(o),u=c?.socket;return!!c&&!c.destroyed&&!!u&&!u.destroyed}D(upstreamOpen,"upstreamOpen"),s(upstreamOpen,"upstreamOpen");function wedgedMessage(o,c,u){const q=u.failure==="gone"?"its process is gone":u.failure==="silent"?`it did not answer its liveness check for ${secs(u.silentMs)}`:"it gave no liveness answer";return`Pod ${o} of ${c} sent no response for ${secs(u.heldMs)} and ${q} \u2014 taken out of rotation, and the service is being restarted, so work it was still doing for this request may have been cut short. Retry if the call is safe to repeat.`}D(wedgedMessage,"wedgedMessage"),s(wedgedMessage,"wedgedMessage");function armFirstByteGuard(o){let c,u=!1,q=!1,V=!1,k,x=0,E=(0,body_stall_1.requestBodyArriving)(o.req)?void 0:Date.now();const N=s(()=>{E??=Date.now()},"onBodyEnd");E===void 0&&o.req.once("end",N);const H=s(()=>(E===void 0&&!(0,body_stall_1.requestBodyArriving)(o.req)&&(E=Date.now()),E===void 0?0:Date.now()-E),"heldMs"),A=s(T=>{c=setTimeout(C,T),c.unref?.()},"arm"),C=s(()=>{if(u||!o.pending())return;const T=H();if(o.ceilingMs<=0){if(E!==void 0&&T>=o.firstByteMs){o.onWedged(`no response within ${T}ms (wedged socket) \u2014 evicted + respawning`,{heldMs:T,silentMs:0,probes:0,failure:"deadline"});return}A(E===void 0?o.firstByteMs:o.firstByteMs-T);return}(0,pod_probe_1.probePodAliveVerdict)(o.socketPath,void 0,o.serviceKey).then(({alive:L,failure:b})=>{if(u||!o.pending())return;const j=H();if(!L){if(b==="gone"&&o.upstreamOpen?.()){if(j>=o.ceilingMs){o.onCeiling(`retiring (its socket is gone) and no response within ${j}ms (ceiling ${o.ceilingMs}ms) \u2014 giving up on this request, pod kept`);return}V||(V=!0,o.onRetiring?.(j)),A(Math.max(o.firstByteMs,types_1.POD_ALIVE_PROBE_TIMEOUT_MS));return}if(x+=1,b==="silent"&&(0,gc_notice_1.inAnnouncedGc)(o.socketPath)){k=void 0,A(types_1.POD_ALIVE_PROBE_TIMEOUT_MS);return}if(b==="silent"&&types_1.POD_WEDGE_CONFIRM_MS>0&&(k??=Date.now(),Date.now()-k<types_1.POD_WEDGE_CONFIRM_MS)){A(types_1.POD_ALIVE_PROBE_TIMEOUT_MS);return}const B=k===void 0?0:Date.now()-k,I=b==="gone"?"its socket no longer accepts (the pod process is gone)":b==="silent"?`nothing answered on ${types_1.POD_ALIVE_PATH} for ${B}ms (${x} probe${x===1?"":"s"})`:`no liveness answer on ${types_1.POD_ALIVE_PATH}`;o.onWedged(`no response within ${j}ms and ${I} (wedged socket) \u2014 evicted + respawning`,{heldMs:j,silentMs:B,probes:x,failure:b??"no-route"});return}if(k=void 0,j>=o.ceilingMs){o.onCeiling(`alive on ${types_1.POD_ALIVE_PATH} but no response within ${j}ms (ceiling ${o.ceilingMs}ms) \u2014 giving up on this request, pod kept`,L);return}!q&&E!==void 0&&(q=!0,o.onSlow(j,L)),A(Math.max(o.firstByteMs,types_1.POD_ALIVE_PROBE_TIMEOUT_MS))})},"onDeadline");return A(o.firstByteMs),{clear:s(()=>{u=!0,c&&clearTimeout(c),o.req.removeListener("end",N)},"clear")}}D(armFirstByteGuard,"armFirstByteGuard"),s(armFirstByteGuard,"armFirstByteGuard");function createProxy(o,c,u){const{recordEdge:q,finishTrace:V,traceStep:k,emit:x}=c,E=s((e,r,t,d)=>{const g=d.kind==="pod-evicted";x(g?"error":"warning",`${g?"pod evicted":"request given up"}: ${e.project} (${t}) \u2014 ${d.status}`,`cluster-pod-incident:${e.project}`,{kind:d.kind,project:e.project,pod:t,status:d.status,reason:d.reason,traceId:(0,gateway_errors_1.ensureRequestId)(r),method:r.method,path:(r.url??"").split("?")[0],...d.detail??{}})},"reportPodIncident"),N=s(async(e,r)=>{const t=e.pool;if(!t)return;t.scannedAt=0;let d=(0,discovery_1.pickSock)(t,o.scanTtlMs);return!d&&e.svc&&(k(r,"cold-start",{project:e.project}),await u.ensureUp(e.svc)&&(t.scannedAt=0,d=(0,discovery_1.pickSock)(t,o.scanTtlMs))),d},"anotherPod"),H=s((e,r,t,d,g)=>{console.log(`[gateway] pod ${t} of ${e.project} is gone \u2014 its ${r.method} was not answered, sending it to ${d}`),x("info",`request moved to another pod: ${e.project} (${t} \u2192 ${d})`,`cluster-pod-moved:${e.project}`,{kind:"pod-gone-rerouted",project:e.project,pod:t,to:d,reason:g,traceId:(0,gateway_errors_1.ensureRequestId)(r),method:r.method,path:(r.url??"").split("?")[0]})},"reportPodMoved"),A=s(async e=>{if(!e.lens||!o.lensSupervisor)return"unsupported";let r;const t=new Promise(f=>{r=setTimeout(()=>f("timeout"),types_1.LENS_REQUEST_RECOVERY_WAIT_MS),r.unref?.()}),d=o.lensSupervisor.recover(e.lens,"proxy-connection").then(f=>f?"ready":"failed").catch(()=>"failed"),g=await Promise.race([d,t]);r&&clearTimeout(r);const S=o.lensSupervisor.status(e.lens);return g==="failed"&&(!S||S.state==="ready")?"unsupported":g},"waitForManagedRecovery"),C=s((e,r,t,d,g,S)=>{if(t.headersSent||t.writableEnded||t.destroyed){t.destroyed||t.destroy();return}const f=e.lens?o.lensSupervisor?.status(e.lens):void 0,$=S==="timeout"||f?.state==="starting"||f?.state==="replacing",P=(0,gateway_errors_1.ensureRequestId)(r),l=e.lens?{project:e.project,reason:f?.reason??"connection-failure",generation:f?.generation??0,...$?{retryAfterMs:2e3}:{}}:void 0,i=$?503:502,y=$?"starting":"unavailable";console.error(`[gateway] ${new Date().toISOString()} upstream-error traceId=${P} project=${e.project} target=${String(d)} state=${f?.state??"unmanaged"} generation=${f?.generation??0}: ${g.message}`),x("warning",`upstream unavailable: ${e.project}`,`cluster-upstream:${e.project}`,{kind:"upstream-error",traceId:P,project:e.project,target:String(d),state:f?.state??"unmanaged",generation:f?.generation,error:g.message}),(0,edge_1.sendError)(t,r,i,y,$?`Upstream ${e.project} is restarting.`:`Upstream ${e.project} unavailable.`,l,$?{"retry-after":"2"}:void 0)},"sendTerminalUpstreamError"),T=(0,body_stall_1.createBodyStallGuard)(o.bodyStallMs??types_1.BODY_STALL_MS),L={keepAlive:!0,keepAliveMsecs:3e4,maxSockets:1024,maxFreeSockets:256},b=new http.Agent(L),j=new(require("node:https")).Agent(L),B=s(e=>typeof e=="string"&&e.startsWith("https:")?j:b,"agentForTarget"),I=httpProxy.createProxyServer({xfwd:!1,secure:!1,proxyTimeout:12e4,agent:b}),Y=s((e,r,t)=>{const d=s(()=>{t()||e.destroyed||e.destroy()},"onEdgeClose");r.once("close",d),e.once("close",()=>r.removeListener("close",d))},"propagateEdgeCancel");I.on("proxyReq",(e,r,t)=>{upstreams.set(r,e);for(const d of UPSTREAM_CONNECTION_HEADERS)e.removeHeader(d);e.setHeader("connection","keep-alive"),Y(e,t,()=>t.writableEnded)}),I.on("proxyRes",(e,r,t)=>{const d=r.__lensmcpPod;d&&(e.headers["x-lensmcp-pod"]=d),delete e.headers["x-powered-by"],e.headers.server="LensMCP",returnRequestId(e.headers,r),t&&Y(e,t,()=>t.writableEnded),t&&T.armResponse(t)});const Q=s((e,r,t,d)=>{(0,edge_1.stampForwardingHeaders)(o,r),T.arm(r);const g={},S=r.method==="GET"||r.method==="HEAD"||r.method==="OPTIONS";for(const[n,a]of Object.entries(r.headers))a===void 0||n.startsWith(":")||HOP_BY_HOP.has(n)||S&&(n==="content-length"||n==="transfer-encoding")||(g[n]=a);let f=http,$;if(typeof e=="object")$={socketPath:e.socketPath,path:r.url,method:r.method,headers:g,agent:b};else{const n=new URL(e),a=n.protocol==="https:";f=a?require("node:https"):http,g.host=n.host,$={protocol:n.protocol,hostname:n.hostname,port:n.port||(a?443:80),path:r.url,method:r.method,headers:g,agent:B(e)}}const P=t;P.__lensmcpErrContained||(P.__lensmcpErrContained=!0,t.on("error",()=>{}));let l;const i=s(()=>{t.writableEnded||p.destroy()},"onReqGone"),y=s(()=>{l&&!l.destroyed&&l.destroy()},"onEdgeClose"),_=s(()=>{r.removeListener("error",i),r.removeListener("aborted",i),r.removeListener("close",i),t.removeListener("close",y)},"detach"),p=f.request($,n=>{if(l=n,d.onResponse(),t.headersSent||t.writableEnded||t.destroyed){n.destroy();return}const a={};for(const[O,U]of Object.entries(n.headers))U===void 0||HOP_BY_HOP.has(O)||(a[O]=U);delete a["x-powered-by"],a.server="LensMCP",returnRequestId(a,r);const w=r.__lensmcpPod;w&&(a["x-lensmcp-pod"]=w);try{t.writeHead(n.statusCode??502,a)}catch(O){console.error("[gateway] h2 relay: bad response header, resetting stream:",O.message),n.destroy(),t.destroyed||t.destroy(O);return}n.pipe(t),T.armResponse(t);const R=s(()=>{!t.writableEnded&&!t.destroyed&&t.destroy()},"abortEdge");n.once("error",R),n.once("close",R),t.on("close",y)});p.once("error",n=>d.onError(n)),upstreams.set(r,p),p.once("close",_),r.on("error",i),r.on("aborted",i),r.on("close",i),S?p.end():r.pipe(p)},"pipeUpstream"),X=s(async(e,r,t)=>{const d=r.__lensmcpTrace;if(e.pool){const l=e.svc;l&&(l.lastUsed=Date.now(),l.inflight+=1,t.on("close",()=>{l.inflight-=1,l.lastUsed=Date.now()}));let i=(0,discovery_1.pickSock)(e.pool,o.scanTtlMs);if(!i&&l&&(k(d,"cold-start",{project:e.project}),await u.ensureUp(l)&&(i=(0,discovery_1.pickSock)(e.pool,o.scanTtlMs))),l&&i&&u.markUp(l,"observed"),l&&u.scaleUp(l),!i){const _=l?.lastErrors?.length?` Service errors: ${l.lastErrors.join("; ")}`:"";(0,edge_1.sendError)(t,r,503,"unavailable",`Service ${e.project} is not reachable (no pods in ${e.pool.dir}).${_} The watcher recovers and the next request retries automatically.`);return}const y=s((_,p)=>{const n=path.basename(_,".sock");r.__lensmcpPod=n,k(d,"pod-select",{pod:n,pods:e.pool.socks.length,strategy:"round-robin",...p?{movedFrom:p}:{}});let a=!1;const w=s((h,M="unlink")=>{if(e.pool.socks=e.pool.socks.filter(m=>m!==_),e.pool.idx=-1,M==="unlink")try{fs.unlinkSync(_)}catch{}console.error(`[gateway] pod ${n} of ${e.project}: ${h}`)},"evictPod"),R=armFirstByteGuard({socketPath:_,serviceKey:o.serviceKeys[(0,service_keys_1.serviceKeyId)(e.svc?.wsKey,e.project)],req:r,firstByteMs:declaredFirstByteMs(e.svc?.decl?.firstByteMs),ceilingMs:types_1.POD_SLOW_FIRST_BYTE_MS,pending:s(()=>!a&&!t.headersSent&&!t.writableEnded,"pending"),upstreamOpen:s(()=>upstreamOpen(r),"upstreamOpen"),onRetiring:s(h=>{console.log(`[gateway] pod ${n} of ${e.project}: retiring (its socket is gone) but still holds this ${r.method} after ${h}ms \u2014 waiting for it, not evicting`)},"onRetiring"),onWedged:s((h,M)=>{a=!0,w(h),E(e,r,n,{kind:"pod-evicted",status:502,reason:h,detail:M}),(0,edge_1.sendError)(t,r,502,"unavailable",wedgedMessage(n,e.project,M))},"onWedged"),onCeiling:s(h=>{a=!0,w(h,"keep"),E(e,r,n,{kind:"request-gave-up",status:504,reason:h}),(0,edge_1.sendError)(t,r,504,"unavailable",`Pod ${n} of ${e.project} did not answer in time \u2014 retry, or raise cluster.firstByteMs. The pod was kept: the request may still complete there.`)},"onCeiling"),onSlow:s((h,M)=>{console.log(`[gateway] pod ${n} of ${e.project}: slow first byte, pod alive (${h}ms, ${M.inflight} in-flight, ${M.activeWork} background) \u2014 waiting, not evicting. Set cluster.firstByteMs on ${e.project} to size this route's budget.`)},"onSlow")});t.on("close",()=>R.clear());const O=_,U=isReplayableRequest(r);let W=0;const F=s(()=>{W+=1,Q({socketPath:O},r,t,{onResponse:s(()=>{R.clear(),a=!0},"onResponse"),onError:s(h=>{if(!a){if(edgeGone(r,t)){R.clear(),a=!0;return}(0,pod_probe_1.podConnectionVerdict)(O,h).then(M=>{if(!a){if(M==="alive"&&W<2&&U&&!edgeGone(r,t)){console.log(`[gateway] pod ${n} of ${e.project}: ${h.message} on one connection, the pod still accepts \u2014 sending the ${r.method} again on a fresh one`),F();return}if(R.clear(),a=!0,M==="gone"){w(h.message);const m=s(()=>{E(e,r,n,{kind:"pod-evicted",status:502,reason:`${h.message} \u2014 its socket no longer accepts (the pod process is gone)${p?`; the request had already been moved here from ${p}`:""}`}),(0,edge_1.sendError)(t,r,502,"unavailable",`Pod ${n} of ${e.project} is gone (${h.message}) \u2014 retry.`)},"giveUp");if(p||!U){m();return}N(e,d).then(v=>{if(!edgeGone(r,t)){if(!v){m();return}H(e,r,n,path.basename(v,".sock"),h.message),y(v,n)}},m);return}console.error(`[gateway] pod ${n} of ${e.project}: ${h.message} on one connection \u2014 the pod still accepts connections, so it stays in the pool`),(0,edge_1.sendError)(t,r,502,"unavailable",`Pod ${n} of ${e.project} dropped the connection \u2014 retry.`)}})}},"onError")})},"sendToPod");F()},"onPod");y(i);return}const g=Date.now()+types_1.UPSTREAM_HEAL_WINDOW_MS;let S=0,f=!1;const $=isReplayableRequest(r),P=s(()=>{if(edgeGone(r,t))return;const l=e.target;Q(l,r,t,{onResponse:s(()=>{},"onResponse"),onError:s(i=>{if(isConnError(i)&&(S+=1),e.lens&&isConnError(i)&&$&&S>=2&&!f&&!edgeGone(r,t)){f=!0,A(e).then(y=>{if(!edgeGone(r,t)){if(y==="ready"){P();return}if(y==="unsupported"&&Date.now()<g){setTimeout(P,types_1.UPSTREAM_HEAL_STEP_MS).unref?.();return}C(e,r,t,e.target,i,y)}});return}if(isConnError(i)&&$&&Date.now()<g&&!edgeGone(r,t)){setTimeout(P,types_1.UPSTREAM_HEAL_STEP_MS).unref?.();return}if(t.headersSent||t.writableEnded||t.destroyed){t.destroyed||t.destroy();return}C(e,r,t,l,i)},"onError")})},"tryTcp");P()},"forwardNative");return{proxy:I,forward:s(async(e,r,t)=>{const d=Date.now(),g=r.__lensmcpTrace;if(t.on("close",()=>{q(e,Date.now()-d,t.statusCode??0,r.__lensmcpCaller),V(g,e.project,t.statusCode??0,{...r.__lensmcpPod?{pod:r.__lensmcpPod}:{},...r.__lensmcpCaller?{caller:r.__lensmcpCaller}:{}},e)}),e.prependPrefix&&!r.url?.startsWith(e.prependPrefix)&&(r.url=e.prependPrefix+(r.url??"/")),(0,edge_1.stampForwardingHeaders)(o,r),T.arm(r),(r.httpVersionMajor??1)>=2){await X(e,r,t);return}if(e.pool){const i=e.svc;i&&(i.lastUsed=Date.now(),i.inflight+=1,t.on("close",()=>{i.inflight-=1,i.lastUsed=Date.now()}));let y=(0,discovery_1.pickSock)(e.pool,o.scanTtlMs);if(!y&&i&&(k(g,"cold-start",{project:e.project}),await u.ensureUp(i)&&(y=(0,discovery_1.pickSock)(e.pool,o.scanTtlMs))),i&&y&&u.markUp(i,"observed"),i&&u.scaleUp(i),!y){const p=i?.lastErrors?.length?` Service errors: ${i.lastErrors.join("; ")}`:"";(0,edge_1.sendError)(t,r,503,"unavailable",`Service ${e.project} is not reachable (no pods in ${e.pool.dir}).${p} The watcher recovers and the next request retries automatically.`);return}const _=s((p,n)=>{const a=path.basename(p,".sock");r.__lensmcpPod=a,k(g,"pod-select",{pod:a,pods:e.pool.socks.length,strategy:"round-robin",...n?{movedFrom:n}:{}});let w=!1;const R=s((m,v="unlink")=>{if(e.pool.socks=e.pool.socks.filter(G=>G!==p),e.pool.idx=-1,v==="unlink")try{fs.unlinkSync(p)}catch{}console.error(`[gateway] pod ${a} of ${e.project}: ${m}`)},"evictPod"),O=armFirstByteGuard({socketPath:p,serviceKey:o.serviceKeys[(0,service_keys_1.serviceKeyId)(e.svc?.wsKey,e.project)],req:r,firstByteMs:declaredFirstByteMs(e.svc?.decl?.firstByteMs),ceilingMs:types_1.POD_SLOW_FIRST_BYTE_MS,pending:s(()=>!w&&!t.headersSent&&!t.writableEnded,"pending"),upstreamOpen:s(()=>upstreamOpen(r),"upstreamOpen"),onRetiring:s(m=>{console.log(`[gateway] pod ${a} of ${e.project}: retiring (its socket is gone) but still holds this ${r.method} after ${m}ms \u2014 waiting for it, not evicting`)},"onRetiring"),onWedged:s((m,v)=>{w=!0,R(m),E(e,r,a,{kind:"pod-evicted",status:502,reason:m,detail:v}),(0,edge_1.sendError)(t,r,502,"unavailable",wedgedMessage(a,e.project,v))},"onWedged"),onCeiling:s(m=>{w=!0,R(m,"keep"),E(e,r,a,{kind:"request-gave-up",status:504,reason:m}),(0,edge_1.sendError)(t,r,504,"unavailable",`Pod ${a} of ${e.project} did not answer in time \u2014 retry, or raise cluster.firstByteMs. The pod was kept: the request may still complete there.`)},"onCeiling"),onSlow:s((m,v)=>{console.log(`[gateway] pod ${a} of ${e.project}: slow first byte, pod alive (${m}ms, ${v.inflight} in-flight, ${v.activeWork} background) \u2014 waiting, not evicting. Set cluster.firstByteMs on ${e.project} to size this route's budget.`)},"onSlow")});t.on("close",()=>O.clear());const U=Math.max(12e4,types_1.POD_SLOW_FIRST_BYTE_MS+6e4),W=p,F=isReplayableRequest(r);let h=0;const M=s(()=>{h+=1;const m=Date.now();I.web(r,t,{target:{socketPath:W},agent:b,proxyTimeout:U},v=>{if(!w){if(edgeGone(r,t)){O.clear(),w=!0;return}(0,pod_probe_1.podConnectionVerdict)(W,v).then(G=>{if(w)return;const J=Date.now()-m>=U-250;if(G==="alive"&&h<2&&F&&!J&&!edgeGone(r,t)){console.log(`[gateway] pod ${a} of ${e.project}: ${v.message} on one connection, the pod still accepts \u2014 sending the ${r.method} again on a fresh one`),M();return}if(O.clear(),w=!0,G==="gone"){R(v.message);const K=s(()=>{E(e,r,a,{kind:"pod-evicted",status:502,reason:`${v.message} \u2014 its socket no longer accepts (the pod process is gone)${n?`; the request had already been moved here from ${n}`:""}`}),(0,edge_1.sendError)(t,r,502,"unavailable",`Pod ${a} of ${e.project} is gone (${v.message}) \u2014 retry.`)},"giveUp");if(n||!F||J){K();return}N(e,g).then(z=>{if(!edgeGone(r,t)){if(!z){K();return}H(e,r,a,path.basename(z,".sock"),v.message),_(z,a)}},K);return}console.error(`[gateway] pod ${a} of ${e.project}: ${v.message} on one connection \u2014 the pod still accepts connections, so it stays in the pool`),(0,edge_1.sendError)(t,r,502,"unavailable",`Pod ${a} of ${e.project} dropped the connection \u2014 retry.`)})}})},"sendToPod");M()},"onPod");_(y);return}const S=Date.now()+types_1.UPSTREAM_HEAL_WINDOW_MS;let f=0,$=!1;const P=isReplayableRequest(r),l=s(()=>{if(edgeGone(r,t))return;const i=e.target,y={target:i,autoRewrite:typeof i=="string",changeOrigin:!0,agent:B(i)};I.web(r,t,y,_=>{if(isConnError(_)&&(f+=1),e.lens&&isConnError(_)&&P&&f>=2&&!$&&!edgeGone(r,t)){$=!0,A(e).then(p=>{if(!edgeGone(r,t)){if(p==="ready"){l();return}if(p==="unsupported"&&Date.now()<S){setTimeout(l,types_1.UPSTREAM_HEAL_STEP_MS).unref?.();return}C(e,r,t,e.target,_,p)}});return}if(isConnError(_)&&P&&Date.now()<S&&!edgeGone(r,t)){setTimeout(l,types_1.UPSTREAM_HEAL_STEP_MS).unref?.();return}t.destroyed||C(e,r,t,i,_)})},"tryTcp");l()},"forward"),agentForTarget:B,destroyAgents:s(()=>{T.stop(),b.destroy(),j.destroy()},"destroyAgents"),closeProxy:s(()=>{try{I.close?.()}catch{}},"closeProxy")}}D(createProxy,"createProxy"),s(createProxy,"createProxy");

package/executors/gateway/runtime/server.js

@@ -1,3 +1,3 @@
-"use strict";var Se=Object.defineProperty;var T=(s,r)=>Se(s,"name",{value:r,configurable:!0});var _e=Object.defineProperty,n=T((s,r)=>_e(s,"name",{value:r,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.GATEWAY_H2_IDLE_SESSION_MS_DEFAULT=exports.GATEWAY_MAX_H2_STREAMS_DEFAULT=exports.GATEWAY_MAX_H2_SESSIONS_DEFAULT=exports.GATEWAY_MAX_CONNECTIONS_DEFAULT=exports.BENIGN_SOCKET_ERRNOS=void 0,exports.buildEdgeVerifierPool=buildEdgeVerifierPool,exports.classifyClientError=classifyClientError,exports.createClientErrorLogGate=createClientErrorLogGate,exports.retirePreviousWorkspace=retirePreviousWorkspace,exports.resolveMaxConnections=resolveMaxConnections,exports.h2BudgetFromEnv=h2BudgetFromEnv,exports.createH2Governor=createH2Governor,exports.startGateway=startGateway;const tslib_1=require("tslib"),http=tslib_1.__importStar(require("node:http")),path=tslib_1.__importStar(require("node:path")),discovery_1=require("./discovery"),scope_1=require("./scope"),route_registry_1=require("./route-registry"),control_1=require("./control"),workspace_middleware_1=require("./workspace-middleware"),workspace_registry_1=require("./workspace-registry"),service_keys_1=require("./service-keys"),client_ip_1=require("../client-ip"),workspace_log_1=require("./workspace-log"),observability_1=require("./observability"),lifecycle_1=require("./lifecycle"),process_names_1=require("./process-names"),project_graph_store_1=require("./project-graph-store"),serve_launch_1=require("./serve-launch"),process_name_1=require("../../../process-name"),protocol_1=require("../../../shared-build/protocol"),lens_children_1=require("./lens-children"),proxy_1=require("./proxy"),auth_1=require("./auth"),hooks_1=require("./hooks"),handler_1=require("./handler"),upgrade_1=require("./upgrade"),jwks_verify_1=require("../jwks-verify"),types_1=require("./types");function insecureLocalFetch(s,r){return new Promise((d,h)=>{const a=(s.startsWith("https:")?require("node:https"):require("node:http")).request(s,{method:"GET",headers:r?.headers,rejectUnauthorized:!1},y=>{const _=[];y.on("data",S=>_.push(S)),y.on("end",()=>{const S=y.statusCode??0,p=Buffer.concat(_).toString("utf8");d({ok:S>=200&&S<300,status:S,json:n(async()=>JSON.parse(p),"json")})})});a.on("error",h),a.end()})}T(insecureLocalFetch,"insecureLocalFetch"),n(insecureLocalFetch,"insecureLocalFetch");function buildEdgeVerifierPool(s){const r=process.env.LENSMCP_GW_JWKS_URL,d=process.env.LENSMCP_GW_JWT_ISS,h=new Map;let a;const y=n((_,S)=>{console.log(`[gateway] edge JWT: verifying via JWKS ${_}${S}`);const p=(0,jwks_verify_1.createJwksVerifier)({jwksUrl:_,...d?{issuer:d}:{},fetchImpl:insecureLocalFetch});return p.refresh().catch(o=>console.warn("[gateway] edge JWKS warm failed (will retry):",o.message)),p},"make");return{for(_){if(r)return a??=y(r,"");const S=_.split(":")[0].toLowerCase();let p;for(const c of s()){const i=c.host;if(typeof i!="string"||!/^auth\./.test(i)||i.startsWith("internal."))continue;const A=i.slice(5);(S===A||S.endsWith(`.${A}`))&&(!p||A.length>p.length)&&(p=A)}if(!p)return;let o=h.get(p);return o||(o=y(`https://auth.${p}/jwks.json`,` (auto-derived for apex ${p})`),h.set(p,o)),o},stop(){a?.stop();for(const _ of h.values())_.stop()}}}T(buildEdgeVerifierPool,"buildEdgeVerifierPool"),n(buildEdgeVerifierPool,"buildEdgeVerifierPool"),exports.BENIGN_SOCKET_ERRNOS=new Set(["ECONNRESET","EPIPE","ETIMEDOUT","ECONNABORTED","ECANCELED"]);function classifyClientError(s,r){return s&&exports.BENIGN_SOCKET_ERRNOS.has(s)?{status:null,report:!1,cause:"client-abort"}:s==="HPE_INVALID_EOF_STATE"?{status:null,report:!1,cause:"truncated-at-eof"}:s==="ERR_HTTP_REQUEST_TIMEOUT"?{status:408,report:!0,cause:"request-timeout"}:s==="HPE_HEADER_OVERFLOW"?{status:431,report:!0,cause:"header-overflow"}:s?.startsWith("HPE_")?{status:400,report:!0,cause:"parse-error"}:{status:400,report:!0,cause:s??r??"unknown"}}T(classifyClientError,"classifyClientError"),n(classifyClientError,"classifyClientError");const CLIENT_ERROR_REASON={400:"Bad Request",408:"Request Timeout",431:"Request Header Fields Too Large"};function createClientErrorLogGate(s=1e4){const r=new Map;return d=>{const h=Date.now(),a=r.get(d)??0;return h-a<s?!1:(r.set(d,h),!0)}}T(createClientErrorLogGate,"createClientErrorLogGate"),n(createClientErrorLogGate,"createClientErrorLogGate");function guardInboundSocket(s){s.on("error",r=>{exports.BENIGN_SOCKET_ERRNOS.has(r.code??"")||console.warn(`[gateway] inbound socket error (${r.code??r.message}) \u2014 dropping this connection only`),s.destroy()})}T(guardInboundSocket,"guardInboundSocket"),n(guardInboundSocket,"guardInboundSocket");function retirePreviousWorkspace(s,r,d){const h=s.get(r);if(!h)return!1;s.delete(r),d==="re-registered"&&console.log(`[gateway] workspace '${r}' re-registered \u2014 retiring the children of its previous registration first.`);try{h()}catch(a){console.warn(`[gateway] could not fully retire the previous registration of '${r}' (${d}): ${a.message}`)}return!0}T(retirePreviousWorkspace,"retirePreviousWorkspace"),n(retirePreviousWorkspace,"retirePreviousWorkspace"),exports.GATEWAY_MAX_CONNECTIONS_DEFAULT=512,exports.GATEWAY_MAX_H2_SESSIONS_DEFAULT=64,exports.GATEWAY_MAX_H2_STREAMS_DEFAULT=4096,exports.GATEWAY_H2_IDLE_SESSION_MS_DEFAULT=3e5;function parseBudget(s,r){if(s===void 0||s.trim()==="")return r;const d=Number(s);return!Number.isFinite(d)||d<0?r:Math.floor(d)}T(parseBudget,"parseBudget"),n(parseBudget,"parseBudget");function resolveMaxConnections(s){return parseBudget(s,exports.GATEWAY_MAX_CONNECTIONS_DEFAULT)}T(resolveMaxConnections,"resolveMaxConnections"),n(resolveMaxConnections,"resolveMaxConnections");function h2BudgetFromEnv(s=process.env){return{maxSessions:parseBudget(s.LENSMCP_MAX_H2_SESSIONS,exports.GATEWAY_MAX_H2_SESSIONS_DEFAULT),maxStreams:parseBudget(s.LENSMCP_MAX_H2_STREAMS,exports.GATEWAY_MAX_H2_STREAMS_DEFAULT),idleSessionMs:parseBudget(s.LENSMCP_H2_IDLE_MS,exports.GATEWAY_H2_IDLE_SESSION_MS_DEFAULT)}}T(h2BudgetFromEnv,"h2BudgetFromEnv"),n(h2BudgetFromEnv,"h2BudgetFromEnv");function createH2Governor(s,r){const{NGHTTP2_ENHANCE_YOUR_CALM:d,NGHTTP2_REFUSED_STREAM:h}=require("node:http2").constants,a=new Map;let y=0;const _=n(o=>{o.idle&&(clearTimeout(o.idle),o.idle=void 0)},"disarm"),S=n((o,c)=>{_(c),!(s.idleSessionMs<=0||c.open>0)&&(c.idle=setTimeout(()=>{o.destroyed||o.closed||(r("session-reclaimed",{idleMs:s.idleSessionMs,sessions:a.size}),a.delete(o),o.close())},s.idleSessionMs),c.idle.unref?.())},"arm"),p=n(()=>{for(const[o,c]of a)if(!(c.open>0||o.destroyed))return _(c),a.delete(o),r("session-reclaimed",{reason:"cap",sessions:a.size+1,maxSessions:s.maxSessions}),o.close(),!0;return!1},"reclaimOldestIdle");return{admitSession(o){if(s.maxSessions>0&&a.size>=s.maxSessions&&!p()){r("session-refused",{sessions:a.size,maxSessions:s.maxSessions,streams:y});try{o.goaway(d)}catch{}try{o.close()}catch{}return!1}const c={open:0};return a.set(o,c),S(o,c),o.once("close",()=>{_(c),a.delete(o)}),!0},admitStream(o,c){const i=a.get(o);if(!i)return!0;if(s.maxStreams>0&&y>=s.maxStreams){r("stream-refused",{streams:y,maxStreams:s.maxStreams,sessions:a.size});try{c.close(h)}catch{}return!1}return y+=1,i.open+=1,_(i),c.once("close",()=>{y=Math.max(0,y-1),i.open=Math.max(0,i.open-1),i.open===0&&a.has(o)&&S(o,i)}),!0},dispose(){for(const o of a.values())_(o);a.clear()}}}T(createH2Governor,"createH2Governor"),n(createH2Governor,"createH2Governor");async function startGateway(s,r){const d=s.https!==!1,h=s.ports?.length?s.ports:[443],a=s.scanTtlMs??1500,y=s.startupTimeoutMs??12e4,_=s.sweepMs??1e4,S=s.trafficFlushMs??5e3;let p=!1;const o=process.env.LENSMCP_EVENT_FILE??path.join(r.root,".lensmcp","events.jsonl"),c=(0,scope_1.readLensScope)(r.root),i=c.key,A=c.sockNs!==i?c.sockNs:void 0,Y=r.projectsConfigurations?.projects??{},B=(0,discovery_1.projectSourceRoots)(r.root,Y,r.projectDependencies),{routes:H,services:N,instance:X}=(0,discovery_1.discoverRoutes)(r.root,Y,void 0,i,B,A,c.instance);if(H.length===0)throw new Error("[gateway] no project declares a `cluster` field \u2014 nothing to route.");const $=new route_registry_1.RouteRegistry;$.register({wsKey:i,...A?{sockNs:A}:{},root:r.root,routes:H,services:N,...X?{instance:X}:{}});const R=[];let J=n(()=>{},"refreshCert");const V=n(()=>{(0,route_registry_1.rebuildRoutesInPlace)(R,$),J()},"rebuildRoutes");V();const{serviceKeys:te,keyToProject:oe,keyToWorkspace:ne}=(0,service_keys_1.loadServiceKeys)(r.root,N,i),ae=(0,client_ip_1.createClientIpResolver)({...(0,client_ip_1.clientIpOptionsFromEnv)(),...s.trustProxyHops!==void 0?{trustProxyHops:s.trustProxyHops}:{},...s.clientIpHeader?{clientIpHeader:s.clientIpHeader}:{},...s.clientIpTrustedProxies?{clientIpTrustedProxies:s.clientIpTrustedProxies}:{}}),m={root:r.root,wsKey:i,...A?{sockNs:A}:{},eventFile:o,routes:R,registry:$,rebuildRoutes:V,services:N,serviceKeys:te,keyToProject:oe,keyToWorkspace:ne,clientIp:ae,bodyStallMs:s.bodyStallMs??types_1.BODY_STALL_MS,scanTtlMs:a,startupTimeoutMs:y,sweepMs:_,trafficFlushMs:S,https:d,projectRoots:Object.fromEntries(Object.entries(r.projectsConfigurations?.projects??{}).map(([e,t])=>[e,path.resolve(r.root,t.root)])),projectSourceRoots:B,...r.projectGraphStore?{graphStores:(0,project_graph_store_1.createProjectGraphStores)(r.projectGraphStore)}:{},...s.sharedCompiler!==void 0?{sharedCompiler:s.sharedCompiler}:{},stopped:n(()=>p,"stopped")};(0,process_name_1.prelinkProcessNames)((0,process_names_1.gatewayProcessNames)(N,{runner:(0,serve_launch_1.serveRunnerEnabled)()&&!!r.projectGraphStore,sharedBuild:(0,protocol_1.sharedCompilerEnabled)(process.env,s.sharedCompiler),label:i||path.basename(r.root),lens:{key:i,dashboard:s.dashboard!==!1,mcp:s.mcp!==!1&&H.some(e=>!!e.lens)}}));const w=(0,observability_1.createObservability)(o,{trafficFlushMs:S}),ie=createClientErrorLogGate(),x=h2BudgetFromEnv(),ce=createClientErrorLogGate(3e4),G=createH2Governor(x,(e,t)=>{ce(e)&&console.warn(`[gateway] h2 aggregate budget: ${e} (${JSON.stringify(t)}). These are the FRONT DOOR's ceilings, not an upstream's \u2014 raise/disable with LENSMCP_MAX_H2_SESSIONS / LENSMCP_MAX_H2_STREAMS / LENSMCP_H2_IDLE_MS / LENSMCP_MAX_CONNECTIONS (0 = unbounded).`),w.emit(e==="session-reclaimed"?"info":"warning",`h2 aggregate budget: ${e}`,`gateway-h2-budget:${e}`,{kind:"h2-aggregate-budget",event:e,project:"gateway",...t})}),M=(0,lifecycle_1.createServiceLayer)(m,w),k=(0,lens_children_1.createLensChildren)(m,w,s),j=new Map;let q;if(s.middleware){const e=require(path.resolve(r.root,s.middleware));q=e.default??e}const W=(0,workspace_middleware_1.createWorkspaceMiddleware)({ownerKey:i,...q?{owner:q}:{},policy:(0,workspace_middleware_1.guestMiddlewarePolicy)()});let O;try{O=(0,control_1.startControlServer)({rt:m,killService:n((e,t)=>M.killSpawned(e,t),"killService"),restartService:n((e,t)=>M.restartService(e,t),"restartService"),onRegister:n(async e=>{retirePreviousWorkspace(j,e.wsKey,"re-registered"),W.set(e.wsKey,e.root,e.middleware);const t=await k.hostWorkspaceDashboard(e),f=await k.hostWorkspaceApps(e);j.set(e.wsKey,()=>{try{t?.()}finally{f()}})},"onRegister"),onUnregister:n(e=>{retirePreviousWorkspace(j,e.wsKey,"unregistered"),W.drop(e.wsKey),M.stopBuildHost(e.root)},"onUnregister")})}catch(e){console.warn("[gateway] control plane failed to start (multi-workspace register disabled):",e.message)}const b=(0,proxy_1.createProxy)(m,w,M),z=buildEdgeVerifierPool(()=>m.routes),Q=(0,auth_1.createEdgeAuth)(m,w,z),le=n(e=>{const t=e.route?.wsKey,f=W.for(t);if(f)try{const l=t?m.registry.get(t):void 0;f(e.req,{...t?{wsKey:t}:{},...l?{root:l.root}:{},env:l?.instance?.env??{}})}catch(l){w.traceStep(e.trace,"auth",{mode:"middleware",ok:!1,reason:l.message}),e.route&&w.finishTrace(e.trace,e.route.project,401),e.sendError(401,"unauthorized",`Gateway middleware rejected the request: ${l.message}`)}},"builtinMiddleware"),Z=s.hooks??{},ee=(0,hooks_1.createHooks)({...Z,afterAuth:[le,...Z.afterAuth??[]]}),se=(0,handler_1.createHandler)({rt:m,obs:w,auth:Q,proxy:b,hooks:ee}),re=(0,upgrade_1.createUpgrade)({rt:m,auth:Q,proxy:b,hooks:ee,obs:w}),ue=w.startEdgeFlusher(),de=M.startSweeper();await k.bootSingletonsAndApps();for(const e of N)e.decl.eager&&M.ensureUp(e);let P,D,L;if(d){const e=require("../../../basic-ssl"),t=(0,service_keys_1.gatewayCacheDir)(r.root);L=n(()=>e.getCertificateSync(t,"gateway",m.routes.map(f=>f.host).filter(f=>!!f)),"mintCert"),P=L(),D=e.caCertPath()}const F=[],I=[],U=s.maxConnections??resolveMaxConnections(process.env.LENSMCP_MAX_CONNECTIONS);for(const e of h){const t=P?require("node:http2").createSecureServer({key:P,cert:P,allowHTTP1:!0,maxSessionMemory:512,settings:{maxConcurrentStreams:512},peerMaxConcurrentStreams:512,streamResetBurst:s.h2ResetBurst??types_1.GATEWAY_H2_RESET_BURST,streamResetRate:s.h2ResetRate??types_1.GATEWAY_H2_RESET_RATE},(l,E)=>se(l,E)):http.createServer(se);t.on("upgrade",re),t.on("error",l=>console.error(`[gateway] port ${e}: ${l.code}`)),t.on("connection",guardInboundSocket),t.on("secureConnection",guardInboundSocket),t.on("tlsClientError",(l,E)=>E.destroy()),t.on("clientError",(l,E)=>{const u=l,g=classifyClientError(u.code,u.message);if(g.report&&ie(g.cause)){const v=E.remoteAddress??"unknown",C=g.status===null?"dropped":String(g.status);console.warn(`[gateway] inbound H1 clientError from ${v}: ${g.cause} (${u.code??u.message}${u.bytesParsed!==void 0?`, bytesParsed=${u.bytesParsed}`:""}) \u2192 ${C}. This status is the GATEWAY's, not the upstream service's.`),w.emit("warning",`inbound clientError: ${g.cause} \u2192 ${C}`,`gateway-client-error:${g.cause}`,{kind:"gateway-client-error",cause:g.cause,code:u.code??null,status:g.status,peer:v,bytesParsed:u.bytesParsed??null})}g.status!==null&&E.writable&&E.end(`HTTP/1.1 ${g.status} ${CLIENT_ERROR_REASON[g.status]}\r
+"use strict";var Ee=Object.defineProperty;var A=(s,r)=>Ee(s,"name",{value:r,configurable:!0});var Se=Object.defineProperty,n=A((s,r)=>Se(s,"name",{value:r,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.GATEWAY_H2_IDLE_SESSION_MS_DEFAULT=exports.GATEWAY_MAX_H2_STREAMS_DEFAULT=exports.GATEWAY_MAX_H2_SESSIONS_DEFAULT=exports.GATEWAY_MAX_CONNECTIONS_DEFAULT=exports.BENIGN_SOCKET_ERRNOS=void 0,exports.buildEdgeVerifierPool=buildEdgeVerifierPool,exports.classifyClientError=classifyClientError,exports.createClientErrorLogGate=createClientErrorLogGate,exports.retirePreviousWorkspace=retirePreviousWorkspace,exports.resolveMaxConnections=resolveMaxConnections,exports.h2BudgetFromEnv=h2BudgetFromEnv,exports.createH2Governor=createH2Governor,exports.startGateway=startGateway;const tslib_1=require("tslib"),http=tslib_1.__importStar(require("node:http")),path=tslib_1.__importStar(require("node:path")),discovery_1=require("./discovery"),scope_1=require("./scope"),route_registry_1=require("./route-registry"),control_1=require("./control"),workspace_middleware_1=require("./workspace-middleware"),workspace_registry_1=require("./workspace-registry"),service_keys_1=require("./service-keys"),client_ip_1=require("../client-ip"),workspace_log_1=require("./workspace-log"),own_log_1=require("./own-log"),observability_1=require("./observability"),lifecycle_1=require("./lifecycle"),process_names_1=require("./process-names"),project_graph_store_1=require("./project-graph-store"),serve_launch_1=require("./serve-launch"),process_name_1=require("../../../process-name"),protocol_1=require("../../../shared-build/protocol"),lens_children_1=require("./lens-children"),proxy_1=require("./proxy"),auth_1=require("./auth"),hooks_1=require("./hooks"),handler_1=require("./handler"),upgrade_1=require("./upgrade"),jwks_verify_1=require("../jwks-verify"),types_1=require("./types");function insecureLocalFetch(s,r){return new Promise((l,h)=>{const a=(s.startsWith("https:")?require("node:https"):require("node:http")).request(s,{method:"GET",headers:r?.headers,rejectUnauthorized:!1},y=>{const p=[];y.on("data",S=>p.push(S)),y.on("end",()=>{const S=y.statusCode??0,u=Buffer.concat(p).toString("utf8");l({ok:S>=200&&S<300,status:S,json:n(async()=>JSON.parse(u),"json")})})});a.on("error",h),a.end()})}A(insecureLocalFetch,"insecureLocalFetch"),n(insecureLocalFetch,"insecureLocalFetch");function buildEdgeVerifierPool(s){const r=process.env.LENSMCP_GW_JWKS_URL,l=process.env.LENSMCP_GW_JWT_ISS,h=new Map;let a;const y=n((p,S)=>{console.log(`[gateway] edge JWT: verifying via JWKS ${p}${S}`);const u=(0,jwks_verify_1.createJwksVerifier)({jwksUrl:p,...l?{issuer:l}:{},fetchImpl:insecureLocalFetch});return u.refresh().catch(o=>console.warn("[gateway] edge JWKS warm failed (will retry):",o.message)),u},"make");return{for(p){if(r)return a??=y(r,"");const S=p.split(":")[0].toLowerCase();let u;for(const d of s()){const _=d.host;if(typeof _!="string"||!/^auth\./.test(_)||_.startsWith("internal."))continue;const m=_.slice(5);(S===m||S.endsWith(`.${m}`))&&(!u||m.length>u.length)&&(u=m)}if(!u)return;let o=h.get(u);return o||(o=y(`https://auth.${u}/jwks.json`,` (auto-derived for apex ${u})`),h.set(u,o)),o},stop(){a?.stop();for(const p of h.values())p.stop()}}}A(buildEdgeVerifierPool,"buildEdgeVerifierPool"),n(buildEdgeVerifierPool,"buildEdgeVerifierPool"),exports.BENIGN_SOCKET_ERRNOS=new Set(["ECONNRESET","EPIPE","ETIMEDOUT","ECONNABORTED","ECANCELED"]);function classifyClientError(s,r){return s&&exports.BENIGN_SOCKET_ERRNOS.has(s)?{status:null,report:!1,cause:"client-abort"}:s==="HPE_INVALID_EOF_STATE"?{status:null,report:!1,cause:"truncated-at-eof"}:s==="ERR_HTTP_REQUEST_TIMEOUT"?{status:408,report:!0,cause:"request-timeout"}:s==="HPE_HEADER_OVERFLOW"?{status:431,report:!0,cause:"header-overflow"}:s?.startsWith("HPE_")?{status:400,report:!0,cause:"parse-error"}:{status:400,report:!0,cause:s??r??"unknown"}}A(classifyClientError,"classifyClientError"),n(classifyClientError,"classifyClientError");const CLIENT_ERROR_REASON={400:"Bad Request",408:"Request Timeout",431:"Request Header Fields Too Large"};function createClientErrorLogGate(s=1e4){const r=new Map;return l=>{const h=Date.now(),a=r.get(l)??0;return h-a<s?!1:(r.set(l,h),!0)}}A(createClientErrorLogGate,"createClientErrorLogGate"),n(createClientErrorLogGate,"createClientErrorLogGate");function guardInboundSocket(s){s.on("error",r=>{exports.BENIGN_SOCKET_ERRNOS.has(r.code??"")||console.warn(`[gateway] inbound socket error (${r.code??r.message}) \u2014 dropping this connection only`),s.destroy()})}A(guardInboundSocket,"guardInboundSocket"),n(guardInboundSocket,"guardInboundSocket");function retirePreviousWorkspace(s,r,l){const h=s.get(r);if(!h)return!1;s.delete(r),l==="re-registered"&&console.log(`[gateway] workspace '${r}' re-registered \u2014 retiring the children of its previous registration first.`);try{h()}catch(a){console.warn(`[gateway] could not fully retire the previous registration of '${r}' (${l}): ${a.message}`)}return!0}A(retirePreviousWorkspace,"retirePreviousWorkspace"),n(retirePreviousWorkspace,"retirePreviousWorkspace"),exports.GATEWAY_MAX_CONNECTIONS_DEFAULT=512,exports.GATEWAY_MAX_H2_SESSIONS_DEFAULT=64,exports.GATEWAY_MAX_H2_STREAMS_DEFAULT=4096,exports.GATEWAY_H2_IDLE_SESSION_MS_DEFAULT=3e5;function parseBudget(s,r){if(s===void 0||s.trim()==="")return r;const l=Number(s);return!Number.isFinite(l)||l<0?r:Math.floor(l)}A(parseBudget,"parseBudget"),n(parseBudget,"parseBudget");function resolveMaxConnections(s){return parseBudget(s,exports.GATEWAY_MAX_CONNECTIONS_DEFAULT)}A(resolveMaxConnections,"resolveMaxConnections"),n(resolveMaxConnections,"resolveMaxConnections");function h2BudgetFromEnv(s=process.env){return{maxSessions:parseBudget(s.LENSMCP_MAX_H2_SESSIONS,exports.GATEWAY_MAX_H2_SESSIONS_DEFAULT),maxStreams:parseBudget(s.LENSMCP_MAX_H2_STREAMS,exports.GATEWAY_MAX_H2_STREAMS_DEFAULT),idleSessionMs:parseBudget(s.LENSMCP_H2_IDLE_MS,exports.GATEWAY_H2_IDLE_SESSION_MS_DEFAULT)}}A(h2BudgetFromEnv,"h2BudgetFromEnv"),n(h2BudgetFromEnv,"h2BudgetFromEnv");function createH2Governor(s,r){const{NGHTTP2_ENHANCE_YOUR_CALM:l,NGHTTP2_REFUSED_STREAM:h}=require("node:http2").constants,a=new Map;let y=0;const p=n(o=>{o.idle&&(clearTimeout(o.idle),o.idle=void 0)},"disarm"),S=n((o,d)=>{p(d),!(s.idleSessionMs<=0||d.open>0)&&(d.idle=setTimeout(()=>{o.destroyed||o.closed||(r("session-reclaimed",{idleMs:s.idleSessionMs,sessions:a.size}),a.delete(o),o.close())},s.idleSessionMs),d.idle.unref?.())},"arm"),u=n(()=>{for(const[o,d]of a)if(!(d.open>0||o.destroyed))return p(d),a.delete(o),r("session-reclaimed",{reason:"cap",sessions:a.size+1,maxSessions:s.maxSessions}),o.close(),!0;return!1},"reclaimOldestIdle");return{admitSession(o){if(s.maxSessions>0&&a.size>=s.maxSessions&&!u()){r("session-refused",{sessions:a.size,maxSessions:s.maxSessions,streams:y});try{o.goaway(l)}catch{}try{o.close()}catch{}return!1}const d={open:0};return a.set(o,d),S(o,d),o.once("close",()=>{p(d),a.delete(o)}),!0},admitStream(o,d){const _=a.get(o);if(!_)return!0;if(s.maxStreams>0&&y>=s.maxStreams){r("stream-refused",{streams:y,maxStreams:s.maxStreams,sessions:a.size});try{d.close(h)}catch{}return!1}return y+=1,_.open+=1,p(_),d.once("close",()=>{y=Math.max(0,y-1),_.open=Math.max(0,_.open-1),_.open===0&&a.has(o)&&S(o,_)}),!0},dispose(){for(const o of a.values())p(o);a.clear()}}}A(createH2Governor,"createH2Governor"),n(createH2Governor,"createH2Governor");async function startGateway(s,r){const l=s.https!==!1,h=s.ports?.length?s.ports:[443],a=s.scanTtlMs??1500,y=s.startupTimeoutMs??12e4,p=s.sweepMs??1e4,S=s.trafficFlushMs??5e3;let u=!1;const o=process.env.LENSMCP_EVENT_FILE??path.join(r.root,".lensmcp","events.jsonl"),d=(0,own_log_1.startOwnLogRotation)(r.root),_=(0,scope_1.readLensScope)(r.root),m=_.key,x=_.sockNs!==m?_.sockNs:void 0,B=r.projectsConfigurations?.projects??{},X=(0,discovery_1.projectSourceRoots)(r.root,B,r.projectDependencies),{routes:$,services:N,instance:J}=(0,discovery_1.discoverRoutes)(r.root,B,void 0,m,X,x,_.instance);if($.length===0)throw new Error("[gateway] no project declares a `cluster` field \u2014 nothing to route.");const G=new route_registry_1.RouteRegistry;G.register({wsKey:m,...x?{sockNs:x}:{},root:r.root,routes:$,services:N,...J?{instance:J}:{}});const R=[];let V=n(()=>{},"refreshCert");const z=n(()=>{(0,route_registry_1.rebuildRoutesInPlace)(R,G),V()},"rebuildRoutes");z();const{serviceKeys:oe,keyToProject:ne,keyToWorkspace:ae}=(0,service_keys_1.loadServiceKeys)(r.root,N,m),ie=(0,client_ip_1.createClientIpResolver)({...(0,client_ip_1.clientIpOptionsFromEnv)(),...s.trustProxyHops!==void 0?{trustProxyHops:s.trustProxyHops}:{},...s.clientIpHeader?{clientIpHeader:s.clientIpHeader}:{},...s.clientIpTrustedProxies?{clientIpTrustedProxies:s.clientIpTrustedProxies}:{}}),w={root:r.root,wsKey:m,...x?{sockNs:x}:{},eventFile:o,routes:R,registry:G,rebuildRoutes:z,services:N,serviceKeys:oe,keyToProject:ne,keyToWorkspace:ae,clientIp:ie,bodyStallMs:s.bodyStallMs??types_1.BODY_STALL_MS,scanTtlMs:a,startupTimeoutMs:y,sweepMs:p,trafficFlushMs:S,https:l,projectRoots:Object.fromEntries(Object.entries(r.projectsConfigurations?.projects??{}).map(([e,t])=>[e,path.resolve(r.root,t.root)])),projectSourceRoots:X,...r.projectGraphStore?{graphStores:(0,project_graph_store_1.createProjectGraphStores)(r.projectGraphStore)}:{},...s.sharedCompiler!==void 0?{sharedCompiler:s.sharedCompiler}:{},stopped:n(()=>u,"stopped")};(0,process_name_1.prelinkProcessNames)((0,process_names_1.gatewayProcessNames)(N,{runner:(0,serve_launch_1.serveRunnerEnabled)()&&!!r.projectGraphStore,sharedBuild:(0,protocol_1.sharedCompilerEnabled)(process.env,s.sharedCompiler),label:m||path.basename(r.root),lens:{key:m,dashboard:s.dashboard!==!1,mcp:s.mcp!==!1&&$.some(e=>!!e.lens)}}));const f=(0,observability_1.createObservability)(o,{trafficFlushMs:S}),ce=createClientErrorLogGate(),k=h2BudgetFromEnv(),le=createClientErrorLogGate(3e4),q=createH2Governor(k,(e,t)=>{le(e)&&console.warn(`[gateway] h2 aggregate budget: ${e} (${JSON.stringify(t)}). These are the FRONT DOOR's ceilings, not an upstream's \u2014 raise/disable with LENSMCP_MAX_H2_SESSIONS / LENSMCP_MAX_H2_STREAMS / LENSMCP_H2_IDLE_MS / LENSMCP_MAX_CONNECTIONS (0 = unbounded).`),f.emit(e==="session-reclaimed"?"info":"warning",`h2 aggregate budget: ${e}`,`gateway-h2-budget:${e}`,{kind:"h2-aggregate-budget",event:e,project:"gateway",...t})}),M=(0,lifecycle_1.createServiceLayer)(w,f),O=(0,lens_children_1.createLensChildren)(w,f,s),j=new Map;let W;if(s.middleware){const e=require(path.resolve(r.root,s.middleware));W=e.default??e}const D=(0,workspace_middleware_1.createWorkspaceMiddleware)({ownerKey:m,...W?{owner:W}:{},policy:(0,workspace_middleware_1.guestMiddlewarePolicy)()});let L;try{L=(0,control_1.startControlServer)({rt:w,killService:n((e,t)=>M.killSpawned(e,t),"killService"),restartService:n((e,t)=>M.restartService(e,t),"restartService"),onRegister:n(async e=>{retirePreviousWorkspace(j,e.wsKey,"re-registered"),D.set(e.wsKey,e.root,e.middleware);const t=await O.hostWorkspaceDashboard(e),T=await O.hostWorkspaceApps(e);j.set(e.wsKey,()=>{try{t?.()}finally{T()}})},"onRegister"),onUnregister:n(e=>{retirePreviousWorkspace(j,e.wsKey,"unregistered"),D.drop(e.wsKey),M.stopBuildHost(e.root)},"onUnregister")})}catch(e){console.warn("[gateway] control plane failed to start (multi-workspace register disabled):",e.message)}const b=(0,proxy_1.createProxy)(w,f,M),Q=buildEdgeVerifierPool(()=>w.routes),Z=(0,auth_1.createEdgeAuth)(w,f,Q),ue=n(e=>{const t=e.route?.wsKey,T=D.for(t);if(T)try{const i=t?w.registry.get(t):void 0;T(e.req,{...t?{wsKey:t}:{},...i?{root:i.root}:{},env:i?.instance?.env??{}})}catch(i){f.traceStep(e.trace,"auth",{mode:"middleware",ok:!1,reason:i.message}),e.route&&f.finishTrace(e.trace,e.route.project,401),e.sendError(401,"unauthorized",`Gateway middleware rejected the request: ${i.message}`)}},"builtinMiddleware"),ee=s.hooks??{},se=(0,hooks_1.createHooks)({...ee,afterAuth:[ue,...ee.afterAuth??[]]}),re=(0,handler_1.createHandler)({rt:w,obs:f,auth:Z,proxy:b,hooks:se}),te=(0,upgrade_1.createUpgrade)({rt:w,auth:Z,proxy:b,hooks:se,obs:f}),de=f.startEdgeFlusher(),pe=M.startSweeper();await O.bootSingletonsAndApps();for(const e of N)e.decl.eager&&M.ensureUp(e);let P,F,I;if(l){const e=require("../../../basic-ssl"),t=(0,service_keys_1.gatewayCacheDir)(r.root);I=n(()=>e.getCertificateSync(t,"gateway",w.routes.map(T=>T.host).filter(T=>!!T)),"mintCert"),P=I(),F=e.caCertPath()}const U=[],H=[],K=s.maxConnections??resolveMaxConnections(process.env.LENSMCP_MAX_CONNECTIONS);for(const e of h){const t=P?require("node:http2").createSecureServer({key:P,cert:P,allowHTTP1:!0,maxSessionMemory:512,settings:{maxConcurrentStreams:512},peerMaxConcurrentStreams:512,streamResetBurst:s.h2ResetBurst??types_1.GATEWAY_H2_RESET_BURST,streamResetRate:s.h2ResetRate??types_1.GATEWAY_H2_RESET_RATE},(i,E)=>re(i,E)):http.createServer(re);t.on("upgrade",te),t.on("error",i=>console.error(`[gateway] port ${e}: ${i.code}`)),t.on("connection",guardInboundSocket),t.on("secureConnection",guardInboundSocket),t.on("tlsClientError",(i,E)=>E.destroy()),t.on("clientError",(i,E)=>{const c=i,g=classifyClientError(c.code,c.message);if(g.report&&ce(g.cause)){const v=E.remoteAddress??"unknown",C=g.status===null?"dropped":String(g.status);console.warn(`[gateway] inbound H1 clientError from ${v}: ${g.cause} (${c.code??c.message}${c.bytesParsed!==void 0?`, bytesParsed=${c.bytesParsed}`:""}) \u2192 ${C}. This status is the GATEWAY's, not the upstream service's.`),f.emit("warning",`inbound clientError: ${g.cause} \u2192 ${C}`,`gateway-client-error:${g.cause}`,{kind:"gateway-client-error",cause:g.cause,code:c.code??null,status:g.status,peer:v,bytesParsed:c.bytesParsed??null})}g.status!==null&&E.writable&&E.end(`HTTP/1.1 ${g.status} ${CLIENT_ERROR_REASON[g.status]}\r
 \r
-`),E.destroy()}),t.keepAliveTimeout=types_1.GATEWAY_KEEPALIVE_TIMEOUT_MS,t.headersTimeout=s.headersTimeoutMs??types_1.GATEWAY_HEADERS_TIMEOUT_MS,U>0&&(t.maxConnections=U);const f=s.connectionsCheckingIntervalMs??types_1.GATEWAY_CONN_CHECK_MS;if(f>0&&(t.connectionsCheckingInterval=f),P!=null){const l=t,{NGHTTP2_CANCEL:E}=require("node:http2").constants;l.on("session",u=>{if(!G.admitSession(u)){u.on("error",()=>{});return}let g=0,v=0;u.on("stream",C=>{G.admitStream(u,C)&&C.once("close",()=>{u.destroyed?v+=1:C.rstCode===E&&(g+=1)})}),u.once("close",()=>{v!==0&&(console.warn(`[gateway] h2 session closed with ${v} stream(s) in flight after ${g} client reset(s) \u2014 every in-flight fetch on that connection failed at once (ERR_HTTP2_PROTOCOL_ERROR in the browser). Reset budget: LENSMCP_H2_RESET_BURST/LENSMCP_H2_RESET_RATE (issues/closed/foodguard-14).`),w.emit("warning",`h2 session lost with ${v} stream(s) in flight`,"gateway-h2-session-lost",{kind:"h2-session-lost",project:"gateway",inflight:v,clientResets:g}))}),u.on("error",C=>{const pe=C.code??C.message;console.warn(`[gateway] h2 session error (${pe}) \u2014 dropping this session only`),u.destroyed||u.destroy()})}),l.on("sessionError",u=>{console.warn(`[gateway] h2 sessionError: ${u.code??u.message}`)})}await new Promise(l=>{t.listen(e,()=>{const E=t.address()?.port??e;I.push(E),console.log(`[gateway] Listening on ${P?"https":"http"}://localhost:${E}`),l()})}),F.push(t)}L&&(J=n(()=>{const e=L();for(const t of F)t.setSecureContext?.({key:e,cert:e})},"refreshCert")),console.log("[gateway] Routes:");for(const e of R){const t=e.pool?`pods@${e.pool.dir}`:e.target;console.log(`[gateway]   ${e.host??"(default)"} \u2192 ${t}${e.prependPrefix?`  (+${e.prependPrefix})`:""}${e.internal?"  [internal: no middleware]":""}  [${e.project}]`)}D&&console.log(`[gateway] CA: ${D} \u2014 one-time setup via the trust executor.`);const K=n(e=>e>0?String(e):"unbounded","unbounded");return console.log(`[gateway] front-door budget: \u2264${K(U)} connections, \u2264${K(x.maxSessions)} h2 sessions (each \u2264512 MB session memory, \u2264512 streams), \u2264${K(x.maxStreams)} open streams in total, idle h2 session reclaimed after ${x.idleSessionMs>0?`${Math.round(x.idleSessionMs/1e3)}s`:"never"}. Override: LENSMCP_MAX_CONNECTIONS / LENSMCP_MAX_H2_SESSIONS / LENSMCP_MAX_H2_STREAMS / LENSMCP_H2_IDLE_MS (0 = unbounded).`),w.emit("info",`gateway up: ${R.length} routes on ${I.join("/")}`,"cluster-gateway",{kind:"gateway-up",project:"gateway",ports:I,routes:R.map(e=>({host:e.host??"(default)",project:e.project,mode:e.pool?"pods":"tcp",internal:!!e.internal,prependPrefix:e.prependPrefix}))}),O&&process.env.LENSMCP_GUEST_REPLAY!=="0"&&O.replay().catch(e=>console.warn("[gateway] guest replay failed:",e.message)),{ports:I,routes:R,services:N,stop:n(async()=>{if(!p){p=!0,clearInterval(ue),clearInterval(de),w.emit("info","gateway down","cluster-gateway",{kind:"gateway-down",project:"gateway"}),z.stop(),O?.close(),(0,workspace_registry_1.unregisterWorkspace)(i);for(const e of N)M.killSpawned(e,"gateway shutdown");M.stopRetiringTrees(),await M.stopBuildHost(),await k.reapAll(),re.closeTunnels(),await Promise.all(F.map(e=>new Promise(t=>{let f=!1;const l=n(()=>{f||(f=!0,t())},"done"),E=e;e.close(()=>l());try{E.closeIdleConnections?.()}catch{}setTimeout(()=>{try{E.closeAllConnections?.()}catch{}l()},types_1.GATEWAY_STOP_GRACE_MS).unref?.()}))),b.closeProxy(),b.destroyAgents(),G.dispose(),(0,workspace_log_1.closeWorkspaceLogs)()}},"stop"),...m.lensSupervisor?{lensSupervisor:m.lensSupervisor}:{},...m.graphStores?{graphStores:m.graphStores}:{}}}T(startGateway,"startGateway"),n(startGateway,"startGateway");
+`),E.destroy()}),t.keepAliveTimeout=types_1.GATEWAY_KEEPALIVE_TIMEOUT_MS,t.headersTimeout=s.headersTimeoutMs??types_1.GATEWAY_HEADERS_TIMEOUT_MS,K>0&&(t.maxConnections=K);const T=s.connectionsCheckingIntervalMs??types_1.GATEWAY_CONN_CHECK_MS;if(T>0&&(t.connectionsCheckingInterval=T),P!=null){const i=t,{NGHTTP2_CANCEL:E}=require("node:http2").constants;i.on("session",c=>{if(!q.admitSession(c)){c.on("error",()=>{});return}let g=0,v=0;c.on("stream",C=>{q.admitStream(c,C)&&C.once("close",()=>{c.destroyed?v+=1:C.rstCode===E&&(g+=1)})}),c.once("close",()=>{v!==0&&(console.warn(`[gateway] h2 session closed with ${v} stream(s) in flight after ${g} client reset(s) \u2014 every in-flight fetch on that connection failed at once (ERR_HTTP2_PROTOCOL_ERROR in the browser). Reset budget: LENSMCP_H2_RESET_BURST/LENSMCP_H2_RESET_RATE (issues/closed/foodguard-14).`),f.emit("warning",`h2 session lost with ${v} stream(s) in flight`,"gateway-h2-session-lost",{kind:"h2-session-lost",project:"gateway",inflight:v,clientResets:g}))}),c.on("error",C=>{const _e=C.code??C.message;console.warn(`[gateway] h2 session error (${_e}) \u2014 dropping this session only`),c.destroyed||c.destroy()})}),i.on("sessionError",c=>{console.warn(`[gateway] h2 sessionError: ${c.code??c.message}`)})}await new Promise(i=>{t.listen(e,()=>{const E=t.address()?.port??e;H.push(E),console.log(`[gateway] Listening on ${P?"https":"http"}://localhost:${E}`),i()})}),U.push(t)}I&&(V=n(()=>{const e=I();for(const t of U)t.setSecureContext?.({key:e,cert:e})},"refreshCert")),console.log("[gateway] Routes:");for(const e of R){const t=e.pool?`pods@${e.pool.dir}`:e.target;console.log(`[gateway]   ${e.host??"(default)"} \u2192 ${t}${e.prependPrefix?`  (+${e.prependPrefix})`:""}${e.internal?"  [internal: no middleware]":""}  [${e.project}]`)}F&&console.log(`[gateway] CA: ${F} \u2014 one-time setup via the trust executor.`);const Y=n(e=>e>0?String(e):"unbounded","unbounded");return console.log(`[gateway] front-door budget: \u2264${Y(K)} connections, \u2264${Y(k.maxSessions)} h2 sessions (each \u2264512 MB session memory, \u2264512 streams), \u2264${Y(k.maxStreams)} open streams in total, idle h2 session reclaimed after ${k.idleSessionMs>0?`${Math.round(k.idleSessionMs/1e3)}s`:"never"}. Override: LENSMCP_MAX_CONNECTIONS / LENSMCP_MAX_H2_SESSIONS / LENSMCP_MAX_H2_STREAMS / LENSMCP_H2_IDLE_MS (0 = unbounded).`),f.emit("info",`gateway up: ${R.length} routes on ${H.join("/")}`,"cluster-gateway",{kind:"gateway-up",project:"gateway",ports:H,routes:R.map(e=>({host:e.host??"(default)",project:e.project,mode:e.pool?"pods":"tcp",internal:!!e.internal,prependPrefix:e.prependPrefix}))}),L&&process.env.LENSMCP_GUEST_REPLAY!=="0"&&L.replay().catch(e=>console.warn("[gateway] guest replay failed:",e.message)),{ports:H,routes:R,services:N,stop:n(async()=>{if(!u){u=!0,clearInterval(de),clearInterval(pe),f.emit("info","gateway down","cluster-gateway",{kind:"gateway-down",project:"gateway"}),Q.stop(),L?.close(),(0,workspace_registry_1.unregisterWorkspace)(m);for(const e of N)M.killSpawned(e,"gateway shutdown");M.stopRetiringTrees(),await M.stopBuildHost(),await O.reapAll(),te.closeTunnels(),await Promise.all(U.map(e=>new Promise(t=>{let T=!1;const i=n(()=>{T||(T=!0,t())},"done"),E=e;e.close(()=>i());try{E.closeIdleConnections?.()}catch{}setTimeout(()=>{try{E.closeAllConnections?.()}catch{}i()},types_1.GATEWAY_STOP_GRACE_MS).unref?.()}))),b.closeProxy(),b.destroyAgents(),q.dispose(),(0,workspace_log_1.closeWorkspaceLogs)(),d()}},"stop"),...w.lensSupervisor?{lensSupervisor:w.lensSupervisor}:{},...w.graphStores?{graphStores:w.graphStores}:{}}}A(startGateway,"startGateway"),n(startGateway,"startGateway");

package/executors/gateway/runtime/types.d.ts

@@ -778,6 +778,10 @@ export interface GatewayRuntime {
     sourceSetChangedFor?: Map<string, number>;
     /** Exact path evidence paired with `sourceSetChangedFor`. */
     sourceSetChangesFor?: Map<string, SourceSetChange>;
+    /** Projects whose own scope the scanner has diffed at least once — for them an absent `sourceSetChangedFor`
+     *  entry means «nothing changed in my scope», not «fall back to the wide clock» (issues/closed/foodguard-76).
+     *  Mutable, written only by the scanner. */
+    sourceSetScoped?: Set<string>;
     /** Workspace-wide fallback evidence when a project scope is unavailable. */
     sourceSetChange?: SourceSetChange;
     /** Absolute project root per project name (from `projectsConfigurations`) — lets the scanner derive each

package/main.devserver.js

@@ -1,4 +1,4 @@
-"use strict";var lt=Object.defineProperty;var h=(c,f)=>lt(c,"name",{value:f,configurable:!0});var at=Object.defineProperty,a=h((c,f)=>at(c,"name",{value:f,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0}),exports.redactInspectorUrls=exports.inspectorPortOf=exports.DEBUG_FIXED_PORTS_ENV=exports.mayDriveThePool=exports.isOwnerOnlyTransport=exports.gatewayManaged=void 0,exports.tell=tell,exports.usesFixedInspectorPorts=usesFixedInspectorPorts,exports.inspectorPortFor=inspectorPortFor;const tslib_1=require("tslib"),path=tslib_1.__importStar(require("node:path")),fs=tslib_1.__importStar(require("node:fs")),os=tslib_1.__importStar(require("node:os")),node_child_process_1=require("node:child_process"),http=tslib_1.__importStar(require("node:http")),readline=tslib_1.__importStar(require("node:readline")),inspector=tslib_1.__importStar(require("node:inspector")),util=tslib_1.__importStar(require("node:util")),v8=tslib_1.__importStar(require("node:v8")),exit_reason_1=require("./exit-reason"),hot_swap_registries_1=require("./hot-swap-registries"),process_name_1=require("./process-name"),inspector_secret_1=require("./inspector-secret");Object.defineProperty(exports,"inspectorPortOf",{enumerable:!0,get:a(function(){return inspector_secret_1.inspectorPortOf},"get")}),Object.defineProperty(exports,"redactInspectorUrls",{enumerable:!0,get:a(function(){return inspector_secret_1.redactInspectorUrls},"get")});const devserver_transport_1=require("./devserver-transport");Object.defineProperty(exports,"gatewayManaged",{enumerable:!0,get:a(function(){return devserver_transport_1.gatewayManaged},"get")}),Object.defineProperty(exports,"isOwnerOnlyTransport",{enumerable:!0,get:a(function(){return devserver_transport_1.isOwnerOnlyTransport},"get")}),Object.defineProperty(exports,"mayDriveThePool",{enumerable:!0,get:a(function(){return devserver_transport_1.mayDriveThePool},"get")});const schema_first_instance_1=require("./schema-first-instance"),redis_disconnect_fix_1=require("./redis-disconnect-fix"),error_stack_release_1=require("./error-stack-release"),swap_recycle_1=require("./swap-recycle"),swap_mode_1=require("./swap-mode"),handoff_retire_1=require("./handoff-retire"),gc_notice_1=require("./gc-notice"),pod_sock_1=require("./pod-sock"),notice_generation_1=require("./notice-generation"),service_build_events_1=require("./service-build-events"),stdio_guard_1=require("./stdio-guard"),bundle_parent_1=require("./bundle-parent"),checkout_cache_1=require("./checkout-cache"),dev_devtool_1=require("./dev-devtool"),pod_memory_1=require("./pod-memory"),pod_memory_events_1=require("./pod-memory-events"),heap_snapshot_1=require("./heap-snapshot"),httpProxy=require("http-proxy"),{prettyFactory}=require("pino-pretty"),BUNDLE_PATH=process.env.BUNDLE_PATH?.trim()||"./main.js",SERVICE_NAME=process.env.SERVICE_NAME||"",SERVICE_PREFIX=process.env.SERVE_PREFIX?`/${process.env.SERVE_PREFIX}`:"",GATEWAY_MIDDLEWARE_PATH=process.env.GATEWAY_MIDDLEWARE||"",GATEWAY_CONFIG=(()=>{const c=process.env.GATEWAY_CONFIG;if(!c)return{};try{return JSON.parse(c)}catch{return{}}})();let gatewayMiddleware=null;if(GATEWAY_MIDDLEWARE_PATH)try{const c=require(GATEWAY_MIDDLEWARE_PATH);gatewayMiddleware=typeof c=="function"?c:typeof c.default=="function"?c.default:null,gatewayMiddleware||console.warn(`[gateway] ${GATEWAY_MIDDLEWARE_PATH} does not export a function, gateway disabled`)}catch(c){console.error(`[gateway] Failed to load middleware from ${GATEWAY_MIDDLEWARE_PATH}:`,c)}function applyGatewayMiddleware(c){if(gatewayMiddleware)try{gatewayMiddleware(c,GATEWAY_CONFIG)}catch(f){console.error("[gateway] Middleware error:",f)}}h(applyGatewayMiddleware,"applyGatewayMiddleware"),a(applyGatewayMiddleware,"applyGatewayMiddleware");const GATEWAY_ROUTES=(()=>{try{return JSON.parse(process.env.GATEWAY_ROUTES||"[]")}catch{return[]}})(),GATEWAY_HTTPS=process.env.GATEWAY_HTTPS==="1";function hostMatches(c,f){if(c.startsWith("*.")){const g=c.slice(1);return f.endsWith(g)||f===c.slice(2)}return f===c}h(hostMatches,"hostMatches"),a(hostMatches,"hostMatches");function matchGatewayRoute(c){if(GATEWAY_ROUTES.length===0)return;const f=(c.headers.host||"").split(":")[0],g=c.url||"/";for(const E of GATEWAY_ROUTES)if(!(E.host&&!hostMatches(E.host,f))&&!(E.prefix&&!g.startsWith(E.prefix)))return E}h(matchGatewayRoute,"matchGatewayRoute"),a(matchGatewayRoute,"matchGatewayRoute");const WORKER_NAMES=(()=>{try{return JSON.parse(process.env.WORKERS||"[]")}catch{return[]}})(),LENSMCP_WS_KEY=process.env.LENSMCP_WS_KEY||"",SOCK_NS=process.env.LENSMCP_SOCK_NS||LENSMCP_WS_KEY,SOCK_DIR=SOCK_NS?path.join(os.tmpdir(),SOCK_NS,`${SERVICE_NAME||"lensmcp-cluster"}-devserver`):path.join(os.tmpdir(),`${SERVICE_NAME||"lensmcp-cluster"}-devserver`),SOCKET_ONLY=process.env.LENSMCP_SOCKET_ONLY==="1",POD_GENERATION=(()=>{const c=Number(process.env.LENSMCP_POD_GENERATION);return Number.isFinite(c)&&c>1?Math.floor(c):1})();function childSockPath(c){return path.join(SOCK_DIR,(0,pod_sock_1.podSockName)(c,POD_GENERATION))}h(childSockPath,"childSockPath"),a(childSockPath,"childSockPath");function sockOwnerPath(c){return`${c}.owner`}h(sockOwnerPath,"sockOwnerPath"),a(sockOwnerPath,"sockOwnerPath");function sockRetiringPath(c){return`${c}.retiring`}h(sockRetiringPath,"sockRetiringPath"),a(sockRetiringPath,"sockRetiringPath");function tell(c,f){if(!c.connected||typeof c.send!="function")return!1;try{return c.send(f,()=>{})}catch{return!1}}h(tell,"tell"),a(tell,"tell");function refusePoolCommand(c,f){console.warn(`[devserver] refused ${c.method} ${c.url} on the public port \u2014 under a gateway the pool is driven on the control socket only.`),f.writeHead(404,{"content-type":"application/json"}),f.end(JSON.stringify({error:"not found"}))}h(refusePoolCommand,"refusePoolCommand"),a(refusePoolCommand,"refusePoolCommand"),exports.DEBUG_FIXED_PORTS_ENV="LENSMCP_DEBUG_FIXED_PORTS";function usesFixedInspectorPorts(c=process.env){const f=(c[exports.DEBUG_FIXED_PORTS_ENV]??"").trim().toLowerCase();return f==="1"||f==="true"||f==="yes"||f==="on"}h(usesFixedInspectorPorts,"usesFixedInspectorPorts"),a(usesFixedInspectorPorts,"usesFixedInspectorPorts");function inspectorPortFor(c,f,g=process.env){if(!usesFixedInspectorPorts(g))return 0;const E=Math.trunc(c)+Math.trunc(f);return Number.isInteger(E)&&E>1024&&E<=65535?E:0}h(inspectorPortFor,"inspectorPortFor"),a(inspectorPortFor,"inspectorPortFor");function ensureOwnerOnlyDir(c){try{fs.mkdirSync(c,{recursive:!0,mode:448})}catch{}try{const f=fs.lstatSync(c);f.isDirectory()&&(f.mode&63)!==0&&fs.chmodSync(c,448)}catch{}}h(ensureOwnerOnlyDir,"ensureOwnerOnlyDir"),a(ensureOwnerOnlyDir,"ensureOwnerOnlyDir");function claimSock(c,f=process.pid){ensureOwnerOnlyDir(path.dirname(c));try{const g=sockOwnerPath(c);try{fs.unlinkSync(g)}catch{}fs.writeFileSync(g,String(f),{flag:"wx",mode:384})}catch{}try{fs.unlinkSync(c)}catch{}try{fs.unlinkSync(sockRetiringPath(c))}catch{}}h(claimSock,"claimSock"),a(claimSock,"claimSock");function sockOwnedByAnother(c,f=process.pid){try{const g=fs.readFileSync(sockOwnerPath(c),"utf8").trim();return!!g&&g!==String(f)}catch{return!1}}h(sockOwnedByAnother,"sockOwnedByAnother"),a(sockOwnedByAnother,"sockOwnedByAnother");function cleanupSock(c,f=process.pid){if(c){try{const g=fs.readFileSync(sockOwnerPath(c),"utf8").trim();if(g&&g!==String(f))return}catch{}try{fs.unlinkSync(c)}catch{}try{fs.unlinkSync(sockOwnerPath(c))}catch{}try{fs.unlinkSync(sockRetiringPath(c))}catch{}(0,gc_notice_1.clearGcNotice)(c)}}h(cleanupSock,"cleanupSock"),a(cleanupSock,"cleanupSock");function postRetiringNotice(c,f){if(!(!c||!f)){try{const g=fs.readFileSync(sockOwnerPath(c),"utf8").trim();if(g&&g!==String(f))return}catch{}try{fs.writeFileSync(sockRetiringPath(c),String(f),{flag:"w",mode:384})}catch{}}}h(postRetiringNotice,"postRetiringNotice"),a(postRetiringNotice,"postRetiringNotice");function serviceKeyFingerprint(){const c=process.env.LENSMCP_SERVICE_KEY;if(!c)return;const{createHash:f}=require("node:crypto");return f("sha256").update(c).digest("hex").slice(0,8)}h(serviceKeyFingerprint,"serviceKeyFingerprint"),a(serviceKeyFingerprint,"serviceKeyFingerprint");function rootModuleOf(c){let f;for(const g of c.getModules?.()?.values()??[])typeof g?.metatype!="function"||typeof g.distance!="number"||!Number.isFinite(g.distance)||(!f||g.distance<f.distance)&&(f=g);return f?.metatype}h(rootModuleOf,"rootModuleOf"),a(rootModuleOf,"rootModuleOf");let lastImportedModule;function takeImportedModule(){const c=lastImportedModule;return lastImportedModule=void 0,c}h(takeImportedModule,"takeImportedModule"),a(takeImportedModule,"takeImportedModule");async function importFresh(spec){process.env.DEVSERVER_MODE="1";const requested=path.isAbsolute(spec)?spec:path.join(__dirname,spec);let resolved=requested;try{resolved=fs.realpathSync(requested)}catch{}eval(`(() => {
+"use strict";var dt=Object.defineProperty;var h=(l,f)=>dt(l,"name",{value:f,configurable:!0});var ct=Object.defineProperty,i=h((l,f)=>ct(l,"name",{value:f,configurable:!0}),"i");Object.defineProperty(exports,"__esModule",{value:!0}),exports.redactInspectorUrls=exports.inspectorPortOf=exports.DEBUG_FIXED_PORTS_ENV=exports.mayDriveThePool=exports.isOwnerOnlyTransport=exports.gatewayManaged=void 0,exports.tell=tell,exports.usesFixedInspectorPorts=usesFixedInspectorPorts,exports.inspectorPortFor=inspectorPortFor;const tslib_1=require("tslib"),path=tslib_1.__importStar(require("node:path")),fs=tslib_1.__importStar(require("node:fs")),os=tslib_1.__importStar(require("node:os")),node_child_process_1=require("node:child_process"),http=tslib_1.__importStar(require("node:http")),readline=tslib_1.__importStar(require("node:readline")),inspector=tslib_1.__importStar(require("node:inspector")),util=tslib_1.__importStar(require("node:util")),v8=tslib_1.__importStar(require("node:v8")),exit_reason_1=require("./exit-reason"),hot_swap_registries_1=require("./hot-swap-registries"),process_name_1=require("./process-name"),inspector_secret_1=require("./inspector-secret");Object.defineProperty(exports,"inspectorPortOf",{enumerable:!0,get:i(function(){return inspector_secret_1.inspectorPortOf},"get")}),Object.defineProperty(exports,"redactInspectorUrls",{enumerable:!0,get:i(function(){return inspector_secret_1.redactInspectorUrls},"get")});const devserver_transport_1=require("./devserver-transport");Object.defineProperty(exports,"gatewayManaged",{enumerable:!0,get:i(function(){return devserver_transport_1.gatewayManaged},"get")}),Object.defineProperty(exports,"isOwnerOnlyTransport",{enumerable:!0,get:i(function(){return devserver_transport_1.isOwnerOnlyTransport},"get")}),Object.defineProperty(exports,"mayDriveThePool",{enumerable:!0,get:i(function(){return devserver_transport_1.mayDriveThePool},"get")});const schema_first_instance_1=require("./schema-first-instance"),redis_disconnect_fix_1=require("./redis-disconnect-fix"),error_stack_release_1=require("./error-stack-release"),swap_recycle_1=require("./swap-recycle"),swap_mode_1=require("./swap-mode"),handoff_retire_1=require("./handoff-retire"),gc_notice_1=require("./gc-notice"),pod_sock_1=require("./pod-sock"),notice_generation_1=require("./notice-generation"),service_build_events_1=require("./service-build-events"),stdio_guard_1=require("./stdio-guard"),bundle_parent_1=require("./bundle-parent"),checkout_cache_1=require("./checkout-cache"),dev_devtool_1=require("./dev-devtool"),pod_memory_1=require("./pod-memory"),pod_memory_events_1=require("./pod-memory-events"),heap_snapshot_1=require("./heap-snapshot"),httpProxy=require("http-proxy"),{prettyFactory}=require("pino-pretty"),BUNDLE_PATH=process.env.BUNDLE_PATH?.trim()||"./main.js",SERVICE_NAME=process.env.SERVICE_NAME||"",SERVICE_PREFIX=process.env.SERVE_PREFIX?`/${process.env.SERVE_PREFIX}`:"",GATEWAY_MIDDLEWARE_PATH=process.env.GATEWAY_MIDDLEWARE||"",GATEWAY_CONFIG=(()=>{const l=process.env.GATEWAY_CONFIG;if(!l)return{};try{return JSON.parse(l)}catch{return{}}})();let gatewayMiddleware=null;if(GATEWAY_MIDDLEWARE_PATH)try{const l=require(GATEWAY_MIDDLEWARE_PATH);gatewayMiddleware=typeof l=="function"?l:typeof l.default=="function"?l.default:null,gatewayMiddleware||console.warn(`[gateway] ${GATEWAY_MIDDLEWARE_PATH} does not export a function, gateway disabled`)}catch(l){console.error(`[gateway] Failed to load middleware from ${GATEWAY_MIDDLEWARE_PATH}:`,l)}function applyGatewayMiddleware(l){if(gatewayMiddleware)try{gatewayMiddleware(l,GATEWAY_CONFIG)}catch(f){console.error("[gateway] Middleware error:",f)}}h(applyGatewayMiddleware,"applyGatewayMiddleware"),i(applyGatewayMiddleware,"applyGatewayMiddleware");const GATEWAY_ROUTES=(()=>{try{return JSON.parse(process.env.GATEWAY_ROUTES||"[]")}catch{return[]}})(),GATEWAY_HTTPS=process.env.GATEWAY_HTTPS==="1";function hostMatches(l,f){if(l.startsWith("*.")){const g=l.slice(1);return f.endsWith(g)||f===l.slice(2)}return f===l}h(hostMatches,"hostMatches"),i(hostMatches,"hostMatches");function matchGatewayRoute(l){if(GATEWAY_ROUTES.length===0)return;const f=(l.headers.host||"").split(":")[0],g=l.url||"/";for(const E of GATEWAY_ROUTES)if(!(E.host&&!hostMatches(E.host,f))&&!(E.prefix&&!g.startsWith(E.prefix)))return E}h(matchGatewayRoute,"matchGatewayRoute"),i(matchGatewayRoute,"matchGatewayRoute");const WORKER_NAMES=(()=>{try{return JSON.parse(process.env.WORKERS||"[]")}catch{return[]}})(),LENSMCP_WS_KEY=process.env.LENSMCP_WS_KEY||"",SOCK_NS=process.env.LENSMCP_SOCK_NS||LENSMCP_WS_KEY,SOCK_DIR=SOCK_NS?path.join(os.tmpdir(),SOCK_NS,`${SERVICE_NAME||"lensmcp-cluster"}-devserver`):path.join(os.tmpdir(),`${SERVICE_NAME||"lensmcp-cluster"}-devserver`),SOCKET_ONLY=process.env.LENSMCP_SOCKET_ONLY==="1",POD_GENERATION=(()=>{const l=Number(process.env.LENSMCP_POD_GENERATION);return Number.isFinite(l)&&l>1?Math.floor(l):1})();function childSockPath(l){return path.join(SOCK_DIR,(0,pod_sock_1.podSockName)(l,POD_GENERATION))}h(childSockPath,"childSockPath"),i(childSockPath,"childSockPath");function sockOwnerPath(l){return`${l}.owner`}h(sockOwnerPath,"sockOwnerPath"),i(sockOwnerPath,"sockOwnerPath");function sockRetiringPath(l){return`${l}.retiring`}h(sockRetiringPath,"sockRetiringPath"),i(sockRetiringPath,"sockRetiringPath");function tell(l,f){if(!l.connected||typeof l.send!="function")return!1;try{return l.send(f,()=>{})}catch{return!1}}h(tell,"tell"),i(tell,"tell");function refusePoolCommand(l,f){console.warn(`[devserver] refused ${l.method} ${l.url} on the public port \u2014 under a gateway the pool is driven on the control socket only.`),f.writeHead(404,{"content-type":"application/json"}),f.end(JSON.stringify({error:"not found"}))}h(refusePoolCommand,"refusePoolCommand"),i(refusePoolCommand,"refusePoolCommand"),exports.DEBUG_FIXED_PORTS_ENV="LENSMCP_DEBUG_FIXED_PORTS";function usesFixedInspectorPorts(l=process.env){const f=(l[exports.DEBUG_FIXED_PORTS_ENV]??"").trim().toLowerCase();return f==="1"||f==="true"||f==="yes"||f==="on"}h(usesFixedInspectorPorts,"usesFixedInspectorPorts"),i(usesFixedInspectorPorts,"usesFixedInspectorPorts");function inspectorPortFor(l,f,g=process.env){if(!usesFixedInspectorPorts(g))return 0;const E=Math.trunc(l)+Math.trunc(f);return Number.isInteger(E)&&E>1024&&E<=65535?E:0}h(inspectorPortFor,"inspectorPortFor"),i(inspectorPortFor,"inspectorPortFor");function ensureOwnerOnlyDir(l){try{fs.mkdirSync(l,{recursive:!0,mode:448})}catch{}try{const f=fs.lstatSync(l);f.isDirectory()&&(f.mode&63)!==0&&fs.chmodSync(l,448)}catch{}}h(ensureOwnerOnlyDir,"ensureOwnerOnlyDir"),i(ensureOwnerOnlyDir,"ensureOwnerOnlyDir");function claimSock(l,f=process.pid){ensureOwnerOnlyDir(path.dirname(l));try{const g=sockOwnerPath(l);try{fs.unlinkSync(g)}catch{}fs.writeFileSync(g,String(f),{flag:"wx",mode:384})}catch{}try{fs.unlinkSync(l)}catch{}try{fs.unlinkSync(sockRetiringPath(l))}catch{}}h(claimSock,"claimSock"),i(claimSock,"claimSock");function sockOwnedByAnother(l,f=process.pid){try{const g=fs.readFileSync(sockOwnerPath(l),"utf8").trim();return!!g&&g!==String(f)}catch{return!1}}h(sockOwnedByAnother,"sockOwnedByAnother"),i(sockOwnedByAnother,"sockOwnedByAnother");function cleanupSock(l,f=process.pid){if(l){try{const g=fs.readFileSync(sockOwnerPath(l),"utf8").trim();if(g&&g!==String(f))return}catch{}try{fs.unlinkSync(l)}catch{}try{fs.unlinkSync(sockOwnerPath(l))}catch{}try{fs.unlinkSync(sockRetiringPath(l))}catch{}(0,gc_notice_1.clearGcNotice)(l)}}h(cleanupSock,"cleanupSock"),i(cleanupSock,"cleanupSock");function postRetiringNotice(l,f){if(!(!l||!f)){try{const g=fs.readFileSync(sockOwnerPath(l),"utf8").trim();if(g&&g!==String(f))return}catch{}try{fs.writeFileSync(sockRetiringPath(l),String(f),{flag:"w",mode:384})}catch{}}}h(postRetiringNotice,"postRetiringNotice"),i(postRetiringNotice,"postRetiringNotice");function serviceKeyFingerprint(){const l=process.env.LENSMCP_SERVICE_KEY;if(!l)return;const{createHash:f}=require("node:crypto");return f("sha256").update(l).digest("hex").slice(0,8)}h(serviceKeyFingerprint,"serviceKeyFingerprint"),i(serviceKeyFingerprint,"serviceKeyFingerprint");function rootModuleOf(l){let f;for(const g of l.getModules?.()?.values()??[])typeof g?.metatype!="function"||typeof g.distance!="number"||!Number.isFinite(g.distance)||(!f||g.distance<f.distance)&&(f=g);return f?.metatype}h(rootModuleOf,"rootModuleOf"),i(rootModuleOf,"rootModuleOf");let lastImportedModule;function takeImportedModule(){const l=lastImportedModule;return lastImportedModule=void 0,l}h(takeImportedModule,"takeImportedModule"),i(takeImportedModule,"takeImportedModule");async function importFresh(spec){process.env.DEVSERVER_MODE="1";const requested=path.isAbsolute(spec)?spec:path.join(__dirname,spec);let resolved=requested;try{resolved=fs.realpathSync(requested)}catch{}eval(`(() => {
     const key = ${JSON.stringify(resolved)};
     const previous = require.cache[key];
     delete require.cache[key]; // delete from CJS cache
@@ -9,15 +9,15 @@
       const at = owner && Array.isArray(owner.children) ? owner.children.indexOf(previous) : -1;
       if (at >= 0) owner.children.splice(at, 1);
     }
-  })()`),(0,bundle_parent_1.routeBundleRequires)(requested,resolved);const exports=eval(`require(${JSON.stringify(resolved)})`);try{const mod=eval("require.cache")[resolved];lastImportedModule=mod&&typeof mod=="object"?mod:void 0}catch{}return exports}h(importFresh,"importFresh"),a(importFresh,"importFresh");function debounce(c,f){let g=null;return(...E)=>{g&&clearTimeout(g),g=setTimeout(()=>c(...E),f)}}if(h(debounce,"debounce"),a(debounce,"debounce"),process.env.APP_RUNNER==="1"){(0,stdio_guard_1.guardBrokenStdio)();const c=a(g=>{if(!inspector.url())try{inspector.open(g,"127.0.0.1",!1)}catch(L){console.warn(`[child] inspector.open(${g}) failed (port taken by another devserver?) \u2014 falling back to a random port:`,L.message);try{inspector.open(0,"127.0.0.1",!1)}catch{}}const E=inspector.url();E&&tell(process,{type:"inspector-url",url:E})},"openInspector"),f=process.env.CHILD_DEBUG_PORT;if(f!==void 0&&f!==""){const g=Number(f);Number.isInteger(g)&&(g===0||g>1024)&&c(g)}try{require("@lensmcp/node-instrumentation/register")}catch{}(async()=>{let g=null,E=!1,L,Z=!1;const He=(0,hot_swap_registries_1.registryPruningEnabled)(),le=a((t,s)=>{const l=(0,hot_swap_registries_1.describePrune)(t,s);l&&console.log(l)},"logPrune");let B={app:null,handler:a((t,s)=>{s.statusCode=503,s.end("starting")},"handler"),inflight:0};const de=(()=>{const t=Number(process.env.LENSMCP_SWAP_DRAIN_MS);return Number.isFinite(t)&&t>=0?t:15*6e4})(),T=a(t=>{const s=globalThis.__lensmcpActiveWork;if(typeof s!="function")return{count:0};try{const l=s(t);return{count:Number(l?.count??0),...l?.oldestStartedAt?{oldestStartedAt:l.oldestStartedAt}:{}}}catch{return{count:0}}},"activeWork"),ke=a(t=>{const s=globalThis.__lensmcpStopWorkIntake;if(typeof s=="function")try{return s(t)}catch{return}},"stopWorkIntake"),pe=a(t=>{const s=globalThis.__lensmcpWorkIntakeReport;if(!(t===void 0||typeof s!="function"))try{return s(t)??void 0}catch{return}},"workIntakeReport"),Ee=(()=>{const t=Number(process.env.LENSMCP_SWAP_MAX_DRAINING);return Number.isFinite(t)&&t>=1?Math.floor(t):1})(),W=new Set,z=(()=>{const t=Number(process.env.LENSMCP_SWAP_EARLY_CLOSE_GRACE_MS);return process.env.LENSMCP_SWAP_EARLY_CLOSE_GRACE_MS!==void 0&&process.env.LENSMCP_SWAP_EARLY_CLOSE_GRACE_MS!==""&&Number.isFinite(t)&&t>=0?t:3e4})(),K=a(t=>{if(!t.abandoned?.size)return 0;const s=Date.now();for(const[l,u]of t.abandoned)(l.writableEnded||s-u>=z)&&t.abandoned.delete(l);return t.abandoned.size},"abandonedRunning"),ee=a(t=>{let s=0;for(const l of t.open??[])l.headersSent||(s+=1);return{unanswered:s+K(t),streams:Math.max(0,t.inflight-s),work:T(t.workGen).count}},"owedBy"),te=a((t,s,l=`${s}s`)=>`${t} ${t===1?s:l}`,"plural");async function De(){if(z<=0)return;const t=Date.now();let s=!1;for(;!(W.size<Ee);){const l=W.values().next().value;if(!l||l.closed)break;const u=ee(l);if(u.unanswered===0&&u.work===0)break;const y=(l.drainingSince??t)+z-Date.now();if(y<=0)break;s||(s=!0,console.log(`[child] swap held \u2014 the app replaced ${Math.round((Date.now()-(l.drainingSince??t))/100)/10}s ago is still `+[u.unanswered?`answering ${te(u.unanswered,"request")}`:"",u.work?`running ${te(u.work,"background job")}`:""].filter(Boolean).join(" and ")+`, and this pod keeps at most ${Ee} replaced app(s) alive (LENSMCP_SWAP_MAX_DRAINING). The new build is applied when it is done \u2014 in ${Math.ceil(y/1e3)}s at the latest (LENSMCP_SWAP_EARLY_CLOSE_GRACE_MS).`)),await new Promise(w=>{setTimeout(w,Math.min(100,y)).unref?.()})}s&&console.log(`[child] swap resumed after ${Date.now()-t}ms`)}h(De,"Ge"),a(De,"holdForOwedWork");const R=(0,swap_recycle_1.swapRecyclePolicy)();let ue,re=0;const Ue=(()=>{const t=Number(process.env.LENSMCP_POD_RETIRE_NOTICE_MS);return Number.isFinite(t)&&t>=0?t:3500})();let _=!1,b=!1;const v=(0,pod_memory_1.podMemoryPolicy)();let j=0;const I=new Set;let he=!1;const q=a(()=>{if(!he)return;let t=0;for(const s of I)s.deref()===void 0?I.delete(s):t+=1;return t},"liveContainers"),k=(0,pod_memory_1.createPodMemoryMonitor)({policy:v,state:a(()=>({gen:B.gen??0,swaps:re,...ue===void 0?{}:{baseline:ue},busy:E||Z||V.size>0,lastBusyAt:M}),"state"),send:a(t=>{tell(process,t)},"send"),containers:q,counter:(0,pod_memory_1.createLiveObjectCounter)(path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.join(__dirname,BUNDLE_PATH)),onRetained:a(()=>Ne(),"onRetained"),gc:a(()=>(0,gc_notice_1.withGcNotice)($,pod_memory_1.fullGc),"gc")}),F=a(()=>((0,gc_notice_1.withGcNotice)($,pod_memory_1.fullGc)&&k.tracker.noteGc(),process.memoryUsage().heapUsed),"liveHeap"),H=(()=>{if(!(0,error_stack_release_1.errorFrameReleaseEnabled)())return null;try{const t=path.dirname(path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.join(__dirname,BUNDLE_PATH))+path.sep,s=`${path.sep}node_modules${path.sep}`,l=new Set(Object.keys(require.cache));return(0,error_stack_release_1.createErrorFrameReleaser)(require.cache,{skip:a(u=>l.has(u)||u.startsWith(t)&&!u.slice(t.length).includes(s)&&!u.slice(t.length).startsWith(`node_modules${path.sep}`),"skip")})}catch{return null}})();let fe=!1;function Pe(){if(!(!H||fe))try{const t=H();t.errors>0&&console.log(`[child] read the stack of ${t.errors} Error object(s) that libraries created while loading and keep for good \u2014 unread, each held the functions that were on its stack, this bundle's included`)}catch(t){console.error("[child] could not release library error frames:",t),fe=!0}}h(Pe,"Ie"),a(Pe,"releaseLibraryErrorFrames");const V=new Map;let M=Date.now();const xe=a(()=>R.settleMs<=0||!E&&!Z&&V.size===0&&Date.now()-M>=R.settleMs,"settled");let Y;function oe(t){if(!(!R.enabled||_||b)){if(R.settleMs<=0){J(t);return}Y&&clearTimeout(Y),Y=setTimeout(()=>{Y=void 0,xe()?J(t):oe(t)},R.settleMs),Y.unref?.()}}h(oe,"le"),a(oe,"recycleCheckWhenSettled");const Se=a(()=>{if(R.stuckCloseMs<=0)return 0;const t=Date.now();let s=0;for(const l of V.values())t-l>=R.stuckCloseMs&&(s+=1);return s},"stuckCloses");function J(t){if(!R.enabled||_||b||!process.send)return;const s=v8.getHeapStatistics().heap_size_limit,l=a(y=>{const w=k.oldestRetained();return{swaps:re,usedBytes:y,limitBytes:s,stuckCloses:Se(),settled:xe(),...ue===void 0?{}:{baselineBytes:ue},...w?{retained:{generation:w.gen,ageMs:Date.now()-w.closedAt,gcs:w.gcs}}:{}}},"state");if(!(0,swap_recycle_1.recycleReason)(R,l(process.memoryUsage().heapUsed)))return;const u=(0,swap_recycle_1.recycleReason)(R,l(F()));u&&(_=!0,console.log(`[child] asking for a fresh pod ${t} \u2014 ${u}. This pod keeps serving until its successor is ready. Size the bound with LENSMCP_SWAP_RECYCLE_HEAP_FACTOR / _HEAP_RATIO / _MIN_MB / _RETAINED_MS, or turn it off with LENSMCP_SWAP_RECYCLE=0.`),tell(process,{type:"recycle-request",reason:u}))}h(J,"X"),a(J,"considerRecycle");let _e;function Ne(){if(!R.enabled||R.retainedMs<=0||_||b)return;const t=k.oldestRetained();if(!t)return;const s=t.closedAt+R.retainedMs-Date.now();if(s<=0){J("with a closed generation still in memory");return}_e||(_e=setTimeout(()=>{_e=void 0,k.measure("retention-check").catch(()=>{})},s),_e.unref?.())}h(Ne,"We"),a(Ne,"retainedRecycleCheck");function ge(t,s){const l={};s&&(l.module=s),t&&(l.app=t);try{const u=t?.app;if(u&&typeof u=="object"&&(l.nestApp=u,u.container&&typeof u.container=="object")){l.container=u.container;const y=rootModuleOf(u.container);y&&(l.rootModule=y)}}catch{}return l}h(ge,"Pe"),a(ge,"generationTargets");async function ne(t,s){if(t.closed||(t.closed=!0,W.delete(t),s&&console.error(`[child] ${s}`),!t.app))return;V.set(t,Date.now());const l=R.enabled&&R.stuckCloseMs>0?setTimeout(()=>{V.has(t)&&(console.error(`[child] a previous app has been closing for ${Math.round(R.stuckCloseMs/1e3)}s and its close() has not returned \u2014 one of its shutdown hooks is waiting on something that does not end (a queue worker, a connection, a stream). It stays in memory until this pod is replaced.`),J("with a previous app stuck in close()"))},R.stuckCloseMs):void 0;l?.unref?.();const u=t.app;try{await t.app.close()}catch(y){console.error("[child] error closing a previous app:",y)}finally{V.delete(t),M=Date.now(),l&&clearTimeout(l),t.app=null,t.abandoned=void 0,t.handler=(y,w)=>{w.statusCode=503,w.end("closed")},t.gen!==void 0&&k.closed(t.gen,re,ge(u,t.module)),t.module=void 0}if(t.superseded){try{le((0,hot_swap_registries_1.pruneRegistries)(t.superseded,"serve"),"after closing the previous app")}catch(y){console.error("[child] could not release the previous app's class registrations:",y)}t.superseded=void 0}oe("after closing the previous app")}h(ne,"_e"),a(ne,"closeGeneration");async function se(t){const s=Date.now();t.drainingSince=s;const l=a(()=>({inflight:t.inflight+K(t),work:T(t.workGen).count}),"busy"),u=l();if(u.inflight>0||u.work>0){for(;W.size>=Ee;){const O=W.values().next().value;if(!O)break;const A=ee(O),Q=Math.round((Date.now()-(O.drainingSince??s))/1e3);if(A.unanswered===0&&A.streams===0&&A.work===0){await ne(O);continue}await ne(O,`closing a still-draining generation early \u2014 ${W.size} were pending and the cap is ${Ee} (each holds a whole app: DI container, DB pool, queue workers). `+(A.unanswered>0||A.work>0?`It was replaced ${Q}s ago and had still not answered ${te(A.unanswered,"request")}`+(A.work?` or finished ${te(A.work,"background job")}`:"")+` \u2014 those fail now (a queue job keeps its lock until the TTL lapses). Raise LENSMCP_SWAP_EARLY_CLOSE_GRACE_MS (currently ${z}ms) to wait longer for them. `:`It held only ${te(A.streams,"open stream")}; their clients reconnect to the new app. `)+"Raise LENSMCP_SWAP_MAX_DRAINING if this pod legitimately needs more.")}W.add(t)}for(;de>0&&Date.now()-s<de;){if(t.closed)return;const O=l();if(O.inflight===0&&O.work===0)break;await new Promise(A=>{setTimeout(A,250).unref?.()})}if(t.closed)return;const y=l(),w=pe(t.workGen);y.inflight>0||y.work>0?console.error(`[child] swap drain expired after ${Date.now()-s}ms \u2014 closing the previous app with ${y.inflight} in-flight request(s) and ${y.work} background job(s) still running. `+(w?`Previous app still processing ${w.running} queue job(s); ${w.takenAfterStop} were taken after the swap. `:"")+`A queue job killed here keeps its lock until the TTL lapses. Raise LENSMCP_SWAP_DRAIN_MS (currently ${de}ms) if this is legitimate work.`):(Date.now()-s>250||w?.runningAtStop||w?.takenAfterStop)&&console.log(`[child] previous app drained in ${Date.now()-s}ms \u2014 closing it`+(w?` (it finished ${w.finishedAfterStop} queue job(s) after the swap; ${w.takenAfterStop} were taken after the swap)`:"")),await ne(t)}h(se,"ge"),a(se,"drainThenClose");async function ie(){if(E)return Z=!0,console.log("[child] Reload deferred \u2014 will re-swap after current swap completes"),g;E=!0,M=Date.now(),await De(),process.removeAllListeners("uncaughtException"),process.removeAllListeners("unhandledRejection"),process.on("uncaughtException",(N,C)=>{console.error(`[child] uncaughtException (${C}):`,N)}),process.on("unhandledRejection",N=>{const C=N instanceof Error?N.stack||N.message:String(N);C.includes("FronteggContextScope")||C.includes("populateLoggerMetadata")||console.error("[child] unhandledRejection:",N)});let t;if(He)try{t=(0,hot_swap_registries_1.captureRegistries)()}catch{t=void 0}const s=global.__lensmcpBeginWorkGeneration,l=typeof s=="function"?s():void 0;try{try{await importFresh(BUNDLE_PATH)}catch(N){if(!(N instanceof SyntaxError))throw N;console.warn(`[child] bundle was unreadable mid-write (${N.message}) \u2014 retrying the swap once`),await new Promise(C=>setTimeout(C,400)),await importFresh(BUNDLE_PATH)}}catch(N){throw E=!1,M=Date.now(),N}if(typeof global.createChildApp!="function")throw E=!1,M=Date.now(),new Error(`Bundle '${BUNDLE_PATH}' does not export createChildApp() and the zero-touch bridge is not active. Either install @lensmcp/node-instrumentation (a plain NestFactory.create + app.listen main.ts then just works) or set global.createChildApp in main.ts when DEVSERVER_MODE === '1'.`);let u;if(t)try{u=(0,hot_swap_registries_1.supersededSince)(t),le((0,hot_swap_registries_1.pruneRegistries)(u,"build"),"at the swap")}catch(N){console.error("[child] could not release superseded class registrations:",N)}let y;try{y=await global.createChildApp()}catch(N){throw E=!1,M=Date.now(),takeImportedModule(),N}const w=B;u?.size&&(w.app?w.superseded=u:le((0,hot_swap_registries_1.pruneRegistries)(u,"serve"),"at the swap")),g=y;const O=takeImportedModule();B={app:y,handler:y.handler,inflight:0,gen:++j,...O?{module:O}:{},...l===void 0?{}:{workGen:l}};const A=ge(y,void 0).container;A&&(I.add(new WeakRef(A)),he=!0);const Q=w.app&&l!==void 0?ke(l):void 0;return console.log("[child] Swapped to fresh app (previous draining in background)"+(Q?.workers?`; its ${Q.workers} queue worker(s) stopped taking new jobs, previous app still processing ${Q.runningAtStop} job(s)`:"")),Pe(),w.app&&(re+=1,se(w).catch(N=>console.error("[child] background close error:",N)),setTimeout(()=>J("30s after a hot swap"),3e4).unref?.(),k.swapped(w.gen,()=>w.closed===!0&&!V.has(w))),E=!1,M=Date.now(),Z?(Z=!1,ie()):y}h(ie,"ye"),a(ie,"swapNow");const ve=debounce(async()=>{try{console.log("[child] /webpack/reload"),await ie()}catch(t){console.error("[child] reload failed:",t)}},250),ye=http.createServer((t,s)=>{if(t.method==="POST"&&t.url==="/webpack/reload"){s.writeHead(200,{"content-type":"application/json"}),s.end(JSON.stringify({ok:!0})),ve();return}if(t.method==="GET"&&t.url==="/__lensmcp/alive"){const u=t.headers["x-internal-token"],y=process.env.LENSMCP_SERVICE_KEY;if(y&&u!==y){s.writeHead(404,{"content-type":"text/plain"}),s.end("not found");return}const w=T();s.writeHead(200,{"content-type":"application/json","cache-control":"no-store"}),s.end(JSON.stringify({ok:!0,pid:process.pid,swapping:E,inflight:B.inflight,oldestInflightAt:B.oldestAt,activeWork:w.count,oldestWorkAt:w.oldestStartedAt,keyFingerprint:serviceKeyFingerprint(),...L?{watcher:L}:{},...Number.isFinite(Number(process.env.LENSMCP_POD_GENERATION))&&process.env.LENSMCP_POD_GENERATION?{podGeneration:Number(process.env.LENSMCP_POD_GENERATION)}:{}}));return}const l=B;l.inflight+=1,(l.open??=new Set).add(s),l.oldestAt===void 0&&(l.oldestAt=Date.now()),s.on("close",()=>{l.inflight-=1,l.open?.delete(s),z>0&&!l.closed&&!s.headersSent&&!s.writableEnded&&((l.abandoned??=new Map).set(s,Date.now()),l.abandoned.size>256&&K(l)),l.inflight===0&&(l.oldestAt=void 0),k.activity()}),l.handler(t,s)});ye.keepAliveTimeout=0;const $=process.env.CHILD_SOCK_PATH;process.on("disconnect",()=>{cleanupSock($),process.exit(0)});try{const t=path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.join(__dirname,BUNDLE_PATH);if((0,schema_first_instance_1.schemaPrewarmEnabled)())try{const s=(0,schema_first_instance_1.prewarmZodFor)(t);s?.created&&console.log(`[child] zod${s.version?` ${s.version}`:""}: built ${s.created} throwaway schemas first, so none of the bundle's own is the first of its class`)}catch{}if((0,redis_disconnect_fix_1.redisDisconnectFixEnabled)())try{const s=(0,redis_disconnect_fix_1.finishStrandedDisconnectsFor)(t);s?.patched&&console.log(`[child] ioredis${s.versions.length?` ${s.versions.join(", ")}`:""}: a disconnect() between reconnect attempts now ends the client \u2014 it used to leave a queue worker's close() waiting for good`)}catch{}await ie(),ue=(await k.booted()).live,console.log(`[child] Using bundle: ${t}`),claimSock($),ye.listen($,()=>{console.log(`[child] Listening on ${$}`),tell(process,{type:"ready",socketPath:$})})}catch(t){console.error("[child] Startup error:",t),tell(process,{type:"boot-error",error:String(t?.stack||t)}),process.exitCode=1;return}process.on("message",async t=>{if(!(!t||typeof t!="object")){if(t.type==="debug-open"){const s=Number(t.port);c(Number.isInteger(s)&&s>1024?s:0);return}if(t.type==="watcher"){const s=t.testimony;s&&typeof s=="object"&&(L=s);return}if(t.type==="heap-snapshot"){Ae(t);return}if(t.type==="recycle-declined"){_=!1;return}if(t.type==="retire"){U();return}if(t.type==="reload"){if(b)return;try{const s=Date.now();await ie(),tell(process,{type:"reloaded",socketPath:$,swap:{generation:j,swaps:re,swapMs:Date.now()-s,draining:W.size}})}catch(s){console.error("[child] reload error:",s),tell(process,{type:"reload-error",error:String(s?.stack||s)})}}}});let we=!1;async function Ae(t){const s=a(l=>{tell(process,{type:"heap-snapshot-result",id:t.id,...l})},"reply");if(we)return s({ok:!1,refused:"a snapshot of this pod is already being written"});we=!0;try{const l=F(),u=k.tracker.views().map(A=>A.gen),y=(0,heap_snapshot_1.heapSnapshotPolicy)();t.maxHeapBytes&&(y.maxHeapBytes=t.maxHeapBytes);const w=(0,heap_snapshot_1.heapSnapshotRefusal)(y,{live:l,...t.available?{available:t.available}:{}});if(w)return s({ok:!1,refused:w,live:l});console.log(`[child] writing a heap snapshot (${Math.round(l/1048576)} MB live) \u2014 the pod pauses while V8 serialises it`);const O=await(0,heap_snapshot_1.writeHeapSnapshot)(t.file);s({ok:!0,file:t.file,bytes:O.bytes,ms:O.ms,live:l,gen:B.gen??0,closedAlive:u})}catch(l){s({ok:!1,error:l?.message??String(l)})}finally{we=!1}}h(Ae,"Ue"),a(Ae,"takeHeapSnapshot");async function U(t="a fresh pod has taken over"){if(b)return;b=!0,k.stop(),console.log(`[child] retiring \u2014 ${t}; ${path.basename($,".sock")} (pid ${process.pid}) is finishing in-flight work, then exiting`);const s=ke(Number.POSITIVE_INFINITY);s?.workers&&console.log(`[child] its ${s.workers} queue worker(s) stopped taking new jobs, still processing ${s.runningAtStop} job(s)`);try{fs.writeFileSync(sockRetiringPath($),String(process.pid),{flag:"w",mode:384})}catch{}await new Promise(u=>{setTimeout(u,Ue).unref?.()}),cleanupSock($),ye.close();const l=Date.now();for(;Date.now()-l<de;){ye.closeIdleConnections?.();let u=0;for(const y of W)u+=ee(y).unanswered;if(B.inflight+K(B)===0&&u===0&&T().count===0)break;await new Promise(y=>{setTimeout(y,250).unref?.()})}setTimeout(()=>process.exit(0),3e4).unref?.();try{await g?.close()}catch(u){console.error("[child] close error while retiring:",u)}process.exit(0)}h(U,"F"),a(U,"retire"),process.on("beforeExit",()=>{try{inspector?.close?.()}catch{}});const ae=a(async t=>{console.log(`[child ${t}] shutting down\u2026`);const s=g?.close().catch(u=>console.error("[child] close error:",u)),l=new Promise(u=>ye.close(()=>u()));cleanupSock($),setTimeout(()=>process.exit(0),700).unref(),await Promise.all([s,l]),process.exit(0)},"shutdown");["SIGINT","SIGTERM","SIGHUP","SIGQUIT","SIGUSR2"].forEach(t=>{process.on(t,()=>{if(t==="SIGTERM"&&!b&&(0,handoff_retire_1.handoffRetireRequested)(SOCK_DIR,POD_GENERATION)){U("this generation was handed over to a newer one");return}inspector?.close?.(),ae(t)})})})()}else{let c=h(function(_){K.push(_),K.length>z&&K.splice(0,K.length-z),Ee?.write((0,inspector_secret_1.redactInspectorUrls)(_.replace(W,"")));for(const b of ee)try{const v=b.plain?_.replace(W,""):_;b.res.write(b.redact?(0,inspector_secret_1.redactInspectorUrls)(v):v)}catch{ee.delete(b)}},"he");a(c,"emitLogLine");const f=12,g=process.env.LENSMCP_PROJECT||SERVICE_NAME||"service",E=(0,pod_memory_events_1.createPodMemoryPublisher)(process.env.LENSMCP_EVENT_FILE),L=a(_=>({project:g,service:SERVICE_NAME||g,pod:_.id,pid:_.proc.pid??0,podGeneration:POD_GENERATION}),"podIdentity"),Z=["\x1B[36m","\x1B[33m","\x1B[35m","\x1B[32m","\x1B[34m","\x1B[31m"],He="\x1B[0m",le=Math.max(1,Number(process.env.CHILD_COUNT||1)),B=LENSMCP_WS_KEY||path.basename(process.cwd()),de=a(_=>(0,process_name_1.namedExecPath)((0,process_name_1.processName)(B,SERVICE_NAME||"service",_)),"execPathFor");let T=(()=>{const _=Number(process.env.LENSMCP_DEBUG_PORT||"");return Number.isInteger(_)&&_>1024?_:0})();const ke=20;T&&(console.warn("[parent] DEBUGGER ENABLED \u2014 pods and workers open a Node inspector. Node's inspector has NO authentication: the ws:// URL's UUID is the whole credential, and any account on this host that obtains it can run code as you. Do not enable this on a shared machine. (issues/closed/codex-security-06)"),console.warn(usesFixedInspectorPorts()?`[parent] ${exports.DEBUG_FIXED_PORTS_ENV} is set \u2014 inspectors bind PREDICTABLE ports (${T}+slot, workers ${T}+${ke}+i). Any account on this host can connect to 127.0.0.1:${T} and read the session UUID from /json/list. Unset it to use ephemeral ports.`:`[parent] Inspectors bind an EPHEMERAL loopback port; attach via the printed "Debugger listening" URL, or \`lensmcp debug <service>\` (control socket). Set ${exports.DEBUG_FIXED_PORTS_ENV}=1 for fixed ports if your IDE needs a pre-configured attach port \u2014 any account on this host can then reach them.`));const pe=process.env.LENSMCP_LOG_FILE||"",Ee=pe?(()=>{try{fs.mkdirSync(path.dirname(pe),{recursive:!0});const _=fs.createWriteStream(pe,{flags:"a",mode:384});try{fs.chmodSync(pe,384)}catch{}return _}catch(_){return console.warn(`[parent] cannot open log file ${pe}:`,_.message),null}})():null,W=/\x1b\[[0-9;]*m/g,z=2e3,K=[],ee=new Set,te=(0,devserver_transport_1.gatewayManaged)();for(const _ of["log","info","warn","error"]){const b=console[_].bind(console),v=_==="log"||_==="info"?process.stdout:process.stderr;console[_]=(...j)=>{b(...j.map(I=>typeof I=="string"?(0,inspector_secret_1.forStream)(v,te,I):I)),c(j.map(I=>typeof I=="string"?I:util.inspect(I)).join(" ")+`
-`)}}const De=a(_=>Z[(_-1)%Z.length],"colorFor"),R=a(_=>{if(le===1)return"";const b=`[child#${_}] `;return`${De(_)}${b}${He}`},"tagFor"),ue=a(_=>_.startsWith("{")&&_.endsWith("}"),"isJsonLog"),re=a((_,b,v)=>{const j=prettyFactory({sync:!0,colorize:!0,crlf:!0,messageKey:"message",errorLikeObjectKeys:["err","error"],errorProps:"type,message,stack",ignore:["logContext","context","hostname","req","res","err.driverError","module","cloudEnvironment","frontegg-application-id","frontegg-tenant-id","frontegg-trace-id","frontegg-vendor-id","host","service","version","err","error"].join(","),messageFormat:"{if module}[{module}] {end}{if context}[{context}] {end}{if logContext}[{logContext}] {end}{message}",customPrettifiers:{stack:a(q=>`
-`+String(q),"stack")}}),I=a((q,k)=>{const F=q==="stdout"?process.stdout:process.stderr;try{v?.(k)}catch{}const H=ue(k)?j(k):`${k}
-`;F.write((0,inspector_secret_1.forStream)(F,te,`${b}${H}`)),c(`${b}${H}`)},"write"),he=a((q,k)=>{if(!q)return;const F=readline.createInterface({input:q});F.on("line",H=>I(k,H)),F.on("close",()=>{})},"attach");he(_.stdout,"stdout"),he(_.stderr,"stderr")},"wireProcLogging"),Ue=a(_=>re(_.proc,R(_.id),b=>_.tail.push(b)),"wireChildLogging");(async()=>{ensureOwnerOnlyDir(SOCK_DIR);const _=httpProxy.createProxyServer({});let b=Number(process.env.PORT)||0;b||(b=9090);const v=[],j=new Set;function I(){let e=0;for(;j.has(e);)e++;return j.add(e),e}h(I,"$"),a(I,"allocDebugSlot");let he=1,q=0,k=!1,F=le,H=[],fe=0;const Pe=(0,swap_mode_1.swapMode)(),V=(()=>{const e=Number(process.env.LENSMCP_POD_BOOT_GRACE_MS);return Number.isFinite(e)&&e>=0?e:12e4})(),M=a(e=>e.proc.exitCode!==null||e.proc.signalCode!==null,"childExited"),xe=a(e=>e.booting&&!M(e)&&Date.now()-e.spawnedAt<V,"stillBooting");function Y(){return v.filter(e=>e.healthy&&typeof e.socketPath=="string")}h(Y,"K"),a(Y,"healthyChildren");let oe,Se=0,J;const _e={project:g,service:SERVICE_NAME||g,podGeneration:POD_GENERATION};function Ne(e){const r=(0,service_build_events_1.buildAccountOf)(e.building);r&&r.startedAt!==Se&&(Se=r.startedAt,E.publish((0,service_build_events_1.buildServiceBuildEvent)(_e,"started",r,{root:process.cwd()})));const n=(0,service_build_events_1.buildAccountOf)(e.failed);n&&(Se=0,E.publish((0,service_build_events_1.buildServiceBuildEvent)(_e,"failed",n,{root:process.cwd()})))}h(Ne,"We"),a(Ne,"recordBuildProgress");function ge(e){if(!e||typeof e!="object")return;const r=e;if(r.schemaVersion===1){Ne(r),"failed"in r&&delete r.failed,oe=r;for(const n of v)tell(n.proc,{type:"watcher",testimony:r})}}h(ge,"Pe"),a(ge,"recordWatcherTestimony");function ne(e,r=256*1024){return new Promise(n=>{let p="",i=!1;e.on("data",o=>{i||(p+=o,p.length>r&&(i=!0))}),e.on("end",()=>{if(i||!p)return n(void 0);try{n(JSON.parse(p))}catch{n(void 0)}}),e.on("error",()=>n(void 0))})}h(ne,"_e"),a(ne,"readJsonBody");function se(){const e=Y();if(e.length===0)return null;const r=q%e.length;return q=(q+1)%e.length,e[r]}h(se,"ge"),a(se,"pickChild");function ie(e,r){const n=`Child#${e.id}`,p=SERVICE_NAME||g,i=Date.now();if(r.type==="pod-memory"){const o=r.report;if(!o||typeof o.live!="number")return;e.memory.latest=o,e.memory.history.push(o),e.memory.history.length>12&&e.memory.history.splice(0,e.memory.history.length-12),console.log(`[parent] ${(0,pod_memory_1.describePodMemory)(n,o)}`),E.publish((0,pod_memory_events_1.buildPodMemoryEvent)(L(e),o))}else if(r.type==="pod-memory-retained"){const o=r.retained;if(!o||typeof o.gen!="number")return;e.memory.retained.set(o.gen,{...o,at:i}),console.warn(`[parent] ${(0,pod_memory_1.describeRetained)(n,p,o)}`),E.publish((0,pod_memory_events_1.buildPodRetainedEvent)(L(e),o,i))}else{const o=r.released;if(!o||typeof o.gen!="number")return;e.memory.retained.delete(o.gen),console.log(`[parent] ${(0,pod_memory_1.describeReleased)(n,p,o)}`),E.publish((0,pod_memory_events_1.buildPodReleasedEvent)(L(e),o,i))}}h(ie,"ye"),a(ie,"recordPodMemory");const ve=new Map;let ye=0;async function $(){const e=he++,r=childSockPath(e);cleanupSock(r);const n=(0,dev_devtool_1.sourceMapExecArgv)();__filename.endsWith(".ts")&&n.unshift("--require","@swc-node/register"),n.push(...(0,inspector_secret_1.inspectorPublishExecArgv)(usesFixedInspectorPorts()));const p=T?I():-1,i=(0,node_child_process_1.fork)(__filename,{env:{...process.env,APP_RUNNER:"1",CHILD_SOCK_PATH:r,...p>=0&&{CHILD_DEBUG_PORT:String(inspectorPortFor(T,p))}},stdio:["inherit","pipe","pipe","ipc"],execArgv:n,execPath:de("pod")}),o={id:e,proc:i,healthy:!1,lastError:null,debugSlot:p,tail:new exit_reason_1.TailBuffer,booting:!0,spawnedAt:Date.now(),bootReloadSeq:fe,memory:{history:[],retained:new Map}};return i.on("error",S=>console.error(`[parent] Child#${e}: ${S.message}`)),i.on("message",S=>{if(!S||typeof S!="object")return;const d=S;if(d.type==="ready")o.socketPath=String(d.socketPath),o.healthy=!0,o.booting=!1,console.log(`[parent] Child#${o.id} ready on socket ${o.socketPath}`),oe&&tell(i,{type:"watcher",testimony:oe}),fe!==o.bootReloadSeq&&(Pe==="process"?Q():tell(i,{type:"reload"}));else if(d.type==="recycle-request")w(o,String(d.reason||"it has outgrown its bound"));else if(d.type==="inspector-url")o.inspectorUrl=String(d.url),console.log(`[parent] Child#${o.id} Debugger listening on ${d.url}`);else if(d.type==="reloaded"){if(U.has(o)){console.log(`[parent] Child#${o.id} finished a swap it began before it was retired \u2014 not serving it: a fresh pod has taken over`);return}o.socketPath=String(d.socketPath),o.healthy=!0,console.log(`[parent] Child#${o.id} hot-swapped on socket ${o.socketPath}`);const m=d.swap;m&&typeof m.generation=="number"&&typeof m.swaps=="number"&&E.publish((0,service_build_events_1.buildServiceSwapEvent)(L(o),{generation:m.generation,swaps:m.swaps,swapMs:typeof m.swapMs=="number"?m.swapMs:0,draining:typeof m.draining=="number"?m.draining:0},J,{root:process.cwd()}))}else d.type==="reload-error"?(o.lastError=String(d.error||"unknown reload error"),console.error(`[parent] Child#${o.id} reload error: ${o.lastError}`),o.healthy=!1):d.type==="boot-error"?(o.lastError=String(d.error||"unknown boot error"),console.error(`[parent] Child#${o.id} boot error: ${o.lastError}`),o.healthy=!1,o.booting=!1):d.type==="pod-memory"||d.type==="pod-memory-retained"||d.type==="pod-memory-released"?ie(o,d):d.type==="heap-snapshot-result"&&ve.get(Number(d.id))?.(d)}),i.on("exit",(S,d)=>{o.booting=!1;for(const D of o.memory.retained.values()){const x={gen:D.gen,closedAt:D.closedAt,ageMs:Date.now()-D.closedAt,reason:"pod-exited"};console.log(`[parent] ${(0,pod_memory_1.describeReleased)(`Child#${o.id}`,SERVICE_NAME||g,x)}`),E.publish((0,pod_memory_events_1.buildPodReleasedEvent)(L(o),x,Date.now()))}o.memory.retained.clear(),o.memory.latest&&E.publish((0,pod_memory_events_1.buildPodExitedEvent)(L(o),{code:S,signal:d},Date.now())),o.debugSlot>=0&&(j.delete(o.debugSlot),o.debugSlot=-1);const m=d==="SIGINT"||d==="SIGTERM"||S===0;if(m?console.log(`[parent] Child#${o.id} exited cleanly (code=${S}, signal=${d??"none"})`):(console.error((0,exit_reason_1.crashReport)(`[parent] Child#${o.id} crashed (code=${S}, signal=${d??"none"}, pid=${o.proc.pid}, ${o.healthy?"was serving":"was not ready"})`,S,d,o.tail.snapshot())),o.lastError||(o.lastError=`Child exited abnormally (code=${S}, signal=${d??"none"})`)),o.healthy=!1,cleanupSock(o.socketPath,o.proc.pid),o.socketPath=void 0,!m&&!k){const D=v.indexOf(o);D>=0&&v.splice(D,1);const x=Date.now();if(H=H.filter(X=>x-X<3e4),H.length>=5){console.error(`[parent] crash-loop detected (${H.length} respawns/30s) \u2014 pausing auto-respawn; POST /webpack/reload to retry`);return}H.push(x),setTimeout(()=>{const X=v.filter(Ie=>Ie.proc.killed===!1).length;!k&&X<F&&(console.log(`[parent] respawning a crashed pod (${X}/${F} live)`),$().catch(()=>{}))},1500).unref?.()}}),v.push(o),Ue(o),o}h($,"M"),a($,"spawnChild");async function we(e){F=Math.max(F,e);const r=v.filter(p=>p.proc.killed===!1),n=e-r.length;for(let p=0;p<n;p++)await $()}h(we,"me"),a(we,"ensurePoolSize");async function Ae(){const e=v.filter(r=>(!r.healthy||typeof r.socketPath!="string")&&!xe(r));await Promise.all(e.map(async r=>{try{r.proc.kill("SIGTERM")}catch{}cleanupSock(r.socketPath,r.proc.pid),r.socketPath=void 0;const n=v.indexOf(r);n>=0&&v.splice(n,1),await $()}))}h(Ae,"Ue"),a(Ae,"respawnUnhealthy");const U=new Set;let ae=!1,t=0;const s=3e4,l=(()=>{const e=Number(process.env.LENSMCP_SWAP_DRAIN_MS);return(Number.isFinite(e)&&e>=0?e:15*6e4)+6e4})();async function u(e){const r=Date.now(),n=await $(),p=Date.now()+V;for(;!n.healthy&&!n.lastError&&!M(n)&&Date.now()<p;)await new Promise(i=>{setTimeout(i,100).unref?.()});if(k)return{why:"shutting down"};if(!n.healthy){const i=v.indexOf(n);i>=0&&v.splice(i,1);try{n.proc.kill("SIGTERM")}catch{}return{why:`its successor Child#${n.id} did not come up (${n.lastError??"no answer in time"})`}}return y(e),{fresh:n,readyMs:Date.now()-r}}h(u,"_"),a(u,"replacePod");function y(e){const r=v.indexOf(e);if(r>=0&&v.splice(r,1),e.healthy=!1,M(e))return;U.add(e),postRetiringNotice(e.socketPath,e.proc.pid);const n=setTimeout(()=>{if(!M(e)){console.error(`[parent] Child#${e.id} was still running ${l}ms after it was retired \u2014 killing it`);try{e.proc.kill("SIGKILL")}catch{}}},l);if(n.unref?.(),e.proc.once("exit",()=>{clearTimeout(n),U.delete(e)}),!tell(e.proc,{type:"retire"}))try{e.proc.kill("SIGTERM")}catch{}}h(y,"g"),a(y,"retirePod");async function w(e,r){const n=a(i=>{console.log(`[parent] Child#${e.id} asked for a fresh pod (${r}) \u2014 not now: ${i}`),tell(e.proc,{type:"recycle-declined"})},"decline");if(k||!v.includes(e))return;if(ae)return n("another pod is already being replaced");const p=Date.now()-t;if(p<s)return n(`a pod was replaced ${Math.round(p/1e3)}s ago`);ae=!0,console.log(`[parent] Child#${e.id} asked for a fresh pod \u2014 ${r}. Starting one; Child#${e.id} keeps serving until it is ready.`);try{const i=await u(e);if("why"in i){i.why!=="shutting down"&&n(i.why);return}t=Date.now(),console.log(`[parent] Child#${i.fresh.id} took over from Child#${e.id} (pid ${e.proc.pid} \u2192 ${i.fresh.proc.pid})`)}catch(i){n(`could not start a successor: ${i?.message??String(i)}`)}finally{ae=!1}}h(w,"y"),a(w,"recyclePod");let O,A=!1;function Q(){if(O){A=!0;return}O=(async()=>{do{A=!1;const e=fe;for(;ae&&!k;)await new Promise(r=>{setTimeout(r,100).unref?.()});for(const r of Y().filter(n=>n.bootReloadSeq<e)){if(k)break;if(!(!v.includes(r)||!r.healthy)){ae=!0;try{N(),console.log(`[parent] A new build \u2014 starting a fresh pod for it; Child#${r.id} keeps serving the previous build until it is ready.`);const n=await u(r);if("why"in n){n.why!=="shutting down"&&console.error(`[parent] Child#${r.id} keeps serving the previous build \u2014 ${n.why}`);continue}console.log(`[parent] Child#${n.fresh.id} took over from Child#${r.id} with the new build (pid ${r.proc.pid} \u2192 ${n.fresh.proc.pid}, ready in ${(n.readyMs/1e3).toFixed(1)}s while Child#${r.id} served)`),E.publish((0,service_build_events_1.buildServiceSwapEvent)(L(n.fresh),{generation:1,swaps:0,swapMs:n.readyMs,draining:U.size,handoff:{fromPid:r.proc.pid??0}},J,{root:process.cwd()}))}catch(n){console.error(`[parent] Child#${r.id} keeps serving the previous build \u2014 could not start a successor: ${n?.message??String(n)}`)}finally{ae=!1}}}}while(A&&!k)})().finally(()=>{O=void 0})}h(Q,"q"),a(Q,"handoffForReload");function N(){const e=(0,swap_mode_1.maxRetiring)(),r=[...U].filter(n=>!M(n));for(;r.length>=e;){const n=r.shift();console.error(`[parent] Child#${n.id} (pid ${n.proc.pid}) was still finishing its work when a newer build replaced its successor too \u2014 stopping it (LENSMCP_SWAP_MAX_RETIRING=${e})`);try{n.proc.kill("SIGTERM")}catch{}}}h(N,"A"),a(N,"capRetiring");const C=[];function qe(e){const r=path.dirname(path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.resolve(BUNDLE_PATH)),n=path.join(r,`${e}.js`);if(!fs.existsSync(n))return console.error(`[parent] Worker "${e}" bundle not found: ${n}`),null;const p=(0,dev_devtool_1.sourceMapExecArgv)();__filename.endsWith(".ts")&&p.unshift("--require","@swc-node/register");try{p.push("--require",require.resolve("@lensmcp/node-instrumentation/register"))}catch{}const i=inspectorPortFor(T||9229,ke+Math.max(0,WORKER_NAMES.indexOf(e)));p.push(T?`--inspect=127.0.0.1:${i}`:`--inspect-port=127.0.0.1:${i}`,...(0,inspector_secret_1.inspectorPublishExecArgv)(usesFixedInspectorPorts()));const o=(0,node_child_process_1.fork)(n,{env:process.env,stdio:["inherit","pipe","pipe","ipc"],execArgv:p,execPath:de(`w-${e}`)}),S={name:e,proc:o,debugPort:i};return C.push(S),o.on("error",d=>console.error(`[parent] Worker "${e}": ${d.message}`)),re(o,`\x1B[35m[worker:${e}] \x1B[0m`,d=>{const m=/Debugger listening on (wss?:\/\/\S+)/.exec(d);m&&(S.inspectorUrl=m[1])}),o.on("exit",(d,m)=>{m==="SIGINT"||m==="SIGTERM"||d===0||console.error(`[parent] Worker "${e}" crashed (code=${d}, signal=${m??"none"})`);const D=C.indexOf(S);D>=0&&C.splice(D,1)}),console.log(`[parent] Worker "${e}" started (pid=${o.pid})`),S}h(qe,"Ye"),a(qe,"spawnWorkerProcess");const Ve=(()=>{const e=Number(process.env.LENSMCP_SWAP_DRAIN_MS);return Number.isFinite(e)&&e>=0?e:15*6e4})(),Je=(()=>{const e=Number(process.env.LENSMCP_SWAP_MAX_DRAINING);return Number.isFinite(e)&&e>=1?Math.floor(e):1})(),me=new Set,Be=a(e=>e.proc.exitCode!==null||e.proc.signalCode!==null,"workerExited");function Ge(e,r){if(me.delete(e),!Be(e)){console.error(`[parent] Worker "${e.name}" (pid=${e.proc.pid}) ${r} \u2014 killing it. A worker that returns from its SIGTERM handler but leaves a handle open (a Redis client handed to BullMQ is not closed by worker.close()) never exits on its own: close what it opened, or call process.exit().`);try{e.proc.kill("SIGKILL")}catch{}}}h(Ge,"He"),a(Ge,"killDrainingWorker");function je(e){try{e.proc.kill("SIGTERM")}catch{}if(Be(e))return;const r=[...me].filter(p=>p.name===e.name);for(;r.length>=Je;)Ge(r.shift(),`was still running when a later reload replaced its successor (cap ${Je})`);me.add(e);const n=setTimeout(()=>Ge(e,`was still running ${Ve}ms after SIGTERM`),Ve);n.unref?.(),e.proc.once("exit",()=>{clearTimeout(n),me.delete(e)})}h(je,"Je"),a(je,"retireWorker");function Xe(){for(const e of[...C])je(e);C.length=0;for(const e of WORKER_NAMES)qe(e)}h(Xe,"et"),a(Xe,"restartWorkers");const ot=debounce(async()=>{fe+=1;const e=Y();if(e.length>0)if(Pe==="process")Q();else{console.log(`[parent] Forwarding reload to ${e.length} child(ren)`);for(const r of e)tell(r.proc,{type:"reload"})}await Ae(),WORKER_NAMES.length>0&&Xe()},200),ze=a((e,r)=>{const n=(0,notice_generation_1.noticeGeneration)(e.headers);return n===void 0||n===POD_GENERATION?!1:(e.resume(),r.writeHead(409,{"content-type":"application/json"}),r.end(JSON.stringify({ok:!1,generation:POD_GENERATION,sentFor:n})),e.url==="/webpack/reload"&&console.log(`[parent] a build of generation g${n} reached generation g${POD_GENERATION} \u2014 not reloaded: it is not this generation's build`),!0)},"refusedForAnotherGeneration"),Re=a(async(e,r)=>{if(e.method==="POST"&&e.url==="/webpack/reload"){if(!(0,devserver_transport_1.mayDriveThePool)(e))return refusePoolCommand(e,r);if(ze(e,r))return;r.writeHead(200,{"content-type":"application/json"}),r.end(JSON.stringify({ok:!0})),ne(e).then(i=>{const o=i;J=(0,service_build_events_1.buildAccountOf)(o?.build),Se=0,ge(o?.watcher)}),ot();return}if(e.method==="POST"&&e.url==="/webpack/watching"){if(!(0,devserver_transport_1.mayDriveThePool)(e))return refusePoolCommand(e,r);if(ze(e,r))return;const i=await ne(e);ge(i),r.writeHead(200,{"content-type":"application/json"}),r.end(JSON.stringify({ok:!0,relayed:oe!==void 0}));return}if(e.method==="POST"&&e.url==="/webpack/scale"){if(!(0,devserver_transport_1.mayDriveThePool)(e))return refusePoolCommand(e,r);let i="";e.on("data",o=>{i+=o}),e.on("end",async()=>{let o=0;try{o=Number(JSON.parse(i||"{}").pods)||0}catch{}o=Math.max(1,Math.min(o,16)),await we(o),r.writeHead(200,{"content-type":"application/json"}),r.end(JSON.stringify({ok:!0,pods:o}))});return}if(e.method==="GET"&&e.url?.startsWith("/webpack/logs")){const i=new URL(e.url,"http://localhost").searchParams,o=Math.min(Math.max(Number(i.get("tail")??"100")||0,0),z),S=i.get("follow")!=="0",d=i.get("plain")==="1",m=!(0,devserver_transport_1.isOwnerOnlyTransport)(e);r.writeHead(200,{"content-type":"text/plain; charset=utf-8","cache-control":"no-cache"});const D=o===0?"":K.slice(-o).join(""),x=d?D.replace(W,""):D;if(r.write(m?(0,inspector_secret_1.redactInspectorUrls)(x):x),!S){r.end();return}const X={res:r,plain:d,redact:m};ee.add(X),e.on("close",()=>ee.delete(X));return}if(e.method==="POST"&&e.url?.startsWith("/webpack/debug")){if(!(0,devserver_transport_1.isOwnerOnlyTransport)(e)){r.writeHead(404,{"content-type":"application/json"}),r.end(JSON.stringify({error:"not found"}));return}const i=Number(new URL(e.url,"http://localhost").searchParams.get("port")||"");Number.isInteger(i)&&i>1024&&(T=i),T||(T=9229);const o=v.filter(d=>d.proc.exitCode===null&&d.proc.signalCode===null);for(const d of o)d.debugSlot<0&&(d.debugSlot=I()),tell(d.proc,{type:"debug-open",port:inspectorPortFor(T,d.debugSlot)});for(const d of C)try{d.proc.kill("SIGUSR1")}catch{}const S=Date.now()+2e3;for(;Date.now()<S&&o.some(d=>!d.inspectorUrl);)await new Promise(d=>setTimeout(d,50));r.writeHead(200,{"content-type":"application/json"}),r.end(JSON.stringify({ok:!0,basePort:T,fixedPorts:usesFixedInspectorPorts(),pods:o.map(d=>({id:d.id,inspectorUrl:d.inspectorUrl??null})),workers:C.map(d=>({name:d.name,port:d.debugPort||(0,inspector_secret_1.inspectorPortOf)(d.inspectorUrl),inspectorUrl:d.inspectorUrl??null}))},null,2)+`
-`);return}if(e.method==="GET"&&e.url==="/webpack/memory"){if(!(0,devserver_transport_1.isOwnerOnlyTransport)(e)){r.writeHead(404,{"content-type":"application/json"}),r.end(JSON.stringify({error:"not found"}));return}const i=path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.resolve(BUNDLE_PATH),o=[...v,...U].map(S=>({id:S.id,pid:S.proc.pid??0,podGeneration:POD_GENERATION,healthy:S.healthy,retiring:U.has(S),latest:S.memory.latest??null,history:S.memory.history,retained:[...S.memory.retained.values()]}));r.writeHead(200,{"content-type":"application/json","cache-control":"no-store"}),r.end(JSON.stringify({ok:!0,service:SERVICE_NAME,project:g,bundle:{path:i},pods:o},null,2)+`
-`);return}if(e.method==="POST"&&e.url?.startsWith("/webpack/heap")){if(!(0,devserver_transport_1.isOwnerOnlyTransport)(e)){r.writeHead(404,{"content-type":"application/json"}),r.end(JSON.stringify({error:"not found"}));return}const i=a((G,Ce)=>{r.writeHead(G,{"content-type":"application/json"}),r.end(JSON.stringify(Ce,null,2)+`
-`)},"reply"),o=new URL(e.url,"http://localhost").searchParams,S=Number(o.get("pod")||""),d=o.has("maxMb")?Number(o.get("maxMb")):void 0;if(d!==void 0&&!(Number.isFinite(d)&&d>0)){i(400,{ok:!1,error:"maxMb takes a positive number of MB"});return}const m=Number.isInteger(S)&&S>0?v.find(G=>G.id===S):Y()[0];if(!m||M(m)){i(404,{ok:!1,error:S?`no pod #${S} \u2014 running: ${v.map(G=>`#${G.id}`).join(", ")||"none"}`:"no pod is serving"});return}if(ve.size>0){i(409,{ok:!1,refused:"a heap snapshot is already being written for this service"});return}const D=(0,heap_snapshot_1.heapSnapshotPolicy)(),x=(0,heap_snapshot_1.heapSnapshotDir)();let X;try{(0,heap_snapshot_1.ensureHeapDir)(x);const G=(0,heap_snapshot_1.pruneHeapSnapshots)(x,D);G.length&&console.log(`[parent] removed ${G.length} older heap snapshot(s) from ${x}`),X=path.join(x,(0,heap_snapshot_1.heapSnapshotFileName)(SERVICE_NAME||g,m.id,m.proc.pid??0,m.memory.latest?.gen??0,Date.now()))}catch(G){i(500,{ok:!1,error:`cannot prepare ${x}: ${G.message}`});return}const Ie=++ye,Fe=(0,heap_snapshot_1.availableSystemMemory)();let Me;const P=await new Promise(G=>{const Ce=setTimeout(()=>G(void 0),6e5);Ce.unref?.(),ve.set(Ie,ct=>{clearTimeout(Ce),G(ct)}),Me=a(()=>{clearTimeout(Ce),G(void 0)},"onExit"),m.proc.once("exit",Me);const it={type:"heap-snapshot",id:Ie,file:X,...Fe?{available:Fe}:{},...d!==void 0?{maxHeapBytes:Math.floor(d*1048576)}:{}};tell(m.proc,it)||Me()}).finally(()=>{ve.delete(Ie),Me&&m.proc.off("exit",Me)});if(!P){i(504,{ok:!1,pod:m.id,error:"the pod did not finish the snapshot (it exited, or took longer than 10 minutes)"});return}P.ok?console.log(`[parent] Child#${m.id} wrote a ${Math.round((P.bytes??0)/1048576)} MB heap snapshot in ${P.ms} ms \u2192 ${P.file}`):console.warn(`[parent] Child#${m.id} heap snapshot not taken: ${P.refused??P.error}`),i(P.ok?200:P.refused?409:500,{ok:P.ok,pod:m.id,pid:m.proc.pid??0,service:SERVICE_NAME,bundle:path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.resolve(BUNDLE_PATH),...Fe?{available:Fe}:{},...P.file?{file:P.file,bytes:P.bytes,ms:P.ms}:{},...P.live!==void 0?{live:P.live}:{},...P.gen!==void 0?{gen:P.gen,closedAlive:P.closedAlive??[]}:{},...P.refused?{refused:P.refused}:{},...P.error?{error:P.error}:{}});return}const n=matchGatewayRoute(e);if(n?.prependPrefix&&!e.url?.startsWith(n.prependPrefix)&&(e.url=n.prependPrefix+(e.url??"/")),n?.target){applyGatewayMiddleware(e),_.web(e,r,{target:n.target,autoRewrite:typeof n.target=="string",changeOrigin:!0},i=>{console.error(`[parent] proxy error to ${n.target}:`,i),r.statusCode=502,r.setHeader("content-type","text/plain; charset=utf-8"),r.end(`Upstream error from ${n.target}.`)});return}if(SERVICE_PREFIX){if(!e.url?.startsWith(SERVICE_PREFIX)){r.writeHead(404,{"content-type":"text/plain; charset=utf-8"}),r.end(`Not found. This service is mounted at ${SERVICE_PREFIX}/`);return}e.url=e.url.slice(SERVICE_PREFIX.length)||"/"}applyGatewayMiddleware(e);const p=se();if(!p){r.statusCode=503,r.setHeader("content-type","text/plain; charset=utf-8");const i=v.map(o=>`#${o.id}: ${o.lastError??"no error recorded"}`).join(`
+  })()`),(0,bundle_parent_1.routeBundleRequires)(requested,resolved);const exports=eval(`require(${JSON.stringify(resolved)})`);try{const mod=eval("require.cache")[resolved];lastImportedModule=mod&&typeof mod=="object"?mod:void 0}catch{}return exports}h(importFresh,"importFresh"),i(importFresh,"importFresh");function debounce(l,f){let g=null;return(...E)=>{g&&clearTimeout(g),g=setTimeout(()=>l(...E),f)}}if(h(debounce,"debounce"),i(debounce,"debounce"),process.env.APP_RUNNER==="1"){(0,stdio_guard_1.guardBrokenStdio)();const l=i(g=>{if(!inspector.url())try{inspector.open(g,"127.0.0.1",!1)}catch(G){console.warn(`[child] inspector.open(${g}) failed (port taken by another devserver?) \u2014 falling back to a random port:`,G.message);try{inspector.open(0,"127.0.0.1",!1)}catch{}}const E=inspector.url();E&&tell(process,{type:"inspector-url",url:E})},"openInspector"),f=process.env.CHILD_DEBUG_PORT;if(f!==void 0&&f!==""){const g=Number(f);Number.isInteger(g)&&(g===0||g>1024)&&l(g)}try{require("@lensmcp/node-instrumentation/register")}catch{}(async()=>{let g=null,E=!1,G,ee=!1;const He=(0,hot_swap_registries_1.registryPruningEnabled)(),pe=i((t,n)=>{const d=(0,hot_swap_registries_1.describePrune)(t,n);d&&console.log(d)},"logPrune");let q={app:null,handler:i((t,n)=>{n.statusCode=503,n.end("starting")},"handler"),inflight:0};const ue=(()=>{const t=Number(process.env.LENSMCP_SWAP_DRAIN_MS);return Number.isFinite(t)&&t>=0?t:15*6e4})(),T=i(t=>{const n=globalThis.__lensmcpActiveWork;if(typeof n!="function")return{count:0};try{const d=n(t);return{count:Number(d?.count??0),...d?.oldestStartedAt?{oldestStartedAt:d.oldestStartedAt}:{}}}catch{return{count:0}}},"activeWork"),Pe=i(t=>{const n=globalThis.__lensmcpStopWorkIntake;if(typeof n=="function")try{return n(t)}catch{return}},"stopWorkIntake"),he=i(t=>{const n=globalThis.__lensmcpWorkIntakeReport;if(!(t===void 0||typeof n!="function"))try{return n(t)??void 0}catch{return}},"workIntakeReport"),Se=(()=>{const t=Number(process.env.LENSMCP_SWAP_MAX_DRAINING);return Number.isFinite(t)&&t>=1?Math.floor(t):1})(),L=new Set,Q=(()=>{const t=Number(process.env.LENSMCP_SWAP_EARLY_CLOSE_GRACE_MS);return process.env.LENSMCP_SWAP_EARLY_CLOSE_GRACE_MS!==void 0&&process.env.LENSMCP_SWAP_EARLY_CLOSE_GRACE_MS!==""&&Number.isFinite(t)&&t>=0?t:3e4})(),Y=i(t=>{if(!t.abandoned?.size)return 0;const n=Date.now();for(const[d,u]of t.abandoned)(d.writableEnded||n-u>=Q)&&t.abandoned.delete(d);return t.abandoned.size},"abandonedRunning"),te=i(t=>{let n=0;for(const d of t.open??[])d.headersSent||(n+=1);return{unanswered:n+Y(t),streams:Math.max(0,t.inflight-n),work:T(t.workGen).count}},"owedBy"),re=i((t,n,d=`${n}s`)=>`${t} ${t===1?n:d}`,"plural");async function xe(){if(Q<=0)return;const t=Date.now();let n=!1;for(;!(L.size<Se);){const d=L.values().next().value;if(!d||d.closed)break;const u=te(d);if(u.unanswered===0&&u.work===0)break;const y=(d.drainingSince??t)+Q-Date.now();if(y<=0)break;n||(n=!0,console.log(`[child] swap held \u2014 the app replaced ${Math.round((Date.now()-(d.drainingSince??t))/100)/10}s ago is still `+[u.unanswered?`answering ${re(u.unanswered,"request")}`:"",u.work?`running ${re(u.work,"background job")}`:""].filter(Boolean).join(" and ")+`, and this pod keeps at most ${Se} replaced app(s) alive (LENSMCP_SWAP_MAX_DRAINING). The new build is applied when it is done \u2014 in ${Math.ceil(y/1e3)}s at the latest (LENSMCP_SWAP_EARLY_CLOSE_GRACE_MS).`)),await new Promise(m=>{setTimeout(m,Math.min(100,y)).unref?.()})}n&&console.log(`[child] swap resumed after ${Date.now()-t}ms`)}h(xe,"Le"),i(xe,"holdForOwedWork");const R=(0,swap_recycle_1.swapRecyclePolicy)();let fe,oe=0;const qe=(()=>{const t=Number(process.env.LENSMCP_POD_RETIRE_NOTICE_MS);return Number.isFinite(t)&&t>=0?t:3500})();let _=!1,b=!1;const S=(0,pod_memory_1.podMemoryPolicy)();let B=0;const O=new Set;let _e=!1;const H=i(()=>{if(!_e)return;let t=0;for(const n of O)n.deref()===void 0?O.delete(n):t+=1;return t},"liveContainers"),k=(0,pod_memory_1.createPodMemoryMonitor)({policy:S,state:i(()=>({gen:q.gen??0,swaps:oe,...fe===void 0?{}:{baseline:fe},busy:E||ee||K.size>0,lastBusyAt:I}),"state"),send:i(t=>{tell(process,t)},"send"),containers:H,counter:(0,pod_memory_1.createLiveObjectCounter)(path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.join(__dirname,BUNDLE_PATH)),onRetained:i(()=>Ne(),"onRetained"),gc:i(()=>(0,gc_notice_1.withGcNotice)($,pod_memory_1.fullGc),"gc")}),W=i(()=>((0,gc_notice_1.withGcNotice)($,pod_memory_1.fullGc)&&k.tracker.noteGc(),process.memoryUsage().heapUsed),"liveHeap"),F=(()=>{if(!(0,error_stack_release_1.errorFrameReleaseEnabled)())return null;try{const t=path.dirname(path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.join(__dirname,BUNDLE_PATH))+path.sep,n=`${path.sep}node_modules${path.sep}`,d=new Set(Object.keys(require.cache));return(0,error_stack_release_1.createErrorFrameReleaser)(require.cache,{skip:i(u=>d.has(u)||u.startsWith(t)&&!u.slice(t.length).includes(n)&&!u.slice(t.length).startsWith(`node_modules${path.sep}`),"skip")})}catch{return null}})();let ne=!1;function Ae(){if(!(!F||ne))try{const t=F();t.errors>0&&console.log(`[child] read the stack of ${t.errors} Error object(s) that libraries created while loading and keep for good \u2014 unread, each held the functions that were on its stack, this bundle's included`)}catch(t){console.error("[child] could not release library error frames:",t),ne=!0}}h(Ae,"Me"),i(Ae,"releaseLibraryErrorFrames");const K=new Map;let I=Date.now();const Ge=i(()=>R.settleMs<=0||!E&&!ee&&K.size===0&&Date.now()-I>=R.settleMs,"settled");let j;function se(t){if(!(!R.enabled||_||b)){if(R.settleMs<=0){V(t);return}j&&clearTimeout(j),j=setTimeout(()=>{j=void 0,Ge()?V(t):se(t)},R.settleMs),j.unref?.()}}h(se,"de"),i(se,"recycleCheckWhenSettled");const ve=i(()=>{if(R.stuckCloseMs<=0)return 0;const t=Date.now();let n=0;for(const d of K.values())t-d>=R.stuckCloseMs&&(n+=1);return n},"stuckCloses");function V(t){if(!R.enabled||_||b||!process.send)return;const n=v8.getHeapStatistics().heap_size_limit,d=i(y=>{const m=k.oldestRetained();return{swaps:oe,usedBytes:y,limitBytes:n,stuckCloses:ve(),settled:Ge(),...fe===void 0?{}:{baselineBytes:fe},...m?{retained:{generation:m.gen,ageMs:Date.now()-m.closedAt,gcs:m.gcs}}:{}}},"state");if(!(0,swap_recycle_1.recycleReason)(R,d(process.memoryUsage().heapUsed)))return;const u=(0,swap_recycle_1.recycleReason)(R,d(W()));u&&(_=!0,console.log(`[child] asking for a fresh pod ${t} \u2014 ${u}. This pod keeps serving until its successor is ready. Size the bound with LENSMCP_SWAP_RECYCLE_HEAP_FACTOR / _HEAP_RATIO / _MIN_MB / _RETAINED_MS, or turn it off with LENSMCP_SWAP_RECYCLE=0.`),tell(process,{type:"recycle-request",reason:u}))}h(V,"z"),i(V,"considerRecycle");let ge;function Ne(){if(!R.enabled||R.retainedMs<=0||_||b)return;const t=k.oldestRetained();if(!t)return;const n=t.closedAt+R.retainedMs-Date.now();if(n<=0){V("with a closed generation still in memory");return}ge||(ge=setTimeout(()=>{ge=void 0,k.measure("retention-check").catch(()=>{})},n),ge.unref?.())}h(Ne,"Ue"),i(Ne,"retainedRecycleCheck");function ye(t,n){const d={};n&&(d.module=n),t&&(d.app=t);try{const u=t?.app;if(u&&typeof u=="object"&&(d.nestApp=u,u.container&&typeof u.container=="object")){d.container=u.container;const y=rootModuleOf(u.container);y&&(d.rootModule=y)}}catch{}return d}h(ye,"ve"),i(ye,"generationTargets");async function ie(t,n){if(t.closed||(t.closed=!0,L.delete(t),n&&console.error(`[child] ${n}`),!t.app))return;K.set(t,Date.now());const d=R.enabled&&R.stuckCloseMs>0?setTimeout(()=>{K.has(t)&&(console.error(`[child] a previous app has been closing for ${Math.round(R.stuckCloseMs/1e3)}s and its close() has not returned \u2014 one of its shutdown hooks is waiting on something that does not end (a queue worker, a connection, a stream). It stays in memory until this pod is replaced.`),V("with a previous app stuck in close()"))},R.stuckCloseMs):void 0;d?.unref?.();const u=t.app;try{await t.app.close()}catch(y){console.error("[child] error closing a previous app:",y)}finally{K.delete(t),I=Date.now(),d&&clearTimeout(d),t.app=null,t.abandoned=void 0,t.handler=(y,m)=>{m.statusCode=503,m.end("closed")},t.gen!==void 0&&k.closed(t.gen,oe,ye(u,t.module)),t.module=void 0}if(t.superseded){try{pe((0,hot_swap_registries_1.pruneRegistries)(t.superseded,"serve"),"after closing the previous app")}catch(y){console.error("[child] could not release the previous app's class registrations:",y)}t.superseded=void 0}se("after closing the previous app")}h(ie,"ye"),i(ie,"closeGeneration");async function ae(t){const n=Date.now();t.drainingSince=n;const d=i(()=>({inflight:t.inflight+Y(t),work:T(t.workGen).count}),"busy"),u=d();if(u.inflight>0||u.work>0){for(;L.size>=Se;){const M=L.values().next().value;if(!M)break;const N=te(M),J=Math.round((Date.now()-(M.drainingSince??n))/1e3);if(N.unanswered===0&&N.streams===0&&N.work===0){await ie(M);continue}await ie(M,`closing a still-draining generation early \u2014 ${L.size} were pending and the cap is ${Se} (each holds a whole app: DI container, DB pool, queue workers). `+(N.unanswered>0||N.work>0?`It was replaced ${J}s ago and had still not answered ${re(N.unanswered,"request")}`+(N.work?` or finished ${re(N.work,"background job")}`:"")+` \u2014 those fail now (a queue job keeps its lock until the TTL lapses). Raise LENSMCP_SWAP_EARLY_CLOSE_GRACE_MS (currently ${Q}ms) to wait longer for them. `:`It held only ${re(N.streams,"open stream")}; their clients reconnect to the new app. `)+"Raise LENSMCP_SWAP_MAX_DRAINING if this pod legitimately needs more.")}L.add(t)}for(;ue>0&&Date.now()-n<ue;){if(t.closed)return;const M=d();if(M.inflight===0&&M.work===0)break;await new Promise(N=>{setTimeout(N,250).unref?.()})}if(t.closed)return;const y=d(),m=he(t.workGen);y.inflight>0||y.work>0?console.error(`[child] swap drain expired after ${Date.now()-n}ms \u2014 closing the previous app with ${y.inflight} in-flight request(s) and ${y.work} background job(s) still running. `+(m?`Previous app still processing ${m.running} queue job(s); ${m.takenAfterStop} were taken after the swap. `:"")+`A queue job killed here keeps its lock until the TTL lapses. Raise LENSMCP_SWAP_DRAIN_MS (currently ${ue}ms) if this is legitimate work.`):(Date.now()-n>250||m?.runningAtStop||m?.takenAfterStop)&&console.log(`[child] previous app drained in ${Date.now()-n}ms \u2014 closing it`+(m?` (it finished ${m.finishedAfterStop} queue job(s) after the swap; ${m.takenAfterStop} were taken after the swap)`:"")),await ie(t)}h(ae,"ge"),i(ae,"drainThenClose");async function ce(){if(E)return ee=!0,console.log("[child] Reload deferred \u2014 will re-swap after current swap completes"),g;E=!0,I=Date.now(),await xe(),process.removeAllListeners("uncaughtException"),process.removeAllListeners("unhandledRejection"),process.on("uncaughtException",(P,Z)=>{console.error(`[child] uncaughtException (${Z}):`,P)}),process.on("unhandledRejection",P=>{const Z=P instanceof Error?P.stack||P.message:String(P);Z.includes("FronteggContextScope")||Z.includes("populateLoggerMetadata")||console.error("[child] unhandledRejection:",P)});let t;if(He)try{t=(0,hot_swap_registries_1.captureRegistries)()}catch{t=void 0}const n=global.__lensmcpBeginWorkGeneration,d=typeof n=="function"?n():void 0;try{try{await importFresh(BUNDLE_PATH)}catch(P){if(!(P instanceof SyntaxError))throw P;console.warn(`[child] bundle was unreadable mid-write (${P.message}) \u2014 retrying the swap once`),await new Promise(Z=>setTimeout(Z,400)),await importFresh(BUNDLE_PATH)}}catch(P){throw E=!1,I=Date.now(),P}if(typeof global.createChildApp!="function")throw E=!1,I=Date.now(),new Error(`Bundle '${BUNDLE_PATH}' does not export createChildApp() and the zero-touch bridge is not active. Either install @lensmcp/node-instrumentation (a plain NestFactory.create + app.listen main.ts then just works) or set global.createChildApp in main.ts when DEVSERVER_MODE === '1'.`);let u;if(t)try{u=(0,hot_swap_registries_1.supersededSince)(t),pe((0,hot_swap_registries_1.pruneRegistries)(u,"build"),"at the swap")}catch(P){console.error("[child] could not release superseded class registrations:",P)}let y;try{y=await global.createChildApp()}catch(P){throw E=!1,I=Date.now(),takeImportedModule(),P}const m=q;u?.size&&(m.app?m.superseded=u:pe((0,hot_swap_registries_1.pruneRegistries)(u,"serve"),"at the swap")),g=y;const M=takeImportedModule();q={app:y,handler:y.handler,inflight:0,gen:++B,...M?{module:M}:{},...d===void 0?{}:{workGen:d}};const N=ye(y,void 0).container;N&&(O.add(new WeakRef(N)),_e=!0);const J=m.app&&d!==void 0?Pe(d):void 0;return console.log("[child] Swapped to fresh app (previous draining in background)"+(J?.workers?`; its ${J.workers} queue worker(s) stopped taking new jobs, previous app still processing ${J.runningAtStop} job(s)`:"")),Ae(),m.app&&(oe+=1,ae(m).catch(P=>console.error("[child] background close error:",P)),setTimeout(()=>V("30s after a hot swap"),3e4).unref?.(),k.swapped(m.gen,()=>m.closed===!0&&!K.has(m))),E=!1,I=Date.now(),ee?(ee=!1,ce()):y}h(ce,"we"),i(ce,"swapNow");const be=debounce(async()=>{try{console.log("[child] /webpack/reload"),await ce()}catch(t){console.error("[child] reload failed:",t)}},250),me=http.createServer((t,n)=>{if(t.method==="POST"&&t.url==="/webpack/reload"){n.writeHead(200,{"content-type":"application/json"}),n.end(JSON.stringify({ok:!0})),be();return}if(t.method==="GET"&&t.url==="/__lensmcp/alive"){const u=t.headers["x-internal-token"],y=process.env.LENSMCP_SERVICE_KEY;if(y&&u!==y){n.writeHead(404,{"content-type":"text/plain"}),n.end("not found");return}const m=T();n.writeHead(200,{"content-type":"application/json","cache-control":"no-store"}),n.end(JSON.stringify({ok:!0,pid:process.pid,swapping:E,inflight:q.inflight,oldestInflightAt:q.oldestAt,activeWork:m.count,oldestWorkAt:m.oldestStartedAt,keyFingerprint:serviceKeyFingerprint(),...G?{watcher:G}:{},...Number.isFinite(Number(process.env.LENSMCP_POD_GENERATION))&&process.env.LENSMCP_POD_GENERATION?{podGeneration:Number(process.env.LENSMCP_POD_GENERATION)}:{}}));return}const d=q;d.inflight+=1,(d.open??=new Set).add(n),d.oldestAt===void 0&&(d.oldestAt=Date.now()),n.on("close",()=>{d.inflight-=1,d.open?.delete(n),Q>0&&!d.closed&&!n.headersSent&&!n.writableEnded&&((d.abandoned??=new Map).set(n,Date.now()),d.abandoned.size>256&&Y(d)),d.inflight===0&&(d.oldestAt=void 0),k.activity()}),d.handler(t,n)});me.keepAliveTimeout=0;const $=process.env.CHILD_SOCK_PATH;process.on("disconnect",()=>{cleanupSock($),process.exit(0)});try{const t=path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.join(__dirname,BUNDLE_PATH);if((0,schema_first_instance_1.schemaPrewarmEnabled)())try{const n=(0,schema_first_instance_1.prewarmZodFor)(t);n?.created&&console.log(`[child] zod${n.version?` ${n.version}`:""}: built ${n.created} throwaway schemas first, so none of the bundle's own is the first of its class`)}catch{}if((0,redis_disconnect_fix_1.redisDisconnectFixEnabled)())try{const n=(0,redis_disconnect_fix_1.finishStrandedDisconnectsFor)(t);n?.patched&&console.log(`[child] ioredis${n.versions.length?` ${n.versions.join(", ")}`:""}: a disconnect() between reconnect attempts now ends the client \u2014 it used to leave a queue worker's close() waiting for good`)}catch{}await ce(),fe=(await k.booted()).live,console.log(`[child] Using bundle: ${t}`),claimSock($),me.listen($,()=>{console.log(`[child] Listening on ${$}`),tell(process,{type:"ready",socketPath:$})})}catch(t){console.error("[child] Startup error:",t),tell(process,{type:"boot-error",error:String(t?.stack||t)}),process.exitCode=1;return}process.on("message",async t=>{if(!(!t||typeof t!="object")){if(t.type==="debug-open"){const n=Number(t.port);l(Number.isInteger(n)&&n>1024?n:0);return}if(t.type==="watcher"){const n=t.testimony;n&&typeof n=="object"&&(G=n);return}if(t.type==="heap-snapshot"){Re(t);return}if(t.type==="recycle-declined"){_=!1;return}if(t.type==="retire"){U();return}if(t.type==="reload"){if(b)return;try{const n=Date.now();await ce(),tell(process,{type:"reloaded",socketPath:$,swap:{generation:B,swaps:oe,swapMs:Date.now()-n,draining:L.size}})}catch(n){console.error("[child] reload error:",n),tell(process,{type:"reload-error",error:String(n?.stack||n)})}}}});let we=!1;async function Re(t){const n=i(d=>{tell(process,{type:"heap-snapshot-result",id:t.id,...d})},"reply");if(we)return n({ok:!1,refused:"a snapshot of this pod is already being written"});we=!0;try{const d=W(),u=k.tracker.views().map(N=>N.gen),y=(0,heap_snapshot_1.heapSnapshotPolicy)();t.maxHeapBytes&&(y.maxHeapBytes=t.maxHeapBytes);const m=(0,heap_snapshot_1.heapSnapshotRefusal)(y,{live:d,...t.available?{available:t.available}:{}});if(m)return n({ok:!1,refused:m,live:d});console.log(`[child] writing a heap snapshot (${Math.round(d/1048576)} MB live) \u2014 the pod pauses while V8 serialises it`);const M=await(0,heap_snapshot_1.writeHeapSnapshot)(t.file);n({ok:!0,file:t.file,bytes:M.bytes,ms:M.ms,live:d,gen:q.gen??0,closedAlive:u})}catch(d){n({ok:!1,error:d?.message??String(d)})}finally{we=!1}}h(Re,"Fe"),i(Re,"takeHeapSnapshot");async function U(t="a fresh pod has taken over"){if(b)return;b=!0,k.stop(),console.log(`[child] retiring \u2014 ${t}; ${path.basename($,".sock")} (pid ${process.pid}) is finishing in-flight work, then exiting`);const n=Pe(Number.POSITIVE_INFINITY);n?.workers&&console.log(`[child] its ${n.workers} queue worker(s) stopped taking new jobs, still processing ${n.runningAtStop} job(s)`);try{fs.writeFileSync(sockRetiringPath($),String(process.pid),{flag:"w",mode:384})}catch{}await new Promise(u=>{setTimeout(u,qe).unref?.()}),cleanupSock($),me.close();const d=Date.now();for(;Date.now()-d<ue;){me.closeIdleConnections?.();let u=0;for(const y of L)u+=te(y).unanswered;if(q.inflight+Y(q)===0&&u===0&&T().count===0)break;await new Promise(y=>{setTimeout(y,250).unref?.()})}setTimeout(()=>process.exit(0),3e4).unref?.();try{await g?.close()}catch(u){console.error("[child] close error while retiring:",u)}process.exit(0)}h(U,"U"),i(U,"retire"),process.on("beforeExit",()=>{try{inspector?.close?.()}catch{}});const le=i(async t=>{console.log(`[child ${t}] shutting down\u2026`);const n=g?.close().catch(u=>console.error("[child] close error:",u)),d=new Promise(u=>me.close(()=>u()));cleanupSock($),setTimeout(()=>process.exit(0),700).unref(),await Promise.all([n,d]),process.exit(0)},"shutdown");["SIGINT","SIGTERM","SIGHUP","SIGQUIT","SIGUSR2"].forEach(t=>{process.on(t,()=>{if(t==="SIGTERM"&&!b&&(0,handoff_retire_1.handoffRetireRequested)(SOCK_DIR,POD_GENERATION)){U("this generation was handed over to a newer one");return}inspector?.close?.(),le(t)})})})()}else{let l=h(function(_){Y.push(_),Y.length>Q&&Y.splice(0,Y.length-Q),Se?.write((0,inspector_secret_1.redactInspectorUrls)(_.replace(L,"")));for(const b of te)try{const S=b.plain?_.replace(L,""):_;b.res.write(b.redact?(0,inspector_secret_1.redactInspectorUrls)(S):S)}catch{te.delete(b)}},"fe");i(l,"emitLogLine");const f=12,g=process.env.LENSMCP_PROJECT||SERVICE_NAME||"service",E=(0,pod_memory_events_1.createPodMemoryPublisher)(process.env.LENSMCP_EVENT_FILE),G=i(_=>({project:g,service:SERVICE_NAME||g,pod:_.id,pid:_.proc.pid??0,podGeneration:POD_GENERATION}),"podIdentity"),ee=["\x1B[36m","\x1B[33m","\x1B[35m","\x1B[32m","\x1B[34m","\x1B[31m"],He="\x1B[0m",pe=Math.max(1,Number(process.env.CHILD_COUNT||1)),q=LENSMCP_WS_KEY||path.basename(process.cwd()),ue=i(_=>(0,process_name_1.namedExecPath)((0,process_name_1.processName)(q,SERVICE_NAME||"service",_)),"execPathFor");let T=(()=>{const _=Number(process.env.LENSMCP_DEBUG_PORT||"");return Number.isInteger(_)&&_>1024?_:0})();const Pe=20;T&&(console.warn("[parent] DEBUGGER ENABLED \u2014 pods and workers open a Node inspector. Node's inspector has NO authentication: the ws:// URL's UUID is the whole credential, and any account on this host that obtains it can run code as you. Do not enable this on a shared machine. (issues/closed/codex-security-06)"),console.warn(usesFixedInspectorPorts()?`[parent] ${exports.DEBUG_FIXED_PORTS_ENV} is set \u2014 inspectors bind PREDICTABLE ports (${T}+slot, workers ${T}+${Pe}+i). Any account on this host can connect to 127.0.0.1:${T} and read the session UUID from /json/list. Unset it to use ephemeral ports.`:`[parent] Inspectors bind an EPHEMERAL loopback port; attach via the printed "Debugger listening" URL, or \`lensmcp debug <service>\` (control socket). Set ${exports.DEBUG_FIXED_PORTS_ENV}=1 for fixed ports if your IDE needs a pre-configured attach port \u2014 any account on this host can then reach them.`));const he=process.env.LENSMCP_LOG_FILE||"",Se=he?(()=>{try{fs.mkdirSync(path.dirname(he),{recursive:!0});const _=fs.createWriteStream(he,{flags:"a",mode:384});try{fs.chmodSync(he,384)}catch{}return _}catch(_){return console.warn(`[parent] cannot open log file ${he}:`,_.message),null}})():null,L=/\x1b\[[0-9;]*m/g,Q=2e3,Y=[],te=new Set,re=(0,devserver_transport_1.gatewayManaged)();for(const _ of["log","info","warn","error"]){const b=console[_].bind(console),S=_==="log"||_==="info"?process.stdout:process.stderr;console[_]=(...B)=>{b(...B.map(O=>typeof O=="string"?(0,inspector_secret_1.forStream)(S,re,O):O)),l(B.map(O=>typeof O=="string"?O:util.inspect(O)).join(" ")+`
+`)}}const xe=i(_=>ee[(_-1)%ee.length],"colorFor"),R=i(_=>{if(pe===1)return"";const b=`[child#${_}] `;return`${xe(_)}${b}${He}`},"tagFor"),fe=i(_=>_.startsWith("{")&&_.endsWith("}"),"isJsonLog"),oe=i((_,b,S)=>{const B=prettyFactory({sync:!0,colorize:!0,crlf:!0,messageKey:"message",errorLikeObjectKeys:["err","error"],errorProps:"type,message,stack",ignore:["logContext","context","hostname","req","res","err.driverError","module","cloudEnvironment","frontegg-application-id","frontegg-tenant-id","frontegg-trace-id","frontegg-vendor-id","host","service","version","err","error"].join(","),messageFormat:"{if module}[{module}] {end}{if context}[{context}] {end}{if logContext}[{logContext}] {end}{message}",customPrettifiers:{stack:i(H=>`
+`+String(H),"stack")}}),O=i((H,k)=>{const W=H==="stdout"?process.stdout:process.stderr;try{S?.(k)}catch{}const F=fe(k)?B(k):`${k}
+`;W.write((0,inspector_secret_1.forStream)(W,re,`${b}${F}`)),l(`${b}${F}`)},"write"),_e=i((H,k)=>{if(!H)return;const W=readline.createInterface({input:H});W.on("line",F=>O(k,F)),W.on("close",()=>{})},"attach");_e(_.stdout,"stdout"),_e(_.stderr,"stderr")},"wireProcLogging"),qe=i(_=>oe(_.proc,R(_.id),b=>_.tail.push(b)),"wireChildLogging");(async()=>{ensureOwnerOnlyDir(SOCK_DIR);const _=httpProxy.createProxyServer({});let b=Number(process.env.PORT)||0;b||(b=9090);const S=[],B=new Set;function O(){let e=0;for(;B.has(e);)e++;return B.add(e),e}h(O,"$"),i(O,"allocDebugSlot");let _e=1,H=0,k=!1,W=pe,F=[],ne=0;const Ae=(0,swap_mode_1.swapMode)(),K=(()=>{const e=Number(process.env.LENSMCP_POD_BOOT_GRACE_MS);return Number.isFinite(e)&&e>=0?e:12e4})(),I=i(e=>e.proc.exitCode!==null||e.proc.signalCode!==null,"childExited"),Ge=i(e=>e.booting&&!I(e)&&Date.now()-e.spawnedAt<K,"stillBooting");function j(){return S.filter(e=>e.healthy&&typeof e.socketPath=="string")}h(j,"K"),i(j,"healthyChildren");let se,ve=0,V;const ge={project:g,service:SERVICE_NAME||g,podGeneration:POD_GENERATION};function Ne(e){const r=(0,service_build_events_1.buildAccountOf)(e.building);r&&r.startedAt!==ve&&(ve=r.startedAt,E.publish((0,service_build_events_1.buildServiceBuildEvent)(ge,"started",r,{root:process.cwd()})));const s=(0,service_build_events_1.buildAccountOf)(e.failed);s&&(ve=0,E.publish((0,service_build_events_1.buildServiceBuildEvent)(ge,"failed",s,{root:process.cwd()})))}h(Ne,"Ue"),i(Ne,"recordBuildProgress");function ye(e){if(!e||typeof e!="object")return;const r=e;if(r.schemaVersion===1){Ne(r),"failed"in r&&delete r.failed,se=r;for(const s of S)tell(s.proc,{type:"watcher",testimony:r})}}h(ye,"ve"),i(ye,"recordWatcherTestimony");function ie(e,r=256*1024){return new Promise(s=>{let c="",a=!1;e.on("data",o=>{a||(c+=o,c.length>r&&(a=!0))}),e.on("end",()=>{if(a||!c)return s(void 0);try{s(JSON.parse(c))}catch{s(void 0)}}),e.on("error",()=>s(void 0))})}h(ie,"ye"),i(ie,"readJsonBody");function ae(){const e=j();if(e.length===0)return null;const r=H%e.length;return H=(H+1)%e.length,e[r]}h(ae,"ge"),i(ae,"pickChild");function ce(e,r){const s=`Child#${e.id}`,c=SERVICE_NAME||g,a=Date.now();if(r.type==="pod-memory"){const o=r.report;if(!o||typeof o.live!="number")return;e.memory.latest=o,e.memory.history.push(o),e.memory.history.length>12&&e.memory.history.splice(0,e.memory.history.length-12),console.log(`[parent] ${(0,pod_memory_1.describePodMemory)(s,o)}`),E.publish((0,pod_memory_events_1.buildPodMemoryEvent)(G(e),o))}else if(r.type==="pod-memory-retained"){const o=r.retained;if(!o||typeof o.gen!="number")return;e.memory.retained.set(o.gen,{...o,at:a}),console.warn(`[parent] ${(0,pod_memory_1.describeRetained)(s,c,o)}`),E.publish((0,pod_memory_events_1.buildPodRetainedEvent)(G(e),o,a))}else{const o=r.released;if(!o||typeof o.gen!="number")return;e.memory.retained.delete(o.gen),console.log(`[parent] ${(0,pod_memory_1.describeReleased)(s,c,o)}`),E.publish((0,pod_memory_events_1.buildPodReleasedEvent)(G(e),o,a))}}h(ce,"we"),i(ce,"recordPodMemory");const be=new Map;let me=0;async function $(){const e=_e++,r=childSockPath(e);cleanupSock(r);const s=(0,dev_devtool_1.sourceMapExecArgv)();__filename.endsWith(".ts")&&s.unshift("--require","@swc-node/register"),s.push(...(0,inspector_secret_1.inspectorPublishExecArgv)(usesFixedInspectorPorts()));const c=T?O():-1,a=(0,node_child_process_1.fork)(__filename,{env:{...process.env,APP_RUNNER:"1",CHILD_SOCK_PATH:r,...c>=0&&{CHILD_DEBUG_PORT:String(inspectorPortFor(T,c))}},stdio:["inherit","pipe","pipe","ipc"],execArgv:s,execPath:ue("pod")}),o={id:e,proc:a,healthy:!1,lastError:null,debugSlot:c,tail:new exit_reason_1.TailBuffer,booting:!0,spawnedAt:Date.now(),bootReloadSeq:ne,memory:{history:[],retained:new Map}};return a.on("error",v=>console.error(`[parent] Child#${e}: ${v.message}`)),a.on("message",v=>{if(!v||typeof v!="object")return;const p=v;if(p.type==="ready")o.socketPath=String(p.socketPath),o.healthy=!0,o.booting=!1,console.log(`[parent] Child#${o.id} ready on socket ${o.socketPath}`),se&&tell(a,{type:"watcher",testimony:se}),ne!==o.bootReloadSeq&&(Ae==="process"?P():tell(a,{type:"reload"}));else if(p.type==="recycle-request")m(o,String(p.reason||"it has outgrown its bound"));else if(p.type==="inspector-url")o.inspectorUrl=String(p.url),console.log(`[parent] Child#${o.id} Debugger listening on ${p.url}`);else if(p.type==="reloaded"){if(U.has(o)){console.log(`[parent] Child#${o.id} finished a swap it began before it was retired \u2014 not serving it: a fresh pod has taken over`);return}o.socketPath=String(p.socketPath),o.healthy=!0,console.log(`[parent] Child#${o.id} hot-swapped on socket ${o.socketPath}`);const w=p.swap;w&&typeof w.generation=="number"&&typeof w.swaps=="number"&&E.publish((0,service_build_events_1.buildServiceSwapEvent)(G(o),{generation:w.generation,swaps:w.swaps,swapMs:typeof w.swapMs=="number"?w.swapMs:0,draining:typeof w.draining=="number"?w.draining:0},V,{root:process.cwd()}))}else p.type==="reload-error"?(o.lastError=String(p.error||"unknown reload error"),console.error(`[parent] Child#${o.id} reload error: ${o.lastError}`),o.healthy=!1):p.type==="boot-error"?(o.lastError=String(p.error||"unknown boot error"),console.error(`[parent] Child#${o.id} boot error: ${o.lastError}`),o.healthy=!1,o.booting=!1):p.type==="pod-memory"||p.type==="pod-memory-retained"||p.type==="pod-memory-released"?ce(o,p):p.type==="heap-snapshot-result"&&be.get(Number(p.id))?.(p)}),a.on("exit",(v,p)=>{o.booting=!1;for(const C of o.memory.retained.values()){const D={gen:C.gen,closedAt:C.closedAt,ageMs:Date.now()-C.closedAt,reason:"pod-exited"};console.log(`[parent] ${(0,pod_memory_1.describeReleased)(`Child#${o.id}`,SERVICE_NAME||g,D)}`),E.publish((0,pod_memory_events_1.buildPodReleasedEvent)(G(o),D,Date.now()))}o.memory.retained.clear(),o.memory.latest&&E.publish((0,pod_memory_events_1.buildPodExitedEvent)(G(o),{code:v,signal:p},Date.now())),o.debugSlot>=0&&(B.delete(o.debugSlot),o.debugSlot=-1);const w=p==="SIGINT"||p==="SIGTERM"||v===0;if(w?console.log(`[parent] Child#${o.id} exited cleanly (code=${v}, signal=${p??"none"})`):(console.error((0,exit_reason_1.crashReport)(`[parent] Child#${o.id} crashed (code=${v}, signal=${p??"none"}, pid=${o.proc.pid}, ${o.healthy?"was serving":"was not ready"})`,v,p,o.tail.snapshot())),o.lastError||(o.lastError=`Child exited abnormally (code=${v}, signal=${p??"none"})`)),o.healthy=!1,cleanupSock(o.socketPath,o.proc.pid),o.socketPath=void 0,!w&&!k){const C=S.indexOf(o);C>=0&&S.splice(C,1);const D=Date.now();if(F=F.filter(z=>D-z<3e4),F.length>=5){console.error(`[parent] crash-loop detected (${F.length} respawns/30s) \u2014 pausing auto-respawn; POST /webpack/reload to retry`);return}F.push(D),setTimeout(()=>{const z=S.filter(Ie=>Ie.proc.killed===!1).length;!k&&z<W&&(console.log(`[parent] respawning a crashed pod (${z}/${W} live)`),$().catch(()=>{}))},1500).unref?.()}}),S.push(o),qe(o),o}h($,"I"),i($,"spawnChild");async function we(e){W=Math.max(W,e);const r=S.filter(c=>c.proc.killed===!1),s=e-r.length;for(let c=0;c<s;c++)await $()}h(we,"Ee"),i(we,"ensurePoolSize");async function Re(){const e=S.filter(r=>(!r.healthy||typeof r.socketPath!="string")&&!Ge(r));await Promise.all(e.map(async r=>{try{r.proc.kill("SIGTERM")}catch{}cleanupSock(r.socketPath,r.proc.pid),r.socketPath=void 0;const s=S.indexOf(r);s>=0&&S.splice(s,1),await $()}))}h(Re,"Fe"),i(Re,"respawnUnhealthy");const U=new Set;let le=!1,t=0;const n=3e4,d=(()=>{const e=Number(process.env.LENSMCP_SWAP_DRAIN_MS);return(Number.isFinite(e)&&e>=0?e:15*6e4)+6e4})();async function u(e,r={}){const s=Date.now(),c=await $(),a=Date.now()+K;for(;!c.healthy&&!c.lastError&&!I(c)&&Date.now()<a;){if(r.superseded?.()){const o=S.indexOf(c);o>=0&&S.splice(o,1);try{c.proc.kill("SIGTERM")}catch{}return{why:`a newer build landed while Child#${c.id} booted`,superseded:!0}}await new Promise(o=>{setTimeout(o,100).unref?.()})}if(k)return{why:"shutting down"};if(!c.healthy){const o=S.indexOf(c);o>=0&&S.splice(o,1);try{c.proc.kill("SIGTERM")}catch{}return{why:`its successor Child#${c.id} did not come up (${c.lastError??"no answer in time"})`}}return y(e),{fresh:c,readyMs:Date.now()-s}}h(u,"_"),i(u,"replacePod");function y(e){const r=S.indexOf(e);if(r>=0&&S.splice(r,1),e.healthy=!1,I(e))return;U.add(e),postRetiringNotice(e.socketPath,e.proc.pid);const s=setTimeout(()=>{if(!I(e)){console.error(`[parent] Child#${e.id} was still running ${d}ms after it was retired \u2014 killing it`);try{e.proc.kill("SIGKILL")}catch{}}},d);if(s.unref?.(),e.proc.once("exit",()=>{clearTimeout(s),U.delete(e)}),!tell(e.proc,{type:"retire"}))try{e.proc.kill("SIGTERM")}catch{}}h(y,"y"),i(y,"retirePod");async function m(e,r){const s=i(a=>{console.log(`[parent] Child#${e.id} asked for a fresh pod (${r}) \u2014 not now: ${a}`),tell(e.proc,{type:"recycle-declined"})},"decline");if(k||!S.includes(e))return;if(le)return s("another pod is already being replaced");const c=Date.now()-t;if(c<n)return s(`a pod was replaced ${Math.round(c/1e3)}s ago`);le=!0,console.log(`[parent] Child#${e.id} asked for a fresh pod \u2014 ${r}. Starting one; Child#${e.id} keeps serving until it is ready.`);try{const a=await u(e);if("why"in a){a.why!=="shutting down"&&s(a.why);return}t=Date.now(),console.log(`[parent] Child#${a.fresh.id} took over from Child#${e.id} (pid ${e.proc.pid} \u2192 ${a.fresh.proc.pid})`)}catch(a){s(`could not start a successor: ${a?.message??String(a)}`)}finally{le=!1}}h(m,"g"),i(m,"recyclePod");let M,N=!1,J=0;function P(){if(M){N=!0;return}M=(async()=>{do{N=!1;const e=ne;for(;le&&!k;)await new Promise(s=>{setTimeout(s,100).unref?.()});let r=!1;for(const s of j().filter(c=>c.bootReloadSeq<e)){if(k)break;if(!(!S.includes(s)||!s.healthy)){le=!0;try{Z(),console.log(`[parent] A new build \u2014 starting a fresh pod for it; Child#${s.id} keeps serving the previous build until it is ready.`);const c=await u(s,{superseded:i(()=>ne!==e&&(0,swap_mode_1.abandonSuperseded)(J),"superseded")});if("why"in c){if(c.superseded){J+=1,console.log(`[parent] ${c.why} \u2014 abandoned; one fresh pod for the newest build instead (${J} in a row). Child#${s.id} keeps serving.`),r=!0;break}c.why!=="shutting down"&&console.error(`[parent] Child#${s.id} keeps serving the previous build \u2014 ${c.why}`);continue}J=0,console.log(`[parent] Child#${c.fresh.id} took over from Child#${s.id} with the new build (pid ${s.proc.pid} \u2192 ${c.fresh.proc.pid}, ready in ${(c.readyMs/1e3).toFixed(1)}s while Child#${s.id} served)`),E.publish((0,service_build_events_1.buildServiceSwapEvent)(G(c.fresh),{generation:1,swaps:0,swapMs:c.readyMs,draining:U.size,handoff:{fromPid:s.proc.pid??0}},V,{root:process.cwd()}))}catch(c){console.error(`[parent] Child#${s.id} keeps serving the previous build \u2014 could not start a successor: ${c?.message??String(c)}`)}finally{le=!1}}}r&&(N=!0)}while(N&&!k)})().finally(()=>{M=void 0})}h(P,"R"),i(P,"handoffForReload");function Z(){const e=(0,swap_mode_1.maxRetiring)(),r=[...U].filter(s=>!I(s));for(;r.length>=e;){const s=r.shift();console.error(`[parent] Child#${s.id} (pid ${s.proc.pid}) was still finishing its work when a newer build replaced its successor too \u2014 stopping it (LENSMCP_SWAP_MAX_RETIRING=${e})`);try{s.proc.kill("SIGTERM")}catch{}}}h(Z,"V"),i(Z,"capRetiring");const X=[];function Be(e){const r=path.dirname(path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.resolve(BUNDLE_PATH)),s=path.join(r,`${e}.js`);if(!fs.existsSync(s))return console.error(`[parent] Worker "${e}" bundle not found: ${s}`),null;const c=(0,dev_devtool_1.sourceMapExecArgv)();__filename.endsWith(".ts")&&c.unshift("--require","@swc-node/register");try{c.push("--require",require.resolve("@lensmcp/node-instrumentation/register"))}catch{}const a=inspectorPortFor(T||9229,Pe+Math.max(0,WORKER_NAMES.indexOf(e)));c.push(T?`--inspect=127.0.0.1:${a}`:`--inspect-port=127.0.0.1:${a}`,...(0,inspector_secret_1.inspectorPublishExecArgv)(usesFixedInspectorPorts()));const o=(0,node_child_process_1.fork)(s,{env:process.env,stdio:["inherit","pipe","pipe","ipc"],execArgv:c,execPath:ue(`w-${e}`)}),v={name:e,proc:o,debugPort:a};return X.push(v),o.on("error",p=>console.error(`[parent] Worker "${e}": ${p.message}`)),oe(o,`\x1B[35m[worker:${e}] \x1B[0m`,p=>{const w=/Debugger listening on (wss?:\/\/\S+)/.exec(p);w&&(v.inspectorUrl=w[1])}),o.on("exit",(p,w)=>{w==="SIGINT"||w==="SIGTERM"||p===0||console.error(`[parent] Worker "${e}" crashed (code=${p}, signal=${w??"none"})`);const C=X.indexOf(v);C>=0&&X.splice(C,1)}),console.log(`[parent] Worker "${e}" started (pid=${o.pid})`),v}h(Be,"Ke"),i(Be,"spawnWorkerProcess");const Je=(()=>{const e=Number(process.env.LENSMCP_SWAP_DRAIN_MS);return Number.isFinite(e)&&e>=0?e:15*6e4})(),Xe=(()=>{const e=Number(process.env.LENSMCP_SWAP_MAX_DRAINING);return Number.isFinite(e)&&e>=1?Math.floor(e):1})(),Ee=new Set,je=i(e=>e.proc.exitCode!==null||e.proc.signalCode!==null,"workerExited");function Le(e,r){if(Ee.delete(e),!je(e)){console.error(`[parent] Worker "${e.name}" (pid=${e.proc.pid}) ${r} \u2014 killing it. A worker that returns from its SIGTERM handler but leaves a handle open (a Redis client handed to BullMQ is not closed by worker.close()) never exits on its own: close what it opened, or call process.exit().`);try{e.proc.kill("SIGKILL")}catch{}}}h(Le,"Be"),i(Le,"killDrainingWorker");function Ye(e){try{e.proc.kill("SIGTERM")}catch{}if(je(e))return;const r=[...Ee].filter(c=>c.name===e.name);for(;r.length>=Xe;)Le(r.shift(),`was still running when a later reload replaced its successor (cap ${Xe})`);Ee.add(e);const s=setTimeout(()=>Le(e,`was still running ${Je}ms after SIGTERM`),Je);s.unref?.(),e.proc.once("exit",()=>{clearTimeout(s),Ee.delete(e)})}h(Ye,"Xe"),i(Ye,"retireWorker");function ze(){for(const e of[...X])Ye(e);X.length=0;for(const e of WORKER_NAMES)Be(e)}h(ze,"tt"),i(ze,"restartWorkers");const nt=debounce(async()=>{ne+=1;const e=j();if(e.length>0)if(Ae==="process")P();else{console.log(`[parent] Forwarding reload to ${e.length} child(ren)`);for(const r of e)tell(r.proc,{type:"reload"})}await Re(),WORKER_NAMES.length>0&&ze()},200),Qe=i((e,r)=>{const s=(0,notice_generation_1.noticeGeneration)(e.headers);return s===void 0||s===POD_GENERATION?!1:(e.resume(),r.writeHead(409,{"content-type":"application/json"}),r.end(JSON.stringify({ok:!1,generation:POD_GENERATION,sentFor:s})),e.url==="/webpack/reload"&&console.log(`[parent] a build of generation g${s} reached generation g${POD_GENERATION} \u2014 not reloaded: it is not this generation's build`),!0)},"refusedForAnotherGeneration"),Te=i(async(e,r)=>{if(e.method==="POST"&&e.url==="/webpack/reload"){if(!(0,devserver_transport_1.mayDriveThePool)(e))return refusePoolCommand(e,r);if(Qe(e,r))return;r.writeHead(200,{"content-type":"application/json"}),r.end(JSON.stringify({ok:!0})),ie(e).then(a=>{const o=a;V=(0,service_build_events_1.buildAccountOf)(o?.build),ve=0,ye(o?.watcher)}),nt();return}if(e.method==="POST"&&e.url==="/webpack/watching"){if(!(0,devserver_transport_1.mayDriveThePool)(e))return refusePoolCommand(e,r);if(Qe(e,r))return;const a=await ie(e);ye(a),r.writeHead(200,{"content-type":"application/json"}),r.end(JSON.stringify({ok:!0,relayed:se!==void 0}));return}if(e.method==="POST"&&e.url==="/webpack/scale"){if(!(0,devserver_transport_1.mayDriveThePool)(e))return refusePoolCommand(e,r);let a="";e.on("data",o=>{a+=o}),e.on("end",async()=>{let o=0;try{o=Number(JSON.parse(a||"{}").pods)||0}catch{}o=Math.max(1,Math.min(o,16)),await we(o),r.writeHead(200,{"content-type":"application/json"}),r.end(JSON.stringify({ok:!0,pods:o}))});return}if(e.method==="GET"&&e.url?.startsWith("/webpack/logs")){const a=new URL(e.url,"http://localhost").searchParams,o=Math.min(Math.max(Number(a.get("tail")??"100")||0,0),Q),v=a.get("follow")!=="0",p=a.get("plain")==="1",w=!(0,devserver_transport_1.isOwnerOnlyTransport)(e);r.writeHead(200,{"content-type":"text/plain; charset=utf-8","cache-control":"no-cache"});const C=o===0?"":Y.slice(-o).join(""),D=p?C.replace(L,""):C;if(r.write(w?(0,inspector_secret_1.redactInspectorUrls)(D):D),!v){r.end();return}const z={res:r,plain:p,redact:w};te.add(z),e.on("close",()=>te.delete(z));return}if(e.method==="POST"&&e.url?.startsWith("/webpack/debug")){if(!(0,devserver_transport_1.isOwnerOnlyTransport)(e)){r.writeHead(404,{"content-type":"application/json"}),r.end(JSON.stringify({error:"not found"}));return}const a=Number(new URL(e.url,"http://localhost").searchParams.get("port")||"");Number.isInteger(a)&&a>1024&&(T=a),T||(T=9229);const o=S.filter(p=>p.proc.exitCode===null&&p.proc.signalCode===null);for(const p of o)p.debugSlot<0&&(p.debugSlot=O()),tell(p.proc,{type:"debug-open",port:inspectorPortFor(T,p.debugSlot)});for(const p of X)try{p.proc.kill("SIGUSR1")}catch{}const v=Date.now()+2e3;for(;Date.now()<v&&o.some(p=>!p.inspectorUrl);)await new Promise(p=>setTimeout(p,50));r.writeHead(200,{"content-type":"application/json"}),r.end(JSON.stringify({ok:!0,basePort:T,fixedPorts:usesFixedInspectorPorts(),pods:o.map(p=>({id:p.id,inspectorUrl:p.inspectorUrl??null})),workers:X.map(p=>({name:p.name,port:p.debugPort||(0,inspector_secret_1.inspectorPortOf)(p.inspectorUrl),inspectorUrl:p.inspectorUrl??null}))},null,2)+`
+`);return}if(e.method==="GET"&&e.url==="/webpack/memory"){if(!(0,devserver_transport_1.isOwnerOnlyTransport)(e)){r.writeHead(404,{"content-type":"application/json"}),r.end(JSON.stringify({error:"not found"}));return}const a=path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.resolve(BUNDLE_PATH),o=[...S,...U].map(v=>({id:v.id,pid:v.proc.pid??0,podGeneration:POD_GENERATION,healthy:v.healthy,retiring:U.has(v),latest:v.memory.latest??null,history:v.memory.history,retained:[...v.memory.retained.values()]}));r.writeHead(200,{"content-type":"application/json","cache-control":"no-store"}),r.end(JSON.stringify({ok:!0,service:SERVICE_NAME,project:g,bundle:{path:a},pods:o},null,2)+`
+`);return}if(e.method==="POST"&&e.url?.startsWith("/webpack/heap")){if(!(0,devserver_transport_1.isOwnerOnlyTransport)(e)){r.writeHead(404,{"content-type":"application/json"}),r.end(JSON.stringify({error:"not found"}));return}const a=i((x,De)=>{r.writeHead(x,{"content-type":"application/json"}),r.end(JSON.stringify(De,null,2)+`
+`)},"reply"),o=new URL(e.url,"http://localhost").searchParams,v=Number(o.get("pod")||""),p=o.has("maxMb")?Number(o.get("maxMb")):void 0;if(p!==void 0&&!(Number.isFinite(p)&&p>0)){a(400,{ok:!1,error:"maxMb takes a positive number of MB"});return}const w=Number.isInteger(v)&&v>0?S.find(x=>x.id===v):j()[0];if(!w||I(w)){a(404,{ok:!1,error:v?`no pod #${v} \u2014 running: ${S.map(x=>`#${x.id}`).join(", ")||"none"}`:"no pod is serving"});return}if(be.size>0){a(409,{ok:!1,refused:"a heap snapshot is already being written for this service"});return}const C=(0,heap_snapshot_1.heapSnapshotPolicy)(),D=(0,heap_snapshot_1.heapSnapshotDir)();let z;try{(0,heap_snapshot_1.ensureHeapDir)(D);const x=(0,heap_snapshot_1.pruneHeapSnapshots)(D,C);x.length&&console.log(`[parent] removed ${x.length} older heap snapshot(s) from ${D}`),z=path.join(D,(0,heap_snapshot_1.heapSnapshotFileName)(SERVICE_NAME||g,w.id,w.proc.pid??0,w.memory.latest?.gen??0,Date.now()))}catch(x){a(500,{ok:!1,error:`cannot prepare ${D}: ${x.message}`});return}const Ie=++me,Ue=(0,heap_snapshot_1.availableSystemMemory)();let Ce;const A=await new Promise(x=>{const De=setTimeout(()=>x(void 0),6e5);De.unref?.(),be.set(Ie,lt=>{clearTimeout(De),x(lt)}),Ce=i(()=>{clearTimeout(De),x(void 0)},"onExit"),w.proc.once("exit",Ce);const at={type:"heap-snapshot",id:Ie,file:z,...Ue?{available:Ue}:{},...p!==void 0?{maxHeapBytes:Math.floor(p*1048576)}:{}};tell(w.proc,at)||Ce()}).finally(()=>{be.delete(Ie),Ce&&w.proc.off("exit",Ce)});if(!A){a(504,{ok:!1,pod:w.id,error:"the pod did not finish the snapshot (it exited, or took longer than 10 minutes)"});return}A.ok?console.log(`[parent] Child#${w.id} wrote a ${Math.round((A.bytes??0)/1048576)} MB heap snapshot in ${A.ms} ms \u2192 ${A.file}`):console.warn(`[parent] Child#${w.id} heap snapshot not taken: ${A.refused??A.error}`),a(A.ok?200:A.refused?409:500,{ok:A.ok,pod:w.id,pid:w.proc.pid??0,service:SERVICE_NAME,bundle:path.isAbsolute(BUNDLE_PATH)?BUNDLE_PATH:path.resolve(BUNDLE_PATH),...Ue?{available:Ue}:{},...A.file?{file:A.file,bytes:A.bytes,ms:A.ms}:{},...A.live!==void 0?{live:A.live}:{},...A.gen!==void 0?{gen:A.gen,closedAlive:A.closedAlive??[]}:{},...A.refused?{refused:A.refused}:{},...A.error?{error:A.error}:{}});return}const s=matchGatewayRoute(e);if(s?.prependPrefix&&!e.url?.startsWith(s.prependPrefix)&&(e.url=s.prependPrefix+(e.url??"/")),s?.target){applyGatewayMiddleware(e),_.web(e,r,{target:s.target,autoRewrite:typeof s.target=="string",changeOrigin:!0},a=>{console.error(`[parent] proxy error to ${s.target}:`,a),r.statusCode=502,r.setHeader("content-type","text/plain; charset=utf-8"),r.end(`Upstream error from ${s.target}.`)});return}if(SERVICE_PREFIX){if(!e.url?.startsWith(SERVICE_PREFIX)){r.writeHead(404,{"content-type":"text/plain; charset=utf-8"}),r.end(`Not found. This service is mounted at ${SERVICE_PREFIX}/`);return}e.url=e.url.slice(SERVICE_PREFIX.length)||"/"}applyGatewayMiddleware(e);const c=ae();if(!c){r.statusCode=503,r.setHeader("content-type","text/plain; charset=utf-8");const a=S.map(o=>`#${o.id}: ${o.lastError??"no error recorded"}`).join(`
 `);r.end(`No healthy children available. POST /webpack/reload to recover.
 
 Last errors:
-${i}`);return}_.web(e,r,{target:{socketPath:p.socketPath},headers:{"x-proxy-child-id":String(p.id)}},i=>{console.error(`[parent] proxy error to Child#${p.id}:`,i),p.healthy=!1,p.lastError=String(i?.stack||i),r.statusCode=502,r.setHeader("content-type","text/plain; charset=utf-8"),r.end(`Upstream error from Child#${p.id}. Try /webpack/reload.
-${p.lastError}`)})},"requestHandler");let ce,Te,Ye;const $e=[];if(GATEWAY_HTTPS){const e=require("./basic-ssl"),r=GATEWAY_ROUTES.map(p=>p.host).filter(p=>!!p),n=(0,checkout_cache_1.checkoutCacheDir)(process.cwd(),"davnx-webpack");Te=e.getCertificateSync(n,SERVICE_NAME||"lensmcp.dev",r),Ye=e.caCertPath(),ce=require("node:https").createServer({key:Te,cert:Te},Re)}else ce=http.createServer(Re);const Qe=a((e,r,n)=>{const p=matchGatewayRoute(e);if(p?.prependPrefix&&!e.url?.startsWith(p.prependPrefix)&&(e.url=p.prependPrefix+(e.url??"/")),p?.target){_.ws(e,r,n,{target:p.target,changeOrigin:!0},()=>r.destroy());return}const i=se();if(!i){r.destroy();return}_.ws(e,r,n,{target:{socketPath:i.socketPath}},()=>r.destroy())},"upgradeHandler");ce.on("upgrade",Qe);const Ze=2e3;let et=!1;ce.on("error",e=>{if(e.code==="EADDRINUSE"){et||(et=!0,console.warn(`[parent] public port ${b} already in use \u2014 continuing on the unix-socket pool only (gateway routing is unaffected) and retrying the bind every ${Ze/1e3}s. Give this service a distinct cluster.port if this is not a rolling handoff.`)),setTimeout(()=>{!k&&!ce.listening&&ce.listen(b)},Ze).unref?.();return}console.error("[parent] public server error:",e)}),await we(le);for(const e of WORKER_NAMES)qe(e);SOCKET_ONLY?console.log(`[parent] socket-only: no TCP listener (port ${b} is not bound \u2014 the gateway reaches this service through its socket pool)`):ce.listen(b,()=>{const e=GATEWAY_HTTPS?"https":"http";console.log(`[parent] Listening on ${e}://localhost:${b}`),SERVICE_PREFIX&&console.log(`[parent] Service prefix: "${SERVICE_PREFIX}" (enforced \u2014 requests without it will get 404)`),gatewayMiddleware&&console.log(`[parent] Gateway middleware: ACTIVE (${GATEWAY_MIDDLEWARE_PATH})`),GATEWAY_ROUTES.length>0&&console.log(`[parent] Gateway routes: ${GATEWAY_ROUTES.map(r=>`${r.host??"*"}${r.prefix??"/"}\u2192${r.target??"children"}`).join("  ")}`),Ye&&(console.log("[parent] HTTPS dev CA (trust ONCE, then rotations/new hostnames stay green):"),console.log(`[parent]   sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${Ye}`)),console.log(`POST ${e}://localhost:${b}/webpack/reload to trigger rolling swap/respawn`)});const Le=Number(process.env.INTERNAL_PORT||0);if(Le>0&&!SOCKET_ONLY){const e=a((n,p)=>{const i=se();if(!i){p.statusCode=503,p.setHeader("content-type","text/plain; charset=utf-8"),p.end("No healthy children available.");return}_.web(n,p,{target:{socketPath:i.socketPath}},o=>{i.healthy=!1,i.lastError=String(o?.stack||o),p.statusCode=502,p.end(`Upstream error from Child#${i.id}.`)})},"internalHandler"),r=http.createServer(e);r.on("upgrade",(n,p,i)=>{const o=se();if(!o){p.destroy();return}_.ws(n,p,i,{target:{socketPath:o.socketPath}},()=>p.destroy())}),r.on("error",n=>{console.warn(`[parent] internal port ${Le} unavailable (${n.code}).`)}),r.listen(Le,()=>{console.log(`[parent] Internal (service-to-service, no gateway middleware) on http://localhost:${Le}`)}),$e.push(r)}const nt=SOCKET_ONLY?[]:(()=>{try{return JSON.parse(process.env.GATEWAY_EXTRA_PORTS||"[]")}catch{return[]}})();for(const e of nt){if(!Number.isInteger(e)||e===Number(b))continue;const r=GATEWAY_HTTPS?require("node:https").createServer({key:Te,cert:Te},Re):http.createServer(Re);r.on("upgrade",Qe),r.on("error",n=>{console.warn(`[parent] extra port ${e} unavailable (${n.code}) \u2014 main port still up.`)}),r.listen(e,()=>{console.log(`[parent] Also listening on ${GATEWAY_HTTPS?"https":"http"}://localhost:${e}`)}),$e.push(r)}const be=path.join(SOCK_DIR,"parent.sock");claimSock(be),(0,handoff_retire_1.clearHandoffRetire)(SOCK_DIR,POD_GENERATION);const Oe=http.createServer(Re);Oe.on("error",e=>{console.warn(`[parent] control socket unavailable (${e.code}) \u2014 lensmcp logs/debug attach disabled.`)}),Oe.listen(be),$e.push(Oe);function tt(){k=!0;const e=[...v,...U];console.log(`[SIGTERM] [parent] generation g${POD_GENERATION} was handed over to a newer one \u2014 ${e.length} pod(s) finish their in-flight work, then it exits`);const r=sockOwnedByAnother(be);cleanupSock(be);for(const i of $e)if(!(i===Oe&&r))try{i.close()}catch{}try{ce.close()}catch{}for(const i of[...C])je(i);C.length=0;for(const i of v)if(!tell(i.proc,{type:"retire"}))try{i.proc.kill("SIGTERM")}catch{}const n=setTimeout(()=>{for(const i of e)if(!M(i)){console.error(`[parent] Child#${i.id} was still running ${l}ms after its generation was retired \u2014 killing it`);try{i.proc.kill("SIGKILL")}catch{}}},l);n.unref?.();const p=a(()=>{if(!(e.some(i=>!M(i))||[...me].some(i=>!Be(i)))){clearTimeout(n);for(const i of e)i.socketPath&&cleanupSock(i.socketPath,i.proc.pid);(0,handoff_retire_1.clearHandoffRetire)(SOCK_DIR,POD_GENERATION);try{fs.rmdirSync(SOCK_DIR)}catch{}console.log(`[parent] generation g${POD_GENERATION} retired`),process.exit(0)}},"finish");for(const i of e)i.proc.once("exit",p);for(const i of me)i.proc.once("exit",p);p()}h(tt,"ot"),a(tt,"retireGeneration");const rt=a(async e=>{k=!0,console.log(`[${e}] [parent] shutting down\u2026`);const r=sockOwnedByAnother(be);cleanupSock(be);for(const n of $e)if(!(n===Oe&&r))try{n.close()}catch{}for(const n of C)try{n.proc.kill("SIGTERM")}catch{}for(const n of[...me])Ge(n,"was still draining when its devserver shut down");for(const n of U)try{n.proc.kill("SIGTERM")}catch{}for(const n of v){try{n.proc.kill("SIGTERM")}catch{}n.socketPath&&cleanupSock(n.socketPath,n.proc.pid)}try{fs.rmdirSync(SOCK_DIR)}catch{}setTimeout(()=>process.exit(0),700).unref()},"shutdown");let Ke=0;const st=2e3;["SIGINT","SIGTERM","SIGHUP","SIGQUIT","SIGUSR2"].forEach(e=>process.on(e,()=>{if(e==="SIGTERM"){if(!k&&(0,handoff_retire_1.handoffRetireRequested)(SOCK_DIR,POD_GENERATION)){Ke=Date.now(),tt();return}if(Ke>0&&Date.now()-Ke<st)return}rt(e)}));const We=Number(process.env.LENSMCP_GATEWAY_PID??0);if(Number.isInteger(We)&&We>0){const e=setInterval(()=>{try{process.kill(We,0)}catch(r){if(r.code==="EPERM")return;clearInterval(e),console.error(`[parent] gateway (pid ${We}) is gone \u2014 shutting the pod down to avoid an orphan tree.`),rt("gateway-gone")}},5e3);e.unref()}})()}
+${a}`);return}_.web(e,r,{target:{socketPath:c.socketPath},headers:{"x-proxy-child-id":String(c.id)}},a=>{console.error(`[parent] proxy error to Child#${c.id}:`,a),c.healthy=!1,c.lastError=String(a?.stack||a),r.statusCode=502,r.setHeader("content-type","text/plain; charset=utf-8"),r.end(`Upstream error from Child#${c.id}. Try /webpack/reload.
+${c.lastError}`)})},"requestHandler");let de,$e,Ke;const Me=[];if(GATEWAY_HTTPS){const e=require("./basic-ssl"),r=GATEWAY_ROUTES.map(c=>c.host).filter(c=>!!c),s=(0,checkout_cache_1.checkoutCacheDir)(process.cwd(),"davnx-webpack");$e=e.getCertificateSync(s,SERVICE_NAME||"lensmcp.dev",r),Ke=e.caCertPath(),de=require("node:https").createServer({key:$e,cert:$e},Te)}else de=http.createServer(Te);const Ze=i((e,r,s)=>{const c=matchGatewayRoute(e);if(c?.prependPrefix&&!e.url?.startsWith(c.prependPrefix)&&(e.url=c.prependPrefix+(e.url??"/")),c?.target){_.ws(e,r,s,{target:c.target,changeOrigin:!0},()=>r.destroy());return}const a=ae();if(!a){r.destroy();return}_.ws(e,r,s,{target:{socketPath:a.socketPath}},()=>r.destroy())},"upgradeHandler");de.on("upgrade",Ze);const et=2e3;let tt=!1;de.on("error",e=>{if(e.code==="EADDRINUSE"){tt||(tt=!0,console.warn(`[parent] public port ${b} already in use \u2014 continuing on the unix-socket pool only (gateway routing is unaffected) and retrying the bind every ${et/1e3}s. Give this service a distinct cluster.port if this is not a rolling handoff.`)),setTimeout(()=>{!k&&!de.listening&&de.listen(b)},et).unref?.();return}console.error("[parent] public server error:",e)}),await we(pe);for(const e of WORKER_NAMES)Be(e);SOCKET_ONLY?console.log(`[parent] socket-only: no TCP listener (port ${b} is not bound \u2014 the gateway reaches this service through its socket pool)`):de.listen(b,()=>{const e=GATEWAY_HTTPS?"https":"http";console.log(`[parent] Listening on ${e}://localhost:${b}`),SERVICE_PREFIX&&console.log(`[parent] Service prefix: "${SERVICE_PREFIX}" (enforced \u2014 requests without it will get 404)`),gatewayMiddleware&&console.log(`[parent] Gateway middleware: ACTIVE (${GATEWAY_MIDDLEWARE_PATH})`),GATEWAY_ROUTES.length>0&&console.log(`[parent] Gateway routes: ${GATEWAY_ROUTES.map(r=>`${r.host??"*"}${r.prefix??"/"}\u2192${r.target??"children"}`).join("  ")}`),Ke&&(console.log("[parent] HTTPS dev CA (trust ONCE, then rotations/new hostnames stay green):"),console.log(`[parent]   sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${Ke}`)),console.log(`POST ${e}://localhost:${b}/webpack/reload to trigger rolling swap/respawn`)});const We=Number(process.env.INTERNAL_PORT||0);if(We>0&&!SOCKET_ONLY){const e=i((s,c)=>{const a=ae();if(!a){c.statusCode=503,c.setHeader("content-type","text/plain; charset=utf-8"),c.end("No healthy children available.");return}_.web(s,c,{target:{socketPath:a.socketPath}},o=>{a.healthy=!1,a.lastError=String(o?.stack||o),c.statusCode=502,c.end(`Upstream error from Child#${a.id}.`)})},"internalHandler"),r=http.createServer(e);r.on("upgrade",(s,c,a)=>{const o=ae();if(!o){c.destroy();return}_.ws(s,c,a,{target:{socketPath:o.socketPath}},()=>c.destroy())}),r.on("error",s=>{console.warn(`[parent] internal port ${We} unavailable (${s.code}).`)}),r.listen(We,()=>{console.log(`[parent] Internal (service-to-service, no gateway middleware) on http://localhost:${We}`)}),Me.push(r)}const st=SOCKET_ONLY?[]:(()=>{try{return JSON.parse(process.env.GATEWAY_EXTRA_PORTS||"[]")}catch{return[]}})();for(const e of st){if(!Number.isInteger(e)||e===Number(b))continue;const r=GATEWAY_HTTPS?require("node:https").createServer({key:$e,cert:$e},Te):http.createServer(Te);r.on("upgrade",Ze),r.on("error",s=>{console.warn(`[parent] extra port ${e} unavailable (${s.code}) \u2014 main port still up.`)}),r.listen(e,()=>{console.log(`[parent] Also listening on ${GATEWAY_HTTPS?"https":"http"}://localhost:${e}`)}),Me.push(r)}const ke=path.join(SOCK_DIR,"parent.sock");claimSock(ke),(0,handoff_retire_1.clearHandoffRetire)(SOCK_DIR,POD_GENERATION);const Oe=http.createServer(Te);Oe.on("error",e=>{console.warn(`[parent] control socket unavailable (${e.code}) \u2014 lensmcp logs/debug attach disabled.`)}),Oe.listen(ke),Me.push(Oe);function rt(){k=!0;const e=[...S,...U];console.log(`[SIGTERM] [parent] generation g${POD_GENERATION} was handed over to a newer one \u2014 ${e.length} pod(s) finish their in-flight work, then it exits`);const r=sockOwnedByAnother(ke);cleanupSock(ke);for(const a of Me)if(!(a===Oe&&r))try{a.close()}catch{}try{de.close()}catch{}for(const a of[...X])Ye(a);X.length=0;for(const a of S)if(!tell(a.proc,{type:"retire"}))try{a.proc.kill("SIGTERM")}catch{}const s=setTimeout(()=>{for(const a of e)if(!I(a)){console.error(`[parent] Child#${a.id} was still running ${d}ms after its generation was retired \u2014 killing it`);try{a.proc.kill("SIGKILL")}catch{}}},d);s.unref?.();const c=i(()=>{if(!(e.some(a=>!I(a))||[...Ee].some(a=>!je(a)))){clearTimeout(s);for(const a of e)a.socketPath&&cleanupSock(a.socketPath,a.proc.pid);(0,handoff_retire_1.clearHandoffRetire)(SOCK_DIR,POD_GENERATION);try{fs.rmdirSync(SOCK_DIR)}catch{}console.log(`[parent] generation g${POD_GENERATION} retired`),process.exit(0)}},"finish");for(const a of e)a.proc.once("exit",c);for(const a of Ee)a.proc.once("exit",c);c()}h(rt,"nt"),i(rt,"retireGeneration");const ot=i(async e=>{k=!0,console.log(`[${e}] [parent] shutting down\u2026`);const r=sockOwnedByAnother(ke);cleanupSock(ke);for(const s of Me)if(!(s===Oe&&r))try{s.close()}catch{}for(const s of X)try{s.proc.kill("SIGTERM")}catch{}for(const s of[...Ee])Le(s,"was still draining when its devserver shut down");for(const s of U)try{s.proc.kill("SIGTERM")}catch{}for(const s of S){try{s.proc.kill("SIGTERM")}catch{}s.socketPath&&cleanupSock(s.socketPath,s.proc.pid)}try{fs.rmdirSync(SOCK_DIR)}catch{}setTimeout(()=>process.exit(0),700).unref()},"shutdown");let Ve=0;const it=2e3;["SIGINT","SIGTERM","SIGHUP","SIGQUIT","SIGUSR2"].forEach(e=>process.on(e,()=>{if(e==="SIGTERM"){if(!k&&(0,handoff_retire_1.handoffRetireRequested)(SOCK_DIR,POD_GENERATION)){Ve=Date.now(),rt();return}if(Ve>0&&Date.now()-Ve<it)return}ot(e)}));const Fe=Number(process.env.LENSMCP_GATEWAY_PID??0);if(Number.isInteger(Fe)&&Fe>0){const e=setInterval(()=>{try{process.kill(Fe,0)}catch(r){if(r.code==="EPERM")return;clearInterval(e),console.error(`[parent] gateway (pid ${Fe}) is gone \u2014 shutting the pod down to avoid an orphan tree.`),ot("gateway-gone")}},5e3);e.unref()}})()}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/cluster",
-  "version": "1.25.2",
+  "version": "1.25.3",
   "description": "Run your Nx workspace as a local production cluster: pods on unix sockets with true HMR, one https gateway with per-project domains, scale-from-zero, autoscale, idle-kill, local-CA TLS — observed by the LensMCP lens.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -57,9 +57,9 @@
     }
   },
   "dependencies": {
-    "@lensmcp/core": "1.25.2",
-    "@lensmcp/node-instrumentation": "1.25.2",
-    "@lensmcp/nx-plugin": "1.25.2",
+    "@lensmcp/core": "1.25.3",
+    "@lensmcp/node-instrumentation": "1.25.3",
+    "@lensmcp/nx-plugin": "1.25.3",
     "fastify": "^5.8.5",
     "@fastify/reply-from": "^12.6.2",
     "@typescript/native-preview": "^7.0.0-dev.20260707.2",

package/swap-mode.d.ts

@@ -15,6 +15,14 @@
  */
 export type SwapMode = 'process' | 'in-process';
 export declare function swapMode(env?: Record<string, string | undefined>): SwapMode;
+/**
+ * A fresh pod still booting for a build that a newer one has already replaced is abandoned, and one pod boots for the
+ * newest build instead (issues/closed/foodguard-75). It used to finish booting, take over, and be replaced at once by
+ * yet another full pod — FoodGuard booted five engine pods (each ~1.8 GB, 9–20 s) in two minutes of an agent's edits.
+ * At most `LENSMCP_SWAP_MAX_SUPERSEDED` (default 2) in a row, so non-stop edits cannot keep a service on an old build
+ * for ever: past it, the booting pod is let through and the next build gets one more.
+ */
+export declare function abandonSuperseded(supersededInARow: number, env?: Record<string, string | undefined>): boolean;
 /**
  * Pods a reload-handoff may leave finishing their work at once (`LENSMCP_SWAP_MAX_RETIRING`, default 2). Edits come
  * faster than a long job ends; past the cap the oldest retiring pod is stopped, as the in-process swap closes the

package/swap-mode.js

@@ -1 +1 @@
-"use strict";var n=Object.defineProperty;var t=(r,e)=>n(r,"name",{value:e,configurable:!0});var o=Object.defineProperty,s=t((r,e)=>o(r,"name",{value:e,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.swapMode=swapMode,exports.maxRetiring=maxRetiring;function swapMode(r=process.env){const e=(r.LENSMCP_SWAP_MODE??"").trim().toLowerCase();return e==="in-process"||e==="inprocess"||e==="hot"?"in-process":"process"}t(swapMode,"swapMode"),s(swapMode,"swapMode");function maxRetiring(r=process.env){const e=Number(r.LENSMCP_SWAP_MAX_RETIRING);return Number.isFinite(e)&&e>=1?Math.floor(e):2}t(maxRetiring,"maxRetiring"),s(maxRetiring,"maxRetiring");
+"use strict";var a=Object.defineProperty;var o=(r,e)=>a(r,"name",{value:e,configurable:!0});var t=Object.defineProperty,s=o((r,e)=>t(r,"name",{value:e,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.swapMode=swapMode,exports.abandonSuperseded=abandonSuperseded,exports.maxRetiring=maxRetiring;function swapMode(r=process.env){const e=(r.LENSMCP_SWAP_MODE??"").trim().toLowerCase();return e==="in-process"||e==="inprocess"||e==="hot"?"in-process":"process"}o(swapMode,"swapMode"),s(swapMode,"swapMode");function abandonSuperseded(r,e=process.env){const n=Number(e.LENSMCP_SWAP_MAX_SUPERSEDED),i=Number.isFinite(n)&&n>=0?Math.floor(n):2;return r<i}o(abandonSuperseded,"abandonSuperseded"),s(abandonSuperseded,"abandonSuperseded");function maxRetiring(r=process.env){const e=Number(r.LENSMCP_SWAP_MAX_RETIRING);return Number.isFinite(e)&&e>=1?Math.floor(e):2}o(maxRetiring,"maxRetiring"),s(maxRetiring,"maxRetiring");