local-serverless-stack 1.0.0 → 1.1.0

package/dist/server/services/config-manager.d.ts

@@ -7,6 +7,7 @@ export interface SelfEngineConfig {
     memoryBudgetMb?: number;
     fsync?: boolean;
     fallbackEndpoint?: string | null;
+    fallbackEndpoints?: Record<string, string>;
 }
 export interface ResolvedSelfEngineConfig {
     port: number;
@@ -16,6 +17,7 @@ export interface ResolvedSelfEngineConfig {
     memoryBudgetMb: number;
     fsync: boolean;
     fallbackEndpoint: string | null;
+    fallbackEndpoints: Record<string, string>;
     persistence: boolean;
     region: string;
 }
@@ -24,12 +26,14 @@ export interface ServicePackageConfig {
     packageArgs?: string[];
     packageEnv?: Record<string, string>;
     packageTimeoutMs?: number;
+    packageCwd?: string;
 }
 export interface ResolvedPackageConfig {
     command: string;
     args: string[];
     env: Record<string, string>;
     timeoutMs: number;
+    cwd: string;
 }
 export type LambdaExecutionMode = 'auto' | 'artifact' | 'source';
 export interface LambdaRuntimeConfig {
@@ -48,6 +52,18 @@ export interface ServiceRuntimeConfig {
     invokePort?: number;
     execution?: LambdaExecutionMode;
     watch?: boolean;
+    env?: Record<string, string>;
+    execArgv?: string[];
+    functions?: Record<string, {
+        env?: Record<string, string>;
+    }>;
+}
+export interface ResolvedWorkerOverrides {
+    env: Record<string, string>;
+    execArgv: string[];
+    functions: Record<string, {
+        env?: Record<string, string>;
+    }>;
 }
 export interface ResolvedRuntimeConfig {
     enabled: boolean;
@@ -97,6 +113,7 @@ export interface LSSConfig {
     packageEnv?: Record<string, string>;
     servicePackaging?: Record<string, ServicePackageConfig>;
     packageTimeoutMs?: number;
+    scanIgnore?: string[];
     lambdaRuntime?: LambdaRuntimeConfig;
     serviceRuntime?: Record<string, ServiceRuntimeConfig>;
     selfEngine?: SelfEngineConfig;
@@ -144,6 +161,28 @@ export declare class ConfigManager {
      * as the global baseline.
      */
     getPackageConfigForService(servicePath: string): ResolvedPackageConfig;
+    /**
+     * Where a package command runs. `packageCwd` is resolved against the PROJECT
+     * ROOT (not the service dir — the point of the key is to reach a directory
+     * above the service) and fenced to it with the same realpath comparison the
+     * /install and /package endpoints apply to `servicePath`: this value is the
+     * cwd of a spawned child, so an unfenced `../..` would walk the packaging
+     * command out of the project entirely. A rejected value falls back to the
+     * service directory and says so, rather than silently packaging elsewhere.
+     */
+    private resolvePackageCwd;
+    /**
+     * Stacks the scan must not offer. A monorepo always holds a few that are
+     * never local by decision — a bootstrap stack deployed once per AWS account,
+     * a us-east-1 DNS/certificate stack the engine does not emulate — and they
+     * came back as pending work, with warnings, on every single scan. Permanent
+     * noise is how a real warning goes unread.
+     *
+     * Matched with the same key spellings as `servicePackaging`/`serviceRuntime`
+     * (path relative to the config file's directory or to the project root, or
+     * the directory basename), so one convention covers all three.
+     */
+    isScanIgnored(servicePath: string): boolean;
     /**
      * The keys a `servicePackaging`/`serviceRuntime` entry may be written under,
      * most specific first: the path relative to the config file's directory, the
@@ -174,13 +213,21 @@ export declare class ConfigManager {
      * (true for source, false for artifact).
      */
     getRuntimeConfigForService(servicePath: string): ResolvedRuntimeConfig;
+    /**
+     * The worker-process overrides for one service: `serviceRuntime.<svc>.env`,
+     * `.execArgv` and `.functions`. Looked up with the same key spellings as the
+     * rest of the entry. Never throws on a malformed hand-edited value — a
+     * non-object env or non-array execArgv reads as absent.
+     */
+    getWorkerOverridesForService(servicePath: string): ResolvedWorkerOverrides;
     getSelfEngineConfig(): ResolvedSelfEngineConfig;
     private homeStateDir;
     getEngineEndpoint(): string;
+    private getSelfEnginePort;
     /**
      * True when the orchestrator and the engine share one listener — the default,
-     * since both ports default to the same value. Give them different values to
-     * go back to two listeners.
+     * since the engine port follows serverPort. Give `selfEngine.port` a
+     * different value to go back to two listeners.
      */
     isSingleListener(): boolean;
     getConfigPath(): string;

package/dist/server/services/config-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-manager.d.ts","sourceRoot":"","sources":["../../../src/server/services/config-manager.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAazD,MAAM,WAAW,gBAAgB;IAG/B,IAAI,CAAC,EAAE,MAAM,CAAC;IAGd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAGhB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAGD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAOD,MAAM,WAAW,oBAAoB;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAID,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;CACnB;AAOD,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEjE,MAAM,WAAW,mBAAmB;IAElC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAGhC,KAAK,CAAC,EAAE,OAAO,CAAC;IAGhB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAI1B,UAAU,CAAC,EAAE,MAAM,CAAC;IAMpB,IAAI,CAAC,EAAE,OAAO,CAAC;IAKf,aAAa,CAAC,EAAE,MAAM,CAAC;IAMvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAID,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAGD,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,MAAM,WAAW,cAAc;IAE7B,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAIlB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAIhC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhC,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAChC,CAAC;CACH;AAID,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,WAAW,EAAE;QACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC/B,CAAC;CACH;AAUD,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAAC;AAEnD,MAAM,WAAW,SAAS;IAExB,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAGhB,WAAW,CAAC,EAAE,OAAO,CAAC;IAGtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAIhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAQlB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAK1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAIlB,WAAW,CAAC,EAAE,OAAO,CAAC;IAUtB,cAAc,CAAC,EAAE,MAAM,CAAC;IAOxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAKvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAOpC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAGxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAGpC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAGtD,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAG9B,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AA0gBD,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE;CAK9B;AAED,MAAM,WAAW,kBAAkB;IAEjC,IAAI,EAAE,MAAM,CAAC;IAGb,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAG5D,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAgB;IACvC,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,UAAU,CAAc;IAEhC,OAAO;IAIP,MAAM,CAAC,WAAW,IAAI,aAAa;IAOnC,OAAO,CAAC,UAAU;IAqClB,OAAO,CAAC,WAAW;IA6EnB,SAAS,IAAI,SAAS;IAItB,aAAa,IAAI,MAAM;IAKvB,gBAAgB,IAAI,MAAM;IAI1B,mBAAmB,IAAI,OAAO;IAQ9B,kBAAkB,IAAI,MAAM;IAI5B,SAAS,IAAI,MAAM;IAInB,aAAa,IAAI,OAAO;IAOxB,OAAO,IAAI,OAAO;IAOlB,WAAW,IAAI,MAAM;IAMrB,iBAAiB,IAAI,MAAM;IAK3B,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC;IAIjD,WAAW,IAAI,MAAM,GAAG,SAAS;IAMjC,aAAa,IAAI,OAAO;IAIxB,iBAAiB,IAAI,MAAM;IAI3B,mBAAmB,IAAI,MAAM;IAI7B;;;;;;OAMG;IACH,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB;IAUtE;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,gBAAgB;IAcxB,OAAO,CAAC,kBAAkB;IAW1B,sBAAsB,IAAI,OAAO;IAIjC,sBAAsB,IAAI,mBAAmB;IAI7C,mBAAmB,IAAI,MAAM;IAO7B,mBAAmB,IAAI,OAAO;IAK9B,sBAAsB,IAAI,MAAM;IAShC,uBAAuB,IAAI,MAAM;IAOjC,aAAa,IAAI,MAAM;IASvB;;;;;;OAMG;IACH,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB;IAWtE,mBAAmB,IAAI,wBAAwB;IAsB/C,OAAO,CAAC,YAAY;IAQpB,iBAAiB,IAAI,MAAM;IAI3B;;;;OAIG;IACH,gBAAgB,IAAI,OAAO;IAI3B,aAAa,IAAI,MAAM;IAIvB;;;;;;OAMG;IACH,cAAc,IAAI,MAAM;IAYxB;;;;;OAKG;IACH,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI;IAY5D,OAAO,CAAC,mBAAmB;IAW3B,WAAW,IAAI,gBAAgB;IAmB/B,oBAAoB,IAAI,MAAM,EAAE;IAYhC,OAAO,CAAC,kBAAkB;IAwB1B,OAAO,CAAC,MAAM,CAAC,QAAQ;IASvB,OAAO,CAAC,cAAc;IAMtB;;;;;;OAMG;IACH,cAAc,IAAI,kBAAkB;IAsBpC;;;;;;OAMG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,kBAAkB;IAyGhE;;OAEG;IACH,YAAY,IAAI,IAAI;IAwCpB,kBAAkB,IAAI,MAAM;CAI7B"}
+{"version":3,"file":"config-manager.d.ts","sourceRoot":"","sources":["../../../src/server/services/config-manager.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAczD,MAAM,WAAW,gBAAgB;IAM/B,IAAI,CAAC,EAAE,MAAM,CAAC;IAGd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAIhB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAIjC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5C;AAGD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AASD,MAAM,WAAW,oBAAoB;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAS1B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAGlB,GAAG,EAAE,MAAM,CAAC;CACb;AAOD,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEjE,MAAM,WAAW,mBAAmB;IAElC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAGhC,KAAK,CAAC,EAAE,OAAO,CAAC;IAGhB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAI1B,UAAU,CAAC,EAAE,MAAM,CAAC;IAMpB,IAAI,CAAC,EAAE,OAAO,CAAC;IAKf,aAAa,CAAC,EAAE,MAAM,CAAC;IAMvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAID,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC,KAAK,CAAC,EAAE,OAAO,CAAC;IAIhB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAG7B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAGpB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;CAC9D;AAKD,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;CAC7D;AAGD,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,MAAM,WAAW,cAAc;IAE7B,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAIlB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAIhC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhC,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAChC,CAAC;CACH;AAID,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,WAAW,EAAE;QACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC/B,CAAC;CACH;AAUD,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAAC;AAEnD,MAAM,WAAW,SAAS;IAExB,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAGhB,WAAW,CAAC,EAAE,OAAO,CAAC;IAGtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAIhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAQlB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAK1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAIlB,WAAW,CAAC,EAAE,OAAO,CAAC;IAUtB,cAAc,CAAC,EAAE,MAAM,CAAC;IAOxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAQvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAOpC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAGxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAO1B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAGtB,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAGpC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAGtD,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAG9B,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAymBD,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE;CAK9B;AAED,MAAM,WAAW,kBAAkB;IAEjC,IAAI,EAAE,MAAM,CAAC;IAGb,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAG5D,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAgB;IACvC,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,UAAU,CAAc;IAEhC,OAAO;IAIP,MAAM,CAAC,WAAW,IAAI,aAAa;IAOnC,OAAO,CAAC,UAAU;IAqClB,OAAO,CAAC,WAAW;IAqFnB,SAAS,IAAI,SAAS;IAItB,aAAa,IAAI,MAAM;IAKvB,gBAAgB,IAAI,MAAM;IAI1B,mBAAmB,IAAI,OAAO;IAQ9B,kBAAkB,IAAI,MAAM;IAI5B,SAAS,IAAI,MAAM;IAInB,aAAa,IAAI,OAAO;IAOxB,OAAO,IAAI,OAAO;IAOlB,WAAW,IAAI,MAAM;IAMrB,iBAAiB,IAAI,MAAM;IAK3B,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC;IAIjD,WAAW,IAAI,MAAM,GAAG,SAAS;IAMjC,aAAa,IAAI,OAAO;IAIxB,iBAAiB,IAAI,MAAM;IAI3B,mBAAmB,IAAI,MAAM;IAI7B;;;;;;OAMG;IACH,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB;IAWtE;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAiBzB;;;;;;;;;;OAUG;IACH,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAO3C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,gBAAgB;IAcxB,OAAO,CAAC,kBAAkB;IAW1B,sBAAsB,IAAI,OAAO;IAIjC,sBAAsB,IAAI,mBAAmB;IAI7C,mBAAmB,IAAI,MAAM;IAO7B,mBAAmB,IAAI,OAAO;IAK9B,sBAAsB,IAAI,MAAM;IAShC,uBAAuB,IAAI,MAAM;IAOjC,aAAa,IAAI,MAAM;IASvB;;;;;;OAMG;IACH,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB;IAWtE;;;;;OAKG;IACH,4BAA4B,CAAC,WAAW,EAAE,MAAM,GAAG,uBAAuB;IAS1E,mBAAmB,IAAI,wBAAwB;IAuB/C,OAAO,CAAC,YAAY;IAQpB,iBAAiB,IAAI,MAAM;IAS3B,OAAO,CAAC,iBAAiB;IAIzB;;;;OAIG;IACH,gBAAgB,IAAI,OAAO;IAI3B,aAAa,IAAI,MAAM;IAIvB;;;;;;OAMG;IACH,cAAc,IAAI,MAAM;IAYxB;;;;;OAKG;IACH,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI;IAY5D,OAAO,CAAC,mBAAmB;IAW3B,WAAW,IAAI,gBAAgB;IAmB/B,oBAAoB,IAAI,MAAM,EAAE;IAYhC,OAAO,CAAC,kBAAkB;IA2B1B,OAAO,CAAC,MAAM,CAAC,QAAQ;IASvB,OAAO,CAAC,cAAc;IAMtB;;;;;;OAMG;IACH,cAAc,IAAI,kBAAkB;IAsBpC;;;;;;OAMG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,kBAAkB;IAkHhE;;OAEG;IACH,YAAY,IAAI,IAAI;IA2CpB,kBAAkB,IAAI,MAAM;CAI7B"}

package/dist/server/services/config-manager.js

@@ -2,6 +2,7 @@ import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import { projectCacheSegment } from './project-scope.js';
+import { execArgvError } from './worker-runtime.js';
 // Symlink-stable spelling of a directory (e.g. macOS /tmp -> /private/tmp),
 // so the project identity matches the plugin's symlink-resolved process.cwd().
 function realpathOrSelf(dir) {
@@ -226,9 +227,11 @@ const EDITABLE_CONFIG_KEYS = {
             packageArgs: { kind: 'packageArgs' },
             packageEnv: { kind: 'envRecord' },
             packageTimeoutMs: { kind: 'positiveInt' },
+            packageCwd: { kind: 'projectRelativePath' },
         },
     },
     packageTimeoutMs: { kind: 'positiveInt' },
+    scanIgnore: { kind: 'stringArray' },
     lambdaRuntime: {
         kind: 'object',
         subKeys: {
@@ -250,6 +253,16 @@ const EDITABLE_CONFIG_KEYS = {
             invokePort: { kind: 'port' },
             execution: { kind: 'string', enum: ['auto', 'artifact', 'source'] },
             watch: { kind: 'boolean' },
+            // Same fence as packageEnv: the map lands in a forked worker's
+            // environment, where NODE_OPTIONS & co. load code of the caller's choosing.
+            env: { kind: 'envRecord' },
+            execArgv: { kind: 'execArgv' },
+            functions: {
+                kind: 'object',
+                entrySubKeys: {
+                    env: { kind: 'envRecord' },
+                },
+            },
         },
     },
     selfEngine: {
@@ -262,6 +275,7 @@ const EDITABLE_CONFIG_KEYS = {
             memoryBudgetMb: { kind: 'positiveInt' },
             fsync: { kind: 'boolean' },
             fallbackEndpoint: { kind: 'string' },
+            fallbackEndpoints: { kind: 'stringRecord' },
         },
     },
     branding: {
@@ -303,7 +317,7 @@ const CONFIG_ENV_OVERRIDES = {
     packageCommand: ['LSS_PACKAGE_COMMAND'],
     packageTimeoutMs: ['LSS_PACKAGE_TIMEOUT_MS'],
     lambdaRuntime: ['LSS_LAMBDA_RUNTIME', 'LSS_LAMBDA_EXECUTION', 'LSS_LAMBDA_WATCH', 'LSS_INVOKE_HOST'],
-    selfEngine: ['LSS_ENGINE_PORT', 'LSS_ENGINE_DATA_DIR'],
+    selfEngine: ['LSS_ENGINE_PORT', 'LSS_ENGINE_DATA_DIR', 'LSS_FALLBACK_ENDPOINT'],
 };
 function isPlainObject(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -438,20 +452,53 @@ function validateValue(key, value, spec) {
             const index = value.findIndex(isBlockedPackageFlag);
             return index === -1 ? null : blockedFlagError(`${key}[${index}]`, value[index]);
         }
+        // A plain list of match patterns (scanIgnore) — never spawned, so the
+        // package-args screen above does not apply; it just has to be a list of
+        // non-empty strings so the matcher cannot be fed garbage.
+        case 'stringArray':
+            return Array.isArray(value) && value.every(v => typeof v === 'string' && v.length > 0)
+                ? null
+                : `"${key}" must be an array of non-empty strings`;
+        // A directory INSIDE the project, written the way the config file spells
+        // every other path: relative, forward slashes. Rejected lexically here
+        // (absolute, or any `..` segment) and again by realpath when it is resolved
+        // — this one becomes the cwd of a spawned child, so "inside the project"
+        // has to hold for the path that is actually used, symlinks included.
+        case 'projectRelativePath': {
+            if (typeof value !== 'string' || value.length === 0) {
+                return `"${key}" must be a non-empty string`;
+            }
+            if (path.isAbsolute(value) || value.split(/[\\/]/).includes('..')) {
+                return `"${key}" must be a path inside the project root, written relative to it (no leading "/" and no "..")`;
+            }
+            return null;
+        }
+        // Handed to fork() as the worker's execArgv — an allowlist, because a
+        // single `--import`/`--require` is code execution. See execArgvError().
+        case 'execArgv':
+            return execArgvError(key, value);
         case 'stringRecord':
+            return isPlainObject(value) && Object.values(value).every(v => typeof v === 'string')
+                ? null
+                : `"${key}" must be an object of string values`;
+        // Written as a PATCH, one variable at a time (mergeEnvRecord), so `null` is
+        // a value with a meaning here — "remove this variable" — and not just the
+        // top-level "delete the block" spelling. Anything else that is not a string
+        // is still refused: the map ends up in a child process's environment.
         case 'envRecord': {
-            if (!isPlainObject(value) || !Object.values(value).every(v => typeof v === 'string')) {
-                return `"${key}" must be an object of string values`;
+            if (!isPlainObject(value) || !Object.values(value).every(v => typeof v === 'string' || v === null)) {
+                return `"${key}" must be an object of string values (null removes a key)`;
             }
             // An env map is merged into the packaging child's environment, where a
             // handful of names are loader/interpreter hooks: they run code in the
             // child whatever program the command grammar let through, which would
-            // make that grammar decorative.
-            if (spec.kind === 'envRecord') {
-                for (const envKey of Object.keys(value)) {
-                    if (BLOCKED_PACKAGE_ENV_KEYS.has(envKey.toLowerCase())) {
-                        return `"${key}.${envKey}" cannot be set — it injects code into the packaging process`;
-                    }
+            // make that grammar decorative. Screened per variable being SET —
+            // REMOVING one of those names only ever takes capability away, and is the
+            // one way the dashboard can undo a hand-edited config file that carries
+            // it (the fence guards the API, not the read path).
+            for (const [envKey, envValue] of Object.entries(value)) {
+                if (envValue !== null && BLOCKED_PACKAGE_ENV_KEYS.has(envKey.toLowerCase())) {
+                    return `"${key}.${envKey}" cannot be set — it injects code into the packaging process`;
                 }
             }
             return null;
@@ -502,6 +549,51 @@ function validateValue(key, value, spec) {
         }
     }
 }
+/**
+ * Merge an `envRecord` patch over the map already in the file: a string sets or
+ * replaces one variable, `null` removes one, and every variable the patch does
+ * not name is left exactly as it was.
+ *
+ * Replacing the whole map — what every other non-`object` key does on write —
+ * cannot work for `packageEnv`, because its values are **write-only**:
+ * `GET /api/config` reports `packageEnvKeys`, the NAMES alone (see
+ * routes/config.ts), so the values never leave this process and a client
+ * editing one variable has nothing to resend for its siblings. Under a
+ * wholesale replace, saving `{"A":"v"}` would silently delete `B` and `C` —
+ * secrets the editor was never shown and cannot recover. So the write is a
+ * patch, for the same reason the one-level block merge above exists (a partial
+ * edit must not drop what it could not see), one level deeper.
+ *
+ * A file value that is not an object is replaced rather than merged into,
+ * mirroring how a malformed `object` block is treated.
+ */
+function mergeEnvRecord(existing, patch) {
+    const merged = isPlainObject(existing) ? { ...existing } : {};
+    for (const [envKey, envValue] of Object.entries(patch)) {
+        if (envValue === null) {
+            delete merged[envKey];
+        }
+        else {
+            merged[envKey] = envValue;
+        }
+    }
+    return merged;
+}
+/**
+ * Write a merged block back, or drop the key when the merge emptied it — an
+ * empty block carries no setting and would only add noise to the file the human
+ * reviews. It is load-bearing for a map entry: an empty object is truthy, so a
+ * leftover `{}` would shadow a basename-keyed entry for the same service and
+ * silently disable that override.
+ */
+function setOrDeleteBlock(target, key, merged) {
+    if (Object.keys(merged).length === 0) {
+        delete target[key];
+    }
+    else {
+        target[key] = merged;
+    }
+}
 // Thrown by updateConfig so the route can answer 400 with every problem at
 // once instead of failing on the first.
 export class ConfigValidationError extends Error {
@@ -634,6 +726,14 @@ export class ConfigManager {
                 dataDir: process.env.LSS_ENGINE_DATA_DIR,
             };
         }
+        // Point unsupported services at another emulator per run (a CI job that
+        // starts one next to LSS) without writing it into the shared config file.
+        if (process.env.LSS_FALLBACK_ENDPOINT) {
+            this.config.selfEngine = {
+                ...this.config.selfEngine,
+                fallbackEndpoint: process.env.LSS_FALLBACK_ENDPOINT,
+            };
+        }
     }
     getConfig() {
         return this.config;
@@ -711,8 +811,51 @@ export class ConfigManager {
             args: [...(this.config.packageArgs ?? []), ...(perService.packageArgs ?? [])],
             env: { ...(this.config.packageEnv ?? {}), ...(perService.packageEnv ?? {}) },
             timeoutMs: perService.packageTimeoutMs ?? this.getPackageTimeoutMs(),
+            cwd: this.resolvePackageCwd(perService.packageCwd, servicePath),
         };
     }
+    /**
+     * Where a package command runs. `packageCwd` is resolved against the PROJECT
+     * ROOT (not the service dir — the point of the key is to reach a directory
+     * above the service) and fenced to it with the same realpath comparison the
+     * /install and /package endpoints apply to `servicePath`: this value is the
+     * cwd of a spawned child, so an unfenced `../..` would walk the packaging
+     * command out of the project entirely. A rejected value falls back to the
+     * service directory and says so, rather than silently packaging elsewhere.
+     */
+    resolvePackageCwd(packageCwd, servicePath) {
+        const serviceDir = path.resolve(servicePath);
+        if (!packageCwd)
+            return serviceDir;
+        const projectRoot = this.getProjectRoot();
+        const resolved = path.resolve(projectRoot, packageCwd);
+        const realRoot = realpathOrSelf(projectRoot);
+        const realTarget = realpathOrSelf(resolved);
+        const relative = path.relative(realRoot, realTarget);
+        if (relative.startsWith('..') || path.isAbsolute(relative)) {
+            console.warn(`⚠️  Ignoring packageCwd "${packageCwd}" for ${serviceDir}: it resolves outside the project root (${projectRoot}).`);
+            return serviceDir;
+        }
+        return resolved;
+    }
+    /**
+     * Stacks the scan must not offer. A monorepo always holds a few that are
+     * never local by decision — a bootstrap stack deployed once per AWS account,
+     * a us-east-1 DNS/certificate stack the engine does not emulate — and they
+     * came back as pending work, with warnings, on every single scan. Permanent
+     * noise is how a real warning goes unread.
+     *
+     * Matched with the same key spellings as `servicePackaging`/`serviceRuntime`
+     * (path relative to the config file's directory or to the project root, or
+     * the directory basename), so one convention covers all three.
+     */
+    isScanIgnored(servicePath) {
+        const ignore = this.config.scanIgnore;
+        if (!ignore || ignore.length === 0)
+            return false;
+        const patterns = new Set(ignore.map(entry => entry.replace(/^\.\//, '').replace(/\/+$/, '')));
+        return this.serviceEntryKeys(servicePath).some(key => patterns.has(key));
+    }
     /**
      * The keys a `servicePackaging`/`serviceRuntime` entry may be written under,
      * most specific first: the path relative to the config file's directory, the
@@ -804,19 +947,34 @@ export class ConfigManager {
             invokePort: perService.invokePort,
         };
     }
+    /**
+     * The worker-process overrides for one service: `serviceRuntime.<svc>.env`,
+     * `.execArgv` and `.functions`. Looked up with the same key spellings as the
+     * rest of the entry. Never throws on a malformed hand-edited value — a
+     * non-object env or non-array execArgv reads as absent.
+     */
+    getWorkerOverridesForService(servicePath) {
+        const perService = this.lookupServiceEntry(this.config.serviceRuntime, servicePath);
+        return {
+            env: isPlainObject(perService.env) ? { ...perService.env } : {},
+            execArgv: Array.isArray(perService.execArgv) ? [...perService.execArgv] : [],
+            functions: isPlainObject(perService.functions) ? { ...perService.functions } : {},
+        };
+    }
     getSelfEngineConfig() {
         const selfEngine = this.config.selfEngine ?? {};
         const stateDir = this.getStateDir();
         const rawDataDir = selfEngine.dataDir
             ?? (stateDir ? path.join(stateDir, 'engine') : this.homeStateDir('engine'));
         return {
-            port: selfEngine.port ?? DEFAULT_PORT,
+            port: this.getSelfEnginePort(),
             dataDir: path.isAbsolute(rawDataDir) ? rawDataDir : path.resolve(process.cwd(), rawDataDir),
             account: selfEngine.account ?? '000000000000',
             idleUnloadMs: selfEngine.idleUnloadMs ?? 300000,
             memoryBudgetMb: selfEngine.memoryBudgetMb ?? 128,
             fsync: selfEngine.fsync ?? false,
             fallbackEndpoint: selfEngine.fallbackEndpoint ?? null,
+            fallbackEndpoints: selfEngine.fallbackEndpoints ?? {},
             persistence: this.isPersistence(),
             region: this.getRegion(),
         };
@@ -833,15 +991,23 @@ export class ConfigManager {
     // which would also resolve the data dir — needless work for a URL, and it
     // drags the project-root lookup into every caller that only wants an endpoint.
     getEngineEndpoint() {
-        return `http://localhost:${this.config.selfEngine?.port ?? DEFAULT_PORT}`;
+        return `http://localhost:${this.getSelfEnginePort()}`;
+    }
+    // The engine port follows serverPort unless set explicitly. It used to
+    // default to 14566 on its own, so `LSS_DASHBOARD_PORT=3100` alone (or a
+    // config with only `serverPort`) silently split the stack: the dashboard
+    // moved to 3100 and a second listener still opened 14566 — colliding with
+    // the instance that a second stack was meant to run beside.
+    getSelfEnginePort() {
+        return this.config.selfEngine?.port ?? this.getServerPort();
     }
     /**
      * True when the orchestrator and the engine share one listener — the default,
-     * since both ports default to the same value. Give them different values to
-     * go back to two listeners.
+     * since the engine port follows serverPort. Give `selfEngine.port` a
+     * different value to go back to two listeners.
      */
     isSingleListener() {
-        return this.getServerPort() === (this.config.selfEngine?.port ?? DEFAULT_PORT);
+        return this.getServerPort() === this.getSelfEnginePort();
     }
     getConfigPath() {
         return this.configPath;
@@ -931,13 +1097,16 @@ export class ConfigManager {
             // Only the block's OWN settings: region/persistence are tracked under
             // their own keys above, so one change never flags two entries.
             selfEngine: {
-                port: selfEngine.port,
+                // The explicit value, not the resolved one: an unset engine port
+                // follows serverPort, and that change is already tracked there.
+                port: this.config.selfEngine?.port,
                 dataDir: selfEngine.dataDir,
                 account: selfEngine.account,
                 idleUnloadMs: selfEngine.idleUnloadMs,
                 memoryBudgetMb: selfEngine.memoryBudgetMb,
                 fsync: selfEngine.fsync,
                 fallbackEndpoint: selfEngine.fallbackEndpoint,
+                fallbackEndpoints: selfEngine.fallbackEndpoints,
             },
         };
     }
@@ -1028,16 +1197,23 @@ export class ConfigManager {
             }
         }
         for (const [key, value] of Object.entries(patch)) {
+            const spec = EDITABLE_CONFIG_KEYS[key];
             if (value === null) {
                 delete fileConfig[key];
             }
-            else if (EDITABLE_CONFIG_KEYS[key].kind === 'object') {
+            else if (spec.kind === 'envRecord') {
+                // Per-variable patch instead of a replace: these values are write-only,
+                // so the client cannot resend the siblings it was never shown and a
+                // replace would delete them. See mergeEnvRecord.
+                setOrDeleteBlock(fileConfig, key, mergeEnvRecord(fileConfig[key], value));
+            }
+            else if (spec.kind === 'object') {
                 // One-level merge so a partial block edit (e.g. branding.title) never
                 // drops sibling settings the UI does not round-trip (branding.logo).
                 // Map-shaped blocks (serviceRuntime/servicePackaging) merge one level
                 // deeper for the same reason: onboarding sending { apiPort } for one
                 // service must not drop that entry's execution/packageEnv siblings.
-                const perEntry = Boolean(EDITABLE_CONFIG_KEYS[key].entrySubKeys);
+                const entrySubKeys = spec.entrySubKeys;
                 const existing = isPlainObject(fileConfig[key])
                     ? fileConfig[key]
                     : {};
@@ -1046,7 +1222,7 @@ export class ConfigManager {
                     if (subValue === null) {
                         delete merged[subKey];
                     }
-                    else if (perEntry && isPlainObject(subValue)) {
+                    else if (entrySubKeys && isPlainObject(subValue)) {
                         const entryExisting = isPlainObject(merged[subKey])
                             ? merged[subKey]
                             : {};
@@ -1055,6 +1231,14 @@ export class ConfigManager {
                             if (entryValue === null) {
                                 delete entryMerged[entryKey];
                             }
+                            else if (entrySubKeys[entryKey].kind === 'envRecord') {
+                                // servicePackaging[*].packageEnv is as write-only as the global
+                                // map (redactPackaging() in routes/config.ts collapses it the
+                                // same way), so it patches per variable too. Validation already
+                                // rejected any subkey that is not in entrySubKeys, so the spec
+                                // lookup here always lands on a declared one.
+                                setOrDeleteBlock(entryMerged, entryKey, mergeEnvRecord(entryMerged[entryKey], entryValue));
+                            }
                             else {
                                 entryMerged[entryKey] = entryValue;
                             }
@@ -1062,12 +1246,7 @@ export class ConfigManager {
                         // An entry left with no settings carries no meaning and would
                         // shadow a basename-keyed entry for the same service (an empty
                         // object is truthy), so it is dropped rather than written.
-                        if (Object.keys(entryMerged).length === 0) {
-                            delete merged[subKey];
-                        }
-                        else {
-                            merged[subKey] = entryMerged;
-                        }
+                        setOrDeleteBlock(merged, subKey, entryMerged);
                     }
                     else {
                         merged[subKey] = subValue;
@@ -1100,6 +1279,9 @@ export class ConfigManager {
         const selfEngine = this.getSelfEngineConfig();
         console.log(`  Self Engine Port: ${selfEngine.port} (http://localhost:${selfEngine.port})`);
         console.log(`  Self Engine Data Dir: ${selfEngine.dataDir}`);
+        for (const [service, endpoint] of Object.entries(selfEngine.fallbackEndpoints)) {
+            console.log(`  Self Engine Fallback (${service}): ${endpoint}`);
+        }
         if (selfEngine.fallbackEndpoint) {
             console.log(`  Self Engine Fallback: ${selfEngine.fallbackEndpoint}`);
         }