mixdog 0.7.1

package/server.mjs

@@ -0,0 +1,468 @@
+#!/usr/bin/env bun
+// Thin entry. A node:-builtin-only prelude registers active-instance.json
+// as early as possible, then dynamically imports server-main.mjs.
+//
+// ES module import hoisting causes statically-imported heavy modules to
+// push the prelude back. Dynamic import is the only way to isolate it.
+import { createServer } from 'node:http'
+import * as fs from 'node:fs'
+import * as path from 'node:path'
+import * as os from 'node:os'
+
+process.stderr.write(`[boot-time] tag=server-prelude-entry tMs=${Date.now()}\n`)
+
+// ── Daemon model fork ───────────────────────────────────────────────────────
+// Only the `--daemon` process runs the heavy backend (server-main → serveDaemon,
+// booting memory/channels/PG ONCE per data dir). Every other invocation is a
+// THIN CLIENT that bridges its stdio (from run-mcp) to the shared daemon over a
+// pipe. When the daemon connection drops, the thin client exits and run-mcp
+// respawns it (re-attaching or re-spawning the daemon), reusing run-mcp's
+// initialize cache/replay. Replaces the per-terminal in-process server +
+// fork-proxy/election model (legacy deleted post-cutover).
+const __DAEMON_MODE = process.argv.includes('--daemon') || process.env.MIXDOG_DAEMON_MODE === '1'
+if (!__DAEMON_MODE) {
+  const __dataDir = process.env.CLAUDE_PLUGIN_DATA
+    || path.join(os.homedir(), '.claude', 'plugins', 'data', 'mixdog-trib-plugin')
+  const { runThinClient } = await import('./src/daemon/thin-client.mjs')
+  await runThinClient(__dataDir)
+  process.exit(0) // the bridge keeps us alive; if it ever returns, never run the daemon prelude
+}
+
+// ── Resolve PLUGIN_DATA (same rule as lib/plugin-paths.cjs: env wins) ─
+const PLUGIN_DATA = process.env.CLAUDE_PLUGIN_DATA
+  || path.join(os.homedir(), '.claude', 'plugins', 'data', 'mixdog-trib-plugin')
+fs.mkdirSync(PLUGIN_DATA, { recursive: true })
+const __parsePositivePid = (value) => {
+  const pid = Number(value)
+  return Number.isFinite(pid) && pid > 0 ? pid : null
+}
+const __ownerLeadPid = __parsePositivePid(process.env.MIXDOG_SUPERVISOR_PID) ?? process.pid
+const __runtimeRoot = process.env.MIXDOG_RUNTIME_ROOT
+  ? path.resolve(process.env.MIXDOG_RUNTIME_ROOT)
+  : path.join(os.tmpdir(), 'mixdog')
+
+// ── Singleton lock (hoisted from server.mjs:46~74) ──────────────────
+const LOCK_PATH = path.join(PLUGIN_DATA, 'server.lock')
+function _isPidAlive(pid) {
+  if (!pid || pid === process.pid) return false
+  try { process.kill(pid, 0); return true }
+  catch (err) { return err?.code === 'EPERM' }
+}
+// Atomic lock acquisition: open with 'wx' (exclusive create) so two racing
+// processes cannot both believe they won. If the file already exists, 'wx'
+// throws EEXIST — read the PID, decide if the owner is still alive, and
+// either retry (stale) or exit (live).
+let _lockFd = null
+function _acquireLock() {
+  // Multi-instance escape hatch. When MIXDOG_MULTI_INSTANCE=1, multiple
+  // server.mjs processes can coexist in the same data dir — each one is its
+  // own CC stdio MCP server, and downstream singletons (PG, memory worker
+  // via fork-proxy mode, channels via proxyMode, status server via
+  // per-instance advert) handle the shared state. Skip the lock entirely so
+  // CC's plugin loader doesn't see "already running" rejections every time
+  // it spawns a second terminal.
+  if (process.env.MIXDOG_MULTI_INSTANCE === '1') return
+  // First try: atomic exclusive create.
+  try {
+    _lockFd = fs.openSync(LOCK_PATH, 'wx')
+    fs.writeSync(_lockFd, String(process.pid))
+    fs.closeSync(_lockFd)
+    _lockFd = null
+    return // success — fast path
+  } catch (err) {
+    if (err?.code !== 'EEXIST') {
+      // Unexpected error — log and abort. Continuing without a valid lock risks
+      // two concurrent instances sharing the same data directory.
+      try { if (_lockFd !== null) { fs.closeSync(_lockFd); _lockFd = null } } catch {}
+      process.stderr.write(`[server] failed to create server.lock (${err?.code ?? err?.message}); exiting.\n`)
+      process.exit(1)
+    }
+  }
+
+  // EEXIST — inspect the current owner.
+  const _LOCK_RETRIES = 3
+  const _LOCK_RETRY_MS = 50
+  for (let attempt = 0; attempt <= _LOCK_RETRIES; attempt++) {
+    let existingPid = NaN
+    try { existingPid = Number.parseInt(fs.readFileSync(LOCK_PATH, 'utf-8').trim(), 10) } catch {}
+    if (Number.isFinite(existingPid) && _isPidAlive(existingPid)) {
+      process.stderr.write(`[server] another mixdog instance already running (pid=${existingPid}); exiting.\n`)
+      process.exit(0)
+    }
+    // Stale lock — unlink then re-acquire atomically via 'wx'.
+    try { fs.unlinkSync(LOCK_PATH) } catch {}
+    try {
+      _lockFd = fs.openSync(LOCK_PATH, 'wx')
+      fs.writeSync(_lockFd, String(process.pid))
+      fs.closeSync(_lockFd)
+      _lockFd = null
+      return // atomic re-acquire succeeded
+    } catch (retryErr) {
+      if (retryErr?.code !== 'EEXIST') {
+        // Unexpected error on retry — log and abort.
+        try { if (_lockFd !== null) { fs.closeSync(_lockFd); _lockFd = null } } catch {}
+        process.stderr.write(`[server] unexpected lock error on retry (${retryErr?.code ?? retryErr?.message}); exiting.\n`)
+        process.exit(1)
+      }
+      // Another process beat us to 'wx' — wait and retry.
+      if (attempt < _LOCK_RETRIES) {
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, _LOCK_RETRY_MS)
+      }
+    }
+  }
+  // All retries exhausted — another process won the race.
+  let finalPid = NaN
+  try { finalPid = Number.parseInt(fs.readFileSync(LOCK_PATH, 'utf-8').trim(), 10) } catch {}
+  process.stderr.write(`[server] failed to acquire server.lock after ${_LOCK_RETRIES} retries (owner pid=${finalPid}); exiting.\n`)
+  process.exit(0)
+}
+_acquireLock()
+
+// ── Process-level crash guards (mirror CC gracefulShutdown.ts:301/313) ──
+// uncaughtException: best-effort append to crash log then exit(1).
+// unhandledRejection: log-only; do NOT exit (avoid killing supervisor on
+// transient promise rejections).
+// Soft-net policy: log only. server-main.mjs installs its own
+// uncaughtException listener (around line 594) that classifies recoverable
+// vs fatal conditions and only exits on the fatal subset. Unconditionally
+// exiting here would preempt that policy for any exception that lands
+// before/while server-main loads. Real fatals (EPIPE on stdio, EADDRINUSE,
+// AssertionError, ERR_INTERNAL_ASSERTION) still terminate via the
+// server-main classifier or the explicit stdout/stdin guards there.
+// Pre-load exception: if an exception lands BEFORE server-main has wired
+// its classifier and connected the MCP transport, swallowing it would leave
+// a half-initialised process that neither serves requests nor exits — the
+// supervisor would never restart. server-main sets
+// globalThis.__mixdogServerReady = true immediately after server.connect();
+// any uncaught seen before that flag must exit(1) so the supervisor
+// respawns. Once ready, fall through to soft-net (server-main classifies).
+process.on('uncaughtException', (err) => {
+  try {
+    const __crashLog = path.join(__runtimeRoot, 'crash.log')
+    fs.appendFileSync(__crashLog, `[${new Date().toISOString()}] uncaughtException pid=${process.pid}: ${err && (err.stack || err.message || err)}\n`)
+  } catch {}
+  try { process.stderr.write(`[server.mjs] uncaughtException: ${err && (err.stack || err.message || err)}\n`) } catch {}
+  if (!globalThis.__mixdogServerReady) {
+    try { process.stderr.write(`[server.mjs] uncaughtException before server ready — exiting for supervisor restart\n`) } catch {}
+    process.exit(1)
+  }
+})
+// unhandledRejection is ALWAYS log-only (soft-net), even pre-ready. Many
+// pre-ready code paths use fire-and-forget imports / IPC dispatch that can
+// transiently reject; exiting on those would cause supervisor restart
+// loops during normal boot. Only uncaughtException keeps the pre-ready
+// exit(1) gate above — that path indicates a synchronous throw with no
+// promise owner, which truly cannot be recovered.
+process.on('unhandledRejection', (reason) => {
+  try {
+    const __crashLog = path.join(__runtimeRoot, 'crash.log')
+    fs.appendFileSync(__crashLog, `[${new Date().toISOString()}] unhandledRejection pid=${process.pid}: ${reason && (reason.stack || reason.message || reason)}\n`)
+  } catch {}
+  try { process.stderr.write(`[server.mjs] unhandledRejection: ${reason && (reason.stack || reason.message || reason)}\n`) } catch {}
+})
+
+const _releaseLock = () => {
+  try {
+    const raw = fs.readFileSync(LOCK_PATH, 'utf-8').trim()
+    if (Number.parseInt(raw, 10) === process.pid) fs.unlinkSync(LOCK_PATH)
+  } catch {}
+  // Clean up active-instance.json if we own it (graceful shutdown is
+  // normally handled by channels' clearActiveInstance; this guards crash / early-exit cases).
+  try {
+    const __af = path.join(__runtimeRoot, 'active-instance.json')
+    const cur = JSON.parse(fs.readFileSync(__af, 'utf-8'))
+    const curServerPid = __parsePositivePid(cur?.server_pid)
+    if (cur && (cur.instanceId === String(process.pid) || curServerPid === process.pid)) fs.unlinkSync(__af)
+  } catch {}
+}
+process.on('exit', _releaseLock)
+// Do NOT call process.exit() directly on SIGTERM/SIGINT — that preempts the
+// graceful shutdown chain in server-main.mjs (worker ACK, etc.).
+// _releaseLock is registered on 'exit' above so it always runs; the signal
+// handlers here just ensure the lock file is released even when server-main's
+// shutdown() calls process.exit(), which itself fires 'exit'. SIGHUP/SIGBREAK
+// are non-standard on Windows; keep them as exit-only guards.
+for (const sig of ['SIGHUP', 'SIGBREAK']) {
+  try { process.on(sig, () => { _releaseLock(); process.exit(0) }) } catch {}
+}
+// SIGTERM and SIGINT: let server-main's handlers own graceful shutdown.
+// _releaseLock fires automatically via 'exit' when server-main calls process.exit().
+
+// ── Graceful supervisor-control shutdown (fd-3) ──────────────────
+// Supervisor (run-mcp.mjs) sends "shutdown\n" or closes fd-3 to request
+// graceful shutdown. fd-3 is dedicated to lifecycle control and is
+// independent of MCP stdio transport — so transient stdin events from
+// the MCP host can never trigger shutdown. Registered before
+// server-main loads so no boot window is missed; server-main re-reads
+// __mixdogSupervisorShutdownRequested when its shutdown() is wired.
+const SUPERVISOR_CONTROL_FD = Number(process.env.MIXDOG_SUPERVISOR_CONTROL_FD || '0') || 0;
+if (SUPERVISOR_CONTROL_FD > 0) {
+  try {
+    const ctrl = fs.createReadStream(null, { fd: SUPERVISOR_CONTROL_FD });
+    ctrl.setEncoding('utf8');
+    let ctrlBuf = '';
+    const fire = () => {
+      if (typeof globalThis.__mixdogShutdownFromSupervisor === 'function') {
+        globalThis.__mixdogShutdownFromSupervisor();
+      } else {
+        globalThis.__mixdogSupervisorShutdownRequested = true;
+      }
+    };
+    ctrl.on('data', (chunk) => {
+      ctrlBuf += chunk;
+      if (ctrlBuf.includes('shutdown')) fire();
+    });
+    ctrl.on('end', fire);
+    // Swallow stream errors so the supervisor stays up; control fd errors
+    // are non-fatal — graceful shutdown will still arrive via SIGTERM/SIGINT.
+    ctrl.on('error', () => {});
+  } catch (e) {
+    process.stderr.write(`[server.mjs] supervisor control fd setup failed: ${e && e.message}\n`);
+  }
+}
+
+// ── Preload/refresh active-instance.json when safe ──────────────────
+// Same schema as channels' buildActiveInstanceState. instanceId follows
+// makeInstanceId() = String(pid). (Sanitize regex /[^a-zA-Z0-9._-]/g
+// is a no-op for numeric PIDs.)
+const __activeDir = __runtimeRoot
+fs.mkdirSync(__activeDir, { recursive: true })
+const __activeFile = path.join(__activeDir, 'active-instance.json')
+const __instanceId = String(process.pid)
+const __multiInstanceMode = process.env.MIXDOG_MULTI_INSTANCE === '1'
+const __renameRetryCodes = new Set(['EPERM', 'EBUSY', 'EACCES', 'EEXIST'])
+function __sleepSync(ms) {
+  try { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms) }
+  catch {
+    const deadline = Date.now() + ms
+    while (Date.now() < deadline) {}
+  }
+}
+function __renameSyncWithRetry(src, dest) {
+  const waits = [20, 50, 100, 200, 400, 800]
+  for (let i = 0; i <= waits.length; i++) {
+    try {
+      fs.renameSync(src, dest)
+      return
+    } catch (err) {
+      if (!__renameRetryCodes.has(err?.code) || i === waits.length) throw err
+      __sleepSync(waits[i])
+    }
+  }
+}
+
+// Split-brain guard. In single-instance mode, server.lock proves we are the
+// owner and this prelude may refresh active-instance.json. In multi-instance
+// mode, server.lock is intentionally skipped, so the prelude must not create
+// or steal ownership; channels' ownership loop is the only writer that may
+// claim a new active owner.
+let __shouldWriteActiveInstance = !__multiInstanceMode
+try {
+  if (fs.existsSync(__activeFile)) {
+    const prev = JSON.parse(fs.readFileSync(__activeFile, 'utf-8'))
+    const prevOwnerPid = __parsePositivePid(prev?.ownerLeadPid)
+      ?? __parsePositivePid(prev?.terminalLeadPid)
+      ?? __parsePositivePid(prev?.supervisor_pid)
+      ?? __parsePositivePid(prev?.instanceId)
+    let prevOwnerLive = false
+    if (prevOwnerPid) {
+      try { process.kill(prevOwnerPid, 0); prevOwnerLive = true }
+      catch (err) { prevOwnerLive = err?.code === 'EPERM' }
+    }
+    if (__multiInstanceMode) {
+      __shouldWriteActiveInstance = prevOwnerPid === __ownerLeadPid
+      if (!__shouldWriteActiveInstance && prevOwnerPid && prevOwnerLive) {
+        process.stderr.write(
+          `[server] active owner lead=${prevOwnerPid} is live; ` +
+          `starting standby lead=${__ownerLeadPid} without overwriting active-instance.json\n`
+        )
+      }
+    } else if (prevOwnerPid && prevOwnerPid !== __ownerLeadPid && prevOwnerLive) {
+      process.stderr.write(
+        `[server] split-brain warning: active-instance.json points to live owner PID ${prevOwnerPid} ` +
+        `but server.lock is ours — overwriting\n`
+      )
+    }
+  }
+} catch {
+  // Malformed active-instance.json should not let a multi-instance prelude
+  // seize ownership. channels will treat it as unreadable and claim only if
+  // this terminal is actually a channel owner.
+  __shouldWriteActiveInstance = !__multiInstanceMode
+}
+
+const __nowMs = Date.now()
+if (__shouldWriteActiveInstance) {
+  // Atomic write: write to .tmp then rename so readers never observe partial JSON.
+  // POSIX rename is atomic per directory entry; on Windows fs.renameSync uses
+  // MoveFileEx with REPLACE_EXISTING which is atomic-equivalent for same-volume.
+  const __activeTmp = `${__activeFile}.${process.pid}.tmp`
+  // B1: read-modify-write so pg_* fields written by supervisor-pg.mjs survive
+  // the initial prelude write. Spread order: cur first so new fields win.
+  const __curActive = (() => { try { return JSON.parse(fs.readFileSync(__activeFile, 'utf-8')) } catch { return {} } })()
+  // Strip stale field names written by older server versions; no callers — destructured to discard only.
+  const { pid: _legacyPid, startedAt: _legacyStartedAt, httpPort: _legacyHttpPort, ...__curActiveRest } = __curActive ?? {}
+  fs.writeFileSync(__activeTmp, JSON.stringify({
+    ...__curActiveRest,
+    instanceId: __instanceId,
+    ownerLeadPid: __ownerLeadPid,
+    terminalLeadPid: __ownerLeadPid,
+    supervisor_pid: __ownerLeadPid,
+    server_pid: process.pid,
+    supervisor_started_at: __nowMs,
+    updatedAt: __nowMs,
+    turnEndFile: path.join(__activeDir, `turn-end-${__instanceId}`),
+    statusFile: path.join(__activeDir, `status-${__instanceId}.json`),
+    backendReady: false,
+    bootPhase: 'prelude',
+  }))
+  __renameSyncWithRetry(__activeTmp, __activeFile)
+}
+
+// ── Supervisor cache-version advert ────────────────────────────────
+// dev-sync reads this to know which cache version is in active use without
+// having to introspect supervisor cmdline. Lives in server.mjs (not the
+// proxy supervisor run-mcp.mjs) so future updates land via child-only
+// restart and never sever the stdio bridge. Validity is verified at read
+// time (pid alive + cacheDir exists) so a stale file from a dead supervisor
+// is naturally rejected — no explicit cleanup required.
+//
+// run-mcp.mjs passes its identity (pid + cacheDir) via env vars at spawn.
+// If they're missing (e.g. someone runs server.mjs standalone without the
+// supervisor wrapper), skip — there's no supervisor to advertise.
+try {
+  const _supPid = Number(process.env.MIXDOG_SUPERVISOR_PID)
+  const _supCacheDir = process.env.MIXDOG_SUPERVISOR_CACHE_DIR
+  if (Number.isFinite(_supPid) && _supPid > 0 && _supCacheDir) {
+    const _writeAdvert = (_file, _payload) => {
+      const _tmp = `${_file}.${process.pid}.${Date.now()}.tmp`
+      fs.writeFileSync(_tmp, JSON.stringify(_payload))
+      __renameSyncWithRetry(_tmp, _file)
+    }
+    const _readAdvert = (_file) => {
+      try { return JSON.parse(fs.readFileSync(_file, 'utf8')) } catch { return null }
+    }
+    const _advertFile = path.join(__activeDir, 'supervisor-advert.json')
+    const _advertByPidFile = path.join(__activeDir, `supervisor-advert.${_supPid}.json`)
+    const _advertIndexFile = path.join(__activeDir, 'supervisor-adverts.json')
+    const _supVer = (() => {
+      try { return JSON.parse(fs.readFileSync(path.join(_supCacheDir, '.claude-plugin', 'plugin.json'), 'utf8')).version }
+      catch { return null }
+    })()
+    const _record = {
+      pid: _supPid,
+      ownerLeadPid: _supPid,
+      serverPid: process.pid,
+      cacheDir: _supCacheDir,
+      version: _supVer,
+      startedAt: __nowMs,
+      updatedAt: Date.now(),
+    }
+    _writeAdvert(_advertFile, _record)
+    _writeAdvert(_advertByPidFile, _record)
+
+    const _recordsByPid = new Map()
+    for (const _ent of fs.readdirSync(__activeDir, { withFileTypes: true })) {
+      if (!_ent.isFile()) continue
+      const _name = _ent.name
+      if (!/^supervisor-advert(?:\.\d+)?\.json$/.test(_name)) continue
+      const _entry = _readAdvert(path.join(__activeDir, _name))
+      const _pid = __parsePositivePid(_entry?.ownerLeadPid) ?? __parsePositivePid(_entry?.pid)
+      if (!_pid || !_isPidAlive(_pid) || !_entry?.cacheDir || !fs.existsSync(_entry.cacheDir)) {
+        if (_name !== 'supervisor-advert.json') {
+          try { fs.unlinkSync(path.join(__activeDir, _name)) } catch {}
+        }
+        continue
+      }
+      _recordsByPid.set(_pid, { ..._entry, pid: _pid, ownerLeadPid: _pid })
+    }
+    _recordsByPid.set(_supPid, _record)
+    const _supervisors = [..._recordsByPid.values()].sort((a, b) => Number(a.pid) - Number(b.pid))
+    _writeAdvert(_advertIndexFile, { updatedAt: Date.now(), supervisors: _supervisors })
+    if (_supervisors.length > 1) {
+      process.stderr.write(
+        `[server] multi-supervisor notice: active supervisors count=${_supervisors.length} ` +
+        `pids=${_supervisors.map(s => s.pid).join(',')}\n`
+      )
+    }
+  }
+} catch (e) {
+  process.stderr.write(`[server] supervisor advert write failed: ${e && e.message}\n`)
+}
+
+// ── Stale status-*.json sweep ──────────────────────────────────────
+// `status-${pid}.json` files outlive their owning supervisor when the
+// process exits without graceful shutdown (crash, SIGKILL, host reboot).
+// Without sweep they accumulate indefinitely and bloat list responses
+// over the runtime dir. Invariant: a status file is stale iff its PID
+// is no longer alive. Live-PID files belong to peer instances and are
+// left untouched. _isPidAlive is the same check used for server.lock.
+try {
+  const _entries = fs.readdirSync(__activeDir, { withFileTypes: true })
+  for (const _ent of _entries) {
+    if (!_ent.isFile()) continue
+    const _name = _ent.name
+    if (!_name.startsWith('status-') || !_name.endsWith('.json')) continue
+    const _pid = Number.parseInt(_name.slice(7, -5), 10)
+    if (!Number.isFinite(_pid) || _pid <= 0) continue
+    if (_isPidAlive(_pid)) continue
+    try { fs.unlinkSync(path.join(__activeDir, _name)) } catch {}
+  }
+} catch (e) {
+  process.stderr.write(`[server] stale status sweep failed: ${e && e.message}\n`)
+}
+
+// ── Bulk log rotation at boot ──────────────────────────────────────
+// Worker logs (drop-trace, memory-worker, channels-worker, mcp-debug,
+// webhook, schedule, event, statusline-trace, history/*.jsonl) outlive
+// the supervisor process and grow without bound; over time the append
+// fsync churn becomes the dominant background IO. Rotate each past
+// 5 MB by renaming to `.1` (single archive; subsequent boots overwrite
+// the archive). Invariant: rotation only at supervisor boot — worker
+// processes have not started yet so there is no append-collision
+// window.
+const LOG_ROTATE_THRESHOLD = 5 * 1024 * 1024
+const _logsToRotate = [
+  'drop-trace.log',
+  'memory-worker.log',
+  'channels-worker.log',
+  'mcp-debug.log',
+  'webhook.log',
+  'schedule.log',
+  'event.log',
+  'statusline-trace.log',
+  'history/model-profile.jsonl',
+]
+for (const _rel of _logsToRotate) {
+  try {
+    const _full = path.join(PLUGIN_DATA, _rel)
+    const _st = fs.statSync(_full)
+    if (_st.size > LOG_ROTATE_THRESHOLD) {
+      const _archive = _full + '.1'
+      try { fs.unlinkSync(_archive) } catch {}
+      fs.renameSync(_full, _archive)
+    }
+  } catch { /* missing or stat failure — skip */ }
+}
+// Also rotate scoped per-Lead-per-server mcp-debug.<lead>.<pid>.log files.
+// server-main.mjs emits these alongside the fixed mcp-debug.log; without
+// scoped rotation they grow unbounded across restarts of the same Lead.
+try {
+  for (const _ent of fs.readdirSync(PLUGIN_DATA, { withFileTypes: true })) {
+    if (!_ent.isFile()) continue
+    const _name = _ent.name
+    if (!/^mcp-debug\.\d+\.\d+\.log$/.test(_name)) continue
+    const _full = path.join(PLUGIN_DATA, _name)
+    try {
+      const _st = fs.statSync(_full)
+      if (_st.size > LOG_ROTATE_THRESHOLD) {
+        const _archive = _full + '.1'
+        try { fs.unlinkSync(_archive) } catch {}
+        fs.renameSync(_full, _archive)
+      }
+    } catch {}
+  }
+} catch { /* readdir failed — skip */ }
+
+// ── Enter the main server ───────────────────────────────────────────
+await import('./server-main.mjs')