@lensmcp/cluster 1.0.0

package/executors/trust/trust.impl.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = trustExecutor;
+exports.collectHosts = collectHosts;
+const tslib_1 = require("tslib");
+const node_child_process_1 = require("node:child_process");
+const fs = tslib_1.__importStar(require("node:fs"));
+const path = tslib_1.__importStar(require("node:path"));
+const basic_ssl_1 = require("../../basic-ssl");
+/**
+ * `trust` executor — one idempotent command that makes the HTTPS dev gateway
+ * green in real browsers:
+ *
+ *   1. mints the local dev CA if missing (same CA the gateway serves),
+ *   2. adds it ONCE to the macOS System keychain (`sudo security
+ *      add-trusted-cert`) — every leaf rotation / new hostname then chains
+ *      to it with no interstitial,
+ *   3. writes BOTH `/etc/hosts` families (`127.0.0.1` + `::1`) for every
+ *      gateway route hostname — the missing `::1` line is what sends `.local`
+ *      AAAA lookups to Bonjour/mDNS and costs ~5s per resolution,
+ *   4. flushes the DNS cache.
+ *
+ * Hostnames come from the project's serve target gateway routes (wildcards
+ * skipped — they can't live in /etc/hosts) plus any `hosts` option extras.
+ * Run it from a terminal: sudo prompts for your password inline.
+ */
+async function trustExecutor(options, context) {
+    const cacheDir = path.join(context.root, 'node_modules', '.cache', 'davnx-webpack');
+    const caPath = (0, basic_ssl_1.ensureCaSync)(cacheDir);
+    const hosts = collectHosts(options, context);
+    if (hosts.length === 0) {
+        console.log('[trust] no concrete hostnames found (only wildcards?) — keychain step only.');
+    }
+    if (process.platform !== 'darwin') {
+        console.log('[trust] non-macOS platform — do these manually:');
+        console.log(`  • trust ${caPath} in your OS/browser store (Linux: update-ca-certificates / certutil)`);
+        for (const h of hosts)
+            console.log(`  • /etc/hosts: "127.0.0.1 ${h}" and "::1 ${h}"`);
+        return { success: true };
+    }
+    // --- 1) CA into the System keychain (skip when already there) -----------
+    const present = (0, node_child_process_1.spawnSync)('security', ['find-certificate', '-c', 'davnx local dev CA', '/Library/Keychains/System.keychain'], {
+        stdio: 'ignore',
+    }).status === 0;
+    if (present) {
+        console.log('[trust] CA already in the System keychain — skipping.');
+    }
+    else {
+        console.log(`[trust] adding CA to the System keychain (sudo will prompt): ${caPath}`);
+        const r = (0, node_child_process_1.spawnSync)('sudo', ['security', 'add-trusted-cert', '-d', '-r', 'trustRoot', '-k', '/Library/Keychains/System.keychain', caPath], { stdio: 'inherit' });
+        if (r.status !== 0) {
+            console.error('[trust] add-trusted-cert failed — rerun in a terminal so sudo can prompt.');
+            return { success: false };
+        }
+        console.log('[trust] CA trusted. Restart your browser once (it caches certificate verdicts).');
+    }
+    // --- 2) /etc/hosts: both address families per hostname ------------------
+    const etcHosts = fs.readFileSync('/etc/hosts', 'utf8');
+    const hasEntry = (ip, host) => etcHosts.split('\n').some((line) => {
+        const t = line.trim();
+        if (t.startsWith('#'))
+            return false;
+        const cols = t.split(/\s+/);
+        return cols[0] === ip && cols.slice(1).includes(host);
+    });
+    const missing = [];
+    for (const h of hosts) {
+        if (!hasEntry('127.0.0.1', h))
+            missing.push(`127.0.0.1 ${h}`);
+        if (!hasEntry('::1', h))
+            missing.push(`::1 ${h}`);
+    }
+    if (missing.length === 0) {
+        console.log('[trust] /etc/hosts already complete (both families for every hostname).');
+    }
+    else {
+        console.log(`[trust] appending to /etc/hosts (sudo):\n  ${missing.join('\n  ')}`);
+        const script = `printf '%s\\n' ${missing.map((l) => `'${l}'`).join(' ')} >> /etc/hosts`;
+        const r = (0, node_child_process_1.spawnSync)('sudo', ['sh', '-c', script], { stdio: 'inherit' });
+        if (r.status !== 0) {
+            console.error('[trust] /etc/hosts update failed.');
+            return { success: false };
+        }
+        // --- 3) flush DNS so the new entries take effect immediately ----------
+        (0, node_child_process_1.spawnSync)('sudo', ['sh', '-c', 'dscacheutil -flushcache; killall -HUP mDNSResponder'], { stdio: 'inherit' });
+    }
+    // --- 4) verify ------------------------------------------------------------
+    const verify = (0, node_child_process_1.spawnSync)('security', ['verify-cert', '-c', caPath, '-p', 'basic'], { stdio: 'ignore' });
+    console.log(`[trust] CA trust check: ${verify.status === 0 ? 'OK' : 'NOT TRUSTED YET (browser restart may be needed)'}`);
+    for (const h of hosts) {
+        console.log(`[trust] ${h} → https ready (hosts + cert SAN ride the gateway config)`);
+    }
+    return { success: true };
+}
+function collectHosts(options, context) {
+    const found = [];
+    // 1) This project's embedded gateway routes (single-service setups).
+    const project = context.projectName
+        ? context.projectsConfigurations?.projects[context.projectName]
+        : undefined;
+    const serveTarget = options.serveTarget ?? 'serve-hmr';
+    const routes = project?.targets?.[serveTarget]?.options?.gateway?.routes ?? [];
+    for (const r of routes) {
+        if (r.host && !r.host.includes('*'))
+            found.push(r.host);
+    }
+    // 2) Every project's `davnx` declaration — the workspace gateway picture.
+    for (const p of Object.values(context.projectsConfigurations?.projects ?? {})) {
+        try {
+            const raw = JSON.parse(fs.readFileSync(path.join(context.root, p.root, 'project.json'), 'utf8'));
+            const decl = raw.cluster ?? raw.davnx;
+            const h = decl?.host;
+            if (h && !h.includes('*')) {
+                found.push(h);
+                // socket-pool services also get internal.<host> (east-west, no middleware)
+                if (decl?.service && decl.internalHost !== false) {
+                    found.push(typeof decl.internalHost === 'string' ? decl.internalHost : `internal.${h}`);
+                }
+            }
+        }
+        catch {
+            /* projects without a project.json (package.json-inferred) — skip */
+        }
+    }
+    return [...new Set([...found, ...(options.hosts ?? [])])];
+}

package/executors.json

@@ -0,0 +1,24 @@
+{
+  "executors": {
+    "build": {
+      "implementation": "./src/executors/build/build.impl",
+      "schema": "./src/executors/build/schema.json",
+      "description": "Production webpack build for a NestJS application."
+    },
+    "serve": {
+      "implementation": "./src/executors/serve/serve.impl",
+      "schema": "./src/executors/serve/schema.json",
+      "description": "Webpack watch mode with integrated devserver for a NestJS application."
+    },
+    "trust": {
+      "implementation": "./src/executors/trust/trust.impl",
+      "schema": "./src/executors/trust/schema.json",
+      "description": "One-time HTTPS dev setup: trust the davnx local CA + write /etc/hosts entries for gateway hostnames (idempotent, sudo prompts inline)."
+    },
+    "gateway": {
+      "implementation": "./src/executors/gateway/gateway.impl",
+      "schema": "./src/executors/gateway/schema.json",
+      "description": "Workspace https front door: reads every project davnx declaration (host/port/prefix), routes by hostname, serves the local-CA cert with all SANs."
+    }
+  }
+}

package/index.d.ts

@@ -0,0 +1,4 @@
+export { type NodeExternalsConfig, type ScopePatterns, buildScopePatterns } from './build-scope-patterns';
+export { createDevWebpackConfig, type DevWebpackOptions } from './create-webpack-dev';
+export { createProdWebpackConfig, type ProdWebpackOptions } from './create-webpack-prod';
+//# sourceMappingURL=index.d.ts.map

package/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../libs/cluster/src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,aAAa,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC1G,OAAO,EAAE,sBAAsB,EAAE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAE,uBAAuB,EAAE,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC"}

package/index.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createProdWebpackConfig = exports.createDevWebpackConfig = exports.buildScopePatterns = void 0;
+var build_scope_patterns_1 = require("./build-scope-patterns");
+Object.defineProperty(exports, "buildScopePatterns", { enumerable: true, get: function () { return build_scope_patterns_1.buildScopePatterns; } });
+var create_webpack_dev_1 = require("./create-webpack-dev");
+Object.defineProperty(exports, "createDevWebpackConfig", { enumerable: true, get: function () { return create_webpack_dev_1.createDevWebpackConfig; } });
+var create_webpack_prod_1 = require("./create-webpack-prod");
+Object.defineProperty(exports, "createProdWebpackConfig", { enumerable: true, get: function () { return create_webpack_prod_1.createProdWebpackConfig; } });

package/main.devserver.d.ts

@@ -0,0 +1,16 @@
+export interface GatewayRoute {
+    /** Hostname to match — exact (`api.tetros.localhost`) or wildcard (`*.tetros.localhost`). */
+    host?: string;
+    /** URL prefix to match (e.g. `/api`). */
+    prefix?: string;
+    /** Proxy destination (e.g. `http://localhost:5173`). Omit → this service's children. */
+    target?: string;
+    /**
+     * Prepend this to the forwarded URL. The prod-parity case: the app mounts
+     * at `/api` but the dev domain `api.tetros.ai.local` should serve it at
+     * the ROOT (like prod `api.tetros.ai`) — `prependPrefix: '/api'` rewrites
+     * `/tenants/...` → `/api/tenants/...` on the way to the children.
+     */
+    prependPrefix?: string;
+}
+//# sourceMappingURL=main.devserver.d.ts.map

package/main.devserver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.devserver.d.ts","sourceRoot":"","sources":["../../../libs/cluster/src/main.devserver.ts"],"names":[],"mappings":"AA8EA,MAAM,WAAW,YAAY;IAC3B,6FAA6F;IAC7F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB"}