@lensmcp/cluster 1.13.0 → 1.15.0

package/executors/gateway/runtime/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lifecycle.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAIrD,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IAChC,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CAsIvF"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lifecycle.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA0BrD,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IAChC,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CAuIvF"}

package/executors/gateway/runtime/lifecycle.js

@@ -12,6 +12,30 @@ const fs = tslib_1.__importStar(require("node:fs"));
 const http = tslib_1.__importStar(require("node:http"));
 const path = tslib_1.__importStar(require("node:path"));
 const discovery_1 = require("./discovery");
+const service_keys_1 = require("./service-keys");
+/**
+ * The east-west env a pod needs to call ANOTHER service's `internal.<host>` route (memberships, settings,
+ * plan): (1) its OWN per-service key — presented as `x-api-key`; the gateway maps it back to the caller and
+ * stamps `x-api-key-id` (a service can't forge another's identity). (2) `NODE_EXTRA_CA_CERTS` = the dev
+ * gateway's self-signed CA, so the pod's OUTBOUND `fetch('https://internal.<host>')` clears TLS. Without
+ * these the call fails (connect/TLS or a gateway 401) and tenant-token minting can't resolve the role.
+ * NOT `INTERNAL_API_KEY`/`LENSMCP_INTERNAL_TOKEN` (those would flip ON the inbound gateway-trust guard) —
+ * a DEDICATED name a service opts into for OUTBOUND only, leaving inbound dev-standalone behavior unchanged.
+ */
+function eastWestEnv(rt, project) {
+    const env = {};
+    const key = rt.serviceKeys[project];
+    if (key)
+        env.LENSMCP_SERVICE_KEY = key;
+    if (rt.https) {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports -- lazy like server.ts (cert deps)
+        const basicSsl = require('../../../basic-ssl');
+        const caPath = basicSsl.caCertPath((0, service_keys_1.gatewayCacheDir)(rt.root));
+        if (fs.existsSync(caPath))
+            env.NODE_EXTRA_CA_CERTS = caPath;
+    }
+    return env;
+}
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function createServiceLayer(rt, obs) {
     const { emit } = obs;
@@ -35,8 +59,9 @@ function createServiceLayer(rt, obs) {
             // daemon (a DIFFERENT group), so the later process-group kill reaps only
             // the `yarn nx` shim and orphans the devserver + pod tree — the classic
             // "idle-kill leaves live pods" leak. (--childCount as a CLI arg already
-            // avoids the env-loss the daemon was relied on for.)
-            env: { ...process.env, NX_DAEMON: 'false' },
+            // avoids the env-loss the daemon was relied on for.) NX_DAEMON=false also
+            // means env vars DO reach the pod, so the east-west key + CA propagate.
+            env: { ...process.env, NX_DAEMON: 'false', ...eastWestEnv(rt, svc.project) },
             stdio: ['ignore', 'pipe', 'pipe'],
         });
         svc.lastErrors = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/cluster",
-  "version": "1.13.0",
+  "version": "1.15.0",
   "description": "Run your Nx workspace as a local production cluster: pods on unix sockets with true HMR, one https gateway with per-project domains, scale-from-zero, autoscale, idle-kill, local-CA TLS — observed by the LensMCP lens.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -65,8 +65,8 @@
     }
   },
   "dependencies": {
-    "@lensmcp/node-instrumentation": "1.13.0",
-    "@lensmcp/nx-plugin": "1.13.0",
+    "@lensmcp/node-instrumentation": "1.15.0",
+    "@lensmcp/nx-plugin": "1.15.0",
     "fork-ts-checker-webpack-plugin": "^9.0.0",
     "glob": "^11.0.0",
     "http-proxy": "^1.18.0",