@lensmcp/cluster 1.16.12 → 1.16.13

package/basic-ssl.d.ts

@@ -1,4 +1,4 @@
-export declare const CA_CERT_FILE = "davnx-local-ca.crt";
+export declare const CA_CERT_FILE = "lensmcp-local-ca.crt";
 export declare function getCertificateSync(cacheDir: string, name?: string, domains?: string[]): string;
 /** Absolute path of the trust-once CA certificate inside `cacheDir`. */
 export declare function caCertPath(cacheDir: string): string;

package/basic-ssl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"basic-ssl.d.ts","sourceRoot":"","sources":["../../../libs/cluster/src/basic-ssl.ts"],"names":[],"mappings":"AA6BA,eAAO,MAAM,YAAY,uBAAuB,CAAC;AAGjD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,SAAc,EAAE,OAAO,GAAE,MAAM,EAAO,GAAG,MAAM,CAoCvG;AAED,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMrD"}
+{"version":3,"file":"basic-ssl.d.ts","sourceRoot":"","sources":["../../../libs/cluster/src/basic-ssl.ts"],"names":[],"mappings":"AA6BA,eAAO,MAAM,YAAY,yBAAyB,CAAC;AAKnD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,SAAgB,EAAE,OAAO,GAAE,MAAM,EAAO,GAAG,MAAM,CAoCzG;AAED,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMrD"}

package/basic-ssl.js

@@ -20,7 +20,7 @@ const tslib_1 = require("tslib");
  *
  * Trust once (macOS):
  *   sudo security add-trusted-cert -d -r trustRoot \
- *     -k /Library/Keychains/System.keychain <cacheDir>/davnx-local-ca.crt
+ *     -k /Library/Keychains/System.keychain <cacheDir>/lensmcp-local-ca.crt
  */
 const crypto = tslib_1.__importStar(require("node:crypto"));
 const fs = tslib_1.__importStar(require("node:fs"));
@@ -30,9 +30,11 @@ const LEAF_MAX_AGE_MS = 25 * 24 * 60 * 60 * 1000;
 /** CA lifetime (~10 years) and the remaining-validity floor for reuse. */
 const CA_TTL_DAYS = 3650;
 const CA_MIN_REMAINING_MS = 30 * 24 * 60 * 60 * 1000;
-exports.CA_CERT_FILE = 'davnx-local-ca.crt';
+exports.CA_CERT_FILE = 'lensmcp-local-ca.crt';
+/** The legacy (pre-rebrand) CA filename — swept on mint so a stale `davnx-local-ca.crt` never lingers. */
+const LEGACY_CA_CERT_FILE = 'davnx-local-ca.crt';
 const CA_KEY_FILE = '_ca-key.pem';
-function getCertificateSync(cacheDir, name = 'davnx.dev', domains = []) {
+function getCertificateSync(cacheDir, name = 'lensmcp.dev', domains = []) {
     // The SAN set is part of the cache key: adding a gateway hostname must
     // mint a fresh leaf, not serve a cached one that lacks the new SAN.
     const sanKey = crypto
@@ -104,8 +106,8 @@ function loadOrCreateCa(cacheDir, forge) {
     cert.validity.notAfter = new Date();
     cert.validity.notAfter.setDate(cert.validity.notAfter.getDate() + CA_TTL_DAYS);
     const attrs = [
-        { name: 'commonName', value: 'davnx local dev CA' },
-        { name: 'organizationName', value: 'davnx' },
+        { name: 'commonName', value: 'lensmcp local dev CA' },
+        { name: 'organizationName', value: 'lensmcp' },
         { shortName: 'OU', value: 'dev' },
     ];
     cert.setSubject(attrs);
@@ -118,6 +120,17 @@ function loadOrCreateCa(cacheDir, forge) {
     cert.sign(keys.privateKey, forge.md.sha256.create());
     fs.writeFileSync(certPath, forge.pki.certificateToPem(cert));
     fs.writeFileSync(keyPath, forge.pki.privateKeyToPem(keys.privateKey), { mode: 0o600 });
+    // A freshly-minted CA invalidates every cached LEAF (they were signed by the OLD CA) — sweep them so the
+    // next getCertificateSync re-mints against THIS CA (otherwise the SAN-keyed leaf cache serves a stale,
+    // old-CA-signed cert). Also drop the legacy `davnx-local-ca.crt` so the lensmcp rebrand leaves nothing behind.
+    for (const f of fs.readdirSync(cacheDir)) {
+        if (/^_leaf-.*\.pem$/.test(f) || f === LEGACY_CA_CERT_FILE) {
+            try {
+                fs.unlinkSync(path.join(cacheDir, f));
+            }
+            catch { /* best effort */ }
+        }
+    }
     return { cert, key: keys.privateKey };
 }
 function createLeafCertificate(forge, ca, name, domains, ttlDays = 30) {
@@ -130,7 +143,7 @@ function createLeafCertificate(forge, ca, name, domains, ttlDays = 30) {
     cert.validity.notAfter.setDate(cert.validity.notAfter.getDate() + ttlDays);
     cert.setSubject([
         { name: 'commonName', value: name },
-        { name: 'organizationName', value: 'davnx' },
+        { name: 'organizationName', value: 'lensmcp' },
         { shortName: 'OU', value: 'dev' },
     ]);
     cert.setIssuer(ca.cert.subject.attributes);

package/executors/gateway/runtime/control.d.ts

@@ -0,0 +1,20 @@
+import type { GatewayRuntime } from './types';
+import type { WorkspaceFragment } from './route-registry';
+/** `~/.lensmcp/control.sock` — the well-known daemon control socket (override the home via `LENSMCP_HOME`). */
+export declare function controlSocketPath(): string;
+export interface ControlServerDeps {
+    rt: GatewayRuntime;
+    /** Reap a fragment's spawned devservers when it unregisters (the svcLayer's `killSpawned`). */
+    killService: (svc: WorkspaceFragment['services'][number], reason: string) => void;
+    /** Hooks so the daemon can host/tear-down a workspace's dashboard around the route merge (P3d). */
+    onRegister?: (fragment: WorkspaceFragment) => void;
+    onUnregister?: (fragment: WorkspaceFragment) => void;
+}
+export interface ControlServer {
+    socketPath: string;
+    close: () => void;
+}
+/** Start the control listener. The socket is loopback-only (a filesystem socket), so no IP allow-listing
+ *  is needed — anything that can open it is already on this machine as this user. */
+export declare function startControlServer(deps: ControlServerDeps): ControlServer;
+//# sourceMappingURL=control.d.ts.map

package/executors/gateway/runtime/control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/control.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,+GAA+G;AAC/G,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,cAAc,CAAC;IACnB,+FAA+F;IAC/F,WAAW,EAAE,CAAC,GAAG,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAClF,mGAAmG;IACnG,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACnD,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAsBD;qFACqF;AACrF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CA2DzE"}

package/executors/gateway/runtime/control.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.controlSocketPath = controlSocketPath;
+exports.startControlServer = startControlServer;
+const tslib_1 = require("tslib");
+/**
+ * The daemon CONTROL PLANE (planning/multi-workspace-gateway.md P3, model A). A UNIX-socket HTTP listener
+ * at `~/.lensmcp/control.sock` — loopback-only by nature (a filesystem socket, no TCP), so a second
+ * workspace's `gateway start` (P4) REGISTERS its fragment into the running `:443` daemon instead of
+ * fighting for the port. The daemon reconstructs the fragment via `discoverRoutes` on the second
+ * workspace's root (so it owns the pool controllers + spawns those devservers itself — model A), merges
+ * the routes live, and reaps them on unregister.
+ *
+ *   POST /register    { wsKey, root, projects }  → discover + register + rebuild
+ *   POST /unregister  { wsKey }                  → unregister + reap its services + rebuild
+ *   GET  /list                                   → the registered workspaces
+ */
+const fs = tslib_1.__importStar(require("node:fs"));
+const http = tslib_1.__importStar(require("node:http"));
+const os = tslib_1.__importStar(require("node:os"));
+const path = tslib_1.__importStar(require("node:path"));
+const discovery_1 = require("./discovery");
+/** `~/.lensmcp/control.sock` — the well-known daemon control socket (override the home via `LENSMCP_HOME`). */
+function controlSocketPath() {
+    const home = process.env['LENSMCP_HOME'] || os.homedir();
+    return path.join(home, '.lensmcp', 'control.sock');
+}
+function readJsonBody(req) {
+    return new Promise((resolve, reject) => {
+        let raw = '';
+        req.on('data', (c) => {
+            raw += c;
+            if (raw.length > 1_000_000)
+                reject(new Error('body too large')); // bound the loopback input
+        });
+        req.on('end', () => {
+            try {
+                resolve(raw ? JSON.parse(raw) : {});
+            }
+            catch (e) {
+                reject(e);
+            }
+        });
+        req.on('error', reject);
+    });
+}
+/** Start the control listener. The socket is loopback-only (a filesystem socket), so no IP allow-listing
+ *  is needed — anything that can open it is already on this machine as this user. */
+function startControlServer(deps) {
+    const { rt } = deps;
+    const socketPath = controlSocketPath();
+    fs.mkdirSync(path.dirname(socketPath), { recursive: true });
+    try {
+        fs.unlinkSync(socketPath);
+    }
+    catch { /* no stale socket to clear */ }
+    const send = (res, code, body) => {
+        res.writeHead(code, { 'content-type': 'application/json' });
+        res.end(JSON.stringify(body));
+    };
+    const server = http.createServer((req, res) => {
+        void (async () => {
+            try {
+                const url = (req.url ?? '').split('?')[0];
+                if (req.method === 'GET' && url === '/list') {
+                    return send(res, 200, {
+                        workspaces: rt.registry.keys().map((key) => {
+                            const f = rt.registry.get(key);
+                            return { key, root: f?.root, routes: f?.routes.length ?? 0, services: f?.services.length ?? 0 };
+                        }),
+                    });
+                }
+                if (req.method === 'POST' && url === '/register') {
+                    const body = (await readJsonBody(req));
+                    if (!body.wsKey || !body.root)
+                        return send(res, 400, { error: 'wsKey and root are required' });
+                    const { routes, services } = (0, discovery_1.discoverRoutes)(body.root, body.projects ?? {}, undefined, body.wsKey);
+                    const fragment = { wsKey: body.wsKey, root: body.root, routes, services };
+                    rt.registry.register(fragment);
+                    deps.onRegister?.(fragment); // hosts the dashboard + APPENDS its route to the fragment BEFORE the rebuild
+                    rt.rebuildRoutes();
+                    return send(res, 200, { ok: true, wsKey: body.wsKey, routes: routes.length, services: services.length, workspaces: rt.registry.keys() });
+                }
+                if (req.method === 'POST' && url === '/unregister') {
+                    const body = (await readJsonBody(req));
+                    if (!body.wsKey)
+                        return send(res, 400, { error: 'wsKey is required' });
+                    const dropped = rt.registry.unregister(body.wsKey);
+                    if (dropped) {
+                        for (const svc of dropped.services)
+                            deps.killService(svc, 'workspace unregistered');
+                        deps.onUnregister?.(dropped);
+                    }
+                    rt.rebuildRoutes();
+                    return send(res, 200, { ok: true, removed: !!dropped, workspaces: rt.registry.keys() });
+                }
+                send(res, 404, { error: 'not found' });
+            }
+            catch (e) {
+                send(res, 500, { error: e.message });
+            }
+        })();
+    });
+    server.listen(socketPath);
+    return {
+        socketPath,
+        close: () => {
+            server.close();
+            try {
+                fs.unlinkSync(socketPath);
+            }
+            catch { /* already gone */ }
+        },
+    };
+}

package/executors/gateway/runtime/discovery.js

@@ -75,7 +75,7 @@ wsKey = '') {
             if (decl.lens)
                 console.warn(`[gateway] ${name}: cluster.lens is ignored for pod (service) decls — backends are instrumented by serve-hmr.`);
             pool = { dir: sockDirFor(decl.service), socks: [], idx: -1, scannedAt: 0 };
-            svc = { project: name, decl, pool, state: 'down', lastUsed: Date.now(), inflight: 0, lastScaleAt: 0 };
+            svc = { project: name, decl, root: rootDir, wsKey, pool, state: 'down', lastUsed: Date.now(), inflight: 0, lastScaleAt: 0 };
             services.push(svc);
         }
         else if (decl.lens) {

package/executors/gateway/runtime/lens-children.d.ts

@@ -1,4 +1,5 @@
 import { type SpawnChild } from '@lensmcp/nx-plugin/lens-frontend';
+import type { WorkspaceFragment } from './route-registry';
 import type { GatewayRuntime, GatewayRuntimeOptions } from './types';
 import { type Observability } from './observability';
 export interface LensChildren {
@@ -6,6 +7,10 @@ export interface LensChildren {
     /** Boot the dashboard + MCP singletons and every `lens:true` app. Pushes the
      *  dashboard route onto `rt.routes` — MUST run before TLS SAN derivation. */
     bootSingletonsAndApps(): void;
+    /** Host a REGISTERED workspace's dashboard (P3d): spawn its dashboard child on its OWN events file + a
+     *  distinct port, append its `lensmcp.local/<key>` route to its fragment. Returns a reaper (kills the
+     *  child WITHOUT auto-heal respawn) for the daemon to call on unregister — or undefined if no bundle. */
+    hostWorkspaceDashboard(fragment: WorkspaceFragment): (() => void) | undefined;
     /** Reap all managed children (called from `stop()`). */
     reapAll(): void;
 }

package/executors/gateway/runtime/lens-children.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lens-children.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lens-children.ts"],"names":[],"mappings":"AAQA,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,kCAAkC,CAAC;AAI1C,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAgB,MAAM,SAAS,CAAC;AAQnF,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAM7E,MAAM,WAAW,YAAY;IAC3B,iBAAiB,EAAE,UAAU,CAAC;IAC9B;iFAC6E;IAC7E,qBAAqB,IAAI,IAAI,CAAC;IAC9B,wDAAwD;IACxD,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,qBAAqB,GAAG,YAAY,CAoKvH"}
+{"version":3,"file":"lens-children.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lens-children.ts"],"names":[],"mappings":"AAQA,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAgB,MAAM,SAAS,CAAC;AAQnF,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAM7E,MAAM,WAAW,YAAY;IAC3B,iBAAiB,EAAE,UAAU,CAAC;IAC9B;iFAC6E;IAC7E,qBAAqB,IAAI,IAAI,CAAC;IAC9B;;6GAEyG;IACzG,sBAAsB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IAC9E,wDAAwD;IACxD,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,qBAAqB,GAAG,YAAY,CA8MvH"}

package/executors/gateway/runtime/lens-children.js

@@ -1,14 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createLensChildren = createLensChildren;
+const tslib_1 = require("tslib");
 /**
  * Lens-mode managed children: the dashboard + MCP SINGLETONS (cluster-wide,
  * owned by the gateway), and each `lens:true` app's Vite + browser capture.
  * EVERY managed child AUTO-HEALS — restarted with exponential backoff when it
  * exits while the gateway is up — and a dead child NEVER kills the cluster.
  */
+const path = tslib_1.__importStar(require("node:path"));
 const node_child_process_1 = require("node:child_process");
-const manifest_1 = require("../manifest");
 const lens_frontend_1 = require("@lensmcp/nx-plugin/lens-frontend");
 const scope_1 = require("./scope");
 const workspace_registry_1 = require("./workspace-registry");
@@ -31,6 +32,12 @@ function createLensChildren(rt, obs, options) {
     // Per-project last-recycle time — the cooldown survives the kill→auto-heal→respawn (a new child handle).
     const viteRecycleAt = new Map();
     let lensSweeper;
+    // Per-workspace dashboard hosting (P3d): the current child by label, labels we've intentionally removed
+    // (so auto-heal does NOT respawn them on the reap kill), and the dashboard ports already in use (so two
+    // workspaces' dashboards get distinct ports).
+    const labeledChildren = new Map();
+    const removedLabels = new Set();
+    const usedDashboardPorts = new Set();
     // A `SpawnChild` over the gateway's managed-children array — the SAME shape `agent-dev` passes to
     // `spawnLensFrontend`. EVERY gateway-managed child AUTO-HEALS: the dashboard + MCP singletons AND each
     // `lens:true` vite app are restarted when they exit while the gateway is up, with exponential backoff.
@@ -44,6 +51,7 @@ function createLensChildren(rt, obs, options) {
         const spawnedAt = Date.now();
         const child = (0, node_child_process_1.spawn)(bin, args, { cwd: rt.root, env: { ...process.env, ...(env ?? {}) }, stdio: 'inherit' });
         lensChildren.push(child);
+        labeledChildren.set(label, child); // the CURRENT handle for this label (a per-workspace dashboard reap targets it)
         // Track a `lens:true` app's vite dev server (label 'vite') for the zombie recycle. Its `LENSMCP_PROJECT`
         // (set by lens-children when it spawns the frontend) names the app; a fresh respawn re-adds via this path.
         if (label === 'vite')
@@ -53,8 +61,8 @@ function createLensChildren(rt, obs, options) {
             if (idx >= 0)
                 lensChildren.splice(idx, 1); // drop the dead handle so stop() won't signal it
             viteChildren.delete(child); // the auto-heal respawn re-registers a fresh handle with a new spawnedAt
-            if (rt.stopped())
-                return; // the gateway is shutting down — do NOT resurrect
+            if (rt.stopped() || removedLabels.has(label))
+                return; // shutting down, or this workspace unregistered — do NOT resurrect
             const heal = lensHeal.get(label) ?? { attempts: 0 };
             if (Date.now() - spawnedAt >= HEAL_HEALTHY_MS)
                 heal.attempts = 0; // it was healthy → fresh budget
@@ -116,12 +124,15 @@ function createLensChildren(rt, obs, options) {
                 // gateway routes pass-through (matchRoute on the prefix; the proxy never strips).
                 const scope = (0, scope_1.readLensScope)(rt.root);
                 const dashboardPort = options.dashboardPort ?? scope.dashboardPort;
+                usedDashboardPorts.add(dashboardPort); // reserve the daemon's own dashboard port so a registered workspace's differs
                 const lensHost = options.lensHost ?? 'lensmcp.local';
                 const lensBase = scope.basePath; // e.g. /tetros
                 // Pushed BEFORE the cert SANs are derived (routes.map(r=>r.host)), so lensmcp.local
                 // auto-joins the TLS SANs. Run `gateway:trust` to add it to /etc/hosts.
-                rt.routes.push({ host: lensHost, prefix: lensBase, project: observability_1.LENS_DASHBOARD_PROJECT, target: `http://localhost:${dashboardPort}` });
-                (0, manifest_1.sortBySpecificity)(rt.routes);
+                // Add this workspace's dashboard route to ITS fragment (not straight to rt.routes) so it survives a
+                // registry rebuild when another workspace registers/unregisters, then rebuild the live merged table.
+                rt.registry.appendRoutes(rt.wsKey, [{ host: lensHost, prefix: lensBase, project: observability_1.LENS_DASHBOARD_PROJECT, target: `http://localhost:${dashboardPort}` }]);
+                rt.rebuildRoutes();
                 // Publish this workspace to the GLOBAL registry so the root chooser at `${lensHost}/` lists it
                 // (and marks it live while this gateway runs). Best-effort — a registry write never blocks serving.
                 (0, workspace_registry_1.registerWorkspace)({ key: scope.key, root: rt.root, base: lensBase, pid: process.pid, updatedAt: new Date().toISOString() });
@@ -176,6 +187,42 @@ function createLensChildren(rt, obs, options) {
         }
         startLensSweeper(); // watch the just-spawned lens vites for a stale-source-set zombie
     };
+    // P3d — host a REGISTERED workspace's dashboard: its OWN events file, a distinct port, and a
+    // `lensmcp.local/<key>` route on its fragment. The dashboard BUNDLE is the daemon's (rt.root); only the
+    // events file + base + port are the registered workspace's. Returns a reaper the control endpoint calls
+    // on unregister (marks the label removed so auto-heal won't respawn it, then kills the child).
+    const hostWorkspaceDashboard = (fragment) => {
+        const bundle = (0, lens_frontend_1.findDashboardBundle)(rt.root);
+        if (!bundle)
+            return undefined;
+        const scope = (0, scope_1.readLensScope)(fragment.root);
+        const lensHost = options.lensHost ?? 'lensmcp.local';
+        const lensBase = scope.basePath; // /<registered key>
+        let port = scope.dashboardPort;
+        while (usedDashboardPorts.has(port))
+            port += 1; // distinct from every other workspace's dashboard
+        usedDashboardPorts.add(port);
+        const label = `lens-dashboard:${fragment.wsKey}`;
+        const eventFile = path.join(fragment.root, '.lensmcp', 'events.jsonl'); // the registered workspace's OWN bus
+        removedLabels.delete(label); // a fresh registration after a prior unregister → allow auto-heal again
+        rt.registry.appendRoutes(fragment.wsKey, [{ host: lensHost, prefix: lensBase, project: observability_1.LENS_DASHBOARD_PROJECT, target: `http://localhost:${port}` }]);
+        console.log(`[gateway] hosting dashboard for workspace '${fragment.wsKey}' → http://localhost:${port} (routed at https://${lensHost}${lensBase}/)`);
+        emit('info', `lens dashboard up: ${lensHost}${lensBase} → :${port}`, 'cluster-lens-dashboard', { kind: 'lens-dashboard-up', host: lensHost, port, base: lensBase });
+        spawnManagedChild(label, process.execPath, [bundle], {
+            LENSMCP_EVENT_FILE: eventFile,
+            LENSMCP_DASHBOARD_PORT: String(port),
+            LENSMCP_DASHBOARD_BASE: lensBase,
+        });
+        return () => {
+            removedLabels.add(label); // stop auto-heal from resurrecting it
+            usedDashboardPorts.delete(port);
+            try {
+                labeledChildren.get(label)?.kill('SIGTERM');
+            }
+            catch { /* already gone */ }
+            labeledChildren.delete(label);
+        };
+    };
     const reapAll = () => {
         if (lensSweeper) {
             clearInterval(lensSweeper);
@@ -188,5 +235,5 @@ function createLensChildren(rt, obs, options) {
             catch { /* already gone */ }
         }
     };
-    return { spawnManagedChild, bootSingletonsAndApps, reapAll };
+    return { spawnManagedChild, bootSingletonsAndApps, hostWorkspaceDashboard, reapAll };
 }

package/executors/gateway/runtime/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lifecycle.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAapE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA4CrD;;sGAEsG;AACtG,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,oBAAoB,CAAC,EACpG,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,gBAAgB,GACpB,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAQvC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7D,OAAO,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IAChC,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CA6PvF"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lifecycle.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAapE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA4CrD;;sGAEsG;AACtG,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,oBAAoB,CAAC,EACpG,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,gBAAgB,GACpB,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAQvC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7D,OAAO,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IAChC,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CA+PvF"}

package/executors/gateway/runtime/lifecycle.js

@@ -153,7 +153,9 @@ function createServiceLayer(rt, obs) {
         // childCount goes as a CLI option, NOT env: nx executes tasks via its
         // daemon, whose environment is not the gateway's — env vars get lost.
         const proc = (0, node_child_process_1.spawn)('yarn', ['nx', 'run', target, `--childCount=${min}`], {
-            cwd: rt.root,
+            // The service's OWN workspace root — `rt.root` for the daemon's own workspace, the registered
+            // workspace's root for a second one (so ONE daemon hosts several workspaces' devservers — model (A)).
+            cwd: svc.root,
             detached: true,
             // NX_DAEMON=false keeps the serve task IN this spawned process group.
             // With the daemon on, Nx hands the long-running task to the persistent
@@ -162,9 +164,9 @@ function createServiceLayer(rt, obs) {
             // "idle-kill leaves live pods" leak. (--childCount as a CLI arg already
             // avoids the env-loss the daemon was relied on for.) NX_DAEMON=false also
             // means env vars DO reach the pod, so the east-west key + CA propagate.
-            // LENSMCP_WS_KEY namespaces this service's pod sock dir ($TMPDIR/<wsKey>/<service>-devserver) so a
-            // shared multi-workspace gateway's same-named services don't collide (planning/multi-workspace-gateway.md).
-            env: { ...process.env, NX_DAEMON: 'false', ...(rt.wsKey ? { LENSMCP_WS_KEY: rt.wsKey } : {}), ...eastWestEnv(rt, svc.project) },
+            // LENSMCP_WS_KEY (the SERVICE's owning workspace) namespaces its pod sock dir
+            // ($TMPDIR/<wsKey>/<service>-devserver) — the namespaced pool the daemon scans for this fragment.
+            env: { ...process.env, NX_DAEMON: 'false', ...(svc.wsKey ? { LENSMCP_WS_KEY: svc.wsKey } : {}), ...eastWestEnv(rt, svc.project) },
             stdio: ['ignore', 'pipe', 'pipe'],
         });
         svc.lastErrors = [];

package/executors/gateway/runtime/route-registry.d.ts

@@ -0,0 +1,38 @@
+import type { Route, ServiceCtl } from './types';
+export interface WorkspaceFragment {
+    /** The workspace key (`readLensScope(root).key`). */
+    wsKey: string;
+    /** Absolute workspace root — the fragment's provenance (for the chooser + reaping). */
+    root: string;
+    /** Every route this workspace contributes (host + path mounts, internal.*, its default catch-all, and —
+     *  appended after discovery — its `lensmcp.local/<key>` dashboard route). */
+    routes: Route[];
+    /** The pod-service controllers this workspace owns (scale-from-zero lifecycle is per-service). */
+    services: ServiceCtl[];
+}
+/** A live map of `wsKey → fragment`; `merged()` is the flat table the pipeline matches against. */
+export declare class RouteRegistry {
+    private readonly fragments;
+    /** Register (or REPLACE) a workspace's fragment. Idempotent by `wsKey`. */
+    register(fragment: WorkspaceFragment): void;
+    /** Drop a workspace's fragment; returns it (so the caller can reap its services/dashboard). */
+    unregister(wsKey: string): WorkspaceFragment | undefined;
+    has(wsKey: string): boolean;
+    get(wsKey: string): WorkspaceFragment | undefined;
+    keys(): string[];
+    size(): number;
+    /** APPEND routes to an already-registered workspace's fragment (e.g. its dashboard route, added after
+     *  discovery). No-op if the workspace isn't registered. */
+    appendRoutes(wsKey: string, routes: Route[]): void;
+    /** Every registered workspace's pod-service controllers, flattened (the daemon's full lifecycle set). */
+    allServices(): ServiceCtl[];
+    /** The merged, specificity-sorted route table (host+path ▸ host ▸ per-apex catch-all). A NEW array each
+     *  call — the caller rebuilds `rt.routes` in place from it so the pipeline (which reads `rt.routes` fresh
+     *  per request) picks the change up atomically. */
+    merged(): Route[];
+}
+/** Rebuild `routes` IN PLACE from the registry (mutate the SAME array the request pipeline holds, so a
+ *  live register/unregister is picked up with no restart and no torn read — JS is single-threaded, so the
+ *  splice+push is atomic w.r.t. request handling). */
+export declare function rebuildRoutesInPlace(routes: Route[], registry: RouteRegistry): void;
+//# sourceMappingURL=route-registry.d.ts.map

package/executors/gateway/runtime/route-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-registry.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/route-registry.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEjD,MAAM,WAAW,iBAAiB;IAChC,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb;iFAC6E;IAC7E,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,kGAAkG;IAClG,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB;AAED,mGAAmG;AACnG,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAElE,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI;IAI3C,+FAA+F;IAC/F,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAMxD,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI3B,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIjD,IAAI,IAAI,MAAM,EAAE;IAIhB,IAAI,IAAI,MAAM;IAId;+DAC2D;IAC3D,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI;IAKlD,yGAAyG;IACzG,WAAW,IAAI,UAAU,EAAE;IAI3B;;uDAEmD;IACnD,MAAM,IAAI,KAAK,EAAE;CAKlB;AAED;;sDAEsD;AACtD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,aAAa,GAAG,IAAI,CAInF"}

package/executors/gateway/runtime/route-registry.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RouteRegistry = void 0;
+exports.rebuildRoutesInPlace = rebuildRoutesInPlace;
+/**
+ * The live, multi-workspace ROUTE-FRAGMENT registry — the core of the shared daemon
+ * (planning/multi-workspace-gateway.md P3). ONE `:443` gateway holds a fragment per registered workspace
+ * (its routes + its pod-service controllers) and merges them into the single flat, specificity-sorted route
+ * table the request pipeline reads. A second workspace's `gateway start` REGISTERS its fragment; a stop
+ * UNREGISTERS it — the daemon rebuilds live, never restarts.
+ *
+ * For a SINGLE workspace the merged table is byte-identical to `discoverRoutes` + the dashboard route, so
+ * this is a no-op refactor until a second workspace registers. The per-apex `default` (see `matchRoute`)
+ * is what keeps two workspaces' catch-alls from shadowing each other.
+ */
+const manifest_1 = require("../manifest");
+/** A live map of `wsKey → fragment`; `merged()` is the flat table the pipeline matches against. */
+class RouteRegistry {
+    constructor() {
+        this.fragments = new Map();
+    }
+    /** Register (or REPLACE) a workspace's fragment. Idempotent by `wsKey`. */
+    register(fragment) {
+        this.fragments.set(fragment.wsKey, fragment);
+    }
+    /** Drop a workspace's fragment; returns it (so the caller can reap its services/dashboard). */
+    unregister(wsKey) {
+        const f = this.fragments.get(wsKey);
+        this.fragments.delete(wsKey);
+        return f;
+    }
+    has(wsKey) {
+        return this.fragments.has(wsKey);
+    }
+    get(wsKey) {
+        return this.fragments.get(wsKey);
+    }
+    keys() {
+        return [...this.fragments.keys()];
+    }
+    size() {
+        return this.fragments.size;
+    }
+    /** APPEND routes to an already-registered workspace's fragment (e.g. its dashboard route, added after
+     *  discovery). No-op if the workspace isn't registered. */
+    appendRoutes(wsKey, routes) {
+        const f = this.fragments.get(wsKey);
+        if (f)
+            f.routes.push(...routes);
+    }
+    /** Every registered workspace's pod-service controllers, flattened (the daemon's full lifecycle set). */
+    allServices() {
+        return [...this.fragments.values()].flatMap((f) => f.services);
+    }
+    /** The merged, specificity-sorted route table (host+path ▸ host ▸ per-apex catch-all). A NEW array each
+     *  call — the caller rebuilds `rt.routes` in place from it so the pipeline (which reads `rt.routes` fresh
+     *  per request) picks the change up atomically. */
+    merged() {
+        const all = [...this.fragments.values()].flatMap((f) => f.routes);
+        (0, manifest_1.sortBySpecificity)(all);
+        return all;
+    }
+}
+exports.RouteRegistry = RouteRegistry;
+/** Rebuild `routes` IN PLACE from the registry (mutate the SAME array the request pipeline holds, so a
+ *  live register/unregister is picked up with no restart and no torn read — JS is single-threaded, so the
+ *  splice+push is atomic w.r.t. request handling). */
+function rebuildRoutesInPlace(routes, registry) {
+    const merged = registry.merged();
+    routes.length = 0;
+    routes.push(...merged);
+}

package/executors/gateway/runtime/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAsB,MAAM,SAAS,CAAC;AAkDxH,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAiLxB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAsB,MAAM,SAAS,CAAC;AAkDxH,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAqNxB"}

package/executors/gateway/runtime/server.js

@@ -16,6 +16,8 @@ const http = tslib_1.__importStar(require("node:http"));
 const path = tslib_1.__importStar(require("node:path"));
 const discovery_1 = require("./discovery");
 const scope_1 = require("./scope");
+const route_registry_1 = require("./route-registry");
+const control_1 = require("./control");
 const workspace_registry_1 = require("./workspace-registry");
 const service_keys_1 = require("./service-keys");
 const observability_1 = require("./observability");
@@ -97,10 +99,19 @@ async function startGateway(options, context) {
     // (planning/multi-workspace-gateway.md). It flows to each service's devserver via `LENSMCP_WS_KEY` (see
     // lifecycle.ts), and `discoverRoutes` derives the matching pool dir the gateway scans.
     const wsKey = (0, scope_1.readLensScope)(context.root).key;
-    const { routes, services } = (0, discovery_1.discoverRoutes)(context.root, context.projectsConfigurations?.projects ?? {}, undefined, wsKey);
-    if (routes.length === 0) {
+    const { routes: discovered, services } = (0, discovery_1.discoverRoutes)(context.root, context.projectsConfigurations?.projects ?? {}, undefined, wsKey);
+    if (discovered.length === 0) {
         throw new Error('[gateway] no project declares a `cluster` field — nothing to route.');
     }
+    // --- the live multi-workspace route-fragment registry -----------------------
+    // This workspace registers its OWN fragment; `routes` is the merged table rebuilt IN PLACE from the
+    // registry (byte-identical to `discovered` for one workspace). A second workspace registers its fragment
+    // via the control endpoint and the daemon rebuilds live (planning/multi-workspace-gateway.md P3).
+    const registry = new route_registry_1.RouteRegistry();
+    registry.register({ wsKey, root: context.root, routes: discovered, services });
+    const routes = []; // the LIVE table the request pipeline reads (a stable ref, mutated in place)
+    const rebuildRoutes = () => (0, route_registry_1.rebuildRoutesInPlace)(routes, registry);
+    rebuildRoutes();
     // --- per-service api keys (the gateway is the trust boundary) ---------------
     const { serviceKeys, keyToProject } = (0, service_keys_1.loadServiceKeys)(context.root, services);
     // --- the shared runtime (state + knobs; stopped() is a live getter) ---------
@@ -109,6 +120,8 @@ async function startGateway(options, context) {
         wsKey,
         eventFile,
         routes,
+        registry,
+        rebuildRoutes,
         services,
         serviceKeys,
         keyToProject,
@@ -123,6 +136,31 @@ async function startGateway(options, context) {
     const obs = (0, observability_1.createObservability)(eventFile, { trafficFlushMs });
     const svcLayer = (0, lifecycle_1.createServiceLayer)(rt, obs);
     const lens = (0, lens_children_1.createLensChildren)(rt, obs, options);
+    // The daemon CONTROL PLANE (loopback ~/.lensmcp/control.sock): a second workspace's `gateway start`
+    // REGISTERS its fragment here instead of fighting for :443, and the daemon HOSTS its services (spawns
+    // them, model A) + its dashboard (planning/multi-workspace-gateway.md P3). Harmless for a lone gateway.
+    const dashboardReapers = new Map();
+    let controlServer;
+    try {
+        controlServer = (0, control_1.startControlServer)({
+            rt,
+            killService: (svc, reason) => svcLayer.killSpawned(svc, reason),
+            onRegister: (fragment) => {
+                // Host the registered workspace's dashboard (appends its lensmcp.local/<key> route to the fragment
+                // BEFORE the control handler's rebuild) and remember its reaper.
+                const reap = lens.hostWorkspaceDashboard(fragment);
+                if (reap)
+                    dashboardReapers.set(fragment.wsKey, reap);
+            },
+            onUnregister: (fragment) => {
+                dashboardReapers.get(fragment.wsKey)?.();
+                dashboardReapers.delete(fragment.wsKey);
+            },
+        });
+    }
+    catch (e) {
+        console.warn('[gateway] control plane failed to start (multi-workspace register disabled):', e.message);
+    }
     const proxyLayer = (0, proxy_1.createProxy)(rt, obs, svcLayer);
     // Edge JWT verification (mirrors the prod gateway): when a JWKS source is configured/derivable, the dev
     // edge verifies RS256 tokens by `kid` against the IdP's published keys and REJECTS anything it can't
@@ -235,6 +273,7 @@ async function startGateway(options, context) {
         clearInterval(sweeper);
         obs.emit('info', 'gateway down', 'cluster-gateway', { kind: 'gateway-down' });
         jwtVerifier?.stop(); // clear the JWKS periodic-refresh timer
+        controlServer?.close(); // tear down the control plane + its socket
         (0, workspace_registry_1.unregisterWorkspace)(wsKey); // drop this workspace from the global chooser registry (graceful stop)
         for (const svc of services)
             svcLayer.killSpawned(svc, 'gateway shutdown');

package/executors/gateway/runtime/types.d.ts

@@ -11,6 +11,7 @@ import type * as stream from 'node:stream';
 import type { GatewayExecutorSchema } from '../schema';
 import type { AuthPolicy, Attrs } from '../manifest';
 import type { GatewayErrorReason } from '../gateway-errors';
+import type { RouteRegistry } from './route-registry';
 export type { Attrs };
 export interface GatewayContext {
     root: string;
@@ -111,6 +112,13 @@ export interface LensFrontend {
 export interface ServiceCtl {
     project: string;
     decl: ClusterProjectDecl;
+    /** The owning workspace's absolute root — the `cwd` for its `nx run <svc>:serve-hmr` spawn. For the
+     *  daemon's OWN workspace this is `rt.root`; for a registered second workspace it's THAT workspace's root
+     *  (so one daemon can host several workspaces' devservers — planning/multi-workspace-gateway.md P3, (A)). */
+    root: string;
+    /** The owning workspace's key — passed as `LENSMCP_WS_KEY` to the spawn so the devserver writes its pods
+     *  to `$TMPDIR/<wsKey>/<svc>-devserver` (the namespaced pool the daemon scans for this fragment). */
+    wsKey: string;
     pool: SockPool;
     proc?: ChildProcess;
     state: 'down' | 'starting' | 'up';
@@ -245,7 +253,14 @@ export interface GatewayRuntime {
      *  each service devserver as `LENSMCP_WS_KEY`. */
     readonly wsKey: string;
     readonly eventFile: string;
+    /** The LIVE merged route table (mutated in place from `registry` on every register/unregister, so the
+     *  request pipeline — which reads `rt.routes` fresh per request — picks the change up with no restart). */
     readonly routes: Route[];
+    /** The multi-workspace route-fragment registry (planning/multi-workspace-gateway.md P3). For a single
+     *  workspace it holds ONE fragment and `routes` is byte-identical to `discoverRoutes` + the dashboard. */
+    readonly registry: RouteRegistry;
+    /** Rebuild `routes` in place from `registry` — called after a fragment register/unregister/append. */
+    readonly rebuildRoutes: () => void;
     readonly services: ServiceCtl[];
     readonly serviceKeys: Record<string, string>;
     readonly keyToProject: ReadonlyMap<string, string>;

package/executors/gateway/runtime/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,KAAK,MAAM,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,YAAY,EAAE,KAAK,EAAE,CAAC;AAEtB,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACzE;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sGAAsG;IACtG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B;;iGAE6F;IAC7F,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,2FAA2F;IAC3F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,QAAQ;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAE1F,MAAM,WAAW,KAAK;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;oGACgG;IAChG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;gEAC4D;IAC5D,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AAED;;;yBAGyB;AACzB,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;iGAE6F;IAC7F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;6GAGyG;IACzG,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;mCAE+B;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;2EAGuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAWD,qGAAqG;AACrG,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C;;wDAEwD;AACxD,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD;;sGAEsG;AACtG,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC;;;;;;;sDAOsD;AACtD,eAAO,MAAM,uBAAuB,QAGhC,CAAC;AAEL;;;;;;;iHAOiH;AACjH,eAAO,MAAM,sBAAsB,QAG/B,CAAC;AAEL;;;;;;;;;GASG;AACH,8GAA8G;AAC9G,eAAO,MAAM,mBAAmB,SAA6C,CAAC;AAC9E;;4CAE4C;AAC5C,eAAO,MAAM,cAAc,QAA0D,CAAC;AACtF;;0FAE0F;AAC1F,eAAO,MAAM,kBAAkB,QAA+C,CAAC;AAC/E;;mDAEmD;AACnD,eAAO,MAAM,qBAAqB,QAAiD,CAAC;AACpF;gEACgE;AAChE,eAAO,MAAM,iBAAiB,QAA8C,CAAC;AAC7E;mFACmF;AACnF,eAAO,MAAM,6BAA6B,QAA0D,CAAC;AAErG,2DAA2D;AAC3D,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAGD,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAGD;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;sDAEkD;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;mHAG+G;IAC/G,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;wFACoF;IACpF,OAAO,IAAI,OAAO,CAAC;CACpB;AAGD,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GACpB,WAAW,GACX,YAAY,GACZ,WAAW,GACX,eAAe,GACf,YAAY,GACZ,SAAS,GACT,WAAW,CAAC;AAEhB,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAErE;6EAC6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,kDAAkD;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC;IACnC,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;IAChC,gEAAgE;IAChE,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,wCAAwC;IACxC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7E,gGAAgG;IAChG,SAAS,IAAI,OAAO,CAAC;CACtB;AAED;;;0DAG0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,KAAK,MAAM,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,YAAY,EAAE,KAAK,EAAE,CAAC;AAEtB,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACzE;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sGAAsG;IACtG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B;;iGAE6F;IAC7F,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,2FAA2F;IAC3F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,QAAQ;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAE1F,MAAM,WAAW,KAAK;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;oGACgG;IAChG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;gEAC4D;IAC5D,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AAED;;;yBAGyB;AACzB,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,kBAAkB,CAAC;IACzB;;iHAE6G;IAC7G,IAAI,EAAE,MAAM,CAAC;IACb;yGACqG;IACrG,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;iGAE6F;IAC7F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;6GAGyG;IACzG,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;mCAE+B;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;2EAGuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAWD,qGAAqG;AACrG,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C;;wDAEwD;AACxD,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD;;sGAEsG;AACtG,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC;;;;;;;sDAOsD;AACtD,eAAO,MAAM,uBAAuB,QAGhC,CAAC;AAEL;;;;;;;iHAOiH;AACjH,eAAO,MAAM,sBAAsB,QAG/B,CAAC;AAEL;;;;;;;;;GASG;AACH,8GAA8G;AAC9G,eAAO,MAAM,mBAAmB,SAA6C,CAAC;AAC9E;;4CAE4C;AAC5C,eAAO,MAAM,cAAc,QAA0D,CAAC;AACtF;;0FAE0F;AAC1F,eAAO,MAAM,kBAAkB,QAA+C,CAAC;AAC/E;;mDAEmD;AACnD,eAAO,MAAM,qBAAqB,QAAiD,CAAC;AACpF;gEACgE;AAChE,eAAO,MAAM,iBAAiB,QAA8C,CAAC;AAC7E;mFACmF;AACnF,eAAO,MAAM,6BAA6B,QAA0D,CAAC;AAErG,2DAA2D;AAC3D,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAGD,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAGD;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;sDAEkD;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;+GAC2G;IAC3G,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IACzB;8GAC0G;IAC1G,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,sGAAsG;IACtG,QAAQ,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;mHAG+G;IAC/G,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;wFACoF;IACpF,OAAO,IAAI,OAAO,CAAC;CACpB;AAGD,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GACpB,WAAW,GACX,YAAY,GACZ,WAAW,GACX,eAAe,GACf,YAAY,GACZ,SAAS,GACT,WAAW,CAAC;AAEhB,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAErE;6EAC6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,kDAAkD;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC;IACnC,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;IAChC,gEAAgE;IAChE,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,wCAAwC;IACxC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7E,gGAAgG;IAChG,SAAS,IAAI,OAAO,CAAC;CACtB;AAED;;;0DAG0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/executors/trust/trust.impl.js

@@ -39,7 +39,7 @@ async function trustExecutor(options, context) {
         return { success: true };
     }
     // --- 1) CA into the System keychain (skip when already there) -----------
-    const present = (0, node_child_process_1.spawnSync)('security', ['find-certificate', '-c', 'davnx local dev CA', '/Library/Keychains/System.keychain'], {
+    const present = (0, node_child_process_1.spawnSync)('security', ['find-certificate', '-c', 'lensmcp local dev CA', '/Library/Keychains/System.keychain'], {
         stdio: 'ignore',
     }).status === 0;
     if (present) {

package/main.devserver.js

@@ -674,7 +674,7 @@ else {
             const basicSsl = require('./basic-ssl');
             const certDomains = GATEWAY_ROUTES.map((r) => r.host).filter((h) => !!h);
             const certCacheDir = path.join(process.cwd(), 'node_modules', '.cache', 'davnx-webpack');
-            gatewayPem = basicSsl.getCertificateSync(certCacheDir, SERVICE_NAME || 'davnx.dev', certDomains);
+            gatewayPem = basicSsl.getCertificateSync(certCacheDir, SERVICE_NAME || 'lensmcp.dev', certDomains);
             gatewayCaPath = basicSsl.caCertPath(certCacheDir);
             // eslint-disable-next-line @typescript-eslint/no-require-imports
             const httpsMod = require('node:https');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/cluster",
-  "version": "1.16.12",
+  "version": "1.16.13",
   "description": "Run your Nx workspace as a local production cluster: pods on unix sockets with true HMR, one https gateway with per-project domains, scale-from-zero, autoscale, idle-kill, local-CA TLS — observed by the LensMCP lens.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -65,8 +65,8 @@
     }
   },
   "dependencies": {
-    "@lensmcp/node-instrumentation": "1.16.12",
-    "@lensmcp/nx-plugin": "1.16.12",
+    "@lensmcp/node-instrumentation": "1.16.13",
+    "@lensmcp/nx-plugin": "1.16.13",
     "fork-ts-checker-webpack-plugin": "^9.0.0",
     "glob": "^11.0.0",
     "http-proxy": "^1.18.0",