@lensmcp/cluster 1.16.14 → 1.16.15

package/executors/gateway/runtime/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAsB,MAAM,SAAS,CAAC;AAkDxH,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAqNxB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAsB,MAAM,SAAS,CAAC;AAkDxH,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA0OxB"}

package/executors/gateway/runtime/server.js

@@ -140,6 +140,10 @@ async function startGateway(options, context) {
     // REGISTERS its fragment here instead of fighting for :443, and the daemon HOSTS its services (spawns
     // them, model A) + its dashboard (planning/multi-workspace-gateway.md P3). Harmless for a lone gateway.
     const dashboardReapers = new Map();
+    // Assigned after the TLS servers are built (below) — re-mints the gateway cert with the CURRENT route
+    // hosts and hot-swaps it, so a workspace that registers AFTER boot gets its hostnames into the cert SANs
+    // (otherwise the browser sees ERR_CERT_COMMON_NAME_INVALID for the new workspace's hosts).
+    let refreshCert = () => { };
     let controlServer;
     try {
         controlServer = (0, control_1.startControlServer)({
@@ -151,10 +155,12 @@ async function startGateway(options, context) {
                 const reap = lens.hostWorkspaceDashboard(fragment);
                 if (reap)
                     dashboardReapers.set(fragment.wsKey, reap);
+                refreshCert(); // the new workspace's hosts must join the gateway cert SANs
             },
             onUnregister: (fragment) => {
                 dashboardReapers.get(fragment.wsKey)?.();
                 dashboardReapers.delete(fragment.wsKey);
+                refreshCert();
             },
         });
     }
@@ -214,12 +220,15 @@ async function startGateway(options, context) {
     // --- TLS + listeners --------------------------------------------------------
     let pem;
     let caPath;
+    let mintCert;
     if (https) {
         // eslint-disable-next-line @typescript-eslint/no-require-imports
         const basicSsl = require('../../../basic-ssl');
         const cacheDir = (0, service_keys_1.gatewayCacheDir)(context.root);
-        const hosts = routes.map((r) => r.host).filter((h) => !!h);
-        pem = basicSsl.getCertificateSync(cacheDir, 'gateway', hosts);
+        // SANs = the CURRENT route hosts. `rt.routes` is rebuilt live on register, so a re-mint (refreshCert
+        // below) automatically includes a newly-registered workspace's hostnames.
+        mintCert = () => basicSsl.getCertificateSync(cacheDir, 'gateway', rt.routes.map((r) => r.host).filter((h) => !!h));
+        pem = mintCert();
         caPath = basicSsl.caCertPath(cacheDir);
     }
     const servers = [];
@@ -253,6 +262,18 @@ async function startGateway(options, context) {
         });
         servers.push(server);
     }
+    // Now that the TLS servers exist, wire the live cert refresh: on a workspace register/unregister the
+    // control endpoint calls this to re-mint the gateway cert with the CURRENT route hosts and hot-swap it
+    // into every HTTP/2 secure server (setSecureContext), so a dynamically-registered workspace's hostnames
+    // are covered (no ERR_CERT_COMMON_NAME_INVALID).
+    if (mintCert) {
+        refreshCert = () => {
+            const fresh = mintCert();
+            for (const s of servers) {
+                s.setSecureContext?.({ key: fresh, cert: fresh });
+            }
+        };
+    }
     console.log('[gateway] Routes:');
     for (const r of routes) {
         const dest = r.pool ? `pods@${r.pool.dir}` : r.target;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/cluster",
-  "version": "1.16.14",
+  "version": "1.16.15",
   "description": "Run your Nx workspace as a local production cluster: pods on unix sockets with true HMR, one https gateway with per-project domains, scale-from-zero, autoscale, idle-kill, local-CA TLS — observed by the LensMCP lens.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -65,8 +65,8 @@
     }
   },
   "dependencies": {
-    "@lensmcp/node-instrumentation": "1.16.14",
-    "@lensmcp/nx-plugin": "1.16.14",
+    "@lensmcp/node-instrumentation": "1.16.15",
+    "@lensmcp/nx-plugin": "1.16.15",
     "fork-ts-checker-webpack-plugin": "^9.0.0",
     "glob": "^11.0.0",
     "http-proxy": "^1.18.0",