@lensmcp/cluster 1.16.14 → 1.16.16

package/executors/gateway/runtime/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAsB,MAAM,SAAS,CAAC;AAkDxH,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAqNxB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAsB,MAAM,SAAS,CAAC;AAkDxH,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAgPxB"}

package/executors/gateway/runtime/server.js

@@ -110,7 +110,18 @@ async function startGateway(options, context) {
     const registry = new route_registry_1.RouteRegistry();
     registry.register({ wsKey, root: context.root, routes: discovered, services });
     const routes = []; // the LIVE table the request pipeline reads (a stable ref, mutated in place)
-    const rebuildRoutes = () => (0, route_registry_1.rebuildRoutesInPlace)(routes, registry);
+    // Assigned after the TLS servers are built (below) — re-mints the gateway cert with the CURRENT route
+    // hosts and hot-swaps it. Declared HERE (above rebuildRoutes) so rebuildRoutes can trigger it AFTER every
+    // live route change; a no-op until the TLS servers exist (the boot mint happens separately, below).
+    let refreshCert = () => { };
+    const rebuildRoutes = () => {
+        (0, route_registry_1.rebuildRoutesInPlace)(routes, registry);
+        // The cert tracks the live route hosts BY CONSTRUCTION: any register/unregister rebuilds the table then
+        // re-mints, so a dynamically-registered workspace's hostnames always join the SANs (no ERR_CERT_COMMON_
+        // NAME_INVALID). Wiring it here (not in the control onRegister) avoids the ordering trap where the cert
+        // was minted from the STALE table because onRegister ran before the control handler's rebuild.
+        refreshCert();
+    };
     rebuildRoutes();
     // --- per-service api keys (the gateway is the trust boundary) ---------------
     const { serviceKeys, keyToProject } = (0, service_keys_1.loadServiceKeys)(context.root, services);
@@ -147,7 +158,8 @@ async function startGateway(options, context) {
             killService: (svc, reason) => svcLayer.killSpawned(svc, reason),
             onRegister: (fragment) => {
                 // Host the registered workspace's dashboard (appends its lensmcp.local/<key> route to the fragment
-                // BEFORE the control handler's rebuild) and remember its reaper.
+                // BEFORE the control handler's rebuild) and remember its reaper. The cert re-mint happens in
+                // rebuildRoutes (called by the control handler right after this), once the full table is live.
                 const reap = lens.hostWorkspaceDashboard(fragment);
                 if (reap)
                     dashboardReapers.set(fragment.wsKey, reap);
@@ -214,12 +226,15 @@ async function startGateway(options, context) {
     // --- TLS + listeners --------------------------------------------------------
     let pem;
     let caPath;
+    let mintCert;
     if (https) {
         // eslint-disable-next-line @typescript-eslint/no-require-imports
         const basicSsl = require('../../../basic-ssl');
         const cacheDir = (0, service_keys_1.gatewayCacheDir)(context.root);
-        const hosts = routes.map((r) => r.host).filter((h) => !!h);
-        pem = basicSsl.getCertificateSync(cacheDir, 'gateway', hosts);
+        // SANs = the CURRENT route hosts. `rt.routes` is rebuilt live on register, so a re-mint (refreshCert
+        // below) automatically includes a newly-registered workspace's hostnames.
+        mintCert = () => basicSsl.getCertificateSync(cacheDir, 'gateway', rt.routes.map((r) => r.host).filter((h) => !!h));
+        pem = mintCert();
         caPath = basicSsl.caCertPath(cacheDir);
     }
     const servers = [];
@@ -253,6 +268,18 @@ async function startGateway(options, context) {
         });
         servers.push(server);
     }
+    // Now that the TLS servers exist, wire the live cert refresh: on a workspace register/unregister the
+    // control endpoint calls this to re-mint the gateway cert with the CURRENT route hosts and hot-swap it
+    // into every HTTP/2 secure server (setSecureContext), so a dynamically-registered workspace's hostnames
+    // are covered (no ERR_CERT_COMMON_NAME_INVALID).
+    if (mintCert) {
+        refreshCert = () => {
+            const fresh = mintCert();
+            for (const s of servers) {
+                s.setSecureContext?.({ key: fresh, cert: fresh });
+            }
+        };
+    }
     console.log('[gateway] Routes:');
     for (const r of routes) {
         const dest = r.pool ? `pods@${r.pool.dir}` : r.target;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/cluster",
-  "version": "1.16.14",
+  "version": "1.16.16",
   "description": "Run your Nx workspace as a local production cluster: pods on unix sockets with true HMR, one https gateway with per-project domains, scale-from-zero, autoscale, idle-kill, local-CA TLS — observed by the LensMCP lens.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -65,8 +65,8 @@
     }
   },
   "dependencies": {
-    "@lensmcp/node-instrumentation": "1.16.14",
-    "@lensmcp/nx-plugin": "1.16.14",
+    "@lensmcp/node-instrumentation": "1.16.16",
+    "@lensmcp/nx-plugin": "1.16.16",
     "fork-ts-checker-webpack-plugin": "^9.0.0",
     "glob": "^11.0.0",
     "http-proxy": "^1.18.0",