@lensmcp/cluster 1.16.15 → 1.16.16

package/executors/gateway/runtime/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAsB,MAAM,SAAS,CAAC;AAkDxH,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA0OxB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAsB,MAAM,SAAS,CAAC;AAkDxH,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAgPxB"}

package/executors/gateway/runtime/server.js

@@ -110,7 +110,18 @@ async function startGateway(options, context) {
     const registry = new route_registry_1.RouteRegistry();
     registry.register({ wsKey, root: context.root, routes: discovered, services });
     const routes = []; // the LIVE table the request pipeline reads (a stable ref, mutated in place)
-    const rebuildRoutes = () => (0, route_registry_1.rebuildRoutesInPlace)(routes, registry);
+    // Assigned after the TLS servers are built (below) — re-mints the gateway cert with the CURRENT route
+    // hosts and hot-swaps it. Declared HERE (above rebuildRoutes) so rebuildRoutes can trigger it AFTER every
+    // live route change; a no-op until the TLS servers exist (the boot mint happens separately, below).
+    let refreshCert = () => { };
+    const rebuildRoutes = () => {
+        (0, route_registry_1.rebuildRoutesInPlace)(routes, registry);
+        // The cert tracks the live route hosts BY CONSTRUCTION: any register/unregister rebuilds the table then
+        // re-mints, so a dynamically-registered workspace's hostnames always join the SANs (no ERR_CERT_COMMON_
+        // NAME_INVALID). Wiring it here (not in the control onRegister) avoids the ordering trap where the cert
+        // was minted from the STALE table because onRegister ran before the control handler's rebuild.
+        refreshCert();
+    };
     rebuildRoutes();
     // --- per-service api keys (the gateway is the trust boundary) ---------------
     const { serviceKeys, keyToProject } = (0, service_keys_1.loadServiceKeys)(context.root, services);
@@ -140,10 +151,6 @@ async function startGateway(options, context) {
     // REGISTERS its fragment here instead of fighting for :443, and the daemon HOSTS its services (spawns
     // them, model A) + its dashboard (planning/multi-workspace-gateway.md P3). Harmless for a lone gateway.
     const dashboardReapers = new Map();
-    // Assigned after the TLS servers are built (below) — re-mints the gateway cert with the CURRENT route
-    // hosts and hot-swaps it, so a workspace that registers AFTER boot gets its hostnames into the cert SANs
-    // (otherwise the browser sees ERR_CERT_COMMON_NAME_INVALID for the new workspace's hosts).
-    let refreshCert = () => { };
     let controlServer;
     try {
         controlServer = (0, control_1.startControlServer)({
@@ -151,16 +158,15 @@ async function startGateway(options, context) {
             killService: (svc, reason) => svcLayer.killSpawned(svc, reason),
             onRegister: (fragment) => {
                 // Host the registered workspace's dashboard (appends its lensmcp.local/<key> route to the fragment
-                // BEFORE the control handler's rebuild) and remember its reaper.
+                // BEFORE the control handler's rebuild) and remember its reaper. The cert re-mint happens in
+                // rebuildRoutes (called by the control handler right after this), once the full table is live.
                 const reap = lens.hostWorkspaceDashboard(fragment);
                 if (reap)
                     dashboardReapers.set(fragment.wsKey, reap);
-                refreshCert(); // the new workspace's hosts must join the gateway cert SANs
             },
             onUnregister: (fragment) => {
                 dashboardReapers.get(fragment.wsKey)?.();
                 dashboardReapers.delete(fragment.wsKey);
-                refreshCert();
             },
         });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/cluster",
-  "version": "1.16.15",
+  "version": "1.16.16",
   "description": "Run your Nx workspace as a local production cluster: pods on unix sockets with true HMR, one https gateway with per-project domains, scale-from-zero, autoscale, idle-kill, local-CA TLS — observed by the LensMCP lens.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -65,8 +65,8 @@
     }
   },
   "dependencies": {
-    "@lensmcp/node-instrumentation": "1.16.15",
-    "@lensmcp/nx-plugin": "1.16.15",
+    "@lensmcp/node-instrumentation": "1.16.16",
+    "@lensmcp/nx-plugin": "1.16.16",
     "fork-ts-checker-webpack-plugin": "^9.0.0",
     "glob": "^11.0.0",
     "http-proxy": "^1.18.0",