@lensmcp/cluster 1.16.19 → 1.16.21

package/executors/gateway/otel-tracing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"otel-tracing.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/otel-tracing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAiD,KAAK,IAAI,EAA0C,MAAM,oBAAoB,CAAC;AAKtI,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEtE,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GAAG,IAAI,CAAC;AAE7B,MAAM,WAAW,aAAa;IAC5B,oFAAoF;IACpF,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,SAAS,CAAC;IAC3G,sFAAsF;IACtF,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC5D,8EAA8E;IAC9E,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC;IAClG,2DAA2D;IAC3D,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,wGAAwG;IACxG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAcD;2EAC2E;AAC3E,wBAAgB,YAAY,CAAC,IAAI,GAAE,cAAmB,GAAG,aAAa,GAAG,SAAS,CA+BjF"}
+{"version":3,"file":"otel-tracing.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/otel-tracing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAiD,KAAK,IAAI,EAA0C,MAAM,oBAAoB,CAAC;AAKtI,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEtE,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GAAG,IAAI,CAAC;AAE7B,MAAM,WAAW,aAAa;IAC5B,oFAAoF;IACpF,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,SAAS,CAAC;IAC3G,sFAAsF;IACtF,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC5D,8EAA8E;IAC9E,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC;IAClG,2DAA2D;IAC3D,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,wGAAwG;IACxG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAcD;2EAC2E;AAC3E,wBAAgB,YAAY,CAAC,IAAI,GAAE,cAAmB,GAAG,aAAa,GAAG,SAAS,CAgCjF"}

package/executors/gateway/otel-tracing.js

@@ -46,10 +46,11 @@ function setupTracing(opts = {}) {
     const url = /\/v1\/traces$/.test(base) ? base : `${base}/v1/traces`;
     const exporter = new exporter_trace_otlp_http_1.OTLPTraceExporter({ url, ...(opts.headers ? { headers: opts.headers } : {}) });
     const provider = new sdk_trace_base_1.BasicTracerProvider({
-        resource: new resources_1.Resource({ 'service.name': opts.serviceName ?? process.env['OTEL_SERVICE_NAME'] ?? 'lensmcp-gateway' }),
+        resource: (0, resources_1.resourceFromAttributes)({ 'service.name': opts.serviceName ?? process.env['OTEL_SERVICE_NAME'] ?? 'lensmcp-gateway' }),
         sampler: new sdk_trace_base_1.ParentBasedSampler({ root: new sdk_trace_base_1.TraceIdRatioBasedSampler(opts.sampleRatio ?? 1) }),
+        // OTel 2.0: span processors are constructor config (the mutating `addSpanProcessor` was removed).
+        spanProcessors: [new sdk_trace_base_1.BatchSpanProcessor(exporter)],
     });
-    provider.addSpanProcessor(new sdk_trace_base_1.BatchSpanProcessor(exporter));
     const tracer = provider.getTracer('lensmcp-gateway');
     const propagator = new core_1.W3CTraceContextPropagator();
     return {

package/executors/gateway/runtime/auth.d.ts

@@ -5,5 +5,16 @@ export interface EdgeAuth {
     internal(req: import('node:http').IncomingMessage, route: Route, trace: GwTrace | undefined): AuthVerdict;
     public(req: import('node:http').IncomingMessage, route: Route, trace: GwTrace | undefined): AuthVerdict;
 }
-export declare function createEdgeAuth(rt: GatewayRuntime, obs: Observability, verifier?: JwtVerifier): EdgeAuth;
+/**
+ * HOST-AWARE verifier selection — a SHARED multi-workspace daemon fronts several
+ * IdPs (each workspace's `auth.<apex>`), so the verifier for a request is chosen
+ * by the request's host rather than fixed at boot: a foodguard token is verified
+ * against the foodguard IdP's JWKS, never the tetros keys. A single-workspace
+ * gateway resolves to its one IdP exactly as before.
+ */
+export interface EdgeVerifierPool {
+    for(host: string): JwtVerifier | undefined;
+    stop(): void;
+}
+export declare function createEdgeAuth(rt: GatewayRuntime, obs: Observability, verifiers?: EdgeVerifierPool): EdgeAuth;
 //# sourceMappingURL=auth.d.ts.map

package/executors/gateway/runtime/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/auth.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IAC1G,MAAM,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;CACzG;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,QAAQ,CA8CvG"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/auth.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IAC1G,MAAM,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;CACzG;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;IAC3C,IAAI,IAAI,IAAI,CAAC;CACd;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,gBAAgB,GAAG,QAAQ,CAkD7G"}

package/executors/gateway/runtime/auth.js

@@ -14,7 +14,7 @@ exports.createEdgeAuth = createEdgeAuth;
  */
 const manifest_1 = require("../manifest");
 const dev_auth_1 = require("./dev-auth");
-function createEdgeAuth(rt, obs, verifier) {
+function createEdgeAuth(rt, obs, verifiers) {
     const { traceStep } = obs;
     const internal = (req, _route, trace) => {
         // service-to-service: validate the CALLER's api key at the boundary
@@ -37,7 +37,11 @@ function createEdgeAuth(rt, obs, verifier) {
             const method = (req.method ?? 'GET').toUpperCase();
             const resolved = (0, manifest_1.authRuleFor)(policy, url0, method);
             if (resolved.mode === 'jwt') {
-                const claims = (0, dev_auth_1.verifyDevJwt)(req, verifier);
+                // The verifier for THIS request's host (per-apex IdP resolution in a shared
+                // multi-workspace daemon; the host is the ROUTED host — trusted exactly the
+                // way routing itself trusts it, never taken from the token).
+                const reqHost = String(req.headers.host ?? '').split(':')[0].toLowerCase();
+                const claims = (0, dev_auth_1.verifyDevJwt)(req, verifiers?.for(reqHost));
                 if (!claims) {
                     traceStep(trace, 'auth', { mode: 'jwt', ok: false });
                     return { ok: false, status: 401, reason: 'unauthorized', detail: 'Unauthorized: invalid or missing token' };

package/executors/gateway/runtime/control.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/control.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,+GAA+G;AAC/G,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,cAAc,CAAC;IACnB,+FAA+F;IAC/F,WAAW,EAAE,CAAC,GAAG,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAClF,mGAAmG;IACnG,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACnD,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAsBD;qFACqF;AACrF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CA2DzE"}
+{"version":3,"file":"control.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/control.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,+GAA+G;AAC/G,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,cAAc,CAAC;IACnB,+FAA+F;IAC/F,WAAW,EAAE,CAAC,GAAG,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAClF,mGAAmG;IACnG,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACnD,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAsBD;qFACqF;AACrF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CAwEzE"}

package/executors/gateway/runtime/control.js

@@ -70,6 +70,19 @@ function startControlServer(deps) {
                         }),
                     });
                 }
+                // A RICHER status than /list: the daemon's own identity + every registered workspace (flagged if it
+                // OWNS the daemon) + per-service live state (down|starting|up). The IDE plugin + `gateway status --json`
+                // consume this to render the active gateway, its workspaces, and each service's health at a glance.
+                if (req.method === 'GET' && url === '/status') {
+                    return send(res, 200, {
+                        daemon: { pid: process.pid, wsKey: rt.wsKey },
+                        workspaces: rt.registry.keys().map((key) => {
+                            const f = rt.registry.get(key);
+                            return { key, root: f?.root, routes: f?.routes.length ?? 0, services: f?.services.length ?? 0, isDaemon: key === rt.wsKey };
+                        }),
+                        services: rt.registry.allServices().map((s) => ({ project: s.project, wsKey: s.wsKey, host: s.decl.host, state: s.state })),
+                    });
+                }
                 if (req.method === 'POST' && url === '/register') {
                     const body = (await readJsonBody(req));
                     if (!body.wsKey || !body.root)

package/executors/gateway/runtime/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lifecycle.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAapE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA4CrD;;sGAEsG;AACtG,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,oBAAoB,CAAC,EACpG,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,gBAAgB,GACpB,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAQvC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7D,OAAO,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IAChC,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CAwQvF"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lifecycle.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAapE,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,iBAAiB,CAAC;AA4C/D;;sGAEsG;AACtG,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,oBAAoB,CAAC,EACpG,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,gBAAgB,GACpB,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAQvC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7D,OAAO,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IAChC,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CAkRvF"}

package/executors/gateway/runtime/lifecycle.js

@@ -140,6 +140,14 @@ function lensFrontendStale(spawnedAt, lastRecycleAt, sourceSetChangedAt, now, cf
 }
 function createServiceLayer(rt, obs) {
     const { emit } = obs;
+    // Route a service's lifecycle events (starting/up/down/cold-start/…) to ITS OWNING workspace's bus —
+    // mirrors the pod runtime-event routing below (svc.wsKey === rt.wsKey ? rt.eventFile : <root>/.lensmcp).
+    // The daemon's own services stay on rt.eventFile; a REGISTERED workspace's go to its own bus, so each
+    // hosted dashboard's cluster view (/<key>/api/cluster) is scoped to ITS workspace, not the daemon's
+    // (foodguard/cluster was empty because every service event went to the daemon's tetros bus). Two
+    // workspaces can share a service NAME (both have `auth`), so this MUST key off svc.wsKey, not the project.
+    const serviceBus = (svc) => svc.wsKey === rt.wsKey ? undefined : path.join(svc.root, '.lensmcp', 'events.jsonl');
+    const emitSvc = (svc, severity, title, fingerprint, raw) => emit(severity, title, fingerprint, { wsKey: svc.wsKey, ...raw }, undefined, serviceBus(svc));
     const scanNow = (pool) => { pool.scannedAt = 0; return (0, discovery_1.pickSock)(pool, rt.scanTtlMs) ? pool.socks.length : 0; };
     const spawnService = (svc) => {
         if (rt.stopped())
@@ -147,7 +155,7 @@ function createServiceLayer(rt, obs) {
         const target = `${svc.project}:${svc.decl.serveTarget ?? 'serve-hmr'}`;
         const min = Math.max(1, svc.decl.minPods ?? 1);
         console.log(`[gateway] starting ${target} (pods=${min})…`);
-        emit('info', `service starting: ${svc.project} (${min} pod${min > 1 ? 's' : ''})`, `cluster-service:${svc.project}`, { kind: 'service-starting', project: svc.project, pods: min });
+        emitSvc(svc, 'info', `service starting: ${svc.project} (${min} pod${min > 1 ? 's' : ''})`, `cluster-service:${svc.project}`, { kind: 'service-starting', project: svc.project, pods: min });
         svc.state = 'starting';
         svc.spawnAt = Date.now();
         // childCount goes as a CLI option, NOT env: nx executes tasks via its
@@ -197,7 +205,7 @@ function createServiceLayer(rt, obs) {
                     if (clean !== svc.lastErrorEmitSig || now - (svc.lastErrorEmitAt ?? 0) >= types_1.SERVICE_ERROR_THROTTLE_MS) {
                         svc.lastErrorEmitSig = clean;
                         svc.lastErrorEmitAt = now;
-                        emit('error', `service error: ${svc.project}`, `cluster-service:${svc.project}`, { kind: 'service-error', project: svc.project, line: clean });
+                        emitSvc(svc, 'error', `service error: ${svc.project}`, `cluster-service:${svc.project}`, { kind: 'service-error', project: svc.project, line: clean });
                     }
                 }
                 if (/No typescript errors found|webpack compiled successfully|Child#\d+ ready/.test(line))
@@ -214,7 +222,7 @@ function createServiceLayer(rt, obs) {
             if (rt.stopped())
                 return; // gateway is tearing down — its dying services' exit chatter is noise
             console.log(`[gateway] ${target} exited (${code})`);
-            emit(code === 0 ? 'info' : 'warning', `service down: ${svc.project} (exit ${code})`, `cluster-service:${svc.project}`, { kind: 'service-down', project: svc.project, code });
+            emitSvc(svc, code === 0 ? 'info' : 'warning', `service down: ${svc.project} (exit ${code})`, `cluster-service:${svc.project}`, { kind: 'service-down', project: svc.project, code });
             // SELF-HEAL: respawn an UNEXPECTEDLY-crashed pod so a transient failure recovers with no manual
             // restart. A clean exit (code 0) or a sniffed BUILD failure (a code error → a fix, not a transient
             // crash) is left down — scale-from-zero (ensureUp) still spawns it on the next request. A crash-loop
@@ -225,7 +233,7 @@ function createServiceLayer(rt, obs) {
             const now = Date.now();
             svc.restarts = (svc.restarts ?? []).filter((t) => now - t < types_1.SERVICE_RESTART_WINDOW_MS);
             if (svc.restarts.length >= types_1.SERVICE_MAX_RESTARTS) {
-                emit('error', `service crash-looping: ${svc.project} — ${types_1.SERVICE_MAX_RESTARTS}+ restarts/min, not auto-respawning (the next request retries)`, `cluster-service:${svc.project}`, { kind: 'service-crash-loop', project: svc.project });
+                emitSvc(svc, 'error', `service crash-looping: ${svc.project} — ${types_1.SERVICE_MAX_RESTARTS}+ restarts/min, not auto-respawning (the next request retries)`, `cluster-service:${svc.project}`, { kind: 'service-crash-loop', project: svc.project });
                 return;
             }
             svc.restarts.push(now);
@@ -234,7 +242,7 @@ function createServiceLayer(rt, obs) {
                 if (rt.stopped() || svc.proc || svc.state !== 'down')
                     return; // a request already respawned it, or teardown
                 console.log(`[gateway] self-heal: respawning ${svc.project} (restart ${svc.restarts.length}/${types_1.SERVICE_MAX_RESTARTS})`);
-                emit('info', `self-heal: respawning ${svc.project}`, `cluster-service:${svc.project}`, { kind: 'service-respawn', project: svc.project, attempt: svc.restarts.length });
+                emitSvc(svc, 'info', `self-heal: respawning ${svc.project}`, `cluster-service:${svc.project}`, { kind: 'service-respawn', project: svc.project, attempt: svc.restarts.length });
                 spawnService(svc);
             }, backoffMs);
         });
@@ -243,7 +251,7 @@ function createServiceLayer(rt, obs) {
     const ensureUp = async (svc) => {
         if (scanNow(svc.pool) > 0) {
             if (svc.state !== 'up') {
-                emit('info', `service up: ${svc.project} (${svc.pool.socks.length} pods, adopted)`, `cluster-service:${svc.project}`, { kind: 'service-up', project: svc.project, pods: svc.pool.socks.length, adopted: true });
+                emitSvc(svc, 'info', `service up: ${svc.project} (${svc.pool.socks.length} pods, adopted)`, `cluster-service:${svc.project}`, { kind: 'service-up', project: svc.project, pods: svc.pool.socks.length, adopted: true });
             }
             svc.state = 'up';
             return true;
@@ -263,7 +271,7 @@ function createServiceLayer(rt, obs) {
                 svc.buildFailed = false;
                 const durationMs = svc.spawnAt ? Date.now() - svc.spawnAt : undefined;
                 console.log(`[gateway] ${svc.project} up (${svc.pool.socks.length} pods${durationMs ? `, cold start ${durationMs}ms` : ''})`);
-                emit('info', `cold start: ${svc.project} (${svc.pool.socks.length} pods, ${durationMs ?? '?'}ms)`, `cluster-service:${svc.project}`, { kind: 'cold-start', project: svc.project, pods: svc.pool.socks.length, durationMs });
+                emitSvc(svc, 'info', `cold start: ${svc.project} (${svc.pool.socks.length} pods, ${durationMs ?? '?'}ms)`, `cluster-service:${svc.project}`, { kind: 'cold-start', project: svc.project, pods: svc.pool.socks.length, durationMs });
                 return true;
             }
             if (svc.state === 'down')
@@ -288,14 +296,14 @@ function createServiceLayer(rt, obs) {
         r.on('error', () => undefined);
         r.end(JSON.stringify({ pods: cur + 1 }));
         console.log(`[gateway] autoscale ${svc.project}: ${cur} → ${cur + 1} pods (inflight ${svc.inflight})`);
-        emit('info', `autoscale: ${svc.project} ${cur} → ${cur + 1} pods`, `cluster-service:${svc.project}`, { kind: 'autoscale', project: svc.project, from: cur, to: cur + 1, inflight: svc.inflight });
+        emitSvc(svc, 'info', `autoscale: ${svc.project} ${cur} → ${cur + 1} pods`, `cluster-service:${svc.project}`, { kind: 'autoscale', project: svc.project, from: cur, to: cur + 1, inflight: svc.inflight });
     };
     // Idle sweeper: kill gateway-spawned lazy services after idleKillSec.
     const killSpawned = (svc, why) => {
         if (!svc.proc)
             return;
         console.log(`[gateway] ${svc.project} ${why} — scaling to zero.`);
-        emit('info', `idle kill: ${svc.project} (${why})`, `cluster-service:${svc.project}`, { kind: 'idle-kill', project: svc.project, why });
+        emitSvc(svc, 'info', `idle kill: ${svc.project} (${why})`, `cluster-service:${svc.project}`, { kind: 'idle-kill', project: svc.project, why });
         const dying = svc.proc;
         // Detach the corpse's handlers BEFORE killing: a dying webpack/nx flushes
         // buffered stdout/stderr as it exits, and those `sniff` callbacks would
@@ -341,13 +349,13 @@ function createServiceLayer(rt, obs) {
         const now = Date.now();
         svc.restarts = (svc.restarts ?? []).filter((t) => now - t < types_1.SERVICE_RESTART_WINDOW_MS);
         if (svc.restarts.length >= types_1.SERVICE_MAX_RESTARTS) {
-            emit('error', `service crash-looping: ${svc.project} — wedged ${types_1.SERVICE_MAX_RESTARTS}+×/min, not auto-recycling (the next request retries)`, `cluster-service:${svc.project}`, { kind: 'service-crash-loop', project: svc.project });
+            emitSvc(svc, 'error', `service crash-looping: ${svc.project} — wedged ${types_1.SERVICE_MAX_RESTARTS}+×/min, not auto-recycling (the next request retries)`, `cluster-service:${svc.project}`, { kind: 'service-crash-loop', project: svc.project });
             killSpawned(svc, 'wedged (crash-loop cap) — leaving down for the next request'); // svc.proc cleared → scale-from-zero can retry
             return;
         }
         svc.restarts.push(now);
         console.log(`[gateway] self-heal: recycling WEDGED ${svc.project} (live parent, 0 live pods; ${svc.restarts.length}/${types_1.SERVICE_MAX_RESTARTS})`);
-        emit('warning', `self-heal: recycling wedged ${svc.project} (0 live pods)`, `cluster-service:${svc.project}`, { kind: 'service-recycle', project: svc.project, attempt: svc.restarts.length });
+        emitSvc(svc, 'warning', `self-heal: recycling wedged ${svc.project} (0 live pods)`, `cluster-service:${svc.project}`, { kind: 'service-recycle', project: svc.project, attempt: svc.restarts.length });
         killSpawned(svc, 'wedged: 0 live pods — recycling'); // kills the tree + unlinks stale socks (+1200ms) + svc.proc=undefined + state='down'
         // A wedge is unexpected — bring it straight back (don't wait for a request). Respawn AFTER killSpawned's
         // deferred sock cleanup (1200ms) so the fresh child binds a clean socket path.
@@ -388,7 +396,7 @@ function createServiceLayer(rt, obs) {
     const recyclePod = (svc, reason) => {
         svc.lastStaleRecycleAt = Date.now();
         console.log(`[gateway] zombie recycle: ${svc.project} (${reason}) — stale fs view; fresh pod incoming`);
-        emit('warning', `zombie recycle: ${svc.project} (${reason})`, `cluster-service:${svc.project}`, { kind: 'pod-recycle', project: svc.project, reason });
+        emitSvc(svc, 'warning', `zombie recycle: ${svc.project} (${reason})`, `cluster-service:${svc.project}`, { kind: 'pod-recycle', project: svc.project, reason });
         const eager = !!svc.decl.eager;
         killSpawned(svc, `${reason} — recycling stale pod`); // clears proc, state='down', unlinks socks (+1200ms)
         if (eager)

package/executors/gateway/runtime/observability.d.ts

@@ -11,7 +11,10 @@ export type Severity = 'info' | 'warning' | 'error';
  */
 export declare const LENS_DASHBOARD_PROJECT = "(lens-dashboard)";
 export interface Observability {
-    emit(severity: Severity, title: string, fingerprint: string, raw?: Record<string, unknown>, flowCtx?: Record<string, unknown>): void;
+    /** Append a cluster event to the bus. `busFile` overrides the default daemon bus for THIS event — used to
+     *  route a REGISTERED workspace's service-lifecycle events to ITS OWN bus, so each hosted dashboard's
+     *  cluster view is scoped to its own workspace (not the daemon's). Omit for the daemon's own events. */
+    emit(severity: Severity, title: string, fingerprint: string, raw?: Record<string, unknown>, flowCtx?: Record<string, unknown>, busFile?: string): void;
     eid(): string;
     beginTrace(req: http.IncomingMessage): GwTrace | undefined;
     traceStep(t: GwTrace | undefined, stepName: string, info?: Record<string, unknown>): void;

package/executors/gateway/runtime/observability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observability.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/observability.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9C,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrI,GAAG,IAAI,MAAM,CAAC;IACd,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,GAAG,SAAS,CAAC;IAC3D,SAAS,CAAC,CAAC,EAAE,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1F,WAAW,CAAC,CAAC,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5G,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5E,0FAA0F;IAC1F,gBAAgB,IAAI,MAAM,CAAC,OAAO,CAAC;CACpC;AAKD,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAmGtG"}
+{"version":3,"file":"observability.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/observability.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9C,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B;;4GAEwG;IACxG,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvJ,GAAG,IAAI,MAAM,CAAC;IACd,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,GAAG,SAAS,CAAC;IAC3D,SAAS,CAAC,CAAC,EAAE,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1F,WAAW,CAAC,CAAC,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5G,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5E,0FAA0F;IAC1F,gBAAgB,IAAI,MAAM,CAAC,OAAO,CAAC;CACpC;AAKD,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAoGtG"}

package/executors/gateway/runtime/observability.js

@@ -29,10 +29,11 @@ exports.LENS_DASHBOARD_PROJECT = '(lens-dashboard)';
 const hdr = (v) => typeof v === 'string' && v !== '' ? v : Array.isArray(v) ? v[0] : undefined;
 function createObservability(eventFile, opts) {
     const eid = () => Date.now().toString(36) + Math.random().toString(36).slice(2, 12);
-    const emit = (severity, title, fingerprint, raw, flowCtx) => {
+    const emit = (severity, title, fingerprint, raw, flowCtx, busFile) => {
+        const target = busFile ?? eventFile; // a registered workspace's service events go to ITS bus, not the daemon's
         try {
-            fs.mkdirSync(path.dirname(eventFile), { recursive: true });
-            fs.appendFileSync(eventFile, JSON.stringify({
+            fs.mkdirSync(path.dirname(target), { recursive: true });
+            fs.appendFileSync(target, JSON.stringify({
                 id: eid(), sessionId: 'pending', timestamp: Date.now(),
                 source: 'gateway', category: 'cluster', severity,
                 context: { sessionId: 'pending', ...flowCtx }, fingerprint, title, raw,

package/executors/gateway/runtime/server.d.ts

@@ -1,3 +1,16 @@
-import type { GatewayContext, GatewayHandle, GatewayRuntimeOptions } from './types';
+import { type EdgeVerifierPool } from './auth';
+import type { GatewayContext, GatewayHandle, GatewayRuntimeOptions, Route } from './types';
+/**
+ * The dev edge's JWT verifiers — matching the prod gateway's RS256/JWKS posture so the LOCAL edge rejects
+ * forged tokens instead of decode-accepting them, and MULTI-ISSUER for the shared daemon: every
+ * `auth.<apex>` host in the LIVE route table is an IdP for its apex, and `for(host)` picks the verifier
+ * whose apex the request host belongs to (longest apex wins) — so a foodguard token is verified against
+ * `auth.foodguard.local/jwks.json`, a tetros token against `auth.tetros.ai.local/jwks.json`, on the SAME
+ * :443 daemon. `LENSMCP_GW_JWKS_URL` (explicit, same env as prod) keeps its old meaning: one verifier for
+ * everything. Auth hosts come from project.json (trusted), never from a token — no SSRF/attacker-chosen
+ * JWKS. `for()` returns undefined when the host matches no IdP apex (→ non-HS256 tokens fail closed
+ * unless the insecure opt-in is set).
+ */
+export declare function buildEdgeVerifierPool(getRoutes: () => Route[]): EdgeVerifierPool;
 export declare function startGateway(options: GatewayRuntimeOptions, context: GatewayContext): Promise<GatewayHandle>;
 //# sourceMappingURL=server.d.ts.map

package/executors/gateway/runtime/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAsB,MAAM,SAAS,CAAC;AAkDxH,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAmPxB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAK/D,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAe,KAAK,EAAE,MAAM,SAAS,CAAC;AA0BxH;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,KAAK,EAAE,GAAG,gBAAgB,CA4ChF;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAkPxB"}

package/executors/gateway/runtime/server.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildEdgeVerifierPool = buildEdgeVerifierPool;
 exports.startGateway = startGateway;
 const tslib_1 = require("tslib");
 /**
@@ -53,31 +54,63 @@ function insecureLocalFetch(url, init) {
     });
 }
 /**
- * The dev edge's JWT verifier — matches the prod gateway's RS256/JWKS posture so the LOCAL edge rejects
- * forged tokens instead of decode-accepting them. The JWKS URL is `LENSMCP_GW_JWKS_URL` (explicit, same
- * env as prod) or, absent that, is AUTO-DERIVED from the trusted `auth.*` host in the gateway's own route
- * table (`https://<auth-host>/jwks.json`) — so a standard `auth.<apex>` IdP needs zero config. The host is
- * taken from project.json (trusted), never from a token, so there's no SSRF/attacker-chosen JWKS. Returns
- * undefined when no source is found (→ non-HS256 tokens fail closed unless the insecure opt-in is set).
+ * The dev edge's JWT verifiers — matching the prod gateway's RS256/JWKS posture so the LOCAL edge rejects
+ * forged tokens instead of decode-accepting them, and MULTI-ISSUER for the shared daemon: every
+ * `auth.<apex>` host in the LIVE route table is an IdP for its apex, and `for(host)` picks the verifier
+ * whose apex the request host belongs to (longest apex wins) — so a foodguard token is verified against
+ * `auth.foodguard.local/jwks.json`, a tetros token against `auth.tetros.ai.local/jwks.json`, on the SAME
+ * :443 daemon. `LENSMCP_GW_JWKS_URL` (explicit, same env as prod) keeps its old meaning: one verifier for
+ * everything. Auth hosts come from project.json (trusted), never from a token — no SSRF/attacker-chosen
+ * JWKS. `for()` returns undefined when the host matches no IdP apex (→ non-HS256 tokens fail closed
+ * unless the insecure opt-in is set).
  */
-function buildEdgeJwtVerifier(routes) {
+function buildEdgeVerifierPool(getRoutes) {
     const explicit = process.env['LENSMCP_GW_JWKS_URL'];
-    let jwksUrl = explicit;
-    let derived = false;
-    if (!jwksUrl) {
-        const authHost = routes
-            .map((r) => r.host)
-            .find((h) => typeof h === 'string' && /^auth\./.test(h) && !h.startsWith('internal.'));
-        if (authHost) {
-            jwksUrl = `https://${authHost}/jwks.json`;
-            derived = true;
-        }
-    }
-    if (!jwksUrl)
-        return undefined;
     const issuer = process.env['LENSMCP_GW_JWT_ISS'];
-    console.log(`[gateway] edge JWT: verifying via JWKS ${jwksUrl}${derived ? ' (auto-derived from the auth route)' : ''}`);
-    return (0, jwks_verify_1.createJwksVerifier)({ jwksUrl, ...(issuer ? { issuer } : {}), fetchImpl: insecureLocalFetch });
+    const byApex = new Map();
+    let explicitVerifier;
+    const make = (jwksUrl, label) => {
+        console.log(`[gateway] edge JWT: verifying via JWKS ${jwksUrl}${label}`);
+        const v = (0, jwks_verify_1.createJwksVerifier)({ jwksUrl, ...(issuer ? { issuer } : {}), fetchImpl: insecureLocalFetch });
+        void v.refresh().catch((e) => console.warn('[gateway] edge JWKS warm failed (will retry):', e.message));
+        return v;
+    };
+    return {
+        // PER-APEX resolution over the LIVE route table: every `auth.<apex>` host is an
+        // IdP for its apex, so a SHARED multi-workspace daemon verifies each workspace's
+        // tokens against ITS OWN IdP's JWKS. Reading the routes lazily means a workspace
+        // REGISTERED LATER (control-plane /register) gets its verifier with no rebuild
+        // hook — and `LENSMCP_GW_JWKS_URL` keeps its old meaning (one verifier for all).
+        // The auth host comes from project.json (trusted), never from a token — no
+        // attacker-chosen JWKS.
+        for(host) {
+            if (explicit)
+                return (explicitVerifier ??= make(explicit, ''));
+            const h = host.split(':')[0].toLowerCase();
+            let best;
+            for (const r of getRoutes()) {
+                const rh = r.host;
+                if (typeof rh !== 'string' || !/^auth\./.test(rh) || rh.startsWith('internal.'))
+                    continue;
+                const apex = rh.slice('auth.'.length);
+                if ((h === apex || h.endsWith(`.${apex}`)) && (!best || apex.length > best.length))
+                    best = apex;
+            }
+            if (!best)
+                return undefined;
+            let v = byApex.get(best);
+            if (!v) {
+                v = make(`https://auth.${best}/jwks.json`, ` (auto-derived for apex ${best})`);
+                byApex.set(best, v);
+            }
+            return v;
+        },
+        stop() {
+            explicitVerifier?.stop();
+            for (const v of byApex.values())
+                v.stop();
+        },
+    };
 }
 async function startGateway(options, context) {
     // NB: this local `https` (TLS-on flag) deliberately SHADOWS the `node:https`
@@ -178,12 +211,10 @@ async function startGateway(options, context) {
     // Edge JWT verification (mirrors the prod gateway): when a JWKS source is configured/derivable, the dev
     // edge verifies RS256 tokens by `kid` against the IdP's published keys and REJECTS anything it can't
     // verify (rogue kid / bad sig / alg:none / HS256-confusion / expired) — closing the dev decode-only bypass.
-    const jwtVerifier = buildEdgeJwtVerifier(routes);
-    const edgeAuth = (0, auth_1.createEdgeAuth)(rt, obs, jwtVerifier);
+    const edgeVerifiers = buildEdgeVerifierPool(() => rt.routes);
+    const edgeAuth = (0, auth_1.createEdgeAuth)(rt, obs, edgeVerifiers);
     // Warm the key cache (non-fatal, non-blocking): the IdP pod may still be booting, so a failure here just
     // means the first tokens fail closed until the on-miss/periodic refresh lands the keys (matches prod).
-    if (jwtVerifier)
-        void jwtVerifier.refresh().catch((e) => console.warn('[gateway] edge JWKS warm failed (will retry):', e.message));
     // Custom user middleware (the JWT seam; internal.* routes skip it) is wired as
     // the BUILT-IN FIRST `afterAuth` hook — so "custom middleware runs AFTER core
     // auth" and the `{ mode:'middleware' }` trace step are preserved.
@@ -300,7 +331,7 @@ async function startGateway(options, context) {
         clearInterval(edgeFlusher);
         clearInterval(sweeper);
         obs.emit('info', 'gateway down', 'cluster-gateway', { kind: 'gateway-down' });
-        jwtVerifier?.stop(); // clear the JWKS periodic-refresh timer
+        edgeVerifiers.stop(); // clear every JWKS periodic-refresh timer
         controlServer?.close(); // tear down the control plane + its socket
         (0, workspace_registry_1.unregisterWorkspace)(wsKey); // drop this workspace from the global chooser registry (graceful stop)
         for (const svc of services)

package/executors/trust/trust.impl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trust.impl.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/trust/trust.impl.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAEpD,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE;QACvB,QAAQ,EAAE,MAAM,CACd,MAAM,EACN;YACE,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;gBAAE,OAAO,CAAC,EAAE;oBAAE,OAAO,CAAC,EAAE;wBAAE,MAAM,CAAC,EAAE,KAAK,CAAC;4BAAE,IAAI,CAAC,EAAE,MAAM,CAAA;yBAAE,CAAC,CAAA;qBAAE,CAAA;iBAAE,CAAA;aAAE,CAAC,CAAC;SAC7F,CACF,CAAC;KACH,CAAC;CACH;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAA8B,aAAa,CACzC,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAwE/B;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,GAAG,MAAM,EAAE,CAmC7F"}
+{"version":3,"file":"trust.impl.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/trust/trust.impl.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAEpD,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE;QACvB,QAAQ,EAAE,MAAM,CACd,MAAM,EACN;YACE,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;gBAAE,OAAO,CAAC,EAAE;oBAAE,OAAO,CAAC,EAAE;wBAAE,MAAM,CAAC,EAAE,KAAK,CAAC;4BAAE,IAAI,CAAC,EAAE,MAAM,CAAA;yBAAE,CAAC,CAAA;qBAAE,CAAA;iBAAE,CAAA;aAAE,CAAC,CAAC;SAC7F,CACF,CAAC;KACH,CAAC;CACH;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAA8B,aAAa,CACzC,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAqF/B;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,GAAG,MAAM,EAAE,CAmC7F"}

package/executors/trust/trust.impl.js

@@ -27,6 +27,11 @@ const basic_ssl_1 = require("../../basic-ssl");
 async function trustExecutor(options, context) {
     const cacheDir = path.join(context.root, 'node_modules', '.cache', 'davnx-webpack');
     const caPath = (0, basic_ssl_1.ensureCaSync)(cacheDir);
+    // HOSTS-ONLY mode (set by the CLI when this workspace is a GUEST of a shared daemon): the daemon serves
+    // TLS with ITS own already-trusted CA, so this workspace's CA is unused — skip the keychain step + the
+    // (misleading) file-based CA verify, and set up /etc/hosts + DNS only. The CLI reports the REAL served-cert
+    // trust afterward.
+    const hostsOnly = process.env['LENSMCP_TRUST_HOSTS_ONLY'] === '1';
     const hosts = collectHosts(options, context);
     if (hosts.length === 0) {
         console.log('[trust] no concrete hostnames found (only wildcards?) — keychain step only.');
@@ -38,11 +43,15 @@ async function trustExecutor(options, context) {
             console.log(`  • /etc/hosts: "127.0.0.1 ${h}" and "::1 ${h}"`);
         return { success: true };
     }
-    // --- 1) CA into the System keychain (skip when already there) -----------
-    const present = (0, node_child_process_1.spawnSync)('security', ['find-certificate', '-c', 'lensmcp local dev CA', '/Library/Keychains/System.keychain'], {
-        stdio: 'ignore',
-    }).status === 0;
-    if (present) {
+    // --- 1) CA into the System keychain (skip when already there, or in hosts-only/guest mode) -----------
+    const present = hostsOnly ||
+        (0, node_child_process_1.spawnSync)('security', ['find-certificate', '-c', 'lensmcp local dev CA', '/Library/Keychains/System.keychain'], {
+            stdio: 'ignore',
+        }).status === 0;
+    if (hostsOnly) {
+        console.log('[trust] hosts-only: a shared daemon serves TLS with its own CA — skipping the keychain step.');
+    }
+    else if (present) {
         console.log('[trust] CA already in the System keychain — skipping.');
     }
     else {
@@ -85,8 +94,12 @@ async function trustExecutor(options, context) {
         (0, node_child_process_1.spawnSync)('sudo', ['sh', '-c', 'dscacheutil -flushcache; killall -HUP mDNSResponder'], { stdio: 'inherit' });
     }
     // --- 4) verify ------------------------------------------------------------
-    const verify = (0, node_child_process_1.spawnSync)('security', ['verify-cert', '-c', caPath, '-p', 'basic'], { stdio: 'ignore' });
-    console.log(`[trust] CA trust check: ${verify.status === 0 ? 'OK' : 'NOT TRUSTED YET (browser restart may be needed)'}`);
+    // Skip in hosts-only mode: verifying THIS workspace's (unused) CA file would falsely report "NOT TRUSTED"
+    // — the daemon serves with its own CA, and the CLI probes the real served cert's trust after this returns.
+    if (!hostsOnly) {
+        const verify = (0, node_child_process_1.spawnSync)('security', ['verify-cert', '-c', caPath, '-p', 'basic'], { stdio: 'ignore' });
+        console.log(`[trust] CA trust check: ${verify.status === 0 ? 'OK' : 'NOT TRUSTED YET (browser restart may be needed)'}`);
+    }
     for (const h of hosts) {
         console.log(`[trust] ${h} → https ready (hosts + cert SAN ride the gateway config)`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/cluster",
-  "version": "1.16.19",
+  "version": "1.16.21",
   "description": "Run your Nx workspace as a local production cluster: pods on unix sockets with true HMR, one https gateway with per-project domains, scale-from-zero, autoscale, idle-kill, local-CA TLS — observed by the LensMCP lens.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -33,10 +33,10 @@
     "@fastify/reply-from": "^12.0.0",
     "ioredis": "^5.0.0",
     "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/core": "^1.30.0",
-    "@opentelemetry/resources": "^1.30.0",
-    "@opentelemetry/sdk-trace-base": "^1.30.0",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.57.0"
+    "@opentelemetry/core": "^2.9.0",
+    "@opentelemetry/resources": "^2.9.0",
+    "@opentelemetry/sdk-trace-base": "^2.9.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.220.0"
   },
   "peerDependenciesMeta": {
     "fastify": {
@@ -65,8 +65,8 @@
     }
   },
   "dependencies": {
-    "@lensmcp/node-instrumentation": "1.16.19",
-    "@lensmcp/nx-plugin": "1.16.19",
+    "@lensmcp/node-instrumentation": "1.16.21",
+    "@lensmcp/nx-plugin": "1.16.21",
     "fork-ts-checker-webpack-plugin": "^9.0.0",
     "glob": "^11.0.0",
     "http-proxy": "^1.18.0",