@lensmcp/cluster 1.16.20 → 1.16.22

package/executors/gateway/rate-limit.d.ts

@@ -30,7 +30,14 @@ export interface RateLimiter {
     check(key: string): RateDecision | Promise<RateDecision>;
     stop(): void;
 }
-export declare function createRateLimiter(opts: RateLimiterOptions): RateLimiter;
+/** The in-memory limiter — its `check` is SYNCHRONOUS (no round-trip). Assignable to {@link RateLimiter}
+ *  (a `RateDecision` widens to `RateDecision | Promise<RateDecision>`), so it drops in wherever the async
+ *  interface is expected while callers/tests can read the result without an `await`. */
+export interface SyncRateLimiter {
+    check(key: string): RateDecision;
+    stop(): void;
+}
+export declare function createRateLimiter(opts: RateLimiterOptions): SyncRateLimiter;
 /**
  * Redis-backed token-bucket rate limiter — ONE GLOBAL budget shared by every
  * gateway container/instance (so a per-IP limit is N-container-independent, unlike

package/executors/gateway/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAAG,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE;AAE3F,MAAM,WAAW,WAAW;IAC1B;oFACgF;IAChF,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,IAAI,IAAI,CAAC;CACd;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,GAAG,WAAW,CA6BvE;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,uBAAuB;IACtC,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvF;AA2BD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,uBAAuB,GAAG,WAAW,CAgCzG"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAAG,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE;AAE3F,MAAM,WAAW,WAAW;IAC1B;oFACgF;IAChF,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,IAAI,IAAI,CAAC;CACd;AAED;;wFAEwF;AACxF,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAAC;IACjC,IAAI,IAAI,IAAI,CAAC;CACd;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,GAAG,eAAe,CA6B3E;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,uBAAuB;IACtC,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvF;AA2BD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,uBAAuB,GAAG,WAAW,CAgCzG"}

package/executors/gateway/runtime/auth.d.ts

@@ -5,5 +5,16 @@ export interface EdgeAuth {
     internal(req: import('node:http').IncomingMessage, route: Route, trace: GwTrace | undefined): AuthVerdict;
     public(req: import('node:http').IncomingMessage, route: Route, trace: GwTrace | undefined): AuthVerdict;
 }
-export declare function createEdgeAuth(rt: GatewayRuntime, obs: Observability, verifier?: JwtVerifier): EdgeAuth;
+/**
+ * HOST-AWARE verifier selection — a SHARED multi-workspace daemon fronts several
+ * IdPs (each workspace's `auth.<apex>`), so the verifier for a request is chosen
+ * by the request's host rather than fixed at boot: a foodguard token is verified
+ * against the foodguard IdP's JWKS, never the tetros keys. A single-workspace
+ * gateway resolves to its one IdP exactly as before.
+ */
+export interface EdgeVerifierPool {
+    for(host: string): JwtVerifier | undefined;
+    stop(): void;
+}
+export declare function createEdgeAuth(rt: GatewayRuntime, obs: Observability, verifiers?: EdgeVerifierPool): EdgeAuth;
 //# sourceMappingURL=auth.d.ts.map

package/executors/gateway/runtime/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/auth.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IAC1G,MAAM,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;CACzG;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,QAAQ,CA8CvG"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/auth.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IAC1G,MAAM,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;CACzG;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;IAC3C,IAAI,IAAI,IAAI,CAAC;CACd;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,gBAAgB,GAAG,QAAQ,CAkD7G"}

package/executors/gateway/runtime/auth.js

@@ -14,7 +14,7 @@ exports.createEdgeAuth = createEdgeAuth;
  */
 const manifest_1 = require("../manifest");
 const dev_auth_1 = require("./dev-auth");
-function createEdgeAuth(rt, obs, verifier) {
+function createEdgeAuth(rt, obs, verifiers) {
     const { traceStep } = obs;
     const internal = (req, _route, trace) => {
         // service-to-service: validate the CALLER's api key at the boundary
@@ -37,7 +37,11 @@ function createEdgeAuth(rt, obs, verifier) {
             const method = (req.method ?? 'GET').toUpperCase();
             const resolved = (0, manifest_1.authRuleFor)(policy, url0, method);
             if (resolved.mode === 'jwt') {
-                const claims = (0, dev_auth_1.verifyDevJwt)(req, verifier);
+                // The verifier for THIS request's host (per-apex IdP resolution in a shared
+                // multi-workspace daemon; the host is the ROUTED host — trusted exactly the
+                // way routing itself trusts it, never taken from the token).
+                const reqHost = String(req.headers.host ?? '').split(':')[0].toLowerCase();
+                const claims = (0, dev_auth_1.verifyDevJwt)(req, verifiers?.for(reqHost));
                 if (!claims) {
                     traceStep(trace, 'auth', { mode: 'jwt', ok: false });
                     return { ok: false, status: 401, reason: 'unauthorized', detail: 'Unauthorized: invalid or missing token' };

package/executors/gateway/runtime/lens-children.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lens-children.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lens-children.ts"],"names":[],"mappings":"AAQA,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAuB,MAAM,SAAS,CAAC;AAQ1F,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAM7E,MAAM,WAAW,YAAY;IAC3B,iBAAiB,EAAE,UAAU,CAAC;IAC9B;iFAC6E;IAC7E,qBAAqB,IAAI,IAAI,CAAC;IAC9B;;6GAEyG;IACzG,sBAAsB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IAC9E;;yGAEqG;IACrG,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAAC;IAC3D;gHAC4G;IAC5G,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,qBAAqB,GAAG,YAAY,CAmTvH"}
+{"version":3,"file":"lens-children.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lens-children.ts"],"names":[],"mappings":"AAQA,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAuB,MAAM,SAAS,CAAC;AAQ1F,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAM7E,MAAM,WAAW,YAAY;IAC3B,iBAAiB,EAAE,UAAU,CAAC;IAC9B;iFAC6E;IAC7E,qBAAqB,IAAI,IAAI,CAAC;IAC9B;;6GAEyG;IACzG,sBAAsB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IAC9E;;yGAEqG;IACrG,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAAC;IAC3D;gHAC4G;IAC5G,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,qBAAqB,GAAG,YAAY,CAiUvH"}

package/executors/gateway/runtime/lens-children.js

@@ -223,7 +223,14 @@ function createLensChildren(rt, obs, options) {
             LENSMCP_EVENT_FILE: eventFile,
             LENSMCP_DASHBOARD_PORT: String(port),
             LENSMCP_DASHBOARD_BASE: lensBase,
-        });
+            LENSMCP_WS_KEY: fragment.wsKey,
+        }, false, undefined, 
+        // The guest dashboard's Cluster view derives its service DECLS + service-keys from `process.cwd()`
+        // (dashboard bundle: `const root = process.cwd()`), so the child MUST run in the REGISTERED
+        // workspace's root — NOT the default `rt.root` (the daemon owner's). Without this a hosted workspace's
+        // dashboard renders the DAEMON's `project.json` services (the "foodguard page shows tetros" bug); the
+        // sibling `hostWorkspaceApps` already threads `fragment.root` this way.
+        fragment.root);
         return () => {
             removedLabels.add(label); // stop auto-heal from resurrecting it
             usedDashboardPorts.delete(port);

package/executors/gateway/runtime/server.d.ts

@@ -1,3 +1,16 @@
-import type { GatewayContext, GatewayHandle, GatewayRuntimeOptions } from './types';
+import { type EdgeVerifierPool } from './auth';
+import type { GatewayContext, GatewayHandle, GatewayRuntimeOptions, Route } from './types';
+/**
+ * The dev edge's JWT verifiers — matching the prod gateway's RS256/JWKS posture so the LOCAL edge rejects
+ * forged tokens instead of decode-accepting them, and MULTI-ISSUER for the shared daemon: every
+ * `auth.<apex>` host in the LIVE route table is an IdP for its apex, and `for(host)` picks the verifier
+ * whose apex the request host belongs to (longest apex wins) — so a foodguard token is verified against
+ * `auth.foodguard.local/jwks.json`, a tetros token against `auth.tetros.ai.local/jwks.json`, on the SAME
+ * :443 daemon. `LENSMCP_GW_JWKS_URL` (explicit, same env as prod) keeps its old meaning: one verifier for
+ * everything. Auth hosts come from project.json (trusted), never from a token — no SSRF/attacker-chosen
+ * JWKS. `for()` returns undefined when the host matches no IdP apex (→ non-HS256 tokens fail closed
+ * unless the insecure opt-in is set).
+ */
+export declare function buildEdgeVerifierPool(getRoutes: () => Route[]): EdgeVerifierPool;
 export declare function startGateway(options: GatewayRuntimeOptions, context: GatewayContext): Promise<GatewayHandle>;
 //# sourceMappingURL=server.d.ts.map

package/executors/gateway/runtime/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAsB,MAAM,SAAS,CAAC;AAkDxH,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAmPxB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAK/D,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAe,KAAK,EAAE,MAAM,SAAS,CAAC;AA0BxH;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,KAAK,EAAE,GAAG,gBAAgB,CA4ChF;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAkPxB"}

package/executors/gateway/runtime/server.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildEdgeVerifierPool = buildEdgeVerifierPool;
 exports.startGateway = startGateway;
 const tslib_1 = require("tslib");
 /**
@@ -53,31 +54,63 @@ function insecureLocalFetch(url, init) {
     });
 }
 /**
- * The dev edge's JWT verifier — matches the prod gateway's RS256/JWKS posture so the LOCAL edge rejects
- * forged tokens instead of decode-accepting them. The JWKS URL is `LENSMCP_GW_JWKS_URL` (explicit, same
- * env as prod) or, absent that, is AUTO-DERIVED from the trusted `auth.*` host in the gateway's own route
- * table (`https://<auth-host>/jwks.json`) — so a standard `auth.<apex>` IdP needs zero config. The host is
- * taken from project.json (trusted), never from a token, so there's no SSRF/attacker-chosen JWKS. Returns
- * undefined when no source is found (→ non-HS256 tokens fail closed unless the insecure opt-in is set).
+ * The dev edge's JWT verifiers — matching the prod gateway's RS256/JWKS posture so the LOCAL edge rejects
+ * forged tokens instead of decode-accepting them, and MULTI-ISSUER for the shared daemon: every
+ * `auth.<apex>` host in the LIVE route table is an IdP for its apex, and `for(host)` picks the verifier
+ * whose apex the request host belongs to (longest apex wins) — so a foodguard token is verified against
+ * `auth.foodguard.local/jwks.json`, a tetros token against `auth.tetros.ai.local/jwks.json`, on the SAME
+ * :443 daemon. `LENSMCP_GW_JWKS_URL` (explicit, same env as prod) keeps its old meaning: one verifier for
+ * everything. Auth hosts come from project.json (trusted), never from a token — no SSRF/attacker-chosen
+ * JWKS. `for()` returns undefined when the host matches no IdP apex (→ non-HS256 tokens fail closed
+ * unless the insecure opt-in is set).
  */
-function buildEdgeJwtVerifier(routes) {
+function buildEdgeVerifierPool(getRoutes) {
     const explicit = process.env['LENSMCP_GW_JWKS_URL'];
-    let jwksUrl = explicit;
-    let derived = false;
-    if (!jwksUrl) {
-        const authHost = routes
-            .map((r) => r.host)
-            .find((h) => typeof h === 'string' && /^auth\./.test(h) && !h.startsWith('internal.'));
-        if (authHost) {
-            jwksUrl = `https://${authHost}/jwks.json`;
-            derived = true;
-        }
-    }
-    if (!jwksUrl)
-        return undefined;
     const issuer = process.env['LENSMCP_GW_JWT_ISS'];
-    console.log(`[gateway] edge JWT: verifying via JWKS ${jwksUrl}${derived ? ' (auto-derived from the auth route)' : ''}`);
-    return (0, jwks_verify_1.createJwksVerifier)({ jwksUrl, ...(issuer ? { issuer } : {}), fetchImpl: insecureLocalFetch });
+    const byApex = new Map();
+    let explicitVerifier;
+    const make = (jwksUrl, label) => {
+        console.log(`[gateway] edge JWT: verifying via JWKS ${jwksUrl}${label}`);
+        const v = (0, jwks_verify_1.createJwksVerifier)({ jwksUrl, ...(issuer ? { issuer } : {}), fetchImpl: insecureLocalFetch });
+        void v.refresh().catch((e) => console.warn('[gateway] edge JWKS warm failed (will retry):', e.message));
+        return v;
+    };
+    return {
+        // PER-APEX resolution over the LIVE route table: every `auth.<apex>` host is an
+        // IdP for its apex, so a SHARED multi-workspace daemon verifies each workspace's
+        // tokens against ITS OWN IdP's JWKS. Reading the routes lazily means a workspace
+        // REGISTERED LATER (control-plane /register) gets its verifier with no rebuild
+        // hook — and `LENSMCP_GW_JWKS_URL` keeps its old meaning (one verifier for all).
+        // The auth host comes from project.json (trusted), never from a token — no
+        // attacker-chosen JWKS.
+        for(host) {
+            if (explicit)
+                return (explicitVerifier ??= make(explicit, ''));
+            const h = host.split(':')[0].toLowerCase();
+            let best;
+            for (const r of getRoutes()) {
+                const rh = r.host;
+                if (typeof rh !== 'string' || !/^auth\./.test(rh) || rh.startsWith('internal.'))
+                    continue;
+                const apex = rh.slice('auth.'.length);
+                if ((h === apex || h.endsWith(`.${apex}`)) && (!best || apex.length > best.length))
+                    best = apex;
+            }
+            if (!best)
+                return undefined;
+            let v = byApex.get(best);
+            if (!v) {
+                v = make(`https://auth.${best}/jwks.json`, ` (auto-derived for apex ${best})`);
+                byApex.set(best, v);
+            }
+            return v;
+        },
+        stop() {
+            explicitVerifier?.stop();
+            for (const v of byApex.values())
+                v.stop();
+        },
+    };
 }
 async function startGateway(options, context) {
     // NB: this local `https` (TLS-on flag) deliberately SHADOWS the `node:https`
@@ -178,12 +211,10 @@ async function startGateway(options, context) {
     // Edge JWT verification (mirrors the prod gateway): when a JWKS source is configured/derivable, the dev
     // edge verifies RS256 tokens by `kid` against the IdP's published keys and REJECTS anything it can't
     // verify (rogue kid / bad sig / alg:none / HS256-confusion / expired) — closing the dev decode-only bypass.
-    const jwtVerifier = buildEdgeJwtVerifier(routes);
-    const edgeAuth = (0, auth_1.createEdgeAuth)(rt, obs, jwtVerifier);
+    const edgeVerifiers = buildEdgeVerifierPool(() => rt.routes);
+    const edgeAuth = (0, auth_1.createEdgeAuth)(rt, obs, edgeVerifiers);
     // Warm the key cache (non-fatal, non-blocking): the IdP pod may still be booting, so a failure here just
     // means the first tokens fail closed until the on-miss/periodic refresh lands the keys (matches prod).
-    if (jwtVerifier)
-        void jwtVerifier.refresh().catch((e) => console.warn('[gateway] edge JWKS warm failed (will retry):', e.message));
     // Custom user middleware (the JWT seam; internal.* routes skip it) is wired as
     // the BUILT-IN FIRST `afterAuth` hook — so "custom middleware runs AFTER core
     // auth" and the `{ mode:'middleware' }` trace step are preserved.
@@ -300,7 +331,7 @@ async function startGateway(options, context) {
         clearInterval(edgeFlusher);
         clearInterval(sweeper);
         obs.emit('info', 'gateway down', 'cluster-gateway', { kind: 'gateway-down' });
-        jwtVerifier?.stop(); // clear the JWKS periodic-refresh timer
+        edgeVerifiers.stop(); // clear every JWKS periodic-refresh timer
         controlServer?.close(); // tear down the control plane + its socket
         (0, workspace_registry_1.unregisterWorkspace)(wsKey); // drop this workspace from the global chooser registry (graceful stop)
         for (const svc of services)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/cluster",
-  "version": "1.16.20",
+  "version": "1.16.22",
   "description": "Run your Nx workspace as a local production cluster: pods on unix sockets with true HMR, one https gateway with per-project domains, scale-from-zero, autoscale, idle-kill, local-CA TLS — observed by the LensMCP lens.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -65,8 +65,8 @@
     }
   },
   "dependencies": {
-    "@lensmcp/node-instrumentation": "1.16.20",
-    "@lensmcp/nx-plugin": "1.16.20",
+    "@lensmcp/node-instrumentation": "1.16.22",
+    "@lensmcp/nx-plugin": "1.16.22",
     "fork-ts-checker-webpack-plugin": "^9.0.0",
     "glob": "^11.0.0",
     "http-proxy": "^1.18.0",