@lensmcp/cluster 1.18.4 → 1.18.7

package/executors/serve/serve.impl.js

@@ -1,280 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const tslib_1 = require("tslib");
-const path = tslib_1.__importStar(require("node:path"));
-const fs = tslib_1.__importStar(require("node:fs"));
-const node_child_process_1 = require("node:child_process");
-const yaml = tslib_1.__importStar(require("js-yaml"));
-const create_webpack_dev_1 = require("../../create-webpack-dev");
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const webpack = require('webpack');
-/**
- * Dev serve executor — webpack watch mode with integrated devserver.
- *
- * Owns the full devserver lifecycle:
- * 1. Starts webpack in watch mode
- * 2. On first successful build, forks main.devserver.js with proper env vars
- * 3. On subsequent builds, POSTs /webpack/reload to devserver
- * 4. On shutdown, cleans up devserver and webpack watcher
- */
-async function* serveExecutor(options, context) {
-    process.env.NODE_ENV = 'development';
-    const projectConfig = context.projectsConfigurations.projects[context.projectName];
-    const workspaceRoot = context.root;
-    const projectRoot = path.join(workspaceRoot, projectConfig.root);
-    const outputPath = options.outputPath
-        ? path.join(workspaceRoot, options.outputPath)
-        : path.join(workspaceRoot, 'dist', projectConfig.root);
-    // Resolve port and serviceName from config YAML
-    const configEnv = options.configEnv || 'development';
-    const configFilePath = path.join(workspaceRoot, 'config', `config.${configEnv}.yaml`);
-    const DEFAULT_PUBLIC_PORT = 3050;
-    let port = DEFAULT_PUBLIC_PORT;
-    let serviceName = context.projectName;
-    let yamlConfig = {};
-    if (fs.existsSync(configFilePath)) {
-        yamlConfig = yaml.load(fs.readFileSync(configFilePath, 'utf8'));
-        port = Number(yamlConfig.port) || port;
-        serviceName = yamlConfig.serviceName || serviceName;
-    }
-    else {
-        // No per-service config → the devserver's PUBLIC port falls back to the shared default. If TWO
-        // services both miss their config, both bind DEFAULT_PUBLIC_PORT and the loser crash-loops with a
-        // cryptic `EADDRINUSE :::3050` that the gateway surfaces as a "service error" — masquerading as a
-        // service bug. Warn loudly + actionably so the real cause (a missing `config/config.<env>.yaml`) is
-        // obvious. Fix: add `config/config.${configEnv}.yaml` with a distinct `port` (mirror its cluster decl).
-        console.warn(`[serve] ${context.projectName}: no config file at ${configFilePath} — public devserver port defaults to ${DEFAULT_PUBLIC_PORT}. ` +
-            `If another service also lacks its config, both bind ${DEFAULT_PUBLIC_PORT} → EADDRINUSE. ` +
-            `Add config/config.${configEnv}.yaml with a distinct \`port:\` (matching this project's cluster.port).`);
-    }
-    if (options.serviceName) {
-        serviceName = options.serviceName;
-    }
-    const servePrefix = options.servePrefix ?? '';
-    // Debug base port: pod #slot opens its inspector on debugPort+slot (workers on
-    // debugPort+20+i). Option wins over the LENSMCP_DEBUG_PORT env var so per-project
-    // config can give each service a distinct base in cluster mode. Even without it,
-    // POST /webpack/debug on the running devserver opens inspectors on demand.
-    const debugPort = options.debugPort ?? (Number(process.env.LENSMCP_DEBUG_PORT) || undefined);
-    // Log tee: every pod/worker line is also appended (ANSI-stripped) to this file so
-    // an IDE can tail it — WebStorm: Run/Debug configuration → Logs tab. Truncated
-    // here once per `nx serve` run; devserver crash-respawns keep appending.
-    const logFile = options.logFile
-        ? path.resolve(workspaceRoot, options.logFile)
-        : process.env.LENSMCP_LOG_FILE || undefined;
-    if (logFile) {
-        fs.mkdirSync(path.dirname(logFile), { recursive: true });
-        fs.writeFileSync(logFile, '');
-    }
-    // Resolve gateway middleware
-    let gatewayMiddlewarePath;
-    let gatewayConfigJson;
-    if (options.gateway?.middleware) {
-        gatewayMiddlewarePath = path.resolve(projectRoot, options.gateway.middleware);
-        gatewayConfigJson = JSON.stringify(yamlConfig);
-    }
-    // Resolve entry/tsconfig relative to project root (absolute paths avoid
-    // NxAppWebpackPlugin's normalizeRelativePaths collision with executor options)
-    const entryFile = options.entryFile || './src/deployments/service/main.ts';
-    const tsConfigFile = options.tsConfigFile || './tsconfig.app.json';
-    const resolvedMain = path.resolve(projectRoot, entryFile);
-    const resolvedTsConfig = path.resolve(projectRoot, tsConfigFile);
-    // Map workers to additional entry points
-    const additionalEntryPoints = (options.workers || []).map((w) => ({
-        entryName: w.name,
-        entryPath: path.resolve(projectRoot, w.entryPath),
-    }));
-    // Build dev webpack config
-    const config = (0, create_webpack_dev_1.createDevWebpackConfig)({
-        appName: context.projectName,
-        appRoot: projectRoot,
-        outputDir: outputPath,
-        main: resolvedMain,
-        tsConfig: resolvedTsConfig,
-        assets: options.assets || [],
-        additionalEntryPoints,
-        port,
-        serviceName,
-        memoryLimit: options.memoryLimit || 8192,
-        buildLibsFromSource: options.buildLibsFromSource !== false,
-        workspaceRoot,
-        orgScopes: options.orgScopes || [],
-        bundlePackages: options.bundlePackages || [],
-        nodeExternalsConfig: options.nodeExternalsConfig,
-        webpackConfigPath: options.webpackConfigPath,
-        httpsReload: options.gateway?.https === true,
-    });
-    // State
-    let devserverProcess = null;
-    let firstBuildComplete = false;
-    // Path to the devserver script — resolve JS first, fall back to TS (local dev with swc-node)
-    const devserverScriptJs = path.join(__dirname, '../../main.devserver.js');
-    const devserverScriptTs = path.join(__dirname, '../../main.devserver.ts');
-    const runningFromSource = !fs.existsSync(devserverScriptJs) && fs.existsSync(devserverScriptTs);
-    const devserverScript = runningFromSource ? devserverScriptTs : devserverScriptJs;
-    // Absolute path to the webpack bundle the devserver should load
-    const bundlePath = path.join(outputPath, 'main.js');
-    function cleanup() {
-        if (devserverProcess && !devserverProcess.killed) {
-            devserverProcess.kill('SIGTERM');
-            devserverProcess = null;
-        }
-    }
-    // Register cleanup on process signals
-    const signals = ['SIGINT', 'SIGTERM', 'SIGHUP', 'SIGQUIT'];
-    const signalHandlers = signals.map((sig) => {
-        const handler = () => cleanup();
-        process.on(sig, handler);
-        return { sig, handler };
-    });
-    process.on('exit', cleanup);
-    function startDevServer() {
-        if (!fs.existsSync(devserverScript)) {
-            console.error(`[serve] devserver script not found at ${devserverScript}`);
-            return;
-        }
-        const execArgv = ['--enable-source-maps'];
-        if (runningFromSource) {
-            execArgv.unshift('--require', '@swc-node/register');
-        }
-        devserverProcess = (0, node_child_process_1.fork)(devserverScript, {
-            cwd: workspaceRoot,
-            env: {
-                ...process.env,
-                PORT: String(port),
-                SERVICE_NAME: serviceName,
-                SERVE_PREFIX: servePrefix,
-                // Zero-touch lens identity + bus for pod children and workers: the
-                // injected @lensmcp/node-instrumentation (and the grafted nest module)
-                // attribute every event to this project and write to the shared file
-                // rendezvous — without these, nest trace events fall to the console
-                // sink and are lost in cluster mode.
-                LENSMCP_PROJECT: process.env.LENSMCP_PROJECT || context.projectName || serviceName,
-                LENSMCP_EVENT_FILE: process.env.LENSMCP_EVENT_FILE || path.join(workspaceRoot, '.lensmcp', 'events.jsonl'),
-                CHILD_COUNT: String(options.childCount || process.env.CHILD_COUNT || 1),
-                BUNDLE_PATH: bundlePath,
-                ...(gatewayMiddlewarePath && { GATEWAY_MIDDLEWARE: gatewayMiddlewarePath }),
-                ...(gatewayConfigJson && { GATEWAY_CONFIG: gatewayConfigJson }),
-                ...(options.gateway?.routes?.length && { GATEWAY_ROUTES: JSON.stringify(options.gateway.routes) }),
-                ...(options.gateway?.https && { GATEWAY_HTTPS: "1" }),
-                ...(options.gateway?.extraPorts?.length && { GATEWAY_EXTRA_PORTS: JSON.stringify(options.gateway.extraPorts) }),
-                ...(options.internalPort && { INTERNAL_PORT: String(options.internalPort) }),
-                ...(debugPort && { LENSMCP_DEBUG_PORT: String(debugPort) }),
-                ...(logFile && { LENSMCP_LOG_FILE: logFile }),
-                ...((options.workers?.length) && { WORKERS: JSON.stringify(options.workers.map(w => w.name)) }),
-            },
-            stdio: ['inherit', 'inherit', 'inherit', 'ipc'],
-            execArgv,
-        });
-        devserverProcess.on('exit', (code, signal) => {
-            devserverProcess = null;
-            if (signal)
-                return; // ANY signal = intentional kill (TERM/INT/KILL) — never respawn a corpse
-            console.error(`[serve] devserver exited unexpectedly (code=${code}, signal=${signal}) — respawning in 1.5s`);
-            // Supervision: the watcher may sit idle (no rebuild event) forever —
-            // without this the service stays podless until a source edit.
-            setTimeout(() => {
-                if (!devserverProcess && firstBuildComplete)
-                    startDevServer();
-            }, 1500).unref?.();
-        });
-        console.log(`[serve] Devserver started on port ${port} (service: ${serviceName}${servePrefix ? `, prefix: /${servePrefix}` : ''})`);
-        if (debugPort) {
-            console.log(`[serve] Debug: pod inspectors on 127.0.0.1:${debugPort}+ — click the "Debugger listening" link in the console, or attach WebStorm (Attach to Node.js/Chrome) to port ${debugPort}`);
-        }
-        else {
-            console.log(`[serve] Debug on demand: POST http://localhost:${port}/webpack/debug (optionally ?port=<base>) opens pod inspectors without a restart`);
-        }
-        if (logFile) {
-            console.log(`[serve] Logs teed to ${logFile} — tail it in WebStorm via Run/Debug configuration → Logs tab`);
-        }
-    }
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    function _notifyDevServerReload() {
-        if (!devserverProcess || devserverProcess.killed) {
-            console.log('[serve] Devserver not running, restarting...');
-            startDevServer();
-            return;
-        }
-        fetch(`http://localhost:${port}/webpack/reload`, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: '{}',
-        })
-            .then(() => console.log('[serve] Notified devserver to reload'))
-            .catch((err) => {
-            console.warn('[serve] Failed to notify devserver, restarting...', err.message);
-            cleanup();
-            startDevServer();
-        });
-    }
-    // Start webpack in watch mode
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    const { watch: _watch, ...normalizedConfig } = config;
-    const compiler = webpack(normalizedConfig);
-    // Event queue for the async generator
-    let resolveNext = null;
-    const pendingResults = [];
-    function pushResult(result) {
-        if (resolveNext) {
-            const resolve = resolveNext;
-            resolveNext = null;
-            resolve(result);
-        }
-        else {
-            pendingResults.push(result);
-        }
-    }
-    function waitForNext() {
-        if (pendingResults.length > 0) {
-            return Promise.resolve(pendingResults.shift());
-        }
-        return new Promise((resolve) => { resolveNext = resolve; });
-    }
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const watching = compiler.watch(config.watchOptions || {}, (err, stats) => {
-        if (err) {
-            console.error('[serve] Webpack error:', err);
-            pushResult({ success: false });
-            return;
-        }
-        const hasErrors = stats.hasErrors();
-        console.info(stats.toString({ colors: true, chunks: false, assets: true }));
-        if (hasErrors) {
-            // Don't kill the devserver — keep the last good build running
-            pushResult({ success: false });
-            return;
-        }
-        if (!firstBuildComplete || !devserverProcess) {
-            // first SUCCESSFUL build (a failed first compile must not strand the
-            // service devserver-less forever), or the devserver died while webpack
-            // recovered — fork it now.
-            firstBuildComplete = true;
-            startDevServer();
-        }
-        // Note: subsequent reloads are handled by DevServerReloadPlugin in webpack config
-        // which POSTs to /webpack/reload. We don't need to do it here since the plugin fires
-        // after each successful build.
-        pushResult({
-            success: true,
-            baseUrl: `http://localhost:${port}`,
-        });
-    });
-    // Main generator loop: yield each build result
-    try {
-        while (true) {
-            const result = await waitForNext();
-            yield result;
-        }
-    }
-    finally {
-        // Generator was returned/thrown (Nx killed the executor)
-        watching.close(() => { });
-        cleanup();
-        // Remove signal handlers
-        signalHandlers.forEach(({ sig, handler }) => process.removeListener(sig, handler));
-    }
-}
-exports.default = serveExecutor;
-module.exports = serveExecutor;
-module.exports.default = serveExecutor;
+"use strict";var Y=Object.defineProperty;var a=(e,o)=>Y(e,"name",{value:o,configurable:!0});var J=Object.defineProperty,c=a((e,o)=>J(e,"name",{value:o,configurable:!0}),"c");Object.defineProperty(exports,"__esModule",{value:!0});const tslib_1=require("tslib"),path=tslib_1.__importStar(require("node:path")),fs=tslib_1.__importStar(require("node:fs")),node_child_process_1=require("node:child_process"),yaml=tslib_1.__importStar(require("js-yaml")),create_webpack_dev_1=require("../../create-webpack-dev"),webpack=require("webpack");async function*serveExecutor(e,o){process.env.NODE_ENV="development";const C=o.projectsConfigurations.projects[o.projectName],n=o.root,u=path.join(n,C.root),L=e.outputPath?path.join(n,e.outputPath):path.join(n,"dist",C.root),j=e.configEnv||"development",S=path.join(n,"config",`config.${j}.yaml`),_=3050;let i=_,l=o.projectName,m={};fs.existsSync(S)?(m=yaml.load(fs.readFileSync(S,"utf8")),i=Number(m.port)||i,l=m.serviceName||l):console.warn(`[serve] ${o.projectName}: no config file at ${S} \u2014 public devserver port defaults to ${_}. If another service also lacks its config, both bind ${_} \u2192 EADDRINUSE. Add config/config.${j}.yaml with a distinct \`port:\` (matching this project's cluster.port).`),e.serviceName&&(l=e.serviceName);const y=e.servePrefix??"",d=e.debugPort??(Number(process.env.LENSMCP_DEBUG_PORT)||void 0),p=e.logFile?path.resolve(n,e.logFile):process.env.LENSMCP_LOG_FILE||void 0;p&&(fs.mkdirSync(path.dirname(p),{recursive:!0}),fs.writeFileSync(p,""));let N,P;e.gateway?.middleware&&(N=path.resolve(u,e.gateway.middleware),P=JSON.stringify(m));const I=e.entryFile||"./src/deployments/service/main.ts",A=e.tsConfigFile||"./tsconfig.app.json",$=path.resolve(u,I),F=path.resolve(u,A),G=(e.workers||[]).map(t=>({entryName:t.name,entryPath:path.resolve(u,t.entryPath)})),k=(0,create_webpack_dev_1.createDevWebpackConfig)({appName:o.projectName,appRoot:u,outputDir:L,main:$,tsConfig:F,assets:e.assets||[],additionalEntryPoints:G,port:i,serviceName:l,memoryLimit:e.memoryLimit||8192,buildLibsFromSource:e.buildLibsFromSource!==!1,workspaceRoot:n,orgScopes:e.orgScopes||[],bundlePackages:e.bundlePackages||[],nodeExternalsConfig:e.nodeExternalsConfig,webpackConfigPath:e.webpackConfigPath,httpsReload:e.gateway?.https===!0});let s=null,b=!1;const R=path.join(__dirname,"../../main.devserver.js"),O=path.join(__dirname,"../../main.devserver.ts"),x=!fs.existsSync(R)&&fs.existsSync(O),w=x?O:R,M=path.join(L,"main.js");function v(){s&&!s.killed&&(s.kill("SIGTERM"),s=null)}a(v,"f"),c(v,"cleanup");const W=["SIGINT","SIGTERM","SIGHUP","SIGQUIT"].map(t=>{const r=c(()=>v(),"handler");return process.on(t,r),{sig:t,handler:r}});process.on("exit",v);function g(){if(!fs.existsSync(w)){console.error(`[serve] devserver script not found at ${w}`);return}const t=["--enable-source-maps"];x&&t.unshift("--require","@swc-node/register"),s=(0,node_child_process_1.fork)(w,{cwd:n,env:{...process.env,PORT:String(i),SERVICE_NAME:l,SERVE_PREFIX:y,LENSMCP_PROJECT:process.env.LENSMCP_PROJECT||o.projectName||l,LENSMCP_EVENT_FILE:process.env.LENSMCP_EVENT_FILE||path.join(n,".lensmcp","events.jsonl"),CHILD_COUNT:String(e.childCount||process.env.CHILD_COUNT||1),BUNDLE_PATH:M,...N&&{GATEWAY_MIDDLEWARE:N},...P&&{GATEWAY_CONFIG:P},...e.gateway?.routes?.length&&{GATEWAY_ROUTES:JSON.stringify(e.gateway.routes)},...e.gateway?.https&&{GATEWAY_HTTPS:"1"},...e.gateway?.extraPorts?.length&&{GATEWAY_EXTRA_PORTS:JSON.stringify(e.gateway.extraPorts)},...e.internalPort&&{INTERNAL_PORT:String(e.internalPort)},...d&&{LENSMCP_DEBUG_PORT:String(d)},...p&&{LENSMCP_LOG_FILE:p},...e.workers?.length&&{WORKERS:JSON.stringify(e.workers.map(r=>r.name))}},stdio:["inherit","inherit","inherit","ipc"],execArgv:t}),s.on("exit",(r,E)=>{s=null,!E&&(console.error(`[serve] devserver exited unexpectedly (code=${r}, signal=${E}) \u2014 respawning in 1.5s`),setTimeout(()=>{!s&&b&&g()},1500).unref?.())}),console.log(`[serve] Devserver started on port ${i} (service: ${l}${y?`, prefix: /${y}`:""})`),console.log(d?`[serve] Debug: pod inspectors on 127.0.0.1:${d}+ \u2014 click the "Debugger listening" link in the console, or attach WebStorm (Attach to Node.js/Chrome) to port ${d}`:`[serve] Debug on demand: POST http://localhost:${i}/webpack/debug (optionally ?port=<base>) opens pod inspectors without a restart`),p&&console.log(`[serve] Logs teed to ${p} \u2014 tail it in WebStorm via Run/Debug configuration \u2192 Logs tab`)}a(g,"v"),c(g,"startDevServer");function U(){if(!s||s.killed){console.log("[serve] Devserver not running, restarting..."),g();return}fetch(`http://localhost:${i}/webpack/reload`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"}).then(()=>console.log("[serve] Notified devserver to reload")).catch(t=>{console.warn("[serve] Failed to notify devserver, restarting...",t.message),v(),g()})}a(U,"B"),c(U,"_notifyDevServerReload");const{watch:B,...q}=k,V=webpack(q);let f=null;const T=[];function h(t){if(f){const r=f;f=null,r(t)}else T.push(t)}a(h,"b"),c(h,"pushResult");function D(){return T.length>0?Promise.resolve(T.shift()):new Promise(t=>{f=t})}a(D,"W"),c(D,"waitForNext");const H=V.watch(k.watchOptions||{},(t,r)=>{if(t){console.error("[serve] Webpack error:",t),h({success:!1});return}const E=r.hasErrors();if(console.info(r.toString({colors:!0,chunks:!1,assets:!0})),E){h({success:!1});return}(!b||!s)&&(b=!0,g()),h({success:!0,baseUrl:`http://localhost:${i}`})});try{for(;;)yield await D()}finally{H.close(()=>{}),v(),W.forEach(({sig:t,handler:r})=>process.removeListener(t,r))}}a(serveExecutor,"serveExecutor"),c(serveExecutor,"serveExecutor"),exports.default=serveExecutor,module.exports=serveExecutor,module.exports.default=serveExecutor;

package/executors/trust/trust.impl.js

@@ -1,162 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.default = trustExecutor;
-exports.collectHosts = collectHosts;
-const tslib_1 = require("tslib");
-const node_child_process_1 = require("node:child_process");
-const fs = tslib_1.__importStar(require("node:fs"));
-const path = tslib_1.__importStar(require("node:path"));
-const basic_ssl_1 = require("../../basic-ssl");
-/**
- * `trust` executor — one idempotent command that makes the HTTPS dev gateway
- * green in real browsers:
- *
- *   1. resolves the MACHINE-LEVEL dev CA (`~/.lensmcp/ca`) — minting it if
- *      missing, or promoting this workspace's legacy per-workspace CA so
- *      existing keychain trust carries over,
- *   2. adds it ONCE PER MACHINE to the macOS System keychain (`sudo security
- *      add-trusted-cert`) — every leaf rotation / new hostname / new workspace
- *      then chains to it with no interstitial,
- *   3. writes BOTH `/etc/hosts` families (`127.0.0.1` + `::1`) for every
- *      gateway route hostname — the missing `::1` line is what sends `.local`
- *      AAAA lookups to Bonjour/mDNS and costs ~5s per resolution,
- *   4. flushes the DNS cache.
- *
- * Hostnames come from the project's serve target gateway routes (wildcards
- * skipped — they can't live in /etc/hosts) plus any `hosts` option extras.
- * Run it from a terminal: sudo prompts for your password inline.
- */
-async function trustExecutor(options, context) {
-    // The workspace cert-cache dir is only the PROMOTION SOURCE now: ensureCaSync resolves the machine-level
-    // CA (~/.lensmcp/ca), adopting a pre-existing per-workspace CA from here so its keychain trust survives.
-    const cacheDir = path.join(context.root, 'node_modules', '.cache', 'davnx-webpack');
-    const caPath = (0, basic_ssl_1.ensureCaSync)(cacheDir);
-    // HOSTS-ONLY mode (set by the CLI when this workspace is a GUEST of a shared daemon): the daemon serves
-    // TLS with ITS own already-trusted CA, so this workspace's CA is unused — skip the keychain step + the
-    // (misleading) file-based CA verify, and set up /etc/hosts + DNS only. The CLI reports the REAL served-cert
-    // trust afterward.
-    const hostsOnly = process.env['LENSMCP_TRUST_HOSTS_ONLY'] === '1';
-    const hosts = collectHosts(options, context);
-    if (hosts.length === 0) {
-        console.log('[trust] no concrete hostnames found (only wildcards?) — keychain step only.');
-    }
-    if (process.platform !== 'darwin') {
-        console.log('[trust] non-macOS platform — do these manually:');
-        console.log(`  • trust ${caPath} in your OS/browser store (Linux: update-ca-certificates / certutil)`);
-        for (const h of hosts)
-            console.log(`  • /etc/hosts: "127.0.0.1 ${h}" and "::1 ${h}"`);
-        return { success: true };
-    }
-    // --- 1) CA into the System keychain (skip when already there, or in hosts-only/guest mode) -----------
-    // "Already there" must match by FINGERPRINT, not CN: every workspace mints its own CA under the same
-    // "lensmcp local dev CA" name, so a same-named cert from another workspace (or a pre-rotation stale one)
-    // would otherwise satisfy a name lookup while the CA this gateway actually serves stays untrusted —
-    // the browser interstitial with a green-looking trust log.
-    const fingerprint = caSha256Fingerprint(caPath);
-    const present = hostsOnly ||
-        (fingerprint !== undefined &&
-            (0, node_child_process_1.spawnSync)('security', ['find-certificate', '-a', '-c', 'lensmcp local dev CA', '-Z', '/Library/Keychains/System.keychain'], { encoding: 'utf8' }).stdout?.includes(fingerprint) === true);
-    if (hostsOnly) {
-        console.log('[trust] hosts-only: a shared daemon serves TLS with its own CA — skipping the keychain step.');
-    }
-    else if (present) {
-        console.log('[trust] CA already in the System keychain — skipping.');
-    }
-    else {
-        console.log(`[trust] adding CA to the System keychain (sudo will prompt): ${caPath}`);
-        const r = (0, node_child_process_1.spawnSync)('sudo', ['security', 'add-trusted-cert', '-d', '-r', 'trustRoot', '-k', '/Library/Keychains/System.keychain', caPath], { stdio: 'inherit' });
-        if (r.status !== 0) {
-            console.error('[trust] add-trusted-cert failed — rerun in a terminal so sudo can prompt.');
-            return { success: false };
-        }
-        console.log('[trust] CA trusted. Restart your browser once (it caches certificate verdicts).');
-    }
-    // --- 2) /etc/hosts: both address families per hostname ------------------
-    const etcHosts = fs.readFileSync('/etc/hosts', 'utf8');
-    const hasEntry = (ip, host) => etcHosts.split('\n').some((line) => {
-        const t = line.trim();
-        if (t.startsWith('#'))
-            return false;
-        const cols = t.split(/\s+/);
-        return cols[0] === ip && cols.slice(1).includes(host);
-    });
-    const missing = [];
-    for (const h of hosts) {
-        if (!hasEntry('127.0.0.1', h))
-            missing.push(`127.0.0.1 ${h}`);
-        if (!hasEntry('::1', h))
-            missing.push(`::1 ${h}`);
-    }
-    if (missing.length === 0) {
-        console.log('[trust] /etc/hosts already complete (both families for every hostname).');
-    }
-    else {
-        console.log(`[trust] appending to /etc/hosts (sudo):\n  ${missing.join('\n  ')}`);
-        const script = `printf '%s\\n' ${missing.map((l) => `'${l}'`).join(' ')} >> /etc/hosts`;
-        const r = (0, node_child_process_1.spawnSync)('sudo', ['sh', '-c', script], { stdio: 'inherit' });
-        if (r.status !== 0) {
-            console.error('[trust] /etc/hosts update failed.');
-            return { success: false };
-        }
-        // --- 3) flush DNS so the new entries take effect immediately ----------
-        (0, node_child_process_1.spawnSync)('sudo', ['sh', '-c', 'dscacheutil -flushcache; killall -HUP mDNSResponder'], { stdio: 'inherit' });
-    }
-    // --- 4) verify ------------------------------------------------------------
-    // Skip in hosts-only mode: verifying THIS workspace's (unused) CA file would falsely report "NOT TRUSTED"
-    // — the daemon serves with its own CA, and the CLI probes the real served cert's trust after this returns.
-    if (!hostsOnly) {
-        const verify = (0, node_child_process_1.spawnSync)('security', ['verify-cert', '-c', caPath, '-p', 'basic'], { stdio: 'ignore' });
-        console.log(`[trust] CA trust check: ${verify.status === 0 ? 'OK' : 'NOT TRUSTED YET (browser restart may be needed)'}`);
-    }
-    for (const h of hosts) {
-        console.log(`[trust] ${h} → https ready (hosts + cert SAN ride the gateway config)`);
-    }
-    return { success: true };
-}
-/**
- * SHA-256 of the CA file as uppercase hex without separators — the exact format
- * `security find-certificate -Z` prints ("SHA-256 hash: <hex>"), so the caller
- * can substring-match the keychain listing. `undefined` when openssl can't read
- * the file (caller then falls through to add-trusted-cert, which is idempotent).
- */
-function caSha256Fingerprint(caPath) {
-    const r = (0, node_child_process_1.spawnSync)('openssl', ['x509', '-in', caPath, '-noout', '-fingerprint', '-sha256'], { encoding: 'utf8' });
-    if (r.status !== 0 || !r.stdout)
-        return undefined;
-    const hex = r.stdout.split('=')[1]?.replaceAll(':', '').trim().toUpperCase();
-    return hex && /^[0-9A-F]{64}$/.test(hex) ? hex : undefined;
-}
-function collectHosts(options, context) {
-    const found = [];
-    // 1) This project's embedded gateway routes (single-service setups).
-    const project = context.projectName
-        ? context.projectsConfigurations?.projects[context.projectName]
-        : undefined;
-    const serveTarget = options.serveTarget ?? 'serve-hmr';
-    const routes = project?.targets?.[serveTarget]?.options?.gateway?.routes ?? [];
-    for (const r of routes) {
-        if (r.host && !r.host.includes('*'))
-            found.push(r.host);
-    }
-    // 2) Every project's `davnx` declaration — the workspace gateway picture.
-    for (const p of Object.values(context.projectsConfigurations?.projects ?? {})) {
-        try {
-            const raw = JSON.parse(fs.readFileSync(path.join(context.root, p.root, 'project.json'), 'utf8'));
-            const decl = raw.cluster ?? raw.davnx;
-            const h = decl?.host;
-            if (h && !h.includes('*')) {
-                found.push(h);
-                // socket-pool services also get internal.<host> (east-west, no middleware)
-                if (decl?.service && decl.internalHost !== false) {
-                    found.push(typeof decl.internalHost === 'string' ? decl.internalHost : `internal.${h}`);
-                }
-            }
-        }
-        catch {
-            /* projects without a project.json (package.json-inferred) — skip */
-        }
-    }
-    // The lens dashboard host is always served by the gateway (at lensmcp.local/<key>/),
-    // so it must resolve + be in the cert SANs like any other dev host.
-    return [...new Set([...found, 'lensmcp.local', ...(options.hosts ?? [])])];
-}
+"use strict";var v=Object.defineProperty;var p=(e,t)=>v(e,"name",{value:t,configurable:!0});var m=Object.defineProperty,d=p((e,t)=>m(e,"name",{value:t,configurable:!0}),"d");Object.defineProperty(exports,"__esModule",{value:!0}),exports.default=trustExecutor,exports.collectHosts=collectHosts;const tslib_1=require("tslib"),node_child_process_1=require("node:child_process"),fs=tslib_1.__importStar(require("node:fs")),path=tslib_1.__importStar(require("node:path")),basic_ssl_1=require("../../basic-ssl");async function trustExecutor(e,t){const o=path.join(t.root,"node_modules",".cache","davnx-webpack"),n=(0,basic_ssl_1.ensureCaSync)(o),u=process.env.LENSMCP_TRUST_HOSTS_ONLY==="1",a=collectHosts(e,t);if(a.length===0&&console.log("[trust] no concrete hostnames found (only wildcards?) \u2014 keychain step only."),process.platform!=="darwin"){console.log("[trust] non-macOS platform \u2014 do these manually:"),console.log(`  \u2022 trust ${n} in your OS/browser store (Linux: update-ca-certificates / certutil)`);for(const s of a)console.log(`  \u2022 /etc/hosts: "127.0.0.1 ${s}" and "::1 ${s}"`);return{success:!0}}const r=caSha256Fingerprint(n),h=u||r!==void 0&&(0,node_child_process_1.spawnSync)("security",["find-certificate","-a","-c","lensmcp local dev CA","-Z","/Library/Keychains/System.keychain"],{encoding:"utf8"}).stdout?.includes(r)===!0;if(u)console.log("[trust] hosts-only: a shared daemon serves TLS with its own CA \u2014 skipping the keychain step.");else if(h)console.log("[trust] CA already in the System keychain \u2014 skipping.");else{if(console.log(`[trust] adding CA to the System keychain (sudo will prompt): ${n}`),(0,node_child_process_1.spawnSync)("sudo",["security","add-trusted-cert","-d","-r","trustRoot","-k","/Library/Keychains/System.keychain",n],{stdio:"inherit"}).status!==0)return console.error("[trust] add-trusted-cert failed \u2014 rerun in a terminal so sudo can prompt."),{success:!1};console.log("[trust] CA trusted. Restart your browser once (it caches certificate verdicts).")}const c=fs.readFileSync("/etc/hosts","utf8"),i=d((s,f)=>c.split(`
+`).some(S=>{const y=S.trim();if(y.startsWith("#"))return!1;const g=y.split(/\s+/);return g[0]===s&&g.slice(1).includes(f)}),"hasEntry"),l=[];for(const s of a)i("127.0.0.1",s)||l.push(`127.0.0.1 ${s}`),i("::1",s)||l.push(`::1 ${s}`);if(l.length===0)console.log("[trust] /etc/hosts already complete (both families for every hostname).");else{console.log(`[trust] appending to /etc/hosts (sudo):
+  ${l.join(`
+  `)}`);const s=`printf '%s\\n' ${l.map(f=>`'${f}'`).join(" ")} >> /etc/hosts`;if((0,node_child_process_1.spawnSync)("sudo",["sh","-c",s],{stdio:"inherit"}).status!==0)return console.error("[trust] /etc/hosts update failed."),{success:!1};(0,node_child_process_1.spawnSync)("sudo",["sh","-c","dscacheutil -flushcache; killall -HUP mDNSResponder"],{stdio:"inherit"})}if(!u){const s=(0,node_child_process_1.spawnSync)("security",["verify-cert","-c",n,"-p","basic"],{stdio:"ignore"});console.log(`[trust] CA trust check: ${s.status===0?"OK":"NOT TRUSTED YET (browser restart may be needed)"}`)}for(const s of a)console.log(`[trust] ${s} \u2192 https ready (hosts + cert SAN ride the gateway config)`);return{success:!0}}p(trustExecutor,"trustExecutor"),d(trustExecutor,"trustExecutor");function caSha256Fingerprint(e){const t=(0,node_child_process_1.spawnSync)("openssl",["x509","-in",e,"-noout","-fingerprint","-sha256"],{encoding:"utf8"});if(t.status!==0||!t.stdout)return;const o=t.stdout.split("=")[1]?.replaceAll(":","").trim().toUpperCase();return o&&/^[0-9A-F]{64}$/.test(o)?o:void 0}p(caSha256Fingerprint,"caSha256Fingerprint"),d(caSha256Fingerprint,"caSha256Fingerprint");function collectHosts(e,t){const o=[],n=t.projectName?t.projectsConfigurations?.projects[t.projectName]:void 0,u=e.serveTarget??"serve-hmr",a=n?.targets?.[u]?.options?.gateway?.routes??[];for(const r of a)r.host&&!r.host.includes("*")&&o.push(r.host);for(const r of Object.values(t.projectsConfigurations?.projects??{}))try{const h=JSON.parse(fs.readFileSync(path.join(t.root,r.root,"project.json"),"utf8")),c=h.cluster??h.davnx,i=c?.host;i&&!i.includes("*")&&(o.push(i),c?.service&&c.internalHost!==!1&&o.push(typeof c.internalHost=="string"?c.internalHost:`internal.${i}`))}catch{}return[...new Set([...o,"lensmcp.local",...e.hosts??[]])]}p(collectHosts,"collectHosts"),d(collectHosts,"collectHosts");

package/gateway.js

@@ -1,35 +1 @@
-"use strict";
-/**
- * `@lensmcp/cluster/gateway` — the PRODUCTION gateway's public, extendable surface.
- *
- * This is the **deployable edge** (`startProdGateway` — Fastify + undici reverse
- * proxy, manifest-driven, the thing `Dockerfile.prod-gateway` runs). A consumer
- * (e.g. tetros' `server/apps/gateway`) imports from here to run or extend it with
- * its own providers/middleware and ship a specialized image.
- *
- * ⚠️ This is NOT the DEV cluster gateway. The dev gateway is the
- * `@lensmcp/cluster:gateway` nx EXECUTOR (`gateway.lib.ts` → `startGateway`) — a
- * local-only HTTPS front door on :443 that fronts unix-socket pods for
- * development. The two share a routing core (`manifest.ts`) but are separate
- * lifecycles: dev = an nx target you run locally; prod = a containerized service
- * you deploy. Kept on a separate subpath so the build-time webpack-config exports
- * in the main `@lensmcp/cluster` entry never pull in fastify/undici.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.manifestFromClusterDecl = exports.DEFAULT_REGISTRY_PREFIX = exports.redisRegistrySource = exports.createRegistryProviders = exports.endpointsPodProvider = exports.staticManifestProvider = exports.startProdGateway = void 0;
-// The prod gateway engine + its option/handle contract.
-var prod_gateway_lib_1 = require("./executors/gateway/prod-gateway.lib");
-Object.defineProperty(exports, "startProdGateway", { enumerable: true, get: function () { return prod_gateway_lib_1.startProdGateway; } });
-// Static (in-memory) providers — build a gateway from explicit manifests/endpoints.
-var providers_prod_1 = require("./executors/gateway/providers-prod");
-Object.defineProperty(exports, "staticManifestProvider", { enumerable: true, get: function () { return providers_prod_1.staticManifestProvider; } });
-Object.defineProperty(exports, "endpointsPodProvider", { enumerable: true, get: function () { return providers_prod_1.endpointsPodProvider; } });
-// Redis-backed registry providers — the prod path (manifests/rollout read live from Redis).
-var registry_source_1 = require("./executors/gateway/registry-source");
-Object.defineProperty(exports, "createRegistryProviders", { enumerable: true, get: function () { return registry_source_1.createRegistryProviders; } });
-Object.defineProperty(exports, "redisRegistrySource", { enumerable: true, get: function () { return registry_source_1.redisRegistrySource; } });
-Object.defineProperty(exports, "DEFAULT_REGISTRY_PREFIX", { enumerable: true, get: function () { return registry_source_1.DEFAULT_REGISTRY_PREFIX; } });
-// Manifest/route types + the cluster-decl → manifest converter (derive prod
-// manifests from the SAME project.json `cluster` declarations dev uses).
-var manifest_1 = require("./executors/gateway/manifest");
-Object.defineProperty(exports, "manifestFromClusterDecl", { enumerable: true, get: function () { return manifest_1.manifestFromClusterDecl; } });
+"use strict";var s=Object.defineProperty;var i=(r,t)=>s(r,"name",{value:t,configurable:!0});var o=Object.defineProperty,e=i((r,t)=>o(r,"name",{value:t,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.manifestFromClusterDecl=exports.DEFAULT_REGISTRY_PREFIX=exports.redisRegistrySource=exports.createRegistryProviders=exports.endpointsPodProvider=exports.staticManifestProvider=exports.startProdGateway=void 0;var prod_gateway_lib_1=require("./executors/gateway/prod-gateway.lib");Object.defineProperty(exports,"startProdGateway",{enumerable:!0,get:e(function(){return prod_gateway_lib_1.startProdGateway},"get")});var providers_prod_1=require("./executors/gateway/providers-prod");Object.defineProperty(exports,"staticManifestProvider",{enumerable:!0,get:e(function(){return providers_prod_1.staticManifestProvider},"get")}),Object.defineProperty(exports,"endpointsPodProvider",{enumerable:!0,get:e(function(){return providers_prod_1.endpointsPodProvider},"get")});var registry_source_1=require("./executors/gateway/registry-source");Object.defineProperty(exports,"createRegistryProviders",{enumerable:!0,get:e(function(){return registry_source_1.createRegistryProviders},"get")}),Object.defineProperty(exports,"redisRegistrySource",{enumerable:!0,get:e(function(){return registry_source_1.redisRegistrySource},"get")}),Object.defineProperty(exports,"DEFAULT_REGISTRY_PREFIX",{enumerable:!0,get:e(function(){return registry_source_1.DEFAULT_REGISTRY_PREFIX},"get")});var manifest_1=require("./executors/gateway/manifest");Object.defineProperty(exports,"manifestFromClusterDecl",{enumerable:!0,get:e(function(){return manifest_1.manifestFromClusterDecl},"get")});

package/index.js

@@ -1,16 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveEventFile = exports.publishTypecheckRun = exports.parseTscOutput = exports.parseTscDiagnosticLine = exports.buildTypecheckRunEvents = exports.appendTypecheckEvents = exports.createProdWebpackConfig = exports.createDevWebpackConfig = exports.buildScopePatterns = void 0;
-var build_scope_patterns_1 = require("./build-scope-patterns");
-Object.defineProperty(exports, "buildScopePatterns", { enumerable: true, get: function () { return build_scope_patterns_1.buildScopePatterns; } });
-var create_webpack_dev_1 = require("./create-webpack-dev");
-Object.defineProperty(exports, "createDevWebpackConfig", { enumerable: true, get: function () { return create_webpack_dev_1.createDevWebpackConfig; } });
-var create_webpack_prod_1 = require("./create-webpack-prod");
-Object.defineProperty(exports, "createProdWebpackConfig", { enumerable: true, get: function () { return create_webpack_prod_1.createProdWebpackConfig; } });
-var typecheck_bus_1 = require("./typecheck-bus");
-Object.defineProperty(exports, "appendTypecheckEvents", { enumerable: true, get: function () { return typecheck_bus_1.appendTypecheckEvents; } });
-Object.defineProperty(exports, "buildTypecheckRunEvents", { enumerable: true, get: function () { return typecheck_bus_1.buildTypecheckRunEvents; } });
-Object.defineProperty(exports, "parseTscDiagnosticLine", { enumerable: true, get: function () { return typecheck_bus_1.parseTscDiagnosticLine; } });
-Object.defineProperty(exports, "parseTscOutput", { enumerable: true, get: function () { return typecheck_bus_1.parseTscOutput; } });
-Object.defineProperty(exports, "publishTypecheckRun", { enumerable: true, get: function () { return typecheck_bus_1.publishTypecheckRun; } });
-Object.defineProperty(exports, "resolveEventFile", { enumerable: true, get: function () { return typecheck_bus_1.resolveEventFile; } });
+"use strict";var p=Object.defineProperty;var c=(t,r)=>p(t,"name",{value:r,configurable:!0});var n=Object.defineProperty,e=c((t,r)=>n(t,"name",{value:r,configurable:!0}),"e");Object.defineProperty(exports,"__esModule",{value:!0}),exports.resolveEventFile=exports.publishTypecheckRun=exports.parseTscOutput=exports.parseTscDiagnosticLine=exports.buildTypecheckRunEvents=exports.appendTypecheckEvents=exports.createProdWebpackConfig=exports.createDevWebpackConfig=exports.buildScopePatterns=void 0;var build_scope_patterns_1=require("./build-scope-patterns");Object.defineProperty(exports,"buildScopePatterns",{enumerable:!0,get:e(function(){return build_scope_patterns_1.buildScopePatterns},"get")});var create_webpack_dev_1=require("./create-webpack-dev");Object.defineProperty(exports,"createDevWebpackConfig",{enumerable:!0,get:e(function(){return create_webpack_dev_1.createDevWebpackConfig},"get")});var create_webpack_prod_1=require("./create-webpack-prod");Object.defineProperty(exports,"createProdWebpackConfig",{enumerable:!0,get:e(function(){return create_webpack_prod_1.createProdWebpackConfig},"get")});var typecheck_bus_1=require("./typecheck-bus");Object.defineProperty(exports,"appendTypecheckEvents",{enumerable:!0,get:e(function(){return typecheck_bus_1.appendTypecheckEvents},"get")}),Object.defineProperty(exports,"buildTypecheckRunEvents",{enumerable:!0,get:e(function(){return typecheck_bus_1.buildTypecheckRunEvents},"get")}),Object.defineProperty(exports,"parseTscDiagnosticLine",{enumerable:!0,get:e(function(){return typecheck_bus_1.parseTscDiagnosticLine},"get")}),Object.defineProperty(exports,"parseTscOutput",{enumerable:!0,get:e(function(){return typecheck_bus_1.parseTscOutput},"get")}),Object.defineProperty(exports,"publishTypecheckRun",{enumerable:!0,get:e(function(){return typecheck_bus_1.publishTypecheckRun},"get")}),Object.defineProperty(exports,"resolveEventFile",{enumerable:!0,get:e(function(){return typecheck_bus_1.resolveEventFile},"get")});