Control plane

The control-plane is Claxedo’s gateway server — a Node-only Hono app. It owns the runnable host composition for the workspace runtime, the sandbox image build, hosted control-plane composition, auth adapters, relay resolver endpoints, telemetry, and storage. Where @claxedo/workspace-runtime ships primitives and an env-driven composition seam, this package composes them into its own runnable entrypoint so local, embedded, and in-sandbox launches cannot drift.

Private and not published. The control plane ships in-repo as @claxedo/server with private: true — deliberately unpublished while the public control-plane contract is split out from the product server surface. A rename to @claxedo/control-plane (a thin wrapper with explicit stable exports) is planned but not published under that scope. Do not treat the root exports as a stable public framework API.

Availability

There is no install line. The package is private and is consumed only inside the monorepo as a workspace dependency.

# Started in production as a Node process (illustrative):
node --import tsx src/main.ts

What it owns

• Host composition — composes @claxedo/workspace-runtime primitives into a single runnable entrypoint (src/hosts/workspace-runtime/host-entry.ts) shared by local/embedded and in-sandbox launches.
• Sandbox image — bundle-first delivery (scripts/sandbox): esbuilds the host entrypoint into .build/, which the Dockerfiles copy and symlink to /usr/local/bin/workspace-runtime. Image/snapshot versioning keys off the bundle plus SNAPSHOT_SCHEMA_VERSION.
• Gateway proxy — the /api/claxedo/... gateway resolves the active workspace target and forwards to @claxedo/workspace-relay; the relay’s resolver decisions cross the seam as RuntimeAccessTokenActiveResult.
• Connections host — the host wiring for @claxedo/connections (storage ports, gates, and configuration) lives here, not in the kit.
• Hosted app — the Cloudflare Worker–deployable control-plane composition (src/worker.ts → src/hosted-app.ts).
• Adapter boundary — Convex access is concentrated behind adapter modules (control-plane/adapters/*, sandbox-manager-adapters/stores/convex.ts) behind typed ports, with pluggable auth adapters and a documented custom-verifier swap.

Full README

See the README on GitHub for the full package-boundary rationale, host-composition/sandbox-image details, and the test-runner decision.