@bakers-build/addon-ddev 0.0.0-stage → 0.1.0-next.42

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 keytec GmbH
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,5 @@
-# Temporary Holding Version
+# @bakers-build/addon-ddev
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+DDEV-specific service discovery and claiming: HTTP(S)_EXPOSE/VIRTUAL_HOST interpretation over @bakers-build/addon-docker-compose's generic container data, plus effective-host discovery via `ddev utility configyaml`. No CMS-specific policy lives here.
+
+Part of the bakers.build CLI. Install the meta package `@bakers-build/bakers` to get the `bakers` CLI with all addons. Source: https://git.key-tec.de/bakers-build/bakers-build (bakers-cli/).

package/dist/src/claims.d.ts

@@ -0,0 +1,9 @@
+import type { ClaimContext, ClaimedService, RawPort } from './types.js';
+/**
+ * DDEV claimer — every exposed HTTP(S) route of this worktree's containers,
+ * coalesced (prefers HTTPS), named from service-type/daemon/VIRTUAL_HOST
+ * evidence. The primary web-container router port names itself `web`, Host
+ * rewritten through Traefik like any other DDEV service — no CMS-specific
+ * policy lives here.
+ */
+export declare function claimDdev(raw: readonly RawPort[], remaining: Set<number>, ctx: ClaimContext): ClaimedService[];

package/dist/src/claims.js

@@ -0,0 +1,347 @@
+// BB-676 Task 2 (spec v3 split) — claim raw observations into named,
+// tunnel-ready DDEV services. A claimer consumes raw IDENTITIES (array
+// indices into one `RawDiscovery` pass), never a global port number: two
+// containers or two site rules can share a port, so "port already seen"
+// would silently merge them.
+//
+// This package knows nothing CMS-specific: the web container's own router
+// port names itself `web` (or `web-<host>` for an additional alias), exactly
+// like every other DDEV service names from its compose/service-type/daemon
+// evidence — a project's own application owns multisite/host-header policy,
+// not this claimer (BB-681: no CMS-specific addon layered on top any more).
+//
+// Only a `healthy` claim produces `TunnelRule`s: an orphan, dead, stopped,
+// unknown or not-exposed service is still reported — so `list` can show it —
+// but never shareable.
+import { normalizeHost } from './hosts.js';
+/** Name a claimed service from the best evidence its raw row carries.
+ *  `serviceType` (`com.ddev.service-type`) is the more specific name when a
+ *  project happens to set it; `composeService` (`com.docker.compose.service`)
+ *  is the label DDEV/compose actually sets on every container. A daemon name
+ *  (a webextradaemon inside the shared web container) distinguishes
+ *  mailpit/phpmyadmin/etc from the web container's own router port. */
+function nameFromEvidence(p, webExtraExposedPortNames) {
+    if (p.daemon) {
+        const name = p.daemon.includes(':') ? p.daemon.split(':')[1] : p.daemon;
+        return name.toLowerCase();
+    }
+    // B: a dead/live row for a `web_extra_exposed_ports`-declared service
+    // (vite, xhgui, …) carries no `daemon` evidence once it stops listening —
+    // its `composeService`/`serviceType` is still just `web` (the shared
+    // container), which would otherwise collide with the primary web group's
+    // own `web` key and get suffixed into an opaque `web-<hash>-<port>` row.
+    // The declared name from `.ddev/config.yaml` is more specific evidence
+    // than that shared container label, so it is checked first.
+    if (p.containerPort !== undefined) {
+        const declared = webExtraExposedPortNames?.get(p.containerPort);
+        if (declared)
+            return declared.toLowerCase();
+    }
+    if (p.serviceType)
+        return p.serviceType.toLowerCase();
+    if (p.composeService)
+        return p.composeService.toLowerCase();
+    if (p.virtualHost) {
+        return p.virtualHost.split(',')[0].split('.')[0].toLowerCase();
+    }
+    return `service-${(p.containerId ?? 'unknown').slice(0, 8)}`;
+}
+/** The Traefik-routed target for a DDEV service: the ROUTER port DDEV's
+ *  router/Traefik listens on at the host loopback — never the
+ *  container-internal port, which only the rule's `direct` origin (dialled
+ *  by a transport that reaches container IPs) uses. */
+function routedServiceOf(p) {
+    const port = p.routerPort ?? p.hostBoundPort ?? p.containerPort ?? 443;
+    // B: an alias that only exists via HTTP_EXPOSE has no HTTPS listener behind
+    // it at all — dialling `https://` there just fails. Default to `https`
+    // only when we have no scheme evidence (e.g. a bare listening socket with
+    // no expose rule attached).
+    const scheme = p.exposeScheme === 'http' ? 'http' : 'https';
+    return `${scheme}://127.0.0.1:${port}`;
+}
+function resolveStatus(p) {
+    if (p.containerState === 'stopped')
+        return 'stopped';
+    if (p.daemonStatus === 'STOPPED' || p.daemonStatus === 'EXITED')
+        return 'stopped';
+    if (p.exposed === 'unknown' || p.listening === 'unknown')
+        return 'unknown';
+    if (p.exposed === true && p.listening === false)
+        return 'dead';
+    if (p.exposed === true && p.listening === true)
+        return 'healthy';
+    if (p.exposed === false && p.listening === true)
+        return 'not-exposed';
+    return 'unknown';
+}
+/** The sibling row carrying the SAME derived name that IS actually listening —
+ *  diagnostic evidence for a dead claim (AC4: "vite is dead, 3002 is not"),
+ *  never asserted as a verified substitute. */
+function listeningSibling(raw, containerId, excludeIdx) {
+    if (!containerId)
+        return undefined;
+    // B: real DDEV topology never repeats a dead group's derived name on the
+    // sibling that actually listens (e.g. vite is dead on 5173, the real
+    // listener is a daemon like `pynq-members-dev` on 3002) — matching by name
+    // never fires. Match by CONTAINER identity instead: any other row on the
+    // same container that is genuinely listening is diagnostic evidence worth
+    // surfacing.
+    //
+    // Critical finding 1: a container can have several genuinely-listening
+    // rows (the web-container's internal nginx, Docker's own embedded DNS
+    // stub, an actual webextradaemon). `127.0.0.11` (Docker's embedded DNS) is
+    // already filtered out upstream, but a daemon-attached row is still the
+    // most useful diagnostic evidence — name the thing an operator can
+    // actually act on, not whichever row happens to come first.
+    // A: a daemon that ALSO owns an exposed, healthy route elsewhere on the
+    // same container (mailpit on its router-mapped port) is not the
+    // diagnostic candidate an operator can "go use instead" — it already has
+    // its own working tunnel. Only an unexposed row names the thing that is
+    // actually, unexpectedly listening where the dead claim expected to find
+    // nothing else. `ss`'s row order must not decide which daemon wins.
+    const exposedDaemonNames = new Set(raw
+        .filter((p) => p.containerId === containerId &&
+        p.exposed === true &&
+        p.daemon !== undefined)
+        .map((p) => p.daemon));
+    const candidates = raw.filter((p, i) => i !== excludeIdx &&
+        p.containerId === containerId &&
+        p.listening === true &&
+        p.exposed === false &&
+        p.address !== '127.0.0.11' &&
+        !(p.daemon !== undefined && exposedDaemonNames.has(p.daemon)));
+    const webExtraDaemon = candidates.find((p) => p.daemon?.startsWith('webextradaemons:'));
+    const anyDaemon = candidates.find((p) => p.daemon !== undefined);
+    return webExtraDaemon ?? anyDaemon ?? candidates[0];
+}
+/**
+ * DDEV claimer — every exposed HTTP(S) route of this worktree's containers,
+ * coalesced (prefers HTTPS), named from service-type/daemon/VIRTUAL_HOST
+ * evidence. The primary web-container router port names itself `web`, Host
+ * rewritten through Traefik like any other DDEV service — no CMS-specific
+ * policy lives here.
+ */
+export function claimDdev(raw, remaining, ctx) {
+    const exposedIdxs = [...remaining].filter((i) => raw[i].containerId !== undefined && raw[i].exposed !== undefined);
+    // Group by (containerId, containerPort) — NOT by routerPort, and NOT by
+    // VIRTUAL_HOST: a service can be reachable through an HTTP_EXPOSE and an
+    // HTTPS_EXPOSE mapping that target the SAME container port (any non-web
+    // alias pair — mailpit, vite, … — follows this pattern); keying on router
+    // port treats those as two distinct services.
+    //
+    // Live pynq-43 topology: DDEV's nginx ALSO listens on container port 443
+    // internally even though HTTP_EXPOSE/HTTPS_EXPOSE both route to container
+    // port 80 (Traefik terminates TLS itself and only ever forwards there) —
+    // that stray, genuinely unexposed 443 socket is NOT part of the public web
+    // service, so it must never be swept into the same group as the real
+    // HTTP/HTTPS alias pair just because 80/443 are both traditionally
+    // "the" web ports. The plain containerPort key already does the right
+    // thing for both real shapes: the HTTP/HTTPS alias pair (same containerPort,
+    // different routerPort) coalesces naturally; the unrelated 443-internal
+    // socket gets its own group, surfacing separately as diagnostic evidence
+    // (R2: a bare, unexposed sibling socket on the SAME containerPort as an
+    // exposed row still joins that row's group — any other containerPort does not).
+    const groups = new Map();
+    for (const i of exposedIdxs) {
+        const p = raw[i];
+        // N2: a port-less `unattachedDaemons` row (STOPPED/EXITED, no socket to
+        // attach to) carries neither `containerPort` nor `routerPort`, so every
+        // such row on the same container used to collapse into one `:unknown`
+        // group — a RUNNING, port-less sibling (nginx/php-fpm) then won the
+        // group and a STOPPED sibling (xhgui) silently vanished instead of
+        // listing. Key port-less rows by daemon name so each keeps its own group.
+        const groupKey = (p.containerPort ?? p.routerPort)
+            ? `${p.containerId}:${p.containerPort ?? p.routerPort}`
+            : `${p.containerId}:unknown:${p.daemon ?? 'unknown'}`;
+        const entry = groups.get(groupKey) ?? [];
+        entry.push(i);
+        groups.set(groupKey, entry);
+    }
+    // B/duplicate-row fix: a group with no `containerPort` at all (an
+    // `unattachedDaemons` row — e.g. the web container's internal `nginx`, or a
+    // supervisor-listed daemon `ss`/the socket scan could not correlate to its
+    // own already-discovered socket) is DIAGNOSTIC-ONLY evidence about a
+    // container that already has a real, port-specific claim elsewhere. Once
+    // that more specific claim exists, the containerPort-less group is a pure
+    // duplicate of the same container and must not surface as its own row. A
+    // container with NO other port-bearing group at all (e.g. `db`, which is
+    // genuinely unclaimed) keeps its single generic row — this only suppresses
+    // the redundant generic twin, never a genuinely unclaimed container.
+    const containerIdsWithPort = new Set();
+    for (const i of exposedIdxs) {
+        const p = raw[i];
+        if (p.containerPort !== undefined && p.containerId !== undefined) {
+            containerIdsWithPort.add(p.containerId);
+        }
+    }
+    // Order groups so that the group whose name assignment MATTERS most (an
+    // actually `healthy` route) claims the clean, unsuffixed name — never
+    // whichever group happens to iterate first. Two sockets on the SAME
+    // container can legitimately derive the identical baseName (phpMyAdmin's
+    // extra loopback-only status socket next to its real port-80 listener;
+    // OpenSearch's internal transport port 9300 next to its real 9200 API) —
+    // a Map's insertion order is otherwise arbitrary, so the bare, operator-
+    // facing key (`phpmyadmin`, not `phpmyadmin-<hash>-80`) could land on the
+    // not-exposed diagnostic row instead of the one `ports up phpmyadmin`
+    // actually needs to resolve to.
+    const statusPriority = {
+        healthy: 0,
+        dead: 1,
+        stopped: 2,
+        unknown: 3,
+        'not-exposed': 4,
+    };
+    const orderedGroups = [...groups.values()]
+        .map((idxs, order) => {
+        const sorted = [...idxs].sort((a, b) => {
+            const score = (i) => (raw[i].exposeScheme === 'http' ? 1 : 0);
+            return score(a) - score(b);
+        });
+        const best = raw[sorted[0]];
+        return { idxs: sorted, best, status: resolveStatus(best), order };
+    })
+        .sort((a, b) => {
+        const byStatus = statusPriority[a.status] - statusPriority[b.status];
+        return byStatus !== 0 ? byStatus : a.order - b.order;
+    });
+    const out = [];
+    const seenKeys = new Set();
+    for (const { idxs, best, status } of orderedGroups) {
+        for (const i of idxs)
+            remaining.delete(i);
+        if (best.containerPort === undefined &&
+            best.containerId !== undefined &&
+            containerIdsWithPort.has(best.containerId) &&
+            // Finding 5: only suppress a RUNNING twin (nginx's own internal
+            // socket, or a daemon the socket scan already attached to a
+            // port-bearing group elsewhere on this container) — a STOPPED/EXITED
+            // `webextradaemons` entry (e.g. `xhgui`) has NO other representation
+            // anywhere else and must still list, or it silently vanishes from
+            // `list` instead of showing as `[stopped]`.
+            (best.daemon === undefined || best.daemonStatus === 'RUNNING')) {
+            // Diagnostic-only twin of a container that already has a real claim
+            // (nginx inside the web container, a daemon the socket scan already
+            // matched elsewhere on this same container) — drop it, never render it
+            // as its own row.
+            continue;
+        }
+        const baseName = nameFromEvidence(best, ctx.webExtraExposedPortNames);
+        // B: group identity is (containerId, containerPort) — never collapsed
+        // across distinct groups just because two unrelated containers happen to
+        // derive the same name. Only suffix when this exact key was already
+        // produced by an EARLIER distinct group.
+        const key = seenKeys.has(baseName)
+            ? `${baseName}-${(best.containerId ?? '').slice(0, 8)}-${best.containerPort ?? 'na'}`
+            : baseName;
+        seenKeys.add(baseName);
+        const rawPorts = idxs.map((i) => raw[i]);
+        let limitation;
+        const rules = [];
+        let healthyService;
+        if (status === 'dead') {
+            const sibling = listeningSibling(raw, best.containerId, idxs[0]);
+            limitation = sibling
+                ? `configured port ${best.routerPort ?? best.containerPort} is dead; ` +
+                    `${nameFromEvidence(sibling, ctx.webExtraExposedPortNames)} is listening on ` +
+                    `${sibling.containerPort} instead`
+                : `configured port ${best.routerPort ?? best.containerPort} is dead`;
+        }
+        else if (status === 'healthy') {
+            const service = routedServiceOf(best);
+            healthyService = service;
+            rules.push({
+                key,
+                service,
+                ...(best.virtualHost
+                    ? { hostHeader: best.virtualHost.split(',')[0] }
+                    : {}),
+                // N7: Traefik presents every DDEV-routed destination over HTTPS
+                // with its own (mkcert/self-signed) certificate — `insecureTls`
+                // belongs to the resolved TARGET's scheme, not to "is the router
+                // port literally 443". `routedServiceOf` always resolves to
+                // `https://`, so Mailpit's router 8026 needs this exactly as much
+                // as Drupal's router 443 did; the old `routerPort === 443` check
+                // silently skipped it for every other router port.
+                ...(service.startsWith('https://') ? { insecureTls: true } : {}),
+                // Transports that reach container IPs skip Traefik and keep the
+                // public Host; the `web-<host>` aliases below need Traefik's
+                // host-based routing, so they never get this.
+                ...(best.containerIp && best.containerPort
+                    ? { direct: `http://${best.containerIp}:${best.containerPort}` }
+                    : {}),
+            });
+        }
+        // Finding 6: name the actual router port an operator would dial —
+        // `https://<vhost>` alone silently implies 443, which is wrong for every
+        // non-default router port (Mailpit 8026, phpMyAdmin 8037, …).
+        const localScheme = best.exposeScheme === 'http' ? 'http' : 'https';
+        const localPort = best.routerPort;
+        const localDefaultPort = localScheme === 'http' ? 80 : 443;
+        const localSuffix = localPort && localPort !== localDefaultPort ? `:${localPort}` : '';
+        out.push({
+            key,
+            claim: 'ddev',
+            status,
+            local: best.virtualHost
+                ? `${localScheme}://${best.virtualHost.split(',')[0]}${localSuffix}`
+                : `container:${best.containerId}`,
+            ...(limitation ? { limitation } : {}),
+            rawPorts,
+            rules,
+        });
+        // BB-681 Task 1 — split the PRIMARY web group (the bare `web` key —
+        // never a duplicate-suffixed or ancillary-service group) into one
+        // additional claim per configured host, each named `web-<host-with-
+        // hyphens-for-dots>`. An alias is only eligible when it is BOTH
+        // configured (`ctx.hosts.additional`) AND observed in this group's own
+        // VIRTUAL_HOST evidence — a configured-but-unobserved alias never
+        // produces a confident claim.
+        if (key === 'web' && status === 'healthy' && ctx.hosts && healthyService) {
+            const observed = new Set((best.virtualHost ?? '')
+                .split(',')
+                .map((h) => normalizeHost(h))
+                .filter(Boolean));
+            const eligibleAliases = ctx.hosts.additional.filter((a) => observed.has(a));
+            // BB-681 review M4: two DIFFERENT hosts can produce the SAME
+            // `web-<key>` after replacing dots with hyphens (`admin.ddev-site` and
+            // `admin-ddev.site` both become `web-admin-ddev-site`). Spec: "reject
+            // collisions instead of selecting by list order" — detect every
+            // colliding aliasKey across this one call BEFORE emitting any of
+            // them, so neither alias is silently favored by iteration order.
+            const keyCounts = new Map();
+            for (const alias of eligibleAliases) {
+                const aliasKey = `web-${alias.replace(/\./g, '-')}`;
+                keyCounts.set(aliasKey, (keyCounts.get(aliasKey) ?? 0) + 1);
+            }
+            for (const alias of eligibleAliases) {
+                const aliasKey = `web-${alias.replace(/\./g, '-')}`;
+                const colliding = (keyCounts.get(aliasKey) ?? 0) > 1;
+                out.push({
+                    key: aliasKey,
+                    claim: 'ddev',
+                    status: 'healthy',
+                    local: `https://${alias}`,
+                    rawPorts,
+                    ...(colliding
+                        ? {
+                            limitation: `collides with another alias's normalized key '${aliasKey}' — neither is shareable`,
+                            rules: [],
+                        }
+                        : {
+                            rules: [
+                                {
+                                    key: aliasKey,
+                                    service: healthyService,
+                                    hostHeader: alias,
+                                    ...(healthyService.startsWith('https://')
+                                        ? { insecureTls: true }
+                                        : {}),
+                                },
+                            ],
+                        }),
+                });
+            }
+        }
+    }
+    return out;
+}

package/dist/src/discovery.d.ts

@@ -0,0 +1,39 @@
+import { type DockerComposeDeps } from '@bakers-build/addon-docker-compose';
+import type { RawDiscovery } from './types.js';
+/**
+ * DDEV's `HTTP_EXPOSE`/`HTTPS_EXPOSE` format: comma-separated
+ * `routerPort:containerPort` pairs (a bare port means router===container).
+ */
+export declare function parseExposeMapping(value: string): Array<{
+    routerPort: number;
+    containerPort: number;
+}>;
+/** `.ddev/config.yaml`'s `web_extra_exposed_ports:` — a block sequence of
+ *  `{name, container_port, http_port, https_port}` entries (real shape,
+ *  captured live from a pynq-43 worktree):
+ *  ```
+ *  web_extra_exposed_ports:
+ *    -
+ *      name: vite
+ *      container_port: 5173
+ *      http_port: 5172
+ *      https_port: 5173
+ *  ```
+ *  A targeted line-parser is enough — no need for a YAML dependency for one
+ *  array. Keyed by `container_port` since that is what a claimed row's `containerPort`
+ *  matches against (B: name a non-primary-web group from this before falling
+ *  back to the web container's generic compose-service label).
+ *
+ *  DDEV accepts both block-sequence shapes — a lone `-` starting the entry
+ *  (above) AND the inline form `- name: vite` with the first field on the
+ *  same line as the dash (DDEV's own documented style). A line starting with
+ *  `-` always begins a new entry either way; its remainder (if any) is the
+ *  first field of that entry, not a lone separator to discard. */
+export declare function parseWebExtraExposedPorts(configYaml: string | null): ReadonlyMap<number, string>;
+/**
+ * Discover this worktree's DDEV-exposed ports: every container the
+ * `com.ddev.approot` label (unioned with the generic compose working-dir
+ * label, `@bakers-build/addon-docker-compose`'s own filter) matches, interpreted
+ * through `HTTP(S)_EXPOSE`/`VIRTUAL_HOST`.
+ */
+export declare function discoverDdevPorts(worktree: string, deps: DockerComposeDeps): Promise<RawDiscovery>;

package/dist/src/discovery.js

@@ -0,0 +1,247 @@
+// BB-676 spec v2 — DDEV-specific interpretation of generic Docker Compose
+// observations: `HTTP_EXPOSE`/`HTTPS_EXPOSE` router-port parsing and the
+// `com.ddev.approot` worktree match. This is the only place in the ports
+// pipeline that knows those conventions exist.
+import { discoverCompose, } from '@bakers-build/addon-docker-compose';
+/**
+ * DDEV's `HTTP_EXPOSE`/`HTTPS_EXPOSE` format: comma-separated
+ * `routerPort:containerPort` pairs (a bare port means router===container).
+ */
+export function parseExposeMapping(value) {
+    const out = [];
+    for (const raw of value.split(',')) {
+        const part = raw.trim();
+        if (!part)
+            continue;
+        const [a, b] = part.split(':');
+        const routerPort = Number(a);
+        const containerPort = Number(b ?? a);
+        if (!Number.isInteger(routerPort) || !Number.isInteger(containerPort)) {
+            continue;
+        }
+        out.push({ routerPort, containerPort });
+    }
+    return out;
+}
+/** Tag each parsed mapping with which `*_EXPOSE` var produced it, so later
+ *  stages know the real scheme instead of guessing from the router port. */
+function parseExposeMappingWithScheme(value, scheme) {
+    return parseExposeMapping(value).map((m) => ({ ...m, scheme }));
+}
+/** `.ddev/config.yaml`'s `web_extra_exposed_ports:` — a block sequence of
+ *  `{name, container_port, http_port, https_port}` entries (real shape,
+ *  captured live from a pynq-43 worktree):
+ *  ```
+ *  web_extra_exposed_ports:
+ *    -
+ *      name: vite
+ *      container_port: 5173
+ *      http_port: 5172
+ *      https_port: 5173
+ *  ```
+ *  A targeted line-parser is enough — no need for a YAML dependency for one
+ *  array. Keyed by `container_port` since that is what a claimed row's `containerPort`
+ *  matches against (B: name a non-primary-web group from this before falling
+ *  back to the web container's generic compose-service label).
+ *
+ *  DDEV accepts both block-sequence shapes — a lone `-` starting the entry
+ *  (above) AND the inline form `- name: vite` with the first field on the
+ *  same line as the dash (DDEV's own documented style). A line starting with
+ *  `-` always begins a new entry either way; its remainder (if any) is the
+ *  first field of that entry, not a lone separator to discard. */
+export function parseWebExtraExposedPorts(configYaml) {
+    const out = new Map();
+    if (!configYaml)
+        return out;
+    const listMatch = /^web_extra_exposed_ports:\s*$/m.exec(configYaml);
+    if (!listMatch)
+        return out;
+    const rest = configYaml.slice(listMatch.index + listMatch[0].length);
+    const lines = rest.split('\n');
+    let name;
+    let containerPort;
+    const flush = () => {
+        if (name !== undefined && containerPort !== undefined) {
+            out.set(containerPort, name);
+        }
+        name = undefined;
+        containerPort = undefined;
+    };
+    const applyField = (field) => {
+        const nameM = /^\s*name:\s*['"]?([^'"#\r\n]*?)['"]?\s*(?:#.*)?$/m.exec(field);
+        if (nameM?.[1]) {
+            name = nameM[1].trim();
+            return;
+        }
+        const portM = /^\s*container_port:\s*(\d+)\s*$/m.exec(field);
+        if (portM?.[1]) {
+            containerPort = Number(portM[1]);
+        }
+    };
+    for (const line of lines) {
+        if (line.trim() === '')
+            continue;
+        // A line with no leading indentation ends this top-level key's block.
+        if (!/^\s/.test(line))
+            break;
+        const dashM = /^(\s*)-(\s*)(.*)$/.exec(line);
+        if (dashM) {
+            flush();
+            const remainder = dashM[3] ?? '';
+            if (remainder.trim() !== '')
+                applyField(remainder);
+            continue;
+        }
+        applyField(line);
+    }
+    flush();
+    return out;
+}
+function rawPortsForContainer(worktree, container) {
+    const containerState = container.running
+        ? 'running'
+        : 'stopped';
+    const virtualHost = container.env.VIRTUAL_HOST;
+    const serviceType = container.labels['com.ddev.service-type'];
+    const composeService = container.labels['com.docker.compose.service'];
+    // N8: DDEV allows `HTTP_EXPOSE` and `HTTPS_EXPOSE` on the SAME container at
+    // once — a project can expose one router port over plain HTTP and a
+    // different one over HTTPS. `??` read only one var, so the other's router
+    // mappings were silently dropped whenever both were set; merge both sets
+    // instead. A router port that appears in both wins by insertion order
+    // (HTTPS mapping taken first, matching the single-source scheme's old
+    // "HTTPS preferred" intent) rather than overwriting silently either way.
+    const mappings = [
+        ...(container.env.HTTPS_EXPOSE
+            ? parseExposeMappingWithScheme(container.env.HTTPS_EXPOSE, 'https')
+            : []),
+        ...(container.env.HTTP_EXPOSE
+            ? parseExposeMappingWithScheme(container.env.HTTP_EXPOSE, 'http')
+            : []),
+    ];
+    // N8: a `Map<containerPort, RawPort>` can only ever hold ONE row per
+    // container port, but with both expose vars set it is legitimate for the
+    // SAME container port to be reachable through two different router ports
+    // (e.g. `HTTP_EXPOSE=80:443` plus `HTTPS_EXPOSE=443:443`) — an array per
+    // port preserves both instead of the second mapping silently clobbering
+    // the first.
+    const byPort = new Map();
+    for (const mapping of mappings) {
+        const arr = byPort.get(mapping.containerPort) ?? [];
+        arr.push({
+            worktree,
+            containerId: container.id,
+            containerPort: mapping.containerPort,
+            routerPort: mapping.routerPort,
+            exposeScheme: mapping.scheme,
+            ...(virtualHost ? { virtualHost } : {}),
+            ...(serviceType ? { serviceType } : {}),
+            ...(composeService ? { composeService } : {}),
+            ...(container.boundPorts.has(mapping.containerPort)
+                ? { hostBoundPort: container.boundPorts.get(mapping.containerPort) }
+                : {}),
+            containerState,
+            exposed: true,
+            // Not yet probed: stopped containers cannot listen; running ones are
+            // resolved below, once (or left `unknown` if the probe itself failed
+            // upstream in `@bakers-build/addon-docker-compose`).
+            listening: containerState === 'running' ? 'unknown' : false,
+        });
+        byPort.set(mapping.containerPort, arr);
+    }
+    const ports = [];
+    const matchedPorts = new Set();
+    for (const socket of container.sockets) {
+        matchedPorts.add(socket.containerPort);
+        const existing = byPort.get(socket.containerPort);
+        if (existing && existing.length > 0) {
+            byPort.set(socket.containerPort, existing.map((row) => ({
+                ...row,
+                listening: true,
+                ...(socket.pid !== undefined ? { pid: socket.pid } : {}),
+                ...(socket.address !== undefined ? { address: socket.address } : {}),
+                ...(socket.daemon !== undefined
+                    ? { daemon: socket.daemon, daemonStatus: socket.daemonStatus }
+                    : {}),
+            })));
+        }
+        else {
+            // Listening but no exposure rule claims it — e.g. a daemon bound on
+            // the wrong port, or an internal-only service (AC1). This is also
+            // where the web container's own `nginx` 80/443 socket shows up when
+            // `ss` cannot resolve its (root-owned) pid — attach its bound host
+            // port here too (R2), so the claimer can still find a BB-500
+            // passthrough target for it.
+            ports.push({
+                worktree,
+                containerId: container.id,
+                containerPort: socket.containerPort,
+                ...(socket.pid !== undefined ? { pid: socket.pid } : {}),
+                ...(socket.address !== undefined ? { address: socket.address } : {}),
+                ...(serviceType ? { serviceType } : {}),
+                ...(composeService ? { composeService } : {}),
+                ...(socket.daemon !== undefined
+                    ? { daemon: socket.daemon, daemonStatus: socket.daemonStatus }
+                    : {}),
+                ...(container.boundPorts.has(socket.containerPort)
+                    ? { hostBoundPort: container.boundPorts.get(socket.containerPort) }
+                    : {}),
+                containerState,
+                exposed: false,
+                listening: true,
+            });
+        }
+    }
+    // Exposure rows the socket scan did NOT confirm are genuinely dead — but
+    // only when the probe itself succeeded; a failed probe means "unknown",
+    // never "dead", so a missing probe binary cannot revoke a live route.
+    //
+    // C: `@bakers-build/addon-docker-compose`'s `discoverCompose` now falls back to
+    // reading `/proc/net/tcp`(6) directly whenever `ss` is missing/fails
+    // outright (images like phpMyAdmin/OpenSearch ship neither `ss` nor
+    // `netstat`), so `container.socketsProbed` is already `true` whenever
+    // EITHER probe succeeded, and matched ports from that fallback already
+    // flow through `matchedPorts` above. A row that reaches here with
+    // `socketsProbed` still `false` means both probes genuinely failed — that
+    // is `unknown`, never a guess from a published host port binding (Docker
+    // binds a host port whether or not anything inside actually listens, so
+    // trusting it as proof of health reads a dead port as healthy just as
+    // often as it rescues a truly-unprobable one).
+    for (const [port, rows] of byPort) {
+        byPort.set(port, rows.map((row) => matchedPorts.has(port)
+            ? row
+            : container.socketsProbed
+                ? { ...row, listening: false }
+                : row));
+    }
+    for (const rows of byPort.values())
+        ports.push(...rows);
+    for (const daemon of container.unattachedDaemons) {
+        ports.push({
+            worktree,
+            containerId: container.id,
+            daemon: daemon.daemon,
+            daemonStatus: daemon.status,
+            containerState,
+            exposed: 'unknown',
+            listening: false,
+        });
+    }
+    const containerIp = container.networks.get('ddev_default');
+    return containerIp ? ports.map((row) => ({ ...row, containerIp })) : ports;
+}
+/**
+ * Discover this worktree's DDEV-exposed ports: every container the
+ * `com.ddev.approot` label (unioned with the generic compose working-dir
+ * label, `@bakers-build/addon-docker-compose`'s own filter) matches, interpreted
+ * through `HTTP(S)_EXPOSE`/`VIRTUAL_HOST`.
+ */
+export async function discoverDdevPorts(worktree, deps) {
+    const { containers, diagnostics: composeDiagnostics } = await discoverCompose(worktree, deps, { extraLabelFilters: ['com.ddev.approot'] });
+    const diagnostics = [...composeDiagnostics];
+    const ports = [];
+    for (const container of containers) {
+        ports.push(...rawPortsForContainer(worktree, container));
+    }
+    return { ports, diagnostics };
+}

package/dist/src/hosts.d.ts

@@ -0,0 +1,48 @@
+export interface DdevHosts {
+    readonly primary: string;
+    readonly additional: readonly string[];
+}
+/** Thrown by `parseDdevHosts` on any config shape it cannot safely derive
+ *  hosts from — a caller converts this to an `unknown` discovery result
+ *  rather than ever inventing a concrete host. */
+export declare class DdevHostsError extends Error {
+    constructor(message: string);
+}
+/** Lowercase/trailing-dot normalization, shared with anything that compares
+ *  an observed `VIRTUAL_HOST` entry against a configured host (`claims.ts`'s
+ *  alias-eligibility check). */
+export declare function normalizeHost(host: string): string;
+/**
+ * Derive `{ primary, additional }` from DDEV's effective config (the parsed
+ * `ddev utility configyaml` object, or a pre-parsed equivalent). Throws
+ * `DdevHostsError` on missing/invalid required fields, a wildcard host, or a
+ * collision between two inputs that normalize to the same host — never
+ * silently drops or invents one.
+ */
+export declare function parseDdevHosts(config: unknown): DdevHosts;
+/** The injected exec seam — the same bounded-exec pattern
+ *  `@bakers-build/addon-docker-compose`'s `discoverCompose` uses (a `run(cmd,
+ *  args, cwd?)` returning `{ stdout, ok, exitCode? }`), reused rather than
+ *  inventing a second one. */
+export interface DdevHostsDeps {
+    run(cmd: string, args: string[], cwd?: string): Promise<{
+        readonly stdout: string;
+        readonly ok: boolean;
+    }>;
+}
+export type DdevHostsResult = {
+    readonly ok: true;
+    readonly hosts: DdevHosts;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/**
+ * Discover this worktree's effective DDEV hosts via `ddev utility configyaml`
+ * (DDEV's own merged config, YAML on stdout) — parsed with the project's
+ * existing `yaml` dependency, never a hand-written parser. A failed command,
+ * unparseable YAML, or any `parseDdevHosts` rejection all become `{ ok:
+ * false }` — never a thrown exception, so a caller converts this directly to
+ * an `unknown` claim instead of crashing discovery.
+ */
+export declare function discoverDdevHosts(worktree: string, deps: DdevHostsDeps): Promise<DdevHostsResult>;

package/dist/src/hosts.js

@@ -0,0 +1,133 @@
+// BB-681 Task 1 — the project's effective DDEV hosts, read once from
+// `ddev utility configyaml` (DDEV's own merged/expanded config, not the raw
+// `.ddev/config.yaml` file, which can omit defaults DDEV fills in at
+// runtime). DDEV alone owns calling/parsing this — no other addon reads
+// `.ddev/config.yaml` for hostnames.
+import { parse as parseYaml } from 'yaml';
+/** Thrown by `parseDdevHosts` on any config shape it cannot safely derive
+ *  hosts from — a caller converts this to an `unknown` discovery result
+ *  rather than ever inventing a concrete host. */
+export class DdevHostsError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'DdevHostsError';
+    }
+}
+/** Lowercase/trailing-dot normalization, shared with anything that compares
+ *  an observed `VIRTUAL_HOST` entry against a configured host (`claims.ts`'s
+ *  alias-eligibility check). */
+export function normalizeHost(host) {
+    return host.trim().toLowerCase().replace(/\.$/, '');
+}
+/** A bare `*` or a `*.`-prefixed entry is a wildcard — DDEV accepts these in
+ *  `additional_hostnames`/`additional_fqdns`, but a wildcard is unsupported
+ *  for individual host sharing: there is no single concrete hostname to
+ *  derive from it, and inventing one would be a guess this module must never
+ *  make. */
+function isWildcard(host) {
+    return host.includes('*');
+}
+/**
+ * Derive `{ primary, additional }` from DDEV's effective config (the parsed
+ * `ddev utility configyaml` object, or a pre-parsed equivalent). Throws
+ * `DdevHostsError` on missing/invalid required fields, a wildcard host, or a
+ * collision between two inputs that normalize to the same host — never
+ * silently drops or invents one.
+ */
+export function parseDdevHosts(config) {
+    if (typeof config !== 'object' || config === null) {
+        throw new DdevHostsError('ddev config is not an object');
+    }
+    const c = config;
+    const name = c.name;
+    const projectTld = c.project_tld;
+    if (typeof name !== 'string' || !name) {
+        throw new DdevHostsError('ddev config is missing `name`');
+    }
+    if (typeof projectTld !== 'string' || !projectTld) {
+        throw new DdevHostsError('ddev config is missing `project_tld`');
+    }
+    const additionalHostnames = Array.isArray(c.additional_hostnames)
+        ? c.additional_hostnames.filter((h) => typeof h === 'string' && h.length > 0)
+        : [];
+    const additionalFqdns = Array.isArray(c.additional_fqdns)
+        ? c.additional_fqdns.filter((h) => typeof h === 'string' && h.length > 0)
+        : [];
+    const primaryRaw = `${name}.${projectTld}`;
+    if (isWildcard(primaryRaw)) {
+        throw new DdevHostsError('the primary host resolves to a wildcard — unsupported for individual host sharing');
+    }
+    const primary = normalizeHost(primaryRaw);
+    // Order of derivation: additional_hostnames first (expanded with
+    // project_tld), then additional_fqdns (literal) — a stable, input-order-
+    // independent derivation (reordering either source list must not change
+    // the resulting set), checked below by normalized-key collision, not by
+    // list position.
+    const rawAdditional = [
+        ...additionalHostnames.map((h) => `${h}.${projectTld}`),
+        ...additionalFqdns,
+    ];
+    for (const host of rawAdditional) {
+        if (isWildcard(host)) {
+            throw new DdevHostsError(`additional host '${host}' is a wildcard — unsupported for individual host sharing`);
+        }
+    }
+    const seen = new Map();
+    const additional = [];
+    for (const raw of rawAdditional) {
+        const normalized = normalizeHost(raw);
+        if (normalized === primary)
+            continue; // already covered by the primary claim
+        const prior = seen.get(normalized);
+        if (prior !== undefined && prior !== raw) {
+            throw new DdevHostsError(`two hosts normalize to the same value '${normalized}': '${prior}' and '${raw}'`);
+        }
+        if (prior === undefined) {
+            seen.set(normalized, raw);
+            additional.push(normalized);
+        }
+    }
+    return { primary, additional };
+}
+/**
+ * Discover this worktree's effective DDEV hosts via `ddev utility configyaml`
+ * (DDEV's own merged config, YAML on stdout) — parsed with the project's
+ * existing `yaml` dependency, never a hand-written parser. A failed command,
+ * unparseable YAML, or any `parseDdevHosts` rejection all become `{ ok:
+ * false }` — never a thrown exception, so a caller converts this directly to
+ * an `unknown` claim instead of crashing discovery.
+ */
+export async function discoverDdevHosts(worktree, deps) {
+    let result;
+    try {
+        result = await deps.run('ddev', ['utility', 'configyaml'], worktree);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            reason: `ddev utility configyaml failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    if (!result.ok) {
+        return { ok: false, reason: 'ddev utility configyaml failed' };
+    }
+    let parsed;
+    try {
+        parsed = parseYaml(result.stdout);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            reason: `ddev utility configyaml output is not valid YAML: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    try {
+        return { ok: true, hosts: parseDdevHosts(parsed) };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            reason: err instanceof Error ? err.message : String(err),
+        };
+    }
+}

package/dist/src/index.d.ts

@@ -0,0 +1,6 @@
+export { parseSocketListeners, type SocketListener, } from '@bakers-build/addon-docker-compose';
+export { claimDdev } from './claims.js';
+export { discoverDdevPorts, parseExposeMapping, parseWebExtraExposedPorts, } from './discovery.js';
+export type { DdevHosts, DdevHostsDeps, DdevHostsResult } from './hosts.js';
+export { DdevHostsError, discoverDdevHosts, normalizeHost, parseDdevHosts, } from './hosts.js';
+export type { ClaimContext, ClaimedDiscovery, ClaimedService, ClaimStatus, HttpProbe, RawDiagnostic, RawDiscovery, RawPort, Tri, TunnelRule, } from './types.js';

package/dist/src/index.js

@@ -0,0 +1,8 @@
+// BB-676 pass-6 review cleanup — `parseSocketListeners`/`SocketListener`
+// live in `@bakers-build/addon-docker-compose` (the lower-level package); routed
+// through here because `@bakers-build/addon-ports` may not edge to
+// `@bakers-build/addon-docker-compose` directly (see `scripts/assert-acyclic.mjs`).
+export { parseSocketListeners, } from '@bakers-build/addon-docker-compose';
+export { claimDdev } from './claims.js';
+export { discoverDdevPorts, parseExposeMapping, parseWebExtraExposedPorts, } from './discovery.js';
+export { DdevHostsError, discoverDdevHosts, normalizeHost, parseDdevHosts, } from './hosts.js';

package/dist/src/types.d.ts

@@ -0,0 +1,133 @@
+import type { DdevHosts } from './hosts.js';
+export type { DdevHosts } from './hosts.js';
+/** One OBSERVATION, not yet a claimed service. A port alone is not an
+ *  identity (two containers, two site rules can share one). `RawPort`
+ *  carries every piece of evidence a claimer needs, and a missing probe is
+ *  `unknown` — never collapsed into `false` — so a permission-denied Docker
+ *  query cannot read as "this is dead" and revoke a route that is actually
+ *  still live. */
+export type Tri = boolean | 'unknown';
+export interface RawPort {
+    readonly worktree: string;
+    readonly containerId?: string;
+    readonly containerPort?: number;
+    readonly protocol?: 'tcp' | 'udp';
+    readonly hostAddress?: string;
+    readonly hostPort?: number;
+    /** The in-container bind address a listening socket reported, when known —
+     *  used to tell Docker's embedded DNS resolver (`127.0.0.11`) apart from a
+     *  real service when picking a dead claim's "what IS listening" sibling. */
+    readonly address?: string;
+    readonly pid?: number;
+    readonly cmdline?: string;
+    readonly cwd?: string;
+    readonly cwdDeleted?: boolean;
+    /** The container's IP on the `ddev_default` network, when it has one. */
+    readonly containerIp?: string;
+    /** The router-side port of an `HTTP_EXPOSE`/`HTTPS_EXPOSE` mapping. */
+    readonly routerPort?: number;
+    /** Which `*_EXPOSE` var produced this row's router mapping — the only
+     *  reliable signal for the target scheme (B): a port that only appears in
+     *  `HTTP_EXPOSE` must be dialled over plain HTTP, never HTTPS. */
+    readonly exposeScheme?: 'http' | 'https';
+    readonly virtualHost?: string;
+    /** The `com.ddev.service-type` label, when a project sets one. Real DDEV
+     *  containers do not carry this by default — `composeService` below is the
+     *  label that is actually present — but a project may still add it, so it
+     *  is kept as the more specific naming source when it exists. */
+    readonly serviceType?: string;
+    /** The `com.docker.compose.service` label (`web`, `mailpit`, `phpmyadmin`,
+     *  `opensearch`, …) — the naming evidence DDEV/compose actually sets on
+     *  every service container; naming evidence for the claimer. */
+    readonly composeService?: string;
+    /** `supervisorctl`'s `group:name`, e.g. `webextradaemons:xhgui`. */
+    readonly daemon?: string;
+    readonly daemonStatus?: 'RUNNING' | 'STOPPED' | 'EXITED' | 'UNKNOWN';
+    readonly containerState?: 'running' | 'stopped' | 'unknown';
+    /** A real socket was observed bound to this port. */
+    readonly listening: Tri;
+    /** A router/DDEV rule claims this port, regardless of whether it listens. */
+    readonly exposed: Tri;
+    /** The host-bound port `docker inspect`'s `NetworkSettings.Ports` maps this
+     *  `containerPort` to (BB-500 passthrough target), when published. */
+    readonly hostBoundPort?: number;
+}
+export interface RawDiagnostic {
+    readonly source: 'host' | 'docker' | 'web-sockets' | 'supervisor' | 'ddev-hosts';
+    readonly message: string;
+    /** D: the container this diagnostic is about, when it is about one in
+     *  particular — see `ComposeDiagnostic.containerId` (`@bakers-build/addon-docker-compose`)
+     *  for why this narrows reap's blast radius instead of widening it. */
+    readonly containerId?: string;
+    /** C: true when this `source: 'host'` diagnostic means the WHOLE host
+     *  probe (`ss -ltnpH`) failed, blinding every host-backed service at once
+     *  — the host-side equivalent of a `containerId`-less Docker diagnostic.
+     *  A per-listener host diagnostic (e.g. "no visible owner") is about one
+     *  socket, not the whole probe, and must not carry this flag. */
+    readonly wholePass?: boolean;
+}
+export interface RawDiscovery {
+    readonly ports: readonly RawPort[];
+    readonly diagnostics: readonly RawDiagnostic[];
+}
+export interface TunnelRule {
+    readonly key: string;
+    readonly service: string;
+    readonly hostHeader?: string;
+    readonly insecureTls?: boolean;
+    /** Plain-HTTP origin of the service container itself
+     *  (`http://<ddev_default IP>:<containerPort>`), reachable with the public
+     *  Host kept; only transports that can dial container IPs (frp) use it. */
+    readonly direct?: string;
+}
+export type ClaimStatus = 'healthy' | 'dead' | 'stopped' | 'not-exposed' | 'unknown';
+export interface ClaimedService {
+    readonly key: string;
+    /** The claimer that owns this service — `'process'` (a configured ports
+     *  rule), `'node'` (the all-Node rule) or `'ddev'`. */
+    readonly claim: string;
+    readonly status: ClaimStatus;
+    /** A local address worth opening on this machine. */
+    readonly local: string;
+    /** Set when the service is shareable but with a known gap (e.g. no login). */
+    readonly limitation?: string;
+    /** The raw evidence this claim rests on, for `list` and diagnostics. */
+    readonly rawPorts: readonly RawPort[];
+    /** Empty unless `status === 'healthy'`. */
+    readonly rules: readonly TunnelRule[];
+}
+export interface ClaimedDiscovery {
+    readonly services: readonly ClaimedService[];
+    /** Surfaced raw-discovery diagnostics — a caller (reap) must be able to
+     *  tell "nothing is here" from "the probe itself could not see", so a
+     *  denied Docker query cannot read as every service having vanished. */
+    readonly diagnostics: readonly RawDiagnostic[];
+    /** Every raw identity no claimer picked up — `list` shows these dimmed,
+     *  literally "no addon" (spec): visible, but never shareable. */
+    readonly unclaimed: readonly RawPort[];
+}
+/** A single bounded, non-redirecting HTTP probe — injected, never a real fetch here. */
+export type HttpProbe = (url: string, opts: {
+    readonly timeoutMs: number;
+}) => Promise<{
+    readonly ok: boolean;
+    readonly status: number;
+    readonly body: string;
+} | null>;
+export interface ClaimContext {
+    readonly worktree: string;
+    readonly ticket: string;
+    readonly zone: string;
+    readonly probe: HttpProbe;
+    /** `.ddev/config.yaml`'s `web_extra_exposed_ports[].name`, keyed by
+     *  `container_port` — the declared name for a non-primary-web service
+     *  (vite, xhgui, …) sharing the web container, so a dead/live claim on that
+     *  port surfaces under its configured name instead of the web container's
+     *  generic `web` compose-service label. */
+    readonly webExtraExposedPortNames?: ReadonlyMap<number, string>;
+    /** BB-681 Task 1 — the project's effective DDEV hosts (primary +
+     *  additional), from `ddev utility configyaml`. Absent/unparseable config
+     *  means no individual-host splitting is attempted — the primary `web`
+     *  claim alone still works, never invented from a guess. */
+    readonly hosts?: DdevHosts;
+}

package/dist/src/types.js

@@ -0,0 +1,8 @@
+// BB-676 spec v2 — the claim contract, owned here since DDEV is the shape's
+// primary producer (routerPort/virtualHost/daemon/daemonStatus/containerState
+// all come from DDEV conventions). `@bakers-build/addon-ports` imports these types
+// (its Storybook claimer also produces `RawPort`-shaped values, for host
+// processes) rather than redeclaring them, so the two packages share one
+// contract; the dependency edge runs addon-ports -> addon-ddev only (the
+// acyclic package graph permits no edge back).
+export {};

package/package.json

@@ -1,6 +1,28 @@
 {
   "name": "@bakers-build/addon-ddev",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0-next.42",
+  "description": "DDEV-specific service discovery and claiming: HTTP(S)_EXPOSE/VIRTUAL_HOST interpretation over @bakers-build/addon-docker-compose's generic container data, plus effective-host discovery via `ddev utility configyaml`. No CMS-specific policy lives here.",
+  "type": "module",
+  "license": "MIT",
+  "exports": {
+    ".": "./dist/src/index.js"
+  },
+  "files": [
+    "dist/src"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://git.key-tec.de/bakers-build/bakers-build.git",
+    "directory": "bakers-cli/addons/ddev"
+  },
+  "dependencies": {
+    "@bakers-build/addon-docker-compose": "^0.1.0-next.42",
+    "yaml": "^2.7.0"
+  },
+  "peerDependencies": {
+    "@bakers-build/core": "^0.1.0-next.42"
+  }
+}