@frontera-sdk/cli 1.43.10 → 1.44.0

package/src/commands/action/deploy.ts

@@ -0,0 +1,135 @@
+import { randomUUID } from 'node:crypto'
+
+import { GovernedActionApi } from '../../api/governed-action-api'
+import { CliError, UsageError } from '../../errors'
+import { deriveOntologyEditPlan, PlanDerivationError } from '../../blueprint/ontology-edit-plan'
+import { flagBool, flagString, type Command, type CommandContext } from '../types'
+
+/**
+ * Arm the write path for one published Action.
+ *
+ * Stops at VALIDATED, deliberately. Review must be performed by someone who
+ * authored none of the material — the service refuses a reviewer who did — so
+ * a single command that also reviewed would either be refused or would be
+ * pretending the separation happened. `action review` is the second half, run
+ * with a second credential.
+ */
+
+function api(ctx: CommandContext): GovernedActionApi {
+  return new GovernedActionApi(ctx.apiUrl, ctx.token)
+}
+
+export const actionDeploy: Command = {
+  meta: {
+    noun: 'action',
+    verb: 'deploy',
+    args: [{ name: 'action', required: true, description: 'The published Action’s API name' }],
+    flags: { 'dry-run': 'boolean', 'plan-id': 'string', 'binding-id': 'string' },
+    summary: 'Build and validate the write path for a published Action',
+    examples: [
+      'frontera action deploy escalateTicket --dry-run',
+      'frontera action deploy escalateTicket',
+    ],
+  },
+
+  async run(ctx) {
+    const apiName = ctx.positional[0]
+    if (!apiName) throw new UsageError('missing <action>', 'frontera action deploy escalateTicket')
+
+    const client = api(ctx)
+    const published = await client.publishedAction(apiName)
+    const definition = published.definition
+
+    const objectType = await client.activeObjectType(
+      await resolveObjectTypeApiName(client, definition.subject.objectTypeId, apiName),
+    )
+    if (!objectType) {
+      throw new CliError(`Object type for "${apiName}" is not in the active release.`, {
+        code: 'NOT_FOUND',
+        hint: 'Publish a release that carries it, then deploy.',
+      })
+    }
+
+    let plan
+    try {
+      plan = deriveOntologyEditPlan(definition, objectType)
+    } catch (err) {
+      if (err instanceof PlanDerivationError) {
+        throw new CliError(err.message, { code: 'VALIDATION_ERROR', hint: err.hint })
+      }
+      throw err
+    }
+
+    const writes = Object.entries(plan.set)
+      .map(([property, parameter]) => `${property} ← ${parameter}`)
+      .join(', ')
+
+    if (flagBool(ctx, 'dry-run')) {
+      return {
+        data: { plan, dryRun: true },
+        text: `${plan.op} ${plan.objectTypeApiName}, addressed by ${plan.pkParameter}\n`
+          + `  sets ${writes}\n`
+          + (plan.expectedVersionParameter ? `  compare-and-set on ${plan.expectedVersionParameter}\n` : '')
+          + '\nNothing was written. Re-run without --dry-run to build it.',
+      }
+    }
+
+    // Client-minted, so a retry after a network failure can name the same
+    // artifact instead of orphaning a half-built one.
+    const planId = flagString(ctx, 'plan-id') ?? randomUUID()
+    const bindingId = flagString(ctx, 'binding-id') ?? randomUUID()
+
+    const planRevision = await client.createMutationPlanRevision(planId, plan)
+    const binding = await client.createBindingRevision(bindingId, {
+      actionDefinitionId: definition.id,
+      actionContractDigest: published.contractDigest,
+      mutationPlanRevisionId: planRevision.id,
+    })
+    const validation = await client.validateBindingRevision(binding.id, 1)
+
+    if (validation.status !== 'valid') {
+      throw new CliError(`Deployment validation returned "${validation.status}".`, {
+        code: 'FAILURE',
+        hint: JSON.stringify(validation.findings ?? validation),
+      })
+    }
+
+    return {
+      data: {
+        action: apiName,
+        planId,
+        planRevisionId: planRevision.id,
+        bindingId,
+        bindingRevisionId: binding.id,
+        stateId: binding.stateId,
+        validationReportId: validation.id,
+        status: validation.status,
+      },
+      text: `Built and validated the write path for "${apiName}".\n`
+        + `  ${plan.op} ${plan.objectTypeApiName} — sets ${writes}\n\n`
+        + 'Next, as a DIFFERENT user — the service refuses a reviewer who authored the material:\n'
+        + `  frontera action review ${binding.id} --report ${validation.id}`,
+    }
+  },
+}
+
+/**
+ * The Action names its subject by id; every read route addresses object types
+ * by API name. One list read bridges them, rather than making the caller pass
+ * a name the Action already knows.
+ */
+async function resolveObjectTypeApiName(
+  client: GovernedActionApi,
+  objectTypeId: string,
+  actionApiName: string,
+): Promise<string> {
+  const types = await client.listActiveObjectTypes()
+  const match = types.find((t) => t.id === objectTypeId)
+  if (!match?.apiName) {
+    throw new CliError(`The object type "${actionApiName}" acts on is not in the active release.`, {
+      code: 'NOT_FOUND',
+      hint: 'frontera blueprint catalog',
+    })
+  }
+  return match.apiName
+}

package/src/commands/action/grant.ts

@@ -0,0 +1,68 @@
+import { GovernedActionApi } from '../../api/governed-action-api'
+import { UsageError } from '../../errors'
+import { flagBool, flagString, type Command } from '../types'
+
+/**
+ * Grant a published Action's invoke capability to a role.
+ *
+ * Narrow on purpose. This does not edit roles — `role` is non-delegable so a
+ * machine credential cannot widen its own authority, and that stays true. It
+ * grants exactly one thing: a capability a published Action declares, on a
+ * resource the platform does not own.
+ *
+ * It exists because the two ends could not otherwise meet. An Action may not
+ * be gated on a platform resource, and the admin permission tree renders only
+ * platform resources — so every capability the invoke check will accept is one
+ * the console cannot display, and an Action could be published, deployed and
+ * active while remaining invisible to everyone.
+ */
+export const actionGrant: Command = {
+  meta: {
+    noun: 'action',
+    verb: 'grant',
+    args: [
+      { name: 'capability', required: true, description: 'The Action’s invoke capability, as resource:action' },
+    ],
+    flags: { role: 'string', revoke: 'boolean' },
+    summary: 'Grant a published Action’s invoke capability to a role',
+    examples: [
+      'frontera action grant support_ticket:escalate_ticket --role owner',
+      'frontera action grant support_ticket:escalate_ticket --role editor --revoke',
+    ],
+  },
+
+  async run(ctx) {
+    const capability = ctx.positional[0]
+    if (!capability) {
+      throw new UsageError(
+        'missing <capability>',
+        'frontera action grant support_ticket:escalate_ticket --role owner',
+      )
+    }
+    const role = flagString(ctx, 'role')
+    if (!role) {
+      throw new UsageError(
+        'missing --role <role>',
+        'A capability is held by a role, never by a person directly.',
+      )
+    }
+
+    const revoke = flagBool(ctx, 'revoke')
+    const client = new GovernedActionApi(ctx.apiUrl, ctx.token)
+    const result = await client.setCapabilityGrant(capability, role, revoke)
+
+    const held = result.actions.length > 0 ? result.actions.join(', ') : '(none)'
+    return {
+      data: result,
+      text: `${revoke ? 'Revoked' : 'Granted'} "${capability}" ${revoke ? 'from' : 'to'} role "${role}".\n`
+        + `  ${capability.split(':')[0]}: ${held}`
+        // The other half of the check, and invisible from here: a role without
+        // actionRequest:submit cannot invoke ANY Action, however many business
+        // capabilities it holds.
+        + (result.roleMaySubmit
+          ? ''
+          : `\n\nRole "${role}" still cannot invoke: it lacks actionRequest: submit.`
+            + '\n  Grant that in the console under Roles — it is a platform permission.'),
+    }
+  },
+}

package/src/commands/action/index-commands.ts

@@ -0,0 +1,29 @@
+import { actionDeploy } from './deploy'
+import { actionGrant } from './grant'
+import { actionList } from './list'
+import { actionPrepare } from './prepare'
+import { actionReview } from './review'
+import type { Command } from '../types'
+
+/**
+ * The deployment plane, which had no client at all.
+ *
+ * Blueprint authoring reaches the Action's CONTRACT — `blueprint create action`
+ * and `blueprint apply` both write it, and `blueprint publish` releases it. What
+ * had no verb anywhere was arming the write: a mutation plan, a Binding pinned
+ * to the contract digest, a validation against the live target, an independent
+ * review and a state-machine activation. Five admin calls with hand-minted
+ * UUIDs, or nothing.
+ *
+ * Invoking is deliberately absent. Both CLI credential kinds present a
+ * non-member principal — `wskey:…` and `orgkey:…` — and the invoke check joins
+ * organization membership, so a `submit` verb here would refuse every call it
+ * ever made. It belongs to a credential that represents a person.
+ */
+export const actionCommands: readonly Command[] = [
+  actionList,
+  actionPrepare,
+  actionDeploy,
+  actionReview,
+  actionGrant,
+]

package/src/commands/action/list.ts

@@ -0,0 +1,49 @@
+import { GovernedActionApi } from '../../api/governed-action-api'
+import { table } from '../../table'
+import type { Command } from '../types'
+
+/**
+ * Published Actions and whether anything can run them.
+ *
+ * `deploymentStatus` is the question this answers: an Action can be published,
+ * correct and completely inert, and nothing else in the CLI says so. `unbound`
+ * here is the same state `blueprint publish` refuses to create and that an
+ * agent silently cannot see.
+ */
+export const actionList: Command = {
+  meta: {
+    noun: 'action',
+    verb: 'list',
+    args: [],
+    flags: {},
+    summary: 'List published Actions and their deployment state',
+    examples: ['frontera action list'],
+  },
+
+  async run(ctx) {
+    const client = new GovernedActionApi(ctx.apiUrl, ctx.token)
+    const actions = await client.listPublishedActions()
+
+    if (actions.length === 0) {
+      return {
+        data: { actions: [] },
+        text: 'No published Actions.\n  Author one, then `frontera blueprint publish`.',
+      }
+    }
+
+    const rows = actions.map((entry) => ({
+      apiName: entry.definition.apiName,
+      deployment: entry.deploymentStatus ?? '—',
+      // Present only when it is NOT invocable, which is when it matters.
+      reason: entry.reason && entry.reason !== 'ACTION_AVAILABLE' ? entry.reason : '',
+    }))
+
+    return {
+      data: { actions },
+      text: table(
+        ['ACTION', 'DEPLOYMENT', 'WHY NOT'],
+        rows.map((r) => [r.apiName, r.deployment, r.reason]),
+      ),
+    }
+  },
+}

package/src/commands/action/prepare.ts

@@ -0,0 +1,48 @@
+import { GovernedActionApi } from '../../api/governed-action-api'
+import { UsageError } from '../../errors'
+import { flagString, type Command } from '../types'
+
+/**
+ * Record that a drafted Action ships switched off, so it can be published.
+ *
+ * Publish refuses an Action with no deployment decision, and every other
+ * deployment route acts on a state that already exists — so without this the
+ * two requirements are circular and the first row has to be written by hand.
+ *
+ * It arms nothing. `action deploy` is still the only thing that builds a write
+ * path, and it runs AFTER the release, because a Binding is validated against
+ * the object type the release actually publishes.
+ */
+export const actionPrepare: Command = {
+  meta: {
+    noun: 'action',
+    verb: 'prepare',
+    args: [{ name: 'action', required: true, description: 'The drafted Action’s API name' }],
+    flags: { reason: 'string' },
+    summary: 'Record that a drafted Action ships disabled, so it can be published',
+    examples: [
+      'frontera action prepare escalateTicket',
+      'frontera action prepare escalateTicket --reason "ships off"',
+    ],
+  },
+
+  async run(ctx) {
+    const apiName = ctx.positional[0]
+    if (!apiName) throw new UsageError('missing <action>', 'frontera action prepare escalateTicket')
+
+    const client = new GovernedActionApi(ctx.apiUrl, ctx.token)
+    const decision = await client.recordDeploymentDecision(
+      apiName,
+      flagString(ctx, 'reason') ?? 'Published before anything could be bound to it.',
+    )
+
+    return {
+      data: decision,
+      text: `"${apiName}" will publish disabled.\n`
+        + `  state ${decision.stateId} · generation ${decision.generation}\n\n`
+        + 'Next:\n'
+        + '  frontera blueprint publish --label "…" \n'
+        + `  frontera action deploy ${apiName}`,
+    }
+  },
+}

package/src/commands/action/review.ts

@@ -0,0 +1,94 @@
+import { GovernedActionApi } from '../../api/governed-action-api'
+import { CliError, UsageError } from '../../errors'
+import { flagString, type Command, type CommandContext } from '../types'
+
+/**
+ * Approve a validated write path, and switch it on.
+ *
+ * Its own verb because it must run as a DIFFERENT principal: the service
+ * refuses a reviewer who authored the Binding, the connector or the plan. An
+ * organization key's principal is `orgkey:<org>:<key>`, so a second key is a
+ * second reviewer — no second human required to arm a deployment in a
+ * non-production organization, and a real one required wherever the roles are
+ * held by people.
+ *
+ * Review and activate are one command because the generation arithmetic
+ * between them is bookkeeping, not a decision: review takes the state to 3,
+ * activate expects exactly that, and a caller who ran them separately would be
+ * asked to carry a number they never chose.
+ */
+
+function api(ctx: CommandContext): GovernedActionApi {
+  return new GovernedActionApi(ctx.apiUrl, ctx.token)
+}
+
+export const actionReview: Command = {
+  meta: {
+    noun: 'action',
+    verb: 'review',
+    args: [{ name: 'bindingRevision', required: true, description: 'The Binding revision to review' }],
+    flags: { report: 'string', reason: 'string', 'no-activate': 'boolean' },
+    summary: 'Review a validated write path and activate it',
+    examples: [
+      'frontera action review 042ca95a-… --report 7c1f… ',
+      'frontera action review 042ca95a-… --report 7c1f… --no-activate',
+    ],
+  },
+
+  async run(ctx) {
+    const bindingRevisionId = ctx.positional[0]
+    if (!bindingRevisionId) {
+      throw new UsageError('missing <bindingRevision>', 'frontera action review <bindingRevision> --report <id>')
+    }
+    const validationReportId = flagString(ctx, 'report')
+    if (!validationReportId) {
+      throw new UsageError(
+        'missing --report <validationReportId>',
+        'The id `frontera action deploy` printed. Review is pinned to the exact validation it read.',
+      )
+    }
+
+    const client = api(ctx)
+
+    // Generations are the service's, not ours: validation left the state at 2,
+    // review takes it to 3, activation expects 3 and the disabled decision it
+    // replaces still at 1.
+    await client.reviewBindingRevision(bindingRevisionId, {
+      validationReportId,
+      expectedStateGeneration: 2,
+    })
+
+    if (ctx.flags['no-activate'] === true) {
+      return {
+        data: { bindingRevisionId, reviewed: true, activated: false },
+        text: 'Reviewed. Not activated — the write path is armed but switched off.',
+      }
+    }
+
+    const binding = await client.listBindings()
+    const entry = binding.entries.find((e) => e.revisionId === bindingRevisionId)
+    const stateId = entry?.deployment?.stateId
+    if (!stateId) {
+      throw new CliError('Reviewed, but the deployment state for this revision is not readable.', {
+        code: 'FAILURE',
+        hint: 'Activate it directly once the state id is known; the review itself has landed.',
+      })
+    }
+
+    const current = binding.entries.find(
+      (e) => e.actionDefinitionId === entry.actionDefinitionId && e.deployment?.state === 'disabled',
+    )
+
+    await client.activateDeployment(stateId, {
+      expectedGeneration: 3,
+      expectedCurrentStateId: current?.deployment?.stateId ?? stateId,
+      expectedCurrentGeneration: current?.deployment?.generation ?? 1,
+      reason: flagString(ctx, 'reason') ?? 'Activated from the CLI after review.',
+    })
+
+    return {
+      data: { bindingRevisionId, stateId, reviewed: true, activated: true },
+      text: 'Reviewed and activated. The Action can now be invoked.',
+    }
+  },
+}

package/src/commands/app/deploy.ts

@@ -7,7 +7,9 @@ import { resolveManifest } from '../../manifest'
 import { collectSourceFiles, formatBytes } from '../../packaging'
 import { packDirectory } from '../../pack'
 import { readPackageVersion, writeAppId, writeState } from '../../project'
-import { describeRenderEvidence, readRenderEvidence } from '../../render-evidence'
+import { collectBuildProvenance } from '../../provenance'
+import { validateStaticAppProject } from '../../static-app-validation'
+import { describeRenderEvidence, readRenderEvidence, readRenderThumbnail } from '../../render-evidence'
 import { createTarGz } from '../../tar'
 import { requireProjectFrom } from './shared'
 import { flagBool, flagString, type Command } from '../types'
@@ -53,10 +55,12 @@ export const appDeploy: Command = {
   async run(ctx) {
     const project = requireProjectFrom(ctx)
     const version = flagString(ctx, 'version') ?? readPackageVersion(project.root)
-    const distDir = join(project.root, 'dist')
+    const outputDirectory = project.outputDirectory ?? 'dist'
+    const distDir = join(project.root, outputDirectory)
+    validateStaticAppProject(project.root, project.routing ?? 'spa')
 
     if (!existsSync(join(distDir, 'index.html'))) {
-      throw new CliError('dist/index.html not found', {
+      throw new CliError(`${outputDirectory}/index.html not found`, {
         code: 'VALIDATION_ERROR',
         hint: 'run your build first: bun run build',
       })
@@ -86,6 +90,11 @@ export const appDeploy: Command = {
     const renderEvidence = readRenderEvidence(project.root)
     ctx.output.note(describeRenderEvidence(renderEvidence))
 
+    // The picture from that same render. Uploaded whenever one exists — the
+    // gallery has shown every app as an identical tinted tile, and a screenshot
+    // of a slightly older state of the app says more than its first letter.
+    const thumbnail = readRenderThumbnail(project.root)
+
     const promote = !flagBool(ctx, 'no-promote')
     const res = await publish(client, app.id, {
       version,
@@ -95,11 +104,13 @@ export const appDeploy: Command = {
       manifest,
       promote,
       renderEvidence,
+      provenance: collectBuildProvenance(project.root),
+      thumbnail,
     })
 
     writeState(project.root, { appId: app.id, parentVersion: res.version })
-    // Committed alongside the code, so a clone deploys to THIS app even after
-    // the slug is renamed — and any stale slug is dropped.
+    // Local environment binding: source remains portable and package.json
+    // remains ordinary package metadata.
     writeAppId(project.root, app.id)
 
     // The one line that turns "published" into something a person can act on.

package/src/commands/app/dev.ts

@@ -0,0 +1,173 @@
+import { AppsApi } from '../../api/apps-api'
+import { PlatformApi } from '../../api/platform-api'
+import { createDevSessionBroker } from '../../dev-broker'
+import { CliError, UsageError } from '../../errors'
+import { detectAppFramework } from '../../provenance'
+import { writeAppId } from '../../project'
+import { requireProjectFrom } from './shared'
+import { flagBool, flagString, type Command } from '../types'
+
+const DEFAULT_PORT = 3000
+const READY_TIMEOUT_MS = 30_000
+
+function appPort(raw: string | undefined): number {
+  if (raw === undefined) return DEFAULT_PORT
+  const port = Number(raw)
+  if (!Number.isInteger(port) || port < 1 || port > 65_535) {
+    throw new UsageError('--port must be an integer from 1 to 65535', 'for example: frontera app dev --port 3210')
+  }
+  return port
+}
+
+async function waitForApp(origin: string, process: Bun.Subprocess): Promise<void> {
+  const deadline = Date.now() + READY_TIMEOUT_MS
+  while (Date.now() < deadline) {
+    if (process.exitCode !== null) {
+      throw new CliError(`App dev server exited with code ${process.exitCode}`, {
+        code: 'FAILURE',
+        hint: 'run `bun run dev` directly to inspect the framework error',
+      })
+    }
+    try {
+      const response = await fetch(origin, { redirect: 'manual' })
+      if (response.status < 500) return
+    } catch {
+      // The listener is not ready yet.
+    }
+    await Bun.sleep(150)
+  }
+  throw new CliError(`App dev server was not ready after ${READY_TIMEOUT_MS / 1000} seconds`, {
+    code: 'SERVICE_UNAVAILABLE',
+    hint: 'inspect the dev-server output above, or choose another --port',
+  })
+}
+
+function openBrowser(url: string): void {
+  const command = process.platform === 'darwin'
+    ? ['open', url]
+    : process.platform === 'win32'
+      ? ['cmd', '/c', 'start', '', url]
+      : ['xdg-open', url]
+  try {
+    Bun.spawn(command, { stdout: 'ignore', stderr: 'ignore' }).unref()
+  } catch {
+    // Opening is convenience only; the URL is always printed.
+  }
+}
+
+export const appDev: Command = {
+  meta: {
+    noun: 'app',
+    verb: 'dev',
+    args: [],
+    flags: { port: 'string', 'no-open': 'boolean' },
+    summary: 'Run an App locally with short-lived authenticated Blueprint access',
+    examples: ['frontera app dev', 'frontera app dev --port 3210 --no-open'],
+    needsProject: true,
+  },
+
+  async run(ctx) {
+    const project = requireProjectFrom(ctx)
+    const port = appPort(flagString(ctx, 'port'))
+    const appOrigin = `http://127.0.0.1:${port}`
+    const framework = detectAppFramework(project.root)
+    const apps = new AppsApi(ctx.apiUrl, ctx.token)
+    const app = await apps.ensureApp(project.slug, project.displayName, project.appId)
+    writeAppId(project.root, app.id)
+
+    let broker: ReturnType<typeof createDevSessionBroker> | null = null
+    if (framework === 'next') {
+      const identity = await new PlatformApi(ctx.apiUrl, ctx.token).whoami()
+      if (!identity.workspaceId || !identity.orgId) {
+        throw new UsageError(
+          'App development requires a workspace-scoped credential',
+          'run `frontera login` with an sk-ws- App-scoped or workspace key',
+        )
+      }
+      broker = createDevSessionBroker({
+        appOrigin,
+        loadSession: async () => {
+          const session = await apps.appToken(app.id)
+          return {
+            init: {
+              type: 'frontera:init',
+              token: session.token,
+              apiBaseUrl: ctx.apiUrl.replace(/\/+$/, ''),
+              appId: app.id,
+              version: 'dev',
+              orgId: identity.orgId,
+              workspaceId: identity.workspaceId,
+              theme: { tokens: {} },
+              state: {},
+            },
+            expiresAt: session.expiresAt,
+          }
+        },
+      })
+      ctx.output.note('[dev] the browser receives only a short-lived sk-app token; the stored CLI key stays in the broker')
+    } else if (framework === 'vite') {
+      ctx.output.note('[dev] legacy Vite mode uses dev-host.html and the existing .env.local compatibility flow')
+    } else {
+      throw new UsageError(
+        'could not detect a supported App development framework',
+        'add Next.js or Vite to package.json dependencies',
+      )
+    }
+
+    const targetUrl = framework === 'vite' ? `${appOrigin}/dev-host.html` : appOrigin
+    ctx.output.note(`[dev] ${app.slug} at ${targetUrl}`)
+
+    let child: Bun.Subprocess
+    try {
+      child = Bun.spawn(
+        framework === 'vite'
+          ? ['bun', 'run', 'dev', '--', '--host', '127.0.0.1', '--port', String(port)]
+          : ['bun', 'run', 'dev', '--', '--hostname', '127.0.0.1', '--port', String(port)],
+        {
+          cwd: project.root,
+          env: broker
+            ? { ...process.env, NEXT_PUBLIC_FRONTERA_DEV_SESSION_ENDPOINT: broker.endpoint }
+            : process.env,
+          stdin: 'inherit',
+          stdout: 'inherit',
+          stderr: 'inherit',
+        },
+      )
+    } catch (error) {
+      broker?.server.stop(true)
+      throw error
+    }
+
+    let stopped = false
+    const stop = () => {
+      if (stopped) return
+      stopped = true
+      child.kill('SIGTERM')
+      broker?.server.stop(true)
+    }
+    const onSignal = () => stop()
+    process.on('SIGINT', onSignal)
+    process.on('SIGTERM', onSignal)
+
+    try {
+      await waitForApp(targetUrl, child)
+      ctx.output.note(`[dev] ready: ${targetUrl}`)
+      if (!flagBool(ctx, 'no-open')) openBrowser(targetUrl)
+      const exitCode = await child.exited
+      if (!stopped && exitCode !== 0) {
+        throw new CliError(`App dev server exited with code ${exitCode}`, {
+          code: 'FAILURE',
+          hint: 'review the framework output above',
+        })
+      }
+      return {
+        data: { appId: app.id, origin: targetUrl, exitCode },
+        text: `Stopped ${app.slug} local development server.`,
+      }
+    } finally {
+      process.off('SIGINT', onSignal)
+      process.off('SIGTERM', onSignal)
+      stop()
+    }
+  },
+}