@k2b/cloud 0.6.0-rc.0

package/README.md

@@ -0,0 +1,98 @@
+<p align="center">
+  <img src="https://raw.githubusercontent.com/k2b-dev/cloud/main/packages/cloud/public/logo.svg" alt="Cloud" width="96" height="96">
+</p>
+
+<h1 align="center">@k2b/cloud</h1>
+
+<p align="center">
+  <em>Modular Hono+SolidJS framework for building per-app docker services behind a dynamic gateway.</em>
+</p>
+
+The runtime that powers [github.com/k2b-dev/cloud](https://github.com/k2b-dev/cloud) — an application platform that runs on infrastructure you operate, where every feature ships as its own Bun container, registers with a gateway through Redis, and inherits a shared session, UI kit, settings store, search, logging, email, websockets, and admin surface.
+
+## Install
+
+```bash
+bun add @k2b/cloud
+```
+
+The package is published as `.ts` source. It is intended for **Bun** consumers.
+
+## Quick start
+
+```ts
+// packages/my-app/src/config.ts
+import { defineApp } from "@k2b/cloud";
+
+export const app = defineApp({
+  id: "my-app",
+  name: "My App",
+  icon: "ti ti-rocket",
+  description: "What this app does",
+  basePath: "/app/my-app",
+  baseUrl: "http://app-my-app:3000",
+  nav: { href: "/app/my-app", section: "more", requiresAuth: true },
+  routes: ["/api/my-app", "/app/my-app", "/admin/my-app", "/public/my-app"],
+});
+
+export const { ssr, plugin } = app;
+```
+
+```ts
+// packages/my-app/src/index.ts
+import { app } from "./config";
+import { Hono } from "hono";
+
+export default await app.start({
+  routes: {
+    api: new Hono().get("/", (c) => c.json({ ok: true })),
+    pages: new Hono().get("/", ...ssr(() => () => <div>hello</div>)),
+  },
+});
+```
+
+A standard app declares four prefixes (`/api/<id>`, `/app/<id>`, `/admin/<id>`, `/public/<id>`); the gateway routes them to your container by URL prefix from a Redis-backed registry.
+
+## Public building blocks
+
+| Import | Use for |
+|---|---|
+| `@k2b/cloud` | `defineApp`, common types |
+| `@k2b/cloud/server` | server context, auth, route helpers |
+| `@k2b/cloud/browser` | typed browser client |
+| `@k2b/cloud/services` | settings, logging, notifications, search |
+| `@k2b/cloud/contracts` | shared public contracts |
+| `@k2b/cloud/ssr` | Cloud SSR helpers and islands |
+| `@k2b/cloud/workflows` | durable, inspectable application workflows |
+| `@k2b/cloud/ai` | AI and tool-calling contracts |
+| `@k2b/cloud/cli` | application CLI commands |
+| `@k2b/cloud/config` | documented configuration helpers |
+| `@k2b/ui` | Portable UI components and application layouts |
+| `@k2b/stdlib/solid` | owner-local queries, mutations, and interaction primitives |
+| `@k2b/ssr` | portable SolidJS SSR, islands, and navigation |
+| `@k2b/sync` | distributed coordination, jobs, queues, and schedulers |
+| `@k2b/cloud/access/ui` | Cloud access and resource-key controls |
+| `@k2b/cloud/account/ui` | Cloud account selectors and avatars |
+| `@k2b/cloud/ai/ui` | Cloud AI protocol adapters |
+| `@k2b/cloud/styles/global.css` | base Tailwind stylesheet |
+
+## Documentation
+
+Full walkthroughs, the per-app anatomy, deployment templates, and a reference app:
+
+- **[github.com/ValentinKolb/cloud-template](https://github.com/ValentinKolb/cloud-template)** — starter repo with a working reference app + the complete app-authoring guide
+- **[github.com/k2b-dev/cloud](https://github.com/k2b-dev/cloud)** — the platform monorepo (gateway, core, all platform apps)
+
+## License
+
+GNU Affero General Public License v3.0 or later.
+
+Commercial use, hosting, modification, and redistribution are permitted under
+the AGPL. If you modify Cloud and let users interact with it over a network,
+you must provide those users access to the corresponding source code under the
+same license.
+
+Separate commercial licenses for proprietary, reseller, managed-service,
+white-label, or embedded product use are available by contacting the maintainer.
+
+See the repository `LICENSE` file.

package/package.json

@@ -0,0 +1,128 @@
+{
+  "name": "@k2b/cloud",
+  "version": "0.6.0-rc.0",
+  "description": "Modular Hono+SolidJS framework for building per-app docker services behind a dynamic gateway. Powers cloud.stuve-ulm.de.",
+  "license": "AGPL-3.0-or-later",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/k2b-dev/cloud.git",
+    "directory": "packages/cloud"
+  },
+  "homepage": "https://github.com/k2b-dev/cloud",
+  "bugs": "https://github.com/k2b-dev/cloud/issues",
+  "type": "module",
+  "files": [
+    "src",
+    "scripts",
+    "public",
+    "!src/**/*.test.ts",
+    "!src/**/*.integration.test.ts"
+  ],
+  "exports": {
+    ".": "./src/index.ts",
+    "./desktop": "./src/desktop/index.ts",
+    "./desktop/solid": "./src/desktop/solid.tsx",
+    "./server": "./src/server/index.ts",
+    "./server/*": "./src/server/*",
+    "./browser": "./src/server/api-client.ts",
+    "./browser/app-approval": "./src/browser/app-approval.ts",
+    "./browser/live": "./src/browser/live-websocket.ts",
+    "./browser/notifications": "./src/browser/notifications.ts",
+    "./browser/resource-clipboard": "./src/browser/resource-clipboard.ts",
+    "./browser/resource-picker": "./src/browser/resource-picker.tsx",
+    "./capabilities": "./src/capabilities/client.ts",
+    "./capabilities/server": "./src/capabilities/server.ts",
+    "./capabilities/testing": "./src/capabilities/testing.ts",
+    "./cli": "./src/cli/index.ts",
+    "./cli/access": "./src/cli/access.ts",
+    "./cli/account": "./src/cli/account.ts",
+    "./cli/apps": "./src/cli/apps.ts",
+    "./cli/capabilities": "./src/cli/capabilities.ts",
+    "./cli/admin": "./src/cli/admin/index.ts",
+    "./shared": "./src/shared/index.ts",
+    "./services": "./src/services/index.ts",
+    "./services/document-extraction": "./src/services/document-extraction.ts",
+    "./services/ipa/service-account": null,
+    "./services/*": "./src/services/*",
+    "./ai": "./src/ai/index.ts",
+    "./ai/admin": "./src/ai/admin.ts",
+    "./ai/browser": "./src/ai/browser.ts",
+    "./ai/live": "./src/ai/live.ts",
+    "./ai/live-events": "./src/ai/live-events.ts",
+    "./ai/runtime": "./src/ai/runtime.ts",
+    "./ai/solid": "./src/ai/solid.ts",
+    "./ai/tools": "./src/ai/runtime-tools.ts",
+    "./ai/ui": "./src/ai/ui.tsx",
+    "./account/ui": "./src/account/ui.ts",
+    "./access/ui": "./src/access/ui.ts",
+    "./ssr": "./src/ssr/index.ts",
+    "./ssr/islands": "./src/ssr/islands/index.ts",
+    "./ssr/*": "./src/ssr/*",
+    "./config": "./src/config/index.ts",
+    "./config/*": "./src/config/*",
+    "./contracts": "./src/contracts/index.ts",
+    "./contracts/notifications": "./src/contracts/notification-types.ts",
+    "./contracts/*": "./src/contracts/*",
+    "./workflows": "./src/workflows/index.ts",
+    "./workflows/ai": "./src/workflows/ai/index.ts",
+    "./workflows/editor": "./src/workflows/editor.ts",
+    "./workflows/language": "./src/workflows/language/index.ts",
+    "./workflows/runtime": "./src/workflows/runtime/index.ts",
+    "./workflows/store": "./src/workflows/store/index.ts",
+    "./workflows/testing": "./src/workflows/testing/index.ts",
+    "./api": "./src/api/index.ts",
+    "./clients/core": "./src/clients/core.ts",
+    "./styles/global.css": "./src/styles/global.css"
+  },
+  "scripts": {
+    "test": "bun test",
+    "typecheck": "tsc -p tsconfig.json --noEmit --pretty false 2>&1 | grep -v node_modules | (! grep -q 'error TS')"
+  },
+  "dependencies": {
+    "@firecrawl/anydoc": "0.1.9",
+    "@k2b/nessi": "0.11.0",
+    "@k2b/ssr": "0.12.0",
+    "@k2b/stdlib": "0.22.0",
+    "@k2b/sync": "6.4.0",
+    "@k2b/ui": "0.2.0",
+    "@modelcontextprotocol/sdk": "1.30.0",
+    "@nats-io/transport-node": "3.4.0",
+    "@simplewebauthn/server": "13.3.2",
+    "@tabler/icons": "3.46.0",
+    "@tailwindcss/typography": "0.5.20",
+    "bun-plugin-tailwind": "0.1.2",
+    "hash-wasm": "4.12.0",
+    "hono-openapi": "1.3.1",
+    "jose": "6.2.5",
+    "katex": "0.16.47",
+    "liquidjs": "10.27.2",
+    "marked": "17.0.6",
+    "mermaid": "11.16.0",
+    "nodemailer": "9.1.1",
+    "postcss": "8.5.25",
+    "reflect-metadata": "0.2.2",
+    "sanitize-html": "2.17.6",
+    "seroval": "1.6.0",
+    "tailwindcss": "4.3.3",
+    "web-push": "3.6.7",
+    "yaml": "2.9.0"
+  },
+  "devDependencies": {
+    "@babel/core": "7.29.7",
+    "@babel/preset-typescript": "7.29.7",
+    "@types/bun": "1.3.14",
+    "@types/nodemailer": "7.0.12",
+    "@types/sanitize-html": "2.16.1",
+    "@types/web-push": "3.6.4",
+    "babel-preset-solid": "1.9.12",
+    "hono": "4.12.32",
+    "solid-js": "1.9.14",
+    "typescript": "5.9.3",
+    "zod": "4.4.3"
+  },
+  "peerDependencies": {
+    "hono": "^4.12.25",
+    "solid-js": "^1.9.10",
+    "zod": "^4.3.4"
+  }
+}

package/public/logo.svg

@@ -0,0 +1 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg width="100%" height="100%" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" xmlns:serif="http://www.serif.com/" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:2;"><rect id="ArtBoard1" x="0" y="0" width="24" height="24" style="fill:none;"/><g id="ArtBoard11" serif:id="ArtBoard1"><path d="M9.974,4.062c2.269,-0.689 4.771,-0.231 6.574,1.216c1.433,1.145 2.262,2.777 2.328,4.486l0.003,0.219l0.094,0.004c2.378,0.11 4.283,2.027 4.394,4.414l0.004,0.218c-0,2.488 -1.949,4.519 -4.399,4.633l-0.217,0.005l-12.278,-0l-0.23,-0.008c-3.039,-0.114 -5.496,-2.48 -5.613,-5.441l-0.005,-0.223c0,-2.84 2.15,-5.179 4.945,-5.6l0.118,-0.016l0.073,-0.187c0.685,-1.675 2.125,-3.004 3.958,-3.637l0.252,-0.083l-0.001,0Z" style="fill:url(#_Linear1);fill-rule:nonzero;"/><path d="M0.156,13.767l-0.001,-0.019l-0.005,-0.205l-0,-0.026c-0,-3.044 2.204,-5.581 5.143,-6.192c0.789,-1.718 2.309,-3.082 4.227,-3.743c-0.121,0.041 0.018,-0.007 0.018,-0.007l0.231,-0.076l0.024,-0.007c2.464,-0.749 5.179,-0.246 7.138,1.326c1.439,1.15 2.321,2.745 2.528,4.443c2.416,0.425 4.269,2.487 4.386,5.006l0.001,0.029l0.004,0.2l-0.034,0.035l-0.009,0.029l0.043,-0.043c0,2.864 -2.245,5.2 -5.066,5.331l-0.039,0.001l-0.21,0.005l-11.878,0c0.097,0 0.097,-0.015 0,0l-0.222,-0.008l-0.032,-0.001c-3.389,-0.126 -6.117,-2.777 -6.247,-6.078Zm9.088,-9.164c-0.161,0.076 -0.094,0.044 -0.232,0.109c-1.411,0.656 -2.482,1.819 -3.044,3.191l-0.07,0.181c0,0 -0.57,0.103 -0.943,0.204c-2.31,0.624 -3.955,2.77 -3.955,5.229l0.005,0.216c0.01,0.259 0.039,0.514 0.085,0.762c0,0 0.008,0.083 0.016,0.082c0.495,2.458 2.684,4.32 5.329,4.419l0.016,0.001l0.002,0l0.204,0.007l0.013,-0c0.324,0.047 11.865,-0 11.865,-0l0.21,-0.005c2.37,-0.11 4.255,-2.075 4.255,-4.482l-0.004,-0.211c-0.107,-2.309 -1.95,-4.163 -4.25,-4.27l-0.091,-0.003l-0.003,-0.212c-0.064,-1.654 -0.866,-3.232 -2.252,-4.34c-1.745,-1.4 -4.164,-1.843 -6.359,-1.176l-0.244,0.08c-0.189,0.065 -0.375,0.134 -0.553,0.218Z" style="fill:url(#_Linear2);"/></g><defs><linearGradient id="_Linear1" x1="0" y1="0" x2="1" y2="0" gradientUnits="userSpaceOnUse" gradientTransform="matrix(0.28477,14.9308,-14.9308,0.28477,12.4271,4.32609)"><stop offset="0" style="stop-color:#f0f6ff;stop-opacity:1"/><stop offset="1" style="stop-color:#5a9cff;stop-opacity:1"/></linearGradient><linearGradient id="_Linear2" x1="0" y1="0" x2="1" y2="0" gradientUnits="userSpaceOnUse" gradientTransform="matrix(1.11193e-15,18.1593,-18.1593,1.11193e-15,12,1.69474)"><stop offset="0" style="stop-color:#a6d1ff;stop-opacity:1"/><stop offset="1" style="stop-color:#1f8bff;stop-opacity:1"/></linearGradient></defs></svg>

package/scripts/app-favicon.test.ts

@@ -0,0 +1,49 @@
+import { describe, expect, test } from "bun:test";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { renderAppFavicon, tablerIconName, writeAppFavicon } from "./app-favicon";
+
+describe("app favicon", () => {
+  test("extracts the documented Tabler icon class", () => {
+    expect(tablerIconName("ti ti-mail")).toBe("mail");
+    expect(() => tablerIconName("mail")).toThrow('such as "ti ti-mail"');
+    expect(() => tablerIconName("ti ti-mail extra")).toThrow('such as "ti ti-mail"');
+  });
+
+  test("renders a large icon with the Cloud gradient", () => {
+    const source = '<svg viewBox="0 0 24 24"><path d="M3 7h18" /></svg>';
+
+    const svg = renderAppFavicon(source);
+    expect(svg).toContain('<linearGradient id="cloud-icon"');
+    expect(svg).toContain(".start { stop-color: #3b82f6; }");
+    expect(svg).toContain(".end { stop-color: #1d4ed8; }");
+    expect(svg).toContain("@media (prefers-color-scheme: dark)");
+    expect(svg).toContain(".start { stop-color: #f0f6ff; }");
+    expect(svg).toContain(".end { stop-color: #1f8bff; }");
+    expect(svg).toContain('stroke="url(#cloud-icon)"');
+    expect(svg).toContain('stroke-width="2"');
+    expect(svg).not.toContain("<rect");
+    expect(svg).not.toContain("<filter");
+    expect(svg).toContain('<path d="M3 7h18" />');
+  });
+
+  test("writes a declared Tabler icon and rejects an unknown one", async () => {
+    const publicDir = await mkdtemp(join(tmpdir(), "cloud-app-favicon-"));
+    try {
+      const target = await writeAppFavicon({ publicDir, appId: "mail", icon: "ti ti-mail" });
+      const svg = await readFile(target, "utf8");
+      expect(svg).toContain('stroke="url(#cloud-icon)"');
+      expect(svg).toContain('d="M3 7l9 6l9 -6"');
+
+      const tableTarget = await writeAppFavicon({ publicDir, appId: "grids", icon: "ti ti-table" });
+      expect(await readFile(tableTarget, "utf8")).toContain('d="M3 10h18"');
+
+      await expect(writeAppFavicon({ publicDir, appId: "missing", icon: "ti ti-definitely-not-real" })).rejects.toThrow(
+        'Unknown Tabler app icon "ti ti-definitely-not-real"',
+      );
+    } finally {
+      await rm(publicDir, { recursive: true, force: true });
+    }
+  });
+});

package/scripts/app-favicon.ts

@@ -0,0 +1,51 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+
+const TABLER_ICON = /^ti-([a-z0-9]+(?:-[a-z0-9]+)*)$/;
+
+export function tablerIconName(iconClass: string): string {
+  const classes = iconClass.trim().split(/\s+/);
+  const match = classes.length === 2 && classes[0] === "ti" ? TABLER_ICON.exec(classes[1] ?? "") : null;
+  if (!match?.[1]) throw new Error(`App icon must be a Tabler class such as "ti ti-mail"; received ${JSON.stringify(iconClass)}`);
+  return match[1];
+}
+
+export function renderAppFavicon(sourceSvg: string): string {
+  const source = sourceSvg.match(/<svg\b[^>]*>([\s\S]*?)<\/svg>\s*$/i);
+  if (!source?.[1]) throw new Error("Tabler icon did not contain an SVG body");
+
+  return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <style>
+    .start { stop-color: #3b82f6; }
+    .end { stop-color: #1d4ed8; }
+    @media (prefers-color-scheme: dark) {
+      .start { stop-color: #f0f6ff; }
+      .end { stop-color: #1f8bff; }
+    }
+  </style>
+  <defs>
+    <linearGradient id="cloud-icon" x1="12" y1="2" x2="12" y2="22" gradientUnits="userSpaceOnUse">
+      <stop class="start" />
+      <stop class="end" offset="1" />
+    </linearGradient>
+  </defs>
+  <g fill="none" stroke="url(#cloud-icon)" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+${source[1].trim()}
+  </g>
+</svg>\n`;
+}
+
+export async function writeAppFavicon(options: { publicDir: string; appId: string; icon: string }): Promise<string> {
+  const iconName = tablerIconName(options.icon);
+  let sourcePath: string;
+  try {
+    sourcePath = Bun.resolveSync(`@tabler/icons/outline/${iconName}.svg`, resolve(import.meta.dir, ".."));
+  } catch {
+    throw new Error(`Unknown Tabler app icon ${JSON.stringify(options.icon)}`);
+  }
+
+  const target = resolve(options.publicDir, options.appId, "favicon.svg");
+  await mkdir(dirname(target), { recursive: true });
+  await writeFile(target, renderAppFavicon(await readFile(sourcePath, "utf8")));
+  return target;
+}

package/scripts/build.ts

@@ -0,0 +1,205 @@
+/**
+ * Production build for a single cloud app.
+ *
+ * Two consumer shapes:
+ *
+ *   Monorepo (this repo):
+ *     APP_ID=<id> bun run packages/cloud/scripts/build.ts
+ *     # appDir defaults to packages/<APP_ID>, run from workspace root.
+ *
+ *   Standalone (npm consumer, see cloud-template):
+ *     APP_ID=<id> APP_DIR=. bun run node_modules/@k2b/cloud/scripts/build.ts
+ *     # appDir = APP_DIR (resolved against cwd) and must be the directory
+ *     # that CONTAINS src/, since entrypoints resolve to <appDir>/src/*.
+ *
+ * Output goes to <cwd>/dist:
+ *   server.js            bundled Bun entry
+ *   _ssr/<island>.js     hydration bundles (auto-emitted by the SSR plugin)
+ *   public/<id>/app.css  Tailwind, if the app has src/styles/app.css
+ *   public/<id>/...      anything from <appDir>/public/
+ *
+ * If the app needs additional artefacts (core's global.css, logo, katex),
+ * it ships a `scripts/build-extras.ts` that this script runs at the end.
+ */
+import { existsSync } from "node:fs";
+import { cp, mkdir, readdir, readFile, rm, writeFile } from "node:fs/promises";
+import { dirname, extname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { brotliCompress, gzip, constants as zlibConstants } from "node:zlib";
+import { CryptoHasher, Glob } from "bun";
+import tailwind from "bun-plugin-tailwind";
+import { writeAppFavicon } from "./app-favicon";
+
+const appId = process.env.APP_ID;
+if (!appId) throw new Error("APP_ID env var required");
+
+// `root` = wherever the user is building from. SSR plugin's rootDir is
+// process.cwd() (set in defineApp), so we use the same here for hash parity.
+const root = process.cwd();
+
+// Framework dir — works whether this script is in packages/cloud/scripts/
+// (monorepo) or node_modules/@k2b/cloud/scripts/ (npm install).
+const frameworkDir = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+const release = process.env.CLOUD_RELEASE?.trim() || "local";
+if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(release)) {
+  throw new Error(`Invalid CLOUD_RELEASE: ${JSON.stringify(release)}`);
+}
+const syncPackagePath = Bun.resolveSync("@k2b/sync/package.json", frameworkDir);
+const syncPackage = JSON.parse(await readFile(syncPackagePath, "utf8")) as {
+  version?: unknown;
+};
+if (typeof syncPackage.version !== "string" || !/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(syncPackage.version)) {
+  throw new Error("Could not resolve the installed @k2b/sync version");
+}
+const syncVersion = syncPackage.version;
+
+// App dir — APP_DIR override for standalone consumers, defaults to monorepo
+// convention. Resolved against cwd if relative.
+const appDir = process.env.APP_DIR ? resolve(root, process.env.APP_DIR) : resolve(root, "packages", appId);
+if (!existsSync(appDir)) throw new Error(`Unknown app dir: ${appDir} (set APP_DIR or check APP_ID)`);
+
+const dist = resolve(root, "dist");
+const distPublic = resolve(dist, "public");
+const compressBrotli = promisify(brotliCompress);
+const compressGzip = promisify(gzip);
+
+await rm(dist, { recursive: true, force: true });
+await mkdir(distPublic, { recursive: true });
+
+// Mirrors @k2b/ssr's island-id (md5 of POSIX path relative to the
+// SSR plugin's rootDir, truncated to 12 chars). Both this script and the
+// plugin use process.cwd() as the rootDir, so hashes match.
+const islandId = (file: string): string => {
+  const rel = file.slice(root.length + 1).replace(/\\/g, "/");
+  return new CryptoHasher("md5").update(rel).digest("hex").slice(0, 12);
+};
+
+const compressibleExtensions = new Set([".css", ".html", ".js", ".json", ".map", ".svg", ".txt", ".xml"]);
+
+async function precompressDistAssets(dir: string): Promise<void> {
+  if (!existsSync(dir)) return;
+
+  for await (const file of new Glob("**/*").scan({ cwd: dir, absolute: true, onlyFiles: true })) {
+    if (file.endsWith(".br") || file.endsWith(".gz")) continue;
+    if (!compressibleExtensions.has(extname(file))) continue;
+
+    const source = await readFile(file);
+    const [br, gz] = await Promise.all([
+      compressBrotli(source, {
+        params: {
+          [zlibConstants.BROTLI_PARAM_QUALITY]: zlibConstants.BROTLI_MAX_QUALITY,
+        },
+      }),
+      compressGzip(source, { level: zlibConstants.Z_BEST_COMPRESSION }),
+    ]);
+
+    await Promise.all([writeFile(`${file}.br`, br), writeFile(`${file}.gz`, gz)]);
+  }
+}
+
+// Register the app's SSR plugin (Solid JSX transform + island bundler).
+// In the monorepo this resolves via `packages/<id>/src/config`; in standalone
+// it resolves via the appDir path (because the script's relative imports
+// only work for monorepo, we use absolute file:// for standalone).
+const configPath = resolve(appDir, "src/config");
+const { app, plugin } = await import(configPath);
+
+// 1. Server entry — also emits dist/_ssr/<island>.js via the SSR plugin.
+// @peculiar/x509 uses tsyringe, whose decorators require this polyfill before
+// any app dependency is evaluated. A wrapper keeps that ordering identical for
+// every production app without requiring app-owned bootstrap imports.
+const serverEntry = resolve(dist, ".server-entry.ts");
+const reflectMetadata = Bun.resolveSync("reflect-metadata", frameworkDir);
+await writeFile(
+  serverEntry,
+  `import ${JSON.stringify(reflectMetadata)};\nexport { default } from ${JSON.stringify(resolve(appDir, "src/index.ts"))};\n`,
+);
+let server: Awaited<ReturnType<typeof Bun.build>>;
+try {
+  server = await Bun.build({
+    entrypoints: [serverEntry],
+    outdir: dist,
+    naming: "server.js",
+    target: "bun",
+    minify: true,
+    define: {
+      __CLOUD_RELEASE__: JSON.stringify(release),
+      __CLOUD_SYNC_VERSION__: JSON.stringify(syncVersion),
+    },
+    plugins: [plugin()],
+  });
+} finally {
+  await rm(serverEntry, { force: true });
+}
+if (!server.success) {
+  for (const m of server.logs) console.error(m);
+  throw new Error("Server bundle failed");
+}
+
+// 1b. The SSR plugin scans the project root and emits one chunk per island
+//     across every reachable package (including any island-shaped files in
+//     other workspace packages or in node_modules). Keep only this app's own
+//     islands plus the framework's; drop the rest. chunk-* files are shared
+//     splits and always kept.
+const ssrDir = resolve(dist, "_ssr");
+if (existsSync(ssrDir)) {
+  const allowedDirs = [frameworkDir, appDir];
+  const allowedIds = new Set<string>();
+  for (const dir of allowedDirs) {
+    for await (const file of new Glob("**/*.{island,client}.tsx").scan({ cwd: dir, absolute: true })) {
+      allowedIds.add(islandId(file));
+    }
+  }
+  for (const entry of await readdir(ssrDir)) {
+    if (entry.startsWith("chunk-") || !entry.endsWith(".js")) continue;
+    const id = entry.slice(0, -3);
+    if (!allowedIds.has(id)) await rm(resolve(ssrDir, entry));
+  }
+}
+
+// 2. Per-app Tailwind stylesheet.
+const appCss = resolve(appDir, "src/styles/app.css");
+if (existsSync(appCss)) {
+  const out = resolve(distPublic, appId);
+  await mkdir(out, { recursive: true });
+  const css = await Bun.build({
+    entrypoints: [appCss],
+    outdir: out,
+    naming: "app.css",
+    root,
+    plugins: [tailwind],
+  });
+  if (!css.success) {
+    for (const m of css.logs) console.error(m);
+    throw new Error("App CSS build failed");
+  }
+}
+
+// 3. Per-app static assets.
+const appPublic = resolve(appDir, "public");
+if (existsSync(appPublic)) {
+  await cp(appPublic, resolve(distPublic, appId), { recursive: true });
+}
+
+if (appId !== "core" && app) {
+  await writeAppFavicon({
+    publicDir: distPublic,
+    appId,
+    icon: app.meta.icon,
+  });
+}
+
+// 4. Optional app-specific extras (e.g. core's global.css + logo + katex).
+const extras = resolve(appDir, "scripts/build-extras.ts");
+if (existsSync(extras)) {
+  process.env.WORKSPACE_ROOT = root;
+  process.env.DIST_DIR = dist;
+  await import(extras);
+}
+
+await precompressDistAssets(resolve(dist, "public"));
+await precompressDistAssets(resolve(dist, "_ssr"));
+
+console.log(`Built ${appId} → ${dist}`);