@mosetta/cli 0.0.0-stage → 0.0.10

package/CHANGELOG.md

@@ -0,0 +1,142 @@
+# @mosetta/cli
+
+## 0.0.10
+
+### Patch Changes
+
+- 95b93d5: The build's node host is an entry of the build: `@mosetta/build/node` gives the real file system,
+  the framework's files resolved from the installed build, and `buildDirectory(root, …)` — the build
+  of a palette that lies on disk with its dependencies installed, by the build installed for it. The
+  CLI builds with it, and so does a platform's build container: a palette is built by the framework
+  version its lock names. `systemjs`, whose files the build mixes into a page, is a dependency of the
+  build now, not of the CLI.
+- Updated dependencies [95b93d5]
+  - @mosetta/build@0.0.10
+  - @mosetta/stores@0.0.10
+  - @mosetta/runtime@0.0.10
+  - @mosetta/server@0.0.10
+
+## 0.0.9
+
+### Patch Changes
+
+- Updated dependencies
+  - @mosetta/runtime@0.0.9
+  - @mosetta/build@0.0.9
+  - @mosetta/server@0.0.9
+  - @mosetta/stores@0.0.9
+
+## 0.0.8
+
+### Patch Changes
+
+- A project's own tile palette. The registry keeps the palettes a project's site takes tiles from;
+  the factory reads each one's tile host after the platform's, and takes a tile of a host other than
+  the primary only with its integrity. The rule a site's tile hosts merge by lives in
+  `@mosetta/core` (`mergeTileHosts`), so the editor offers the blocks of every tile host of the site
+  by the same rule (`TILE_HOSTS_TOKEN` in `@mosetta/server-action`). The platform's API publishes
+  into `palettes/<brand>` for the members of the project of that namespace, with the palette's stores
+  granted to that one request. `mosetta build --released <descriptor>` leaves out what a platform
+  already holds; `checkPaletteBuild` says what a palette may hold. The CLI's and the build's output
+  speaks the vocabulary: tile palettes, tiles, package tiles.
+- Updated dependencies
+  - @mosetta/server@0.0.8
+  - @mosetta/build@0.0.8
+  - @mosetta/runtime@0.0.8
+  - @mosetta/stores@0.0.8
+
+## 0.0.7
+
+### Patch Changes
+
+- One vocabulary: code is tiles, content is blueprints, running requests is the factory, and a tile and a
+  blueprint made in the factory give a mosaic. A tile is a folder under `tiles/` (was `modules/`) whose
+  files are its sides, each defined with `define<Side>Side` — `defineComponentSide`, `defineEditorSide`,
+  `defineFallbackSide`, `defineRootComponentSide`, `defineServerSide`, `defineSsrSide` (were
+  `define…Module`); `useTile` (was `useModule`), `markInternalTile`, `BlueprintRoot`,
+  `BlueprintNodeRenderer`. `mosetta.json` names the tile `brand` (was `namespace`; a config that still
+  says `namespace` is refused with the word to use). The store connectors' package is `@mosetta/stores`
+  (was `@mosetta/provider`): `IStoreConnector`, `StoreConnectors`, `tileHostsOf`. The server's runner
+  is the factory gate (`@mosetta/server/factoryGate`, was `/runner`). Nothing on the wire moves: tile
+  ids keep `_ns_`, a build keeps `modules/<id>/`, stored JSON keeps its fields.
+- Updated dependencies
+  - @mosetta/runtime@0.0.7
+  - @mosetta/server@0.0.7
+  - @mosetta/build@0.0.7
+  - @mosetta/stores@0.0.7
+
+## 0.0.6
+
+### Patch Changes
+
+- Updated dependencies
+  - @mosetta/provider@0.0.6
+  - @mosetta/server@0.0.6
+  - @mosetta/runtime@0.0.6
+  - @mosetta/build@0.0.6
+
+## 0.0.5
+
+### Patch Changes
+
+- Updated dependencies [92417dc]
+  - @mosetta/server@0.0.5
+  - @mosetta/build@0.0.5
+  - @mosetta/provider@0.0.5
+  - @mosetta/runtime@0.0.5
+
+## 0.0.4
+
+### Patch Changes
+
+- 7577aa3: A server action asks the project's secrets by name — `SECRETS_TOKEN` (`get(name)` → the value or null) — and reads the
+  request it answers — `REQUEST_TOKEN` (its address and headers). The host grants each server module's isolate a
+  capability for its own scopes (`/`, `/<namespace>`, `/<namespace>/<module>`, the narrowest wins); no value sits in an
+  isolate's env, and pages get none. The registry keeps a project's secrets and plain settings, sealed with AES-GCM under
+  a root key the host provides. `mosetta dev` reads them from `.mosetta/secrets.json`.
+- Updated dependencies [7577aa3]
+- Updated dependencies [7577aa3]
+  - @mosetta/server@0.0.4
+  - @mosetta/build@0.0.4
+  - @mosetta/provider@0.0.4
+  - @mosetta/runtime@0.0.4
+
+## 0.0.3
+
+### Patch Changes
+
+- a8d5a2c: A person acts on the platform from a program with a platform token: `mosetta login` signs the CLI in by a code the
+  person approves in the browser (a device flow), and keeps the token per installation in their config folder, readable
+  by them only; `MOSETTA_TOKEN` wins over it. The registry keeps tokens as hashes only, and the CLI's sign-in requests;
+  the cabinet's Worker makes, lists and revokes tokens and approves sign-ins.
+- 1330d5d: Code is published THROUGH a platform: `mosetta push` describes the build (both catalogs, every file with its SHA-256,
+  the commit it comes from), asks the platform's API for a plan and sends the files it asks for — no store key on the
+  publisher's side. The release rules check a fresh module's bytes against the catalog entry that vouches for them, on
+  either path. A runner can grant stores to server actions only (found by name), never read for its own modules — how
+  the platform's API writes code stores whose keys stay with its host; the host names the publish target in a header of
+  its own, beside the caller's identity.
+- 886c43a: The release rules live in `@mosetta/build/release`, portable, for every publisher: `mosetta deploy` runs them against a
+  provider registry, a platform can run them on its side. A release writes each catalog over exactly the copy it planned
+  from and a module file only where none is, so two deploys into one store at once can no longer drop each other's
+  entries — the one overtaken plans again. A provider write takes a condition (`ifMatch`, `ifNoneMatch: '*'`), answered
+  412 when someone else got there first.
+- Updated dependencies [1330d5d]
+- Updated dependencies [886c43a]
+- Updated dependencies [842344f]
+  - @mosetta/build@0.0.3
+  - @mosetta/provider@0.0.3
+  - @mosetta/server@0.0.3
+  - @mosetta/runtime@0.0.3
+
+## 0.0.2
+
+### Patch Changes
+
+- The first versioned release. A deployed version never changes, and the stores keep every version
+  deployed. A page runs one copy of each framework package — the newest its blocks were built with,
+  or the version its root pins; the Framework distribution's updater lifts a page to its framework.
+- Updated dependencies
+  - @mosetta/server@0.0.2
+  - @mosetta/build@0.0.2
+  - @mosetta/provider@0.0.2
+  - @mosetta/runtime@0.0.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 mosetta contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,22 @@
-# Temporary Holding Version
+# @mosetta/cli
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The `mosetta` command: a development server and the build of a deployable tile palette.
+
+```
+mosetta dev   [--root <dir>] [--port <n>] [--write] [--no-typecheck]
+mosetta build [--root <dir>] [--out <dir>] [--no-typecheck] [--released <descriptor url|file>]
+mosetta push  [--root <dir>] [--target <name>] [--dry-run]
+mosetta login [--target <name>]
+mosetta version <patch|minor|major> [--package <brand|name>]
+```
+
+- `dev` builds in memory and serves everything on one port — the factory in workerd, static
+  assets, the content write channel and live reload — while node only builds and watches files.
+- `build` writes `dist/public/` (what browsers may load: tile side artifacts, package tiles,
+  stylesheets, the tile host descriptor) and `dist/private/` (server sides, root renderers), gated
+  on a clean type check. `--released` leaves out what a platform already holds.
+- `push` releases the build through a platform's API: no store key on the machine, the platform
+  checks every byte against the build's manifest.
+
+A site is a folder with `mosetta.json` (its brand and the tile palettes it uses), `tiles/` and
+`pages/`.

package/bin/mosetta.mjs

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { startDev } from '../src/dev.mjs';
+import { releasedIdsOf, staticBuild } from '../src/staticBuild.mjs';
+import { deploy } from '../src/deploy.mjs';
+import { raiseVersion } from '../src/version.mjs';
+import { forget, login, publishTargetOf } from '../src/login.mjs';
+import { push } from '../src/push.mjs';
+import { runTypecheck } from '../src/typecheck.mjs';
+import { NodeFileSystem } from '../src/host/nodeFileSystem.mjs';
+import { frameworkFileOf } from '../src/scanner.mjs';
+import { packageDirOf } from '@mosetta/build/packagesResolver';
+import { loadEngine } from '../src/engineLoader.mjs';
+import { sectionLog } from '../src/log.mjs';
+
+const args = process.argv.slice(2);
+const cmd = args[0];
+
+const flag = (name) => args.includes(name);
+const opt = (name, dflt) => {
+  const i = args.indexOf(name);
+  return i >= 0 ? args[i + 1] : dflt;
+};
+
+const root = path.resolve(opt('--root', process.cwd()));
+
+// Binding the build to the environment happens HERE and only here: the builder itself has no
+// defaults, otherwise a default silently drags node back into portable code.
+//   fileSystem — where sources come from (one implementation so far: disk); the package resolver
+//   is rebuilt BEFORE EVERY build iteration from the scanner catalog — inside dev/build
+//   engine — what builds the module graph. ONE for all environments: wasm (`@rollup/browser` +
+// `esbuild-wasm`) — the same set that ships into the isolate. The framework deliberately has no
+// native binaries (per-OS platform builds, CI matrices and differential verification of two
+// engines are a class of problems we do not have to own). Extra speed comes via the
+// `mosetta.engine.mjs` hook (see engineLoader.mjs).
+const fileSystem = new NodeFileSystem();
+// The directory GENERATED facets' imports (default ssr) resolve from: the @mosetta/build
+// installation, where @mosetta/router, @mosetta/server and react are declared.
+// Computed HERE and passed down — the builder must not derive its own location.
+const frameworkDir = packageDirOf(fileSystem, frameworkFileOf('@mosetta/build'));
+// only the commands that build need the engine — a wasm service left running keeps the others
+// from exiting cleanly
+const engine = cmd === 'build' || cmd === 'dev'
+  ? await loadEngine(root, { mode: cmd === 'build' ? 'production' : 'development', log: sectionLog('cli') })
+  : null;
+
+switch (cmd) {
+  case 'build':
+    // types gate the PROD build only (dev stays fast): tsc --noEmit against the app tsconfig
+    if (!flag('--no-typecheck') && !(await runTypecheck({ root }))) {
+      sectionLog('cli')('build: type errors above — nothing emitted (--no-typecheck to bypass)');
+      process.exit(1);
+    }
+    // build the deployable tile palette → <root>/dist (artifacts + pages→HTML + pages.json);
+    // --released <descriptor url|file>: what is there already is not built (a project's palette
+    // over the platform's tiles)
+    await staticBuild(root, {
+      outDir: opt('--out', undefined),
+      fileSystem,
+      engine,
+      frameworkDir,
+      released: opt('--released', undefined) ? await releasedIdsOf(opt('--released', undefined)) : null,
+    });
+    break;
+  case 'dev': {
+    // one public port: workerd holds render, static assets and the content channel; node builds
+    // and watches files, opening no sockets. `--port` picks the address; a busy port is
+    // diagnosed at startup (most often a copy that survived a previous run).
+    // in-memory build by default; --write (or --emit) mirrors the raw build to <root>/dist for inspection.
+    const write = flag('--write') || flag('--emit');
+    const port = Number(opt('--port', 3000));
+    await startDev({ root, port, write, typecheck: !flag('--no-typecheck'), fileSystem, engine, frameworkDir });
+    break;
+  }
+  case 'deploy': {
+    // the built distribution → the project's stores by the provider registry (S3-compatible:
+    // R2, MinIO, …); --content seeds pages/prefabs/config.json without overwriting edits.
+    // --target <name> picks <root>/.mosetta/providers.<name>.json (a stage beside prod); without
+    // it — the default registry, never another installation by accident
+    const target = opt('--target', undefined);
+    if (target !== undefined && !/^[a-z0-9-]+$/.test(target)) {
+      sectionLog('cli')(`deploy: --target "${target}" is not a name (a-z, 0-9, -)`);
+      process.exitCode = 1;
+      break;
+    }
+    try {
+      const summary = await deploy(root, {
+        registryFile: opt('--registry', target ? path.join(root, '.mosetta', `providers.${target}.json`) : undefined),
+        content: flag('--content') || flag('--force-content'),
+        forceContent: flag('--force-content'),
+        contentOnly: flag('--content-only'),
+        dryRun: flag('--dry-run'),
+      });
+      sectionLog('cli')(`deploy: ${JSON.stringify(summary)}`);
+    } catch (e) {
+      // a refused release is an answer, not a crash: said plainly, exit code set
+      sectionLog('cli')(e.message);
+      process.exitCode = 1;
+    }
+    break;
+  }
+  case 'push': {
+    // the built distribution released THROUGH the platform's API: no store key here — the token
+    // `mosetta login` kept, the target from mosetta.json's publish.<--target|default>
+    try {
+      const release = await push(root, { target: opt('--target', 'default'), dryRun: flag('--dry-run') });
+      sectionLog('cli')(`push: ${JSON.stringify(release)}`);
+    } catch (e) {
+      sectionLog('cli')(e.message);
+      process.exitCode = 1;
+    }
+    break;
+  }
+  case 'login':
+  case 'logout': {
+    // a platform's token for this CLI: approved in the browser (a code, like `gh auth login`),
+    // kept in the person's config folder per installation; --target picks mosetta.json's
+    // publish.<name> (default: publish.default), --cabinet <origin> names one outright
+    try {
+      const { cabinet } = publishTargetOf(root, opt('--target', 'default'), { cabinet: opt('--cabinet', undefined) });
+      if (cmd === 'login') await login(cabinet, { open: flag('--no-browser') ? () => undefined : undefined });
+      else sectionLog('cli')(forget(cabinet) ? `signed out of ${cabinet} here — revoke the token in the cabinet's access tokens to end it everywhere` : `not signed in to ${cabinet}`);
+    } catch (e) {
+      sectionLog('cli')(e.message);
+      process.exitCode = 1;
+    }
+    break;
+  }
+  case 'version':
+    // a deployed version never changes: a change ships under a new one — `mosetta version patch
+    // --package mosetta-ui` raises it in the distribution's package.json
+    try {
+      raiseVersion(root, { target: opt('--package', undefined), level: args[1] });
+    } catch (e) {
+      sectionLog('cli')(`version: ${e.message}`);
+      process.exitCode = 1;
+    }
+    break;
+  default:
+    sectionLog('cli')('usage: mosetta <dev|build|deploy|push|login|logout|version> [--root <dir>] [--port <n>] [--write] [--out <dir>] [--no-typecheck] [--released <descriptor url|file>] [--registry <file> | --target <name>] [--content|--force-content|--content-only] [--dry-run]; mosetta version <patch|minor|major> [--package <brand|name>]');
+}

package/package.json

@@ -1,6 +1,24 @@
 {
   "name": "@mosetta/cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.0.10",
+  "license": "MIT",
+  "description": "mosetta CLI: development server (single port, live reload, type-check companion), building a deployable tile palette and publishing it.",
+  "type": "module",
+  "bin": {
+    "mosetta": "./bin/mosetta.mjs"
+  },
+  "dependencies": {
+    "@rollup/browser": "4.62.3",
+    "chokidar": "^4.0.3",
+    "esbuild-wasm": "0.24.2",
+    "systemjs": "^6.15.1",
+    "workerd": "^1.20260630.1",
+    "@mosetta/stores": "0.0.10",
+    "@mosetta/build": "0.0.10",
+    "@mosetta/runtime": "0.0.10",
+    "@mosetta/server": "0.0.10"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
 }

package/src/buildArchivePacker.mjs

@@ -0,0 +1,144 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { writeTar, gzip, SCAN_ENTRY } from '@mosetta/build/archive';
+import { loadLockEdges, scanCatalog, scanToolingCatalog } from '@mosetta/build/scanner';
+import { packageDirOf } from '@mosetta/build/packagesResolver';
+import { NodeFileSystem } from './host/nodeFileSystem.mjs';
+import { frameworkResolutions } from './scanner.mjs';
+
+/**
+ * Packer for the build-action body — the trusted node side.
+ *
+ * The virtual world mirrors the layout RELATIVE to the outermost lockfile: base → /repo, every
+ * closure package and the sources at their own relative paths. This keeps the module graph's
+ * relative paths identical to disk, so isolate artifacts are byte-equal to a local build. The
+ * container carries: a gzip-tar of the sources, a gzip-tar per closure package (in prod these
+ * would be ready-made registry archives — the packer would not recreate them), meta.tgz with
+ * package.json/locks of the walk-up contexts, and the scan.json manifest.
+ */
+
+// tenant SOURCES also drop dist (a build product); PACKAGES keep their dist (shipped code:
+// systemjs/dist) and carry what a registry archive carries: the node_modules INSIDE a package are
+// its bundledDependencies only (lightningcss-wasm ships napi-wasm this way; the scanner derives
+// their edges from the lock) — anything else there (a workspace package's links, leftovers of
+// another layout) is not the package's, and its own dependencies ship as packages of their own
+const SKIP_SOURCE_DIRS = new Set(['node_modules', 'dist', '.git']);
+const SKIP_PACKAGE_DIRS = new Set();
+const VIRTUAL_BASE = '/repo';
+
+/** the dependencies a package ships inside itself — `bundledDependencies` (or its older spelling) */
+function bundledOf(dir) {
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'));
+    const named = pkg.bundledDependencies ?? pkg.bundleDependencies ?? [];
+    return new Set(Array.isArray(named) ? named : named === true ? Object.keys(pkg.dependencies ?? {}) : []);
+  } catch {
+    return new Set();
+  }
+}
+
+function filesOfDir(dir, skip, { bundled = null } = {}) {
+  const entries = [];
+  const walk = (d, rel) => {
+    for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+      if (e.name.startsWith('.') && e.name !== '.npmrc') continue;
+      const abs = path.join(d, e.name);
+      const r = rel ? `${rel}/${e.name}` : e.name;
+      if (e.isDirectory()) {
+        if (skip.has(e.name)) continue;
+        // a package's own node_modules: its bundled dependencies, by name, and nothing else
+        if (bundled && r === 'node_modules') {
+          for (const name of bundled) {
+            const at = path.join(abs, ...name.split('/'));
+            if (fs.existsSync(at) && fs.statSync(at).isDirectory()) walk(at, `node_modules/${name}`);
+          }
+          continue;
+        }
+        walk(abs, r);
+      } else if (e.isFile()) {
+        entries.push({ name: r, data: fs.readFileSync(abs) });
+      }
+    }
+  };
+  walk(dir, '');
+  return entries;
+}
+
+export async function packBuildArchive({ root, frameworkDir, mode = 'production' }) {
+  const fileSystem = new NodeFileSystem();
+  const { lockfileDirs } = loadLockEdges(fileSystem, root);
+  const base = fs.realpathSync(lockfileDirs[lockfileDirs.length - 1]); // outermost lock = world root
+  const toVirtual = (p) => {
+    const real = fs.realpathSync(p);
+    if (real === base) return VIRTUAL_BASE;
+    if (!real.startsWith(base + path.sep)) throw new Error(`outside the lock world: ${p}`);
+    return `${VIRTUAL_BASE}/${path.relative(base, real).split(path.sep).join('/')}`;
+  };
+
+  const includeDev = mode !== 'production';
+  const catalog = scanCatalog({ fileSystem, root, frameworkDir, includeDev });
+  // the tooling closure (build config) ships too: PHASE 1 inside the isolate assembles it,
+  // and devDependencies are legitimate there
+  const tooling = scanToolingCatalog({ fileSystem, root, frameworkDir });
+  const framework = frameworkResolutions();
+
+  // closure packages: edge targets + owners of framework files; walk-up contexts (ancestors of
+  // the root) ship as metadata only
+  const dirs = new Set();
+  for (const bucketSet of [catalog.edges, tooling.edges]) {
+    for (const [dir, bucket] of Object.entries(bucketSet)) {
+      dirs.add(dir);
+      for (const target of Object.values(bucket)) dirs.add(target);
+    }
+  }
+  for (const file of Object.values(framework)) {
+    const owner = packageDirOf(fileSystem, file);
+    if (owner) dirs.add(owner);
+  }
+  const realRoot = fs.realpathSync(root);
+  const isContext = (d) => realRoot === d || realRoot.startsWith(d + path.sep);
+
+  const outer = [];
+  const unpack = [];
+  const sources = writeTar(filesOfDir(realRoot, SKIP_SOURCE_DIRS));
+  outer.push({ name: 'sources.tgz', data: await gzip(sources) });
+  unpack.push({ entry: 'sources.tgz', dir: toVirtual(realRoot), strip: 0 });
+
+  const meta = [];
+  let i = 0;
+  // the lock also declares UNinstalled optional packages (platform binaries for other OSes) —
+  // absent on disk, so absent in the body; inside the isolate their absence behaves as on disk
+  const installed = [...dirs].filter((d) => fs.existsSync(d));
+  for (const d of installed.map((d) => fs.realpathSync(d)).sort()) {
+    if (d === realRoot) continue;
+    if (isContext(d)) {
+      for (const f of ['package.json', 'pnpm-lock.yaml', 'package-lock.json']) {
+        const abs = path.join(d, f);
+        if (fs.existsSync(abs)) {
+          meta.push({ name: `${toVirtual(d)}/${f}`.slice(VIRTUAL_BASE.length + 1) || f, data: fs.readFileSync(abs) });
+        }
+      }
+      continue;
+    }
+    const entry = `packages/${i++}.tgz`;
+    outer.push({ name: entry, data: await gzip(writeTar(filesOfDir(d, SKIP_PACKAGE_DIRS, { bundled: bundledOf(d) }))) });
+    unpack.push({ entry, dir: toVirtual(d), strip: 0 });
+  }
+  // base is itself a context: its lock is mandatory
+  for (const f of ['pnpm-lock.yaml', 'package-lock.json']) {
+    const abs = path.join(base, f);
+    if (fs.existsSync(abs) && !meta.some((m) => m.name === f)) meta.push({ name: f, data: fs.readFileSync(abs) });
+  }
+  outer.push({ name: 'meta.tgz', data: await gzip(writeTar(meta)) });
+  unpack.push({ entry: 'meta.tgz', dir: VIRTUAL_BASE, strip: 0 });
+
+  const manifest = {
+    root: toVirtual(realRoot),
+    frameworkDir: toVirtual(frameworkDir),
+    framework: Object.fromEntries(Object.entries(framework).map(([spec, file]) => [spec, toVirtual(file)])),
+    mode,
+    unpack,
+  };
+  outer.unshift({ name: SCAN_ENTRY, data: new TextEncoder().encode(JSON.stringify(manifest, null, 2)) });
+  return writeTar(outer);
+}

package/src/buildConfigLoader.mjs

@@ -0,0 +1,48 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { INERT_BUILD_CONFIG } from '@mosetta/build';
+
+// mosetta.build.mjs: build extension hooks. `mosetta.json` is pure data, while build CODE lives in
+// this co-located file. Loading cache-busts by mtime (the ESM import cache is permanent, a
+// re-import needs a fresh URL) — config edits are picked up by the dev server without a restart.
+//
+// Lives in the CLI, not in @mosetta/build, BECAUSE this executes foreign code from a file —
+// i.e. an environment capability. The build receives the result AS DATA and executes nothing
+// itself; that is what kept the host port read-only.
+
+const asFn = (v, name, file) => {
+  if (v === undefined || v === null) return null;
+  if (typeof v !== 'function') throw new Error(`mosetta.build.mjs: \`${name}\` must be a function (${file})`);
+  return v;
+};
+
+export async function loadBuildConfig(root) {
+  const file = path.join(root, 'mosetta.build.mjs');
+  let mtimeMs;
+  try {
+    mtimeMs = fs.statSync(file).mtimeMs;
+  } catch {
+    return { ...INERT_BUILD_CONFIG, file };
+  }
+  const ns = await import(`${pathToFileURL(file).href}?v=${mtimeMs}`);
+  const cfg = ns.default ?? {};
+  if (typeof cfg !== 'object') throw new Error(`mosetta.build.mjs must default-export an object of hooks (${file})`);
+  return {
+    file,
+    stamp: String(mtimeMs),
+    clientPlugins: asFn(cfg.clientPlugins, 'clientPlugins', file),
+    serverEsbuild: asFn(cfg.serverEsbuild, 'serverEsbuild', file),
+    rollupOptions: asFn(cfg.rollupOptions, 'rollupOptions', file),
+  };
+}
+
+/** Mirror a build snapshot to disk — also the host's side, not the build's. */
+export function mirrorArtifacts(files, dir) {
+  fs.rmSync(dir, { recursive: true, force: true });
+  for (const [rel, content] of files) {
+    const p = path.join(dir, rel);
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, content);
+  }
+}

package/src/buildWorker.mjs

@@ -0,0 +1,11 @@
+import { bundleServer, SERVER_WORKER_ENTRY, SERVER_DEV_WORKER_ENTRY } from './serverPackage.mjs';
+
+// Bundle the @mosetta/server worker (TS, OOP) into a single ESM module for workerd. Web API only
+// (platform 'neutral') — runs unchanged in the Workers runtime.
+//
+// `dev: true` takes a DIFFERENT entry — `devWorker.ts`: the same render plus static serving from
+// a Durable Object and the rebuild control channel (one port in dev). The prod worker knows
+// nothing about it: dev knowledge lives in a separate facet, not in a flag inside the runner.
+export async function buildRenderWorker({ mode = 'development', dev = false } = {}) {
+  return bundleServer(dev ? SERVER_DEV_WORKER_ENTRY : SERVER_WORKER_ENTRY, { platform: 'neutral', mode });
+}