@sequenceholdings/studio-cli 0.1.22 → 0.1.25

package/dist/app/scaffold.js

@@ -0,0 +1,263 @@
+/**
+ * Scaffold ORM / function / artifact into an app monorepo and keep
+ * sequence.app.yml in sync. Delegates to each primitive's real `init`.
+ */
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { dirname, join, relative, resolve } from 'node:path';
+import { functionsInitCommand } from '../functions/commands.js';
+import { parseArgs } from '../process/commands.js';
+import { currentVersion } from '../update-check.js';
+import { defaultDeployOrder, extendDeployOrder, loadAppManifest, ormNamespaceFromAppId, titleizeSlug, writeAppManifest, } from './manifest.js';
+const LOG = '[seq-studio]';
+const APP_MANIFEST_LABEL = 'sequence.app.yml';
+export function defaultScaffoldNames(_appId) {
+    return { functionName: 'hello' };
+}
+function primitiveIdFor({ kind, name }) {
+    switch (kind) {
+        case 'orm':
+            return `${name}-orm`;
+        case 'artifact':
+            return `${name}-ui`;
+        case 'function':
+            return name;
+    }
+}
+function relativePathFor({ kind, appId, name, }) {
+    switch (kind) {
+        case 'orm':
+            return join('orm', ormNamespaceFromAppId(appId));
+        case 'function':
+            return join('functions', name);
+        case 'artifact':
+            return 'artifact';
+    }
+}
+function buildPrimitiveEntry({ kind, appId, name, dependsOn, }) {
+    const path = relativePathFor({ kind, appId, name }).replace(/\\/g, '/');
+    const id = primitiveIdFor({ kind, name: kind === 'orm' || kind === 'artifact' ? appId : name });
+    const base = { id, kind, path, depends_on: dependsOn };
+    switch (kind) {
+        case 'orm':
+            return { ...base, namespace: ormNamespaceFromAppId(appId) };
+        case 'function':
+            return { ...base, slug: name };
+        case 'artifact':
+            return { ...base, project_id: appId };
+    }
+}
+async function rewriteArtifactIdentity({ artifactDir, appId, }) {
+    const title = titleizeSlug(appId);
+    const manifestPath = join(artifactDir, 'artifact.bundle.yml');
+    if (existsSync(manifestPath)) {
+        const body = await readFile(manifestPath, 'utf8');
+        const next = body
+            .replace(/(project_id:\s*)\S+/g, `$1${appId}`)
+            .replace(/^(\s*)title:\s*.*$/m, `$1title: "${title}"`);
+        if (next !== body)
+            await writeFile(manifestPath, next, 'utf8');
+    }
+    const pkgPath = join(artifactDir, 'package.json');
+    if (existsSync(pkgPath)) {
+        try {
+            const pkg = JSON.parse(await readFile(pkgPath, 'utf8'));
+            pkg.name = appId;
+            await writeFile(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`, 'utf8');
+        }
+        catch {
+            // leave non-JSON package.json alone
+        }
+    }
+}
+async function scaffoldOrm({ absPath }) {
+    const { runOrmCommand } = await import('../orm/delegate.js');
+    const code = await runOrmCommand('init', [absPath]);
+    if (code !== 0) {
+        throw new Error(`orm init failed for ${absPath} (exit ${code}). ` +
+            '`seq-studio init --with orm` requires `@sequenceholdings/orm` ' +
+            '(workspace / internal installs today; not yet available via public npm).');
+    }
+}
+async function scaffoldArtifact({ absPath, appId, }) {
+    const { runCli } = await import('@sequenceholdings/artifact-studio/cli');
+    const code = await runCli(['init', absPath]);
+    if (code !== 0) {
+        throw new Error(`artifact init failed for ${absPath} (exit ${code})`);
+    }
+    await rewriteArtifactIdentity({ artifactDir: absPath, appId });
+}
+async function scaffoldFunction({ absPath }) {
+    const code = await functionsInitCommand(parseArgs([absPath]));
+    if (code !== 0) {
+        throw new Error(`functions init failed for ${absPath} (exit ${code})`);
+    }
+}
+async function scaffoldKind({ kind, appRoot, appId, name, }) {
+    const relPath = relativePathFor({ kind, appId, name }).replace(/\\/g, '/');
+    const absPath = join(appRoot, relPath);
+    const entry = buildPrimitiveEntry({ kind, appId, name, dependsOn: [] });
+    switch (kind) {
+        case 'orm':
+            await mkdir(dirname(absPath), { recursive: true });
+            await scaffoldOrm({ absPath });
+            break;
+        case 'function':
+            await scaffoldFunction({ absPath });
+            break;
+        case 'artifact':
+            await mkdir(absPath, { recursive: true });
+            await scaffoldArtifact({ absPath, appId });
+            break;
+    }
+    return entry;
+}
+function applyDefaultDependsOn(primitives) {
+    const orm = primitives.find((entry) => entry.kind === 'orm');
+    if (!orm)
+        return primitives;
+    return primitives.map((entry) => {
+        if (entry.kind === 'orm' || entry.depends_on.length > 0)
+            return entry;
+        return { ...entry, depends_on: [orm.id] };
+    });
+}
+export async function initAppMonorepo({ rootDir, appId, kinds, names = defaultScaffoldNames(appId), description, }) {
+    if (kinds.length === 0) {
+        throw new Error('select at least one primitive via --with orm,function,artifact (or --orm --function …)');
+    }
+    const appRoot = resolve(rootDir);
+    if (existsSync(join(appRoot, 'sequence.app.yml'))) {
+        throw new Error(`${join(appRoot, 'sequence.app.yml')} already exists — refusing to re-init`);
+    }
+    if (existsSync(appRoot)) {
+        const { readdir } = await import('node:fs/promises');
+        const entries = await readdir(appRoot).catch((error) => {
+            if (error.code === 'ENOENT')
+                return [];
+            throw error;
+        });
+        if (entries.length > 0) {
+            throw new Error(`${appRoot} is not empty — init into a new directory, or remove existing files first`);
+        }
+    }
+    await mkdir(appRoot, { recursive: true });
+    try {
+        const version = currentVersion();
+        const primitives = [];
+        for (const kind of kinds) {
+            const name = kind === 'function' ? names.functionName : appId;
+            primitives.push(await scaffoldKind({ kind, appRoot, appId, name }));
+        }
+        const withDeps = applyDefaultDependsOn(primitives);
+        const manifest = {
+            schema_version: 1,
+            app: {
+                id: appId,
+                title: titleizeSlug(appId),
+                ...(description !== undefined ? { description } : {}),
+            },
+            studio: {
+                created_with: version,
+                min_cli: version,
+            },
+            primitives: withDeps,
+            deploy: {
+                order: defaultDeployOrder(withDeps),
+                on_error: 'stop',
+            },
+        };
+        await writeAppManifest({ rootDir: appRoot, manifest });
+        await writeFile(join(appRoot, '.gitignore'), ['node_modules/', 'dist/', '.env', '.env.*', '!.env.example', '.DS_Store', '*.log'].join('\n') + '\n', 'utf8');
+        return manifest;
+    }
+    catch (error) {
+        // Directory was empty (or newly created) — remove partial scaffolds so a
+        // retry can `init` into the same path without a manual cleanup.
+        await rm(appRoot, { recursive: true, force: true }).catch(() => {
+            /* best-effort */
+        });
+        throw error;
+    }
+}
+export async function addPrimitiveToApp({ rootDir, kind, name, }) {
+    const appRoot = resolve(rootDir);
+    const manifest = await loadAppManifest(appRoot);
+    const appId = manifest.app.id;
+    if (kind === 'orm') {
+        throw new Error('adding a second orm namespace is not supported via `seq-studio add` yet — edit sequence.app.yml and scaffold with `seq-studio orm init` manually');
+    }
+    if (kind === 'artifact' && manifest.primitives.some((entry) => entry.kind === 'artifact')) {
+        throw new Error('this app already has an artifact primitive — remove it from sequence.app.yml before re-adding');
+    }
+    const entryId = primitiveIdFor({ kind, name: kind === 'artifact' ? appId : name });
+    if (manifest.primitives.some((entry) => entry.id === entryId)) {
+        throw new Error(`primitive id "${entryId}" already exists in sequence.app.yml`);
+    }
+    const relPath = relativePathFor({ kind, appId, name }).replace(/\\/g, '/');
+    if (manifest.primitives.some((entry) => entry.path === relPath)) {
+        throw new Error(`path "${relPath}" is already declared in sequence.app.yml`);
+    }
+    const absPath = join(appRoot, relPath);
+    // Refuse before scaffolding so a failed init cannot roll back pre-existing files.
+    if (existsSync(absPath)) {
+        throw new Error(`${relPath} already exists on disk — remove it or choose a different name before \`seq-studio add\``);
+    }
+    try {
+        let entry = await scaffoldKind({ kind, appRoot, appId, name });
+        const orm = manifest.primitives.find((item) => item.kind === 'orm');
+        if (orm && entry.depends_on.length === 0) {
+            entry = { ...entry, depends_on: [orm.id] };
+        }
+        const primitives = [...manifest.primitives, entry];
+        const next = {
+            ...manifest,
+            primitives,
+            deploy: {
+                ...manifest.deploy,
+                order: extendDeployOrder({
+                    existingOrder: manifest.deploy.order,
+                    primitives,
+                    newId: entry.id,
+                }),
+                on_error: manifest.deploy.on_error,
+            },
+        };
+        await writeAppManifest({ rootDir: appRoot, manifest: next });
+        return { manifest: next, entry };
+    }
+    catch (error) {
+        // Safe: absPath did not exist before this invocation.
+        await rm(absPath, { recursive: true, force: true }).catch(() => {
+            /* best-effort */
+        });
+        throw error;
+    }
+}
+export function printInitNextSteps({ appRoot, manifest, }) {
+    const rel = relative(process.cwd(), appRoot);
+    const display = !rel || rel.startsWith('..') ? appRoot : rel;
+    console.log(`${LOG} scaffolded app "${manifest.app.id}" in ${display}`);
+    console.log(`${LOG} wrote ${APP_MANIFEST_LABEL} with ${manifest.primitives.length} primitive(s):`);
+    for (const entry of manifest.primitives) {
+        console.log(`${LOG}   - ${entry.kind.padEnd(9)} ${entry.id}  (${entry.path})`);
+    }
+    console.log('');
+    console.log('Next:');
+    console.log(`  cd ${display}`);
+    for (const entry of manifest.primitives) {
+        console.log(`  (cd ${entry.path} && pnpm install)`);
+    }
+    console.log('  seq-studio login');
+    console.log('  seq-studio deploy -e local --yes');
+    console.log('  # or targeted:');
+    const fn = manifest.primitives.find((entry) => entry.kind === 'function');
+    if (fn) {
+        console.log(`  seq-studio functions deploy --dir ${fn.path} -e local --yes`);
+    }
+    if (manifest.primitives.some((entry) => entry.kind === 'artifact')) {
+        console.log('  seq-studio artifact deploy artifact -e local');
+    }
+    console.log('  # add another function later:');
+    console.log('  seq-studio add function list-types');
+}

package/dist/auth.d.ts

@@ -53,14 +53,17 @@ export interface SeqapiTokens {
     access_token?: string;
     expires_at?: number;
 }
+interface RealmResolutionOptions {
+    fetchImpl?: typeof fetch;
+    targetUrl?: string;
+}
 /**
  * Resolve the auth realm for an environment name. Undefined, built-ins, and
- * per-PR preview targets map to the shared Sequence realm. Preview URLs are
- * constrained to Sequence's preview domain by the environment resolver. Every
- * other explicit name must have a valid seqapi registry entry; otherwise fail
- * closed so a shared Sequence bearer token can never be sent to a tenant URL.
+ * per-PR preview targets map to the shared Sequence realm, except loopback
+ * targets can advertise the isolated Sequence-staging realm used by contractor
+ * local dev. Every other explicit name must have a valid seqapi registry entry.
  */
-export declare function realmForEnv(envName?: string): Promise<AuthRealm>;
+export declare function realmForEnv(envName?: string, options?: RealmResolutionOptions): Promise<AuthRealm>;
 /** Env var(s) carrying a realm's M2M client secret — the Sequence realm keeps
  * the legacy bare name; OpCo realms use a suffixed name so one shell can hold
  * several credentials unambiguously. Mirrors seqapi's `_m2m_secret_env_names`. */
@@ -153,3 +156,4 @@ export declare function currentIdentitySubject(options?: {
 export declare function loadCachedUserTokens(realmName?: string): Promise<SeqapiTokens | null>;
 export declare function saveTokens(tokens: SeqapiTokens, realmName?: string): Promise<void>;
 export declare function deleteRealmTokens(realmName: string): Promise<void>;
+export {};

package/dist/auth.js

@@ -40,6 +40,12 @@ const AUTH0_M2M_CLIENT_ID = '5TLffZqvLq4ztLDjZhwKVJCpB5VNrWj0';
  * also the implicit realm of the legacy flat fields in tokens.json. */
 export const SEQUENCE_REALM = 'sequence';
 const SEQUENCE_BUILTIN_ENVS = new Set(['local', 'staging', 'production', 'banksouth']);
+const LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1']);
+const SEQUENCE_STAGING_AUTH0_AUDIENCE = 'https://staging.sequence.seqholdings.com/api';
+const TRUSTED_LOOPBACK_AUTH0_AUDIENCES = new Set([
+    AUTH0_AUDIENCE,
+    SEQUENCE_STAGING_AUTH0_AUDIENCE,
+]);
 export function isSequenceAuthEnvName(envName) {
     return (envName === SEQUENCE_REALM ||
         SEQUENCE_BUILTIN_ENVS.has(envName) ||
@@ -76,14 +82,116 @@ export const SEQUENCE_AUTH_REALM = {
 function seqapiConfigPath() {
     return join(seqapiTokenDir(), 'config.json');
 }
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+function isLoopbackEnvName(envName) {
+    return envName === 'local' || envName.startsWith('local:');
+}
+function loopbackTargetUrl({ configuredTargetUrl, envName, }) {
+    if (configuredTargetUrl)
+        return configuredTargetUrl;
+    return envName === 'local' ? 'http://localhost:5001' : undefined;
+}
+function optionalString({ field, value, }) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value === 'string')
+        return value;
+    throw new Error(`Local Auth0 discovery returned invalid '${field}'.`);
+}
+function parseDiscoveredAuth0(payload) {
+    const auth0 = isRecord(payload) ? Reflect.get(payload, 'auth0') : undefined;
+    const auth0Record = isRecord(auth0) ? auth0 : {};
+    const domain = Reflect.get(auth0Record, 'domain');
+    const clientId = Reflect.get(auth0Record, 'clientId');
+    const audience = Reflect.get(auth0Record, 'audience');
+    if (typeof domain !== 'string' ||
+        !domain ||
+        typeof clientId !== 'string' ||
+        !clientId ||
+        typeof audience !== 'string' ||
+        !audience) {
+        throw new Error('Local Auth0 discovery returned incomplete required config.');
+    }
+    return {
+        domain,
+        clientId,
+        audience,
+        organization: optionalString({
+            field: 'organization',
+            value: Reflect.get(auth0Record, 'organization'),
+        }),
+        m2mClientId: optionalString({
+            field: 'm2mClientId',
+            value: Reflect.get(auth0Record, 'm2mClientId'),
+        }),
+    };
+}
+async function discoverLoopbackRealm({ envName, fetchImpl = fetch, targetUrl, }) {
+    const baseUrl = validateDeploymentBaseUrl(targetUrl);
+    const hostname = new URL(baseUrl).hostname.toLowerCase();
+    if (!LOOPBACK_HOSTNAMES.has(hostname))
+        return SEQUENCE_AUTH_REALM;
+    let response;
+    try {
+        response = await fetchImpl(`${baseUrl}/api/auth/cli-config`, {
+            redirect: 'error',
+            signal: AbortSignal.timeout(2_000),
+        });
+    }
+    catch {
+        // Preserve the historical realm choice while local Atlas is stopped. The
+        // subsequent API request reports that the local server is unavailable.
+        return SEQUENCE_AUTH_REALM;
+    }
+    if (!response.ok) {
+        throw new Error(`Could not discover Auth0 config for local environment '${envName}': ` +
+            `${baseUrl}/api/auth/cli-config returned HTTP ${response.status}.`);
+    }
+    const payload = await response.json();
+    const { audience, clientId, domain, m2mClientId, organization } = parseDiscoveredAuth0(payload);
+    if (!TRUSTED_LOOPBACK_AUTH0_AUDIENCES.has(audience)) {
+        throw new Error(`Untrusted Auth0 audience '${audience}' for local environment '${envName}'.`);
+    }
+    const trustedDomain = validateAuth0Domain(domain);
+    if (clientId === AUTH0_CLIENT_ID && audience === AUTH0_AUDIENCE) {
+        return SEQUENCE_AUTH_REALM;
+    }
+    return {
+        name: 'local',
+        domain: trustedDomain,
+        clientId,
+        audience,
+        organization,
+        m2mClientId,
+    };
+}
+async function maybeDiscoverLoopbackRealm({ envName, options, }) {
+    if (!envName || !isLoopbackEnvName(envName))
+        return undefined;
+    const targetUrl = loopbackTargetUrl({
+        configuredTargetUrl: options.targetUrl,
+        envName,
+    });
+    if (!targetUrl)
+        return undefined;
+    return discoverLoopbackRealm({
+        envName,
+        fetchImpl: options.fetchImpl,
+        targetUrl,
+    });
+}
 /**
  * Resolve the auth realm for an environment name. Undefined, built-ins, and
- * per-PR preview targets map to the shared Sequence realm. Preview URLs are
- * constrained to Sequence's preview domain by the environment resolver. Every
- * other explicit name must have a valid seqapi registry entry; otherwise fail
- * closed so a shared Sequence bearer token can never be sent to a tenant URL.
+ * per-PR preview targets map to the shared Sequence realm, except loopback
+ * targets can advertise the isolated Sequence-staging realm used by contractor
+ * local dev. Every other explicit name must have a valid seqapi registry entry.
  */
-export async function realmForEnv(envName) {
+export async function realmForEnv(envName, options = {}) {
+    const discoveredRealm = await maybeDiscoverLoopbackRealm({ envName, options });
+    if (discoveredRealm)
+        return discoveredRealm;
     if (!envName || isSequenceAuthEnvName(envName)) {
         return SEQUENCE_AUTH_REALM;
     }
@@ -303,7 +411,12 @@ function validateRealmTarget({ realm, targetUrl, }) {
     try {
         const baseUrl = validateDeploymentBaseUrl(targetUrl);
         if (realm.name !== SEQUENCE_REALM) {
-            validateDeploymentAudience({ audience: realm.audience, baseUrl });
+            const hostname = new URL(baseUrl).hostname.toLowerCase();
+            const isReviewedLoopbackRealm = LOOPBACK_HOSTNAMES.has(hostname) &&
+                TRUSTED_LOOPBACK_AUTH0_AUDIENCES.has(realm.audience);
+            if (!isReviewedLoopbackRealm) {
+                validateDeploymentAudience({ audience: realm.audience, baseUrl });
+            }
         }
     }
     catch (error) {
@@ -312,7 +425,7 @@ function validateRealmTarget({ realm, targetUrl, }) {
     }
 }
 export async function getAccessTokenWithMode(options) {
-    const realm = await realmForEnv(options?.env);
+    const realm = await realmForEnv(options?.env, { targetUrl: options?.targetUrl });
     if (options?.targetUrl)
         validateRealmTarget({ realm, targetUrl: options.targetUrl });
     const forceM2m = authModePrefersM2m();
@@ -377,7 +490,7 @@ export async function tryGetAccessTokenWithMode(options) {
             // Do not replace an invalid tenant registration with the Sequence realm:
             // that could hide a rejected discovery token host or inspect the wrong
             // M2M secret. Config-resolution errors must surface unchanged.
-            const realm = await realmForEnv(options.env);
+            const realm = await realmForEnv(options.env, { targetUrl: options.targetUrl });
             if (process.env[m2mSecretEnvName(realm)]?.trim())
                 throw err;
         }

package/dist/config.d.ts

@@ -24,14 +24,18 @@ export declare function defaultConfig(): LatticeConfig;
  * Read the effective config. Merge precedence (later wins):
  *
  *   1. built-in `local`
- *   2. the cached discovered catalog (`~/.config/lattice/environments.json`)
- *   3. user entries in config.toml (an override for `local`, or net-new envs)
- *   4. OpCo registrations shared with seqapi (`~/.config/sequence-api/config.json`)
+ *   2. local worktrees discovered from `.wt.env`
+ *   3. the cached discovered catalog (`~/.config/lattice/environments.json`)
+ *   4. user entries in config.toml (an override for `local`, or net-new envs)
+ *   5. OpCo registrations shared with seqapi (`~/.config/sequence-api/config.json`)
  *
  * Registered OpCo routes are authoritative for their names so a lower-trust
  * config.toml override cannot send a tenant token to another origin.
  */
 export declare function readConfig(): Promise<LatticeConfig>;
+export declare function localAuthRealmOptions(envName?: string): Promise<{
+    targetUrl?: string;
+}>;
 /** Write the config to disk, creating the dir if missing. */
 export declare function writeConfig(config: LatticeConfig): Promise<void>;
 export interface ResolvedEnv {

package/dist/config.js

@@ -1,7 +1,9 @@
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { execFile } from 'node:child_process';
+import { mkdir, readFile, readdir, writeFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { basename, dirname, join } from 'node:path';
+import { promisify } from 'node:util';
 import { parse as parseToml, stringify as stringifyToml } from 'smol-toml';
 import { M2mTokenError } from './auth.js';
 import { fetchCatalog, readCachedCatalog, } from './env-catalog.js';
@@ -26,7 +28,69 @@ export const PREVIEW_ENV_PREFIX = 'preview:';
 const BUILT_IN_ENV_URLS = {
     local: 'http://localhost:5001',
 };
+const execFileAsync = promisify(execFile);
+const WORKTREE_ENV_PREFIX = 'local:';
+const WORKTREE_NAME_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
 export const ENV_NAMES = Object.keys(BUILT_IN_ENV_URLS);
+async function atlasPortFromWorktreeEnv(directory) {
+    let text;
+    try {
+        text = await readFile(join(directory, '.wt.env'), 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+    const value = text
+        .split('\n')
+        .map((line) => line.split('=', 2))
+        .find(([key]) => key?.trim() === 'ATLAS_PORT')?.[1]
+        ?.trim();
+    if (!value || !/^\d+$/.test(value))
+        return undefined;
+    const port = Number(value);
+    return port >= 1 && port <= 65_535 ? port : undefined;
+}
+async function worktreeDirectories() {
+    const root = process.env.WT_ROOT ?? join(homedir(), 'studio-worktrees');
+    const directories = [];
+    try {
+        const entries = await readdir(root, { withFileTypes: true });
+        directories.push(...entries
+            .filter((entry) => entry.isDirectory())
+            .map((entry) => join(root, entry.name)));
+    }
+    catch {
+        // The default worktree root is optional.
+    }
+    try {
+        const { stdout } = await execFileAsync('git', ['worktree', 'list', '--porcelain']);
+        const gitWorktrees = stdout
+            .split('\n')
+            .filter((line) => line.startsWith('worktree '))
+            .map((line) => line.slice('worktree '.length))
+            .slice(1);
+        directories.push(...gitWorktrees);
+    }
+    catch {
+        // Global CLI use outside a git checkout still supports WT_ROOT discovery.
+    }
+    return [...new Set(directories)];
+}
+async function worktreeEnvironmentUrls() {
+    const environments = {};
+    for (const directory of await worktreeDirectories()) {
+        const name = basename(directory);
+        if (!WORKTREE_NAME_PATTERN.test(name))
+            continue;
+        const port = await atlasPortFromWorktreeEnv(directory);
+        if (port === undefined)
+            continue;
+        environments[`${WORKTREE_ENV_PREFIX}${name}`] ??= {
+            url: `http://localhost:${port}`,
+        };
+    }
+    return environments;
+}
 export function globalConfigDir() {
     return join(homedir(), '.config', 'lattice');
 }
@@ -44,15 +108,17 @@ export function defaultConfig() {
  * Read the effective config. Merge precedence (later wins):
  *
  *   1. built-in `local`
- *   2. the cached discovered catalog (`~/.config/lattice/environments.json`)
- *   3. user entries in config.toml (an override for `local`, or net-new envs)
- *   4. OpCo registrations shared with seqapi (`~/.config/sequence-api/config.json`)
+ *   2. local worktrees discovered from `.wt.env`
+ *   3. the cached discovered catalog (`~/.config/lattice/environments.json`)
+ *   4. user entries in config.toml (an override for `local`, or net-new envs)
+ *   5. OpCo registrations shared with seqapi (`~/.config/sequence-api/config.json`)
  *
  * Registered OpCo routes are authoritative for their names so a lower-trust
  * config.toml override cannot send a tenant token to another origin.
  */
 export async function readConfig() {
     const merged = defaultConfig();
+    Object.assign(merged.envs, await worktreeEnvironmentUrls());
     const catalog = await readCachedCatalog();
     if (catalog) {
         merged.tier = catalog.tier;
@@ -80,6 +146,12 @@ export async function readConfig() {
     }
     return merged;
 }
+export async function localAuthRealmOptions(envName) {
+    if (!envName || (envName !== 'local' && !envName.startsWith('local:'))) {
+        return {};
+    }
+    return { targetUrl: (await readConfig()).envs[envName]?.url };
+}
 /** Write the config to disk, creating the dir if missing. */
 export async function writeConfig(config) {
     const path = configPath();

package/dist/envs/commands.js

@@ -14,7 +14,8 @@ const ENVS_USAGE = `usage:
   catalog is cached at ~/.config/lattice/environments.json and also refreshes
   lazily the first time you pass an -e <env> that isn't cached yet.
 
-  Custom entries in ${configPath()} are always honored on top.
+  Local worktrees are discovered from their .wt.env files. Custom entries in
+  ${configPath()} are always honored on top.
 `;
 export async function runEnvsCommand(sub, rest) {
     switch (sub) {
@@ -97,11 +98,13 @@ async function listCommand() {
     for (const [name, { url }] of Object.entries(config.envs)) {
         const source = name === 'local' && !discovered.has(name)
             ? 'built-in'
-            : discovered.has(name)
-                ? 'discovered'
-                : registeredNames.has(name)
-                    ? 'registered'
-                    : 'config.toml';
+            : name.startsWith('local:')
+                ? 'worktree'
+                : discovered.has(name)
+                    ? 'discovered'
+                    : registeredNames.has(name)
+                        ? 'registered'
+                        : 'config.toml';
         console.log(`  ${name.padEnd(width)}  ${url}  (${source})`);
     }
     if (config.tier === 'anonymous') {

package/dist/functions/bundle.js

@@ -59,13 +59,13 @@ export async function validateLocalBundle({ rootDir, files, }) {
         if (existsSync(join(rootDir, 'package-lock.json')) || existsSync(join(rootDir, 'yarn.lock'))) {
             issues.push({
                 level: 'warning',
-                message: 'Found a non-pnpm lockfile (package-lock.json / yarn.lock). It is ignored — the deploy worker resolves dependencies against Chainguard, Sequence\'s internal registry. With Chainguard credentials, `pnpm install` produces a pinned lockfile for a faster deploy; without them this is fine as-is.',
+                message: 'Found a non-pnpm lockfile (package-lock.json / yarn.lock). It is ignored; dependencies are resolved server-side at deploy time.',
             });
         }
         else {
             issues.push({
                 level: 'info',
-                message: 'No pnpm-lock.yaml — the deploy worker will resolve dependencies against Chainguard, Sequence\'s internal registry. With Chainguard credentials, `pnpm install` produces a pinned lockfile for a faster deploy; without them this is fine as-is.',
+                message: 'No pnpm-lock.yaml — dependencies are resolved server-side at deploy time.',
             });
         }
     }
@@ -76,7 +76,7 @@ export async function validateLocalBundle({ rootDir, files, }) {
         if (classifyLockfileOrigin(lockfileText) !== 'chainguard') {
             issues.push({
                 level: 'warning',
-                message: 'pnpm-lock.yaml was not resolved against Chainguard — the deploy worker will discard it and re-resolve (slower, and versions may differ). This is expected without Chainguard credentials; with them, regenerate against Chainguard (registry=https://libraries.cgr.dev/javascript/) for a fast, pinned deploy.',
+                message: 'pnpm-lock.yaml cannot be used for this deployment, so dependencies are resolved server-side at deploy time. Resolved versions may differ.',
             });
         }
     }