everything-dev 1.49.0 → 1.51.0

package/dist/ui/router.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.mts","names":[],"sources":["../../src/ui/router.ts"],"mappings":";;;;iBAGgB,UAAA,CAAW,IAAA,EAAM,QAAA;AAAA,iBAcjB,UAAA,CAAW,IAAA,EAAM,QAAA;AAAA,iBAMjB,YAAA,CAAa,MAAA,EAAQ,UAAA;AAAA,iBASf,eAAA,CAAgB,MAAA,EAAQ,SAAA,GAAY,OAAA,CAAQ,QAAA"}
+{"version":3,"file":"router.d.mts","names":[],"sources":["../../src/ui/router.ts"],"mappings":";;;;iBAGgB,UAAA,CAAW,IAAA,EAAM,QAAA;AAAA,iBAcjB,UAAA,CAAW,IAAA,EAAM,QAAA;AAAA,iBAMjB,YAAA,CAAa,MAAA,EAAQ,UAAA;AAAA,iBASf,eAAA,CAAgB,MAAA,EAAQ,SAAA,GAAY,OAAA,CAAQ,QAAA;AAAA,iBA0GlD,iBAAA,CACd,QAAA,EAAU,QAAA,EACV,QAAA;EACG,QAAA;EAAkB,QAAA;EAAkB,UAAA;AAAA"}

package/dist/ui/router.mjs

@@ -45,7 +45,46 @@ async function collectHeadData(router) {
 		scripts: [...scriptMap.values()]
 	};
 }
+function escapeHtml(s) {
+	return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function serializeMeta(meta) {
+	if (!meta) return "";
+	if ("charSet" in meta) return `<meta charset="${escapeHtml(String(meta.charSet))}">`;
+	if ("title" in meta) return `<title>${escapeHtml(String(meta.title))}</title>`;
+	return `<meta ${Object.entries(meta).filter(([, v]) => v != null).map(([k, v]) => `${k}="${escapeHtml(String(v))}"`).join(" ")}>`;
+}
+function serializeLink(link) {
+	if (!link) return "";
+	return `<link ${Object.entries(link).filter(([, v]) => v != null).map(([k, v]) => `${k}="${escapeHtml(String(v))}"`).join(" ")}>`;
+}
+function serializeScript(script, cspNonce) {
+	if (!script) return "";
+	if ("src" in script && script.src) {
+		const attrs = [`src="${escapeHtml(script.src)}"`];
+		if (script.integrity) attrs.push(`integrity="${escapeHtml(script.integrity)}"`);
+		if (script.crossOrigin) attrs.push(`crossorigin="${escapeHtml(script.crossOrigin)}"`);
+		if (script.type) attrs.push(`type="${escapeHtml(script.type)}"`);
+		if (cspNonce) attrs.push(`nonce="${cspNonce}"`);
+		return `<script ${attrs.join(" ")}><\/script>`;
+	}
+	if ("children" in script) {
+		const attrs = [];
+		if (script.type) attrs.push(`type="${escapeHtml(script.type)}"`);
+		if (cspNonce) attrs.push(`nonce="${cspNonce}"`);
+		const content = typeof script.children === "string" ? script.children : JSON.stringify(script.children);
+		return `<script${attrs.length ? ` ${attrs.join(" ")}` : ""}>${content}<\/script>`;
+	}
+	return "";
+}
+function serializeHeadData(headData, cspNonce) {
+	return {
+		metaHtml: headData.meta.filter(Boolean).map((m) => serializeMeta(m)).join("\n"),
+		linkHtml: headData.links.filter(Boolean).map((l) => serializeLink(l)).join("\n"),
+		scriptHtml: headData.scripts.filter(Boolean).map((s) => serializeScript(s, cspNonce)).join("\n")
+	};
+}
 
 //#endregion
-export { collectHeadData, getLinkKey, getMetaKey, getScriptKey };
+export { collectHeadData, getLinkKey, getMetaKey, getScriptKey, serializeHeadData };
 //# sourceMappingURL=router.mjs.map

package/dist/ui/router.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"router.mjs","names":[],"sources":["../../src/ui/router.ts"],"sourcesContent":["import type { AnyRouter } from \"@tanstack/react-router\";\nimport type { HeadData, HeadLink, HeadMeta, HeadScript } from \"./types\";\n\nexport function getMetaKey(meta: HeadMeta): string {\n  if (!meta) return \"null\";\n  if (\"title\" in meta) return \"title\";\n  if (\"charSet\" in meta) return \"charSet\";\n  if (\"name\" in meta) return `name:${(meta as { name: string }).name}`;\n  if (\"property\" in meta) {\n    return `property:${(meta as { property: string }).property}`;\n  }\n  if (\"httpEquiv\" in meta) {\n    return `httpEquiv:${(meta as { httpEquiv: string }).httpEquiv}`;\n  }\n  return JSON.stringify(meta);\n}\n\nexport function getLinkKey(link: HeadLink): string {\n  const rel = (link as { rel?: string }).rel ?? \"\";\n  const href = (link as { href?: string }).href ?? \"\";\n  return `${rel}:${href}`;\n}\n\nexport function getScriptKey(script: HeadScript): string {\n  if (!script) return \"null\";\n  if (\"src\" in script && script.src) return `src:${script.src}`;\n  if (\"children\" in script && script.children) {\n    return `children:${typeof script.children === \"string\" ? script.children : JSON.stringify(script.children)}`;\n  }\n  return JSON.stringify(script);\n}\n\nexport async function collectHeadData(router: AnyRouter): Promise<HeadData> {\n  await router.load();\n\n  const metaMap = new Map<string, HeadMeta>();\n  const linkMap = new Map<string, HeadLink>();\n  const scriptMap = new Map<string, HeadScript>();\n\n  for (const match of router.state.matches) {\n    const route =\n      (\n        router as AnyRouter & {\n          routesById?: Record<string, { options?: { head?: (...args: unknown[]) => unknown } }>;\n        }\n      ).routesById?.[(match as { routeId: string }).routeId] ??\n      (match as { route?: { options?: { head?: (...args: unknown[]) => unknown } } }).route;\n    const headFn = route?.options?.head;\n    if (!headFn) continue;\n\n    try {\n      const headResult = (await headFn({\n        loaderData: match.loaderData,\n        matches: router.state.matches,\n        match,\n        params: match.params,\n      })) as {\n        meta?: HeadMeta[];\n        links?: HeadLink[];\n        scripts?: HeadScript[];\n      };\n\n      if (headResult?.meta) {\n        for (const meta of headResult.meta) {\n          metaMap.set(getMetaKey(meta), meta);\n        }\n      }\n      if (headResult?.links) {\n        for (const link of headResult.links) {\n          linkMap.set(getLinkKey(link), link);\n        }\n      }\n      if (headResult?.scripts) {\n        for (const script of headResult.scripts) {\n          scriptMap.set(getScriptKey(script), script);\n        }\n      }\n    } catch (error) {\n      console.warn(`[collectHeadData] head() failed for ${match.routeId}:`, error);\n    }\n  }\n\n  return {\n    meta: [...metaMap.values()],\n    links: [...linkMap.values()],\n    scripts: [...scriptMap.values()],\n  };\n}\n"],"mappings":";AAGA,SAAgB,WAAW,MAAwB;AACjD,KAAI,CAAC,KAAM,QAAO;AAClB,KAAI,WAAW,KAAM,QAAO;AAC5B,KAAI,aAAa,KAAM,QAAO;AAC9B,KAAI,UAAU,KAAM,QAAO,QAAS,KAA0B;AAC9D,KAAI,cAAc,KAChB,QAAO,YAAa,KAA8B;AAEpD,KAAI,eAAe,KACjB,QAAO,aAAc,KAA+B;AAEtD,QAAO,KAAK,UAAU,KAAK;;AAG7B,SAAgB,WAAW,MAAwB;AAGjD,QAAO,GAFM,KAA0B,OAAO,GAEhC,GADA,KAA2B,QAAQ;;AAInD,SAAgB,aAAa,QAA4B;AACvD,KAAI,CAAC,OAAQ,QAAO;AACpB,KAAI,SAAS,UAAU,OAAO,IAAK,QAAO,OAAO,OAAO;AACxD,KAAI,cAAc,UAAU,OAAO,SACjC,QAAO,YAAY,OAAO,OAAO,aAAa,WAAW,OAAO,WAAW,KAAK,UAAU,OAAO,SAAS;AAE5G,QAAO,KAAK,UAAU,OAAO;;AAG/B,eAAsB,gBAAgB,QAAsC;AAC1E,OAAM,OAAO,MAAM;CAEnB,MAAM,0BAAU,IAAI,KAAuB;CAC3C,MAAM,0BAAU,IAAI,KAAuB;CAC3C,MAAM,4BAAY,IAAI,KAAyB;AAE/C,MAAK,MAAM,SAAS,OAAO,MAAM,SAAS;EAQxC,MAAM,UALF,OAGA,aAAc,MAA8B,YAC7C,MAA+E,QAC5D,SAAS;AAC/B,MAAI,CAAC,OAAQ;AAEb,MAAI;GACF,MAAM,aAAc,MAAM,OAAO;IAC/B,YAAY,MAAM;IAClB,SAAS,OAAO,MAAM;IACtB;IACA,QAAQ,MAAM;IACf,CAAC;AAMF,OAAI,YAAY,KACd,MAAK,MAAM,QAAQ,WAAW,KAC5B,SAAQ,IAAI,WAAW,KAAK,EAAE,KAAK;AAGvC,OAAI,YAAY,MACd,MAAK,MAAM,QAAQ,WAAW,MAC5B,SAAQ,IAAI,WAAW,KAAK,EAAE,KAAK;AAGvC,OAAI,YAAY,QACd,MAAK,MAAM,UAAU,WAAW,QAC9B,WAAU,IAAI,aAAa,OAAO,EAAE,OAAO;WAGxC,OAAO;AACd,WAAQ,KAAK,uCAAuC,MAAM,QAAQ,IAAI,MAAM;;;AAIhF,QAAO;EACL,MAAM,CAAC,GAAG,QAAQ,QAAQ,CAAC;EAC3B,OAAO,CAAC,GAAG,QAAQ,QAAQ,CAAC;EAC5B,SAAS,CAAC,GAAG,UAAU,QAAQ,CAAC;EACjC"}
+{"version":3,"file":"router.mjs","names":[],"sources":["../../src/ui/router.ts"],"sourcesContent":["import type { AnyRouter } from \"@tanstack/react-router\";\nimport type { HeadData, HeadLink, HeadMeta, HeadScript } from \"./types\";\n\nexport function getMetaKey(meta: HeadMeta): string {\n  if (!meta) return \"null\";\n  if (\"title\" in meta) return \"title\";\n  if (\"charSet\" in meta) return \"charSet\";\n  if (\"name\" in meta) return `name:${(meta as { name: string }).name}`;\n  if (\"property\" in meta) {\n    return `property:${(meta as { property: string }).property}`;\n  }\n  if (\"httpEquiv\" in meta) {\n    return `httpEquiv:${(meta as { httpEquiv: string }).httpEquiv}`;\n  }\n  return JSON.stringify(meta);\n}\n\nexport function getLinkKey(link: HeadLink): string {\n  const rel = (link as { rel?: string }).rel ?? \"\";\n  const href = (link as { href?: string }).href ?? \"\";\n  return `${rel}:${href}`;\n}\n\nexport function getScriptKey(script: HeadScript): string {\n  if (!script) return \"null\";\n  if (\"src\" in script && script.src) return `src:${script.src}`;\n  if (\"children\" in script && script.children) {\n    return `children:${typeof script.children === \"string\" ? script.children : JSON.stringify(script.children)}`;\n  }\n  return JSON.stringify(script);\n}\n\nexport async function collectHeadData(router: AnyRouter): Promise<HeadData> {\n  await router.load();\n\n  const metaMap = new Map<string, HeadMeta>();\n  const linkMap = new Map<string, HeadLink>();\n  const scriptMap = new Map<string, HeadScript>();\n\n  for (const match of router.state.matches) {\n    const route =\n      (\n        router as AnyRouter & {\n          routesById?: Record<string, { options?: { head?: (...args: unknown[]) => unknown } }>;\n        }\n      ).routesById?.[(match as { routeId: string }).routeId] ??\n      (match as { route?: { options?: { head?: (...args: unknown[]) => unknown } } }).route;\n    const headFn = route?.options?.head;\n    if (!headFn) continue;\n\n    try {\n      const headResult = (await headFn({\n        loaderData: match.loaderData,\n        matches: router.state.matches,\n        match,\n        params: match.params,\n      })) as {\n        meta?: HeadMeta[];\n        links?: HeadLink[];\n        scripts?: HeadScript[];\n      };\n\n      if (headResult?.meta) {\n        for (const meta of headResult.meta) {\n          metaMap.set(getMetaKey(meta), meta);\n        }\n      }\n      if (headResult?.links) {\n        for (const link of headResult.links) {\n          linkMap.set(getLinkKey(link), link);\n        }\n      }\n      if (headResult?.scripts) {\n        for (const script of headResult.scripts) {\n          scriptMap.set(getScriptKey(script), script);\n        }\n      }\n    } catch (error) {\n      console.warn(`[collectHeadData] head() failed for ${match.routeId}:`, error);\n    }\n  }\n\n  return {\n    meta: [...metaMap.values()],\n    links: [...linkMap.values()],\n    scripts: [...scriptMap.values()],\n  };\n}\n\nfunction escapeHtml(s: string): string {\n  return s\n    .replace(/&/g, \"&amp;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\");\n}\n\nfunction serializeMeta(meta: HeadMeta): string {\n  if (!meta) return \"\";\n  if (\"charSet\" in meta) return `<meta charset=\"${escapeHtml(String(meta.charSet))}\">`;\n  if (\"title\" in meta) return `<title>${escapeHtml(String(meta.title))}</title>`;\n  const attrs = Object.entries(meta as Record<string, unknown>)\n    .filter(([, v]) => v != null)\n    .map(([k, v]) => `${k}=\"${escapeHtml(String(v))}\"`)\n    .join(\" \");\n  return `<meta ${attrs}>`;\n}\n\nfunction serializeLink(link: HeadLink): string {\n  if (!link) return \"\";\n  const attrs = Object.entries(link as Record<string, unknown>)\n    .filter(([, v]) => v != null)\n    .map(([k, v]) => `${k}=\"${escapeHtml(String(v))}\"`)\n    .join(\" \");\n  return `<link ${attrs}>`;\n}\n\nfunction serializeScript(script: HeadScript, cspNonce?: string): string {\n  if (!script) return \"\";\n  if (\"src\" in script && script.src) {\n    const attrs: string[] = [`src=\"${escapeHtml(script.src)}\"`];\n    if (script.integrity) attrs.push(`integrity=\"${escapeHtml(script.integrity)}\"`);\n    if (script.crossOrigin) attrs.push(`crossorigin=\"${escapeHtml(script.crossOrigin)}\"`);\n    if (script.type) attrs.push(`type=\"${escapeHtml(script.type)}\"`);\n    if (cspNonce) attrs.push(`nonce=\"${cspNonce}\"`);\n    return `<script ${attrs.join(\" \")}></script>`;\n  }\n  if (\"children\" in script) {\n    const attrs: string[] = [];\n    if (script.type) attrs.push(`type=\"${escapeHtml(script.type)}\"`);\n    if (cspNonce) attrs.push(`nonce=\"${cspNonce}\"`);\n    const content =\n      typeof script.children === \"string\" ? script.children : JSON.stringify(script.children);\n    return `<script${attrs.length ? ` ${attrs.join(\" \")}` : \"\"}>${content}</script>`;\n  }\n  return \"\";\n}\n\nexport function serializeHeadData(\n  headData: HeadData,\n  cspNonce?: string,\n): { metaHtml: string; linkHtml: string; scriptHtml: string } {\n  return {\n    metaHtml: headData.meta\n      .filter(Boolean)\n      .map((m) => serializeMeta(m))\n      .join(\"\\n\"),\n    linkHtml: headData.links\n      .filter(Boolean)\n      .map((l) => serializeLink(l))\n      .join(\"\\n\"),\n    scriptHtml: headData.scripts\n      .filter(Boolean)\n      .map((s) => serializeScript(s, cspNonce))\n      .join(\"\\n\"),\n  };\n}\n"],"mappings":";AAGA,SAAgB,WAAW,MAAwB;AACjD,KAAI,CAAC,KAAM,QAAO;AAClB,KAAI,WAAW,KAAM,QAAO;AAC5B,KAAI,aAAa,KAAM,QAAO;AAC9B,KAAI,UAAU,KAAM,QAAO,QAAS,KAA0B;AAC9D,KAAI,cAAc,KAChB,QAAO,YAAa,KAA8B;AAEpD,KAAI,eAAe,KACjB,QAAO,aAAc,KAA+B;AAEtD,QAAO,KAAK,UAAU,KAAK;;AAG7B,SAAgB,WAAW,MAAwB;AAGjD,QAAO,GAFM,KAA0B,OAAO,GAEhC,GADA,KAA2B,QAAQ;;AAInD,SAAgB,aAAa,QAA4B;AACvD,KAAI,CAAC,OAAQ,QAAO;AACpB,KAAI,SAAS,UAAU,OAAO,IAAK,QAAO,OAAO,OAAO;AACxD,KAAI,cAAc,UAAU,OAAO,SACjC,QAAO,YAAY,OAAO,OAAO,aAAa,WAAW,OAAO,WAAW,KAAK,UAAU,OAAO,SAAS;AAE5G,QAAO,KAAK,UAAU,OAAO;;AAG/B,eAAsB,gBAAgB,QAAsC;AAC1E,OAAM,OAAO,MAAM;CAEnB,MAAM,0BAAU,IAAI,KAAuB;CAC3C,MAAM,0BAAU,IAAI,KAAuB;CAC3C,MAAM,4BAAY,IAAI,KAAyB;AAE/C,MAAK,MAAM,SAAS,OAAO,MAAM,SAAS;EAQxC,MAAM,UALF,OAGA,aAAc,MAA8B,YAC7C,MAA+E,QAC5D,SAAS;AAC/B,MAAI,CAAC,OAAQ;AAEb,MAAI;GACF,MAAM,aAAc,MAAM,OAAO;IAC/B,YAAY,MAAM;IAClB,SAAS,OAAO,MAAM;IACtB;IACA,QAAQ,MAAM;IACf,CAAC;AAMF,OAAI,YAAY,KACd,MAAK,MAAM,QAAQ,WAAW,KAC5B,SAAQ,IAAI,WAAW,KAAK,EAAE,KAAK;AAGvC,OAAI,YAAY,MACd,MAAK,MAAM,QAAQ,WAAW,MAC5B,SAAQ,IAAI,WAAW,KAAK,EAAE,KAAK;AAGvC,OAAI,YAAY,QACd,MAAK,MAAM,UAAU,WAAW,QAC9B,WAAU,IAAI,aAAa,OAAO,EAAE,OAAO;WAGxC,OAAO;AACd,WAAQ,KAAK,uCAAuC,MAAM,QAAQ,IAAI,MAAM;;;AAIhF,QAAO;EACL,MAAM,CAAC,GAAG,QAAQ,QAAQ,CAAC;EAC3B,OAAO,CAAC,GAAG,QAAQ,QAAQ,CAAC;EAC5B,SAAS,CAAC,GAAG,UAAU,QAAQ,CAAC;EACjC;;AAGH,SAAS,WAAW,GAAmB;AACrC,QAAO,EACJ,QAAQ,MAAM,QAAQ,CACtB,QAAQ,MAAM,SAAS,CACvB,QAAQ,MAAM,OAAO,CACrB,QAAQ,MAAM,OAAO;;AAG1B,SAAS,cAAc,MAAwB;AAC7C,KAAI,CAAC,KAAM,QAAO;AAClB,KAAI,aAAa,KAAM,QAAO,kBAAkB,WAAW,OAAO,KAAK,QAAQ,CAAC,CAAC;AACjF,KAAI,WAAW,KAAM,QAAO,UAAU,WAAW,OAAO,KAAK,MAAM,CAAC,CAAC;AAKrE,QAAO,SAJO,OAAO,QAAQ,KAAgC,CAC1D,QAAQ,GAAG,OAAO,KAAK,KAAK,CAC5B,KAAK,CAAC,GAAG,OAAO,GAAG,EAAE,IAAI,WAAW,OAAO,EAAE,CAAC,CAAC,GAAG,CAClD,KAAK,IACa,CAAC;;AAGxB,SAAS,cAAc,MAAwB;AAC7C,KAAI,CAAC,KAAM,QAAO;AAKlB,QAAO,SAJO,OAAO,QAAQ,KAAgC,CAC1D,QAAQ,GAAG,OAAO,KAAK,KAAK,CAC5B,KAAK,CAAC,GAAG,OAAO,GAAG,EAAE,IAAI,WAAW,OAAO,EAAE,CAAC,CAAC,GAAG,CAClD,KAAK,IACa,CAAC;;AAGxB,SAAS,gBAAgB,QAAoB,UAA2B;AACtE,KAAI,CAAC,OAAQ,QAAO;AACpB,KAAI,SAAS,UAAU,OAAO,KAAK;EACjC,MAAM,QAAkB,CAAC,QAAQ,WAAW,OAAO,IAAI,CAAC,GAAG;AAC3D,MAAI,OAAO,UAAW,OAAM,KAAK,cAAc,WAAW,OAAO,UAAU,CAAC,GAAG;AAC/E,MAAI,OAAO,YAAa,OAAM,KAAK,gBAAgB,WAAW,OAAO,YAAY,CAAC,GAAG;AACrF,MAAI,OAAO,KAAM,OAAM,KAAK,SAAS,WAAW,OAAO,KAAK,CAAC,GAAG;AAChE,MAAI,SAAU,OAAM,KAAK,UAAU,SAAS,GAAG;AAC/C,SAAO,WAAW,MAAM,KAAK,IAAI,CAAC;;AAEpC,KAAI,cAAc,QAAQ;EACxB,MAAM,QAAkB,EAAE;AAC1B,MAAI,OAAO,KAAM,OAAM,KAAK,SAAS,WAAW,OAAO,KAAK,CAAC,GAAG;AAChE,MAAI,SAAU,OAAM,KAAK,UAAU,SAAS,GAAG;EAC/C,MAAM,UACJ,OAAO,OAAO,aAAa,WAAW,OAAO,WAAW,KAAK,UAAU,OAAO,SAAS;AACzF,SAAO,UAAU,MAAM,SAAS,IAAI,MAAM,KAAK,IAAI,KAAK,GAAG,GAAG,QAAQ;;AAExE,QAAO;;AAGT,SAAgB,kBACd,UACA,UAC4D;AAC5D,QAAO;EACL,UAAU,SAAS,KAChB,OAAO,QAAQ,CACf,KAAK,MAAM,cAAc,EAAE,CAAC,CAC5B,KAAK,KAAK;EACb,UAAU,SAAS,MAChB,OAAO,QAAQ,CACf,KAAK,MAAM,cAAc,EAAE,CAAC,CAC5B,KAAK,KAAK;EACb,YAAY,SAAS,QAClB,OAAO,QAAQ,CACf,KAAK,MAAM,gBAAgB,GAAG,SAAS,CAAC,CACxC,KAAK,KAAK;EACd"}

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "everything-dev",
-  "version": "1.49.0",
+  "version": "1.51.0",
   "type": "module",
+  "engines": {
+    "node": ">=20.11"
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -137,7 +140,7 @@
     "dotenv": "^17.3.1",
     "effect": "^3.21.0",
     "execa": "^9.5.2",
-    "every-plugin": "^2.9.1",
+    "every-plugin": "^2.9.2",
     "glob": "^13.0.6",
     "gradient-string": "^3.0.0",
     "ink": "^6.8.0",

package/skills/api-and-auth/SKILL.md

@@ -17,17 +17,22 @@ export default createPlugin.withPlugins<PluginsClient>()({
   secrets: z.object({ /* typed env vars, defaults for dev */ }),
   context: z.object({ /* per-request context injected by host */ }),
   contract,
-  initialize: (config, plugins) => Effect.promise(async () => {
-    return { db, upvoteService, publisher, auth, plugins };
-  }),
-  shutdown: (services) => Effect.promise(async () => { /* cleanup */ }),
-  createRouter: (services, builder) => ({
+  initialize: (config, plugins, tools) =>
+    Effect.gen(function* () {
+      const registry = yield* tools.buildService(
+        RegistryTag,
+        RegistryLive.pipe(Layer.provide(DatabaseLive(config.secrets.API_DATABASE_URL))),
+      );
+      return { registry, publisher, auth: plugins.auth, plugins };
+    }),
+  shutdown: (deps) => Effect.promise(async () => { /* cleanup */ }),
+  createRouter: (deps, builder) => ({
     ping: builder.ping.handler(async () => ({ status: "ok", timestamp })),
   }),
 });
 ```
 
-Fields: `variables` (public config), `secrets` (private env), `context` (per-request host context), `contract` (oRPC router), `initialize` (startup, returns services), `createRouter` (maps procedures to handlers), `shutdown` (cleanup). `plugins` in `initialize` gives typed factories for all other plugins.
+Fields: `variables` (public config), `secrets` (private env), `context` (per-request host context), `contract` (oRPC router), `initialize` (startup, returns services; third arg `tools` for scoped resources), `createRouter` (maps procedures to handlers), `shutdown` (cleanup). `plugins` in `initialize` gives typed factories for all other plugins. Use `tools.buildService(tag, layer)` for DB-backed services, caches, and other scoped resources.
 
 ## oRPC Contract Design
 
@@ -193,10 +198,11 @@ export function buildPluginContext(c) {
 The API plugin receives `auth` in `initialize`:
 
 ```ts
-initialize: (config, plugins) => Effect.promise(async () => {
-  const { auth, ...restPlugins } = plugins;
-  return { auth, plugins: restPlugins, ... };
-})
+initialize: (config, plugins, _tools) =>
+  Effect.gen(function* () {
+    const { auth, ...restPlugins } = plugins;
+    return { auth, plugins: restPlugins, ... };
+  })
 ```
 
 Use `getAuthClient()` for in-process calls:
@@ -279,11 +285,12 @@ const baseApi = await loadPluginEntry(runtime, apiEntry, integrityRegistry, plug
 The API plugin receives `plugins` in `initialize`:
 
 ```ts
-initialize: (config, plugins) => Effect.promise(async () => {
-  const authClient = plugins.auth({ reqHeaders: someHeaders });
-  const session = await authClient.getSession();
-  return { auth: plugins.auth, plugins, ... };
-})
+initialize: (config, plugins, _tools) =>
+  Effect.gen(function* () {
+    const authClient = plugins.auth({ reqHeaders: someHeaders });
+    const session = await authClient.getSession();
+    return { auth: plugins.auth, plugins, ... };
+  })
 ```
 
 ### API-Owned Registry Pattern
@@ -309,7 +316,22 @@ import { runEffect } from "@/lib/context";
 const result = await runEffect(services.myService.doSomething(input));
 ```
 
-Best practices: Keep service interfaces Effect-native, bridge to async only at the handler boundary via `runEffect()`. Use `Context.Tag` for DI between services. Initialize long-lived resources in `initialize` and return them as services.
+Best practices: Keep service interfaces Effect-native, bridge to async only at the handler boundary via `runEffect()`. Use `Context.Tag` for DI between services.
+
+**Scoped resources** — For DB pools, caches, publishers, or any resource that must live for the plugin's lifetime, build them inside `initialize` using `tools.buildService(tag, layer)`. This binds the resource to the plugin lifecycle scope — it persists until plugin shutdown and is automatically released.
+
+```ts
+initialize: (config, plugins, tools) =>
+  Effect.gen(function* () {
+    const repo = yield* tools.buildService(
+      MyRepoTag,
+      MyRepoLive.pipe(Layer.provide(DatabaseLive(config.secrets.MY_DATABASE_URL))),
+    );
+    return { repo, plugins };
+  }),
+```
+
+Do **not** use `Effect.provide(Tag, Layer.scoped(...))` inside `initialize` for long-lived resources — it creates a transient scope that closes immediately. `tools.buildService(...)` uses the plugin's lifecycle scope instead.
 
 ### SSR Proxy Client
 

package/skills/cli-reference/SKILL.md

@@ -155,15 +155,16 @@ bos deploy --service my-railway   # override Railway service name
 
 → [`publish-sync`](.) skill and [`super-app`](.) for tenant-aware deploy considerations.
 
-### `bos key publish`
+### `bos key generate`
 
 Generate a publish access key (NEAR function-call key) scoped to the FastKV registry contract.
+If existing publish keys are found on the account, you will be prompted to remove them.
 
-**Flags:** `--allowance <amount>` (default: `0.25NEAR`)
+**Flags:** `--allowance <amount>` (default: `1NEAR`)
 
 ```bash
-bos key publish                    # generate key with default allowance
-bos key publish --allowance 1NEAR  # custom allowance
+bos key generate                    # generate key with default allowance
+bos key generate --allowance 2NEAR  # custom allowance
 ```
 
 Outputs the public key, private key, and registry contract address. The generated key can only call the set and get methods on the BOS registry contract — it cannot transfer funds or call other contracts.

package/skills/dev-workflow/SKILL.md

@@ -2,7 +2,7 @@
 name: dev-workflow
 description: Development workflow for everything-dev projects using bos dev, bos start, and the Module Federation runtime. Use when starting dev servers, debugging hot reload, or understanding the service-descriptor architecture.
 metadata:
-  sources: "packages/everything-dev/src/service-descriptor.ts,packages/everything-dev/src/orchestrator.ts,packages/everything-dev/src/dev-logs.ts,packages/everything-dev/src/dev-session.ts"
+  sources: "packages/everything-dev/src/service-descriptor.ts,packages/everything-dev/src/orchestrator.ts,packages/everything-dev/src/dev-logs.ts,packages/everything-dev/src/dev-session.ts,packages/everything-dev/src/process-registry.ts,packages/everything-dev/src/app.ts"
 ---
 
 # everything-dev Development Workflow
@@ -17,12 +17,29 @@ bos dev
 bos dev --api remote     # UI only
 bos dev --ui remote      # API only
 bos dev                  # Full local (rarely needed)
+
+# Pin individual service ports (unset flags are picked automatically and persisted)
+bos dev --port 3100 --api-port 3101 --ui-port 3103 --auth-port 3102 --plugin-port-start 3110
 ```
 
+### Port persistence
+
+`bos dev` writes the resolved host/api/ui/auth/plugin-port-start values to `.bos/infra-state.json`
+under a `devPorts` key. Subsequent runs reuse the same ports unless you pass an explicit flag
+(or delete the file). This keeps CORS, browser bookmarks, and wallet-allowlisted origins stable
+across restarts.
+
+### Port budgets (forward-compat for `--workspaces`)
+
+`prepareDevelopmentRuntimeConfig` accepts an optional `portBudget: { min, max }`. When set,
+`pickAvailablePort` skips candidates outside the budget and throws `RangeError` if no free port
+is found inside it. The standalone `bos dev` path does not pass a budget today; a future
+`bos dev --workspaces` orchestrator will slice disjoint budgets per child project.
+
 ## Port Assignments
 
-| Service | Port | URL |
-|---------|------|-----|
+| Service | Default | URL |
+|---------|---------|-----|
 | host | 3000 | http://localhost:3000 |
 | api | 3001 | http://localhost:3001 |
 | auth | 3002 | http://localhost:3002 |
@@ -118,13 +135,16 @@ lsof -i :3003             # Check what is using port 3003
 
 Kill the conflicting process and retry, or stop the existing `bos dev` session first.
 
-### Stale PID file
+### Stale PID registry
 
-If `bos kill` doesn't run cleanly (e.g., terminal was closed), stale PIDs in `.bos/pids.json` can block restart:
+If `bos kill` doesn't run cleanly (e.g., terminal was closed), stale entries can linger in the
+global registry at `~/.cache/everything-dev/pids.json`. `bos ps` and `bos kill` always prune
+ESRCH (dead) PIDs on read, so stale entries don't block restart — but you can wipe the file
+manually if you want a clean slate:
 
 ```bash
-rm .bos/pids.json         # Clear stale PID tracking
-bos dev                   # Start fresh
+rm ~/.cache/everything-dev/pids.json   # Clear global registry
+bos dev                                # Start fresh
 ```
 
 ### API not responding
@@ -157,9 +177,18 @@ bos start --account foo.near --domain bar.com # Load specific config
 ## Process Management
 
 ```bash
-bos ps              # Show PID, name, port, started time
-bos kill            # Graceful SIGTERM → SIGKILL
-bos kill --force    # Immediate SIGKILL
+bos ps                       # List tracked development processes (cwd's entries, with role/ports)
+bos kill                     # SIGTERM processes owned by cwd
+bos kill --all               # SIGTERM across all config directories
+bos kill --signal SIGKILL    # Force kill (cwd)
+bos kill --config-dir /path  # Target a specific project
 ```
 
-Process tracking uses `.bos/pids.json`.
+The registry lives at `~/.cache/everything-dev/pids.json`, keyed by `pid`. Each entry stores
+`configDir`, `role` (`standalone` today; `workspace-parent`/`workspace-child` reserved for the
+planned `bos dev --workspaces` orchestrator), `ports`, optional `budget`, `startedAt`, and
+`description`. `bos dev` registers on startup and unregisters on graceful shutdown; the
+`BOS_WORKSPACE_CHILD=1` env var suppresses standalone registration so a future parent
+orchestrator owns registry entries.
+
+Process tracking uses `~/.cache/everything-dev/pids.json` (global, atomic writes).

package/skills/plugin-development/SKILL.md

@@ -159,20 +159,23 @@ export default createPlugin.withPlugins<PluginsClient>()({
 
   contract,
 
-  initialize: (config) =>
+  initialize: (config, _plugins, tools) =>
     Effect.gen(function* () {
       const service = new TemplateService(config.variables.baseUrl, config.secrets.apiKey, config.variables.timeout);
       yield* service.ping(); // health check on startup
 
       const publisher = new MemoryPublisher({ resumeRetentionSeconds: 120 });
 
+      // For scoped resources (DB pools, caches, repositories):
+      // const repo = yield* tools.buildService(MyRepoTag, MyRepoLive.pipe(...))
+
       return { service, publisher };
     }),
 
   shutdown: () => Effect.void,
 
-  createRouter: (context, builder) => {
-    const { service, publisher } = context;
+  createRouter: (deps, builder) => {
+    const { service, publisher } = deps;
     const requireAuth = builder.middleware(async ({ context, next }) => {
       if (!context.userId) throw new ORPCError("UNAUTHORIZED", { message: "User ID required" });
       return next({ context: { ...context, userId: context.userId } });
@@ -236,7 +239,8 @@ Good practice:
 **`variables`** — Public config exposed in `bos.config.json` (typed, with defaults).  
 **`secrets`** — Private values from `process.env` (typed, dev defaults).  
 **`context`** — Per-request context injected by the host. See "Request Context Reference" below for all available fields.  
-**`initialize`** — Effect-based startup. Create services, publishers, DB connections. Return value is passed as `context` to `createRouter`.  
+**`initialize`** — Effect-based startup. Create services, publishers, DB connections. Receives an optional third argument `tools` for building scoped resources. Return value is passed as `deps` to `createRouter`.  
+**`tools`** — Framework-provided third argument in `initialize(config, plugins, tools)`. Use `tools.buildService(tag, layer)` to build scoped resources (DB pools, caches, repositories) that live for the plugin's lifetime.  
 **`createRouter`** — Maps contract procedures to handlers. Receives the value returned by `initialize` plus a pre-configured `builder`.
 
 ## Request Context Reference
@@ -418,7 +422,10 @@ export function DatabaseLive(url: string) {
 1. Create `drizzle.config.ts` in your plugin directory
 2. Run `drizzle-kit generate` to produce SQL migration files
 3. Store migrations in `src/db/migrations/`
-4. Use the custom `migrate()` function during `initialize`:
+4. Use the custom `migrate()` function during `initialize`. Pass an explicit
+   `storage` resolved from the workspace so the journal slug is reliable
+   under rspack/Module Federation bundling (the no-arg fallback reads
+   `npm_package_name`, which is unreliable in bundled remotes):
 
 ```ts
 initialize: (config) =>
@@ -427,8 +434,12 @@ initialize: (config) =>
     // Or load and apply migrations directly:
     const { loadMigrations } = yield* Effect.promise(() => import("./db/load-migrations"));
     const { migrate } = yield* Effect.promise(() => import("./db/migrator"));
+    const { getMigrationSlug, getMigrationStorage } = yield* Effect.promise(
+      () => import("everything-dev/db"),
+    );
+    const storage = getMigrationStorage(getMigrationSlug(import.meta.dirname));
     const migrations = yield* loadMigrations();
-    yield* migrate(driver.db, migrations);
+    yield* migrate(driver.db, migrations, storage);
 
     return { db: driver.db, ... };
   }),