everything-dev 1.53.1 → 2.0.0-rc.0

package/dist/cli/init.cjs

@@ -2,32 +2,117 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_auth_types_gen = require('../auth-types-gen.cjs');
 const require_http_client = require('../http-client.cjs');
 const require_fastkv = require('../fastkv.cjs');
+const require_config = require('../config.cjs');
+const require_serialize = require('../descriptor/serialize.cjs');
+const require_workspace_catalog = require('../workspace-catalog.cjs');
 const require_manifest_normalizer = require('../internal/manifest-normalizer.cjs');
 const require_save_config = require('../utils/save-config.cjs');
+const require_snapshot_hash = require('../utils/snapshot-hash.cjs');
 const require_snapshot = require('./snapshot.cjs');
 const require_helpers = require('./utils/helpers.cjs');
+const require_docker = require('../infra/docker.cjs');
+const require_resolution_session = require('../resolution/session.cjs');
 let node_fs = require("node:fs");
 let node_path = require("node:path");
-let node_crypto = require("node:crypto");
 let node_os = require("node:os");
-let execa = require("execa");
-let node_module = require("node:module");
 let node_stream_promises = require("node:stream/promises");
+let execa = require("execa");
 let glob = require("glob");
+let tar = require("tar");
+let yaml = require("yaml");
 
 //#region src/cli/init.ts
-const require$1 = (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href);
+const PNPM_PACKAGE_MANAGER = "pnpm@12.10.1";
+/**
+* Transitive-singleton overrides every workspace in the fleet must agree on
+* (ticket 05's deviation log: isolated resolution splits better-auth
+* peer-context identities across the plugin fleet). Values derive from the
+* catalog so sync keeps them current; keys absent from the catalog are left
+* unpinned.
+*/
+const CHILD_OVERRIDE_KEYS = [
+	"@better-fetch/fetch",
+	"@rspack/core",
+	"better-auth",
+	"react",
+	"react-dom"
+];
+/**
+* The child's workspace manifest: pnpm-workspace.yaml is canonical (v2, ADR
+* 0026) — packages globs synthesized from the child's override sections, the
+* catalog merged over any local entry, plus the fleet-wide linker posture and
+* singleton overrides. Re-running (sync/upgrade) merges instead of clobbering.
+*/
+function writeChildWorkspaceYaml(projectDir, next) {
+	const yamlPath = (0, node_path.join)(projectDir, "pnpm-workspace.yaml");
+	let doc = {};
+	if ((0, node_fs.existsSync)(yamlPath)) try {
+		const parsed = (0, yaml.parse)((0, node_fs.readFileSync)(yamlPath, "utf-8"));
+		if (parsed && typeof parsed === "object") doc = parsed;
+	} catch {
+		doc = {};
+	}
+	let changed = !(0, node_fs.existsSync)(yamlPath);
+	const packages = [.../* @__PURE__ */ new Set([...doc.packages ?? [], ...next.packages])].sort();
+	if (JSON.stringify(packages) !== JSON.stringify(doc.packages)) {
+		doc.packages = packages;
+		changed = true;
+	}
+	const catalog = { ...doc.catalog ?? {} };
+	for (const [name, version] of Object.entries(next.catalog)) if (catalog[name] !== version) {
+		catalog[name] = version;
+		changed = true;
+	}
+	if (Object.keys(catalog).length > 0 && Object.keys(catalog).length !== Object.keys(doc.catalog ?? {}).length) changed = true;
+	if (changed || !doc.catalog) doc.catalog = Object.fromEntries(Object.entries(catalog).sort(([a], [b]) => a.localeCompare(b)));
+	if (doc.nodeLinker !== "hoisted") {
+		doc.nodeLinker = "hoisted";
+		changed = true;
+	}
+	if (doc.linkWorkspacePackages !== true) {
+		doc.linkWorkspacePackages = true;
+		changed = true;
+	}
+	if (doc.ignoreScripts !== true) {
+		doc.ignoreScripts = true;
+		changed = true;
+	}
+	const overrides = { ...doc.overrides ?? {} };
+	for (const key of CHILD_OVERRIDE_KEYS) if (catalog[key] && overrides[key] !== catalog[key]) {
+		overrides[key] = catalog[key];
+		changed = true;
+	}
+	if (Object.keys(overrides).length > 0) doc.overrides = Object.fromEntries(Object.entries(overrides).sort(([a], [b]) => a.localeCompare(b)));
+	if (changed) {
+		(0, node_fs.writeFileSync)(yamlPath, `${(0, yaml.stringify)(doc, { lineWidth: 0 }).trimEnd()}\n`);
+		return true;
+	}
+	return false;
+}
+/**
+* Init must never reuse a lockfile left in the target (copied from a parent
+* checkout or left by a previous run) — stale framework resolutions would
+* survive the fresh install. Bun's bun.lock is deleted on sight (ADR 0026's
+* silent-revert footgun); the child's own pnpm-lock.yaml is re-resolved.
+*/
+function removeStrayLockfiles(projectDir) {
+	for (const lockfile of ["pnpm-lock.yaml", "bun.lock"]) {
+		const lockfilePath = (0, node_path.join)(projectDir, lockfile);
+		if ((0, node_fs.existsSync)(lockfilePath)) (0, node_fs.rmSync)(lockfilePath, { force: true });
+	}
+}
 const INIT_ROOT_PATTERNS = [
 	"bos.config.json",
 	"package.json",
 	".env.example",
 	".gitignore",
 	"biome.json",
-	"bunfig.toml",
-	"Dockerfile",
 	"railway.json",
 	"railway.toml",
 	"AGENTS.md",
+	".agents/skills/**",
+	"skills-lock.json",
+	"docs/agents/**",
 	".changeset/config.json",
 	".changeset/README.md",
 	"README.md",
@@ -41,75 +126,43 @@ const OVERRIDE_WORKSPACE_MAP = {
 	plugins: []
 };
 function readWorkspaceCatalog(sourceDir) {
-	const pkgPath = (0, node_path.join)(sourceDir, "package.json");
-	if (!(0, node_fs.existsSync)(pkgPath)) return {};
-	return { ...require_helpers.readJsonFile(pkgPath).workspaces?.catalog ?? {} };
+	return require_workspace_catalog.readWorkspaceCatalog(sourceDir);
 }
 async function resolveCatalogChainSource(opts) {
+	const entry = opts.sourceDir ? require_config.findConfigPath((0, node_path.resolve)(opts.sourceDir)) ?? (0, node_path.join)((0, node_path.resolve)(opts.sourceDir), "bos.config.json") : `bos://${opts.extendsAccount}/${opts.extendsGateway}`;
 	const catalogs = [];
 	const cleanups = [];
-	const extendsChain = [];
-	const visited = /* @__PURE__ */ new Set();
+	const resolvedRefs = [];
 	let repository;
-	let currentRef = `bos://${opts.extendsAccount}/${opts.extendsGateway}`;
-	let sourceDir = opts.sourceDir ? (0, node_path.resolve)(opts.sourceDir) : void 0;
-	let configPath = sourceDir ? (0, node_path.join)(sourceDir, "bos.config.json") : void 0;
 	try {
-		while (true) {
-			if (visited.has(currentRef)) throw new Error(`Circular extends detected while resolving catalog source: ${currentRef}`);
-			visited.add(currentRef);
-			extendsChain.push(currentRef);
-			let config;
-			let currentSourceDir = sourceDir;
-			let cleanup = async () => {};
-			if (configPath) {
-				config = require_helpers.readJsonFile(configPath);
-				currentSourceDir = (0, node_path.dirname)(configPath);
-			} else {
-				const parsed = require_helpers.parseBosRef(currentRef);
-				if (!parsed) break;
-				const sourceResult = await resolveSourceDir({
-					extendsAccount: parsed.account,
-					extendsGateway: parsed.gateway
-				});
-				config = sourceResult.parentConfig;
-				currentSourceDir = sourceResult.sourceDir || void 0;
-				cleanup = sourceResult.cleanup;
+		await require_resolution_session.walkExtendsChain(entry, {
+			env: "production",
+			collectCatalogs: true,
+			registerCleanup: (fn) => cleanups.push(fn),
+			visit: async (link) => {
+				resolvedRefs.unshift(link.ref.startsWith("bos://") ? link.ref : (0, node_path.join)(link.baseDir, (0, node_path.basename)(link.ref)));
+				catalogs.push(readWorkspaceCatalog(link.sourceDir ?? link.baseDir));
+				const repositoryValue = link.config.repository;
+				if (typeof repositoryValue === "string" && repository === void 0) repository = repositoryValue;
 			}
-			cleanups.push(cleanup);
-			catalogs.push(currentSourceDir ? readWorkspaceCatalog(currentSourceDir) : {});
-			if (typeof config.repository === "string") repository = config.repository;
-			const nextExtendsRef = require_helpers.getExtendsRef(config);
-			if (!nextExtendsRef) break;
-			if (nextExtendsRef.startsWith("bos://")) {
-				currentRef = nextExtendsRef;
-				sourceDir = void 0;
-				configPath = void 0;
-				continue;
-			}
-			if (!currentSourceDir) break;
-			const nextConfigPath = (0, node_path.resolve)(currentSourceDir, nextExtendsRef);
-			if (!(0, node_fs.existsSync)(nextConfigPath)) break;
-			currentRef = nextConfigPath;
-			sourceDir = (0, node_path.dirname)(nextConfigPath);
-			configPath = nextConfigPath;
-		}
+		});
 	} finally {
-		for (const cleanup of cleanups.reverse()) await cleanup();
+		for (const cleanup of [...cleanups].reverse()) await cleanup();
 	}
 	return {
-		catalog: Object.assign({}, ...catalogs.reverse()),
+		catalog: Object.assign({}, ...catalogs),
 		repository,
-		extendsChain
+		extendsChain: opts.sourceDir ? [`bos://${opts.extendsAccount}/${opts.extendsGateway}`, ...resolvedRefs.slice(1)] : resolvedRefs
 	};
 }
 async function resolveSourceDir(opts) {
 	if (opts.source) {
 		const sourceDir = (0, node_path.resolve)(opts.source);
-		if (!(0, node_fs.existsSync)((0, node_path.join)(sourceDir, "bos.config.json"))) throw new Error(`No bos.config.json found in source directory: ${sourceDir}`);
+		const configPath = require_config.findConfigPath(sourceDir);
+		if (!configPath) throw new Error(`No authored config (bos.app.ts or bos.config.json) found in source directory: ${sourceDir}`);
 		return {
 			sourceDir,
-			parentConfig: JSON.parse((0, node_fs.readFileSync)((0, node_path.join)(sourceDir, "bos.config.json"), "utf-8")),
+			parentConfig: require_config.isAppDescriptorPath(configPath) ? await require_config.loadAppDescriptorConfig(configPath) : JSON.parse((0, node_fs.readFileSync)(configPath, "utf-8")),
 			cleanup: async () => {}
 		};
 	}
@@ -141,7 +194,8 @@ function buildInitPatterns(overrides, plugins, pluginDirMap) {
 	const has = (section) => overrides.includes(section);
 	const patterns = [...INIT_ROOT_PATTERNS];
 	if (has("ui")) patterns.push("ui/**");
-	if (has("api")) patterns.push("api/**");
+	if (has("api")) patterns.push(API_TEMPLATE_PATTERN);
+	if (has("api") || has("host")) patterns.push(COMPOSE_TEMPLATE_PATTERN);
 	if (has("host")) patterns.push("host/**");
 	if (has("plugins")) for (const plugin of plugins ?? []) {
 		const dirName = pluginDirMap?.[plugin] ?? plugin;
@@ -149,6 +203,16 @@ function buildInitPatterns(overrides, plugins, pluginDirMap) {
 	}
 	return patterns;
 }
+/** api-override children get the slim generic shell, never the parent's domain API. */
+const API_TEMPLATE_PATTERN = ".github/templates/api/**";
+/** Child-sized compose (api + api-test databases) for local compute overrides. */
+const COMPOSE_TEMPLATE_PATTERN = ".github/templates/docker-compose.yml";
+function isApiTemplatePath(filePath) {
+	return filePath.startsWith(".github/templates/api/");
+}
+function isComposeTemplatePath(filePath) {
+	return filePath === COMPOSE_TEMPLATE_PATTERN;
+}
 function buildPluginRouteExclusions(parentConfig, selectedPlugins) {
 	if (!parentConfig?.plugins) return [];
 	const selected = new Set(selectedPlugins);
@@ -162,6 +226,54 @@ function buildPluginRouteExclusions(parentConfig, selectedPlugins) {
 	}
 	return claimedByUnselected.filter((route) => !claimedBySelected.has(route));
 }
+const STARTER_PRODUCT_EXCLUSIONS = [
+	"_public/explore.tsx",
+	"_public/stake.tsx",
+	"_public/n/**",
+	"_public/$accountId.tsx",
+	"_public/$accountId/**",
+	"_public/activity/**",
+	"_public/-stake-*",
+	"_authenticated/_dashboard/dashboard/node/**",
+	"_authenticated/_dashboard/nodes/**",
+	"_authenticated/_dashboard/tenant.*",
+	"_authenticated/_dashboard/discover.tsx",
+	"_authenticated/_dashboard/apply.tsx",
+	"_authenticated/_dashboard/prototype-staking-poc.tsx",
+	"_authenticated/onboarding/**",
+	"_admin/_dashboard/_dashboard/admin/nodes/**",
+	"_admin/_dashboard/_dashboard/admin/proposals/**",
+	"_admin/_dashboard/_dashboard/admin/tenants/**",
+	"_admin/_dashboard/_dashboard/admin/relayer.tsx",
+	"_admin/_dashboard/_dashboard/admin/organizations.tsx"
+];
+const STARTER_SIMPLE_EXCLUSIONS = [
+	"_authenticated.tsx",
+	"_authenticated/**",
+	"_admin.tsx",
+	"_admin/**"
+];
+/**
+* Route-file globs (relative to the child's `ui/src/routes/`) that a starter
+* of the given level must not receive. Parent `starter` config can add
+* exclusions (`exclude`, `levels[level].exclude`) or reclaim routes for a
+* level (`levels[level].include`). Entries are prefixed with
+* `ui/src/routes/` so they compose with `copyFilteredFiles`'s ignore list.
+*/
+function buildStarterRouteExclusions(level, parentConfig) {
+	const excluded = /* @__PURE__ */ new Set([...STARTER_PRODUCT_EXCLUSIONS]);
+	if (level === "simple") for (const entry of STARTER_SIMPLE_EXCLUSIONS) excluded.add(entry);
+	const starter = parentConfig?.starter;
+	if (starter) {
+		for (const entry of starter.exclude ?? []) excluded.add(entry);
+		const levelConfig = starter.levels?.[level];
+		if (levelConfig) {
+			for (const entry of levelConfig.exclude ?? []) excluded.add(entry);
+			for (const entry of levelConfig.include ?? []) excluded.delete(entry);
+		}
+	}
+	return [...excluded].map((entry) => `ui/src/routes/${entry}`);
+}
 function extractPluginRoutes(entry) {
 	if (typeof entry !== "object" || entry === null) return void 0;
 	const routes = entry.routes;
@@ -169,10 +281,13 @@ function extractPluginRoutes(entry) {
 	return routes.filter((r) => typeof r === "string");
 }
 function sourcePathToDestinationPath(filePath) {
+	if (isApiTemplatePath(filePath)) return filePath.replace(/^\.github\/templates\/api\//, "api/");
+	if (isComposeTemplatePath(filePath)) return "docker-compose.yml";
 	return filePath.startsWith(".github/templates/") ? filePath.replace(/^\.github\/templates\//, ".github/") : filePath;
 }
 async function fetchParentConfig(extendsAccount, extendsGateway) {
-	return require_fastkv.fetchBosConfigFromFastKv(`bos://${extendsAccount}/${extendsGateway}`);
+	const bosUrl = `bos://${extendsAccount}/${extendsGateway}`;
+	return require_fastkv.fetchBosConfigFromFastKv(bosUrl);
 }
 async function resolveRepositoryViaExtendsChain(extendsAccount, extendsGateway, visited = /* @__PURE__ */ new Set()) {
 	const key = `bos://${extendsAccount}/${extendsGateway}`;
@@ -186,7 +301,8 @@ async function resolveRepositoryViaExtendsChain(extendsAccount, extendsGateway,
 		};
 		const extendsRef = require_helpers.getExtendsRef(config);
 		if (extendsRef) {
-			const parsed = require_helpers.parseBosRef(extendsRef.startsWith("bos://") ? extendsRef : `bos://${extendsRef}`);
+			const normalized = extendsRef.startsWith("bos://") ? extendsRef : `bos://${extendsRef}`;
+			const parsed = require_helpers.parseBosRef(normalized);
 			if (parsed) {
 				const result = await resolveRepositoryViaExtendsChain(parsed.account, parsed.gateway, visited);
 				if (result) return result;
@@ -247,7 +363,7 @@ async function downloadTarball(repoUrl) {
 	await (0, node_stream_promises.pipeline)(reader, fileStream);
 	const extractDir = mkTmpDir("bos-init-extract-");
 	try {
-		await require$1("tar").extract({
+		await (0, tar.extract)({
 			cwd: extractDir,
 			file: tarballPath,
 			strip: 1
@@ -277,12 +393,12 @@ async function downloadTarball(repoUrl) {
 }
 function parseGitHubUrl(url) {
 	const httpsMatch = url.match(/^https?:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?(?:\/.*)?$/);
-	if (httpsMatch) return {
+	if (httpsMatch?.[1] && httpsMatch[2]) return {
 		owner: httpsMatch[1],
 		repo: httpsMatch[2]
 	};
 	const sshMatch = url.match(/^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/);
-	if (sshMatch) return {
+	if (sshMatch?.[1] && sshMatch[2]) return {
 		owner: sshMatch[1],
 		repo: sshMatch[2]
 	};
@@ -308,14 +424,22 @@ async function copyFilteredFiles(sourceDir, destination, patterns, options) {
 		});
 		for (const match of matches) allFiles.add(match);
 	}
+	if (!options.overrides.includes("api")) {
+		for (const match of allFiles) if (isApiTemplatePath(match)) allFiles.delete(match);
+	}
+	if (!options.overrides.includes("api") && !options.overrides.includes("host")) {
+		for (const match of allFiles) if (isComposeTemplatePath(match)) allFiles.delete(match);
+	}
 	(0, node_fs.mkdirSync)(destination, { recursive: true });
 	let count = 0;
 	for (const filePath of allFiles) {
 		const src = (0, node_path.join)(sourceDir, filePath);
 		if (!(0, node_fs.lstatSync)(src).isFile()) continue;
-		const dest = (0, node_path.join)(destination, sourcePathToDestinationPath(filePath));
+		const destPath = sourcePathToDestinationPath(filePath);
+		const dest = (0, node_path.join)(destination, destPath);
 		(0, node_fs.mkdirSync)((0, node_path.dirname)(dest), { recursive: true });
-		(0, node_fs.writeFileSync)(dest, (0, node_fs.readFileSync)(src));
+		const content = (0, node_fs.readFileSync)(src);
+		(0, node_fs.writeFileSync)(dest, content);
 		count++;
 	}
 	return count;
@@ -325,13 +449,52 @@ function stripProductionFields(entry) {
 	delete entry.integrity;
 	delete entry.ssr;
 	delete entry.ssrIntegrity;
+	delete entry.pin;
+}
+/**
+* Scaffold the authored config as the TS form: the personalized
+* bos.config.json materializes into an authored `bos.app.ts` descriptor and
+* the JSON copy is removed — publish/sync still canonicalize to JSON for
+* FastKV from the resolved config. Returns the config that was converted, so
+* callers that need it (before the child has node_modules to import the
+* descriptor) can pass it onward.
+*/
+async function convertChildConfigToAppForm(destination) {
+	const configPath = (0, node_path.join)(destination, "bos.config.json");
+	if (!(0, node_fs.existsSync)(configPath)) return null;
+	const config = JSON.parse((0, node_fs.readFileSync)(configPath, "utf-8"));
+	(0, node_fs.writeFileSync)((0, node_path.join)(destination, "bos.app.ts"), require_serialize.serializeAppDescriptorSource(config));
+	(0, node_fs.rmSync)(configPath);
+	return config;
+}
+/**
+* Scaffold the root dev-overlay starter (`bos.dev.ts`). Idempotent — never
+* overwrites an existing overlay. Dev overlays are merged child-wins over
+* the resolved config in development and are never published.
+*/
+function writeDevOverlayTemplate(destination, opts = {}) {
+	const overlayPath = (0, node_path.join)(destination, "bos.dev.ts");
+	if ((0, node_fs.existsSync)(overlayPath)) return;
+	const extendsLine = opts.extendsRef ? `\n// Inherited base: ${opts.extendsRef}\n` : "";
+	(0, node_fs.writeFileSync)(overlayPath, `import type { AppDescriptor } from "everything-dev/descriptor";
+${extendsLine}
+/**
+ * Development-only overlay for bos.app.ts — merged child-wins over the
+ * resolved config when the environment is development. Never published.
+ * Example: pin the auth attachment to a running dev server instead of
+ * letting the dev harness spawn it.
+ */
+export default {
+  // auth: { development: "http://localhost:3006" },
+} satisfies Partial<AppDescriptor>;
+`);
 }
 function buildRootTypecheckScript(sections) {
-	const commands = ["bun run types:gen"];
-	if (sections.ui) commands.push("if [ -d ui ]; then bun run --cwd ui typecheck; fi");
-	if (sections.api) commands.push("if [ -d api ]; then bun run --cwd api typecheck; fi");
-	if (sections.host) commands.push("if [ -d host ]; then bun run --cwd host typecheck; fi");
-	if (sections.plugins) commands.push("if [ -d plugins ]; then for dir in plugins/*; do if [ -f \"$dir/package.json\" ]; then bun run --cwd \"$dir\" typecheck; fi; done; fi");
+	const commands = ["pnpm run types:gen"];
+	if (sections.ui) commands.push("if [ -d ui ]; then pnpm --dir ui run typecheck; fi");
+	if (sections.api) commands.push("if [ -d api ]; then pnpm --dir api run typecheck; fi");
+	if (sections.host) commands.push("if [ -d host ]; then pnpm --dir host run typecheck; fi");
+	if (sections.plugins) commands.push("if [ -d plugins ]; then for dir in plugins/*; do if [ -f \"$dir/package.json\" ]; then pnpm --dir \"$dir\" run typecheck; fi; done; fi");
 	return commands.join(" && ");
 }
 function getParentOnlyScriptKeys(projectDir) {
@@ -356,7 +519,7 @@ function buildChildRootScripts(sections) {
 		dev: "bos dev",
 		"dev:proxy": "bos dev --proxy",
 		build: "bos build",
-		deploy: "bos build --deploy",
+		deploy: "bos deploy",
 		publish: "bos publish",
 		start: "bos start",
 		typecheck: buildRootTypecheckScript(sections),
@@ -367,29 +530,28 @@ function buildChildRootScripts(sections) {
 		changeset: "changeset",
 		version: "changeset version",
 		release: "echo 'Packages versioned - app release handled by workflow'",
-		postinstall: "node node_modules/.bin/bos types gen || true",
-		"types:gen": "node node_modules/.bin/bos types gen",
+		"types:gen": "bos types gen",
 		bos: "bos"
 	};
 	if (sections.api) {
-		scripts["db:push"] = "bun run --cwd api drizzle-kit push";
+		scripts["db:push"] = "pnpm --dir api exec drizzle-kit push";
 		scripts["db:studio"] = "bos db:studio";
 		scripts["db:doctor"] = "bos db:doctor";
 		scripts["db:repair"] = "bos db:repair";
-		scripts["db:generate"] = "bun run --cwd api drizzle-kit generate";
-		scripts["db:migrate"] = "bun run --cwd api drizzle-kit migrate";
-		scripts["test:api"] = "bun run --cwd api test --if-present";
-		scripts["test:integration"] = "bun run --cwd api test tests/integration/ --if-present";
+		scripts["db:generate"] = "pnpm --dir api exec drizzle-kit generate";
+		scripts["db:migrate"] = "pnpm --dir api exec drizzle-kit migrate";
+		scripts["test:api"] = "pnpm --dir api run test --if-present";
+		scripts["test:integration"] = "pnpm --dir api run test tests/integration/ --if-present";
 	}
-	if (sections.host) scripts["test:e2e"] = "bun run --cwd host test --if-present";
+	if (sections.host) scripts["test:e2e"] = "pnpm --dir host run test --if-present";
 	const testTargets = [];
-	if (sections.api) testTargets.push("bun run --cwd api test --if-present");
-	if (sections.host) testTargets.push("bun run --cwd host test --if-present");
-	if (sections.ui) testTargets.push("bun run --cwd ui test --if-present");
-	if (sections.plugins) testTargets.push("for d in plugins/*; do [ -f \"$d/package.json\" ] && bun run --cwd \"$d\" test --if-present; done");
+	if (sections.api) testTargets.push("pnpm --dir api run test --if-present");
+	if (sections.host) testTargets.push("pnpm --dir host run test --if-present");
+	if (sections.ui) testTargets.push("pnpm --dir ui run test --if-present");
+	if (sections.plugins) testTargets.push("for d in plugins/*; do [ -f \"$d/package.json\" ] && pnpm --dir \"$d\" run test --if-present; done");
 	scripts.test = testTargets.length > 0 ? testTargets.join(" && ") : "echo \"No workspace directories configured\"";
 	if (sections.api || sections.host) {
-		scripts["dev:postgres"] = "docker compose up -d --wait && bun run dev";
+		scripts["dev:postgres"] = "docker compose up -d --wait && pnpm run dev";
 		scripts["dev:postgres:down"] = "docker compose down";
 		scripts["dev:postgres:reset"] = "docker compose down -v && docker compose up -d --wait";
 	}
@@ -400,6 +562,10 @@ function buildChildRootScripts(sections) {
 async function personalizeConfig(destination, opts) {
 	const has = (section) => opts.overrides.includes(section);
 	const preservedAuth = (opts.mode === "sync" && opts.existingConfig?.app && typeof opts.existingConfig.app === "object" ? opts.existingConfig.app : void 0)?.auth;
+	const applyStarter = (config) => {
+		if (opts.starter) config.starter = opts.starter;
+		else if (opts.mode !== "sync") delete config.starter;
+	};
 	const explicitRootKeys = new Set(Object.entries(opts).filter(([key, value]) => value !== void 0 && ![
 		"extendsAccount",
 		"extendsGateway",
@@ -410,6 +576,63 @@ async function personalizeConfig(destination, opts) {
 		"mode",
 		"existingConfig"
 	].includes(key)).map(([key]) => key));
+	const jsonConfigPath = (0, node_path.join)(destination, "bos.config.json");
+	const appConfigPath = (0, node_path.join)(destination, "bos.app.ts");
+	if (!(0, node_fs.existsSync)(jsonConfigPath) && (0, node_fs.existsSync)(appConfigPath)) {
+		const config = await require_config.loadAppDescriptorConfig(appConfigPath);
+		config.extends = `bos://${opts.extendsAccount}/${opts.extendsGateway}`;
+		if (opts.account) config.account = opts.account;
+		if (opts.domain) config.domain = opts.domain;
+		if (opts.repository) config.repository = opts.repository;
+		else delete config.repository;
+		for (const field of [
+			"title",
+			"description",
+			"testnet",
+			"staging"
+		]) if (!(field in opts)) delete config[field];
+		applyStarter(config);
+		if (config.app && typeof config.app === "object") {
+			const app = config.app;
+			for (const entryKey of Object.keys(app)) {
+				if (!has(entryKey) && (entryKey === "host" || entryKey === "ui" || entryKey === "api")) {
+					delete app[entryKey];
+					continue;
+				}
+				if (entryKey === "auth") {
+					delete app[entryKey];
+					continue;
+				}
+				const entry = app[entryKey];
+				if (entry && typeof entry === "object") stripProductionFields(entry);
+			}
+			if (preservedAuth !== void 0) app.auth = preservedAuth;
+			if (Object.keys(app).length === 0) delete config.app;
+		}
+		if (has("plugins")) {
+			if (config.plugins && typeof config.plugins === "object") {
+				const plugins = config.plugins;
+				if (opts.plugins !== void 0) {
+					for (const pluginKey of Object.keys(plugins)) if (!opts.plugins.includes(pluginKey)) delete plugins[pluginKey];
+				}
+				for (const pluginKey of Object.keys(plugins)) {
+					const plugin = plugins[pluginKey];
+					let pluginObj;
+					if (typeof plugin === "string") {
+						pluginObj = { extends: plugin };
+						plugins[pluginKey] = pluginObj;
+					} else if (plugin && typeof plugin === "object") {
+						pluginObj = { ...plugin };
+						plugins[pluginKey] = pluginObj;
+					} else continue;
+					stripProductionFields(pluginObj);
+				}
+				if (Object.keys(plugins).length === 0) config.plugins = {};
+			}
+		} else config.plugins = {};
+		(0, node_fs.writeFileSync)(appConfigPath, require_serialize.serializeAppDescriptorSource(config));
+		return;
+	}
 	const configPath = (0, node_path.join)(destination, "bos.config.json");
 	if ((0, node_fs.existsSync)(configPath)) {
 		const config = JSON.parse((0, node_fs.readFileSync)(configPath, "utf-8"));
@@ -424,6 +647,7 @@ async function personalizeConfig(destination, opts) {
 			"testnet",
 			"staging"
 		]) if (!(field in opts)) delete config[field];
+		applyStarter(config);
 		if (config.app && typeof config.app === "object") {
 			const app = config.app;
 			for (const entryKey of Object.keys(app)) {
@@ -498,30 +722,24 @@ async function personalizeConfig(destination, opts) {
 		if (typeof pkg.name !== "string" || pkg.name.length === 0) pkg.name = "monorepo";
 		pkg.private = true;
 		pkg.type = "module";
+		pkg.packageManager = PNPM_PACKAGE_MANAGER;
 		delete pkg.module;
 		delete pkg.peerDependencies;
-		if (pkg.workspaces && typeof pkg.workspaces === "object") {
-			const ws = pkg.workspaces;
-			if (Array.isArray(ws.packages)) {
-				ws.packages = ws.packages.filter((p) => {
-					if (p.startsWith("packages/")) return false;
-					if (p === "ui") return has("ui");
-					if (p === "api") return has("api");
-					if (p === "host") return has("host");
-					if (p.startsWith("plugins/")) return false;
-					return true;
-				});
-				if (has("plugins")) {
-					if (!ws.packages.includes("plugins/*")) ws.packages.push("plugins/*");
-				}
-			}
-		}
+		delete pkg.patchedDependencies;
+		const childWorkspaces = [];
+		if (has("host")) childWorkspaces.push("host");
+		if (has("ui")) childWorkspaces.push("ui");
+		if (has("api")) childWorkspaces.push("api");
+		if (has("plugins")) childWorkspaces.push("plugins/*");
+		const localCatalog = pkg.workspaces && typeof pkg.workspaces === "object" ? pkg.workspaces.catalog ?? {} : {};
+		delete pkg.workspaces;
 		if (!pkg.scripts || typeof pkg.scripts !== "object") pkg.scripts = {};
 		const scripts = pkg.scripts;
 		for (const [key, value] of Object.entries(childScripts)) scripts[key] = value;
 		for (const obsoleteScript of [
 			...getParentOnlyScriptKeys(destination),
 			"init",
+			"prepare",
 			"sync-catalog",
 			"db:push",
 			"db:studio",
@@ -544,28 +762,32 @@ async function personalizeConfig(destination, opts) {
 			delete deps["every-plugin"];
 			delete deps["everything-dev"];
 		}
-		if (!pkg.workspaces || typeof pkg.workspaces !== "object") pkg.workspaces = {
-			packages: [],
-			catalog: {}
+		const catalog = { ...localCatalog };
+		pkg.dependencies = {
+			"everything-dev": "catalog:",
+			"every-plugin": "catalog:"
 		};
-		const workspaces = pkg.workspaces;
-		if (!workspaces.catalog || typeof workspaces.catalog !== "object") workspaces.catalog = {};
-		if (!pkg.dependencies) pkg.dependencies = {};
 		const deps = pkg.dependencies;
 		const spec = opts.workspaceOpts?.sourceDir ? require_manifest_normalizer.loadManifestNormalizationSpec(opts.workspaceOpts.sourceDir) : null;
 		if (spec) {
-			workspaces.catalog["everything-dev"] = spec.rootCatalog["everything-dev"];
-			workspaces.catalog["every-plugin"] = spec.rootCatalog["every-plugin"];
+			const rootCatalogEverythingDev = spec.rootCatalog["everything-dev"];
+			const rootCatalogEveryPlugin = spec.rootCatalog["every-plugin"];
+			if (rootCatalogEverythingDev) catalog["everything-dev"] = rootCatalogEverythingDev;
+			if (rootCatalogEveryPlugin) catalog["every-plugin"] = rootCatalogEveryPlugin;
 		}
 		const frameworkCatalog = (await resolveCatalogChainSource({
 			extendsAccount: opts.extendsAccount,
 			extendsGateway: opts.extendsGateway,
 			sourceDir: opts.workspaceOpts?.sourceDir
 		})).catalog;
-		for (const [name, version] of Object.entries(frameworkCatalog)) workspaces.catalog[name] = version;
+		for (const [name, version] of Object.entries(frameworkCatalog)) catalog[name] = version;
 		if (!deps["everything-dev"]) deps["everything-dev"] = "catalog:";
 		if (!deps["every-plugin"]) deps["every-plugin"] = "catalog:";
 		(0, node_fs.writeFileSync)(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+		writeChildWorkspaceYaml(destination, {
+			packages: childWorkspaces,
+			catalog
+		});
 	}
 	const apiTsConfigPath = (0, node_path.join)(destination, "api", "tsconfig.json");
 	if ((0, node_fs.existsSync)(apiTsConfigPath)) {
@@ -586,12 +808,30 @@ async function personalizeConfig(destination, opts) {
 			(0, node_fs.mkdirSync)((0, node_path.dirname)(genContractPath), { recursive: true });
 			(0, node_fs.writeFileSync)(genContractPath, `export type ApiContract = Record<string, never>;\n`);
 		}
+		const publicDir = (0, node_path.join)(destination, "ui", "public");
+		if (!(0, node_fs.existsSync)(publicDir)) (0, node_fs.mkdirSync)(publicDir, { recursive: true });
+		const llmsTxtPath = (0, node_path.join)(publicDir, "llms.txt");
+		if (!(0, node_fs.existsSync)(llmsTxtPath)) {
+			const title = opts.title ?? opts.account ?? "app";
+			(0, node_fs.writeFileSync)(llmsTxtPath, buildChildLlmsTxt(title));
+		}
+		const skillMdPath = (0, node_path.join)(publicDir, "skill.md");
+		if (!(0, node_fs.existsSync)(skillMdPath)) {
+			const title = opts.title ?? opts.account ?? "app";
+			const repository = opts.repository ?? "";
+			(0, node_fs.writeFileSync)(skillMdPath, buildChildSkillMd(title, repository));
+		}
+		for (const agentFilePath of [llmsTxtPath, skillMdPath]) {
+			const content = (0, node_fs.readFileSync)(agentFilePath, "utf-8");
+			if (content.includes(WORKFLOW_SKILLS_MARKER)) continue;
+			(0, node_fs.writeFileSync)(agentFilePath, `${content.replace(/\n*$/, "\n")}${WORKFLOW_SKILLS_NOTE}`);
+		}
 	}
 	if (has("api")) {
 		const pluginsClientGenPath = (0, node_path.join)(destination, "api", "src", "lib", "plugins-types.gen.ts");
 		if (!(0, node_fs.existsSync)(pluginsClientGenPath)) {
 			(0, node_fs.mkdirSync)((0, node_path.dirname)(pluginsClientGenPath), { recursive: true });
-			(0, node_fs.writeFileSync)(pluginsClientGenPath, `import type { ContractRouterClient, AnyContractRouter } from "@orpc/contract";\ntype ClientFactory<C extends AnyContractRouter> = (context?: Record<string, unknown>) => ContractRouterClient<C>;\nexport type PluginsClient = Record<string, never>;\n`);
+			(0, node_fs.writeFileSync)(pluginsClientGenPath, `import type { RouterContractClient, RouterContract } from "@orpc/contract";\ntype ClientFactory<C extends RouterContract> = (context?: Record<string, unknown>) => RouterContractClient<C>;\nexport type PluginsClient = Record<string, never>;\n`);
 		}
 	}
 	const authTypesPaths = [];
@@ -600,7 +840,9 @@ async function personalizeConfig(destination, opts) {
 	if (has("host") && (0, node_fs.existsSync)((0, node_path.join)(destination, "host", "src"))) authTypesPaths.push((0, node_path.join)(destination, "host", "src", "lib", "auth-types.gen.ts"));
 	for (const authTypesGenPath of authTypesPaths) if (!(0, node_fs.existsSync)(authTypesGenPath)) {
 		(0, node_fs.mkdirSync)((0, node_path.dirname)(authTypesGenPath), { recursive: true });
-		(0, node_fs.writeFileSync)(authTypesGenPath, require_auth_types_gen.buildAuthTypesGenContent(toRelativeImportPath((0, node_path.join)(destination, ".bos", "generated", "auth", "auth-export.d.ts"), authTypesGenPath), toRelativeImportPath((0, node_path.join)(destination, ".bos", "generated", "auth", "contract.d.ts"), authTypesGenPath)));
+		const authExportRel = toRelativeImportPath((0, node_path.join)(destination, ".bos", "generated", "auth", "auth-export.d.ts"), authTypesGenPath);
+		const contractRel = toRelativeImportPath((0, node_path.join)(destination, ".bos", "generated", "auth", "contract.d.ts"), authTypesGenPath);
+		(0, node_fs.writeFileSync)(authTypesGenPath, require_auth_types_gen.buildAuthTypesGenContent(authExportRel, contractRel));
 	}
 	if (authTypesPaths.length > 0) {
 		const authDir = (0, node_path.join)(destination, ".bos", "generated", "auth");
@@ -623,11 +865,11 @@ function toRelativeImportPath(fromPath, toPath) {
 	const rel = (0, node_path.relative)((0, node_path.dirname)(toPath), fromPath);
 	return rel.startsWith(".") ? rel : `./${rel}`;
 }
-async function runBunInstall(destination, opts) {
-	await runWithProgress("bun", ["install", "--ignore-scripts"], destination, opts?.spinner, "Installing dependencies");
+async function runPnpmInstall(destination, opts) {
+	await runWithProgress("pnpm", ["install", "--ignore-scripts"], destination, opts?.spinner, "Installing dependencies");
 }
-async function runBunInstallForUpgrade(destination, opts) {
-	await runWithProgress("bun", ["install", "--force"], destination, opts?.spinner, "Installing dependencies");
+async function runPnpmInstallForUpgrade(destination, opts) {
+	await runWithProgress("pnpm", ["install", "--force"], destination, opts?.spinner, "Installing dependencies");
 }
 async function runTypesGen(destination, opts) {
 	const bosModule = (0, node_path.join)(destination, "node_modules", "everything-dev", "dist", "cli.mjs");
@@ -643,19 +885,12 @@ async function runTypesGen(destination, opts) {
 	}
 	throw new Error("Unable to locate bos CLI for types generation");
 }
-async function runDockerComposeUp(destination) {
-	await execCommand("docker", [
-		"compose",
-		"up",
-		"-d",
-		"--wait"
-	], destination, { stdio: "inherit" });
-}
 async function runWithProgress(command, args, cwd, spinner, label) {
+	const timeout = COMMAND_TIMEOUTS[command] ?? 12e4;
 	const child = (0, execa.execa)(command, args, {
 		cwd,
 		stdio: "inherit",
-		timeout: COMMAND_TIMEOUTS[command] ?? 2 * 6e4,
+		timeout,
 		env: {
 			...process.env,
 			BOS_NO_BANNER: "1"
@@ -674,33 +909,6 @@ async function runWithProgress(command, args, cwd, spinner, label) {
 		}
 	} else await child;
 }
-function stripOrphanedWorkspacesFromLockfile(lockfilePath, allowedWorkspaces) {
-	if (!(0, node_fs.existsSync)(lockfilePath)) return;
-	const content = (0, node_fs.readFileSync)(lockfilePath, "utf-8");
-	let lockfile;
-	try {
-		lockfile = JSON.parse(content);
-	} catch {
-		return;
-	}
-	const workspaces = lockfile.workspaces;
-	if (!workspaces || typeof workspaces !== "object") return;
-	const workspaceMap = workspaces;
-	const allowed = /* @__PURE__ */ new Set(["", ...allowedWorkspaces]);
-	const keys = Object.keys(workspaceMap);
-	let changed = false;
-	for (const key of keys) {
-		if (allowed.has(key)) continue;
-		if (allowedWorkspaces.some((pattern) => pattern.endsWith("/*") && key.startsWith(pattern.slice(0, -1)))) continue;
-		delete workspaceMap[key];
-		changed = true;
-	}
-	if (changed) (0, node_fs.writeFileSync)(lockfilePath, `${JSON.stringify(lockfile, null, 2)}\n`);
-}
-function removeInitLockfile(lockfilePath) {
-	if (!(0, node_fs.existsSync)(lockfilePath)) return;
-	(0, node_fs.rmSync)(lockfilePath, { force: true });
-}
 async function scaffoldMinimalProject(destination, parentConfig, opts) {
 	(0, node_fs.mkdirSync)(destination, { recursive: true });
 	const has = (section) => opts.overrides.includes(section);
@@ -710,7 +918,8 @@ async function scaffoldMinimalProject(destination, parentConfig, opts) {
 		...opts.domain ? { domain: opts.domain } : {},
 		...opts.repository ? { repository: opts.repository } : {},
 		...opts.title ? { title: opts.title } : {},
-		...opts.description ? { description: opts.description } : {}
+		...opts.description ? { description: opts.description } : {},
+		...opts.starter ? { starter: opts.starter } : {}
 	};
 	if (parentConfig.app && typeof parentConfig.app === "object") {
 		const app = {};
@@ -733,11 +942,13 @@ async function scaffoldMinimalProject(destination, parentConfig, opts) {
 		const plugins = {};
 		for (const key of opts.plugins) {
 			const parentPlugin = parentConfig.plugins?.[key];
-			if (parentPlugin) if (typeof parentPlugin === "string") plugins[key] = { extends: parentPlugin };
-			else {
-				const pluginCopy = { ...parentPlugin };
-				stripProductionFields(pluginCopy);
-				plugins[key] = pluginCopy;
+			if (parentPlugin) {
+				if (typeof parentPlugin === "string") plugins[key] = { extends: parentPlugin };
+				else {
+					const pluginCopy = { ...parentPlugin };
+					stripProductionFields(pluginCopy);
+					plugins[key] = pluginCopy;
+				}
 			}
 		}
 		config.plugins = plugins;
@@ -748,12 +959,14 @@ async function scaffoldMinimalProject(destination, parentConfig, opts) {
 	if (has("plugins")) workspacePackages.push("plugins/*");
 	const catalog = (await resolveCatalogChainSource({
 		extendsAccount: opts.extendsAccount,
-		extendsGateway: opts.extendsGateway
+		extendsGateway: opts.extendsGateway,
+		sourceDir: opts.catalogSourceDir
 	})).catalog;
 	const pkg = {
 		name: "monorepo",
 		private: true,
 		type: "module",
+		packageManager: PNPM_PACKAGE_MANAGER,
 		scripts: buildChildRootScripts({
 			ui: has("ui"),
 			api: has("api"),
@@ -764,13 +977,13 @@ async function scaffoldMinimalProject(destination, parentConfig, opts) {
 			"everything-dev": "catalog:",
 			"every-plugin": "catalog:"
 		},
-		devDependencies: {},
-		workspaces: {
-			packages: workspacePackages,
-			catalog
-		}
+		devDependencies: {}
 	};
 	(0, node_fs.writeFileSync)((0, node_path.join)(destination, "package.json"), `${JSON.stringify(pkg, null, 2)}\n`);
+	writeChildWorkspaceYaml(destination, {
+		packages: workspacePackages,
+		catalog
+	});
 	(0, node_fs.writeFileSync)((0, node_path.join)(destination, ".gitignore"), generateGitignore());
 	return 4;
 }
@@ -802,22 +1015,27 @@ async function writeInitSnapshot(destination, extendsAccount, extendsGateway, so
 		});
 		for (const match of matches) allFiles.add(match);
 	}
+	if (!options.overrides.includes("api")) {
+		for (const match of allFiles) if (isApiTemplatePath(match)) allFiles.delete(match);
+	}
+	if (!options.overrides.includes("api") && !options.overrides.includes("host")) {
+		for (const match of allFiles) if (isComposeTemplatePath(match)) allFiles.delete(match);
+	}
 	const fileHashes = {};
 	for (const filePath of allFiles) {
 		const src = (0, node_path.join)(sourceDir, filePath);
 		if (!(0, node_fs.lstatSync)(src).isFile()) continue;
-		const content = (0, node_fs.readFileSync)(src);
 		const destPath = sourcePathToDestinationPath(filePath);
-		fileHashes[destPath] = computeHash(content);
+		if (!(0, node_fs.existsSync)((0, node_path.join)(destination, destPath))) continue;
+		const content = (0, node_fs.readFileSync)(src);
+		fileHashes[destPath] = require_snapshot_hash.computeSnapshotHash(content);
 	}
 	await require_snapshot.writeSnapshot(destination, {
 		parentRef: `bos://${extendsAccount}/${extendsGateway}`,
-		files: fileHashes
+		files: fileHashes,
+		starter: options.starter
 	});
 }
-function computeHash(data) {
-	return (0, node_crypto.createHash)("sha256").update(data).digest("hex").substring(0, 16);
-}
 function mkTmpDir(prefix) {
 	return (0, node_fs.mkdtempSync)((0, node_path.join)((0, node_os.tmpdir)(), `${prefix}-`));
 }
@@ -834,17 +1052,23 @@ async function generateDatabaseMigrations(destination) {
 		const pkgPath = (0, node_path.join)(destination, workspaceDir, "package.json");
 		if (!(0, node_fs.existsSync)(pkgPath)) continue;
 		if (!JSON.parse((0, node_fs.readFileSync)(pkgPath, "utf-8")).scripts?.["db:generate"]) continue;
-		await execCommand("bun", ["run", "db:generate"], (0, node_path.join)(destination, workspaceDir));
+		await execCommand("pnpm", [
+			"--dir",
+			"api",
+			"exec",
+			"drizzle-kit",
+			"generate"
+		], (0, node_path.join)(destination, workspaceDir));
 	}
 }
 const COMMAND_TIMEOUTS = {
-	bun: 5 * 6e4,
-	docker: 5 * 6e4,
-	node_modules: 2 * 6e4,
+	pnpm: 3e5,
+	docker: 3e5,
+	node_modules: 12e4,
 	tar: 6e4
 };
 async function execCommand(command, args, cwd, options) {
-	const timeout = COMMAND_TIMEOUTS[command] ?? 2 * 6e4;
+	const timeout = COMMAND_TIMEOUTS[command] ?? 12e4;
 	await (0, execa.execa)(command, args, {
 		cwd,
 		stdio: options?.stdio ?? "pipe",
@@ -866,9 +1090,8 @@ This document provides operational guidance for AI agents working in this everyt
 
 **Start Development:**
 \`\`\`bash
-cp .env.example .env   # First time only
-bun install
-bun run dev
+pnpm install
+pnpm run dev
 \`\`\`
 
 **Check Status:**
@@ -876,7 +1099,51 @@ bun run dev
 bos ps        # List running processes
 bos status    # Project health check
 bos info      # Show configuration
-\`\`\``);
+\`\`\`
+
+**Deploy:**
+
+[![Deploy on Railway](https://railway.com/button.svg)](https://railway.com/deploy/everything-dev-template?referralCode=MuB_vg&utm_medium=integration&utm_source=template&utm_campaign=generic)
+
+The Railway template deploys the everything.dev Docker image. Set these variables:
+
+| Variable | Description | Example |
+|----------|-------------|---------|
+| \`BOS_ACCOUNT\` | The NEAR account that owns this app's published configuration on-chain | \`myapp.near\` |
+| \`BOS_GATEWAY\` | The core domain where this app is served | \`myapp.com\` |
+| \`BETTER_AUTH_SECRET\` | Secret for session encryption — generate with \`openssl rand -base64 32\` | (random) |
+
+**Self-deployed production:**
+
+You don't need to wait for a PR to merge and run through CI/CD. Publish your own config on-chain under your own NEAR account and run your own host instance, inheriting the base platform via \`extends\`.
+
+1. **Install near-cli-rs** (the \`bos\` CLI shells out to it for \`bos publish\` and \`bos key generate\`):
+   \`\`\`bash
+   curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/near-cli-rs/releases/download/v0.23.5/near-cli-rs-installer.sh | sh
+   \`\`\`
+2. **Create a NEAR account** (testnet or mainnet). Named accounts can own subaccounts; implicit hex accounts cannot:
+   \`\`\`bash
+   near account create-account fund-my-account <your-account>.testnet use-faucet network-config testnet
+   \`\`\`
+3. **Generate a publish key** — a function-call key scoped to the FastKV registry contract:
+   \`\`\`bash
+   bos key generate
+   # Output: NEAR_PRIVATE_KEY=ed25519:...
+   \`\`\`
+   Add the key to your account via near-cli-rs, then set \`NEAR_PRIVATE_KEY\` in \`.env\` or CI secrets.
+4. **Update \`bos.config.json\`** — set \`account\` to your NEAR account, add \`extends\` to inherit the base platform, keep \`domain\` as the gateway:
+   \`\`\`json
+   { "extends": "bos://<parent-account>/<parent-gateway>", "account": "<your-account>.near", "domain": "<parent-gateway>" }
+   \`\`\`
+ 5. **Publish and deploy:**
+    \`\`\`bash
+    bos deploy           # preflight → build → upload bundles → publish config to FastKV at bos://<your-account>/<gateway> → image/Railway when configured
+    \`\`\`
+6. **Deploy to Railway** (one-click template or \`railway up\`), set \`BOS_ACCOUNT\`, \`BOS_GATEWAY\` (same gateway as parent), and \`BETTER_AUTH_SECRET\`. Your Railway host fetches your config from FastKV and serves live.
+
+\`BOS_GATEWAY\` is the **FastKV lookup key**, not the DNS domain your Railway instance serves on. By keeping the same gateway while using your own \`BOS_ACCOUNT\`, your config lives at a separate FastKV path that \`extends\` the base runtime — you inherit the full platform and override only what you change.
+
+**Tenant creation** (for the admin wizard) is DAO-owned: connect a sputnik-dao account via the Trezu wallet in the admin wizard; the wizard publishes the tenant runtime config under \`bos://<dao-account>/<gateway>\`. No server-side subaccount keys are needed.`);
 	const archLines = ["This is an everything.dev child project. Depending on your overrides, it may include:"];
 	if (has("ui")) archLines.push("- **UI** — React 19 + TanStack Router frontend, loaded via Module Federation");
 	if (has("api")) archLines.push("- **API** — Hono.js + oRPC backend with Effect services");
@@ -887,9 +1154,9 @@ bos info      # Show configuration
 	parts.push(`## Development Workflow
 
 ### Starting Development
-1. \`cp .env.example .env\` (first time)
-2. \`bun install\`
-3. \`bun run dev\``);
+1. \`pnpm install\`
+2. \`pnpm run dev\`
+3. \`bos dev\` creates \`.env\` on first run and starts local Postgres via docker compose when it is down`);
 	parts.push(`### Debugging Issues
 
 **API not responding:**
@@ -902,7 +1169,7 @@ bos info      # Show configuration
 - Clear browser cache and retry
 
 **Type errors:**
-- Run \`bun run typecheck\``);
+- Run \`pnpm run typecheck\``);
 	const changeLines = ["### Making Changes"];
 	if (has("ui")) changeLines.push("- **UI Changes**: Edit `ui/src/` files → hot reload automatically");
 	if (has("api")) changeLines.push("- **API Changes**: Edit `api/src/` files → hot reload automatically");
@@ -935,14 +1202,14 @@ The API plugin receives typed client factories for all other plugins via \`creat
 
 ### Generated Types
 
-\`api/src/lib/plugins-types.gen.ts\`, \`api/src/lib/auth-types.gen.ts\`, \`ui/src/lib/api-types.gen.ts\`, and \`ui/src/lib/auth-types.gen.ts\` are generated by \`bos types gen\` from \`bos.config.json\`. These files are gitignored and auto-regenerated on \`bun install\`, \`typecheck\`, \`bos dev\`, \`bos build\`, and bos plugin management commands.
+\`api/src/lib/plugins-types.gen.ts\`, \`api/src/lib/auth-types.gen.ts\`, \`ui/src/lib/api-types.gen.ts\`, and \`ui/src/lib/auth-types.gen.ts\` are generated by \`bos types gen\` from \`bos.config.json\`. These files are gitignored and auto-regenerated on \`pnpm install\`, \`typecheck\`, \`bos dev\`, \`bos build\`, and bos plugin management commands.
 
 If you hand-edit \`bos.config.json\`, run \`bos types gen\` or restart \`bos dev\` to regenerate.`);
 	const testCommands = [];
 	if (has("api") || has("host") || has("ui")) {
-		testCommands.push("bun run test    # Run all tests");
-		testCommands.push("bun typecheck   # Type check all packages");
-		testCommands.push("bun lint        # Run linting");
+		testCommands.push("pnpm run test    # Run all tests");
+		testCommands.push("pnpm run typecheck   # Type check all packages");
+		testCommands.push("pnpm run lint        # Run linting");
 	}
 	if (testCommands.length > 0) parts.push(`## Testing & Quality
 
@@ -974,13 +1241,46 @@ function MyComponent() {
   const { data } = await apiClient.ping();
 }
 \`\`\``);
+	parts.push(`## Workflow Skills
+
+This repo ships agent workflow skills in \`.agents/skills/\` — the ordered development flow (grill → spec → tickets → implement/tdd → code-review). Start \`/everything-dev-app\` to orient and pick the right next step; \`/ask-matt\` is the router if unsure.
+
+- \`/grill-with-docs\` — sharpen an idea by interview, leaving a paper trail in \`GLOSSARY.md\` and ADRs
+- \`/to-spec\` / \`/to-tickets\` — turn a plan into a spec, then tracer-bullet tickets under \`.scratch/<feature>/issues/\`
+- \`/implement\` + \`/tdd\` — build a ticket test-first at pre-agreed seams
+- \`/code-review\` — two-axis review (Standards + Spec) of the diff since a fixed point
+- \`/diagnosing-bugs\` — diagnosis loop for hard bugs and performance regressions
+
+Run \`/setup-matt-pocock-skills\` once before first use. Tracker and triage conventions live in \`docs/agents/\`.`);
+	parts.push(`## Agent Communication Surface
+
+The host exposes several surfaces for programmatic agent access:
+
+| Surface | Endpoint | Auth | Use |
+|---------|----------|------|-----|
+| MCP | \`POST /api/mcp\` | \`x-api-key\` header or session cookie | MCP clients — auto-generated tools from OpenAPI spec, stateless Streamable HTTP transport |
+| REST/OpenAPI | \`GET/POST/... /api/{path}\` | \`x-api-key\` header or session cookie | Standard REST; Scalar docs at \`GET /api\`, spec at \`GET /api/spec.json\` |
+| oRPC RPC | \`POST /api/rpc/{procedure}\` | \`x-api-key\` header or session cookie | Typed JSON-RPC for all API procedures |
+| Plugin RPC | \`POST /api/rpc/{plugin}/{procedure}\` | \`x-api-key\` header or session cookie | Per-plugin RPC (e.g. \`/api/rpc/auth/getSession\`) |
+| MCP discovery | \`GET /.well-known/mcp.json\` | None | JSON descriptor with server name, endpoint, and auth scheme |
+
+### Authentication for agents
+
+1. Sign in with your NEAR wallet (SIWN) at the website.
+2. Navigate to **Settings → API Keys** at \`/settings/api-keys\`.
+3. Create a new key — the full secret (\`edk_...\`) is shown once. Copy it immediately.
+4. Pass it on every request: \`x-api-key: edk_your_key_here\`
+
+### Architecture note: remotes are code bundles
+
+Remotes in \`bos.config.json\` are **not hosted APIs** — they are code bundles loaded via Module Federation at runtime. The UI, API, auth, and plugins all run in the same host process. There is no remote server to call; everything is loaded in-process through Module Federation and \`every-plugin\`.`);
 	parts.push(`## Troubleshooting
 
 **Process won't start:**
 \`\`\`bash
 bos kill        # Kill all tracked processes
-bun install     # Ensure dependencies
-bun run dev     # Restart
+pnpm install    # Ensure dependencies
+pnpm run dev    # Restart
 \`\`\`
 
 **Module Federation errors:**
@@ -990,8 +1290,8 @@ bun run dev     # Restart
 
 **Database issues:**
 \`\`\`bash
-bun run db:push   # Push schema changes
-bun run db:studio # Open Drizzle Studio
+pnpm run db:push   # Push schema changes
+pnpm run db:studio # Open Drizzle Studio
 \`\`\`
 
 ## Environment
@@ -1009,7 +1309,8 @@ async function personalizeAgentsMd(destination, opts) {
 	if (!(0, node_fs.existsSync)(agentsMdPath)) return;
 	const skillsBlock = extractSkillsBlock((0, node_fs.readFileSync)(agentsMdPath, "utf-8"));
 	if (!skillsBlock) return;
-	(0, node_fs.writeFileSync)(agentsMdPath, buildChildAgentsMd(skillsBlock, opts));
+	const childContent = buildChildAgentsMd(skillsBlock, opts);
+	(0, node_fs.writeFileSync)(agentsMdPath, childContent);
 }
 function generateGitignore() {
 	return `node_modules/
@@ -1021,13 +1322,136 @@ docker-compose.yml
 *.gen.tsx
 `;
 }
+const WORKFLOW_SKILLS_MARKER = "everything-dev-app";
+const WORKFLOW_SKILLS_NOTE = `
+
+## Workflow skills
+
+This repo ships agent workflow skills in \`.agents/skills/\` — the ordered development flow (grill → spec → tickets → implement/tdd → code-review). Start with \`/everything-dev-app\` to orient and pick the right next step. See \`AGENTS.md\` → Workflow Skills.
+`;
+function buildChildLlmsTxt(title) {
+	return `# ${title}
+
+> Application running on the everything.dev runtime.
+
+## Skills
+
+- [Skill](/skill.md): Agent-ready prompt for talking to, running, editing, and publishing this runtime.
+- Workflow skills (in the repo): \`.agents/skills/\` — start with \`everything-dev-app\` for the ordered development flow.
+
+## API
+
+- [OpenAPI docs](/api): Interactive API reference (Scalar)
+- [OpenAPI spec](/api/spec.json): Machine-readable OpenAPI JSON
+- [oRPC RPC](/api/rpc): Typed JSON-RPC endpoint for all API procedures
+- [Plugin RPC](/api/rpc/auth): Auth plugin RPC (session, NEAR SIWN, relay, API keys, organizations)
+
+## MCP
+
+- [MCP server](/api/mcp): Model Context Protocol server (Streamable HTTP, stateless). Auto-generates tools from the API's OpenAPI spec.
+- [MCP discovery](/.well-known/mcp.json): JSON descriptor with server name, endpoint URL, and auth scheme.
+
+## Auth
+
+Authenticate to the API using an API key:
+
+1. Sign in with your NEAR wallet (SIWN) at the website.
+2. Go to **Settings → API Keys** at \`/settings/api-keys\`.
+3. Create a key — the full secret (\`edk_...\`) is shown once.
+4. Pass it on every request: \`x-api-key: edk_your_key_here\`
+
+The \`x-api-key\` header works for \`/api/*\` (REST), \`/api/rpc/*\` (oRPC), and \`/api/mcp\` (MCP).
+
+## Source
+
+- [Repository](https://github.com/NEARBuilders/everything-dev): Clone and read \`AGENTS.md\` for full development instructions, TanStack Intent skills, and workflow guidance.
+`;
+}
+function buildChildSkillMd(title, repository) {
+	return `# ${title} skill
+
+Use this when you want an agent to run, edit, and publish **${title}** — an everything.dev app composed at runtime from \`bos.config.json\`.
+
+There are two ways to work with this app:
+
+1. **Talk to the app** — use the API via MCP or REST to read/write data without cloning anything.
+2. **Clone and modify** — clone the repository, run locally, edit code, and publish.
+
+## Mode 1: Talk to the app
+
+### MCP endpoint
+
+\`\`\`
+POST /api/mcp
+\`\`\`
+
+Transport: Streamable HTTP (stateless). Connect your MCP client to \`{origin}/api/mcp\` to discover all available tools automatically.
+
+### Authentication
+
+Use an **API key**:
+
+1. Sign in with your NEAR wallet at the website (SIWN).
+2. Navigate to **Settings → API Keys** at \`/settings/api-keys\`.
+3. Create a key — the full secret (\`edk_...\`) is shown once.
+4. Pass it on every request: \`x-api-key: edk_your_key_here\`
+
+### REST / OpenAPI
+
+- **API docs**: \`GET /api\`
+- **OpenAPI spec**: \`GET /api/spec.json\`
+- **oRPC RPC**: \`POST /api/rpc/{procedure}\`
+- **MCP discovery**: \`GET /.well-known/mcp.json\`
+
+## Mode 2: Clone and modify
+
+### TanStack Intent
+
+- Registry entry: \`https://tanstack.com/intent/registry/everything-dev\`
+- Load with TanStack Intent: \`npx @tanstack/intent@latest load everything-dev\`
+
+### Read AGENTS.md first
+
+After cloning, read **\`AGENTS.md\`** at the repo root. It contains operational guidance, TanStack Intent skills, and workflow instructions.
+
+### Workflow skills
+
+The repo ships agent workflow skills in \`.agents/skills/\` — start with \`everything-dev-app\` for the ordered development flow (grill → spec → tickets → implement/tdd → code-review).
+
+### Architecture note
+
+Remotes in \`bos.config.json\` are **not hosted APIs** — they are code bundles loaded via Module Federation at runtime. Everything runs in the same host process.
+
+### Run locally
+
+\`\`\`bash
+pnpm install
+bos dev
+\`\`\`
+
+### Publish
+
+\`\`\`bash
+bos deploy
+\`\`\`
+
+## Source
+
+${repository ? `- [Repository](${repository}): Clone and read \`AGENTS.md\` for full development instructions.` : `- Clone the repository and read \`AGENTS.md\` for full development instructions.`}
+`;
+}
 
 //#endregion
 exports.INIT_ROOT_PATTERNS = INIT_ROOT_PATTERNS;
+exports.PNPM_PACKAGE_MANAGER = PNPM_PACKAGE_MANAGER;
 exports.buildChildAgentsMd = buildChildAgentsMd;
+exports.buildChildLlmsTxt = buildChildLlmsTxt;
 exports.buildChildRootScripts = buildChildRootScripts;
+exports.buildChildSkillMd = buildChildSkillMd;
 exports.buildInitPatterns = buildInitPatterns;
 exports.buildPluginRouteExclusions = buildPluginRouteExclusions;
+exports.buildStarterRouteExclusions = buildStarterRouteExclusions;
+exports.convertChildConfigToAppForm = convertChildConfigToAppForm;
 exports.copyFilteredFiles = copyFilteredFiles;
 exports.detectGitRemoteUrl = detectGitRemoteUrl;
 exports.downloadTarball = downloadTarball;
@@ -1036,18 +1460,22 @@ exports.extractSkillsBlock = extractSkillsBlock;
 exports.fetchParentConfig = fetchParentConfig;
 exports.generateDatabaseMigrations = generateDatabaseMigrations;
 exports.getParentOnlyScriptKeys = getParentOnlyScriptKeys;
+exports.isApiTemplatePath = isApiTemplatePath;
+exports.isComposeTemplatePath = isComposeTemplatePath;
 exports.personalizeAgentsMd = personalizeAgentsMd;
 exports.personalizeConfig = personalizeConfig;
-exports.removeInitLockfile = removeInitLockfile;
+exports.readWorkspaceCatalog = readWorkspaceCatalog;
+exports.removeStrayLockfiles = removeStrayLockfiles;
 exports.resolveCatalogChainSource = resolveCatalogChainSource;
 exports.resolveRepositoryViaExtendsChain = resolveRepositoryViaExtendsChain;
 exports.resolveSourceDir = resolveSourceDir;
-exports.runBunInstall = runBunInstall;
-exports.runBunInstallForUpgrade = runBunInstallForUpgrade;
-exports.runDockerComposeUp = runDockerComposeUp;
+exports.runDockerComposeUp = require_docker.runDockerComposeUp;
+exports.runPnpmInstall = runPnpmInstall;
+exports.runPnpmInstallForUpgrade = runPnpmInstallForUpgrade;
 exports.runTypesGen = runTypesGen;
 exports.scaffoldMinimalProject = scaffoldMinimalProject;
 exports.sourcePathToDestinationPath = sourcePathToDestinationPath;
-exports.stripOrphanedWorkspacesFromLockfile = stripOrphanedWorkspacesFromLockfile;
+exports.writeChildWorkspaceYaml = writeChildWorkspaceYaml;
+exports.writeDevOverlayTemplate = writeDevOverlayTemplate;
 exports.writeInitSnapshot = writeInitSnapshot;
 //# sourceMappingURL=init.cjs.map