everything-dev 1.53.2 → 2.0.0-rc.0

package/dist/infra/preflight.cjs

@@ -2,14 +2,22 @@ let effect = require("effect");
 let node_net = require("node:net");
 
 //#region src/infra/preflight.ts
+var PreflightConnectionError = class extends effect.Data.TaggedError("PreflightConnectionError") {
+	get message() {
+		return `Postgres connection failed: ${this.cause instanceof Error ? this.cause.message : String(this.cause)}`;
+	}
+};
+const scheduleTimeout = (ms, fn) => setTimeout(fn, ms);
 function parseLocalUrl(url) {
 	try {
-		const match = url.match(/:\/\/([^:/]+):(\d+)/);
-		if (!match) return null;
-		const host = match[1];
-		const port = Number.parseInt(match[2], 10);
-		if (Number.isNaN(port)) return null;
-		if (host !== "localhost" && host !== "127.0.0.1") return null;
+		const parsed = new URL(url);
+		const host = parsed.hostname;
+		if (host !== "localhost" && host !== "127.0.0.1" && host !== "::1") return null;
+		const port = Number.parseInt(parsed.port, 10);
+		if (Number.isNaN(port)) return {
+			host,
+			port: parsed.protocol === "redis:" ? 6379 : 5432
+		};
 		return {
 			host,
 			port
@@ -19,15 +27,15 @@ function parseLocalUrl(url) {
 	}
 }
 function checkTcpReachable(host, port, timeoutMs = 2e3) {
-	return effect.Effect.async((resume) => {
+	return effect.Effect.callback((resume) => {
 		const socket = (0, node_net.createConnection)({
 			host,
 			port
 		});
-		const timer = setTimeout(() => {
+		const timer = scheduleTimeout(timeoutMs, () => {
 			socket.destroy();
 			resume(effect.Effect.succeed(false));
-		}, timeoutMs);
+		});
 		socket.once("connect", () => {
 			clearTimeout(timer);
 			socket.destroy();
@@ -43,26 +51,27 @@ function checkTcpReachable(host, port, timeoutMs = 2e3) {
 function checkPgConnection(url) {
 	return effect.Effect.gen(function* () {
 		if (!(yield* checkTcpReachable(new URL(url).hostname, Number(new URL(url).port) || 5432, 4e3))) return false;
-		try {
-			const { Pool } = yield* effect.Effect.promise(() => import("pg"));
-			const pool = new Pool({
-				connectionString: url,
-				connectionTimeoutMillis: 3e3
-			});
-			const client = yield* effect.Effect.promise(() => pool.connect().then((c) => ({
-				client: c,
-				pool
-			})));
-			try {
-				yield* effect.Effect.promise(() => client.client.query("SELECT 1"));
-				return true;
-			} finally {
-				client.client.release();
-				yield* effect.Effect.promise(() => client.pool.end().catch(() => {}));
-			}
-		} catch {
-			return false;
-		}
+		return yield* effect.Effect.tryPromise({
+			try: async () => {
+				const { Pool } = await import("pg");
+				const pool = new Pool({
+					connectionString: url,
+					connectionTimeoutMillis: 3e3
+				});
+				try {
+					const client = await pool.connect();
+					try {
+						await client.query("SELECT 1");
+						return true;
+					} finally {
+						client.release();
+					}
+				} finally {
+					await pool.end().catch(() => {});
+				}
+			},
+			catch: (cause) => new PreflightConnectionError({ cause })
+		}).pipe(effect.Effect.orElseSucceed(() => false));
 	});
 }
 function preflightTargetsFromEnv(env) {
@@ -101,18 +110,20 @@ function preflightLocalInfra(env, overrides) {
 		if (target.kind === "postgres") {
 			if (yield* checkPgConnection(target.url)) return null;
 			const tcpOk = yield* checkTcpReachable(target.host, target.port);
-			const pluginContext = target.secret.endsWith("_DATABASE_URL") ? ` The plugin for ${target.secret} runs inside the local host process, so this DB must be reachable. Run \`docker compose up -d --wait\` to start local Postgres/Redis.` : "";
+			const pluginContext = target.secret === "API_DATABASE_URL" || target.secret === "AUTH_DATABASE_URL" ? " Run `docker compose up -d --wait` to start local Postgres." : ` The plugin for ${target.secret} runs inside the local host process, so this DB must be reachable. Run \`docker compose up -d --wait\` to start local Postgres.`;
 			if (tcpOk) return {
 				secret: target.secret,
 				host: target.host,
 				port: target.port,
-				error: `${target.secret} at ${target.host}:${target.port} is reachable but Postgres connection failed. Check credentials and database name.${pluginContext}`
+				error: `${target.secret} at ${target.host}:${target.port} is reachable but Postgres connection failed. Check credentials and database name.${pluginContext}`,
+				tcpReachable: true
 			};
 			return {
 				secret: target.secret,
 				host: target.host,
 				port: target.port,
-				error: `${target.secret} points to ${target.host}:${target.port} but nothing is listening.${pluginContext}`
+				error: `${target.secret} points to ${target.host}:${target.port} but nothing is listening.${pluginContext}`,
+				tcpReachable: false
 			};
 		}
 		if (yield* checkTcpReachable(target.host, target.port)) return null;
@@ -120,7 +131,8 @@ function preflightLocalInfra(env, overrides) {
 			secret: target.secret,
 			host: target.host,
 			port: target.port,
-			error: `${target.secret} points to ${target.host}:${target.port} but nothing is listening`
+			error: `${target.secret} points to ${target.host}:${target.port} but nothing is listening`,
+			tcpReachable: false
 		};
 	}), { concurrency: "unbounded" }).pipe(effect.Effect.map((results) => results.filter((r) => r !== null)));
 }

package/dist/infra/preflight.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"preflight.cjs","names":["Effect"],"sources":["../../src/infra/preflight.ts"],"sourcesContent":["import { createConnection } from \"node:net\";\nimport { Effect } from \"effect\";\n\nexport interface PreflightTarget {\n  secret: string;\n  host: string;\n  port: number;\n  kind: \"postgres\" | \"redis\";\n  url: string;\n}\n\nexport interface PreflightFailure {\n  secret: string;\n  host: string;\n  port: number;\n  error: string;\n}\n\nfunction parseLocalUrl(url: string): { host: string; port: number } | null {\n  try {\n    const match = url.match(/:\\/\\/([^:/]+):(\\d+)/);\n    if (!match) return null;\n    const host = match[1];\n    const port = Number.parseInt(match[2], 10);\n    if (Number.isNaN(port)) return null;\n    if (host !== \"localhost\" && host !== \"127.0.0.1\") return null;\n    return { host, port };\n  } catch {\n    return null;\n  }\n}\n\nfunction checkTcpReachable(host: string, port: number, timeoutMs = 2000): Effect.Effect<boolean> {\n  return Effect.async<boolean>((resume) => {\n    const socket = createConnection({ host, port });\n    const timer = setTimeout(() => {\n      socket.destroy();\n      resume(Effect.succeed(false));\n    }, timeoutMs);\n\n    socket.once(\"connect\", () => {\n      clearTimeout(timer);\n      socket.destroy();\n      resume(Effect.succeed(true));\n    });\n\n    socket.once(\"error\", () => {\n      clearTimeout(timer);\n      socket.destroy();\n      resume(Effect.succeed(false));\n    });\n  });\n}\n\nfunction checkPgConnection(url: string): Effect.Effect<boolean> {\n  return Effect.gen(function* () {\n    const reachable = yield* checkTcpReachable(\n      new URL(url).hostname,\n      Number(new URL(url).port) || 5432,\n      4000,\n    );\n    if (!reachable) return false;\n\n    try {\n      const { Pool } = yield* Effect.promise(() => import(\"pg\"));\n      const pool = new Pool({ connectionString: url, connectionTimeoutMillis: 3000 });\n      const client = yield* Effect.promise(() => pool.connect().then((c) => ({ client: c, pool })));\n      try {\n        yield* Effect.promise(() => client.client.query(\"SELECT 1\"));\n        return true;\n      } finally {\n        client.client.release();\n        yield* Effect.promise(() => client.pool.end().catch(() => {}));\n      }\n    } catch {\n      return false;\n    }\n  });\n}\n\nfunction preflightTargetsFromEnv(env: Record<string, string>): PreflightTarget[] {\n  const targets: PreflightTarget[] = [];\n  for (const [secret, value] of Object.entries(env)) {\n    if (!value) continue;\n    if (secret.endsWith(\"_DATABASE_URL\")) {\n      const parsed = parseLocalUrl(value);\n      if (parsed) {\n        targets.push({\n          secret,\n          host: parsed.host,\n          port: parsed.port,\n          kind: \"postgres\",\n          url: value,\n        });\n      }\n    } else if (secret.endsWith(\"_REDIS_URL\")) {\n      const parsed = parseLocalUrl(value);\n      if (parsed) {\n        targets.push({ secret, host: parsed.host, port: parsed.port, kind: \"redis\", url: value });\n      }\n    }\n  }\n  return targets;\n}\n\nexport function preflightLocalInfra(\n  env: Record<string, string>,\n  overrides?: Record<string, string>,\n): Effect.Effect<PreflightFailure[], never> {\n  const merged = overrides ? { ...env, ...overrides } : env;\n  const targets = preflightTargetsFromEnv(merged);\n  if (targets.length === 0) return Effect.succeed([]);\n\n  return Effect.forEach(\n    targets,\n    (target) =>\n      Effect.gen(function* () {\n        if (target.kind === \"postgres\") {\n          const ok = yield* checkPgConnection(target.url);\n          if (ok) return null;\n          const tcpOk = yield* checkTcpReachable(target.host, target.port);\n          const pluginContext = target.secret.endsWith(\"_DATABASE_URL\")\n            ? ` The plugin for ${target.secret} runs inside the local host process, so this DB must be reachable. Run \\`docker compose up -d --wait\\` to start local Postgres/Redis.`\n            : \"\";\n          if (tcpOk) {\n            return {\n              secret: target.secret,\n              host: target.host,\n              port: target.port,\n              error: `${target.secret} at ${target.host}:${target.port} is reachable but Postgres connection failed. Check credentials and database name.${pluginContext}`,\n            } satisfies PreflightFailure;\n          }\n          return {\n            secret: target.secret,\n            host: target.host,\n            port: target.port,\n            error: `${target.secret} points to ${target.host}:${target.port} but nothing is listening.${pluginContext}`,\n          } satisfies PreflightFailure;\n        }\n\n        const reachable = yield* checkTcpReachable(target.host, target.port);\n        if (reachable) return null;\n        return {\n          secret: target.secret,\n          host: target.host,\n          port: target.port,\n          error: `${target.secret} points to ${target.host}:${target.port} but nothing is listening`,\n        } satisfies PreflightFailure;\n      }),\n    { concurrency: \"unbounded\" },\n  ).pipe(Effect.map((results) => results.filter((r): r is PreflightFailure => r !== null)));\n}\n"],"mappings":";;;;AAkBA,SAAS,cAAc,KAAoD;CACzE,IAAI;EACF,MAAM,QAAQ,IAAI,MAAM,qBAAqB;EAC7C,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,OAAO,MAAM;EACnB,MAAM,OAAO,OAAO,SAAS,MAAM,IAAI,EAAE;EACzC,IAAI,OAAO,MAAM,IAAI,GAAG,OAAO;EAC/B,IAAI,SAAS,eAAe,SAAS,aAAa,OAAO;EACzD,OAAO;GAAE;GAAM;EAAK;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,kBAAkB,MAAc,MAAc,YAAY,KAA8B;CAC/F,OAAOA,cAAO,OAAgB,WAAW;EACvC,MAAM,wCAA0B;GAAE;GAAM;EAAK,CAAC;EAC9C,MAAM,QAAQ,iBAAiB;GAC7B,OAAO,QAAQ;GACf,OAAOA,cAAO,QAAQ,KAAK,CAAC;EAC9B,GAAG,SAAS;EAEZ,OAAO,KAAK,iBAAiB;GAC3B,aAAa,KAAK;GAClB,OAAO,QAAQ;GACf,OAAOA,cAAO,QAAQ,IAAI,CAAC;EAC7B,CAAC;EAED,OAAO,KAAK,eAAe;GACzB,aAAa,KAAK;GAClB,OAAO,QAAQ;GACf,OAAOA,cAAO,QAAQ,KAAK,CAAC;EAC9B,CAAC;CACH,CAAC;AACH;AAEA,SAAS,kBAAkB,KAAqC;CAC9D,OAAOA,cAAO,IAAI,aAAa;EAM7B,IAAI,EAAC,OALoB,kBACvB,IAAI,IAAI,GAAG,CAAC,CAAC,UACb,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,MAC7B,GACF,IACgB,OAAO;EAEvB,IAAI;GACF,MAAM,EAAE,SAAS,OAAOA,cAAO,cAAc,OAAO,KAAK;GACzD,MAAM,OAAO,IAAI,KAAK;IAAE,kBAAkB;IAAK,yBAAyB;GAAK,CAAC;GAC9E,MAAM,SAAS,OAAOA,cAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,MAAM,OAAO;IAAE,QAAQ;IAAG;GAAK,EAAE,CAAC;GAC5F,IAAI;IACF,OAAOA,cAAO,cAAc,OAAO,OAAO,MAAM,UAAU,CAAC;IAC3D,OAAO;GACT,UAAU;IACR,OAAO,OAAO,QAAQ;IACtB,OAAOA,cAAO,cAAc,OAAO,KAAK,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;GAC/D;EACF,QAAQ;GACN,OAAO;EACT;CACF,CAAC;AACH;AAEA,SAAS,wBAAwB,KAAgD;CAC/E,MAAM,UAA6B,CAAC;CACpC,KAAK,MAAM,CAAC,QAAQ,UAAU,OAAO,QAAQ,GAAG,GAAG;EACjD,IAAI,CAAC,OAAO;EACZ,IAAI,OAAO,SAAS,eAAe,GAAG;GACpC,MAAM,SAAS,cAAc,KAAK;GAClC,IAAI,QACF,QAAQ,KAAK;IACX;IACA,MAAM,OAAO;IACb,MAAM,OAAO;IACb,MAAM;IACN,KAAK;GACP,CAAC;EAEL,OAAO,IAAI,OAAO,SAAS,YAAY,GAAG;GACxC,MAAM,SAAS,cAAc,KAAK;GAClC,IAAI,QACF,QAAQ,KAAK;IAAE;IAAQ,MAAM,OAAO;IAAM,MAAM,OAAO;IAAM,MAAM;IAAS,KAAK;GAAM,CAAC;EAE5F;CACF;CACA,OAAO;AACT;AAEA,SAAgB,oBACd,KACA,WAC0C;CAE1C,MAAM,UAAU,wBADD,YAAY;EAAE,GAAG;EAAK,GAAG;CAAU,IAAI,GACR;CAC9C,IAAI,QAAQ,WAAW,GAAG,OAAOA,cAAO,QAAQ,CAAC,CAAC;CAElD,OAAOA,cAAO,QACZ,UACC,WACCA,cAAO,IAAI,aAAa;EACtB,IAAI,OAAO,SAAS,YAAY;GAE9B,IAAI,OADc,kBAAkB,OAAO,GAAG,GACtC,OAAO;GACf,MAAM,QAAQ,OAAO,kBAAkB,OAAO,MAAM,OAAO,IAAI;GAC/D,MAAM,gBAAgB,OAAO,OAAO,SAAS,eAAe,IACxD,mBAAmB,OAAO,OAAO,yIACjC;GACJ,IAAI,OACF,OAAO;IACL,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,MAAM,OAAO;IACb,OAAO,GAAG,OAAO,OAAO,MAAM,OAAO,KAAK,GAAG,OAAO,KAAK,oFAAoF;GAC/I;GAEF,OAAO;IACL,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,MAAM,OAAO;IACb,OAAO,GAAG,OAAO,OAAO,aAAa,OAAO,KAAK,GAAG,OAAO,KAAK,4BAA4B;GAC9F;EACF;EAGA,IAAI,OADqB,kBAAkB,OAAO,MAAM,OAAO,IAAI,GACpD,OAAO;EACtB,OAAO;GACL,QAAQ,OAAO;GACf,MAAM,OAAO;GACb,MAAM,OAAO;GACb,OAAO,GAAG,OAAO,OAAO,aAAa,OAAO,KAAK,GAAG,OAAO,KAAK;EAClE;CACF,CAAC,GACH,EAAE,aAAa,YAAY,CAC7B,CAAC,CAAC,KAAKA,cAAO,KAAK,YAAY,QAAQ,QAAQ,MAA6B,MAAM,IAAI,CAAC,CAAC;AAC1F"}
+{"version":3,"file":"preflight.cjs","names":["Data","Effect","createConnection"],"sources":["../../src/infra/preflight.ts"],"sourcesContent":["import { createConnection } from \"node:net\";\nimport { Data, Effect } from \"effect\";\n\nclass PreflightConnectionError extends Data.TaggedError(\"PreflightConnectionError\")<{\n  readonly cause: unknown;\n}> {\n  override get message() {\n    return `Postgres connection failed: ${\n      this.cause instanceof Error ? this.cause.message : String(this.cause)\n    }`;\n  }\n}\n\nconst scheduleTimeout = (ms: number, fn: () => void): ReturnType<typeof setTimeout> =>\n  setTimeout(fn, ms);\n\nexport interface PreflightTarget {\n  secret: string;\n  host: string;\n  port: number;\n  kind: \"postgres\" | \"redis\";\n  url: string;\n}\n\nexport interface PreflightFailure {\n  secret: string;\n  host: string;\n  port: number;\n  error: string;\n  /** True when the target port accepted a TCP connection (so docker compose cannot fix this failure). */\n  tcpReachable: boolean;\n}\n\nfunction parseLocalUrl(url: string): { host: string; port: number } | null {\n  try {\n    const parsed = new URL(url);\n    const host = parsed.hostname;\n    if (host !== \"localhost\" && host !== \"127.0.0.1\" && host !== \"::1\") return null;\n    const port = Number.parseInt(parsed.port, 10);\n    if (Number.isNaN(port)) {\n      const fallback = parsed.protocol === \"redis:\" ? 6379 : 5432;\n      return { host, port: fallback };\n    }\n    return { host, port };\n  } catch {\n    return null;\n  }\n}\n\nfunction checkTcpReachable(host: string, port: number, timeoutMs = 2000): Effect.Effect<boolean> {\n  return Effect.callback<boolean>((resume) => {\n    const socket = createConnection({ host, port });\n    const timer = scheduleTimeout(timeoutMs, () => {\n      socket.destroy();\n      resume(Effect.succeed(false));\n    });\n\n    socket.once(\"connect\", () => {\n      clearTimeout(timer);\n      socket.destroy();\n      resume(Effect.succeed(true));\n    });\n\n    socket.once(\"error\", () => {\n      clearTimeout(timer);\n      socket.destroy();\n      resume(Effect.succeed(false));\n    });\n  });\n}\n\nfunction checkPgConnection(url: string): Effect.Effect<boolean> {\n  return Effect.gen(function* () {\n    const reachable = yield* checkTcpReachable(\n      new URL(url).hostname,\n      Number(new URL(url).port) || 5432,\n      4000,\n    );\n    if (!reachable) return false;\n\n    return yield* Effect.tryPromise({\n      try: async () => {\n        const { Pool } = await import(\"pg\");\n        const pool = new Pool({ connectionString: url, connectionTimeoutMillis: 3000 });\n        try {\n          const client = await pool.connect();\n          try {\n            await client.query(\"SELECT 1\");\n            return true;\n          } finally {\n            client.release();\n          }\n        } finally {\n          await pool.end().catch(() => {});\n        }\n      },\n      catch: (cause) => new PreflightConnectionError({ cause }),\n    }).pipe(Effect.orElseSucceed(() => false));\n  });\n}\n\nfunction preflightTargetsFromEnv(env: Record<string, string>): PreflightTarget[] {\n  const targets: PreflightTarget[] = [];\n  for (const [secret, value] of Object.entries(env)) {\n    if (!value) continue;\n    if (secret.endsWith(\"_DATABASE_URL\")) {\n      const parsed = parseLocalUrl(value);\n      if (parsed) {\n        targets.push({\n          secret,\n          host: parsed.host,\n          port: parsed.port,\n          kind: \"postgres\",\n          url: value,\n        });\n      }\n    } else if (secret.endsWith(\"_REDIS_URL\")) {\n      const parsed = parseLocalUrl(value);\n      if (parsed) {\n        targets.push({ secret, host: parsed.host, port: parsed.port, kind: \"redis\", url: value });\n      }\n    }\n  }\n  return targets;\n}\n\nexport function preflightLocalInfra(\n  env: Record<string, string>,\n  overrides?: Record<string, string>,\n): Effect.Effect<PreflightFailure[], never> {\n  const merged = overrides ? { ...env, ...overrides } : env;\n  const targets = preflightTargetsFromEnv(merged);\n  if (targets.length === 0) return Effect.succeed([]);\n\n  return Effect.forEach(\n    targets,\n    (target) =>\n      Effect.gen(function* () {\n        if (target.kind === \"postgres\") {\n          const ok = yield* checkPgConnection(target.url);\n          if (ok) return null;\n          const tcpOk = yield* checkTcpReachable(target.host, target.port);\n          const appDb =\n            target.secret === \"API_DATABASE_URL\" || target.secret === \"AUTH_DATABASE_URL\";\n          const pluginContext = appDb\n            ? \" Run `docker compose up -d --wait` to start local Postgres.\"\n            : ` The plugin for ${target.secret} runs inside the local host process, so this DB must be reachable. Run \\`docker compose up -d --wait\\` to start local Postgres.`;\n          if (tcpOk) {\n            return {\n              secret: target.secret,\n              host: target.host,\n              port: target.port,\n              error: `${target.secret} at ${target.host}:${target.port} is reachable but Postgres connection failed. Check credentials and database name.${pluginContext}`,\n              tcpReachable: true,\n            } satisfies PreflightFailure;\n          }\n          return {\n            secret: target.secret,\n            host: target.host,\n            port: target.port,\n            error: `${target.secret} points to ${target.host}:${target.port} but nothing is listening.${pluginContext}`,\n            tcpReachable: false,\n          } satisfies PreflightFailure;\n        }\n\n        const reachable = yield* checkTcpReachable(target.host, target.port);\n        if (reachable) return null;\n        return {\n          secret: target.secret,\n          host: target.host,\n          port: target.port,\n          error: `${target.secret} points to ${target.host}:${target.port} but nothing is listening`,\n          tcpReachable: false,\n        } satisfies PreflightFailure;\n      }),\n    { concurrency: \"unbounded\" },\n  ).pipe(Effect.map((results) => results.filter((r): r is PreflightFailure => r !== null)));\n}\n"],"mappings":";;;;AAGA,IAAM,2BAAN,cAAuCA,YAAK,YAAY,0BAA0B,CAAC,CAEhF;CACD,IAAa,UAAU;EACrB,OAAO,+BACL,KAAK,iBAAiB,QAAQ,KAAK,MAAM,UAAU,OAAO,KAAK,KAAK;CAExE;AACF;AAEA,MAAM,mBAAmB,IAAY,OACnC,WAAW,IAAI,EAAE;AAmBnB,SAAS,cAAc,KAAoD;CACzE,IAAI;EACF,MAAM,SAAS,IAAI,IAAI,GAAG;EAC1B,MAAM,OAAO,OAAO;EACpB,IAAI,SAAS,eAAe,SAAS,eAAe,SAAS,OAAO,OAAO;EAC3E,MAAM,OAAO,OAAO,SAAS,OAAO,MAAM,EAAE;EAC5C,IAAI,OAAO,MAAM,IAAI,GAEnB,OAAO;GAAE;GAAM,MADE,OAAO,aAAa,WAAW,OAAO;EACzB;EAEhC,OAAO;GAAE;GAAM;EAAK;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,kBAAkB,MAAc,MAAc,YAAY,KAA8B;CAC/F,OAAOC,cAAO,UAAmB,WAAW;EAC1C,MAAM,aAASC,2BAAiB;GAAE;GAAM;EAAK,CAAC;EAC9C,MAAM,QAAQ,gBAAgB,iBAAiB;GAC7C,OAAO,QAAQ;GACf,OAAOD,cAAO,QAAQ,KAAK,CAAC;EAC9B,CAAC;EAED,OAAO,KAAK,iBAAiB;GAC3B,aAAa,KAAK;GAClB,OAAO,QAAQ;GACf,OAAOA,cAAO,QAAQ,IAAI,CAAC;EAC7B,CAAC;EAED,OAAO,KAAK,eAAe;GACzB,aAAa,KAAK;GAClB,OAAO,QAAQ;GACf,OAAOA,cAAO,QAAQ,KAAK,CAAC;EAC9B,CAAC;CACH,CAAC;AACH;AAEA,SAAS,kBAAkB,KAAqC;CAC9D,OAAOA,cAAO,IAAI,aAAa;EAM7B,IAAI,EAAC,OALoB,kBACvB,IAAI,IAAI,GAAG,CAAC,CAAC,UACb,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,MAC7B,GACF,IACgB,OAAO;EAEvB,OAAO,OAAOA,cAAO,WAAW;GAC9B,KAAK,YAAY;IACf,MAAM,EAAE,SAAS,MAAM,OAAO;IAC9B,MAAM,OAAO,IAAI,KAAK;KAAE,kBAAkB;KAAK,yBAAyB;IAAK,CAAC;IAC9E,IAAI;KACF,MAAM,SAAS,MAAM,KAAK,QAAQ;KAClC,IAAI;MACF,MAAM,OAAO,MAAM,UAAU;MAC7B,OAAO;KACT,UAAU;MACR,OAAO,QAAQ;KACjB;IACF,UAAU;KACR,MAAM,KAAK,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;IACjC;GACF;GACA,QAAQ,UAAU,IAAI,yBAAyB,EAAE,MAAM,CAAC;EAC1D,CAAC,CAAC,CAAC,KAAKA,cAAO,oBAAoB,KAAK,CAAC;CAC3C,CAAC;AACH;AAEA,SAAS,wBAAwB,KAAgD;CAC/E,MAAM,UAA6B,CAAC;CACpC,KAAK,MAAM,CAAC,QAAQ,UAAU,OAAO,QAAQ,GAAG,GAAG;EACjD,IAAI,CAAC,OAAO;EACZ,IAAI,OAAO,SAAS,eAAe,GAAG;GACpC,MAAM,SAAS,cAAc,KAAK;GAClC,IAAI,QACF,QAAQ,KAAK;IACX;IACA,MAAM,OAAO;IACb,MAAM,OAAO;IACb,MAAM;IACN,KAAK;GACP,CAAC;EAEL,OAAO,IAAI,OAAO,SAAS,YAAY,GAAG;GACxC,MAAM,SAAS,cAAc,KAAK;GAClC,IAAI,QACF,QAAQ,KAAK;IAAE;IAAQ,MAAM,OAAO;IAAM,MAAM,OAAO;IAAM,MAAM;IAAS,KAAK;GAAM,CAAC;EAE5F;CACF;CACA,OAAO;AACT;AAEA,SAAgB,oBACd,KACA,WAC0C;CAE1C,MAAM,UAAU,wBADD,YAAY;EAAE,GAAG;EAAK,GAAG;CAAU,IAAI,GACR;CAC9C,IAAI,QAAQ,WAAW,GAAG,OAAOA,cAAO,QAAQ,CAAC,CAAC;CAElD,OAAOA,cAAO,QACZ,UACC,WACCA,cAAO,IAAI,aAAa;EACtB,IAAI,OAAO,SAAS,YAAY;GAE9B,IAAI,OADc,kBAAkB,OAAO,GAAG,GACtC,OAAO;GACf,MAAM,QAAQ,OAAO,kBAAkB,OAAO,MAAM,OAAO,IAAI;GAG/D,MAAM,gBADJ,OAAO,WAAW,sBAAsB,OAAO,WAAW,sBAExD,gEACA,mBAAmB,OAAO,OAAO;GACrC,IAAI,OACF,OAAO;IACL,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,MAAM,OAAO;IACb,OAAO,GAAG,OAAO,OAAO,MAAM,OAAO,KAAK,GAAG,OAAO,KAAK,oFAAoF;IAC7I,cAAc;GAChB;GAEF,OAAO;IACL,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,MAAM,OAAO;IACb,OAAO,GAAG,OAAO,OAAO,aAAa,OAAO,KAAK,GAAG,OAAO,KAAK,4BAA4B;IAC5F,cAAc;GAChB;EACF;EAGA,IAAI,OADqB,kBAAkB,OAAO,MAAM,OAAO,IAAI,GACpD,OAAO;EACtB,OAAO;GACL,QAAQ,OAAO;GACf,MAAM,OAAO;GACb,MAAM,OAAO;GACb,OAAO,GAAG,OAAO,OAAO,aAAa,OAAO,KAAK,GAAG,OAAO,KAAK;GAChE,cAAc;EAChB;CACF,CAAC,GACH,EAAE,aAAa,YAAY,CAC7B,CAAC,CAAC,KAAKA,cAAO,KAAK,YAAY,QAAQ,QAAQ,MAA6B,MAAM,IAAI,CAAC,CAAC;AAC1F"}

package/dist/infra/preflight.d.cts

@@ -0,0 +1 @@
+import { Effect } from "effect";

package/dist/infra/preflight.d.mts

@@ -0,0 +1 @@
+import { Effect } from "effect";

package/dist/infra/preflight.mjs

@@ -1,15 +1,23 @@
-import { Effect } from "effect";
+import { Data, Effect } from "effect";
 import { createConnection } from "node:net";
 
 //#region src/infra/preflight.ts
+var PreflightConnectionError = class extends Data.TaggedError("PreflightConnectionError") {
+	get message() {
+		return `Postgres connection failed: ${this.cause instanceof Error ? this.cause.message : String(this.cause)}`;
+	}
+};
+const scheduleTimeout = (ms, fn) => setTimeout(fn, ms);
 function parseLocalUrl(url) {
 	try {
-		const match = url.match(/:\/\/([^:/]+):(\d+)/);
-		if (!match) return null;
-		const host = match[1];
-		const port = Number.parseInt(match[2], 10);
-		if (Number.isNaN(port)) return null;
-		if (host !== "localhost" && host !== "127.0.0.1") return null;
+		const parsed = new URL(url);
+		const host = parsed.hostname;
+		if (host !== "localhost" && host !== "127.0.0.1" && host !== "::1") return null;
+		const port = Number.parseInt(parsed.port, 10);
+		if (Number.isNaN(port)) return {
+			host,
+			port: parsed.protocol === "redis:" ? 6379 : 5432
+		};
 		return {
 			host,
 			port
@@ -19,15 +27,15 @@ function parseLocalUrl(url) {
 	}
 }
 function checkTcpReachable(host, port, timeoutMs = 2e3) {
-	return Effect.async((resume) => {
+	return Effect.callback((resume) => {
 		const socket = createConnection({
 			host,
 			port
 		});
-		const timer = setTimeout(() => {
+		const timer = scheduleTimeout(timeoutMs, () => {
 			socket.destroy();
 			resume(Effect.succeed(false));
-		}, timeoutMs);
+		});
 		socket.once("connect", () => {
 			clearTimeout(timer);
 			socket.destroy();
@@ -43,26 +51,27 @@ function checkTcpReachable(host, port, timeoutMs = 2e3) {
 function checkPgConnection(url) {
 	return Effect.gen(function* () {
 		if (!(yield* checkTcpReachable(new URL(url).hostname, Number(new URL(url).port) || 5432, 4e3))) return false;
-		try {
-			const { Pool } = yield* Effect.promise(() => import("pg"));
-			const pool = new Pool({
-				connectionString: url,
-				connectionTimeoutMillis: 3e3
-			});
-			const client = yield* Effect.promise(() => pool.connect().then((c) => ({
-				client: c,
-				pool
-			})));
-			try {
-				yield* Effect.promise(() => client.client.query("SELECT 1"));
-				return true;
-			} finally {
-				client.client.release();
-				yield* Effect.promise(() => client.pool.end().catch(() => {}));
-			}
-		} catch {
-			return false;
-		}
+		return yield* Effect.tryPromise({
+			try: async () => {
+				const { Pool } = await import("pg");
+				const pool = new Pool({
+					connectionString: url,
+					connectionTimeoutMillis: 3e3
+				});
+				try {
+					const client = await pool.connect();
+					try {
+						await client.query("SELECT 1");
+						return true;
+					} finally {
+						client.release();
+					}
+				} finally {
+					await pool.end().catch(() => {});
+				}
+			},
+			catch: (cause) => new PreflightConnectionError({ cause })
+		}).pipe(Effect.orElseSucceed(() => false));
 	});
 }
 function preflightTargetsFromEnv(env) {
@@ -101,18 +110,20 @@ function preflightLocalInfra(env, overrides) {
 		if (target.kind === "postgres") {
 			if (yield* checkPgConnection(target.url)) return null;
 			const tcpOk = yield* checkTcpReachable(target.host, target.port);
-			const pluginContext = target.secret.endsWith("_DATABASE_URL") ? ` The plugin for ${target.secret} runs inside the local host process, so this DB must be reachable. Run \`docker compose up -d --wait\` to start local Postgres/Redis.` : "";
+			const pluginContext = target.secret === "API_DATABASE_URL" || target.secret === "AUTH_DATABASE_URL" ? " Run `docker compose up -d --wait` to start local Postgres." : ` The plugin for ${target.secret} runs inside the local host process, so this DB must be reachable. Run \`docker compose up -d --wait\` to start local Postgres.`;
 			if (tcpOk) return {
 				secret: target.secret,
 				host: target.host,
 				port: target.port,
-				error: `${target.secret} at ${target.host}:${target.port} is reachable but Postgres connection failed. Check credentials and database name.${pluginContext}`
+				error: `${target.secret} at ${target.host}:${target.port} is reachable but Postgres connection failed. Check credentials and database name.${pluginContext}`,
+				tcpReachable: true
 			};
 			return {
 				secret: target.secret,
 				host: target.host,
 				port: target.port,
-				error: `${target.secret} points to ${target.host}:${target.port} but nothing is listening.${pluginContext}`
+				error: `${target.secret} points to ${target.host}:${target.port} but nothing is listening.${pluginContext}`,
+				tcpReachable: false
 			};
 		}
 		if (yield* checkTcpReachable(target.host, target.port)) return null;
@@ -120,7 +131,8 @@ function preflightLocalInfra(env, overrides) {
 			secret: target.secret,
 			host: target.host,
 			port: target.port,
-			error: `${target.secret} points to ${target.host}:${target.port} but nothing is listening`
+			error: `${target.secret} points to ${target.host}:${target.port} but nothing is listening`,
+			tcpReachable: false
 		};
 	}), { concurrency: "unbounded" }).pipe(Effect.map((results) => results.filter((r) => r !== null)));
 }

package/dist/infra/preflight.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"preflight.mjs","names":[],"sources":["../../src/infra/preflight.ts"],"sourcesContent":["import { createConnection } from \"node:net\";\nimport { Effect } from \"effect\";\n\nexport interface PreflightTarget {\n  secret: string;\n  host: string;\n  port: number;\n  kind: \"postgres\" | \"redis\";\n  url: string;\n}\n\nexport interface PreflightFailure {\n  secret: string;\n  host: string;\n  port: number;\n  error: string;\n}\n\nfunction parseLocalUrl(url: string): { host: string; port: number } | null {\n  try {\n    const match = url.match(/:\\/\\/([^:/]+):(\\d+)/);\n    if (!match) return null;\n    const host = match[1];\n    const port = Number.parseInt(match[2], 10);\n    if (Number.isNaN(port)) return null;\n    if (host !== \"localhost\" && host !== \"127.0.0.1\") return null;\n    return { host, port };\n  } catch {\n    return null;\n  }\n}\n\nfunction checkTcpReachable(host: string, port: number, timeoutMs = 2000): Effect.Effect<boolean> {\n  return Effect.async<boolean>((resume) => {\n    const socket = createConnection({ host, port });\n    const timer = setTimeout(() => {\n      socket.destroy();\n      resume(Effect.succeed(false));\n    }, timeoutMs);\n\n    socket.once(\"connect\", () => {\n      clearTimeout(timer);\n      socket.destroy();\n      resume(Effect.succeed(true));\n    });\n\n    socket.once(\"error\", () => {\n      clearTimeout(timer);\n      socket.destroy();\n      resume(Effect.succeed(false));\n    });\n  });\n}\n\nfunction checkPgConnection(url: string): Effect.Effect<boolean> {\n  return Effect.gen(function* () {\n    const reachable = yield* checkTcpReachable(\n      new URL(url).hostname,\n      Number(new URL(url).port) || 5432,\n      4000,\n    );\n    if (!reachable) return false;\n\n    try {\n      const { Pool } = yield* Effect.promise(() => import(\"pg\"));\n      const pool = new Pool({ connectionString: url, connectionTimeoutMillis: 3000 });\n      const client = yield* Effect.promise(() => pool.connect().then((c) => ({ client: c, pool })));\n      try {\n        yield* Effect.promise(() => client.client.query(\"SELECT 1\"));\n        return true;\n      } finally {\n        client.client.release();\n        yield* Effect.promise(() => client.pool.end().catch(() => {}));\n      }\n    } catch {\n      return false;\n    }\n  });\n}\n\nfunction preflightTargetsFromEnv(env: Record<string, string>): PreflightTarget[] {\n  const targets: PreflightTarget[] = [];\n  for (const [secret, value] of Object.entries(env)) {\n    if (!value) continue;\n    if (secret.endsWith(\"_DATABASE_URL\")) {\n      const parsed = parseLocalUrl(value);\n      if (parsed) {\n        targets.push({\n          secret,\n          host: parsed.host,\n          port: parsed.port,\n          kind: \"postgres\",\n          url: value,\n        });\n      }\n    } else if (secret.endsWith(\"_REDIS_URL\")) {\n      const parsed = parseLocalUrl(value);\n      if (parsed) {\n        targets.push({ secret, host: parsed.host, port: parsed.port, kind: \"redis\", url: value });\n      }\n    }\n  }\n  return targets;\n}\n\nexport function preflightLocalInfra(\n  env: Record<string, string>,\n  overrides?: Record<string, string>,\n): Effect.Effect<PreflightFailure[], never> {\n  const merged = overrides ? { ...env, ...overrides } : env;\n  const targets = preflightTargetsFromEnv(merged);\n  if (targets.length === 0) return Effect.succeed([]);\n\n  return Effect.forEach(\n    targets,\n    (target) =>\n      Effect.gen(function* () {\n        if (target.kind === \"postgres\") {\n          const ok = yield* checkPgConnection(target.url);\n          if (ok) return null;\n          const tcpOk = yield* checkTcpReachable(target.host, target.port);\n          const pluginContext = target.secret.endsWith(\"_DATABASE_URL\")\n            ? ` The plugin for ${target.secret} runs inside the local host process, so this DB must be reachable. Run \\`docker compose up -d --wait\\` to start local Postgres/Redis.`\n            : \"\";\n          if (tcpOk) {\n            return {\n              secret: target.secret,\n              host: target.host,\n              port: target.port,\n              error: `${target.secret} at ${target.host}:${target.port} is reachable but Postgres connection failed. Check credentials and database name.${pluginContext}`,\n            } satisfies PreflightFailure;\n          }\n          return {\n            secret: target.secret,\n            host: target.host,\n            port: target.port,\n            error: `${target.secret} points to ${target.host}:${target.port} but nothing is listening.${pluginContext}`,\n          } satisfies PreflightFailure;\n        }\n\n        const reachable = yield* checkTcpReachable(target.host, target.port);\n        if (reachable) return null;\n        return {\n          secret: target.secret,\n          host: target.host,\n          port: target.port,\n          error: `${target.secret} points to ${target.host}:${target.port} but nothing is listening`,\n        } satisfies PreflightFailure;\n      }),\n    { concurrency: \"unbounded\" },\n  ).pipe(Effect.map((results) => results.filter((r): r is PreflightFailure => r !== null)));\n}\n"],"mappings":";;;;AAkBA,SAAS,cAAc,KAAoD;CACzE,IAAI;EACF,MAAM,QAAQ,IAAI,MAAM,qBAAqB;EAC7C,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,OAAO,MAAM;EACnB,MAAM,OAAO,OAAO,SAAS,MAAM,IAAI,EAAE;EACzC,IAAI,OAAO,MAAM,IAAI,GAAG,OAAO;EAC/B,IAAI,SAAS,eAAe,SAAS,aAAa,OAAO;EACzD,OAAO;GAAE;GAAM;EAAK;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,kBAAkB,MAAc,MAAc,YAAY,KAA8B;CAC/F,OAAO,OAAO,OAAgB,WAAW;EACvC,MAAM,SAAS,iBAAiB;GAAE;GAAM;EAAK,CAAC;EAC9C,MAAM,QAAQ,iBAAiB;GAC7B,OAAO,QAAQ;GACf,OAAO,OAAO,QAAQ,KAAK,CAAC;EAC9B,GAAG,SAAS;EAEZ,OAAO,KAAK,iBAAiB;GAC3B,aAAa,KAAK;GAClB,OAAO,QAAQ;GACf,OAAO,OAAO,QAAQ,IAAI,CAAC;EAC7B,CAAC;EAED,OAAO,KAAK,eAAe;GACzB,aAAa,KAAK;GAClB,OAAO,QAAQ;GACf,OAAO,OAAO,QAAQ,KAAK,CAAC;EAC9B,CAAC;CACH,CAAC;AACH;AAEA,SAAS,kBAAkB,KAAqC;CAC9D,OAAO,OAAO,IAAI,aAAa;EAM7B,IAAI,EAAC,OALoB,kBACvB,IAAI,IAAI,GAAG,CAAC,CAAC,UACb,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,MAC7B,GACF,IACgB,OAAO;EAEvB,IAAI;GACF,MAAM,EAAE,SAAS,OAAO,OAAO,cAAc,OAAO,KAAK;GACzD,MAAM,OAAO,IAAI,KAAK;IAAE,kBAAkB;IAAK,yBAAyB;GAAK,CAAC;GAC9E,MAAM,SAAS,OAAO,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,MAAM,OAAO;IAAE,QAAQ;IAAG;GAAK,EAAE,CAAC;GAC5F,IAAI;IACF,OAAO,OAAO,cAAc,OAAO,OAAO,MAAM,UAAU,CAAC;IAC3D,OAAO;GACT,UAAU;IACR,OAAO,OAAO,QAAQ;IACtB,OAAO,OAAO,cAAc,OAAO,KAAK,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;GAC/D;EACF,QAAQ;GACN,OAAO;EACT;CACF,CAAC;AACH;AAEA,SAAS,wBAAwB,KAAgD;CAC/E,MAAM,UAA6B,CAAC;CACpC,KAAK,MAAM,CAAC,QAAQ,UAAU,OAAO,QAAQ,GAAG,GAAG;EACjD,IAAI,CAAC,OAAO;EACZ,IAAI,OAAO,SAAS,eAAe,GAAG;GACpC,MAAM,SAAS,cAAc,KAAK;GAClC,IAAI,QACF,QAAQ,KAAK;IACX;IACA,MAAM,OAAO;IACb,MAAM,OAAO;IACb,MAAM;IACN,KAAK;GACP,CAAC;EAEL,OAAO,IAAI,OAAO,SAAS,YAAY,GAAG;GACxC,MAAM,SAAS,cAAc,KAAK;GAClC,IAAI,QACF,QAAQ,KAAK;IAAE;IAAQ,MAAM,OAAO;IAAM,MAAM,OAAO;IAAM,MAAM;IAAS,KAAK;GAAM,CAAC;EAE5F;CACF;CACA,OAAO;AACT;AAEA,SAAgB,oBACd,KACA,WAC0C;CAE1C,MAAM,UAAU,wBADD,YAAY;EAAE,GAAG;EAAK,GAAG;CAAU,IAAI,GACR;CAC9C,IAAI,QAAQ,WAAW,GAAG,OAAO,OAAO,QAAQ,CAAC,CAAC;CAElD,OAAO,OAAO,QACZ,UACC,WACC,OAAO,IAAI,aAAa;EACtB,IAAI,OAAO,SAAS,YAAY;GAE9B,IAAI,OADc,kBAAkB,OAAO,GAAG,GACtC,OAAO;GACf,MAAM,QAAQ,OAAO,kBAAkB,OAAO,MAAM,OAAO,IAAI;GAC/D,MAAM,gBAAgB,OAAO,OAAO,SAAS,eAAe,IACxD,mBAAmB,OAAO,OAAO,yIACjC;GACJ,IAAI,OACF,OAAO;IACL,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,MAAM,OAAO;IACb,OAAO,GAAG,OAAO,OAAO,MAAM,OAAO,KAAK,GAAG,OAAO,KAAK,oFAAoF;GAC/I;GAEF,OAAO;IACL,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,MAAM,OAAO;IACb,OAAO,GAAG,OAAO,OAAO,aAAa,OAAO,KAAK,GAAG,OAAO,KAAK,4BAA4B;GAC9F;EACF;EAGA,IAAI,OADqB,kBAAkB,OAAO,MAAM,OAAO,IAAI,GACpD,OAAO;EACtB,OAAO;GACL,QAAQ,OAAO;GACf,MAAM,OAAO;GACb,MAAM,OAAO;GACb,OAAO,GAAG,OAAO,OAAO,aAAa,OAAO,KAAK,GAAG,OAAO,KAAK;EAClE;CACF,CAAC,GACH,EAAE,aAAa,YAAY,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,YAAY,QAAQ,QAAQ,MAA6B,MAAM,IAAI,CAAC,CAAC;AAC1F"}
+{"version":3,"file":"preflight.mjs","names":[],"sources":["../../src/infra/preflight.ts"],"sourcesContent":["import { createConnection } from \"node:net\";\nimport { Data, Effect } from \"effect\";\n\nclass PreflightConnectionError extends Data.TaggedError(\"PreflightConnectionError\")<{\n  readonly cause: unknown;\n}> {\n  override get message() {\n    return `Postgres connection failed: ${\n      this.cause instanceof Error ? this.cause.message : String(this.cause)\n    }`;\n  }\n}\n\nconst scheduleTimeout = (ms: number, fn: () => void): ReturnType<typeof setTimeout> =>\n  setTimeout(fn, ms);\n\nexport interface PreflightTarget {\n  secret: string;\n  host: string;\n  port: number;\n  kind: \"postgres\" | \"redis\";\n  url: string;\n}\n\nexport interface PreflightFailure {\n  secret: string;\n  host: string;\n  port: number;\n  error: string;\n  /** True when the target port accepted a TCP connection (so docker compose cannot fix this failure). */\n  tcpReachable: boolean;\n}\n\nfunction parseLocalUrl(url: string): { host: string; port: number } | null {\n  try {\n    const parsed = new URL(url);\n    const host = parsed.hostname;\n    if (host !== \"localhost\" && host !== \"127.0.0.1\" && host !== \"::1\") return null;\n    const port = Number.parseInt(parsed.port, 10);\n    if (Number.isNaN(port)) {\n      const fallback = parsed.protocol === \"redis:\" ? 6379 : 5432;\n      return { host, port: fallback };\n    }\n    return { host, port };\n  } catch {\n    return null;\n  }\n}\n\nfunction checkTcpReachable(host: string, port: number, timeoutMs = 2000): Effect.Effect<boolean> {\n  return Effect.callback<boolean>((resume) => {\n    const socket = createConnection({ host, port });\n    const timer = scheduleTimeout(timeoutMs, () => {\n      socket.destroy();\n      resume(Effect.succeed(false));\n    });\n\n    socket.once(\"connect\", () => {\n      clearTimeout(timer);\n      socket.destroy();\n      resume(Effect.succeed(true));\n    });\n\n    socket.once(\"error\", () => {\n      clearTimeout(timer);\n      socket.destroy();\n      resume(Effect.succeed(false));\n    });\n  });\n}\n\nfunction checkPgConnection(url: string): Effect.Effect<boolean> {\n  return Effect.gen(function* () {\n    const reachable = yield* checkTcpReachable(\n      new URL(url).hostname,\n      Number(new URL(url).port) || 5432,\n      4000,\n    );\n    if (!reachable) return false;\n\n    return yield* Effect.tryPromise({\n      try: async () => {\n        const { Pool } = await import(\"pg\");\n        const pool = new Pool({ connectionString: url, connectionTimeoutMillis: 3000 });\n        try {\n          const client = await pool.connect();\n          try {\n            await client.query(\"SELECT 1\");\n            return true;\n          } finally {\n            client.release();\n          }\n        } finally {\n          await pool.end().catch(() => {});\n        }\n      },\n      catch: (cause) => new PreflightConnectionError({ cause }),\n    }).pipe(Effect.orElseSucceed(() => false));\n  });\n}\n\nfunction preflightTargetsFromEnv(env: Record<string, string>): PreflightTarget[] {\n  const targets: PreflightTarget[] = [];\n  for (const [secret, value] of Object.entries(env)) {\n    if (!value) continue;\n    if (secret.endsWith(\"_DATABASE_URL\")) {\n      const parsed = parseLocalUrl(value);\n      if (parsed) {\n        targets.push({\n          secret,\n          host: parsed.host,\n          port: parsed.port,\n          kind: \"postgres\",\n          url: value,\n        });\n      }\n    } else if (secret.endsWith(\"_REDIS_URL\")) {\n      const parsed = parseLocalUrl(value);\n      if (parsed) {\n        targets.push({ secret, host: parsed.host, port: parsed.port, kind: \"redis\", url: value });\n      }\n    }\n  }\n  return targets;\n}\n\nexport function preflightLocalInfra(\n  env: Record<string, string>,\n  overrides?: Record<string, string>,\n): Effect.Effect<PreflightFailure[], never> {\n  const merged = overrides ? { ...env, ...overrides } : env;\n  const targets = preflightTargetsFromEnv(merged);\n  if (targets.length === 0) return Effect.succeed([]);\n\n  return Effect.forEach(\n    targets,\n    (target) =>\n      Effect.gen(function* () {\n        if (target.kind === \"postgres\") {\n          const ok = yield* checkPgConnection(target.url);\n          if (ok) return null;\n          const tcpOk = yield* checkTcpReachable(target.host, target.port);\n          const appDb =\n            target.secret === \"API_DATABASE_URL\" || target.secret === \"AUTH_DATABASE_URL\";\n          const pluginContext = appDb\n            ? \" Run `docker compose up -d --wait` to start local Postgres.\"\n            : ` The plugin for ${target.secret} runs inside the local host process, so this DB must be reachable. Run \\`docker compose up -d --wait\\` to start local Postgres.`;\n          if (tcpOk) {\n            return {\n              secret: target.secret,\n              host: target.host,\n              port: target.port,\n              error: `${target.secret} at ${target.host}:${target.port} is reachable but Postgres connection failed. Check credentials and database name.${pluginContext}`,\n              tcpReachable: true,\n            } satisfies PreflightFailure;\n          }\n          return {\n            secret: target.secret,\n            host: target.host,\n            port: target.port,\n            error: `${target.secret} points to ${target.host}:${target.port} but nothing is listening.${pluginContext}`,\n            tcpReachable: false,\n          } satisfies PreflightFailure;\n        }\n\n        const reachable = yield* checkTcpReachable(target.host, target.port);\n        if (reachable) return null;\n        return {\n          secret: target.secret,\n          host: target.host,\n          port: target.port,\n          error: `${target.secret} points to ${target.host}:${target.port} but nothing is listening`,\n          tcpReachable: false,\n        } satisfies PreflightFailure;\n      }),\n    { concurrency: \"unbounded\" },\n  ).pipe(Effect.map((results) => results.filter((r): r is PreflightFailure => r !== null)));\n}\n"],"mappings":";;;;AAGA,IAAM,2BAAN,cAAuC,KAAK,YAAY,0BAA0B,CAAC,CAEhF;CACD,IAAa,UAAU;EACrB,OAAO,+BACL,KAAK,iBAAiB,QAAQ,KAAK,MAAM,UAAU,OAAO,KAAK,KAAK;CAExE;AACF;AAEA,MAAM,mBAAmB,IAAY,OACnC,WAAW,IAAI,EAAE;AAmBnB,SAAS,cAAc,KAAoD;CACzE,IAAI;EACF,MAAM,SAAS,IAAI,IAAI,GAAG;EAC1B,MAAM,OAAO,OAAO;EACpB,IAAI,SAAS,eAAe,SAAS,eAAe,SAAS,OAAO,OAAO;EAC3E,MAAM,OAAO,OAAO,SAAS,OAAO,MAAM,EAAE;EAC5C,IAAI,OAAO,MAAM,IAAI,GAEnB,OAAO;GAAE;GAAM,MADE,OAAO,aAAa,WAAW,OAAO;EACzB;EAEhC,OAAO;GAAE;GAAM;EAAK;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,kBAAkB,MAAc,MAAc,YAAY,KAA8B;CAC/F,OAAO,OAAO,UAAmB,WAAW;EAC1C,MAAM,SAAS,iBAAiB;GAAE;GAAM;EAAK,CAAC;EAC9C,MAAM,QAAQ,gBAAgB,iBAAiB;GAC7C,OAAO,QAAQ;GACf,OAAO,OAAO,QAAQ,KAAK,CAAC;EAC9B,CAAC;EAED,OAAO,KAAK,iBAAiB;GAC3B,aAAa,KAAK;GAClB,OAAO,QAAQ;GACf,OAAO,OAAO,QAAQ,IAAI,CAAC;EAC7B,CAAC;EAED,OAAO,KAAK,eAAe;GACzB,aAAa,KAAK;GAClB,OAAO,QAAQ;GACf,OAAO,OAAO,QAAQ,KAAK,CAAC;EAC9B,CAAC;CACH,CAAC;AACH;AAEA,SAAS,kBAAkB,KAAqC;CAC9D,OAAO,OAAO,IAAI,aAAa;EAM7B,IAAI,EAAC,OALoB,kBACvB,IAAI,IAAI,GAAG,CAAC,CAAC,UACb,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,MAC7B,GACF,IACgB,OAAO;EAEvB,OAAO,OAAO,OAAO,WAAW;GAC9B,KAAK,YAAY;IACf,MAAM,EAAE,SAAS,MAAM,OAAO;IAC9B,MAAM,OAAO,IAAI,KAAK;KAAE,kBAAkB;KAAK,yBAAyB;IAAK,CAAC;IAC9E,IAAI;KACF,MAAM,SAAS,MAAM,KAAK,QAAQ;KAClC,IAAI;MACF,MAAM,OAAO,MAAM,UAAU;MAC7B,OAAO;KACT,UAAU;MACR,OAAO,QAAQ;KACjB;IACF,UAAU;KACR,MAAM,KAAK,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;IACjC;GACF;GACA,QAAQ,UAAU,IAAI,yBAAyB,EAAE,MAAM,CAAC;EAC1D,CAAC,CAAC,CAAC,KAAK,OAAO,oBAAoB,KAAK,CAAC;CAC3C,CAAC;AACH;AAEA,SAAS,wBAAwB,KAAgD;CAC/E,MAAM,UAA6B,CAAC;CACpC,KAAK,MAAM,CAAC,QAAQ,UAAU,OAAO,QAAQ,GAAG,GAAG;EACjD,IAAI,CAAC,OAAO;EACZ,IAAI,OAAO,SAAS,eAAe,GAAG;GACpC,MAAM,SAAS,cAAc,KAAK;GAClC,IAAI,QACF,QAAQ,KAAK;IACX;IACA,MAAM,OAAO;IACb,MAAM,OAAO;IACb,MAAM;IACN,KAAK;GACP,CAAC;EAEL,OAAO,IAAI,OAAO,SAAS,YAAY,GAAG;GACxC,MAAM,SAAS,cAAc,KAAK;GAClC,IAAI,QACF,QAAQ,KAAK;IAAE;IAAQ,MAAM,OAAO;IAAM,MAAM,OAAO;IAAM,MAAM;IAAS,KAAK;GAAM,CAAC;EAE5F;CACF;CACA,OAAO;AACT;AAEA,SAAgB,oBACd,KACA,WAC0C;CAE1C,MAAM,UAAU,wBADD,YAAY;EAAE,GAAG;EAAK,GAAG;CAAU,IAAI,GACR;CAC9C,IAAI,QAAQ,WAAW,GAAG,OAAO,OAAO,QAAQ,CAAC,CAAC;CAElD,OAAO,OAAO,QACZ,UACC,WACC,OAAO,IAAI,aAAa;EACtB,IAAI,OAAO,SAAS,YAAY;GAE9B,IAAI,OADc,kBAAkB,OAAO,GAAG,GACtC,OAAO;GACf,MAAM,QAAQ,OAAO,kBAAkB,OAAO,MAAM,OAAO,IAAI;GAG/D,MAAM,gBADJ,OAAO,WAAW,sBAAsB,OAAO,WAAW,sBAExD,gEACA,mBAAmB,OAAO,OAAO;GACrC,IAAI,OACF,OAAO;IACL,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,MAAM,OAAO;IACb,OAAO,GAAG,OAAO,OAAO,MAAM,OAAO,KAAK,GAAG,OAAO,KAAK,oFAAoF;IAC7I,cAAc;GAChB;GAEF,OAAO;IACL,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,MAAM,OAAO;IACb,OAAO,GAAG,OAAO,OAAO,aAAa,OAAO,KAAK,GAAG,OAAO,KAAK,4BAA4B;IAC5F,cAAc;GAChB;EACF;EAGA,IAAI,OADqB,kBAAkB,OAAO,MAAM,OAAO,IAAI,GACpD,OAAO;EACtB,OAAO;GACL,QAAQ,OAAO;GACf,MAAM,OAAO;GACb,MAAM,OAAO;GACb,OAAO,GAAG,OAAO,OAAO,aAAa,OAAO,KAAK,GAAG,OAAO,KAAK;GAChE,cAAc;EAChB;CACF,CAAC,GACH,EAAE,aAAa,YAAY,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,YAAY,QAAQ,QAAQ,MAA6B,MAAM,IAAI,CAAC,CAAC;AAC1F"}

package/dist/infra/types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.cjs","names":["Data"],"sources":["../../src/infra/types.ts"],"sourcesContent":["import { Data } from \"effect\";\nimport type { AppOrchestrator } from \"../service-descriptor\";\nimport type { RuntimeConfig } from \"../types\";\n\nexport interface CliPorts {\n  host?: number;\n  api?: number;\n  auth?: number;\n  ui?: number;\n  uiSsr?: number;\n  pluginsStart?: number;\n  plugins?: Record<string, { api?: number; ui?: number }>;\n}\n\nexport interface ResolvedPorts {\n  host?: number;\n  api?: number;\n  auth?: number;\n  ui?: number;\n  uiSsr?: number;\n  plugins: Record<string, { api?: number; ui?: number }>;\n  postgres: Record<string, number>;\n  redis: Record<string, number>;\n}\n\nexport interface RuntimeLaunchSpec {\n  port?: number;\n  hostUrl?: string;\n  corsOrigin?: string;\n  trustedOrigins?: string[];\n  env: Record<string, string>;\n  runtimeConfig: RuntimeConfig;\n}\n\nexport interface ClaimRecord {\n  resourceKey: string;\n  pid: number;\n  configDir: string;\n  ports: Record<string, number>;\n  startedAt: number;\n}\n\nexport interface InfraPlan {\n  workspaceKey: string;\n  cliPorts: CliPorts;\n  resolvedPorts: ResolvedPorts;\n  runtimeConfig: RuntimeConfig;\n  launch: RuntimeLaunchSpec;\n  description: string;\n  serviceDescriptors: Map<string, ServiceDescriptorPlan>;\n  envGenerated: Record<string, string>;\n  composeModel: ComposeModelPlan;\n  claims: ClaimRecord[];\n  orchestrator: AppOrchestrator;\n}\n\nexport interface ServiceDescriptorPlan {\n  key: string;\n  source: \"local\" | \"remote\";\n  url: string;\n  port?: number;\n  localPath?: string;\n}\n\nexport interface ComposeModelPlan {\n  databases: DatabasePlan[];\n  redis: RedisPlan[];\n}\n\nexport interface DatabasePlan {\n  secret: string;\n  slug: string;\n  port: number;\n  dbName: string;\n  containerName: string;\n  volumeName: string;\n  url: string;\n}\n\nexport interface RedisPlan {\n  secret: string;\n  slug: string;\n  port: number;\n  containerName: string;\n  volumeName: string;\n  url: string;\n}\n\nexport type InfraPhase =\n  | \"resolve-config\"\n  | \"allocate-services\"\n  | \"allocate-databases\"\n  | \"claim\"\n  | \"materialize-env\"\n  | \"materialize-compose\"\n  | \"launch\";\n\nexport class InfraError extends Data.TaggedError(\"InfraError\")<{\n  phase: InfraPhase;\n  message: string;\n  cause?: unknown;\n}> {}\n\nexport interface InfraInput {\n  configDir: string;\n  bosConfig: RuntimeConfig;\n  cli: {\n    port?: number;\n    apiPort?: number;\n    authPort?: number;\n    uiPort?: number;\n    pluginPortStart?: number;\n    plugins?: Record<string, { api?: number; ui?: number }>;\n    ssr?: boolean;\n    proxy?: boolean;\n    hostSource?: \"local\" | \"remote\";\n    uiSource?: \"local\" | \"remote\";\n    apiSource?: \"local\" | \"remote\";\n    authSource?: \"local\" | \"remote\";\n    interactive?: boolean;\n  };\n}\n"],"mappings":";;;AAiGA,IAAa,aAAb,cAAgCA,YAAK,YAAY,YAAY,CAAC,CAI3D,CAAC"}
+{"version":3,"file":"types.cjs","names":["Data"],"sources":["../../src/infra/types.ts"],"sourcesContent":["import { Data } from \"effect\";\nimport type { AppOrchestrator } from \"../service-descriptor\";\nimport type { RuntimeConfig } from \"../types\";\n\nexport interface CliPorts {\n  host?: number;\n  api?: number;\n  auth?: number;\n  ui?: number;\n  pluginsStart?: number;\n  plugins?: Record<string, { api?: number; ui?: number }>;\n}\n\nexport interface ResolvedPorts {\n  host?: number;\n  api?: number;\n  auth?: number;\n  ui?: number;\n  plugins: Record<string, { api?: number; ui?: number }>;\n}\n\nexport interface RuntimeLaunchSpec {\n  port?: number;\n  hostUrl?: string;\n  corsOrigin?: string;\n  trustedOrigins?: string[];\n  env: Record<string, string>;\n  runtimeConfig: RuntimeConfig;\n}\n\nexport interface ClaimRecord {\n  resourceKey: string;\n  pid: number;\n  configDir: string;\n  ports: Record<string, number>;\n  startedAt: number;\n}\n\nexport interface InfraPlan {\n  workspaceKey: string;\n  cliPorts: CliPorts;\n  resolvedPorts: ResolvedPorts;\n  runtimeConfig: RuntimeConfig;\n  launch: RuntimeLaunchSpec;\n  description: string;\n  serviceDescriptors: Map<string, ServiceDescriptorPlan>;\n  envGenerated: Record<string, string>;\n  claims: ClaimRecord[];\n  orchestrator: AppOrchestrator;\n}\n\nexport interface ServiceDescriptorPlan {\n  key: string;\n  source: \"local\" | \"remote\";\n  url: string;\n  port?: number;\n  localPath?: string;\n}\n\nexport interface DatabasePlan {\n  secret: string;\n  slug: string;\n  port: number;\n  dbName: string;\n  url: string;\n}\n\nexport interface RedisPlan {\n  secret: string;\n  slug: string;\n  port: number;\n  url: string;\n}\n\nexport type InfraPhase =\n  | \"resolve-config\"\n  | \"allocate-services\"\n  | \"allocate-databases\"\n  | \"claim\"\n  | \"materialize-env\"\n  | \"launch\";\n\nexport class InfraError extends Data.TaggedError(\"InfraError\")<{\n  phase: InfraPhase;\n  message: string;\n  cause?: unknown;\n}> {}\n\nexport interface InfraInput {\n  configDir: string;\n  bosConfig: RuntimeConfig;\n  cli: {\n    port?: number;\n    apiPort?: number;\n    authPort?: number;\n    uiPort?: number;\n    pluginPortStart?: number;\n    plugins?: Record<string, { api?: number; ui?: number }>;\n    ssr?: boolean;\n    proxy?: boolean;\n    hostSource?: \"local\" | \"remote\";\n    uiSource?: \"local\" | \"remote\";\n    apiSource?: \"local\" | \"remote\";\n    authSource?: \"local\" | \"remote\";\n    interactive?: boolean;\n  };\n}\n"],"mappings":";;;AAkFA,IAAa,aAAb,cAAgCA,YAAK,YAAY,YAAY,CAAC,CAI3D,CAAC"}

package/dist/infra/types.d.cts

@@ -0,0 +1,2 @@
+import "../types.cjs";
+import "../service-descriptor.cjs";

package/dist/infra/types.d.mts

@@ -0,0 +1,2 @@
+import "../types.mjs";
+import "../service-descriptor.mjs";

package/dist/infra/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","names":[],"sources":["../../src/infra/types.ts"],"sourcesContent":["import { Data } from \"effect\";\nimport type { AppOrchestrator } from \"../service-descriptor\";\nimport type { RuntimeConfig } from \"../types\";\n\nexport interface CliPorts {\n  host?: number;\n  api?: number;\n  auth?: number;\n  ui?: number;\n  uiSsr?: number;\n  pluginsStart?: number;\n  plugins?: Record<string, { api?: number; ui?: number }>;\n}\n\nexport interface ResolvedPorts {\n  host?: number;\n  api?: number;\n  auth?: number;\n  ui?: number;\n  uiSsr?: number;\n  plugins: Record<string, { api?: number; ui?: number }>;\n  postgres: Record<string, number>;\n  redis: Record<string, number>;\n}\n\nexport interface RuntimeLaunchSpec {\n  port?: number;\n  hostUrl?: string;\n  corsOrigin?: string;\n  trustedOrigins?: string[];\n  env: Record<string, string>;\n  runtimeConfig: RuntimeConfig;\n}\n\nexport interface ClaimRecord {\n  resourceKey: string;\n  pid: number;\n  configDir: string;\n  ports: Record<string, number>;\n  startedAt: number;\n}\n\nexport interface InfraPlan {\n  workspaceKey: string;\n  cliPorts: CliPorts;\n  resolvedPorts: ResolvedPorts;\n  runtimeConfig: RuntimeConfig;\n  launch: RuntimeLaunchSpec;\n  description: string;\n  serviceDescriptors: Map<string, ServiceDescriptorPlan>;\n  envGenerated: Record<string, string>;\n  composeModel: ComposeModelPlan;\n  claims: ClaimRecord[];\n  orchestrator: AppOrchestrator;\n}\n\nexport interface ServiceDescriptorPlan {\n  key: string;\n  source: \"local\" | \"remote\";\n  url: string;\n  port?: number;\n  localPath?: string;\n}\n\nexport interface ComposeModelPlan {\n  databases: DatabasePlan[];\n  redis: RedisPlan[];\n}\n\nexport interface DatabasePlan {\n  secret: string;\n  slug: string;\n  port: number;\n  dbName: string;\n  containerName: string;\n  volumeName: string;\n  url: string;\n}\n\nexport interface RedisPlan {\n  secret: string;\n  slug: string;\n  port: number;\n  containerName: string;\n  volumeName: string;\n  url: string;\n}\n\nexport type InfraPhase =\n  | \"resolve-config\"\n  | \"allocate-services\"\n  | \"allocate-databases\"\n  | \"claim\"\n  | \"materialize-env\"\n  | \"materialize-compose\"\n  | \"launch\";\n\nexport class InfraError extends Data.TaggedError(\"InfraError\")<{\n  phase: InfraPhase;\n  message: string;\n  cause?: unknown;\n}> {}\n\nexport interface InfraInput {\n  configDir: string;\n  bosConfig: RuntimeConfig;\n  cli: {\n    port?: number;\n    apiPort?: number;\n    authPort?: number;\n    uiPort?: number;\n    pluginPortStart?: number;\n    plugins?: Record<string, { api?: number; ui?: number }>;\n    ssr?: boolean;\n    proxy?: boolean;\n    hostSource?: \"local\" | \"remote\";\n    uiSource?: \"local\" | \"remote\";\n    apiSource?: \"local\" | \"remote\";\n    authSource?: \"local\" | \"remote\";\n    interactive?: boolean;\n  };\n}\n"],"mappings":";;;AAiGA,IAAa,aAAb,cAAgC,KAAK,YAAY,YAAY,CAAC,CAI3D,CAAC"}
+{"version":3,"file":"types.mjs","names":[],"sources":["../../src/infra/types.ts"],"sourcesContent":["import { Data } from \"effect\";\nimport type { AppOrchestrator } from \"../service-descriptor\";\nimport type { RuntimeConfig } from \"../types\";\n\nexport interface CliPorts {\n  host?: number;\n  api?: number;\n  auth?: number;\n  ui?: number;\n  pluginsStart?: number;\n  plugins?: Record<string, { api?: number; ui?: number }>;\n}\n\nexport interface ResolvedPorts {\n  host?: number;\n  api?: number;\n  auth?: number;\n  ui?: number;\n  plugins: Record<string, { api?: number; ui?: number }>;\n}\n\nexport interface RuntimeLaunchSpec {\n  port?: number;\n  hostUrl?: string;\n  corsOrigin?: string;\n  trustedOrigins?: string[];\n  env: Record<string, string>;\n  runtimeConfig: RuntimeConfig;\n}\n\nexport interface ClaimRecord {\n  resourceKey: string;\n  pid: number;\n  configDir: string;\n  ports: Record<string, number>;\n  startedAt: number;\n}\n\nexport interface InfraPlan {\n  workspaceKey: string;\n  cliPorts: CliPorts;\n  resolvedPorts: ResolvedPorts;\n  runtimeConfig: RuntimeConfig;\n  launch: RuntimeLaunchSpec;\n  description: string;\n  serviceDescriptors: Map<string, ServiceDescriptorPlan>;\n  envGenerated: Record<string, string>;\n  claims: ClaimRecord[];\n  orchestrator: AppOrchestrator;\n}\n\nexport interface ServiceDescriptorPlan {\n  key: string;\n  source: \"local\" | \"remote\";\n  url: string;\n  port?: number;\n  localPath?: string;\n}\n\nexport interface DatabasePlan {\n  secret: string;\n  slug: string;\n  port: number;\n  dbName: string;\n  url: string;\n}\n\nexport interface RedisPlan {\n  secret: string;\n  slug: string;\n  port: number;\n  url: string;\n}\n\nexport type InfraPhase =\n  | \"resolve-config\"\n  | \"allocate-services\"\n  | \"allocate-databases\"\n  | \"claim\"\n  | \"materialize-env\"\n  | \"launch\";\n\nexport class InfraError extends Data.TaggedError(\"InfraError\")<{\n  phase: InfraPhase;\n  message: string;\n  cause?: unknown;\n}> {}\n\nexport interface InfraInput {\n  configDir: string;\n  bosConfig: RuntimeConfig;\n  cli: {\n    port?: number;\n    apiPort?: number;\n    authPort?: number;\n    uiPort?: number;\n    pluginPortStart?: number;\n    plugins?: Record<string, { api?: number; ui?: number }>;\n    ssr?: boolean;\n    proxy?: boolean;\n    hostSource?: \"local\" | \"remote\";\n    uiSource?: \"local\" | \"remote\";\n    apiSource?: \"local\" | \"remote\";\n    authSource?: \"local\" | \"remote\";\n    interactive?: boolean;\n  };\n}\n"],"mappings":";;;AAkFA,IAAa,aAAb,cAAgC,KAAK,YAAY,YAAY,CAAC,CAI3D,CAAC"}

package/dist/integrity.cjs

@@ -1,12 +1,11 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_http_client = require('./http-client.cjs');
 const require_fastkv = require('./fastkv.cjs');
-let node_fs = require("node:fs");
-let node_path = require("node:path");
+let effect = require("effect");
 let node_crypto = require("node:crypto");
 
 //#region src/integrity.ts
-const DEFAULT_MAX_SRI_RESPONSE_BYTES = 20 * 1024 * 1024;
+const DEFAULT_MAX_SRI_RESPONSE_BYTES = 20971520;
 function computeSriHash(content) {
 	return `sha384-${(0, node_crypto.createHash)("sha384").update(content).digest("base64")}`;
 }
@@ -40,6 +39,15 @@ async function computeSriHashFromResponse(response, url, options) {
 	return `sha384-${hash.digest("base64")}`;
 }
 async function computeSriHashForUrl(url, options) {
+	const attempts = 3;
+	for (let attempt = 1; attempt < attempts; attempt++) {
+		const hash = await computeSriHashOnce(url, options);
+		if (hash) return hash;
+		await new Promise((resolve) => setTimeout(resolve, 1e3 * attempt));
+	}
+	return computeSriHashOnce(url, options);
+}
+async function computeSriHashOnce(url, options) {
 	try {
 		const entryUrl = resolveSriTargetUrl(url, options);
 		const response = await require_http_client.fetchResponse(entryUrl, { timeout: "30 seconds" });
@@ -58,13 +66,18 @@ function resolveEntryUrl(url) {
 	if (url.endsWith("/mf-manifest.json")) return `${url.replace(/\/mf-manifest\.json$/, "")}/remoteEntry.js`;
 	return `${url.replace(/\/$/, "")}/remoteEntry.js`;
 }
+var SriVerificationError = class extends effect.Data.TaggedError("SriVerificationError") {
+	constructor(message) {
+		super({ detail: message });
+	}
+	get message() {
+		return this.detail;
+	}
+};
 async function verifySriForUrl(url, expectedIntegrity, options) {
 	const entryUrl = resolveSriTargetUrl(url, options);
 	const response = await require_http_client.fetchResponse(entryUrl, { timeout: "30 seconds" });
-	if (!response.ok) {
-		console.warn(`[SRI] Failed to fetch ${entryUrl} for verification: ${response.status}`);
-		return;
-	}
+	if (!response.ok) throw new SriVerificationError(`Failed to fetch ${entryUrl} for verification: ${response.status}`);
 	const computed = await computeSriHashFromResponse(response, entryUrl, options);
 	if (computed !== expectedIntegrity) throw new Error(`[SRI] Integrity check failed for ${entryUrl}\n  Expected: ${expectedIntegrity}\n  Computed: ${computed}`);
 }
@@ -90,14 +103,32 @@ function extractIntegrityHashes(config) {
 	const hashes = /* @__PURE__ */ new Map();
 	const app = config.app;
 	const plugins = config.plugins;
-	if (app) {
-		for (const [, entry] of Object.entries(app)) if (entry?.integrity && entry?.production) hashes.set(resolveEntryUrl(entry.production), entry.integrity);
-	}
-	if (plugins) {
-		for (const [, entry] of Object.entries(plugins)) if (entry?.integrity && entry?.production) hashes.set(resolveEntryUrl(entry.production), entry.integrity);
+	for (const entry of [...Object.values(app ?? {}), ...Object.values(plugins ?? {})]) {
+		if (!entry) continue;
+		const slotHash = slotHashOf(entry);
+		if (slotHash) hashes.set(slotHash.key, slotHash.hash);
 	}
 	return hashes;
 }
+/**
+* The integrity anchor a slot contributes to local↔chain attestation: pinned
+* slots anchor at the pinned manifest document (the pin's SRI), unpinned
+* slots at their fixed-name entry (the direct entry SRI).
+*/
+function slotHashOf(entry) {
+	const production = entry.production;
+	if (typeof production !== "string") return null;
+	const pin = entry.pin;
+	if (pin && typeof pin.manifest === "string" && typeof pin.integrity === "string") return {
+		key: `${production.replace(/\/$/, "")}/${pin.manifest.replace(/^\//, "")}`,
+		hash: pin.integrity
+	};
+	if (typeof entry.integrity === "string") return {
+		key: resolveEntryUrl(production),
+		hash: entry.integrity
+	};
+	return null;
+}
 async function verifyConfigAgainstChain(localConfig, bosUrl) {
 	const mismatches = [];
 	let chainConfig;
@@ -145,68 +176,26 @@ function deleteNestedPath(obj, dottedPath) {
 	}
 	delete current[keys[keys.length - 1]];
 }
-function reportDeployResult(opts) {
-	console.log(`[BOS_DEPLOY] url=${opts.url} urlField=${opts.urlField} integrityField=${opts.integrityField ?? ""} integrity=${opts.integrity ?? ""}`);
-	try {
-		const config = JSON.parse((0, node_fs.readFileSync)(opts.bosConfigPath, "utf8"));
-		setNestedPath(config, opts.urlField, opts.url);
-		if (opts.integrityField) if (opts.integrity) setNestedPath(config, opts.integrityField, opts.integrity);
-		else deleteNestedPath(config, opts.integrityField);
-		(0, node_fs.writeFileSync)(opts.bosConfigPath, `${JSON.stringify(config, null, 2)}\n`);
-		console.log(`   ✅ Updated bos.config.json: ${opts.urlField}`);
-		if (opts.integrityField && opts.integrity) console.log(`   ✅ Updated bos.config.json: ${opts.integrityField}`);
-	} catch (err) {
-		console.error("   ❌ Failed to update bos.config.json:", err.message);
-	}
-}
-function parseDeployLines(output) {
-	const results = [];
-	for (const line of output.split("\n")) {
-		if (!line.includes("[BOS_DEPLOY]")) continue;
-		const urlMatch = line.match(/url=(\S+)/);
-		const urlFieldMatch = line.match(/urlField=(\S+)/);
-		if (!urlMatch || !urlFieldMatch) continue;
-		const integrityFieldMatch = line.match(/integrityField=(\S+)/);
-		const integrityMatch = line.match(/integrity=(\S+)/);
-		results.push({
-			url: urlMatch[1],
-			urlField: urlFieldMatch[1],
-			integrityField: integrityFieldMatch?.[1] || void 0,
-			integrity: integrityMatch?.[1] || void 0
-		});
-	}
-	return results;
-}
 function applyDeployResults(config, results) {
 	const merged = structuredClone(config);
 	for (const result of results) {
 		setNestedPath(merged, result.urlField, result.url);
-		if (result.integrityField) if (result.integrity) setNestedPath(merged, result.integrityField, result.integrity);
-		else deleteNestedPath(merged, result.integrityField);
+		if (result.integrityField) {
+			if (result.integrity) setNestedPath(merged, result.integrityField, result.integrity);
+			else deleteNestedPath(merged, result.integrityField);
+		}
+		if (result.valueField && result.value !== void 0 && result.value !== null) setNestedPath(merged, result.valueField, result.value);
+		for (const field of result.removeFields ?? []) deleteNestedPath(merged, field);
 	}
 	return merged;
 }
-function findPluginKey(bosConfigPath, pluginDir) {
-	const plugins = JSON.parse((0, node_fs.readFileSync)(bosConfigPath, "utf8")).plugins;
-	if (!plugins) return null;
-	const configRoot = (0, node_path.join)(bosConfigPath, "..");
-	const normalizedPluginDir = pluginDir.replace(/\\/g, "/").replace(/\/+$/, "");
-	for (const [key, plugin] of Object.entries(plugins)) {
-		const dev = plugin?.development;
-		if (typeof dev !== "string" || !dev.startsWith("local:")) continue;
-		if ((0, node_path.join)(configRoot, dev.slice(6)).replace(/\\/g, "/").replace(/\/+$/, "") === normalizedPluginDir) return key;
-	}
-	return null;
-}
 
 //#endregion
 exports.IntegrityRegistry = IntegrityRegistry;
+exports.SriVerificationError = SriVerificationError;
 exports.applyDeployResults = applyDeployResults;
 exports.computeSriHash = computeSriHash;
 exports.computeSriHashForUrl = computeSriHashForUrl;
-exports.findPluginKey = findPluginKey;
-exports.parseDeployLines = parseDeployLines;
-exports.reportDeployResult = reportDeployResult;
 exports.resolveEntryUrl = resolveEntryUrl;
 exports.verifyConfigAgainstChain = verifyConfigAgainstChain;
 exports.verifySriForUrl = verifySriForUrl;