everything-dev 1.53.2 → 2.0.0-rc.0

package/dist/rollback.cjs

@@ -0,0 +1,131 @@
+let node_crypto = require("node:crypto");
+
+//#region src/rollback.ts
+function collectPinnedSlots(config) {
+	const slots = [];
+	const app = config.app;
+	const plugins = config.plugins;
+	const push = (slot, ref) => {
+		if (ref && typeof ref === "object") slots.push({
+			slot,
+			ref
+		});
+	};
+	if (app) {
+		for (const key of [
+			"host",
+			"ui",
+			"api",
+			"auth"
+		]) push(`app.${key}`, app[key]);
+		const auth = app.auth;
+		if (auth?.ui) push("app.auth.ui", auth.ui);
+	}
+	if (plugins) for (const [key, plugin] of Object.entries(plugins)) {
+		if (typeof plugin !== "object" || plugin === null) continue;
+		push(key, plugin);
+		const ui = plugin.ui;
+		if (ui) push(`${key}.ui`, ui);
+	}
+	return slots;
+}
+function pinOf(ref) {
+	const manifest = typeof ref.pin?.manifest === "string" ? ref.pin.manifest : void 0;
+	const integrity = typeof ref.pin?.integrity === "string" ? ref.pin.integrity : void 0;
+	return manifest && integrity ? {
+		manifest,
+		integrity
+	} : null;
+}
+/** Every pinned slot with both a production base and a verifiable pin. */
+function collectSlotPinRefs(config) {
+	return collectPinnedSlots(config).map(({ slot, ref }) => {
+		const pin = pinOf(ref);
+		const base = typeof ref.production === "string" ? ref.production : void 0;
+		return pin && base ? {
+			slot,
+			base,
+			pin
+		} : null;
+	}).filter((entry) => entry !== null);
+}
+async function verifySlot(slot, ref, fetchImpl) {
+	const base = typeof ref.production === "string" ? ref.production : void 0;
+	const pin = pinOf(ref);
+	if (!pin) return {
+		slot,
+		ok: true
+	};
+	const { manifest, integrity } = pin;
+	if (!base) return {
+		slot,
+		manifest,
+		ok: false,
+		reason: "no production URL to fetch the manifest from"
+	};
+	const manifestUrl = `${base.replace(/\/$/, "")}/${manifest.replace(/^\//, "")}`;
+	try {
+		const response = await fetchImpl(manifestUrl);
+		if (!response.ok) return {
+			slot,
+			manifest,
+			ok: false,
+			reason: `manifest fetch failed: ${response.status}`
+		};
+		const body = await response.text();
+		const computed = `sha384-${(0, node_crypto.createHash)("sha384").update(body).digest("base64")}`;
+		if (computed !== integrity) return {
+			slot,
+			manifest,
+			ok: false,
+			reason: `integrity mismatch for ${manifestUrl} (expected ${integrity}, computed ${computed})`
+		};
+		return {
+			slot,
+			manifest,
+			ok: true
+		};
+	} catch (error) {
+		return {
+			slot,
+			manifest,
+			ok: false,
+			reason: `manifest fetch failed: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+}
+async function verifyRollbackSnapshot(config, opts) {
+	const fetchImpl = opts?.fetchImpl ?? fetch;
+	const pinned = collectPinnedSlots(config).filter((entry) => pinOf(entry.ref) !== null);
+	if (pinned.length === 0) return {
+		verifiable: false,
+		ok: false,
+		slots: []
+	};
+	const slots = await Promise.all(pinned.map((entry) => verifySlot(entry.slot, entry.ref, fetchImpl)));
+	return {
+		verifiable: true,
+		ok: slots.every((check) => check.ok),
+		slots
+	};
+}
+function summarizeSlotPins(config) {
+	const pinned = collectPinnedSlots(config).map((entry) => {
+		const pin = pinOf(entry.ref);
+		return pin ? `${entry.slot}=${pin.manifest}` : null;
+	}).filter(Boolean);
+	return pinned.length > 0 ? pinned.join(" ") : "no version pins (pre-pin snapshot)";
+}
+function buildRollbackPayload(targetConfig, rolledBackFrom) {
+	return {
+		...targetConfig,
+		rolledBackFrom
+	};
+}
+
+//#endregion
+exports.buildRollbackPayload = buildRollbackPayload;
+exports.collectSlotPinRefs = collectSlotPinRefs;
+exports.summarizeSlotPins = summarizeSlotPins;
+exports.verifyRollbackSnapshot = verifyRollbackSnapshot;
+//# sourceMappingURL=rollback.cjs.map

package/dist/rollback.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback.cjs","names":["createHash"],"sources":["../src/rollback.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { BosConfigInput } from \"./types\";\n\n/**\n * Rollback safety gate (atomic-deploys 11): before republishing a historical\n * snapshot, every pinned slot's version manifest must still serve and match\n * its SRI — Phase A made bytes additive and retention is keep-everything, so\n * a verify failure means the pointer is broken, never publishable. Snapshots\n * from before the pin existed cannot be verified this way; they are allowed\n * only with an explicit force (their bytes were overwritten in place), with\n * the caller expected to warn loudly.\n */\n\nexport interface RollbackSlotCheck {\n  slot: string;\n  manifest?: string;\n  ok: boolean;\n  reason?: string;\n}\n\nexport interface RollbackVerification {\n  /** false = pre-pin snapshot with no verifiable pins (force required) */\n  verifiable: boolean;\n  ok: boolean;\n  slots: RollbackSlotCheck[];\n}\n\ninterface PinnedSlotRef {\n  production?: unknown;\n  pin?: { manifest?: unknown; integrity?: unknown };\n}\n\nfunction collectPinnedSlots(config: BosConfigInput): Array<{ slot: string; ref: PinnedSlotRef }> {\n  const slots: Array<{ slot: string; ref: PinnedSlotRef }> = [];\n  const app = config.app as Record<string, PinnedSlotRef | undefined> | undefined;\n  const plugins = config.plugins as Record<string, unknown> | undefined;\n\n  const push = (slot: string, ref: unknown): void => {\n    if (ref && typeof ref === \"object\") slots.push({ slot, ref: ref as PinnedSlotRef });\n  };\n\n  if (app) {\n    for (const key of [\"host\", \"ui\", \"api\", \"auth\"] as const) push(`app.${key}`, app[key]);\n    const auth = app.auth as { ui?: unknown } | undefined;\n    if (auth?.ui) push(\"app.auth.ui\", auth.ui);\n  }\n  if (plugins) {\n    for (const [key, plugin] of Object.entries(plugins)) {\n      if (typeof plugin !== \"object\" || plugin === null) continue;\n      push(key, plugin);\n      const ui = (plugin as { ui?: unknown }).ui;\n      if (ui) push(`${key}.ui`, ui);\n    }\n  }\n  return slots;\n}\n\nfunction pinOf(ref: PinnedSlotRef): { manifest: string; integrity: string } | null {\n  const manifest = typeof ref.pin?.manifest === \"string\" ? ref.pin.manifest : undefined;\n  const integrity = typeof ref.pin?.integrity === \"string\" ? ref.pin.integrity : undefined;\n  return manifest && integrity ? { manifest, integrity } : null;\n}\n\nexport interface SlotPinRef {\n  slot: string;\n  /** the slot's production base URL (…/bundles/<account>/<gateway>/<workspace>/) */\n  base: string;\n  pin: { manifest: string; integrity: string };\n}\n\n/** Every pinned slot with both a production base and a verifiable pin. */\nexport function collectSlotPinRefs(config: BosConfigInput): SlotPinRef[] {\n  return collectPinnedSlots(config)\n    .map(({ slot, ref }) => {\n      const pin = pinOf(ref);\n      const base = typeof ref.production === \"string\" ? ref.production : undefined;\n      return pin && base ? { slot, base, pin } : null;\n    })\n    .filter((entry): entry is SlotPinRef => entry !== null);\n}\n\nasync function verifySlot(\n  slot: string,\n  ref: PinnedSlotRef,\n  fetchImpl: typeof fetch,\n): Promise<RollbackSlotCheck> {\n  const base = typeof ref.production === \"string\" ? ref.production : undefined;\n  const pin = pinOf(ref);\n  if (!pin) return { slot, ok: true };\n  const { manifest, integrity } = pin;\n\n  if (!base)\n    return { slot, manifest, ok: false, reason: \"no production URL to fetch the manifest from\" };\n\n  const manifestUrl = `${base.replace(/\\/$/, \"\")}/${manifest.replace(/^\\//, \"\")}`;\n  try {\n    const response = await fetchImpl(manifestUrl);\n    if (!response.ok) {\n      return { slot, manifest, ok: false, reason: `manifest fetch failed: ${response.status}` };\n    }\n    const body = await response.text();\n    const computed = `sha384-${createHash(\"sha384\").update(body).digest(\"base64\")}`;\n    if (computed !== integrity) {\n      return {\n        slot,\n        manifest,\n        ok: false,\n        reason: `integrity mismatch for ${manifestUrl} (expected ${integrity}, computed ${computed})`,\n      };\n    }\n    return { slot, manifest, ok: true };\n  } catch (error) {\n    return {\n      slot,\n      manifest,\n      ok: false,\n      reason: `manifest fetch failed: ${error instanceof Error ? error.message : String(error)}`,\n    };\n  }\n}\n\nexport async function verifyRollbackSnapshot(\n  config: BosConfigInput,\n  opts?: { fetchImpl?: typeof fetch },\n): Promise<RollbackVerification> {\n  const fetchImpl = opts?.fetchImpl ?? fetch;\n  const pinned = collectPinnedSlots(config).filter((entry) => pinOf(entry.ref) !== null);\n\n  if (pinned.length === 0) {\n    return { verifiable: false, ok: false, slots: [] };\n  }\n\n  const slots = await Promise.all(\n    pinned.map((entry) => verifySlot(entry.slot, entry.ref, fetchImpl)),\n  );\n  return { verifiable: true, ok: slots.every((check) => check.ok), slots };\n}\n\nexport function summarizeSlotPins(config: BosConfigInput): string {\n  const pinned = collectPinnedSlots(config)\n    .map((entry) => {\n      const pin = pinOf(entry.ref);\n      return pin ? `${entry.slot}=${pin.manifest}` : null;\n    })\n    .filter(Boolean) as string[];\n  return pinned.length > 0 ? pinned.join(\" \") : \"no version pins (pre-pin snapshot)\";\n}\n\nexport function buildRollbackPayload<T extends Record<string, unknown>>(\n  targetConfig: T,\n  rolledBackFrom: string,\n): T {\n  return { ...targetConfig, rolledBackFrom } as T;\n}\n"],"mappings":";;;AAgCA,SAAS,mBAAmB,QAAqE;CAC/F,MAAM,QAAqD,CAAC;CAC5D,MAAM,MAAM,OAAO;CACnB,MAAM,UAAU,OAAO;CAEvB,MAAM,QAAQ,MAAc,QAAuB;EACjD,IAAI,OAAO,OAAO,QAAQ,UAAU,MAAM,KAAK;GAAE;GAAW;EAAqB,CAAC;CACpF;CAEA,IAAI,KAAK;EACP,KAAK,MAAM,OAAO;GAAC;GAAQ;GAAM;GAAO;EAAM,GAAY,KAAK,OAAO,OAAO,IAAI,IAAI;EACrF,MAAM,OAAO,IAAI;EACjB,IAAI,MAAM,IAAI,KAAK,eAAe,KAAK,EAAE;CAC3C;CACA,IAAI,SACF,KAAK,MAAM,CAAC,KAAK,WAAW,OAAO,QAAQ,OAAO,GAAG;EACnD,IAAI,OAAO,WAAW,YAAY,WAAW,MAAM;EACnD,KAAK,KAAK,MAAM;EAChB,MAAM,KAAM,OAA4B;EACxC,IAAI,IAAI,KAAK,GAAG,IAAI,MAAM,EAAE;CAC9B;CAEF,OAAO;AACT;AAEA,SAAS,MAAM,KAAoE;CACjF,MAAM,WAAW,OAAO,IAAI,KAAK,aAAa,WAAW,IAAI,IAAI,WAAW;CAC5E,MAAM,YAAY,OAAO,IAAI,KAAK,cAAc,WAAW,IAAI,IAAI,YAAY;CAC/E,OAAO,YAAY,YAAY;EAAE;EAAU;CAAU,IAAI;AAC3D;;AAUA,SAAgB,mBAAmB,QAAsC;CACvE,OAAO,mBAAmB,MAAM,CAAC,CAC9B,KAAK,EAAE,MAAM,UAAU;EACtB,MAAM,MAAM,MAAM,GAAG;EACrB,MAAM,OAAO,OAAO,IAAI,eAAe,WAAW,IAAI,aAAa;EACnE,OAAO,OAAO,OAAO;GAAE;GAAM;GAAM;EAAI,IAAI;CAC7C,CAAC,CAAC,CACD,QAAQ,UAA+B,UAAU,IAAI;AAC1D;AAEA,eAAe,WACb,MACA,KACA,WAC4B;CAC5B,MAAM,OAAO,OAAO,IAAI,eAAe,WAAW,IAAI,aAAa;CACnE,MAAM,MAAM,MAAM,GAAG;CACrB,IAAI,CAAC,KAAK,OAAO;EAAE;EAAM,IAAI;CAAK;CAClC,MAAM,EAAE,UAAU,cAAc;CAEhC,IAAI,CAAC,MACH,OAAO;EAAE;EAAM;EAAU,IAAI;EAAO,QAAQ;CAA+C;CAE7F,MAAM,cAAc,GAAG,KAAK,QAAQ,OAAO,EAAE,EAAE,GAAG,SAAS,QAAQ,OAAO,EAAE;CAC5E,IAAI;EACF,MAAM,WAAW,MAAM,UAAU,WAAW;EAC5C,IAAI,CAAC,SAAS,IACZ,OAAO;GAAE;GAAM;GAAU,IAAI;GAAO,QAAQ,0BAA0B,SAAS;EAAS;EAE1F,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,WAAW,cAAUA,wBAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,QAAQ;EAC5E,IAAI,aAAa,WACf,OAAO;GACL;GACA;GACA,IAAI;GACJ,QAAQ,0BAA0B,YAAY,aAAa,UAAU,aAAa,SAAS;EAC7F;EAEF,OAAO;GAAE;GAAM;GAAU,IAAI;EAAK;CACpC,SAAS,OAAO;EACd,OAAO;GACL;GACA;GACA,IAAI;GACJ,QAAQ,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACzF;CACF;AACF;AAEA,eAAsB,uBACpB,QACA,MAC+B;CAC/B,MAAM,YAAY,MAAM,aAAa;CACrC,MAAM,SAAS,mBAAmB,MAAM,CAAC,CAAC,QAAQ,UAAU,MAAM,MAAM,GAAG,MAAM,IAAI;CAErF,IAAI,OAAO,WAAW,GACpB,OAAO;EAAE,YAAY;EAAO,IAAI;EAAO,OAAO,CAAC;CAAE;CAGnD,MAAM,QAAQ,MAAM,QAAQ,IAC1B,OAAO,KAAK,UAAU,WAAW,MAAM,MAAM,MAAM,KAAK,SAAS,CAAC,CACpE;CACA,OAAO;EAAE,YAAY;EAAM,IAAI,MAAM,OAAO,UAAU,MAAM,EAAE;EAAG;CAAM;AACzE;AAEA,SAAgB,kBAAkB,QAAgC;CAChE,MAAM,SAAS,mBAAmB,MAAM,CAAC,CACtC,KAAK,UAAU;EACd,MAAM,MAAM,MAAM,MAAM,GAAG;EAC3B,OAAO,MAAM,GAAG,MAAM,KAAK,GAAG,IAAI,aAAa;CACjD,CAAC,CAAC,CACD,OAAO,OAAO;CACjB,OAAO,OAAO,SAAS,IAAI,OAAO,KAAK,GAAG,IAAI;AAChD;AAEA,SAAgB,qBACd,cACA,gBACG;CACH,OAAO;EAAE,GAAG;EAAc;CAAe;AAC3C"}

package/dist/rollback.mjs

@@ -0,0 +1,128 @@
+import { createHash } from "node:crypto";
+
+//#region src/rollback.ts
+function collectPinnedSlots(config) {
+	const slots = [];
+	const app = config.app;
+	const plugins = config.plugins;
+	const push = (slot, ref) => {
+		if (ref && typeof ref === "object") slots.push({
+			slot,
+			ref
+		});
+	};
+	if (app) {
+		for (const key of [
+			"host",
+			"ui",
+			"api",
+			"auth"
+		]) push(`app.${key}`, app[key]);
+		const auth = app.auth;
+		if (auth?.ui) push("app.auth.ui", auth.ui);
+	}
+	if (plugins) for (const [key, plugin] of Object.entries(plugins)) {
+		if (typeof plugin !== "object" || plugin === null) continue;
+		push(key, plugin);
+		const ui = plugin.ui;
+		if (ui) push(`${key}.ui`, ui);
+	}
+	return slots;
+}
+function pinOf(ref) {
+	const manifest = typeof ref.pin?.manifest === "string" ? ref.pin.manifest : void 0;
+	const integrity = typeof ref.pin?.integrity === "string" ? ref.pin.integrity : void 0;
+	return manifest && integrity ? {
+		manifest,
+		integrity
+	} : null;
+}
+/** Every pinned slot with both a production base and a verifiable pin. */
+function collectSlotPinRefs(config) {
+	return collectPinnedSlots(config).map(({ slot, ref }) => {
+		const pin = pinOf(ref);
+		const base = typeof ref.production === "string" ? ref.production : void 0;
+		return pin && base ? {
+			slot,
+			base,
+			pin
+		} : null;
+	}).filter((entry) => entry !== null);
+}
+async function verifySlot(slot, ref, fetchImpl) {
+	const base = typeof ref.production === "string" ? ref.production : void 0;
+	const pin = pinOf(ref);
+	if (!pin) return {
+		slot,
+		ok: true
+	};
+	const { manifest, integrity } = pin;
+	if (!base) return {
+		slot,
+		manifest,
+		ok: false,
+		reason: "no production URL to fetch the manifest from"
+	};
+	const manifestUrl = `${base.replace(/\/$/, "")}/${manifest.replace(/^\//, "")}`;
+	try {
+		const response = await fetchImpl(manifestUrl);
+		if (!response.ok) return {
+			slot,
+			manifest,
+			ok: false,
+			reason: `manifest fetch failed: ${response.status}`
+		};
+		const body = await response.text();
+		const computed = `sha384-${createHash("sha384").update(body).digest("base64")}`;
+		if (computed !== integrity) return {
+			slot,
+			manifest,
+			ok: false,
+			reason: `integrity mismatch for ${manifestUrl} (expected ${integrity}, computed ${computed})`
+		};
+		return {
+			slot,
+			manifest,
+			ok: true
+		};
+	} catch (error) {
+		return {
+			slot,
+			manifest,
+			ok: false,
+			reason: `manifest fetch failed: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+}
+async function verifyRollbackSnapshot(config, opts) {
+	const fetchImpl = opts?.fetchImpl ?? fetch;
+	const pinned = collectPinnedSlots(config).filter((entry) => pinOf(entry.ref) !== null);
+	if (pinned.length === 0) return {
+		verifiable: false,
+		ok: false,
+		slots: []
+	};
+	const slots = await Promise.all(pinned.map((entry) => verifySlot(entry.slot, entry.ref, fetchImpl)));
+	return {
+		verifiable: true,
+		ok: slots.every((check) => check.ok),
+		slots
+	};
+}
+function summarizeSlotPins(config) {
+	const pinned = collectPinnedSlots(config).map((entry) => {
+		const pin = pinOf(entry.ref);
+		return pin ? `${entry.slot}=${pin.manifest}` : null;
+	}).filter(Boolean);
+	return pinned.length > 0 ? pinned.join(" ") : "no version pins (pre-pin snapshot)";
+}
+function buildRollbackPayload(targetConfig, rolledBackFrom) {
+	return {
+		...targetConfig,
+		rolledBackFrom
+	};
+}
+
+//#endregion
+export { buildRollbackPayload, collectSlotPinRefs, summarizeSlotPins, verifyRollbackSnapshot };
+//# sourceMappingURL=rollback.mjs.map

package/dist/rollback.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback.mjs","names":[],"sources":["../src/rollback.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { BosConfigInput } from \"./types\";\n\n/**\n * Rollback safety gate (atomic-deploys 11): before republishing a historical\n * snapshot, every pinned slot's version manifest must still serve and match\n * its SRI — Phase A made bytes additive and retention is keep-everything, so\n * a verify failure means the pointer is broken, never publishable. Snapshots\n * from before the pin existed cannot be verified this way; they are allowed\n * only with an explicit force (their bytes were overwritten in place), with\n * the caller expected to warn loudly.\n */\n\nexport interface RollbackSlotCheck {\n  slot: string;\n  manifest?: string;\n  ok: boolean;\n  reason?: string;\n}\n\nexport interface RollbackVerification {\n  /** false = pre-pin snapshot with no verifiable pins (force required) */\n  verifiable: boolean;\n  ok: boolean;\n  slots: RollbackSlotCheck[];\n}\n\ninterface PinnedSlotRef {\n  production?: unknown;\n  pin?: { manifest?: unknown; integrity?: unknown };\n}\n\nfunction collectPinnedSlots(config: BosConfigInput): Array<{ slot: string; ref: PinnedSlotRef }> {\n  const slots: Array<{ slot: string; ref: PinnedSlotRef }> = [];\n  const app = config.app as Record<string, PinnedSlotRef | undefined> | undefined;\n  const plugins = config.plugins as Record<string, unknown> | undefined;\n\n  const push = (slot: string, ref: unknown): void => {\n    if (ref && typeof ref === \"object\") slots.push({ slot, ref: ref as PinnedSlotRef });\n  };\n\n  if (app) {\n    for (const key of [\"host\", \"ui\", \"api\", \"auth\"] as const) push(`app.${key}`, app[key]);\n    const auth = app.auth as { ui?: unknown } | undefined;\n    if (auth?.ui) push(\"app.auth.ui\", auth.ui);\n  }\n  if (plugins) {\n    for (const [key, plugin] of Object.entries(plugins)) {\n      if (typeof plugin !== \"object\" || plugin === null) continue;\n      push(key, plugin);\n      const ui = (plugin as { ui?: unknown }).ui;\n      if (ui) push(`${key}.ui`, ui);\n    }\n  }\n  return slots;\n}\n\nfunction pinOf(ref: PinnedSlotRef): { manifest: string; integrity: string } | null {\n  const manifest = typeof ref.pin?.manifest === \"string\" ? ref.pin.manifest : undefined;\n  const integrity = typeof ref.pin?.integrity === \"string\" ? ref.pin.integrity : undefined;\n  return manifest && integrity ? { manifest, integrity } : null;\n}\n\nexport interface SlotPinRef {\n  slot: string;\n  /** the slot's production base URL (…/bundles/<account>/<gateway>/<workspace>/) */\n  base: string;\n  pin: { manifest: string; integrity: string };\n}\n\n/** Every pinned slot with both a production base and a verifiable pin. */\nexport function collectSlotPinRefs(config: BosConfigInput): SlotPinRef[] {\n  return collectPinnedSlots(config)\n    .map(({ slot, ref }) => {\n      const pin = pinOf(ref);\n      const base = typeof ref.production === \"string\" ? ref.production : undefined;\n      return pin && base ? { slot, base, pin } : null;\n    })\n    .filter((entry): entry is SlotPinRef => entry !== null);\n}\n\nasync function verifySlot(\n  slot: string,\n  ref: PinnedSlotRef,\n  fetchImpl: typeof fetch,\n): Promise<RollbackSlotCheck> {\n  const base = typeof ref.production === \"string\" ? ref.production : undefined;\n  const pin = pinOf(ref);\n  if (!pin) return { slot, ok: true };\n  const { manifest, integrity } = pin;\n\n  if (!base)\n    return { slot, manifest, ok: false, reason: \"no production URL to fetch the manifest from\" };\n\n  const manifestUrl = `${base.replace(/\\/$/, \"\")}/${manifest.replace(/^\\//, \"\")}`;\n  try {\n    const response = await fetchImpl(manifestUrl);\n    if (!response.ok) {\n      return { slot, manifest, ok: false, reason: `manifest fetch failed: ${response.status}` };\n    }\n    const body = await response.text();\n    const computed = `sha384-${createHash(\"sha384\").update(body).digest(\"base64\")}`;\n    if (computed !== integrity) {\n      return {\n        slot,\n        manifest,\n        ok: false,\n        reason: `integrity mismatch for ${manifestUrl} (expected ${integrity}, computed ${computed})`,\n      };\n    }\n    return { slot, manifest, ok: true };\n  } catch (error) {\n    return {\n      slot,\n      manifest,\n      ok: false,\n      reason: `manifest fetch failed: ${error instanceof Error ? error.message : String(error)}`,\n    };\n  }\n}\n\nexport async function verifyRollbackSnapshot(\n  config: BosConfigInput,\n  opts?: { fetchImpl?: typeof fetch },\n): Promise<RollbackVerification> {\n  const fetchImpl = opts?.fetchImpl ?? fetch;\n  const pinned = collectPinnedSlots(config).filter((entry) => pinOf(entry.ref) !== null);\n\n  if (pinned.length === 0) {\n    return { verifiable: false, ok: false, slots: [] };\n  }\n\n  const slots = await Promise.all(\n    pinned.map((entry) => verifySlot(entry.slot, entry.ref, fetchImpl)),\n  );\n  return { verifiable: true, ok: slots.every((check) => check.ok), slots };\n}\n\nexport function summarizeSlotPins(config: BosConfigInput): string {\n  const pinned = collectPinnedSlots(config)\n    .map((entry) => {\n      const pin = pinOf(entry.ref);\n      return pin ? `${entry.slot}=${pin.manifest}` : null;\n    })\n    .filter(Boolean) as string[];\n  return pinned.length > 0 ? pinned.join(\" \") : \"no version pins (pre-pin snapshot)\";\n}\n\nexport function buildRollbackPayload<T extends Record<string, unknown>>(\n  targetConfig: T,\n  rolledBackFrom: string,\n): T {\n  return { ...targetConfig, rolledBackFrom } as T;\n}\n"],"mappings":";;;AAgCA,SAAS,mBAAmB,QAAqE;CAC/F,MAAM,QAAqD,CAAC;CAC5D,MAAM,MAAM,OAAO;CACnB,MAAM,UAAU,OAAO;CAEvB,MAAM,QAAQ,MAAc,QAAuB;EACjD,IAAI,OAAO,OAAO,QAAQ,UAAU,MAAM,KAAK;GAAE;GAAW;EAAqB,CAAC;CACpF;CAEA,IAAI,KAAK;EACP,KAAK,MAAM,OAAO;GAAC;GAAQ;GAAM;GAAO;EAAM,GAAY,KAAK,OAAO,OAAO,IAAI,IAAI;EACrF,MAAM,OAAO,IAAI;EACjB,IAAI,MAAM,IAAI,KAAK,eAAe,KAAK,EAAE;CAC3C;CACA,IAAI,SACF,KAAK,MAAM,CAAC,KAAK,WAAW,OAAO,QAAQ,OAAO,GAAG;EACnD,IAAI,OAAO,WAAW,YAAY,WAAW,MAAM;EACnD,KAAK,KAAK,MAAM;EAChB,MAAM,KAAM,OAA4B;EACxC,IAAI,IAAI,KAAK,GAAG,IAAI,MAAM,EAAE;CAC9B;CAEF,OAAO;AACT;AAEA,SAAS,MAAM,KAAoE;CACjF,MAAM,WAAW,OAAO,IAAI,KAAK,aAAa,WAAW,IAAI,IAAI,WAAW;CAC5E,MAAM,YAAY,OAAO,IAAI,KAAK,cAAc,WAAW,IAAI,IAAI,YAAY;CAC/E,OAAO,YAAY,YAAY;EAAE;EAAU;CAAU,IAAI;AAC3D;;AAUA,SAAgB,mBAAmB,QAAsC;CACvE,OAAO,mBAAmB,MAAM,CAAC,CAC9B,KAAK,EAAE,MAAM,UAAU;EACtB,MAAM,MAAM,MAAM,GAAG;EACrB,MAAM,OAAO,OAAO,IAAI,eAAe,WAAW,IAAI,aAAa;EACnE,OAAO,OAAO,OAAO;GAAE;GAAM;GAAM;EAAI,IAAI;CAC7C,CAAC,CAAC,CACD,QAAQ,UAA+B,UAAU,IAAI;AAC1D;AAEA,eAAe,WACb,MACA,KACA,WAC4B;CAC5B,MAAM,OAAO,OAAO,IAAI,eAAe,WAAW,IAAI,aAAa;CACnE,MAAM,MAAM,MAAM,GAAG;CACrB,IAAI,CAAC,KAAK,OAAO;EAAE;EAAM,IAAI;CAAK;CAClC,MAAM,EAAE,UAAU,cAAc;CAEhC,IAAI,CAAC,MACH,OAAO;EAAE;EAAM;EAAU,IAAI;EAAO,QAAQ;CAA+C;CAE7F,MAAM,cAAc,GAAG,KAAK,QAAQ,OAAO,EAAE,EAAE,GAAG,SAAS,QAAQ,OAAO,EAAE;CAC5E,IAAI;EACF,MAAM,WAAW,MAAM,UAAU,WAAW;EAC5C,IAAI,CAAC,SAAS,IACZ,OAAO;GAAE;GAAM;GAAU,IAAI;GAAO,QAAQ,0BAA0B,SAAS;EAAS;EAE1F,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,WAAW,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,QAAQ;EAC5E,IAAI,aAAa,WACf,OAAO;GACL;GACA;GACA,IAAI;GACJ,QAAQ,0BAA0B,YAAY,aAAa,UAAU,aAAa,SAAS;EAC7F;EAEF,OAAO;GAAE;GAAM;GAAU,IAAI;EAAK;CACpC,SAAS,OAAO;EACd,OAAO;GACL;GACA;GACA,IAAI;GACJ,QAAQ,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACzF;CACF;AACF;AAEA,eAAsB,uBACpB,QACA,MAC+B;CAC/B,MAAM,YAAY,MAAM,aAAa;CACrC,MAAM,SAAS,mBAAmB,MAAM,CAAC,CAAC,QAAQ,UAAU,MAAM,MAAM,GAAG,MAAM,IAAI;CAErF,IAAI,OAAO,WAAW,GACpB,OAAO;EAAE,YAAY;EAAO,IAAI;EAAO,OAAO,CAAC;CAAE;CAGnD,MAAM,QAAQ,MAAM,QAAQ,IAC1B,OAAO,KAAK,UAAU,WAAW,MAAM,MAAM,MAAM,KAAK,SAAS,CAAC,CACpE;CACA,OAAO;EAAE,YAAY;EAAM,IAAI,MAAM,OAAO,UAAU,MAAM,EAAE;EAAG;CAAM;AACzE;AAEA,SAAgB,kBAAkB,QAAgC;CAChE,MAAM,SAAS,mBAAmB,MAAM,CAAC,CACtC,KAAK,UAAU;EACd,MAAM,MAAM,MAAM,MAAM,GAAG;EAC3B,OAAO,MAAM,GAAG,MAAM,KAAK,GAAG,IAAI,aAAa;CACjD,CAAC,CAAC,CACD,OAAO,OAAO;CACjB,OAAO,OAAO,SAAS,IAAI,OAAO,KAAK,GAAG,IAAI;AAChD;AAEA,SAAgB,qBACd,cACA,gBACG;CACH,OAAO;EAAE,GAAG;EAAc;CAAe;AAC3C"}

package/dist/sdk.cjs

@@ -1,25 +1,25 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+let effect = require("effect");
 let zod = require("zod");
+let _orpc_contract = require("@orpc/contract");
 let every_plugin = require("every-plugin");
-let every_plugin_effect = require("every-plugin/effect");
-let every_plugin_orpc = require("every-plugin/orpc");
 
 Object.defineProperty(exports, 'Context', {
   enumerable: true,
   get: function () {
-    return every_plugin_effect.Context;
+    return effect.Context;
   }
 });
 Object.defineProperty(exports, 'Effect', {
   enumerable: true,
   get: function () {
-    return every_plugin_effect.Effect;
+    return effect.Effect;
   }
 });
 Object.defineProperty(exports, 'Layer', {
   enumerable: true,
   get: function () {
-    return every_plugin_effect.Layer;
+    return effect.Layer;
   }
 });
 Object.defineProperty(exports, 'PluginRuntime', {
@@ -31,7 +31,7 @@ Object.defineProperty(exports, 'PluginRuntime', {
 Object.defineProperty(exports, 'Scope', {
   enumerable: true,
   get: function () {
-    return every_plugin_effect.Scope;
+    return effect.Scope;
   }
 });
 Object.defineProperty(exports, 'createPlugin', {
@@ -49,7 +49,7 @@ Object.defineProperty(exports, 'createPluginRuntime', {
 Object.defineProperty(exports, 'oc', {
   enumerable: true,
   get: function () {
-    return every_plugin_orpc.oc;
+    return _orpc_contract.oc;
   }
 });
 Object.defineProperty(exports, 'z', {

package/dist/sdk.d.cts

@@ -1,5 +1,5 @@
 import { z } from "zod";
+import { Context, Effect, Layer, Scope } from "effect";
+import { AnySchema, RouterContract, oc } from "@orpc/contract";
 import { LoadedPluginWithBinding, Plugin, PluginRuntime, createPlugin, createPluginRuntime } from "every-plugin";
-import { Context, Effect, Layer, Scope } from "every-plugin/effect";
-import { AnyContractRouter, AnySchema, oc } from "every-plugin/orpc";
-export { type AnyContractRouter, type AnySchema, Context, Effect, Layer, type LoadedPluginWithBinding, type Plugin, PluginRuntime, Scope, createPlugin, createPluginRuntime, oc, z };
+export { type AnySchema, Context, Effect, Layer, type LoadedPluginWithBinding, type Plugin, PluginRuntime, type RouterContract, Scope, createPlugin, createPluginRuntime, oc, z };

package/dist/sdk.d.mts

@@ -1,5 +1,5 @@
+import { Context, Effect, Layer, Scope } from "effect";
 import { z } from "zod";
+import { AnySchema, RouterContract, oc } from "@orpc/contract";
 import { LoadedPluginWithBinding, Plugin, PluginRuntime, createPlugin, createPluginRuntime } from "every-plugin";
-import { Context, Effect, Layer, Scope } from "every-plugin/effect";
-import { AnyContractRouter, AnySchema, oc } from "every-plugin/orpc";
-export { type AnyContractRouter, type AnySchema, Context, Effect, Layer, type LoadedPluginWithBinding, type Plugin, PluginRuntime, Scope, createPlugin, createPluginRuntime, oc, z };
+export { type AnySchema, Context, Effect, Layer, type LoadedPluginWithBinding, type Plugin, PluginRuntime, type RouterContract, Scope, createPlugin, createPluginRuntime, oc, z };

package/dist/sdk.mjs

@@ -1,6 +1,6 @@
+import { Context, Effect, Layer, Scope } from "effect";
 import { z } from "zod";
+import { oc } from "@orpc/contract";
 import { PluginRuntime, createPlugin, createPluginRuntime } from "every-plugin";
-import { Context, Effect, Layer, Scope } from "every-plugin/effect";
-import { oc } from "every-plugin/orpc";
 
 export { Context, Effect, Layer, PluginRuntime, Scope, createPlugin, createPluginRuntime, oc, z };

package/dist/service-descriptor.cjs

@@ -1,30 +1,57 @@
+const require_runtime = require('./_virtual/_rolldown/runtime.cjs');
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path, 1);
 let effect = require("effect");
 
 //#region src/service-descriptor.ts
-var ServiceDescriptorMap = class extends effect.Context.Tag("ServiceDescriptorMap")() {};
-var DevRuntimeConfig = class extends effect.Context.Tag("DevRuntimeConfig")() {};
+/**
+* True when a `plugins.<id>` entry is the runtime-config mirror of the
+* app-slot auth plugin (same backend target) — the `auth` service already
+* spawns that backend, so the mirror contributes only its `ui` surface.
+* The single implementation; consumed by the service descriptors, the DAG,
+* the infra planner, and the dev session.
+*/
+function isAuthMirrorPluginEntry(authEntry, pluginId, pluginConfig) {
+	if (pluginId !== "auth" || !authEntry) return false;
+	if (pluginConfig === authEntry) return true;
+	if (pluginConfig.localPath && pluginConfig.localPath === authEntry.localPath) return true;
+	if (!pluginConfig.localPath && pluginConfig.source === "remote" && pluginConfig.url && pluginConfig.url === authEntry.url) return true;
+	return false;
+}
+var ServiceDescriptorMap = class extends effect.Context.Service()("ServiceDescriptorMap") {};
+var DevRuntimeConfig = class extends effect.Context.Service()("DevRuntimeConfig") {};
+var DevGeneratedEnv = class extends effect.Context.Service()("DevGeneratedEnv") {};
+const DevGeneratedEnvLive = (env) => effect.Layer.succeed(DevGeneratedEnv, env);
 const PLUGIN_READY_PATTERNS = [
 	/ready in/i,
 	/compiled.*successfully/i,
 	/listening/i,
 	/started/i
 ];
-const PLUGIN_ERROR_PATTERNS = [/error/i, /failed/i];
+const PLUGIN_ERROR_PATTERNS = [
+	/\bERROR in\b/,
+	/failed to compile/i,
+	/Module not found/i,
+	/Cannot find module/i
+];
 const SERVICE_CONFIGS = {
 	host: {
-		command: "bun",
+		command: "pnpm",
 		args: ["run", "dev"],
+		env: { NODE_OPTIONS: "--conditions=development" },
 		readyPatterns: [/Host (dev|production) server running at/i, /Server running at/i],
 		errorPatterns: [
-			/error:/i,
-			/failed/i,
+			/\berror\b(?!s)/i,
+			/\bfailed to\b/i,
+			/\bbuild failed\b/i,
 			/exception/i
 		],
 		defaultPort: 3e3,
 		readinessPath: "/health"
 	},
 	auth: {
-		command: "bun",
+		command: "pnpm",
 		args: ["run", "dev"],
 		readyPatterns: PLUGIN_READY_PATTERNS,
 		errorPatterns: PLUGIN_ERROR_PATTERNS,
@@ -32,27 +59,23 @@ const SERVICE_CONFIGS = {
 		readinessPath: "/remoteEntry.js"
 	},
 	ui: {
-		command: "bun",
+		command: "pnpm",
 		args: ["run", "dev"],
 		readyPatterns: [
 			/\bready\s+built in\b/i,
 			/\bLocal:\b/i,
 			/\bcompiled\b.*successfully/i
 		],
-		errorPatterns: [/error/i, /failed to compile/i],
+		errorPatterns: [
+			/\berror\b(?!s)/i,
+			/\bfailed to\b/i,
+			/\bbuild failed\b/i
+		],
 		defaultPort: 3003,
 		readinessPath: "/remoteEntry.js"
 	},
-	"ui-ssr": {
-		command: "bun",
-		args: ["run", "dev:ssr"],
-		readyPatterns: [/\bready\s+built in\b/i, /\bcompiled\b.*successfully/i],
-		errorPatterns: [/error/i, /failed/i],
-		defaultPort: 3004,
-		readinessPath: "/"
-	},
 	api: {
-		command: "bun",
+		command: "pnpm",
 		args: ["run", "dev"],
 		readyPatterns: PLUGIN_READY_PATTERNS,
 		errorPatterns: PLUGIN_ERROR_PATTERNS,
@@ -89,17 +112,9 @@ function buildServiceDescriptorMap(runtimeConfig, options) {
 		port: runtimeConfig.ui.port,
 		integrity: runtimeConfig.ui.integrity,
 		ssr,
-		...SERVICE_CONFIGS.ui
-	});
-	if (ssr && runtimeConfig.ui.source === "local") map.set("ui-ssr", {
-		key: "ui-ssr",
-		source: runtimeConfig.ui.source,
-		url: runtimeConfig.ui.ssrUrl ?? "",
-		entry: "",
-		name: "ui-ssr",
-		localPath: runtimeConfig.ui.localPath,
-		port: runtimeConfig.ui.ssrUrl ? Number.parseInt(new URL(runtimeConfig.ui.ssrUrl).port, 10) : (runtimeConfig.ui.port ?? 3003) + 1,
-		...SERVICE_CONFIGS["ui-ssr"]
+		...SERVICE_CONFIGS.ui,
+		env: { BOS_DEV_SERVER: "1" },
+		args: process.env.BOS_NO_WATCH === "1" ? ["run", "dev:built"] : SERVICE_CONFIGS.ui.args
 	});
 	map.set("api", {
 		key: "api",
@@ -134,10 +149,15 @@ function buildServiceDescriptorMap(runtimeConfig, options) {
 	if (runtimeConfig.plugins) {
 		let pluginBasePort = 3010;
 		for (const [pluginId, pluginConfig] of Object.entries(runtimeConfig.plugins)) {
+			const isAuthMirror = isAuthMirrorPluginEntry(runtimeConfig.auth, pluginId, pluginConfig);
 			const pluginKey = `plugin:${pluginId}`;
 			const resolvedPort = pluginConfig.port ?? pluginBasePort;
 			pluginBasePort = resolvedPort + 1;
-			map.set(pluginKey, {
+			const uiLocalPath = pluginConfig.ui?.localPath;
+			const isFolderFormUi = Boolean(uiLocalPath && pluginConfig.ui?.source === "local" && (0, node_fs.existsSync)(node_path.default.join(uiLocalPath, "src", "routes")) && !(0, node_fs.existsSync)(node_path.default.join(uiLocalPath, "package.json")));
+			const folderUiPort = pluginConfig.ui?.port ?? pluginBasePort;
+			if (isFolderFormUi) pluginBasePort = folderUiPort + 1;
+			if (!isAuthMirror) map.set(pluginKey, {
 				key: pluginKey,
 				source: pluginConfig.source,
 				url: pluginConfig.url,
@@ -150,14 +170,24 @@ function buildServiceDescriptorMap(runtimeConfig, options) {
 				proxy: pluginConfig.proxy,
 				variables: pluginConfig.variables,
 				secrets: pluginConfig.secrets,
-				command: "bun",
+				command: "pnpm",
 				args: ["run", "dev"],
+				env: isFolderFormUi ? { BOS_UI_PORT: String(folderUiPort) } : void 0,
+				uiPort: isFolderFormUi ? folderUiPort : void 0,
 				readyPatterns: PLUGIN_READY_PATTERNS,
 				errorPatterns: PLUGIN_ERROR_PATTERNS,
 				defaultPort: resolvedPort,
 				readinessPath: "/remoteEntry.js"
 			});
-			if (pluginConfig.ui?.localPath && pluginConfig.ui.source === "local") {
+			else if (isFolderFormUi) {
+				const authDescriptor = map.get("auth");
+				if (authDescriptor) map.set("auth", {
+					...authDescriptor,
+					env: { BOS_UI_PORT: String(folderUiPort) },
+					uiPort: folderUiPort
+				});
+			}
+			if (pluginConfig.ui?.localPath && pluginConfig.ui.source === "local" && !isFolderFormUi) {
 				const uiKey = `plugin-ui:${pluginId}`;
 				const uiPort = pluginConfig.ui.port ?? pluginBasePort;
 				pluginBasePort = uiPort + 1;
@@ -170,7 +200,7 @@ function buildServiceDescriptorMap(runtimeConfig, options) {
 					localPath: pluginConfig.ui.localPath,
 					port: uiPort,
 					integrity: pluginConfig.ui.integrity,
-					command: "bun",
+					command: "pnpm",
 					args: ["run", "dev"],
 					readyPatterns: PLUGIN_READY_PATTERNS,
 					errorPatterns: PLUGIN_ERROR_PATTERNS,
@@ -188,7 +218,7 @@ function buildServiceDescriptorMapFromPlan(plan, options) {
 	return buildServiceDescriptorMap(plan.runtimeConfig, options);
 }
 function buildDescription(map) {
-	const descriptors = [...map.values()].filter((d) => d.key !== "ui-ssr" && !d.key.startsWith("plugin:"));
+	const descriptors = [...map.values()].filter((d) => !d.key.startsWith("plugin:"));
 	const allLocal = descriptors.every((d) => d.source === "local");
 	const hasProxy = [...map.values()].some((d) => d.proxy && d.source === "local");
 	if (allLocal && !hasProxy) return "Full Local Development";
@@ -202,6 +232,8 @@ function buildDescription(map) {
 }
 
 //#endregion
+exports.DevGeneratedEnv = DevGeneratedEnv;
+exports.DevGeneratedEnvLive = DevGeneratedEnvLive;
 exports.DevRuntimeConfig = DevRuntimeConfig;
 exports.DevRuntimeConfigLive = DevRuntimeConfigLive;
 exports.ServiceDescriptorMap = ServiceDescriptorMap;
@@ -209,4 +241,5 @@ exports.ServiceDescriptorMapLive = ServiceDescriptorMapLive;
 exports.buildDescription = buildDescription;
 exports.buildServiceDescriptorMap = buildServiceDescriptorMap;
 exports.buildServiceDescriptorMapFromPlan = buildServiceDescriptorMapFromPlan;
+exports.isAuthMirrorPluginEntry = isAuthMirrorPluginEntry;
 //# sourceMappingURL=service-descriptor.cjs.map

package/dist/service-descriptor.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"service-descriptor.cjs","names":["Context","Layer"],"sources":["../src/service-descriptor.ts"],"sourcesContent":["import { Context, Layer } from \"effect\";\nimport type { JsonObject, RuntimeConfig, SourceMode } from \"./types\";\n\nexport interface ServiceDescriptor {\n  key: string;\n  source: SourceMode;\n  url: string;\n  remoteUrl?: string;\n  entry: string;\n  name: string;\n  localPath?: string;\n  port?: number;\n  readinessPath: string;\n  defaultPort: number;\n  integrity?: string;\n  proxy?: string;\n  variables?: JsonObject;\n  secrets?: string[];\n  ssr?: boolean;\n  command?: string;\n  args?: string[];\n  readyPatterns?: RegExp[];\n  errorPatterns?: RegExp[];\n}\n\nexport class ServiceDescriptorMap extends Context.Tag(\"ServiceDescriptorMap\")<\n  ServiceDescriptorMap,\n  Map<string, ServiceDescriptor>\n>() {}\n\nexport class DevRuntimeConfig extends Context.Tag(\"DevRuntimeConfig\")<\n  DevRuntimeConfig,\n  RuntimeConfig\n>() {}\n\nconst PLUGIN_READY_PATTERNS = [/ready in/i, /compiled.*successfully/i, /listening/i, /started/i];\n\nconst PLUGIN_ERROR_PATTERNS = [/error/i, /failed/i];\n\nconst SERVICE_CONFIGS: Record<\n  string,\n  Pick<\n    ServiceDescriptor,\n    \"command\" | \"args\" | \"readyPatterns\" | \"errorPatterns\" | \"defaultPort\" | \"readinessPath\"\n  >\n> = {\n  host: {\n    command: \"bun\",\n    args: [\"run\", \"dev\"],\n    readyPatterns: [/Host (dev|production) server running at/i, /Server running at/i],\n    errorPatterns: [/error:/i, /failed/i, /exception/i],\n    defaultPort: 3000,\n    readinessPath: \"/health\",\n  },\n  auth: {\n    command: \"bun\",\n    args: [\"run\", \"dev\"],\n    readyPatterns: PLUGIN_READY_PATTERNS,\n    errorPatterns: PLUGIN_ERROR_PATTERNS,\n    defaultPort: 3002,\n    readinessPath: \"/remoteEntry.js\",\n  },\n  ui: {\n    command: \"bun\",\n    args: [\"run\", \"dev\"],\n    readyPatterns: [/\\bready\\s+built in\\b/i, /\\bLocal:\\b/i, /\\bcompiled\\b.*successfully/i],\n    errorPatterns: [/error/i, /failed to compile/i],\n    defaultPort: 3003,\n    readinessPath: \"/remoteEntry.js\",\n  },\n  \"ui-ssr\": {\n    command: \"bun\",\n    args: [\"run\", \"dev:ssr\"],\n    readyPatterns: [/\\bready\\s+built in\\b/i, /\\bcompiled\\b.*successfully/i],\n    errorPatterns: [/error/i, /failed/i],\n    defaultPort: 3004,\n    readinessPath: \"/\",\n  },\n  api: {\n    command: \"bun\",\n    args: [\"run\", \"dev\"],\n    readyPatterns: PLUGIN_READY_PATTERNS,\n    errorPatterns: PLUGIN_ERROR_PATTERNS,\n    defaultPort: 3001,\n    readinessPath: \"/remoteEntry.js\",\n  },\n};\n\nexport function buildServiceDescriptorMap(\n  runtimeConfig: RuntimeConfig,\n  options?: { ssr?: boolean; proxy?: boolean },\n): Map<string, ServiceDescriptor> {\n  const map = new Map<string, ServiceDescriptor>();\n  const ssr = options?.ssr ?? false;\n\n  const hostIsRemote = runtimeConfig.host.source === \"remote\";\n  const hostProbeUrl = hostIsRemote\n    ? (runtimeConfig.host.remoteUrl ?? runtimeConfig.host.url)\n    : runtimeConfig.host.url;\n  map.set(\"host\", {\n    key: \"host\",\n    source: runtimeConfig.host.source,\n    url: hostProbeUrl,\n    remoteUrl: runtimeConfig.host.remoteUrl,\n    entry: hostIsRemote\n      ? hostProbeUrl\n        ? `${hostProbeUrl}/mf-manifest.json`\n        : \"/mf-manifest.json\"\n      : runtimeConfig.host.entry,\n    name: runtimeConfig.host.name,\n    localPath: runtimeConfig.host.localPath,\n    port: runtimeConfig.host.port,\n    integrity: runtimeConfig.host.integrity,\n    secrets: runtimeConfig.host.secrets,\n    ...SERVICE_CONFIGS.host,\n  });\n\n  map.set(\"ui\", {\n    key: \"ui\",\n    source: runtimeConfig.ui.source,\n    url: runtimeConfig.ui.url,\n    remoteUrl: runtimeConfig.ui.source === \"remote\" ? runtimeConfig.ui.url : undefined,\n    entry: runtimeConfig.ui.entry,\n    name: runtimeConfig.ui.name,\n    localPath: runtimeConfig.ui.localPath,\n    port: runtimeConfig.ui.port,\n    integrity: runtimeConfig.ui.integrity,\n    ssr,\n    ...SERVICE_CONFIGS.ui,\n  });\n\n  if (ssr && runtimeConfig.ui.source === \"local\") {\n    map.set(\"ui-ssr\", {\n      key: \"ui-ssr\",\n      source: runtimeConfig.ui.source,\n      url: runtimeConfig.ui.ssrUrl ?? \"\",\n      entry: \"\",\n      name: \"ui-ssr\",\n      localPath: runtimeConfig.ui.localPath,\n      port: runtimeConfig.ui.ssrUrl\n        ? Number.parseInt(new URL(runtimeConfig.ui.ssrUrl).port, 10)\n        : (runtimeConfig.ui.port ?? 3003) + 1,\n      ...SERVICE_CONFIGS[\"ui-ssr\"],\n    });\n  }\n\n  map.set(\"api\", {\n    key: \"api\",\n    source: runtimeConfig.api.source,\n    url: runtimeConfig.api.url,\n    remoteUrl: runtimeConfig.api.source === \"remote\" ? runtimeConfig.api.url : undefined,\n    entry: runtimeConfig.api.entry,\n    name: runtimeConfig.api.name,\n    localPath: runtimeConfig.api.localPath,\n    port: runtimeConfig.api.port,\n    integrity: runtimeConfig.api.integrity,\n    proxy: runtimeConfig.api.proxy,\n    variables: runtimeConfig.api.variables,\n    secrets: runtimeConfig.api.secrets,\n    ...SERVICE_CONFIGS.api,\n  });\n\n  if (runtimeConfig.auth) {\n    map.set(\"auth\", {\n      key: \"auth\",\n      source: runtimeConfig.auth.source,\n      url: runtimeConfig.auth.url,\n      remoteUrl: runtimeConfig.auth.source === \"remote\" ? runtimeConfig.auth.url : undefined,\n      entry: runtimeConfig.auth.entry,\n      name: runtimeConfig.auth.name,\n      localPath: runtimeConfig.auth.localPath,\n      port: runtimeConfig.auth.port,\n      integrity: runtimeConfig.auth.integrity,\n      proxy: runtimeConfig.auth.proxy,\n      variables: runtimeConfig.auth.variables,\n      secrets: runtimeConfig.auth.secrets,\n      ...SERVICE_CONFIGS.auth,\n    });\n  }\n\n  if (runtimeConfig.plugins) {\n    let pluginBasePort = 3010;\n    for (const [pluginId, pluginConfig] of Object.entries(runtimeConfig.plugins)) {\n      const pluginKey = `plugin:${pluginId}`;\n      const resolvedPort = pluginConfig.port ?? pluginBasePort;\n      pluginBasePort = resolvedPort + 1;\n\n      map.set(pluginKey, {\n        key: pluginKey,\n        source: pluginConfig.source,\n        url: pluginConfig.url,\n        remoteUrl: pluginConfig.source === \"remote\" ? pluginConfig.url : undefined,\n        entry: pluginConfig.entry,\n        name: pluginConfig.name,\n        localPath: pluginConfig.localPath,\n        port: resolvedPort,\n        integrity: pluginConfig.integrity,\n        proxy: pluginConfig.proxy,\n        variables: pluginConfig.variables,\n        secrets: pluginConfig.secrets,\n        command: \"bun\",\n        args: [\"run\", \"dev\"],\n        readyPatterns: PLUGIN_READY_PATTERNS,\n        errorPatterns: PLUGIN_ERROR_PATTERNS,\n        defaultPort: resolvedPort,\n        readinessPath: \"/remoteEntry.js\",\n      });\n\n      if (pluginConfig.ui?.localPath && pluginConfig.ui.source === \"local\") {\n        const uiKey = `plugin-ui:${pluginId}`;\n        const uiPort = pluginConfig.ui.port ?? pluginBasePort;\n        pluginBasePort = uiPort + 1;\n\n        map.set(uiKey, {\n          key: uiKey,\n          source: pluginConfig.ui.source,\n          url: pluginConfig.ui.url,\n          entry: pluginConfig.ui.entry,\n          name: pluginConfig.ui.name,\n          localPath: pluginConfig.ui.localPath,\n          port: uiPort,\n          integrity: pluginConfig.ui.integrity,\n          command: \"bun\",\n          args: [\"run\", \"dev\"],\n          readyPatterns: PLUGIN_READY_PATTERNS,\n          errorPatterns: PLUGIN_ERROR_PATTERNS,\n          defaultPort: uiPort,\n          readinessPath: \"/remoteEntry.js\",\n        });\n      }\n    }\n  }\n\n  return map;\n}\n\nexport interface AppOrchestrator {\n  packages: string[];\n  description: string;\n  env: Record<string, string>;\n  port?: number;\n  interactive?: boolean;\n  noLogs?: boolean;\n}\n\nexport const ServiceDescriptorMapLive = (map: Map<string, ServiceDescriptor>) =>\n  Layer.succeed(ServiceDescriptorMap, map);\n\nexport const DevRuntimeConfigLive = (config: RuntimeConfig) =>\n  Layer.succeed(DevRuntimeConfig, config);\n\nexport function buildServiceDescriptorMapFromPlan(\n  plan: {\n    runtimeConfig: RuntimeConfig;\n    resolvedPorts: { host?: number; api?: number; auth?: number; ui?: number; uiSsr?: number };\n  },\n  options?: { ssr?: boolean; proxy?: boolean },\n): Map<string, ServiceDescriptor> {\n  return buildServiceDescriptorMap(plan.runtimeConfig, options);\n}\n\ninterface ServiceDescriptorInfo {\n  key: string;\n  source: string;\n  proxy?: string;\n}\n\nexport function buildDescription(map: Map<string, ServiceDescriptorInfo>): string {\n  const descriptors = [...map.values()].filter(\n    (d) => d.key !== \"ui-ssr\" && !d.key.startsWith(\"plugin:\"),\n  );\n\n  const allLocal = descriptors.every((d) => d.source === \"local\");\n  const hasProxy = [...map.values()].some((d) => d.proxy && d.source === \"local\");\n  if (allLocal && !hasProxy) return \"Full Local Development\";\n\n  const parts: string[] = [];\n  for (const d of descriptors) {\n    if (d.source === \"remote\") {\n      const label =\n        d.key === \"host\"\n          ? \"Remote Host\"\n          : d.key === \"ui\"\n            ? \"Remote UI\"\n            : d.key === \"api\"\n              ? hasProxy\n                ? undefined\n                : \"Remote API\"\n              : d.key === \"auth\"\n                ? \"Remote Auth\"\n                : undefined;\n      if (label) parts.push(label);\n    }\n  }\n  if (hasProxy) parts.push(\"Proxy API → Production\");\n  return parts.join(\" + \") || \"Remote Mode\";\n}\n"],"mappings":";;;AAyBA,IAAa,uBAAb,cAA0CA,eAAQ,IAAI,sBAAsB,CAAC,CAG3E,CAAC,CAAC,CAAC;AAEL,IAAa,mBAAb,cAAsCA,eAAQ,IAAI,kBAAkB,CAAC,CAGnE,CAAC,CAAC,CAAC;AAEL,MAAM,wBAAwB;CAAC;CAAa;CAA2B;CAAc;AAAU;AAE/F,MAAM,wBAAwB,CAAC,UAAU,SAAS;AAElD,MAAM,kBAMF;CACF,MAAM;EACJ,SAAS;EACT,MAAM,CAAC,OAAO,KAAK;EACnB,eAAe,CAAC,4CAA4C,oBAAoB;EAChF,eAAe;GAAC;GAAW;GAAW;EAAY;EAClD,aAAa;EACb,eAAe;CACjB;CACA,MAAM;EACJ,SAAS;EACT,MAAM,CAAC,OAAO,KAAK;EACnB,eAAe;EACf,eAAe;EACf,aAAa;EACb,eAAe;CACjB;CACA,IAAI;EACF,SAAS;EACT,MAAM,CAAC,OAAO,KAAK;EACnB,eAAe;GAAC;GAAyB;GAAe;EAA6B;EACrF,eAAe,CAAC,UAAU,oBAAoB;EAC9C,aAAa;EACb,eAAe;CACjB;CACA,UAAU;EACR,SAAS;EACT,MAAM,CAAC,OAAO,SAAS;EACvB,eAAe,CAAC,yBAAyB,6BAA6B;EACtE,eAAe,CAAC,UAAU,SAAS;EACnC,aAAa;EACb,eAAe;CACjB;CACA,KAAK;EACH,SAAS;EACT,MAAM,CAAC,OAAO,KAAK;EACnB,eAAe;EACf,eAAe;EACf,aAAa;EACb,eAAe;CACjB;AACF;AAEA,SAAgB,0BACd,eACA,SACgC;CAChC,MAAM,sBAAM,IAAI,IAA+B;CAC/C,MAAM,MAAM,SAAS,OAAO;CAE5B,MAAM,eAAe,cAAc,KAAK,WAAW;CACnD,MAAM,eAAe,eAChB,cAAc,KAAK,aAAa,cAAc,KAAK,MACpD,cAAc,KAAK;CACvB,IAAI,IAAI,QAAQ;EACd,KAAK;EACL,QAAQ,cAAc,KAAK;EAC3B,KAAK;EACL,WAAW,cAAc,KAAK;EAC9B,OAAO,eACH,eACE,GAAG,aAAa,qBAChB,sBACF,cAAc,KAAK;EACvB,MAAM,cAAc,KAAK;EACzB,WAAW,cAAc,KAAK;EAC9B,MAAM,cAAc,KAAK;EACzB,WAAW,cAAc,KAAK;EAC9B,SAAS,cAAc,KAAK;EAC5B,GAAG,gBAAgB;CACrB,CAAC;CAED,IAAI,IAAI,MAAM;EACZ,KAAK;EACL,QAAQ,cAAc,GAAG;EACzB,KAAK,cAAc,GAAG;EACtB,WAAW,cAAc,GAAG,WAAW,WAAW,cAAc,GAAG,MAAM;EACzE,OAAO,cAAc,GAAG;EACxB,MAAM,cAAc,GAAG;EACvB,WAAW,cAAc,GAAG;EAC5B,MAAM,cAAc,GAAG;EACvB,WAAW,cAAc,GAAG;EAC5B;EACA,GAAG,gBAAgB;CACrB,CAAC;CAED,IAAI,OAAO,cAAc,GAAG,WAAW,SACrC,IAAI,IAAI,UAAU;EAChB,KAAK;EACL,QAAQ,cAAc,GAAG;EACzB,KAAK,cAAc,GAAG,UAAU;EAChC,OAAO;EACP,MAAM;EACN,WAAW,cAAc,GAAG;EAC5B,MAAM,cAAc,GAAG,SACnB,OAAO,SAAS,IAAI,IAAI,cAAc,GAAG,MAAM,CAAC,CAAC,MAAM,EAAE,KACxD,cAAc,GAAG,QAAQ,QAAQ;EACtC,GAAG,gBAAgB;CACrB,CAAC;CAGH,IAAI,IAAI,OAAO;EACb,KAAK;EACL,QAAQ,cAAc,IAAI;EAC1B,KAAK,cAAc,IAAI;EACvB,WAAW,cAAc,IAAI,WAAW,WAAW,cAAc,IAAI,MAAM;EAC3E,OAAO,cAAc,IAAI;EACzB,MAAM,cAAc,IAAI;EACxB,WAAW,cAAc,IAAI;EAC7B,MAAM,cAAc,IAAI;EACxB,WAAW,cAAc,IAAI;EAC7B,OAAO,cAAc,IAAI;EACzB,WAAW,cAAc,IAAI;EAC7B,SAAS,cAAc,IAAI;EAC3B,GAAG,gBAAgB;CACrB,CAAC;CAED,IAAI,cAAc,MAChB,IAAI,IAAI,QAAQ;EACd,KAAK;EACL,QAAQ,cAAc,KAAK;EAC3B,KAAK,cAAc,KAAK;EACxB,WAAW,cAAc,KAAK,WAAW,WAAW,cAAc,KAAK,MAAM;EAC7E,OAAO,cAAc,KAAK;EAC1B,MAAM,cAAc,KAAK;EACzB,WAAW,cAAc,KAAK;EAC9B,MAAM,cAAc,KAAK;EACzB,WAAW,cAAc,KAAK;EAC9B,OAAO,cAAc,KAAK;EAC1B,WAAW,cAAc,KAAK;EAC9B,SAAS,cAAc,KAAK;EAC5B,GAAG,gBAAgB;CACrB,CAAC;CAGH,IAAI,cAAc,SAAS;EACzB,IAAI,iBAAiB;EACrB,KAAK,MAAM,CAAC,UAAU,iBAAiB,OAAO,QAAQ,cAAc,OAAO,GAAG;GAC5E,MAAM,YAAY,UAAU;GAC5B,MAAM,eAAe,aAAa,QAAQ;GAC1C,iBAAiB,eAAe;GAEhC,IAAI,IAAI,WAAW;IACjB,KAAK;IACL,QAAQ,aAAa;IACrB,KAAK,aAAa;IAClB,WAAW,aAAa,WAAW,WAAW,aAAa,MAAM;IACjE,OAAO,aAAa;IACpB,MAAM,aAAa;IACnB,WAAW,aAAa;IACxB,MAAM;IACN,WAAW,aAAa;IACxB,OAAO,aAAa;IACpB,WAAW,aAAa;IACxB,SAAS,aAAa;IACtB,SAAS;IACT,MAAM,CAAC,OAAO,KAAK;IACnB,eAAe;IACf,eAAe;IACf,aAAa;IACb,eAAe;GACjB,CAAC;GAED,IAAI,aAAa,IAAI,aAAa,aAAa,GAAG,WAAW,SAAS;IACpE,MAAM,QAAQ,aAAa;IAC3B,MAAM,SAAS,aAAa,GAAG,QAAQ;IACvC,iBAAiB,SAAS;IAE1B,IAAI,IAAI,OAAO;KACb,KAAK;KACL,QAAQ,aAAa,GAAG;KACxB,KAAK,aAAa,GAAG;KACrB,OAAO,aAAa,GAAG;KACvB,MAAM,aAAa,GAAG;KACtB,WAAW,aAAa,GAAG;KAC3B,MAAM;KACN,WAAW,aAAa,GAAG;KAC3B,SAAS;KACT,MAAM,CAAC,OAAO,KAAK;KACnB,eAAe;KACf,eAAe;KACf,aAAa;KACb,eAAe;IACjB,CAAC;GACH;EACF;CACF;CAEA,OAAO;AACT;AAWA,MAAa,4BAA4B,QACvCC,aAAM,QAAQ,sBAAsB,GAAG;AAEzC,MAAa,wBAAwB,WACnCA,aAAM,QAAQ,kBAAkB,MAAM;AAExC,SAAgB,kCACd,MAIA,SACgC;CAChC,OAAO,0BAA0B,KAAK,eAAe,OAAO;AAC9D;AAQA,SAAgB,iBAAiB,KAAiD;CAChF,MAAM,cAAc,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,QACnC,MAAM,EAAE,QAAQ,YAAY,CAAC,EAAE,IAAI,WAAW,SAAS,CAC1D;CAEA,MAAM,WAAW,YAAY,OAAO,MAAM,EAAE,WAAW,OAAO;CAC9D,MAAM,WAAW,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,SAAS,EAAE,WAAW,OAAO;CAC9E,IAAI,YAAY,CAAC,UAAU,OAAO;CAElC,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,KAAK,aACd,IAAI,EAAE,WAAW,UAAU;EACzB,MAAM,QACJ,EAAE,QAAQ,SACN,gBACA,EAAE,QAAQ,OACR,cACA,EAAE,QAAQ,QACR,WACE,SACA,eACF,EAAE,QAAQ,SACR,gBACA;EACZ,IAAI,OAAO,MAAM,KAAK,KAAK;CAC7B;CAEF,IAAI,UAAU,MAAM,KAAK,wBAAwB;CACjD,OAAO,MAAM,KAAK,KAAK,KAAK;AAC9B"}
+{"version":3,"file":"service-descriptor.cjs","names":["Context","Layer","existsSync","path"],"sources":["../src/service-descriptor.ts"],"sourcesContent":["import { existsSync } from \"node:fs\";\nimport path from \"node:path\";\nimport { Context, Layer } from \"effect\";\nimport type { JsonObject, RuntimeConfig, SourceMode } from \"./types\";\n\nexport interface AuthSlotShape {\n  source: string;\n  localPath?: string;\n  url?: string;\n}\n\n/**\n * True when a `plugins.<id>` entry is the runtime-config mirror of the\n * app-slot auth plugin (same backend target) — the `auth` service already\n * spawns that backend, so the mirror contributes only its `ui` surface.\n * The single implementation; consumed by the service descriptors, the DAG,\n * the infra planner, and the dev session.\n */\nexport function isAuthMirrorPluginEntry(\n  authEntry: AuthSlotShape | undefined,\n  pluginId: string,\n  pluginConfig: AuthSlotShape,\n): boolean {\n  if (pluginId !== \"auth\" || !authEntry) return false;\n  if (pluginConfig === authEntry) return true;\n  if (pluginConfig.localPath && pluginConfig.localPath === authEntry.localPath) return true;\n  if (\n    !pluginConfig.localPath &&\n    pluginConfig.source === \"remote\" &&\n    pluginConfig.url &&\n    pluginConfig.url === authEntry.url\n  ) {\n    return true;\n  }\n  return false;\n}\n\nexport interface ServiceDescriptor {\n  key: string;\n  source: SourceMode;\n  url: string;\n  remoteUrl?: string;\n  entry: string;\n  name: string;\n  localPath?: string;\n  port?: number;\n  readinessPath: string;\n  defaultPort: number;\n  integrity?: string;\n  proxy?: string;\n  variables?: JsonObject;\n  secrets?: string[];\n  ssr?: boolean;\n  command?: string;\n  args?: string[];\n  env?: Record<string, string>;\n  readyPatterns?: RegExp[];\n  errorPatterns?: RegExp[];\n  /** folder-form plugin UI port — the UI build is a child of this dev process (BOS_UI_PORT) */\n  uiPort?: number;\n}\n\nexport class ServiceDescriptorMap extends Context.Service<\n  ServiceDescriptorMap,\n  Map<string, ServiceDescriptor>\n>()(\"ServiceDescriptorMap\") {}\n\nexport class DevRuntimeConfig extends Context.Service<DevRuntimeConfig, RuntimeConfig>()(\n  \"DevRuntimeConfig\",\n) {}\n\nexport class DevGeneratedEnv extends Context.Service<DevGeneratedEnv, Record<string, string>>()(\n  \"DevGeneratedEnv\",\n) {}\n\nexport const DevGeneratedEnvLive = (env: Record<string, string>) =>\n  Layer.succeed(DevGeneratedEnv, env);\n\nconst PLUGIN_READY_PATTERNS = [/ready in/i, /compiled.*successfully/i, /listening/i, /started/i];\n\nconst PLUGIN_ERROR_PATTERNS = [\n  /\\bERROR in\\b/,\n  /failed to compile/i,\n  /Module not found/i,\n  /Cannot find module/i,\n];\n\nconst SERVICE_CONFIGS = {\n  host: {\n    command: \"pnpm\",\n    args: [\"run\", \"dev\"],\n    // The host dev server runs on tsx (TS-capable node), so it can consume\n    // framework package sources directly — NODE_OPTIONS makes node's\n    // resolver pick the `development` export condition. The env var rides\n    // the spawn environment (ADR 0026 §2) and is inherited by the host's\n    // tsx children. rsbuild/rspack config loaders must NOT rely on it:\n    // their .mjs config evaluation resolves dist (freshness is the\n    // prerequisite train's job, ADR 0022).\n    env: { NODE_OPTIONS: \"--conditions=development\" },\n    readyPatterns: [/Host (dev|production) server running at/i, /Server running at/i],\n    errorPatterns: [/\\berror\\b(?!s)/i, /\\bfailed to\\b/i, /\\bbuild failed\\b/i, /exception/i],\n    defaultPort: 3000,\n    readinessPath: \"/health\",\n  },\n  auth: {\n    command: \"pnpm\",\n    args: [\"run\", \"dev\"],\n    readyPatterns: PLUGIN_READY_PATTERNS,\n    errorPatterns: PLUGIN_ERROR_PATTERNS,\n    defaultPort: 3002,\n    readinessPath: \"/remoteEntry.js\",\n  },\n  ui: {\n    command: \"pnpm\",\n    args: [\"run\", \"dev\"],\n    readyPatterns: [/\\bready\\s+built in\\b/i, /\\bLocal:\\b/i, /\\bcompiled\\b.*successfully/i],\n    errorPatterns: [/\\berror\\b(?!s)/i, /\\bfailed to\\b/i, /\\bbuild failed\\b/i],\n    defaultPort: 3003,\n    readinessPath: \"/remoteEntry.js\",\n  },\n  api: {\n    command: \"pnpm\",\n    args: [\"run\", \"dev\"],\n    readyPatterns: PLUGIN_READY_PATTERNS,\n    errorPatterns: PLUGIN_ERROR_PATTERNS,\n    defaultPort: 3001,\n    readinessPath: \"/remoteEntry.js\",\n  },\n} as const satisfies Record<\n  string,\n  Pick<\n    ServiceDescriptor,\n    \"command\" | \"args\" | \"env\" | \"readyPatterns\" | \"errorPatterns\" | \"defaultPort\" | \"readinessPath\"\n  >\n>;\n\nexport function buildServiceDescriptorMap(\n  runtimeConfig: RuntimeConfig,\n  options?: { ssr?: boolean; proxy?: boolean },\n): Map<string, ServiceDescriptor> {\n  const map = new Map<string, ServiceDescriptor>();\n  const ssr = options?.ssr ?? false;\n\n  const hostIsRemote = runtimeConfig.host.source === \"remote\";\n  const hostProbeUrl = hostIsRemote\n    ? (runtimeConfig.host.remoteUrl ?? runtimeConfig.host.url)\n    : runtimeConfig.host.url;\n  map.set(\"host\", {\n    key: \"host\",\n    source: runtimeConfig.host.source,\n    url: hostProbeUrl,\n    remoteUrl: runtimeConfig.host.remoteUrl,\n    entry: hostIsRemote\n      ? hostProbeUrl\n        ? `${hostProbeUrl}/mf-manifest.json`\n        : \"/mf-manifest.json\"\n      : runtimeConfig.host.entry,\n    name: runtimeConfig.host.name,\n    localPath: runtimeConfig.host.localPath,\n    port: runtimeConfig.host.port,\n    integrity: runtimeConfig.host.integrity,\n    secrets: runtimeConfig.host.secrets,\n    ...SERVICE_CONFIGS.host,\n  });\n\n  map.set(\"ui\", {\n    key: \"ui\",\n    source: runtimeConfig.ui.source,\n    url: runtimeConfig.ui.url,\n    remoteUrl: runtimeConfig.ui.source === \"remote\" ? runtimeConfig.ui.url : undefined,\n    entry: runtimeConfig.ui.entry,\n    name: runtimeConfig.ui.name,\n    localPath: runtimeConfig.ui.localPath,\n    port: runtimeConfig.ui.port,\n    integrity: runtimeConfig.ui.integrity,\n    ssr,\n    ...SERVICE_CONFIGS.ui,\n    env: { BOS_DEV_SERVER: \"1\" },\n    // BOS_NO_WATCH stacks (regression/CI) build once and serve the built dist\n    // via rsbuild preview — no watcher, no HMR.\n    args: process.env.BOS_NO_WATCH === \"1\" ? [\"run\", \"dev:built\"] : SERVICE_CONFIGS.ui.args,\n  });\n\n  map.set(\"api\", {\n    key: \"api\",\n    source: runtimeConfig.api.source,\n    url: runtimeConfig.api.url,\n    remoteUrl: runtimeConfig.api.source === \"remote\" ? runtimeConfig.api.url : undefined,\n    entry: runtimeConfig.api.entry,\n    name: runtimeConfig.api.name,\n    localPath: runtimeConfig.api.localPath,\n    port: runtimeConfig.api.port,\n    integrity: runtimeConfig.api.integrity,\n    proxy: runtimeConfig.api.proxy,\n    variables: runtimeConfig.api.variables,\n    secrets: runtimeConfig.api.secrets,\n    ...SERVICE_CONFIGS.api,\n  });\n\n  if (runtimeConfig.auth) {\n    map.set(\"auth\", {\n      key: \"auth\",\n      source: runtimeConfig.auth.source,\n      url: runtimeConfig.auth.url,\n      remoteUrl: runtimeConfig.auth.source === \"remote\" ? runtimeConfig.auth.url : undefined,\n      entry: runtimeConfig.auth.entry,\n      name: runtimeConfig.auth.name,\n      localPath: runtimeConfig.auth.localPath,\n      port: runtimeConfig.auth.port,\n      integrity: runtimeConfig.auth.integrity,\n      proxy: runtimeConfig.auth.proxy,\n      variables: runtimeConfig.auth.variables,\n      secrets: runtimeConfig.auth.secrets,\n      ...SERVICE_CONFIGS.auth,\n    });\n  }\n\n  if (runtimeConfig.plugins) {\n    let pluginBasePort = 3010;\n    for (const [pluginId, pluginConfig] of Object.entries(runtimeConfig.plugins)) {\n      const isAuthMirror = isAuthMirrorPluginEntry(runtimeConfig.auth, pluginId, pluginConfig);\n      const pluginKey = `plugin:${pluginId}`;\n      const resolvedPort = pluginConfig.port ?? pluginBasePort;\n      pluginBasePort = resolvedPort + 1;\n\n      // Folder-form ui source: the ui dir lives inside the plugin workspace\n      // (no own package.json) — `every-plugin dev` spawns its UI build as a\n      // child (BOS_UI_PORT), so no separate plugin-ui service is spawned.\n      const uiLocalPath = pluginConfig.ui?.localPath;\n      const isFolderFormUi = Boolean(\n        uiLocalPath &&\n          pluginConfig.ui?.source === \"local\" &&\n          existsSync(path.join(uiLocalPath, \"src\", \"routes\")) &&\n          !existsSync(path.join(uiLocalPath, \"package.json\")),\n      );\n      const folderUiPort = pluginConfig.ui?.port ?? pluginBasePort;\n      if (isFolderFormUi) pluginBasePort = folderUiPort + 1;\n\n      if (!isAuthMirror) {\n        map.set(pluginKey, {\n          key: pluginKey,\n          source: pluginConfig.source,\n          url: pluginConfig.url,\n          remoteUrl: pluginConfig.source === \"remote\" ? pluginConfig.url : undefined,\n          entry: pluginConfig.entry,\n          name: pluginConfig.name,\n          localPath: pluginConfig.localPath,\n          port: resolvedPort,\n          integrity: pluginConfig.integrity,\n          proxy: pluginConfig.proxy,\n          variables: pluginConfig.variables,\n          secrets: pluginConfig.secrets,\n          command: \"pnpm\",\n          args: [\"run\", \"dev\"],\n          env: isFolderFormUi ? { BOS_UI_PORT: String(folderUiPort) } : undefined,\n          uiPort: isFolderFormUi ? folderUiPort : undefined,\n          readyPatterns: PLUGIN_READY_PATTERNS,\n          errorPatterns: PLUGIN_ERROR_PATTERNS,\n          defaultPort: resolvedPort,\n          readinessPath: \"/remoteEntry.js\",\n        });\n      } else if (isFolderFormUi) {\n        // Folder-form ui for the auth mirror: the `auth` app slot owns the\n        // dev process (plugin:auth is not spawned), so BOS_UI_PORT rides on\n        // the auth descriptor. folderUiPort is the same port the runtime\n        // config wired into the mirror's ui.url (withLocalRuntimeUrl).\n        const authDescriptor = map.get(\"auth\");\n        if (authDescriptor) {\n          map.set(\"auth\", {\n            ...authDescriptor,\n            env: { BOS_UI_PORT: String(folderUiPort) },\n            uiPort: folderUiPort,\n          });\n        }\n      }\n\n      if (pluginConfig.ui?.localPath && pluginConfig.ui.source === \"local\" && !isFolderFormUi) {\n        const uiKey = `plugin-ui:${pluginId}`;\n        const uiPort = pluginConfig.ui.port ?? pluginBasePort;\n        pluginBasePort = uiPort + 1;\n\n        map.set(uiKey, {\n          key: uiKey,\n          source: pluginConfig.ui.source,\n          url: pluginConfig.ui.url,\n          entry: pluginConfig.ui.entry,\n          name: pluginConfig.ui.name,\n          localPath: pluginConfig.ui.localPath,\n          port: uiPort,\n          integrity: pluginConfig.ui.integrity,\n          command: \"pnpm\",\n          args: [\"run\", \"dev\"],\n          readyPatterns: PLUGIN_READY_PATTERNS,\n          errorPatterns: PLUGIN_ERROR_PATTERNS,\n          defaultPort: uiPort,\n          readinessPath: \"/remoteEntry.js\",\n        });\n      }\n    }\n  }\n\n  return map;\n}\n\nexport interface AppOrchestrator {\n  packages: string[];\n  description: string;\n  env: Record<string, string>;\n  port?: number;\n  interactive?: boolean;\n  noLogs?: boolean;\n}\n\nexport const ServiceDescriptorMapLive = (map: Map<string, ServiceDescriptor>) =>\n  Layer.succeed(ServiceDescriptorMap, map);\n\nexport const DevRuntimeConfigLive = (config: RuntimeConfig) =>\n  Layer.succeed(DevRuntimeConfig, config);\n\nexport function buildServiceDescriptorMapFromPlan(\n  plan: {\n    runtimeConfig: RuntimeConfig;\n    resolvedPorts: { host?: number; api?: number; auth?: number; ui?: number; uiSsr?: number };\n  },\n  options?: { ssr?: boolean; proxy?: boolean },\n): Map<string, ServiceDescriptor> {\n  return buildServiceDescriptorMap(plan.runtimeConfig, options);\n}\n\ninterface ServiceDescriptorInfo {\n  key: string;\n  source: string;\n  proxy?: string;\n}\n\nexport function buildDescription(map: Map<string, ServiceDescriptorInfo>): string {\n  const descriptors = [...map.values()].filter((d) => !d.key.startsWith(\"plugin:\"));\n\n  const allLocal = descriptors.every((d) => d.source === \"local\");\n  const hasProxy = [...map.values()].some((d) => d.proxy && d.source === \"local\");\n  if (allLocal && !hasProxy) return \"Full Local Development\";\n\n  const parts: string[] = [];\n  for (const d of descriptors) {\n    if (d.source === \"remote\") {\n      const label =\n        d.key === \"host\"\n          ? \"Remote Host\"\n          : d.key === \"ui\"\n            ? \"Remote UI\"\n            : d.key === \"api\"\n              ? hasProxy\n                ? undefined\n                : \"Remote API\"\n              : d.key === \"auth\"\n                ? \"Remote Auth\"\n                : undefined;\n      if (label) parts.push(label);\n    }\n  }\n  if (hasProxy) parts.push(\"Proxy API → Production\");\n  return parts.join(\" + \") || \"Remote Mode\";\n}\n"],"mappings":";;;;;;;;;;;;;;AAkBA,SAAgB,wBACd,WACA,UACA,cACS;CACT,IAAI,aAAa,UAAU,CAAC,WAAW,OAAO;CAC9C,IAAI,iBAAiB,WAAW,OAAO;CACvC,IAAI,aAAa,aAAa,aAAa,cAAc,UAAU,WAAW,OAAO;CACrF,IACE,CAAC,aAAa,aACd,aAAa,WAAW,YACxB,aAAa,OACb,aAAa,QAAQ,UAAU,KAE/B,OAAO;CAET,OAAO;AACT;AA2BA,IAAa,uBAAb,cAA0CA,eAAQ,QAGhD,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAE7B,IAAa,mBAAb,cAAsCA,eAAQ,QAAyC,CAAC,CACtF,kBACF,CAAC,CAAC,CAAC;AAEH,IAAa,kBAAb,cAAqCA,eAAQ,QAAiD,CAAC,CAC7F,iBACF,CAAC,CAAC,CAAC;AAEH,MAAa,uBAAuB,QAClCC,aAAM,QAAQ,iBAAiB,GAAG;AAEpC,MAAM,wBAAwB;CAAC;CAAa;CAA2B;CAAc;AAAU;AAE/F,MAAM,wBAAwB;CAC5B;CACA;CACA;CACA;AACF;AAEA,MAAM,kBAAkB;CACtB,MAAM;EACJ,SAAS;EACT,MAAM,CAAC,OAAO,KAAK;EAQnB,KAAK,EAAE,cAAc,2BAA2B;EAChD,eAAe,CAAC,4CAA4C,oBAAoB;EAChF,eAAe;GAAC;GAAmB;GAAkB;GAAqB;EAAY;EACtF,aAAa;EACb,eAAe;CACjB;CACA,MAAM;EACJ,SAAS;EACT,MAAM,CAAC,OAAO,KAAK;EACnB,eAAe;EACf,eAAe;EACf,aAAa;EACb,eAAe;CACjB;CACA,IAAI;EACF,SAAS;EACT,MAAM,CAAC,OAAO,KAAK;EACnB,eAAe;GAAC;GAAyB;GAAe;EAA6B;EACrF,eAAe;GAAC;GAAmB;GAAkB;EAAmB;EACxE,aAAa;EACb,eAAe;CACjB;CACA,KAAK;EACH,SAAS;EACT,MAAM,CAAC,OAAO,KAAK;EACnB,eAAe;EACf,eAAe;EACf,aAAa;EACb,eAAe;CACjB;AACF;AAQA,SAAgB,0BACd,eACA,SACgC;CAChC,MAAM,sBAAM,IAAI,IAA+B;CAC/C,MAAM,MAAM,SAAS,OAAO;CAE5B,MAAM,eAAe,cAAc,KAAK,WAAW;CACnD,MAAM,eAAe,eAChB,cAAc,KAAK,aAAa,cAAc,KAAK,MACpD,cAAc,KAAK;CACvB,IAAI,IAAI,QAAQ;EACd,KAAK;EACL,QAAQ,cAAc,KAAK;EAC3B,KAAK;EACL,WAAW,cAAc,KAAK;EAC9B,OAAO,eACH,eACE,GAAG,aAAa,qBAChB,sBACF,cAAc,KAAK;EACvB,MAAM,cAAc,KAAK;EACzB,WAAW,cAAc,KAAK;EAC9B,MAAM,cAAc,KAAK;EACzB,WAAW,cAAc,KAAK;EAC9B,SAAS,cAAc,KAAK;EAC5B,GAAG,gBAAgB;CACrB,CAAC;CAED,IAAI,IAAI,MAAM;EACZ,KAAK;EACL,QAAQ,cAAc,GAAG;EACzB,KAAK,cAAc,GAAG;EACtB,WAAW,cAAc,GAAG,WAAW,WAAW,cAAc,GAAG,MAAM;EACzE,OAAO,cAAc,GAAG;EACxB,MAAM,cAAc,GAAG;EACvB,WAAW,cAAc,GAAG;EAC5B,MAAM,cAAc,GAAG;EACvB,WAAW,cAAc,GAAG;EAC5B;EACA,GAAG,gBAAgB;EACnB,KAAK,EAAE,gBAAgB,IAAI;EAG3B,MAAM,QAAQ,IAAI,iBAAiB,MAAM,CAAC,OAAO,WAAW,IAAI,gBAAgB,GAAG;CACrF,CAAC;CAED,IAAI,IAAI,OAAO;EACb,KAAK;EACL,QAAQ,cAAc,IAAI;EAC1B,KAAK,cAAc,IAAI;EACvB,WAAW,cAAc,IAAI,WAAW,WAAW,cAAc,IAAI,MAAM;EAC3E,OAAO,cAAc,IAAI;EACzB,MAAM,cAAc,IAAI;EACxB,WAAW,cAAc,IAAI;EAC7B,MAAM,cAAc,IAAI;EACxB,WAAW,cAAc,IAAI;EAC7B,OAAO,cAAc,IAAI;EACzB,WAAW,cAAc,IAAI;EAC7B,SAAS,cAAc,IAAI;EAC3B,GAAG,gBAAgB;CACrB,CAAC;CAED,IAAI,cAAc,MAChB,IAAI,IAAI,QAAQ;EACd,KAAK;EACL,QAAQ,cAAc,KAAK;EAC3B,KAAK,cAAc,KAAK;EACxB,WAAW,cAAc,KAAK,WAAW,WAAW,cAAc,KAAK,MAAM;EAC7E,OAAO,cAAc,KAAK;EAC1B,MAAM,cAAc,KAAK;EACzB,WAAW,cAAc,KAAK;EAC9B,MAAM,cAAc,KAAK;EACzB,WAAW,cAAc,KAAK;EAC9B,OAAO,cAAc,KAAK;EAC1B,WAAW,cAAc,KAAK;EAC9B,SAAS,cAAc,KAAK;EAC5B,GAAG,gBAAgB;CACrB,CAAC;CAGH,IAAI,cAAc,SAAS;EACzB,IAAI,iBAAiB;EACrB,KAAK,MAAM,CAAC,UAAU,iBAAiB,OAAO,QAAQ,cAAc,OAAO,GAAG;GAC5E,MAAM,eAAe,wBAAwB,cAAc,MAAM,UAAU,YAAY;GACvF,MAAM,YAAY,UAAU;GAC5B,MAAM,eAAe,aAAa,QAAQ;GAC1C,iBAAiB,eAAe;GAKhC,MAAM,cAAc,aAAa,IAAI;GACrC,MAAM,iBAAiB,QACrB,eACE,aAAa,IAAI,WAAW,eAC5BC,oBAAWC,kBAAK,KAAK,aAAa,OAAO,QAAQ,CAAC,KAClD,KAACD,oBAAWC,kBAAK,KAAK,aAAa,cAAc,CAAC,CACtD;GACA,MAAM,eAAe,aAAa,IAAI,QAAQ;GAC9C,IAAI,gBAAgB,iBAAiB,eAAe;GAEpD,IAAI,CAAC,cACH,IAAI,IAAI,WAAW;IACjB,KAAK;IACL,QAAQ,aAAa;IACrB,KAAK,aAAa;IAClB,WAAW,aAAa,WAAW,WAAW,aAAa,MAAM;IACjE,OAAO,aAAa;IACpB,MAAM,aAAa;IACnB,WAAW,aAAa;IACxB,MAAM;IACN,WAAW,aAAa;IACxB,OAAO,aAAa;IACpB,WAAW,aAAa;IACxB,SAAS,aAAa;IACtB,SAAS;IACT,MAAM,CAAC,OAAO,KAAK;IACnB,KAAK,iBAAiB,EAAE,aAAa,OAAO,YAAY,EAAE,IAAI;IAC9D,QAAQ,iBAAiB,eAAe;IACxC,eAAe;IACf,eAAe;IACf,aAAa;IACb,eAAe;GACjB,CAAC;QACI,IAAI,gBAAgB;IAKzB,MAAM,iBAAiB,IAAI,IAAI,MAAM;IACrC,IAAI,gBACF,IAAI,IAAI,QAAQ;KACd,GAAG;KACH,KAAK,EAAE,aAAa,OAAO,YAAY,EAAE;KACzC,QAAQ;IACV,CAAC;GAEL;GAEA,IAAI,aAAa,IAAI,aAAa,aAAa,GAAG,WAAW,WAAW,CAAC,gBAAgB;IACvF,MAAM,QAAQ,aAAa;IAC3B,MAAM,SAAS,aAAa,GAAG,QAAQ;IACvC,iBAAiB,SAAS;IAE1B,IAAI,IAAI,OAAO;KACb,KAAK;KACL,QAAQ,aAAa,GAAG;KACxB,KAAK,aAAa,GAAG;KACrB,OAAO,aAAa,GAAG;KACvB,MAAM,aAAa,GAAG;KACtB,WAAW,aAAa,GAAG;KAC3B,MAAM;KACN,WAAW,aAAa,GAAG;KAC3B,SAAS;KACT,MAAM,CAAC,OAAO,KAAK;KACnB,eAAe;KACf,eAAe;KACf,aAAa;KACb,eAAe;IACjB,CAAC;GACH;EACF;CACF;CAEA,OAAO;AACT;AAWA,MAAa,4BAA4B,QACvCF,aAAM,QAAQ,sBAAsB,GAAG;AAEzC,MAAa,wBAAwB,WACnCA,aAAM,QAAQ,kBAAkB,MAAM;AAExC,SAAgB,kCACd,MAIA,SACgC;CAChC,OAAO,0BAA0B,KAAK,eAAe,OAAO;AAC9D;AAQA,SAAgB,iBAAiB,KAAiD;CAChF,MAAM,cAAc,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,EAAE,IAAI,WAAW,SAAS,CAAC;CAEhF,MAAM,WAAW,YAAY,OAAO,MAAM,EAAE,WAAW,OAAO;CAC9D,MAAM,WAAW,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,SAAS,EAAE,WAAW,OAAO;CAC9E,IAAI,YAAY,CAAC,UAAU,OAAO;CAElC,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,KAAK,aACd,IAAI,EAAE,WAAW,UAAU;EACzB,MAAM,QACJ,EAAE,QAAQ,SACN,gBACA,EAAE,QAAQ,OACR,cACA,EAAE,QAAQ,QACR,WACE,SACA,eACF,EAAE,QAAQ,SACR,gBACA;EACZ,IAAI,OAAO,MAAM,KAAK,KAAK;CAC7B;CAEF,IAAI,UAAU,MAAM,KAAK,wBAAwB;CACjD,OAAO,MAAM,KAAK,KAAK,KAAK;AAC9B"}