everything-dev 1.53.2 → 2.0.0-rc.1

package/dist/env/project-env.cjs

@@ -0,0 +1,144 @@
+const require_runtime = require('../_virtual/_rolldown/runtime.cjs');
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+let effect = require("effect");
+let node_crypto = require("node:crypto");
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process, 1);
+let dotenv = require("dotenv");
+let _clack_prompts = require("@clack/prompts");
+_clack_prompts = require_runtime.__toESM(_clack_prompts, 1);
+
+//#region src/env/project-env.ts
+var EnvEnsureError = class extends effect.Data.TaggedError("EnvEnsureError") {};
+var EnvLoadError = class extends effect.Data.TaggedError("EnvLoadError") {};
+var EnvSyncError = class extends effect.Data.TaggedError("EnvSyncError") {};
+/**
+* The process environment as exported by the parent shell. Values present
+* here were explicitly provided by the caller (shell, CI, the regression
+* harness) and therefore outrank planner-generated values; values that only
+* exist after `.env` loading do not. The bootstrap program captures this
+* snapshot as its first step — before any `.env` loading — and provides it
+* to the rest of the program as a service.
+*/
+var ShellEnv = class extends effect.Context.Service()("everything-dev/ShellEnv") {};
+const captureShellEnv = effect.Effect.sync(() => Object.fromEntries(Object.entries(node_process.default.env).filter((entry) => entry[1] != null)));
+const ShellEnvLive = (env) => effect.Layer.succeed(ShellEnv, env);
+/**
+* Align the bos-owned lines of `.env` with the generated infra env
+* (ports/secrets derived from the resolved dev topology). Keys the caller
+* explicitly exported (`shellEnv`) are skipped — a deliberate override must
+* not be silently reverted on disk. Lines the user added outside the
+* generated key set are untouched. Idempotent.
+*/
+const GENERATED_OWNED_KEYS = /* @__PURE__ */ new Set(["BASE_URL", "CORS_ORIGIN"]);
+const maskValue = (key, value) => {
+	if (value === void 0) return "(absent)";
+	if (/_DATABASE_URL$|_REDIS_URL$|_SECRET$|_KEY$/.test(key)) return value.replace(/\/\/([^:/@]+):([^@]+)@/, "//***:***@");
+	return value;
+};
+const syncEnvFile = (configDir, generated, shellEnv = {}) => effect.Effect.gen(function* () {
+	if (Object.keys(generated).length === 0) return [];
+	const envPath = (0, node_path.join)(configDir, ".env");
+	if (!(0, node_fs.existsSync)(envPath)) return [];
+	const lines = yield* effect.Effect.try({
+		try: () => (0, node_fs.readFileSync)(envPath, "utf-8").split("\n"),
+		catch: (cause) => new EnvSyncError({ cause })
+	});
+	const drift = [];
+	const seen = /* @__PURE__ */ new Set();
+	const keyOf = (line) => {
+		return /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line)?.[1] ?? null;
+	};
+	const updated = lines.map((line) => {
+		const key = keyOf(line);
+		if (!key || !(key in generated)) return line;
+		if (key in shellEnv && !GENERATED_OWNED_KEYS.has(key)) return line;
+		seen.add(key);
+		const value = line.slice(key.length + 1);
+		if (value === generated[key]) return line;
+		drift.push({
+			key,
+			from: value,
+			to: generated[key]
+		});
+		return `${key}=${generated[key]}`;
+	});
+	for (const [key, value] of Object.entries(generated)) {
+		if (seen.has(key)) continue;
+		if (key in shellEnv && !GENERATED_OWNED_KEYS.has(key)) continue;
+		drift.push({
+			key,
+			from: void 0,
+			to: value
+		});
+		updated.push(`${key}=${value}`);
+	}
+	if (drift.length > 0) {
+		yield* effect.Effect.try({
+			try: () => (0, node_fs.writeFileSync)(envPath, updated.join("\n")),
+			catch: (cause) => new EnvSyncError({ cause })
+		});
+		for (const { key, from, to } of drift) yield* effect.Effect.logInfo(`[env] ${key} updated: ${maskValue(key, from)} → ${maskValue(key, to)} (generated from resolved ports)`);
+	}
+	return drift;
+});
+var ProjectEnv = class extends effect.Context.Service()("everything-dev/ProjectEnv") {};
+const makeProjectEnv = () => {
+	const loadedDirs = /* @__PURE__ */ new Set();
+	return {
+		ensureFile: (configDir) => effect.Effect.try({
+			try: () => {
+				const envPath = (0, node_path.join)(configDir, ".env");
+				const examplePath = (0, node_path.join)(configDir, ".env.example");
+				if ((0, node_fs.existsSync)(envPath) || !(0, node_fs.existsSync)(examplePath)) return false;
+				const lines = (0, node_fs.readFileSync)(examplePath, "utf-8").split("\n");
+				const secret = (0, node_crypto.randomBytes)(32).toString("base64url");
+				const updated = lines.map((line) => {
+					if (line.startsWith("BETTER_AUTH_SECRET=")) return `BETTER_AUTH_SECRET=${secret}`;
+					return line;
+				}).join("\n");
+				(0, node_fs.writeFileSync)(envPath, updated);
+				_clack_prompts.log.info("Created .env from generated .env.example with generated BETTER_AUTH_SECRET");
+				return true;
+			},
+			catch: (cause) => new EnvEnsureError({ cause })
+		}),
+		load: (configDir, options) => effect.Effect.gen(function* () {
+			if (!options?.force && loadedDirs.has(configDir)) return;
+			const envPath = (0, node_path.join)(configDir, ".env");
+			if (!(0, node_fs.existsSync)(envPath)) return;
+			yield* effect.Effect.try({
+				try: () => (0, dotenv.config)({
+					path: envPath,
+					processEnv: node_process.default.env,
+					quiet: true
+				}),
+				catch: (cause) => new EnvLoadError({ cause })
+			});
+			loadedDirs.add(configDir);
+		}),
+		sync: (configDir, generated, shellEnv) => syncEnvFile(configDir, generated, shellEnv)
+	};
+};
+/**
+* One `ProjectEnv` implementation, installed in two scopes: the CLI provides
+* `ProjectEnvLive` from `bootstrapLayers`, and the plugin runtime installs the
+* same layer with `buildScoped` so it finalizes with the plugin. `makeProjectEnv`
+* is that implementation; command and test callers that need a single shot use
+* the factory and do not register another service.
+*/
+const ProjectEnvLive = effect.Layer.sync(ProjectEnv, () => makeProjectEnv());
+
+//#endregion
+exports.EnvEnsureError = EnvEnsureError;
+exports.EnvLoadError = EnvLoadError;
+exports.EnvSyncError = EnvSyncError;
+exports.ProjectEnv = ProjectEnv;
+exports.ProjectEnvLive = ProjectEnvLive;
+exports.ShellEnv = ShellEnv;
+exports.ShellEnvLive = ShellEnvLive;
+exports.captureShellEnv = captureShellEnv;
+exports.makeProjectEnv = makeProjectEnv;
+exports.syncEnvFile = syncEnvFile;
+//# sourceMappingURL=project-env.cjs.map

package/dist/env/project-env.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-env.cjs","names":["Data","Context","Effect","process","Layer","join","existsSync","readFileSync","writeFileSync","randomBytes","loadDotenv"],"sources":["../../src/env/project-env.ts"],"sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport { existsSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport process from \"node:process\";\nimport * as p from \"@clack/prompts\";\nimport { config as loadDotenv } from \"dotenv\";\nimport { Context, Data, Effect, Layer } from \"effect\";\n\nexport class EnvEnsureError extends Data.TaggedError(\"EnvEnsureError\")<{ cause: unknown }> {}\n\nexport class EnvLoadError extends Data.TaggedError(\"EnvLoadError\")<{ cause: unknown }> {}\n\nexport interface EnvDrift {\n  key: string;\n  from: string | undefined;\n  to: string;\n}\n\nexport class EnvSyncError extends Data.TaggedError(\"EnvSyncError\")<{ cause: unknown }> {}\n\n/**\n * The process environment as exported by the parent shell. Values present\n * here were explicitly provided by the caller (shell, CI, the regression\n * harness) and therefore outrank planner-generated values; values that only\n * exist after `.env` loading do not. The bootstrap program captures this\n * snapshot as its first step — before any `.env` loading — and provides it\n * to the rest of the program as a service.\n */\nexport class ShellEnv extends Context.Service<ShellEnv, Record<string, string>>()(\n  \"everything-dev/ShellEnv\",\n) {}\n\nexport const captureShellEnv: Effect.Effect<Record<string, string>> = Effect.sync(() =>\n  Object.fromEntries(\n    Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] != null),\n  ),\n);\n\nexport const ShellEnvLive = (env: Record<string, string>) => Layer.succeed(ShellEnv, env);\n\n/**\n * Align the bos-owned lines of `.env` with the generated infra env\n * (ports/secrets derived from the resolved dev topology). Keys the caller\n * explicitly exported (`shellEnv`) are skipped — a deliberate override must\n * not be silently reverted on disk. Lines the user added outside the\n * generated key set are untouched. Idempotent.\n */\nconst GENERATED_OWNED_KEYS = new Set([\"BASE_URL\", \"CORS_ORIGIN\"]);\n\nconst maskValue = (key: string, value: string | undefined): string => {\n  if (value === undefined) return \"(absent)\";\n  if (/_DATABASE_URL$|_REDIS_URL$|_SECRET$|_KEY$/.test(key)) {\n    return value.replace(/\\/\\/([^:/@]+):([^@]+)@/, \"//***:***@\");\n  }\n  return value;\n};\n\nexport const syncEnvFile = (\n  configDir: string,\n  generated: Record<string, string>,\n  shellEnv: Record<string, string> = {},\n): Effect.Effect<EnvDrift[], EnvSyncError> =>\n  Effect.gen(function* () {\n    if (Object.keys(generated).length === 0) return [];\n\n    const envPath = join(configDir, \".env\");\n    if (!existsSync(envPath)) return [];\n\n    const lines = yield* Effect.try({\n      try: () => readFileSync(envPath, \"utf-8\").split(\"\\n\"),\n      catch: (cause) => new EnvSyncError({ cause }),\n    });\n\n    const drift: EnvDrift[] = [];\n    const seen = new Set<string>();\n    const keyOf = (line: string): string | null => {\n      const match = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);\n      return match?.[1] ?? null;\n    };\n\n    const updated = lines.map((line) => {\n      const key = keyOf(line);\n      if (!key || !(key in generated)) return line;\n      const shellOwned = key in shellEnv && !GENERATED_OWNED_KEYS.has(key);\n      if (shellOwned) return line;\n      seen.add(key);\n      const value = line.slice(key.length + 1);\n      if (value === generated[key]) return line;\n      drift.push({ key, from: value, to: generated[key] });\n      return `${key}=${generated[key]}`;\n    });\n\n    for (const [key, value] of Object.entries(generated)) {\n      if (seen.has(key)) continue;\n      const shellOwned = key in shellEnv && !GENERATED_OWNED_KEYS.has(key);\n      if (shellOwned) continue;\n      drift.push({ key, from: undefined, to: value });\n      updated.push(`${key}=${value}`);\n    }\n\n    if (drift.length > 0) {\n      yield* Effect.try({\n        try: () => writeFileSync(envPath, updated.join(\"\\n\")),\n        catch: (cause) => new EnvSyncError({ cause }),\n      });\n      for (const { key, from, to } of drift) {\n        yield* Effect.logInfo(\n          `[env] ${key} updated: ${maskValue(key, from)} → ${maskValue(key, to)} (generated from resolved ports)`,\n        );\n      }\n    }\n    return drift;\n  });\n\nexport interface ProjectEnvService {\n  readonly ensureFile: (configDir: string) => Effect.Effect<boolean, EnvEnsureError>;\n  readonly load: (\n    configDir: string,\n    options?: { force?: boolean },\n  ) => Effect.Effect<void, EnvLoadError>;\n  readonly sync: (\n    configDir: string,\n    generated: Record<string, string>,\n    shellEnv: Record<string, string>,\n  ) => Effect.Effect<EnvDrift[], EnvSyncError>;\n}\n\nexport class ProjectEnv extends Context.Service<ProjectEnv, ProjectEnvService>()(\n  \"everything-dev/ProjectEnv\",\n) {}\n\nexport const makeProjectEnv = (): ProjectEnvService => {\n  const loadedDirs = new Set<string>();\n  return {\n    ensureFile: (configDir) =>\n      Effect.try({\n        try: () => {\n          const envPath = join(configDir, \".env\");\n          const examplePath = join(configDir, \".env.example\");\n          if (existsSync(envPath) || !existsSync(examplePath)) return false;\n\n          const content = readFileSync(examplePath, \"utf-8\");\n          const lines = content.split(\"\\n\");\n          const secret = randomBytes(32).toString(\"base64url\");\n          const updated = lines\n            .map((line) => {\n              if (line.startsWith(\"BETTER_AUTH_SECRET=\")) {\n                return `BETTER_AUTH_SECRET=${secret}`;\n              }\n              return line;\n            })\n            .join(\"\\n\");\n\n          writeFileSync(envPath, updated);\n          p.log.info(\"Created .env from generated .env.example with generated BETTER_AUTH_SECRET\");\n          return true;\n        },\n        catch: (cause) => new EnvEnsureError({ cause }),\n      }),\n    load: (configDir, options) =>\n      Effect.gen(function* () {\n        if (!options?.force && loadedDirs.has(configDir)) return;\n        const envPath = join(configDir, \".env\");\n        if (!existsSync(envPath)) return;\n\n        yield* Effect.try({\n          try: () => loadDotenv({ path: envPath, processEnv: process.env, quiet: true }),\n          catch: (cause) => new EnvLoadError({ cause }),\n        });\n        loadedDirs.add(configDir);\n      }),\n    sync: (configDir, generated, shellEnv) => syncEnvFile(configDir, generated, shellEnv),\n  };\n};\n\n/**\n * One `ProjectEnv` implementation, installed in two scopes: the CLI provides\n * `ProjectEnvLive` from `bootstrapLayers`, and the plugin runtime installs the\n * same layer with `buildScoped` so it finalizes with the plugin. `makeProjectEnv`\n * is that implementation; command and test callers that need a single shot use\n * the factory and do not register another service.\n */\nexport const ProjectEnvLive: Layer.Layer<ProjectEnv> = Layer.sync(ProjectEnv, () =>\n  makeProjectEnv(),\n);\n"],"mappings":";;;;;;;;;;;;AAQA,IAAa,iBAAb,cAAoCA,YAAK,YAAY,gBAAgB,CAAC,CAAqB,CAAC;AAE5F,IAAa,eAAb,cAAkCA,YAAK,YAAY,cAAc,CAAC,CAAqB,CAAC;AAQxF,IAAa,eAAb,cAAkCA,YAAK,YAAY,cAAc,CAAC,CAAqB,CAAC;;;;;;;;;AAUxF,IAAa,WAAb,cAA8BC,eAAQ,QAA0C,CAAC,CAC/E,yBACF,CAAC,CAAC,CAAC;AAEH,MAAa,kBAAyDC,cAAO,WAC3E,OAAO,YACL,OAAO,QAAQC,qBAAQ,GAAG,CAAC,CAAC,QAAQ,UAAqC,MAAM,MAAM,IAAI,CAC3F,CACF;AAEA,MAAa,gBAAgB,QAAgCC,aAAM,QAAQ,UAAU,GAAG;;;;;;;;AASxF,MAAM,uCAAuB,IAAI,IAAI,CAAC,YAAY,aAAa,CAAC;AAEhE,MAAM,aAAa,KAAa,UAAsC;CACpE,IAAI,UAAU,QAAW,OAAO;CAChC,IAAI,4CAA4C,KAAK,GAAG,GACtD,OAAO,MAAM,QAAQ,0BAA0B,YAAY;CAE7D,OAAO;AACT;AAEA,MAAa,eACX,WACA,WACA,WAAmC,CAAC,MAEpCF,cAAO,IAAI,aAAa;CACtB,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,WAAW,GAAG,OAAO,CAAC;CAEjD,MAAM,cAAUG,gBAAK,WAAW,MAAM;CACtC,IAAI,KAACC,oBAAW,OAAO,GAAG,OAAO,CAAC;CAElC,MAAM,QAAQ,OAAOJ,cAAO,IAAI;EAC9B,eAAWK,sBAAa,SAAS,OAAO,CAAC,CAAC,MAAM,IAAI;EACpD,QAAQ,UAAU,IAAI,aAAa,EAAE,MAAM,CAAC;CAC9C,CAAC;CAED,MAAM,QAAoB,CAAC;CAC3B,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,SAAS,SAAgC;EAE7C,OADc,kCAAkC,KAAK,IAC1C,CAAC,GAAG,MAAM;CACvB;CAEA,MAAM,UAAU,MAAM,KAAK,SAAS;EAClC,MAAM,MAAM,MAAM,IAAI;EACtB,IAAI,CAAC,OAAO,EAAE,OAAO,YAAY,OAAO;EAExC,IADmB,OAAO,YAAY,CAAC,qBAAqB,IAAI,GAAG,GACnD,OAAO;EACvB,KAAK,IAAI,GAAG;EACZ,MAAM,QAAQ,KAAK,MAAM,IAAI,SAAS,CAAC;EACvC,IAAI,UAAU,UAAU,MAAM,OAAO;EACrC,MAAM,KAAK;GAAE;GAAK,MAAM;GAAO,IAAI,UAAU;EAAK,CAAC;EACnD,OAAO,GAAG,IAAI,GAAG,UAAU;CAC7B,CAAC;CAED,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,GAAG;EACpD,IAAI,KAAK,IAAI,GAAG,GAAG;EAEnB,IADmB,OAAO,YAAY,CAAC,qBAAqB,IAAI,GAAG,GACnD;EAChB,MAAM,KAAK;GAAE;GAAK,MAAM;GAAW,IAAI;EAAM,CAAC;EAC9C,QAAQ,KAAK,GAAG,IAAI,GAAG,OAAO;CAChC;CAEA,IAAI,MAAM,SAAS,GAAG;EACpB,OAAOL,cAAO,IAAI;GAChB,eAAWM,uBAAc,SAAS,QAAQ,KAAK,IAAI,CAAC;GACpD,QAAQ,UAAU,IAAI,aAAa,EAAE,MAAM,CAAC;EAC9C,CAAC;EACD,KAAK,MAAM,EAAE,KAAK,MAAM,QAAQ,OAC9B,OAAON,cAAO,QACZ,SAAS,IAAI,YAAY,UAAU,KAAK,IAAI,EAAE,KAAK,UAAU,KAAK,EAAE,EAAE,iCACxE;CAEJ;CACA,OAAO;AACT,CAAC;AAeH,IAAa,aAAb,cAAgCD,eAAQ,QAAuC,CAAC,CAC9E,2BACF,CAAC,CAAC,CAAC;AAEH,MAAa,uBAA0C;CACrD,MAAM,6BAAa,IAAI,IAAY;CACnC,OAAO;EACL,aAAa,cACXC,cAAO,IAAI;GACT,WAAW;IACT,MAAM,cAAUG,gBAAK,WAAW,MAAM;IACtC,MAAM,kBAAcA,gBAAK,WAAW,cAAc;IAClD,QAAIC,oBAAW,OAAO,KAAK,KAACA,oBAAW,WAAW,GAAG,OAAO;IAG5D,MAAM,YADUC,sBAAa,aAAa,OACtB,CAAC,CAAC,MAAM,IAAI;IAChC,MAAM,aAASE,yBAAY,EAAE,CAAC,CAAC,SAAS,WAAW;IACnD,MAAM,UAAU,MACb,KAAK,SAAS;KACb,IAAI,KAAK,WAAW,qBAAqB,GACvC,OAAO,sBAAsB;KAE/B,OAAO;IACT,CAAC,CAAC,CACD,KAAK,IAAI;IAEZ,2BAAc,SAAS,OAAO;IAC9B,eAAE,IAAI,KAAK,4EAA4E;IACvF,OAAO;GACT;GACA,QAAQ,UAAU,IAAI,eAAe,EAAE,MAAM,CAAC;EAChD,CAAC;EACH,OAAO,WAAW,YAChBP,cAAO,IAAI,aAAa;GACtB,IAAI,CAAC,SAAS,SAAS,WAAW,IAAI,SAAS,GAAG;GAClD,MAAM,cAAUG,gBAAK,WAAW,MAAM;GACtC,IAAI,KAACC,oBAAW,OAAO,GAAG;GAE1B,OAAOJ,cAAO,IAAI;IAChB,eAAWQ,eAAW;KAAE,MAAM;KAAS,YAAYP,qBAAQ;KAAK,OAAO;IAAK,CAAC;IAC7E,QAAQ,UAAU,IAAI,aAAa,EAAE,MAAM,CAAC;GAC9C,CAAC;GACD,WAAW,IAAI,SAAS;EAC1B,CAAC;EACH,OAAO,WAAW,WAAW,aAAa,YAAY,WAAW,WAAW,QAAQ;CACtF;AACF;;;;;;;;AASA,MAAa,iBAA0CC,aAAM,KAAK,kBAChE,eAAe,CACjB"}

package/dist/env/project-env.d.cts

@@ -0,0 +1 @@
+import { Context, Effect, Layer } from "effect";

package/dist/env/project-env.d.mts

@@ -0,0 +1 @@
+import { Context, Effect, Layer } from "effect";

package/dist/env/project-env.mjs

@@ -0,0 +1,132 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { Context, Data, Effect, Layer } from "effect";
+import { randomBytes } from "node:crypto";
+import process from "node:process";
+import { config } from "dotenv";
+import * as p from "@clack/prompts";
+
+//#region src/env/project-env.ts
+var EnvEnsureError = class extends Data.TaggedError("EnvEnsureError") {};
+var EnvLoadError = class extends Data.TaggedError("EnvLoadError") {};
+var EnvSyncError = class extends Data.TaggedError("EnvSyncError") {};
+/**
+* The process environment as exported by the parent shell. Values present
+* here were explicitly provided by the caller (shell, CI, the regression
+* harness) and therefore outrank planner-generated values; values that only
+* exist after `.env` loading do not. The bootstrap program captures this
+* snapshot as its first step — before any `.env` loading — and provides it
+* to the rest of the program as a service.
+*/
+var ShellEnv = class extends Context.Service()("everything-dev/ShellEnv") {};
+const captureShellEnv = Effect.sync(() => Object.fromEntries(Object.entries(process.env).filter((entry) => entry[1] != null)));
+const ShellEnvLive = (env) => Layer.succeed(ShellEnv, env);
+/**
+* Align the bos-owned lines of `.env` with the generated infra env
+* (ports/secrets derived from the resolved dev topology). Keys the caller
+* explicitly exported (`shellEnv`) are skipped — a deliberate override must
+* not be silently reverted on disk. Lines the user added outside the
+* generated key set are untouched. Idempotent.
+*/
+const GENERATED_OWNED_KEYS = /* @__PURE__ */ new Set(["BASE_URL", "CORS_ORIGIN"]);
+const maskValue = (key, value) => {
+	if (value === void 0) return "(absent)";
+	if (/_DATABASE_URL$|_REDIS_URL$|_SECRET$|_KEY$/.test(key)) return value.replace(/\/\/([^:/@]+):([^@]+)@/, "//***:***@");
+	return value;
+};
+const syncEnvFile = (configDir, generated, shellEnv = {}) => Effect.gen(function* () {
+	if (Object.keys(generated).length === 0) return [];
+	const envPath = join(configDir, ".env");
+	if (!existsSync(envPath)) return [];
+	const lines = yield* Effect.try({
+		try: () => readFileSync(envPath, "utf-8").split("\n"),
+		catch: (cause) => new EnvSyncError({ cause })
+	});
+	const drift = [];
+	const seen = /* @__PURE__ */ new Set();
+	const keyOf = (line) => {
+		return /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line)?.[1] ?? null;
+	};
+	const updated = lines.map((line) => {
+		const key = keyOf(line);
+		if (!key || !(key in generated)) return line;
+		if (key in shellEnv && !GENERATED_OWNED_KEYS.has(key)) return line;
+		seen.add(key);
+		const value = line.slice(key.length + 1);
+		if (value === generated[key]) return line;
+		drift.push({
+			key,
+			from: value,
+			to: generated[key]
+		});
+		return `${key}=${generated[key]}`;
+	});
+	for (const [key, value] of Object.entries(generated)) {
+		if (seen.has(key)) continue;
+		if (key in shellEnv && !GENERATED_OWNED_KEYS.has(key)) continue;
+		drift.push({
+			key,
+			from: void 0,
+			to: value
+		});
+		updated.push(`${key}=${value}`);
+	}
+	if (drift.length > 0) {
+		yield* Effect.try({
+			try: () => writeFileSync(envPath, updated.join("\n")),
+			catch: (cause) => new EnvSyncError({ cause })
+		});
+		for (const { key, from, to } of drift) yield* Effect.logInfo(`[env] ${key} updated: ${maskValue(key, from)} → ${maskValue(key, to)} (generated from resolved ports)`);
+	}
+	return drift;
+});
+var ProjectEnv = class extends Context.Service()("everything-dev/ProjectEnv") {};
+const makeProjectEnv = () => {
+	const loadedDirs = /* @__PURE__ */ new Set();
+	return {
+		ensureFile: (configDir) => Effect.try({
+			try: () => {
+				const envPath = join(configDir, ".env");
+				const examplePath = join(configDir, ".env.example");
+				if (existsSync(envPath) || !existsSync(examplePath)) return false;
+				const lines = readFileSync(examplePath, "utf-8").split("\n");
+				const secret = randomBytes(32).toString("base64url");
+				const updated = lines.map((line) => {
+					if (line.startsWith("BETTER_AUTH_SECRET=")) return `BETTER_AUTH_SECRET=${secret}`;
+					return line;
+				}).join("\n");
+				writeFileSync(envPath, updated);
+				p.log.info("Created .env from generated .env.example with generated BETTER_AUTH_SECRET");
+				return true;
+			},
+			catch: (cause) => new EnvEnsureError({ cause })
+		}),
+		load: (configDir, options) => Effect.gen(function* () {
+			if (!options?.force && loadedDirs.has(configDir)) return;
+			const envPath = join(configDir, ".env");
+			if (!existsSync(envPath)) return;
+			yield* Effect.try({
+				try: () => config({
+					path: envPath,
+					processEnv: process.env,
+					quiet: true
+				}),
+				catch: (cause) => new EnvLoadError({ cause })
+			});
+			loadedDirs.add(configDir);
+		}),
+		sync: (configDir, generated, shellEnv) => syncEnvFile(configDir, generated, shellEnv)
+	};
+};
+/**
+* One `ProjectEnv` implementation, installed in two scopes: the CLI provides
+* `ProjectEnvLive` from `bootstrapLayers`, and the plugin runtime installs the
+* same layer with `buildScoped` so it finalizes with the plugin. `makeProjectEnv`
+* is that implementation; command and test callers that need a single shot use
+* the factory and do not register another service.
+*/
+const ProjectEnvLive = Layer.sync(ProjectEnv, () => makeProjectEnv());
+
+//#endregion
+export { EnvEnsureError, EnvLoadError, EnvSyncError, ProjectEnv, ProjectEnvLive, ShellEnv, ShellEnvLive, captureShellEnv, makeProjectEnv, syncEnvFile };
+//# sourceMappingURL=project-env.mjs.map

package/dist/env/project-env.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-env.mjs","names":["loadDotenv"],"sources":["../../src/env/project-env.ts"],"sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport { existsSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport process from \"node:process\";\nimport * as p from \"@clack/prompts\";\nimport { config as loadDotenv } from \"dotenv\";\nimport { Context, Data, Effect, Layer } from \"effect\";\n\nexport class EnvEnsureError extends Data.TaggedError(\"EnvEnsureError\")<{ cause: unknown }> {}\n\nexport class EnvLoadError extends Data.TaggedError(\"EnvLoadError\")<{ cause: unknown }> {}\n\nexport interface EnvDrift {\n  key: string;\n  from: string | undefined;\n  to: string;\n}\n\nexport class EnvSyncError extends Data.TaggedError(\"EnvSyncError\")<{ cause: unknown }> {}\n\n/**\n * The process environment as exported by the parent shell. Values present\n * here were explicitly provided by the caller (shell, CI, the regression\n * harness) and therefore outrank planner-generated values; values that only\n * exist after `.env` loading do not. The bootstrap program captures this\n * snapshot as its first step — before any `.env` loading — and provides it\n * to the rest of the program as a service.\n */\nexport class ShellEnv extends Context.Service<ShellEnv, Record<string, string>>()(\n  \"everything-dev/ShellEnv\",\n) {}\n\nexport const captureShellEnv: Effect.Effect<Record<string, string>> = Effect.sync(() =>\n  Object.fromEntries(\n    Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] != null),\n  ),\n);\n\nexport const ShellEnvLive = (env: Record<string, string>) => Layer.succeed(ShellEnv, env);\n\n/**\n * Align the bos-owned lines of `.env` with the generated infra env\n * (ports/secrets derived from the resolved dev topology). Keys the caller\n * explicitly exported (`shellEnv`) are skipped — a deliberate override must\n * not be silently reverted on disk. Lines the user added outside the\n * generated key set are untouched. Idempotent.\n */\nconst GENERATED_OWNED_KEYS = new Set([\"BASE_URL\", \"CORS_ORIGIN\"]);\n\nconst maskValue = (key: string, value: string | undefined): string => {\n  if (value === undefined) return \"(absent)\";\n  if (/_DATABASE_URL$|_REDIS_URL$|_SECRET$|_KEY$/.test(key)) {\n    return value.replace(/\\/\\/([^:/@]+):([^@]+)@/, \"//***:***@\");\n  }\n  return value;\n};\n\nexport const syncEnvFile = (\n  configDir: string,\n  generated: Record<string, string>,\n  shellEnv: Record<string, string> = {},\n): Effect.Effect<EnvDrift[], EnvSyncError> =>\n  Effect.gen(function* () {\n    if (Object.keys(generated).length === 0) return [];\n\n    const envPath = join(configDir, \".env\");\n    if (!existsSync(envPath)) return [];\n\n    const lines = yield* Effect.try({\n      try: () => readFileSync(envPath, \"utf-8\").split(\"\\n\"),\n      catch: (cause) => new EnvSyncError({ cause }),\n    });\n\n    const drift: EnvDrift[] = [];\n    const seen = new Set<string>();\n    const keyOf = (line: string): string | null => {\n      const match = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);\n      return match?.[1] ?? null;\n    };\n\n    const updated = lines.map((line) => {\n      const key = keyOf(line);\n      if (!key || !(key in generated)) return line;\n      const shellOwned = key in shellEnv && !GENERATED_OWNED_KEYS.has(key);\n      if (shellOwned) return line;\n      seen.add(key);\n      const value = line.slice(key.length + 1);\n      if (value === generated[key]) return line;\n      drift.push({ key, from: value, to: generated[key] });\n      return `${key}=${generated[key]}`;\n    });\n\n    for (const [key, value] of Object.entries(generated)) {\n      if (seen.has(key)) continue;\n      const shellOwned = key in shellEnv && !GENERATED_OWNED_KEYS.has(key);\n      if (shellOwned) continue;\n      drift.push({ key, from: undefined, to: value });\n      updated.push(`${key}=${value}`);\n    }\n\n    if (drift.length > 0) {\n      yield* Effect.try({\n        try: () => writeFileSync(envPath, updated.join(\"\\n\")),\n        catch: (cause) => new EnvSyncError({ cause }),\n      });\n      for (const { key, from, to } of drift) {\n        yield* Effect.logInfo(\n          `[env] ${key} updated: ${maskValue(key, from)} → ${maskValue(key, to)} (generated from resolved ports)`,\n        );\n      }\n    }\n    return drift;\n  });\n\nexport interface ProjectEnvService {\n  readonly ensureFile: (configDir: string) => Effect.Effect<boolean, EnvEnsureError>;\n  readonly load: (\n    configDir: string,\n    options?: { force?: boolean },\n  ) => Effect.Effect<void, EnvLoadError>;\n  readonly sync: (\n    configDir: string,\n    generated: Record<string, string>,\n    shellEnv: Record<string, string>,\n  ) => Effect.Effect<EnvDrift[], EnvSyncError>;\n}\n\nexport class ProjectEnv extends Context.Service<ProjectEnv, ProjectEnvService>()(\n  \"everything-dev/ProjectEnv\",\n) {}\n\nexport const makeProjectEnv = (): ProjectEnvService => {\n  const loadedDirs = new Set<string>();\n  return {\n    ensureFile: (configDir) =>\n      Effect.try({\n        try: () => {\n          const envPath = join(configDir, \".env\");\n          const examplePath = join(configDir, \".env.example\");\n          if (existsSync(envPath) || !existsSync(examplePath)) return false;\n\n          const content = readFileSync(examplePath, \"utf-8\");\n          const lines = content.split(\"\\n\");\n          const secret = randomBytes(32).toString(\"base64url\");\n          const updated = lines\n            .map((line) => {\n              if (line.startsWith(\"BETTER_AUTH_SECRET=\")) {\n                return `BETTER_AUTH_SECRET=${secret}`;\n              }\n              return line;\n            })\n            .join(\"\\n\");\n\n          writeFileSync(envPath, updated);\n          p.log.info(\"Created .env from generated .env.example with generated BETTER_AUTH_SECRET\");\n          return true;\n        },\n        catch: (cause) => new EnvEnsureError({ cause }),\n      }),\n    load: (configDir, options) =>\n      Effect.gen(function* () {\n        if (!options?.force && loadedDirs.has(configDir)) return;\n        const envPath = join(configDir, \".env\");\n        if (!existsSync(envPath)) return;\n\n        yield* Effect.try({\n          try: () => loadDotenv({ path: envPath, processEnv: process.env, quiet: true }),\n          catch: (cause) => new EnvLoadError({ cause }),\n        });\n        loadedDirs.add(configDir);\n      }),\n    sync: (configDir, generated, shellEnv) => syncEnvFile(configDir, generated, shellEnv),\n  };\n};\n\n/**\n * One `ProjectEnv` implementation, installed in two scopes: the CLI provides\n * `ProjectEnvLive` from `bootstrapLayers`, and the plugin runtime installs the\n * same layer with `buildScoped` so it finalizes with the plugin. `makeProjectEnv`\n * is that implementation; command and test callers that need a single shot use\n * the factory and do not register another service.\n */\nexport const ProjectEnvLive: Layer.Layer<ProjectEnv> = Layer.sync(ProjectEnv, () =>\n  makeProjectEnv(),\n);\n"],"mappings":";;;;;;;;;AAQA,IAAa,iBAAb,cAAoC,KAAK,YAAY,gBAAgB,CAAC,CAAqB,CAAC;AAE5F,IAAa,eAAb,cAAkC,KAAK,YAAY,cAAc,CAAC,CAAqB,CAAC;AAQxF,IAAa,eAAb,cAAkC,KAAK,YAAY,cAAc,CAAC,CAAqB,CAAC;;;;;;;;;AAUxF,IAAa,WAAb,cAA8B,QAAQ,QAA0C,CAAC,CAC/E,yBACF,CAAC,CAAC,CAAC;AAEH,MAAa,kBAAyD,OAAO,WAC3E,OAAO,YACL,OAAO,QAAQ,QAAQ,GAAG,CAAC,CAAC,QAAQ,UAAqC,MAAM,MAAM,IAAI,CAC3F,CACF;AAEA,MAAa,gBAAgB,QAAgC,MAAM,QAAQ,UAAU,GAAG;;;;;;;;AASxF,MAAM,uCAAuB,IAAI,IAAI,CAAC,YAAY,aAAa,CAAC;AAEhE,MAAM,aAAa,KAAa,UAAsC;CACpE,IAAI,UAAU,QAAW,OAAO;CAChC,IAAI,4CAA4C,KAAK,GAAG,GACtD,OAAO,MAAM,QAAQ,0BAA0B,YAAY;CAE7D,OAAO;AACT;AAEA,MAAa,eACX,WACA,WACA,WAAmC,CAAC,MAEpC,OAAO,IAAI,aAAa;CACtB,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,WAAW,GAAG,OAAO,CAAC;CAEjD,MAAM,UAAU,KAAK,WAAW,MAAM;CACtC,IAAI,CAAC,WAAW,OAAO,GAAG,OAAO,CAAC;CAElC,MAAM,QAAQ,OAAO,OAAO,IAAI;EAC9B,WAAW,aAAa,SAAS,OAAO,CAAC,CAAC,MAAM,IAAI;EACpD,QAAQ,UAAU,IAAI,aAAa,EAAE,MAAM,CAAC;CAC9C,CAAC;CAED,MAAM,QAAoB,CAAC;CAC3B,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,SAAS,SAAgC;EAE7C,OADc,kCAAkC,KAAK,IAC1C,CAAC,GAAG,MAAM;CACvB;CAEA,MAAM,UAAU,MAAM,KAAK,SAAS;EAClC,MAAM,MAAM,MAAM,IAAI;EACtB,IAAI,CAAC,OAAO,EAAE,OAAO,YAAY,OAAO;EAExC,IADmB,OAAO,YAAY,CAAC,qBAAqB,IAAI,GAAG,GACnD,OAAO;EACvB,KAAK,IAAI,GAAG;EACZ,MAAM,QAAQ,KAAK,MAAM,IAAI,SAAS,CAAC;EACvC,IAAI,UAAU,UAAU,MAAM,OAAO;EACrC,MAAM,KAAK;GAAE;GAAK,MAAM;GAAO,IAAI,UAAU;EAAK,CAAC;EACnD,OAAO,GAAG,IAAI,GAAG,UAAU;CAC7B,CAAC;CAED,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,GAAG;EACpD,IAAI,KAAK,IAAI,GAAG,GAAG;EAEnB,IADmB,OAAO,YAAY,CAAC,qBAAqB,IAAI,GAAG,GACnD;EAChB,MAAM,KAAK;GAAE;GAAK,MAAM;GAAW,IAAI;EAAM,CAAC;EAC9C,QAAQ,KAAK,GAAG,IAAI,GAAG,OAAO;CAChC;CAEA,IAAI,MAAM,SAAS,GAAG;EACpB,OAAO,OAAO,IAAI;GAChB,WAAW,cAAc,SAAS,QAAQ,KAAK,IAAI,CAAC;GACpD,QAAQ,UAAU,IAAI,aAAa,EAAE,MAAM,CAAC;EAC9C,CAAC;EACD,KAAK,MAAM,EAAE,KAAK,MAAM,QAAQ,OAC9B,OAAO,OAAO,QACZ,SAAS,IAAI,YAAY,UAAU,KAAK,IAAI,EAAE,KAAK,UAAU,KAAK,EAAE,EAAE,iCACxE;CAEJ;CACA,OAAO;AACT,CAAC;AAeH,IAAa,aAAb,cAAgC,QAAQ,QAAuC,CAAC,CAC9E,2BACF,CAAC,CAAC,CAAC;AAEH,MAAa,uBAA0C;CACrD,MAAM,6BAAa,IAAI,IAAY;CACnC,OAAO;EACL,aAAa,cACX,OAAO,IAAI;GACT,WAAW;IACT,MAAM,UAAU,KAAK,WAAW,MAAM;IACtC,MAAM,cAAc,KAAK,WAAW,cAAc;IAClD,IAAI,WAAW,OAAO,KAAK,CAAC,WAAW,WAAW,GAAG,OAAO;IAG5D,MAAM,QADU,aAAa,aAAa,OACtB,CAAC,CAAC,MAAM,IAAI;IAChC,MAAM,SAAS,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;IACnD,MAAM,UAAU,MACb,KAAK,SAAS;KACb,IAAI,KAAK,WAAW,qBAAqB,GACvC,OAAO,sBAAsB;KAE/B,OAAO;IACT,CAAC,CAAC,CACD,KAAK,IAAI;IAEZ,cAAc,SAAS,OAAO;IAC9B,EAAE,IAAI,KAAK,4EAA4E;IACvF,OAAO;GACT;GACA,QAAQ,UAAU,IAAI,eAAe,EAAE,MAAM,CAAC;EAChD,CAAC;EACH,OAAO,WAAW,YAChB,OAAO,IAAI,aAAa;GACtB,IAAI,CAAC,SAAS,SAAS,WAAW,IAAI,SAAS,GAAG;GAClD,MAAM,UAAU,KAAK,WAAW,MAAM;GACtC,IAAI,CAAC,WAAW,OAAO,GAAG;GAE1B,OAAO,OAAO,IAAI;IAChB,WAAWA,OAAW;KAAE,MAAM;KAAS,YAAY,QAAQ;KAAK,OAAO;IAAK,CAAC;IAC7E,QAAQ,UAAU,IAAI,aAAa,EAAE,MAAM,CAAC;GAC9C,CAAC;GACD,WAAW,IAAI,SAAS;EAC1B,CAAC;EACH,OAAO,WAAW,WAAW,aAAa,YAAY,WAAW,WAAW,QAAQ;CACtF;AACF;;;;;;;;AASA,MAAa,iBAA0C,MAAM,KAAK,kBAChE,eAAe,CACjB"}

package/dist/fastkv.cjs

@@ -5,29 +5,34 @@ const require_http_client = require('./http-client.cjs');
 function getNetworkIdForAccount(accountId) {
 	return accountId.endsWith(".testnet") ? "testnet" : "mainnet";
 }
+const FASTKV_TESTNET_URL = "https://kv.test.fastnear.com";
+const FASTKV_MAINNET_URL = "https://kv.main.fastnear.com";
+const REGISTRY_NAMESPACE_TESTNET = "dev.allthethings.testnet";
+const REGISTRY_NAMESPACE_MAINNET = "dev.everything.near";
 function getFastKvBaseUrlForNetwork(network) {
-	return network === "testnet" ? process.env.REGISTRY_FASTKV_TESTNET_URL || "https://kv.test.fastnear.com" : process.env.REGISTRY_FASTKV_MAINNET_URL || "https://kv.main.fastnear.com";
+	return network === "testnet" ? FASTKV_TESTNET_URL : FASTKV_MAINNET_URL;
 }
 function getFastKvBaseUrlForAccount(accountId) {
 	return getNetworkIdForAccount(accountId) === "testnet" ? getFastKvBaseUrlForNetwork("testnet") : getFastKvBaseUrlForNetwork("mainnet");
 }
-function buildRegistryConfigUrl(accountId, gatewayId) {
+function buildRegistryConfigUrl(accountId, gatewayId, registry) {
 	const baseUrl = getFastKvBaseUrlForAccount(accountId);
-	const namespace = getRegistryNamespaceForAccount(accountId);
+	const namespace = getRegistryNamespaceForAccount(accountId, registry);
 	const key = encodeURIComponent(getRegistryConfigKey(accountId, gatewayId));
 	return `${baseUrl}/v0/latest/${encodeURIComponent(namespace)}/${encodeURIComponent(accountId)}/${key}`;
 }
-function buildRegistryConfigUrlForNetwork(network, accountId, gatewayId) {
+function buildRegistryConfigUrlForNetwork(network, accountId, gatewayId, registry) {
 	const baseUrl = getFastKvBaseUrlForNetwork(network);
-	const namespace = getRegistryNamespaceForNetwork(network);
+	const namespace = getRegistryNamespaceForNetwork(network, registry);
 	const key = encodeURIComponent(getRegistryConfigKey(accountId, gatewayId));
 	return `${baseUrl}/v0/latest/${encodeURIComponent(namespace)}/${encodeURIComponent(accountId)}/${key}`;
 }
-function getRegistryNamespaceForAccount(accountId) {
-	return accountId.endsWith(".testnet") ? process.env.REGISTRY_FASTKV_TESTNET_NAMESPACE || "dev.everything.near" : process.env.REGISTRY_FASTKV_MAINNET_NAMESPACE || "dev.everything.near";
+function getRegistryNamespaceForAccount(accountId, registry) {
+	return registry ?? getRegistryNamespaceForNetwork(getNetworkIdForAccount(accountId));
 }
-function getRegistryNamespaceForNetwork(network) {
-	return network === "testnet" ? process.env.REGISTRY_FASTKV_TESTNET_NAMESPACE || "dev.everything.near" : process.env.REGISTRY_FASTKV_MAINNET_NAMESPACE || "dev.everything.near";
+function getRegistryNamespaceForNetwork(network, registry) {
+	if (registry) return registry;
+	return network === "testnet" ? REGISTRY_NAMESPACE_TESTNET : REGISTRY_NAMESPACE_MAINNET;
 }
 function getRegistryConfigKey(accountId, gatewayId, pathSegments = []) {
 	return `apps/${accountId}/${gatewayId}${pathSegments.length > 0 ? `/${pathSegments.map((segment) => encodeURIComponent(segment)).join("/")}` : ""}/bos.config.json`;
@@ -45,17 +50,57 @@ function parseBosUrl(bosUrl) {
 		pathSegments: pathSegmentsTail
 	};
 }
-async function fetchBosConfigFromFastKv(bosUrl) {
+async function fetchBosConfigFromFastKv(bosUrl, registry) {
 	const { accountId, gatewayId, pathSegments } = parseBosUrl(bosUrl);
 	const key = encodeURIComponent(getRegistryConfigKey(accountId, gatewayId, pathSegments));
-	const value = (await fetchJson(`${getFastKvBaseUrlForAccount(accountId)}/v0/latest/${encodeURIComponent(getRegistryNamespaceForAccount(accountId))}/${encodeURIComponent(accountId)}/${key}`))?.entries?.find(Boolean)?.value;
+	const value = (await fetchJson(`${getFastKvBaseUrlForAccount(accountId)}/v0/latest/${encodeURIComponent(getRegistryNamespaceForAccount(accountId, registry))}/${encodeURIComponent(accountId)}/${key}`))?.entries?.find(Boolean)?.value;
 	if (!value) throw new Error(`No config found for ${bosUrl}`);
 	if (typeof value === "string") return JSON.parse(value);
 	if (typeof value !== "object") throw new Error(`Invalid config value for ${bosUrl}`);
 	return value;
 }
+const FASTKV_HISTORY_MAX_LIMIT = 200;
+/**
+* Publish history for the registry config key (atomic-deploys 11): the
+* exact-key variant of FastData's history endpoint, newest-first. The API
+* caps a page at 200 rows; a config key's write history fits well inside
+* that, so a single request is the whole story (the limit param is clamped).
+*/
+async function fetchConfigHistory(opts) {
+	const key = encodeURIComponent(getRegistryConfigKey(opts.accountId, opts.gatewayId));
+	const limit = Math.max(1, Math.min(opts.limit ?? 20, FASTKV_HISTORY_MAX_LIMIT));
+	return ((await fetchJson(`${getFastKvBaseUrlForAccount(opts.accountId)}/v0/history/${encodeURIComponent(getRegistryNamespaceForAccount(opts.accountId, opts.registry))}/${encodeURIComponent(opts.accountId)}/${key}?limit=${limit}`))?.entries ?? []).filter(Boolean).map((entry) => ({
+		blockHeight: entry.block_height ?? 0,
+		blockTimestampNs: String(entry.block_timestamp ?? ""),
+		...entry.tx_hash ? { txHash: entry.tx_hash } : {},
+		value: typeof entry.value === "string" && entry.value.length > 0 ? JSON.parse(entry.value) : entry.value
+	})).sort((a, b) => b.blockHeight - a.blockHeight);
+}
+/**
+* The per-deploy audit trail (atomic-deploys 03/12): every publish writes
+* `apps/<account>/<gateway>/manifests/<ts>.json` atomically with the pointer
+* swap — this lists that key family newest-first via the history-by-prefix
+* endpoint.
+*/
+async function fetchDeployManifests(opts) {
+	const keyPrefix = encodeURIComponent(`${getRegistryConfigKey(opts.accountId, opts.gatewayId).replace(/bos\.config\.json$/, "")}manifests/`);
+	return ((await fetchJson(`${getFastKvBaseUrlForAccount(opts.accountId)}/v0/history/${encodeURIComponent(getRegistryNamespaceForAccount(opts.accountId, opts.registry))}/${encodeURIComponent(opts.accountId)}`, {
+		method: "POST",
+		body: JSON.stringify({
+			key_prefix: decodeURIComponent(keyPrefix),
+			asc: false,
+			limit: Math.max(1, Math.min(opts.limit ?? 20, FASTKV_HISTORY_MAX_LIMIT))
+		})
+	}))?.entries ?? []).filter(Boolean).map((entry) => ({
+		key: entry.key ?? "",
+		blockHeight: entry.block_height ?? 0,
+		blockTimestampNs: String(entry.block_timestamp ?? ""),
+		value: typeof entry.value === "string" && entry.value.length > 0 ? JSON.parse(entry.value) : entry.value
+	})).sort((a, b) => b.blockHeight - a.blockHeight);
+}
 async function fetchRemotePluginManifest(cdnUrl) {
-	return require_http_client.fetchJsonOrNull(`${cdnUrl.replace(/\/$/, "")}/plugin.manifest.json`, { retries: 0 });
+	const baseUrl = cdnUrl.replace(/\/$/, "");
+	return require_http_client.fetchJsonOrNull(`${baseUrl}/plugin.manifest.json`, { retries: 2 });
 }
 async function fetchJson(url, init) {
 	const headers = {
@@ -75,6 +120,8 @@ async function fetchJson(url, init) {
 exports.buildRegistryConfigUrl = buildRegistryConfigUrl;
 exports.buildRegistryConfigUrlForNetwork = buildRegistryConfigUrlForNetwork;
 exports.fetchBosConfigFromFastKv = fetchBosConfigFromFastKv;
+exports.fetchConfigHistory = fetchConfigHistory;
+exports.fetchDeployManifests = fetchDeployManifests;
 exports.fetchRemotePluginManifest = fetchRemotePluginManifest;
 exports.getFastKvBaseUrlForNetwork = getFastKvBaseUrlForNetwork;
 exports.getRegistryNamespaceForAccount = getRegistryNamespaceForAccount;

package/dist/fastkv.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"fastkv.cjs","names":["fetchJsonOrNull"],"sources":["../src/fastkv.ts"],"sourcesContent":["export type NetworkId = \"mainnet\" | \"testnet\";\n\ninterface FastKvEntry {\n  value: unknown;\n}\n\ninterface FastKvListResponse {\n  entries?: Array<FastKvEntry | null>;\n}\n\nimport { fetchJsonOrNull } from \"./http-client\";\n\nfunction getNetworkIdForAccount(accountId: string): NetworkId {\n  return accountId.endsWith(\".testnet\") ? \"testnet\" : \"mainnet\";\n}\n\nexport function getFastKvBaseUrlForNetwork(network: NetworkId): string {\n  return network === \"testnet\"\n    ? process.env.REGISTRY_FASTKV_TESTNET_URL || \"https://kv.test.fastnear.com\"\n    : process.env.REGISTRY_FASTKV_MAINNET_URL || \"https://kv.main.fastnear.com\";\n}\n\nfunction getFastKvBaseUrlForAccount(accountId: string): string {\n  return getNetworkIdForAccount(accountId) === \"testnet\"\n    ? getFastKvBaseUrlForNetwork(\"testnet\")\n    : getFastKvBaseUrlForNetwork(\"mainnet\");\n}\n\nexport function buildRegistryConfigUrl(accountId: string, gatewayId: string): string {\n  const baseUrl = getFastKvBaseUrlForAccount(accountId);\n  const namespace = getRegistryNamespaceForAccount(accountId);\n  const key = encodeURIComponent(getRegistryConfigKey(accountId, gatewayId));\n  return `${baseUrl}/v0/latest/${encodeURIComponent(namespace)}/${encodeURIComponent(accountId)}/${key}`;\n}\n\nexport function buildRegistryConfigUrlForNetwork(\n  network: NetworkId,\n  accountId: string,\n  gatewayId: string,\n): string {\n  const baseUrl = getFastKvBaseUrlForNetwork(network);\n  const namespace = getRegistryNamespaceForNetwork(network);\n  const key = encodeURIComponent(getRegistryConfigKey(accountId, gatewayId));\n  return `${baseUrl}/v0/latest/${encodeURIComponent(namespace)}/${encodeURIComponent(accountId)}/${key}`;\n}\n\nexport function getRegistryNamespaceForAccount(accountId: string): string {\n  return accountId.endsWith(\".testnet\")\n    ? process.env.REGISTRY_FASTKV_TESTNET_NAMESPACE || \"dev.everything.near\"\n    : process.env.REGISTRY_FASTKV_MAINNET_NAMESPACE || \"dev.everything.near\";\n}\n\nexport function getRegistryNamespaceForNetwork(network: NetworkId): string {\n  return network === \"testnet\"\n    ? process.env.REGISTRY_FASTKV_TESTNET_NAMESPACE || \"dev.everything.near\"\n    : process.env.REGISTRY_FASTKV_MAINNET_NAMESPACE || \"dev.everything.near\";\n}\n\nfunction getRegistryConfigKey(\n  accountId: string,\n  gatewayId: string,\n  pathSegments: string[] = [],\n): string {\n  const suffix =\n    pathSegments.length > 0\n      ? `/${pathSegments.map((segment) => encodeURIComponent(segment)).join(\"/\")}`\n      : \"\";\n  return `apps/${accountId}/${gatewayId}${suffix}/bos.config.json`;\n}\n\nexport function parseBosUrl(bosUrl: string): {\n  accountId: string;\n  gatewayId: string;\n  pathSegments: string[];\n} {\n  const strippedUrl = bosUrl.split(\"#\")[0];\n  const match = strippedUrl.match(/^bos:\\/\\/([^/]+)\\/(.+)$/);\n  if (!match?.[1] || !match[2]) {\n    throw new Error(`Invalid BOS URL: ${bosUrl}`);\n  }\n\n  const pathSegments = match[2]\n    .split(\"/\")\n    .filter(Boolean)\n    .map((segment) => decodeURIComponent(segment));\n  if (pathSegments.length === 0) {\n    throw new Error(`Invalid BOS URL: ${bosUrl}`);\n  }\n\n  const [gatewayId, ...pathSegmentsTail] = pathSegments;\n  if (!gatewayId) {\n    throw new Error(`Invalid BOS URL: ${bosUrl}`);\n  }\n\n  return {\n    accountId: match[1],\n    gatewayId,\n    pathSegments: pathSegmentsTail,\n  };\n}\n\nexport async function fetchBosConfigFromFastKv<T>(bosUrl: string): Promise<T> {\n  const { accountId, gatewayId, pathSegments } = parseBosUrl(bosUrl);\n  const key = encodeURIComponent(getRegistryConfigKey(accountId, gatewayId, pathSegments));\n  const payload = await fetchJson<FastKvListResponse>(\n    `${getFastKvBaseUrlForAccount(accountId)}/v0/latest/${encodeURIComponent(getRegistryNamespaceForAccount(accountId))}/${encodeURIComponent(accountId)}/${key}`,\n  );\n  const value = payload?.entries?.find(Boolean)?.value;\n\n  if (!value) {\n    throw new Error(`No config found for ${bosUrl}`);\n  }\n\n  if (typeof value === \"string\") {\n    return JSON.parse(value) as T;\n  }\n\n  if (typeof value !== \"object\") {\n    throw new Error(`Invalid config value for ${bosUrl}`);\n  }\n\n  return value as T;\n}\n\nexport interface PluginManifest {\n  schemaVersion: number;\n  kind: string;\n  plugin: { name: string; version: string };\n  runtime: { remoteEntry: string };\n  contract: {\n    kind: string;\n    types: { path: string; exportName: string; typeName: string; sha256: string };\n  };\n  additionalExports?: Array<{ path: string; exports: string[]; sha256: string }>;\n}\n\nexport async function fetchRemotePluginManifest(cdnUrl: string): Promise<PluginManifest | null> {\n  const baseUrl = cdnUrl.replace(/\\/$/, \"\");\n  return fetchJsonOrNull<PluginManifest>(`${baseUrl}/plugin.manifest.json`, { retries: 0 });\n}\n\nasync function fetchJson<T>(url: string, init?: RequestInit): Promise<T | null> {\n  const headers: Record<string, string> = {\n    accept: \"application/json\",\n    \"content-type\": \"application/json\",\n    ...(init?.headers as Record<string, string> | undefined),\n  };\n  return fetchJsonOrNull<T>(url, {\n    method: init?.method,\n    headers,\n    body: init?.body ?? undefined,\n    retries: 3,\n  });\n}\n"],"mappings":";;;;AAYA,SAAS,uBAAuB,WAA8B;CAC5D,OAAO,UAAU,SAAS,UAAU,IAAI,YAAY;AACtD;AAEA,SAAgB,2BAA2B,SAA4B;CACrE,OAAO,YAAY,YACf,QAAQ,IAAI,+BAA+B,iCAC3C,QAAQ,IAAI,+BAA+B;AACjD;AAEA,SAAS,2BAA2B,WAA2B;CAC7D,OAAO,uBAAuB,SAAS,MAAM,YACzC,2BAA2B,SAAS,IACpC,2BAA2B,SAAS;AAC1C;AAEA,SAAgB,uBAAuB,WAAmB,WAA2B;CACnF,MAAM,UAAU,2BAA2B,SAAS;CACpD,MAAM,YAAY,+BAA+B,SAAS;CAC1D,MAAM,MAAM,mBAAmB,qBAAqB,WAAW,SAAS,CAAC;CACzE,OAAO,GAAG,QAAQ,aAAa,mBAAmB,SAAS,EAAE,GAAG,mBAAmB,SAAS,EAAE,GAAG;AACnG;AAEA,SAAgB,iCACd,SACA,WACA,WACQ;CACR,MAAM,UAAU,2BAA2B,OAAO;CAClD,MAAM,YAAY,+BAA+B,OAAO;CACxD,MAAM,MAAM,mBAAmB,qBAAqB,WAAW,SAAS,CAAC;CACzE,OAAO,GAAG,QAAQ,aAAa,mBAAmB,SAAS,EAAE,GAAG,mBAAmB,SAAS,EAAE,GAAG;AACnG;AAEA,SAAgB,+BAA+B,WAA2B;CACxE,OAAO,UAAU,SAAS,UAAU,IAChC,QAAQ,IAAI,qCAAqC,wBACjD,QAAQ,IAAI,qCAAqC;AACvD;AAEA,SAAgB,+BAA+B,SAA4B;CACzE,OAAO,YAAY,YACf,QAAQ,IAAI,qCAAqC,wBACjD,QAAQ,IAAI,qCAAqC;AACvD;AAEA,SAAS,qBACP,WACA,WACA,eAAyB,CAAC,GAClB;CAKR,OAAO,QAAQ,UAAU,GAAG,YAH1B,aAAa,SAAS,IAClB,IAAI,aAAa,KAAK,YAAY,mBAAmB,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,MACvE,GACyC;AACjD;AAEA,SAAgB,YAAY,QAI1B;CAEA,MAAM,QADc,OAAO,MAAM,GAAG,CAAC,CAAC,EACb,CAAC,MAAM,yBAAyB;CACzD,IAAI,CAAC,QAAQ,MAAM,CAAC,MAAM,IACxB,MAAM,IAAI,MAAM,oBAAoB,QAAQ;CAG9C,MAAM,eAAe,MAAM,EAAE,CAC1B,MAAM,GAAG,CAAC,CACV,OAAO,OAAO,CAAC,CACf,KAAK,YAAY,mBAAmB,OAAO,CAAC;CAC/C,IAAI,aAAa,WAAW,GAC1B,MAAM,IAAI,MAAM,oBAAoB,QAAQ;CAG9C,MAAM,CAAC,WAAW,GAAG,oBAAoB;CACzC,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,oBAAoB,QAAQ;CAG9C,OAAO;EACL,WAAW,MAAM;EACjB;EACA,cAAc;CAChB;AACF;AAEA,eAAsB,yBAA4B,QAA4B;CAC5E,MAAM,EAAE,WAAW,WAAW,iBAAiB,YAAY,MAAM;CACjE,MAAM,MAAM,mBAAmB,qBAAqB,WAAW,WAAW,YAAY,CAAC;CAIvF,MAAM,SAAQ,MAHQ,UACpB,GAAG,2BAA2B,SAAS,EAAE,aAAa,mBAAmB,+BAA+B,SAAS,CAAC,EAAE,GAAG,mBAAmB,SAAS,EAAE,GAAG,KAC1J,EACqB,EAAE,SAAS,KAAK,OAAO,CAAC,EAAE;CAE/C,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,uBAAuB,QAAQ;CAGjD,IAAI,OAAO,UAAU,UACnB,OAAO,KAAK,MAAM,KAAK;CAGzB,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,4BAA4B,QAAQ;CAGtD,OAAO;AACT;AAcA,eAAsB,0BAA0B,QAAgD;CAE9F,OAAOA,oCAAgC,GADvB,OAAO,QAAQ,OAAO,EACU,EAAE,wBAAwB,EAAE,SAAS,EAAE,CAAC;AAC1F;AAEA,eAAe,UAAa,KAAa,MAAuC;CAC9E,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;EAChB,GAAI,MAAM;CACZ;CACA,OAAOA,oCAAmB,KAAK;EAC7B,QAAQ,MAAM;EACd;EACA,MAAM,MAAM,QAAQ;EACpB,SAAS;CACX,CAAC;AACH"}
+{"version":3,"file":"fastkv.cjs","names":["fetchJsonOrNull"],"sources":["../src/fastkv.ts"],"sourcesContent":["export type NetworkId = \"mainnet\" | \"testnet\";\n\ninterface FastKvEntry {\n  value: unknown;\n}\n\ninterface FastKvListResponse {\n  entries?: Array<FastKvEntry | null>;\n}\n\nimport { fetchJsonOrNull } from \"./http-client\";\n\nfunction getNetworkIdForAccount(accountId: string): NetworkId {\n  return accountId.endsWith(\".testnet\") ? \"testnet\" : \"mainnet\";\n}\n\nconst FASTKV_TESTNET_URL = \"https://kv.test.fastnear.com\";\nconst FASTKV_MAINNET_URL = \"https://kv.main.fastnear.com\";\nconst REGISTRY_NAMESPACE_TESTNET = \"dev.allthethings.testnet\";\nconst REGISTRY_NAMESPACE_MAINNET = \"dev.everything.near\";\n\nexport function getFastKvBaseUrlForNetwork(network: NetworkId): string {\n  return network === \"testnet\" ? FASTKV_TESTNET_URL : FASTKV_MAINNET_URL;\n}\n\nfunction getFastKvBaseUrlForAccount(accountId: string): string {\n  return getNetworkIdForAccount(accountId) === \"testnet\"\n    ? getFastKvBaseUrlForNetwork(\"testnet\")\n    : getFastKvBaseUrlForNetwork(\"mainnet\");\n}\n\nexport function buildRegistryConfigUrl(\n  accountId: string,\n  gatewayId: string,\n  registry?: string,\n): string {\n  const baseUrl = getFastKvBaseUrlForAccount(accountId);\n  const namespace = getRegistryNamespaceForAccount(accountId, registry);\n  const key = encodeURIComponent(getRegistryConfigKey(accountId, gatewayId));\n  return `${baseUrl}/v0/latest/${encodeURIComponent(namespace)}/${encodeURIComponent(accountId)}/${key}`;\n}\n\nexport function buildRegistryConfigUrlForNetwork(\n  network: NetworkId,\n  accountId: string,\n  gatewayId: string,\n  registry?: string,\n): string {\n  const baseUrl = getFastKvBaseUrlForNetwork(network);\n  const namespace = getRegistryNamespaceForNetwork(network, registry);\n  const key = encodeURIComponent(getRegistryConfigKey(accountId, gatewayId));\n  return `${baseUrl}/v0/latest/${encodeURIComponent(namespace)}/${encodeURIComponent(accountId)}/${key}`;\n}\n\nexport function getRegistryNamespaceForAccount(accountId: string, registry?: string): string {\n  return registry ?? getRegistryNamespaceForNetwork(getNetworkIdForAccount(accountId));\n}\n\nexport function getRegistryNamespaceForNetwork(network: NetworkId, registry?: string): string {\n  if (registry) return registry;\n  return network === \"testnet\" ? REGISTRY_NAMESPACE_TESTNET : REGISTRY_NAMESPACE_MAINNET;\n}\n\nfunction getRegistryConfigKey(\n  accountId: string,\n  gatewayId: string,\n  pathSegments: string[] = [],\n): string {\n  const suffix =\n    pathSegments.length > 0\n      ? `/${pathSegments.map((segment) => encodeURIComponent(segment)).join(\"/\")}`\n      : \"\";\n  return `apps/${accountId}/${gatewayId}${suffix}/bos.config.json`;\n}\n\nexport function parseBosUrl(bosUrl: string): {\n  accountId: string;\n  gatewayId: string;\n  pathSegments: string[];\n} {\n  const strippedUrl = bosUrl.split(\"#\")[0]!;\n  const match = strippedUrl.match(/^bos:\\/\\/([^/]+)\\/(.+)$/);\n  if (!match?.[1] || !match[2]) {\n    throw new Error(`Invalid BOS URL: ${bosUrl}`);\n  }\n\n  const pathSegments = match[2]\n    .split(\"/\")\n    .filter(Boolean)\n    .map((segment) => decodeURIComponent(segment));\n  if (pathSegments.length === 0) {\n    throw new Error(`Invalid BOS URL: ${bosUrl}`);\n  }\n\n  const [gatewayId, ...pathSegmentsTail] = pathSegments;\n  if (!gatewayId) {\n    throw new Error(`Invalid BOS URL: ${bosUrl}`);\n  }\n\n  return {\n    accountId: match[1],\n    gatewayId,\n    pathSegments: pathSegmentsTail,\n  };\n}\n\nexport async function fetchBosConfigFromFastKv<T>(bosUrl: string, registry?: string): Promise<T> {\n  const { accountId, gatewayId, pathSegments } = parseBosUrl(bosUrl);\n  const key = encodeURIComponent(getRegistryConfigKey(accountId, gatewayId, pathSegments));\n  const payload = await fetchJson<FastKvListResponse>(\n    `${getFastKvBaseUrlForAccount(accountId)}/v0/latest/${encodeURIComponent(getRegistryNamespaceForAccount(accountId, registry))}/${encodeURIComponent(accountId)}/${key}`,\n  );\n  const value = payload?.entries?.find(Boolean)?.value;\n\n  if (!value) {\n    throw new Error(`No config found for ${bosUrl}`);\n  }\n\n  if (typeof value === \"string\") {\n    return JSON.parse(value) as T;\n  }\n\n  if (typeof value !== \"object\") {\n    throw new Error(`Invalid config value for ${bosUrl}`);\n  }\n\n  return value as T;\n}\n\nexport interface ConfigHistoryEntry {\n  blockHeight: number;\n  blockTimestampNs: string;\n  txHash?: string;\n  value: unknown;\n}\n\ninterface FastKvHistoryEntry {\n  block_height?: number;\n  block_timestamp?: string | number;\n  tx_hash?: string;\n  value?: unknown;\n}\n\ninterface FastKvHistoryResponse {\n  entries?: Array<FastKvHistoryEntry | null>;\n}\n\nconst FASTKV_HISTORY_MAX_LIMIT = 200;\n\n/**\n * Publish history for the registry config key (atomic-deploys 11): the\n * exact-key variant of FastData's history endpoint, newest-first. The API\n * caps a page at 200 rows; a config key's write history fits well inside\n * that, so a single request is the whole story (the limit param is clamped).\n */\nexport async function fetchConfigHistory(opts: {\n  accountId: string;\n  gatewayId: string;\n  registry?: string;\n  limit?: number;\n}): Promise<ConfigHistoryEntry[]> {\n  const key = encodeURIComponent(getRegistryConfigKey(opts.accountId, opts.gatewayId));\n  const limit = Math.max(1, Math.min(opts.limit ?? 20, FASTKV_HISTORY_MAX_LIMIT));\n  const url = `${getFastKvBaseUrlForAccount(opts.accountId)}/v0/history/${encodeURIComponent(getRegistryNamespaceForAccount(opts.accountId, opts.registry))}/${encodeURIComponent(opts.accountId)}/${key}?limit=${limit}`;\n  const payload = await fetchJson<FastKvHistoryResponse>(url);\n  const entries = (payload?.entries ?? []).filter(Boolean) as FastKvHistoryEntry[];\n\n  return entries\n    .map((entry) => ({\n      blockHeight: entry.block_height ?? 0,\n      blockTimestampNs: String(entry.block_timestamp ?? \"\"),\n      ...(entry.tx_hash ? { txHash: entry.tx_hash } : {}),\n      value:\n        typeof entry.value === \"string\" && entry.value.length > 0\n          ? (JSON.parse(entry.value) as unknown)\n          : entry.value,\n    }))\n    .sort((a, b) => b.blockHeight - a.blockHeight);\n}\n\nexport interface DeployManifestEntry {\n  key: string;\n  blockHeight: number;\n  blockTimestampNs: string;\n  value: unknown;\n}\n\n/**\n * The per-deploy audit trail (atomic-deploys 03/12): every publish writes\n * `apps/<account>/<gateway>/manifests/<ts>.json` atomically with the pointer\n * swap — this lists that key family newest-first via the history-by-prefix\n * endpoint.\n */\nexport async function fetchDeployManifests(opts: {\n  accountId: string;\n  gatewayId: string;\n  registry?: string;\n  limit?: number;\n}): Promise<DeployManifestEntry[]> {\n  const keyPrefix = encodeURIComponent(\n    `${getRegistryConfigKey(opts.accountId, opts.gatewayId).replace(/bos\\.config\\.json$/, \"\")}manifests/`,\n  );\n  const url = `${getFastKvBaseUrlForAccount(opts.accountId)}/v0/history/${encodeURIComponent(getRegistryNamespaceForAccount(opts.accountId, opts.registry))}/${encodeURIComponent(opts.accountId)}`;\n  const payload = await fetchJson<FastKvHistoryResponse>(url, {\n    method: \"POST\",\n    body: JSON.stringify({\n      key_prefix: decodeURIComponent(keyPrefix),\n      asc: false,\n      limit: Math.max(1, Math.min(opts.limit ?? 20, FASTKV_HISTORY_MAX_LIMIT)),\n    }),\n  });\n  const entries = (payload?.entries ?? []).filter(Boolean) as Array<\n    FastKvHistoryEntry & { key?: string }\n  >;\n\n  return entries\n    .map((entry) => ({\n      key: entry.key ?? \"\",\n      blockHeight: entry.block_height ?? 0,\n      blockTimestampNs: String(entry.block_timestamp ?? \"\"),\n      value:\n        typeof entry.value === \"string\" && entry.value.length > 0\n          ? (JSON.parse(entry.value) as unknown)\n          : entry.value,\n    }))\n    .sort((a, b) => b.blockHeight - a.blockHeight);\n}\n\nexport interface PluginManifest {\n  schemaVersion: number;\n  kind: string;\n  plugin: { name: string; version: string };\n  runtime: { remoteEntry: string };\n  contract: {\n    kind: string;\n    types: { path: string; exportName: string; typeName: string; sha256: string };\n  };\n  additionalExports?: Array<{ path: string; exports: string[]; sha256: string }>;\n}\n\nexport async function fetchRemotePluginManifest(cdnUrl: string): Promise<PluginManifest | null> {\n  const baseUrl = cdnUrl.replace(/\\/$/, \"\");\n  return fetchJsonOrNull<PluginManifest>(`${baseUrl}/plugin.manifest.json`, { retries: 2 });\n}\n\nasync function fetchJson<T>(url: string, init?: RequestInit): Promise<T | null> {\n  const headers: Record<string, string> = {\n    accept: \"application/json\",\n    \"content-type\": \"application/json\",\n    ...(init?.headers as Record<string, string> | undefined),\n  };\n  return fetchJsonOrNull<T>(url, {\n    method: init?.method,\n    headers,\n    body: init?.body ?? undefined,\n    retries: 3,\n  });\n}\n"],"mappings":";;;;AAYA,SAAS,uBAAuB,WAA8B;CAC5D,OAAO,UAAU,SAAS,UAAU,IAAI,YAAY;AACtD;AAEA,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAC3B,MAAM,6BAA6B;AACnC,MAAM,6BAA6B;AAEnC,SAAgB,2BAA2B,SAA4B;CACrE,OAAO,YAAY,YAAY,qBAAqB;AACtD;AAEA,SAAS,2BAA2B,WAA2B;CAC7D,OAAO,uBAAuB,SAAS,MAAM,YACzC,2BAA2B,SAAS,IACpC,2BAA2B,SAAS;AAC1C;AAEA,SAAgB,uBACd,WACA,WACA,UACQ;CACR,MAAM,UAAU,2BAA2B,SAAS;CACpD,MAAM,YAAY,+BAA+B,WAAW,QAAQ;CACpE,MAAM,MAAM,mBAAmB,qBAAqB,WAAW,SAAS,CAAC;CACzE,OAAO,GAAG,QAAQ,aAAa,mBAAmB,SAAS,EAAE,GAAG,mBAAmB,SAAS,EAAE,GAAG;AACnG;AAEA,SAAgB,iCACd,SACA,WACA,WACA,UACQ;CACR,MAAM,UAAU,2BAA2B,OAAO;CAClD,MAAM,YAAY,+BAA+B,SAAS,QAAQ;CAClE,MAAM,MAAM,mBAAmB,qBAAqB,WAAW,SAAS,CAAC;CACzE,OAAO,GAAG,QAAQ,aAAa,mBAAmB,SAAS,EAAE,GAAG,mBAAmB,SAAS,EAAE,GAAG;AACnG;AAEA,SAAgB,+BAA+B,WAAmB,UAA2B;CAC3F,OAAO,YAAY,+BAA+B,uBAAuB,SAAS,CAAC;AACrF;AAEA,SAAgB,+BAA+B,SAAoB,UAA2B;CAC5F,IAAI,UAAU,OAAO;CACrB,OAAO,YAAY,YAAY,6BAA6B;AAC9D;AAEA,SAAS,qBACP,WACA,WACA,eAAyB,CAAC,GAClB;CAKR,OAAO,QAAQ,UAAU,GAAG,YAH1B,aAAa,SAAS,IAClB,IAAI,aAAa,KAAK,YAAY,mBAAmB,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,MACvE,GACyC;AACjD;AAEA,SAAgB,YAAY,QAI1B;CAEA,MAAM,QADc,OAAO,MAAM,GAAG,CAAC,CAAC,EACb,CAAC,MAAM,yBAAyB;CACzD,IAAI,CAAC,QAAQ,MAAM,CAAC,MAAM,IACxB,MAAM,IAAI,MAAM,oBAAoB,QAAQ;CAG9C,MAAM,eAAe,MAAM,EAAE,CAC1B,MAAM,GAAG,CAAC,CACV,OAAO,OAAO,CAAC,CACf,KAAK,YAAY,mBAAmB,OAAO,CAAC;CAC/C,IAAI,aAAa,WAAW,GAC1B,MAAM,IAAI,MAAM,oBAAoB,QAAQ;CAG9C,MAAM,CAAC,WAAW,GAAG,oBAAoB;CACzC,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,oBAAoB,QAAQ;CAG9C,OAAO;EACL,WAAW,MAAM;EACjB;EACA,cAAc;CAChB;AACF;AAEA,eAAsB,yBAA4B,QAAgB,UAA+B;CAC/F,MAAM,EAAE,WAAW,WAAW,iBAAiB,YAAY,MAAM;CACjE,MAAM,MAAM,mBAAmB,qBAAqB,WAAW,WAAW,YAAY,CAAC;CAIvF,MAAM,SAAQ,MAHQ,UACpB,GAAG,2BAA2B,SAAS,EAAE,aAAa,mBAAmB,+BAA+B,WAAW,QAAQ,CAAC,EAAE,GAAG,mBAAmB,SAAS,EAAE,GAAG,KACpK,EACqB,EAAE,SAAS,KAAK,OAAO,CAAC,EAAE;CAE/C,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,uBAAuB,QAAQ;CAGjD,IAAI,OAAO,UAAU,UACnB,OAAO,KAAK,MAAM,KAAK;CAGzB,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,4BAA4B,QAAQ;CAGtD,OAAO;AACT;AAoBA,MAAM,2BAA2B;;;;;;;AAQjC,eAAsB,mBAAmB,MAKP;CAChC,MAAM,MAAM,mBAAmB,qBAAqB,KAAK,WAAW,KAAK,SAAS,CAAC;CACnF,MAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,IAAI,KAAK,SAAS,IAAI,wBAAwB,CAAC;CAK9E,SAFiB,MADK,UAAiC,GADxC,2BAA2B,KAAK,SAAS,EAAE,cAAc,mBAAmB,+BAA+B,KAAK,WAAW,KAAK,QAAQ,CAAC,EAAE,GAAG,mBAAmB,KAAK,SAAS,EAAE,GAAG,IAAI,SAAS,OACtJ,EAClC,EAAE,WAAW,CAAC,EAAC,CAAE,OAAO,OAEnC,CAAC,CACX,KAAK,WAAW;EACf,aAAa,MAAM,gBAAgB;EACnC,kBAAkB,OAAO,MAAM,mBAAmB,EAAE;EACpD,GAAI,MAAM,UAAU,EAAE,QAAQ,MAAM,QAAQ,IAAI,CAAC;EACjD,OACE,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,IACnD,KAAK,MAAM,MAAM,KAAK,IACvB,MAAM;CACd,EAAE,CAAC,CACF,MAAM,GAAG,MAAM,EAAE,cAAc,EAAE,WAAW;AACjD;;;;;;;AAeA,eAAsB,qBAAqB,MAKR;CACjC,MAAM,YAAY,mBAChB,GAAG,qBAAqB,KAAK,WAAW,KAAK,SAAS,CAAC,CAAC,QAAQ,sBAAsB,EAAE,EAAE,WAC5F;CAcA,SAJiB,MARK,UAAiC,GADxC,2BAA2B,KAAK,SAAS,EAAE,cAAc,mBAAmB,+BAA+B,KAAK,WAAW,KAAK,QAAQ,CAAC,EAAE,GAAG,mBAAmB,KAAK,SAAS,KAClI;EAC1D,QAAQ;EACR,MAAM,KAAK,UAAU;GACnB,YAAY,mBAAmB,SAAS;GACxC,KAAK;GACL,OAAO,KAAK,IAAI,GAAG,KAAK,IAAI,KAAK,SAAS,IAAI,wBAAwB,CAAC;EACzE,CAAC;CACH,CAAC,EACuB,EAAE,WAAW,CAAC,EAAC,CAAE,OAAO,OAInC,CAAC,CACX,KAAK,WAAW;EACf,KAAK,MAAM,OAAO;EAClB,aAAa,MAAM,gBAAgB;EACnC,kBAAkB,OAAO,MAAM,mBAAmB,EAAE;EACpD,OACE,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,IACnD,KAAK,MAAM,MAAM,KAAK,IACvB,MAAM;CACd,EAAE,CAAC,CACF,MAAM,GAAG,MAAM,EAAE,cAAc,EAAE,WAAW;AACjD;AAcA,eAAsB,0BAA0B,QAAgD;CAC9F,MAAM,UAAU,OAAO,QAAQ,OAAO,EAAE;CACxC,OAAOA,oCAAgC,GAAG,QAAQ,wBAAwB,EAAE,SAAS,EAAE,CAAC;AAC1F;AAEA,eAAe,UAAa,KAAa,MAAuC;CAC9E,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;EAChB,GAAI,MAAM;CACZ;CACA,OAAOA,oCAAmB,KAAK;EAC7B,QAAQ,MAAM;EACd;EACA,MAAM,MAAM,QAAQ;EACpB,SAAS;CACX,CAAC;AACH"}

package/dist/fastkv.d.cts

@@ -1,16 +1,52 @@
 //#region src/fastkv.d.ts
 type NetworkId = "mainnet" | "testnet";
 declare function getFastKvBaseUrlForNetwork(network: NetworkId): string;
-declare function buildRegistryConfigUrl(accountId: string, gatewayId: string): string;
-declare function buildRegistryConfigUrlForNetwork(network: NetworkId, accountId: string, gatewayId: string): string;
-declare function getRegistryNamespaceForAccount(accountId: string): string;
-declare function getRegistryNamespaceForNetwork(network: NetworkId): string;
+declare function buildRegistryConfigUrl(accountId: string, gatewayId: string, registry?: string): string;
+declare function buildRegistryConfigUrlForNetwork(network: NetworkId, accountId: string, gatewayId: string, registry?: string): string;
+declare function getRegistryNamespaceForAccount(accountId: string, registry?: string): string;
+declare function getRegistryNamespaceForNetwork(network: NetworkId, registry?: string): string;
 declare function parseBosUrl(bosUrl: string): {
   accountId: string;
   gatewayId: string;
   pathSegments: string[];
 };
-declare function fetchBosConfigFromFastKv<T>(bosUrl: string): Promise<T>;
+declare function fetchBosConfigFromFastKv<T>(bosUrl: string, registry?: string): Promise<T>;
+interface ConfigHistoryEntry {
+  blockHeight: number;
+  blockTimestampNs: string;
+  txHash?: string;
+  value: unknown;
+}
+/**
+ * Publish history for the registry config key (atomic-deploys 11): the
+ * exact-key variant of FastData's history endpoint, newest-first. The API
+ * caps a page at 200 rows; a config key's write history fits well inside
+ * that, so a single request is the whole story (the limit param is clamped).
+ */
+declare function fetchConfigHistory(opts: {
+  accountId: string;
+  gatewayId: string;
+  registry?: string;
+  limit?: number;
+}): Promise<ConfigHistoryEntry[]>;
+interface DeployManifestEntry {
+  key: string;
+  blockHeight: number;
+  blockTimestampNs: string;
+  value: unknown;
+}
+/**
+ * The per-deploy audit trail (atomic-deploys 03/12): every publish writes
+ * `apps/<account>/<gateway>/manifests/<ts>.json` atomically with the pointer
+ * swap — this lists that key family newest-first via the history-by-prefix
+ * endpoint.
+ */
+declare function fetchDeployManifests(opts: {
+  accountId: string;
+  gatewayId: string;
+  registry?: string;
+  limit?: number;
+}): Promise<DeployManifestEntry[]>;
 interface PluginManifest {
   schemaVersion: number;
   kind: string;
@@ -38,5 +74,5 @@ interface PluginManifest {
 }
 declare function fetchRemotePluginManifest(cdnUrl: string): Promise<PluginManifest | null>;
 //#endregion
-export { NetworkId, PluginManifest, buildRegistryConfigUrl, buildRegistryConfigUrlForNetwork, fetchBosConfigFromFastKv, fetchRemotePluginManifest, getFastKvBaseUrlForNetwork, getRegistryNamespaceForAccount, getRegistryNamespaceForNetwork, parseBosUrl };
+export { ConfigHistoryEntry, DeployManifestEntry, NetworkId, PluginManifest, buildRegistryConfigUrl, buildRegistryConfigUrlForNetwork, fetchBosConfigFromFastKv, fetchConfigHistory, fetchDeployManifests, fetchRemotePluginManifest, getFastKvBaseUrlForNetwork, getRegistryNamespaceForAccount, getRegistryNamespaceForNetwork, parseBosUrl };
 //# sourceMappingURL=fastkv.d.cts.map

package/dist/fastkv.d.mts

@@ -1,16 +1,52 @@
 //#region src/fastkv.d.ts
 type NetworkId = "mainnet" | "testnet";
 declare function getFastKvBaseUrlForNetwork(network: NetworkId): string;
-declare function buildRegistryConfigUrl(accountId: string, gatewayId: string): string;
-declare function buildRegistryConfigUrlForNetwork(network: NetworkId, accountId: string, gatewayId: string): string;
-declare function getRegistryNamespaceForAccount(accountId: string): string;
-declare function getRegistryNamespaceForNetwork(network: NetworkId): string;
+declare function buildRegistryConfigUrl(accountId: string, gatewayId: string, registry?: string): string;
+declare function buildRegistryConfigUrlForNetwork(network: NetworkId, accountId: string, gatewayId: string, registry?: string): string;
+declare function getRegistryNamespaceForAccount(accountId: string, registry?: string): string;
+declare function getRegistryNamespaceForNetwork(network: NetworkId, registry?: string): string;
 declare function parseBosUrl(bosUrl: string): {
   accountId: string;
   gatewayId: string;
   pathSegments: string[];
 };
-declare function fetchBosConfigFromFastKv<T>(bosUrl: string): Promise<T>;
+declare function fetchBosConfigFromFastKv<T>(bosUrl: string, registry?: string): Promise<T>;
+interface ConfigHistoryEntry {
+  blockHeight: number;
+  blockTimestampNs: string;
+  txHash?: string;
+  value: unknown;
+}
+/**
+ * Publish history for the registry config key (atomic-deploys 11): the
+ * exact-key variant of FastData's history endpoint, newest-first. The API
+ * caps a page at 200 rows; a config key's write history fits well inside
+ * that, so a single request is the whole story (the limit param is clamped).
+ */
+declare function fetchConfigHistory(opts: {
+  accountId: string;
+  gatewayId: string;
+  registry?: string;
+  limit?: number;
+}): Promise<ConfigHistoryEntry[]>;
+interface DeployManifestEntry {
+  key: string;
+  blockHeight: number;
+  blockTimestampNs: string;
+  value: unknown;
+}
+/**
+ * The per-deploy audit trail (atomic-deploys 03/12): every publish writes
+ * `apps/<account>/<gateway>/manifests/<ts>.json` atomically with the pointer
+ * swap — this lists that key family newest-first via the history-by-prefix
+ * endpoint.
+ */
+declare function fetchDeployManifests(opts: {
+  accountId: string;
+  gatewayId: string;
+  registry?: string;
+  limit?: number;
+}): Promise<DeployManifestEntry[]>;
 interface PluginManifest {
   schemaVersion: number;
   kind: string;
@@ -38,5 +74,5 @@ interface PluginManifest {
 }
 declare function fetchRemotePluginManifest(cdnUrl: string): Promise<PluginManifest | null>;
 //#endregion
-export { NetworkId, PluginManifest, buildRegistryConfigUrl, buildRegistryConfigUrlForNetwork, fetchBosConfigFromFastKv, fetchRemotePluginManifest, getFastKvBaseUrlForNetwork, getRegistryNamespaceForAccount, getRegistryNamespaceForNetwork, parseBosUrl };
+export { ConfigHistoryEntry, DeployManifestEntry, NetworkId, PluginManifest, buildRegistryConfigUrl, buildRegistryConfigUrlForNetwork, fetchBosConfigFromFastKv, fetchConfigHistory, fetchDeployManifests, fetchRemotePluginManifest, getFastKvBaseUrlForNetwork, getRegistryNamespaceForAccount, getRegistryNamespaceForNetwork, parseBosUrl };
 //# sourceMappingURL=fastkv.d.mts.map