everything-dev 2.0.0-rc.6 → 2.0.0-rc.8

package/dist/ui/router-client.cjs

@@ -33,7 +33,8 @@ function createRouter(opts) {
 					cspNonce: opts.context.cspNonce
 				}),
 				session: opts.context.session,
-				locale: opts.context.locale
+				locale: opts.context.locale,
+				pluginNav: opts.context.pluginNav
 			},
 			...cspNonce ? { ssr: { nonce: cspNonce } } : {},
 			defaultPreload: "intent",

package/dist/ui/router-client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"router-client.cjs","names":["createBrowserHistory","createTanStackRouter","createAuthClient","RouterError","dehydrate"],"sources":["../../src/ui/router-client.tsx"],"sourcesContent":["/**\n * Client router factory — creates a TanStack Router with browser history.\n * The app-specific route tree is injected as `defaultRouteTree` (the\n * bundled core-only fallback); the composed tree wins when manifest\n * construction produced one.\n */\n\nimport { dehydrate, hydrate } from \"@tanstack/react-query\";\nimport {\n  type AnyRoute,\n  createBrowserHistory,\n  createRouter as createTanStackRouter,\n} from \"@tanstack/react-router\";\nimport { createAuthClient } from \"./auth\";\nimport { defaultNotFoundComponent, defaultPendingComponent } from \"./router-defaults\";\nimport { RouterError } from \"./router-error\";\nimport type { CreateRouterOptions, RouterContextWithApi } from \"./types\";\n\nexport interface CoreRouterOptions<TApiClient = unknown, TSession = unknown>\n  extends CreateRouterOptions<TApiClient, TSession> {\n  /** The app's generated route tree — the core-only fallback when no composed tree is passed. */\n  defaultRouteTree?: unknown;\n}\n\nexport function createRouter<\n  TApiClient = unknown,\n  TSession = unknown,\n  TRouteTree extends AnyRoute = AnyRoute,\n>(\n  opts: CoreRouterOptions<TApiClient, TSession> & {\n    context: RouterContextWithApi<TApiClient, TSession> & { authClient?: unknown };\n  },\n) {\n  const queryClient = opts.context.queryClient;\n  const history = opts.history ?? createBrowserHistory();\n  const cspNonce = opts.context.cspNonce;\n\n  const routeTree = opts.routeTree ?? opts.defaultRouteTree;\n  if (!routeTree) {\n    throw new Error(\n      \"createRouter: no route tree — compose failed and no core-only fallback was constructed\",\n    );\n  }\n\n  const router = createTanStackRouter({\n    routeTree: routeTree as TRouteTree,\n    history,\n    basepath: opts.basepath ?? opts.context.runtimeConfig?.runtime?.runtimeBasePath ?? \"/\",\n    context: {\n      queryClient,\n      runtimeConfig: opts.context.runtimeConfig,\n      cspNonce: opts.context.cspNonce,\n      apiClient: opts.context.apiClient,\n      authClient:\n        opts.context.authClient ??\n        createAuthClient({\n          runtimeConfig: opts.context.runtimeConfig,\n          cspNonce: opts.context.cspNonce,\n        }),\n      session: opts.context.session,\n      locale: opts.context.locale,\n    },\n    ...(cspNonce ? { ssr: { nonce: cspNonce } } : {}),\n    defaultPreload: \"intent\",\n    scrollRestoration: true,\n    defaultStructuralSharing: true,\n    defaultPreloadStaleTime: 0,\n    defaultPendingMinMs: 0,\n    defaultErrorComponent: RouterError,\n    defaultNotFoundComponent,\n    defaultPendingComponent,\n    dehydrate: () => {\n      if (typeof window === \"undefined\") {\n        return { queryClientState: dehydrate(queryClient) };\n      }\n\n      return { queryClientState: {} };\n    },\n    hydrate: (dehydrated: { queryClientState?: unknown }) => {\n      if (typeof window !== \"undefined\" && dehydrated?.queryClientState) {\n        hydrate(queryClient, dehydrated.queryClientState);\n      }\n    },\n  });\n\n  return { router, queryClient };\n}\n"],"mappings":";;;;;;;;;;;;;;AAwBA,SAAgB,aAKd,MAGA;CACA,MAAM,cAAc,KAAK,QAAQ;CACjC,MAAM,UAAU,KAAK,eAAWA,6CAAqB;CACrD,MAAM,WAAW,KAAK,QAAQ;CAE9B,MAAM,YAAY,KAAK,aAAa,KAAK;CACzC,IAAI,CAAC,WACH,MAAM,IAAI,MACR,wFACF;CA4CF,OAAO;EAAE,YAzCMC,qCAAqB;GACvB;GACX;GACA,UAAU,KAAK,YAAY,KAAK,QAAQ,eAAe,SAAS,mBAAmB;GACnF,SAAS;IACP;IACA,eAAe,KAAK,QAAQ;IAC5B,UAAU,KAAK,QAAQ;IACvB,WAAW,KAAK,QAAQ;IACxB,YACE,KAAK,QAAQ,cACbC,iCAAiB;KACf,eAAe,KAAK,QAAQ;KAC5B,UAAU,KAAK,QAAQ;IACzB,CAAC;IACH,SAAS,KAAK,QAAQ;IACtB,QAAQ,KAAK,QAAQ;GACvB;GACA,GAAI,WAAW,EAAE,KAAK,EAAE,OAAO,SAAS,EAAE,IAAI,CAAC;GAC/C,gBAAgB;GAChB,mBAAmB;GACnB,0BAA0B;GAC1B,yBAAyB;GACzB,qBAAqB;GACrB,uBAAuBC;GACvB;GACA;GACA,iBAAiB;IACf,IAAI,OAAO,WAAW,aACpB,OAAO,EAAE,sBAAkBC,iCAAU,WAAW,EAAE;IAGpD,OAAO,EAAE,kBAAkB,CAAC,EAAE;GAChC;GACA,UAAU,eAA+C;IACvD,IAAI,OAAO,WAAW,eAAe,YAAY,kBAC/C,mCAAQ,aAAa,WAAW,gBAAgB;GAEpD;EACF,CAEc;EAAG;CAAY;AAC/B"}
+{"version":3,"file":"router-client.cjs","names":["createBrowserHistory","createTanStackRouter","createAuthClient","RouterError","dehydrate"],"sources":["../../src/ui/router-client.tsx"],"sourcesContent":["/**\n * Client router factory — creates a TanStack Router with browser history.\n * The app-specific route tree is injected as `defaultRouteTree` (the\n * bundled core-only fallback); the composed tree wins when manifest\n * construction produced one.\n */\n\nimport { dehydrate, hydrate } from \"@tanstack/react-query\";\nimport {\n  type AnyRoute,\n  createBrowserHistory,\n  createRouter as createTanStackRouter,\n} from \"@tanstack/react-router\";\nimport { createAuthClient } from \"./auth\";\nimport { defaultNotFoundComponent, defaultPendingComponent } from \"./router-defaults\";\nimport { RouterError } from \"./router-error\";\nimport type { CreateRouterOptions, RouterContextWithApi } from \"./types\";\n\nexport interface CoreRouterOptions<TApiClient = unknown, TSession = unknown>\n  extends CreateRouterOptions<TApiClient, TSession> {\n  /** The app's generated route tree — the core-only fallback when no composed tree is passed. */\n  defaultRouteTree?: unknown;\n}\n\nexport function createRouter<\n  TApiClient = unknown,\n  TSession = unknown,\n  TRouteTree extends AnyRoute = AnyRoute,\n>(\n  opts: CoreRouterOptions<TApiClient, TSession> & {\n    context: RouterContextWithApi<TApiClient, TSession> & { authClient?: unknown };\n  },\n) {\n  const queryClient = opts.context.queryClient;\n  const history = opts.history ?? createBrowserHistory();\n  const cspNonce = opts.context.cspNonce;\n\n  const routeTree = opts.routeTree ?? opts.defaultRouteTree;\n  if (!routeTree) {\n    throw new Error(\n      \"createRouter: no route tree — compose failed and no core-only fallback was constructed\",\n    );\n  }\n\n  const router = createTanStackRouter({\n    routeTree: routeTree as TRouteTree,\n    history,\n    basepath: opts.basepath ?? opts.context.runtimeConfig?.runtime?.runtimeBasePath ?? \"/\",\n    context: {\n      queryClient,\n      runtimeConfig: opts.context.runtimeConfig,\n      cspNonce: opts.context.cspNonce,\n      apiClient: opts.context.apiClient,\n      authClient:\n        opts.context.authClient ??\n        createAuthClient({\n          runtimeConfig: opts.context.runtimeConfig,\n          cspNonce: opts.context.cspNonce,\n        }),\n      session: opts.context.session,\n      locale: opts.context.locale,\n      pluginNav: opts.context.pluginNav,\n    },\n    ...(cspNonce ? { ssr: { nonce: cspNonce } } : {}),\n    defaultPreload: \"intent\",\n    scrollRestoration: true,\n    defaultStructuralSharing: true,\n    defaultPreloadStaleTime: 0,\n    defaultPendingMinMs: 0,\n    defaultErrorComponent: RouterError,\n    defaultNotFoundComponent,\n    defaultPendingComponent,\n    dehydrate: () => {\n      if (typeof window === \"undefined\") {\n        return { queryClientState: dehydrate(queryClient) };\n      }\n\n      return { queryClientState: {} };\n    },\n    hydrate: (dehydrated: { queryClientState?: unknown }) => {\n      if (typeof window !== \"undefined\" && dehydrated?.queryClientState) {\n        hydrate(queryClient, dehydrated.queryClientState);\n      }\n    },\n  });\n\n  return { router, queryClient };\n}\n"],"mappings":";;;;;;;;;;;;;;AAwBA,SAAgB,aAKd,MAGA;CACA,MAAM,cAAc,KAAK,QAAQ;CACjC,MAAM,UAAU,KAAK,eAAWA,6CAAqB;CACrD,MAAM,WAAW,KAAK,QAAQ;CAE9B,MAAM,YAAY,KAAK,aAAa,KAAK;CACzC,IAAI,CAAC,WACH,MAAM,IAAI,MACR,wFACF;CA6CF,OAAO;EAAE,YA1CMC,qCAAqB;GACvB;GACX;GACA,UAAU,KAAK,YAAY,KAAK,QAAQ,eAAe,SAAS,mBAAmB;GACnF,SAAS;IACP;IACA,eAAe,KAAK,QAAQ;IAC5B,UAAU,KAAK,QAAQ;IACvB,WAAW,KAAK,QAAQ;IACxB,YACE,KAAK,QAAQ,cACbC,iCAAiB;KACf,eAAe,KAAK,QAAQ;KAC5B,UAAU,KAAK,QAAQ;IACzB,CAAC;IACH,SAAS,KAAK,QAAQ;IACtB,QAAQ,KAAK,QAAQ;IACrB,WAAW,KAAK,QAAQ;GAC1B;GACA,GAAI,WAAW,EAAE,KAAK,EAAE,OAAO,SAAS,EAAE,IAAI,CAAC;GAC/C,gBAAgB;GAChB,mBAAmB;GACnB,0BAA0B;GAC1B,yBAAyB;GACzB,qBAAqB;GACrB,uBAAuBC;GACvB;GACA;GACA,iBAAiB;IACf,IAAI,OAAO,WAAW,aACpB,OAAO,EAAE,sBAAkBC,iCAAU,WAAW,EAAE;IAGpD,OAAO,EAAE,kBAAkB,CAAC,EAAE;GAChC;GACA,UAAU,eAA+C;IACvD,IAAI,OAAO,WAAW,eAAe,YAAY,kBAC/C,mCAAQ,aAAa,WAAW,gBAAgB;GAEpD;EACF,CAEc;EAAG;CAAY;AAC/B"}

package/dist/ui/router-client.mjs

@@ -32,7 +32,8 @@ function createRouter(opts) {
 					cspNonce: opts.context.cspNonce
 				}),
 				session: opts.context.session,
-				locale: opts.context.locale
+				locale: opts.context.locale,
+				pluginNav: opts.context.pluginNav
 			},
 			...cspNonce ? { ssr: { nonce: cspNonce } } : {},
 			defaultPreload: "intent",

package/dist/ui/router-client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"router-client.mjs","names":["createTanStackRouter"],"sources":["../../src/ui/router-client.tsx"],"sourcesContent":["/**\n * Client router factory — creates a TanStack Router with browser history.\n * The app-specific route tree is injected as `defaultRouteTree` (the\n * bundled core-only fallback); the composed tree wins when manifest\n * construction produced one.\n */\n\nimport { dehydrate, hydrate } from \"@tanstack/react-query\";\nimport {\n  type AnyRoute,\n  createBrowserHistory,\n  createRouter as createTanStackRouter,\n} from \"@tanstack/react-router\";\nimport { createAuthClient } from \"./auth\";\nimport { defaultNotFoundComponent, defaultPendingComponent } from \"./router-defaults\";\nimport { RouterError } from \"./router-error\";\nimport type { CreateRouterOptions, RouterContextWithApi } from \"./types\";\n\nexport interface CoreRouterOptions<TApiClient = unknown, TSession = unknown>\n  extends CreateRouterOptions<TApiClient, TSession> {\n  /** The app's generated route tree — the core-only fallback when no composed tree is passed. */\n  defaultRouteTree?: unknown;\n}\n\nexport function createRouter<\n  TApiClient = unknown,\n  TSession = unknown,\n  TRouteTree extends AnyRoute = AnyRoute,\n>(\n  opts: CoreRouterOptions<TApiClient, TSession> & {\n    context: RouterContextWithApi<TApiClient, TSession> & { authClient?: unknown };\n  },\n) {\n  const queryClient = opts.context.queryClient;\n  const history = opts.history ?? createBrowserHistory();\n  const cspNonce = opts.context.cspNonce;\n\n  const routeTree = opts.routeTree ?? opts.defaultRouteTree;\n  if (!routeTree) {\n    throw new Error(\n      \"createRouter: no route tree — compose failed and no core-only fallback was constructed\",\n    );\n  }\n\n  const router = createTanStackRouter({\n    routeTree: routeTree as TRouteTree,\n    history,\n    basepath: opts.basepath ?? opts.context.runtimeConfig?.runtime?.runtimeBasePath ?? \"/\",\n    context: {\n      queryClient,\n      runtimeConfig: opts.context.runtimeConfig,\n      cspNonce: opts.context.cspNonce,\n      apiClient: opts.context.apiClient,\n      authClient:\n        opts.context.authClient ??\n        createAuthClient({\n          runtimeConfig: opts.context.runtimeConfig,\n          cspNonce: opts.context.cspNonce,\n        }),\n      session: opts.context.session,\n      locale: opts.context.locale,\n    },\n    ...(cspNonce ? { ssr: { nonce: cspNonce } } : {}),\n    defaultPreload: \"intent\",\n    scrollRestoration: true,\n    defaultStructuralSharing: true,\n    defaultPreloadStaleTime: 0,\n    defaultPendingMinMs: 0,\n    defaultErrorComponent: RouterError,\n    defaultNotFoundComponent,\n    defaultPendingComponent,\n    dehydrate: () => {\n      if (typeof window === \"undefined\") {\n        return { queryClientState: dehydrate(queryClient) };\n      }\n\n      return { queryClientState: {} };\n    },\n    hydrate: (dehydrated: { queryClientState?: unknown }) => {\n      if (typeof window !== \"undefined\" && dehydrated?.queryClientState) {\n        hydrate(queryClient, dehydrated.queryClientState);\n      }\n    },\n  });\n\n  return { router, queryClient };\n}\n"],"mappings":";;;;;;;;;;;;;AAwBA,SAAgB,aAKd,MAGA;CACA,MAAM,cAAc,KAAK,QAAQ;CACjC,MAAM,UAAU,KAAK,WAAW,qBAAqB;CACrD,MAAM,WAAW,KAAK,QAAQ;CAE9B,MAAM,YAAY,KAAK,aAAa,KAAK;CACzC,IAAI,CAAC,WACH,MAAM,IAAI,MACR,wFACF;CA4CF,OAAO;EAAE,QAzCMA,eAAqB;GACvB;GACX;GACA,UAAU,KAAK,YAAY,KAAK,QAAQ,eAAe,SAAS,mBAAmB;GACnF,SAAS;IACP;IACA,eAAe,KAAK,QAAQ;IAC5B,UAAU,KAAK,QAAQ;IACvB,WAAW,KAAK,QAAQ;IACxB,YACE,KAAK,QAAQ,cACb,iBAAiB;KACf,eAAe,KAAK,QAAQ;KAC5B,UAAU,KAAK,QAAQ;IACzB,CAAC;IACH,SAAS,KAAK,QAAQ;IACtB,QAAQ,KAAK,QAAQ;GACvB;GACA,GAAI,WAAW,EAAE,KAAK,EAAE,OAAO,SAAS,EAAE,IAAI,CAAC;GAC/C,gBAAgB;GAChB,mBAAmB;GACnB,0BAA0B;GAC1B,yBAAyB;GACzB,qBAAqB;GACrB,uBAAuB;GACvB;GACA;GACA,iBAAiB;IACf,IAAI,OAAO,WAAW,aACpB,OAAO,EAAE,kBAAkB,UAAU,WAAW,EAAE;IAGpD,OAAO,EAAE,kBAAkB,CAAC,EAAE;GAChC;GACA,UAAU,eAA+C;IACvD,IAAI,OAAO,WAAW,eAAe,YAAY,kBAC/C,QAAQ,aAAa,WAAW,gBAAgB;GAEpD;EACF,CAEc;EAAG;CAAY;AAC/B"}
+{"version":3,"file":"router-client.mjs","names":["createTanStackRouter"],"sources":["../../src/ui/router-client.tsx"],"sourcesContent":["/**\n * Client router factory — creates a TanStack Router with browser history.\n * The app-specific route tree is injected as `defaultRouteTree` (the\n * bundled core-only fallback); the composed tree wins when manifest\n * construction produced one.\n */\n\nimport { dehydrate, hydrate } from \"@tanstack/react-query\";\nimport {\n  type AnyRoute,\n  createBrowserHistory,\n  createRouter as createTanStackRouter,\n} from \"@tanstack/react-router\";\nimport { createAuthClient } from \"./auth\";\nimport { defaultNotFoundComponent, defaultPendingComponent } from \"./router-defaults\";\nimport { RouterError } from \"./router-error\";\nimport type { CreateRouterOptions, RouterContextWithApi } from \"./types\";\n\nexport interface CoreRouterOptions<TApiClient = unknown, TSession = unknown>\n  extends CreateRouterOptions<TApiClient, TSession> {\n  /** The app's generated route tree — the core-only fallback when no composed tree is passed. */\n  defaultRouteTree?: unknown;\n}\n\nexport function createRouter<\n  TApiClient = unknown,\n  TSession = unknown,\n  TRouteTree extends AnyRoute = AnyRoute,\n>(\n  opts: CoreRouterOptions<TApiClient, TSession> & {\n    context: RouterContextWithApi<TApiClient, TSession> & { authClient?: unknown };\n  },\n) {\n  const queryClient = opts.context.queryClient;\n  const history = opts.history ?? createBrowserHistory();\n  const cspNonce = opts.context.cspNonce;\n\n  const routeTree = opts.routeTree ?? opts.defaultRouteTree;\n  if (!routeTree) {\n    throw new Error(\n      \"createRouter: no route tree — compose failed and no core-only fallback was constructed\",\n    );\n  }\n\n  const router = createTanStackRouter({\n    routeTree: routeTree as TRouteTree,\n    history,\n    basepath: opts.basepath ?? opts.context.runtimeConfig?.runtime?.runtimeBasePath ?? \"/\",\n    context: {\n      queryClient,\n      runtimeConfig: opts.context.runtimeConfig,\n      cspNonce: opts.context.cspNonce,\n      apiClient: opts.context.apiClient,\n      authClient:\n        opts.context.authClient ??\n        createAuthClient({\n          runtimeConfig: opts.context.runtimeConfig,\n          cspNonce: opts.context.cspNonce,\n        }),\n      session: opts.context.session,\n      locale: opts.context.locale,\n      pluginNav: opts.context.pluginNav,\n    },\n    ...(cspNonce ? { ssr: { nonce: cspNonce } } : {}),\n    defaultPreload: \"intent\",\n    scrollRestoration: true,\n    defaultStructuralSharing: true,\n    defaultPreloadStaleTime: 0,\n    defaultPendingMinMs: 0,\n    defaultErrorComponent: RouterError,\n    defaultNotFoundComponent,\n    defaultPendingComponent,\n    dehydrate: () => {\n      if (typeof window === \"undefined\") {\n        return { queryClientState: dehydrate(queryClient) };\n      }\n\n      return { queryClientState: {} };\n    },\n    hydrate: (dehydrated: { queryClientState?: unknown }) => {\n      if (typeof window !== \"undefined\" && dehydrated?.queryClientState) {\n        hydrate(queryClient, dehydrated.queryClientState);\n      }\n    },\n  });\n\n  return { router, queryClient };\n}\n"],"mappings":";;;;;;;;;;;;;AAwBA,SAAgB,aAKd,MAGA;CACA,MAAM,cAAc,KAAK,QAAQ;CACjC,MAAM,UAAU,KAAK,WAAW,qBAAqB;CACrD,MAAM,WAAW,KAAK,QAAQ;CAE9B,MAAM,YAAY,KAAK,aAAa,KAAK;CACzC,IAAI,CAAC,WACH,MAAM,IAAI,MACR,wFACF;CA6CF,OAAO;EAAE,QA1CMA,eAAqB;GACvB;GACX;GACA,UAAU,KAAK,YAAY,KAAK,QAAQ,eAAe,SAAS,mBAAmB;GACnF,SAAS;IACP;IACA,eAAe,KAAK,QAAQ;IAC5B,UAAU,KAAK,QAAQ;IACvB,WAAW,KAAK,QAAQ;IACxB,YACE,KAAK,QAAQ,cACb,iBAAiB;KACf,eAAe,KAAK,QAAQ;KAC5B,UAAU,KAAK,QAAQ;IACzB,CAAC;IACH,SAAS,KAAK,QAAQ;IACtB,QAAQ,KAAK,QAAQ;IACrB,WAAW,KAAK,QAAQ;GAC1B;GACA,GAAI,WAAW,EAAE,KAAK,EAAE,OAAO,SAAS,EAAE,IAAI,CAAC;GAC/C,gBAAgB;GAChB,mBAAmB;GACnB,0BAA0B;GAC1B,yBAAyB;GACzB,qBAAqB;GACrB,uBAAuB;GACvB;GACA;GACA,iBAAiB;IACf,IAAI,OAAO,WAAW,aACpB,OAAO,EAAE,kBAAkB,UAAU,WAAW,EAAE;IAGpD,OAAO,EAAE,kBAAkB,CAAC,EAAE;GAChC;GACA,UAAU,eAA+C;IACvD,IAAI,OAAO,WAAW,eAAe,YAAY,kBAC/C,QAAQ,aAAa,WAAW,gBAAgB;GAEpD;EACF,CAEc;EAAG;CAAY;AAC/B"}

package/dist/version-manifest-resolve.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('./_virtual/_rolldown/runtime.cjs');
-const require_bundle_path = require('./bundle-path.cjs');
+const require_resolver = require('./resolver.cjs');
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 node_path = require_runtime.__toESM(node_path, 1);
@@ -46,9 +46,9 @@ function slotVersionFromManifest(base, manifest) {
 function readStagedSlotVersion(base, pin) {
 	const bundleDir = process.env.BOS_BUNDLE_DIR;
 	if (!bundleDir) return null;
-	const slotDir = require_bundle_path.bundleUrlToStagedPath(base, bundleDir);
+	const slotDir = require_resolver.bundleUrlToStagedPath(base, bundleDir);
 	if (!slotDir || !(0, node_fs.existsSync)(slotDir)) return null;
-	const pinnedManifestPath = require_bundle_path.resolveContained(slotDir, pin.manifest);
+	const pinnedManifestPath = require_resolver.resolveContained(slotDir, pin.manifest);
 	if (!pinnedManifestPath || (0, node_fs.existsSync)(pinnedManifestPath)) return null;
 	const versionsDir = node_path.default.join(slotDir, "versions");
 	if (!(0, node_fs.existsSync)(versionsDir)) return null;

package/dist/version-manifest-resolve.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"version-manifest-resolve.cjs","names":["bundleUrlToStagedPath","existsSync","resolveContained","path","readdirSync","statSync","WorkspaceVersionManifestSchema","readFileSync","createHash"],"sources":["../src/version-manifest-resolve.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { existsSync, readdirSync, readFileSync, statSync } from \"node:fs\";\nimport path from \"node:path\";\nimport {\n  type WorkspaceVersionManifest,\n  WorkspaceVersionManifestSchema,\n} from \"every-plugin/version-manifest\";\nimport { bundleUrlToStagedPath, resolveContained } from \"./bundle-path\";\n\n/**\n * Version-manifest slot resolution (atomic-deploys 04): a config slot's\n * `pin` ({ manifest, integrity }) resolves to the derived entry-level fields\n * every consumer needs. The cache is keyed by the full pin — the pinned\n * bytes are immutable, so a verified entry is cached for the process\n * lifetime and serves as last-known-good if the origin later fails; a fetch\n * or SRI failure with nothing cached propagates (a boot-time resolution\n * failure fails the deploy, which is the platform's rollback).\n */\n\nexport interface ResolvedSlotVersion {\n  /** Absolute URL of the content-hashed container entry. */\n  entryUrl: string;\n  entryIntegrity: string;\n  /** Absolute URL of the hashed browser manifest (mf-manifest), when present. */\n  browserManifestUrl?: string;\n  /** Absolute URL of the content-hashed SSR entry, when present. */\n  ssrEntryUrl?: string;\n  ssrIntegrity?: string;\n  /** Full per-file digest map of the dist (object path → SRI), when the\n   * pinned manifest carries one — the diff base for skip-unchanged uploads. */\n  files?: Record<string, string>;\n}\n\nexport interface SlotPin {\n  /** versioned manifest filename, relative to the slot's production base */\n  manifest: string;\n  /** the manifest document's own SRI */\n  integrity: string;\n}\n\nconst cache = new Map<string, ResolvedSlotVersion>();\n\nexport function clearSlotVersionCache(): void {\n  cache.clear();\n}\n\nfunction fetchText(url: string, fetchImpl: typeof fetch): Promise<string> {\n  return fetchImpl(url).then((response) => {\n    if (!response.ok) throw new Error(`version manifest fetch failed: ${response.status}`);\n    return response.text();\n  });\n}\n\nfunction slotVersionFromManifest(\n  base: string,\n  manifest: WorkspaceVersionManifest,\n): ResolvedSlotVersion {\n  const trimmedBase = base.replace(/\\/$/, \"\");\n  return {\n    entryUrl: `${trimmedBase}/${manifest.entry}`,\n    entryIntegrity: manifest.entryIntegrity,\n    ...(manifest.browserManifest\n      ? { browserManifestUrl: `${trimmedBase}/${manifest.browserManifest.file}` }\n      : {}),\n    ...(manifest.ssr\n      ? {\n          ssrEntryUrl: `${trimmedBase}/${manifest.ssr.entry}`,\n          ssrIntegrity: manifest.ssr.integrity,\n        }\n      : {}),\n    ...(manifest.files ? { files: manifest.files } : {}),\n  };\n}\n\n/**\n * Staged-slot preference (ADR 0020/0021 self-contained tier): when a runtime\n * stages its own namespace under `BOS_BUNDLE_DIR`, a slot resolves from the\n * staged dist's own version manifest instead of the config's pin — pinned\n * manifest bytes that predate the image (deploy lag after a release bump)\n * cannot exist in the staged namespace, so their hashed files would 404 the\n * disk and fall through to the network, where the stale immutable bytes\n * still answer 200 and boot a foreign build. The staged manifest is trusted\n * (staged by the image build itself) and skipped entirely when the slot is\n * absent from the staged namespace or the pinned manifest is present (the\n * normal healthy case, which keeps the pin's SRI check).\n */\nfunction readStagedSlotVersion(base: string, pin: SlotPin): ResolvedSlotVersion | null {\n  const bundleDir = process.env.BOS_BUNDLE_DIR;\n  if (!bundleDir) return null;\n\n  const slotDir = bundleUrlToStagedPath(base, bundleDir);\n  if (!slotDir || !existsSync(slotDir)) return null;\n\n  const pinnedManifestPath = resolveContained(slotDir, pin.manifest);\n  if (!pinnedManifestPath || existsSync(pinnedManifestPath)) return null;\n\n  const versionsDir = path.join(slotDir, \"versions\");\n  if (!existsSync(versionsDir)) return null;\n  const manifests = readdirSync(versionsDir)\n    .filter((name) => name.endsWith(\".json\"))\n    .map((name) => path.join(versionsDir, name))\n    .filter((file) => statSync(file).isFile())\n    .sort((a, b) => statSync(b).mtimeMs - statSync(a).mtimeMs || (a < b ? -1 : 1));\n  if (manifests.length === 0) return null;\n  const manifestPath = manifests[0];\n  if (!manifestPath) return null;\n\n  try {\n    const manifest = WorkspaceVersionManifestSchema.parse(\n      JSON.parse(readFileSync(manifestPath, \"utf8\")),\n    );\n    return slotVersionFromManifest(base, manifest);\n  } catch {\n    return null;\n  }\n}\n\nexport async function resolveSlotVersion(input: {\n  base: string;\n  pin: SlotPin;\n  fetchImpl?: typeof fetch;\n}): Promise<ResolvedSlotVersion> {\n  const key = `${input.base}::${input.pin.manifest}::${input.pin.integrity}`;\n  // content-addressed: a verified pin is cached for the process lifetime and\n  // never refetched — the cache IS the last-known-good\n  const cached = cache.get(key);\n  if (cached) return cached;\n\n  const staged = readStagedSlotVersion(input.base, input.pin);\n  if (staged) {\n    cache.set(key, staged);\n    return staged;\n  }\n\n  const manifestUrl = `${input.base.replace(/\\/$/, \"\")}/${input.pin.manifest.replace(/^\\//, \"\")}`;\n  const body = await fetchText(manifestUrl, input.fetchImpl ?? fetch);\n  const computed = `sha384-${createHash(\"sha384\").update(body).digest(\"base64\")}`;\n  if (computed !== input.pin.integrity) {\n    throw new Error(\n      `[SRI] version manifest integrity mismatch for ${manifestUrl}\\n  Expected: ${input.pin.integrity}\\n  Computed: ${computed}`,\n    );\n  }\n  const manifest: WorkspaceVersionManifest = WorkspaceVersionManifestSchema.parse(JSON.parse(body));\n\n  const resolved = slotVersionFromManifest(input.base, manifest);\n  cache.set(key, resolved);\n  return resolved;\n}\n"],"mappings":";;;;;;;;;;AAwCA,MAAM,wBAAQ,IAAI,IAAiC;AAEnD,SAAgB,wBAA8B;CAC5C,MAAM,MAAM;AACd;AAEA,SAAS,UAAU,KAAa,WAA0C;CACxE,OAAO,UAAU,GAAG,CAAC,CAAC,MAAM,aAAa;EACvC,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,kCAAkC,SAAS,QAAQ;EACrF,OAAO,SAAS,KAAK;CACvB,CAAC;AACH;AAEA,SAAS,wBACP,MACA,UACqB;CACrB,MAAM,cAAc,KAAK,QAAQ,OAAO,EAAE;CAC1C,OAAO;EACL,UAAU,GAAG,YAAY,GAAG,SAAS;EACrC,gBAAgB,SAAS;EACzB,GAAI,SAAS,kBACT,EAAE,oBAAoB,GAAG,YAAY,GAAG,SAAS,gBAAgB,OAAO,IACxE,CAAC;EACL,GAAI,SAAS,MACT;GACE,aAAa,GAAG,YAAY,GAAG,SAAS,IAAI;GAC5C,cAAc,SAAS,IAAI;EAC7B,IACA,CAAC;EACL,GAAI,SAAS,QAAQ,EAAE,OAAO,SAAS,MAAM,IAAI,CAAC;CACpD;AACF;;;;;;;;;;;;;AAcA,SAAS,sBAAsB,MAAc,KAA0C;CACrF,MAAM,YAAY,QAAQ,IAAI;CAC9B,IAAI,CAAC,WAAW,OAAO;CAEvB,MAAM,UAAUA,0CAAsB,MAAM,SAAS;CACrD,IAAI,CAAC,WAAW,KAACC,oBAAW,OAAO,GAAG,OAAO;CAE7C,MAAM,qBAAqBC,qCAAiB,SAAS,IAAI,QAAQ;CACjE,IAAI,CAAC,0BAAsBD,oBAAW,kBAAkB,GAAG,OAAO;CAElE,MAAM,cAAcE,kBAAK,KAAK,SAAS,UAAU;CACjD,IAAI,KAACF,oBAAW,WAAW,GAAG,OAAO;CACrC,MAAM,gBAAYG,qBAAY,WAAW,CAAC,CACvC,QAAQ,SAAS,KAAK,SAAS,OAAO,CAAC,CAAC,CACxC,KAAK,SAASD,kBAAK,KAAK,aAAa,IAAI,CAAC,CAAC,CAC3C,QAAQ,aAASE,kBAAS,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CACzC,MAAM,GAAG,UAAMA,kBAAS,CAAC,CAAC,CAAC,cAAUA,kBAAS,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,KAAK,EAAE;CAC/E,IAAI,UAAU,WAAW,GAAG,OAAO;CACnC,MAAM,eAAe,UAAU;CAC/B,IAAI,CAAC,cAAc,OAAO;CAE1B,IAAI;EAIF,OAAO,wBAAwB,MAHdC,6DAA+B,MAC9C,KAAK,UAAMC,sBAAa,cAAc,MAAM,CAAC,CAEH,CAAC;CAC/C,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAsB,mBAAmB,OAIR;CAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,IAAI,MAAM,IAAI,SAAS,IAAI,MAAM,IAAI;CAG/D,MAAM,SAAS,MAAM,IAAI,GAAG;CAC5B,IAAI,QAAQ,OAAO;CAEnB,MAAM,SAAS,sBAAsB,MAAM,MAAM,MAAM,GAAG;CAC1D,IAAI,QAAQ;EACV,MAAM,IAAI,KAAK,MAAM;EACrB,OAAO;CACT;CAEA,MAAM,cAAc,GAAG,MAAM,KAAK,QAAQ,OAAO,EAAE,EAAE,GAAG,MAAM,IAAI,SAAS,QAAQ,OAAO,EAAE;CAC5F,MAAM,OAAO,MAAM,UAAU,aAAa,MAAM,aAAa,KAAK;CAClE,MAAM,WAAW,cAAUC,wBAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,QAAQ;CAC5E,IAAI,aAAa,MAAM,IAAI,WACzB,MAAM,IAAI,MACR,iDAAiD,YAAY,gBAAgB,MAAM,IAAI,UAAU,gBAAgB,UACnH;CAEF,MAAM,WAAqCF,6DAA+B,MAAM,KAAK,MAAM,IAAI,CAAC;CAEhG,MAAM,WAAW,wBAAwB,MAAM,MAAM,QAAQ;CAC7D,MAAM,IAAI,KAAK,QAAQ;CACvB,OAAO;AACT"}
+{"version":3,"file":"version-manifest-resolve.cjs","names":["bundleUrlToStagedPath","existsSync","resolveContained","path","readdirSync","statSync","WorkspaceVersionManifestSchema","readFileSync","createHash"],"sources":["../src/version-manifest-resolve.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { existsSync, readdirSync, readFileSync, statSync } from \"node:fs\";\nimport path from \"node:path\";\nimport {\n  type WorkspaceVersionManifest,\n  WorkspaceVersionManifestSchema,\n} from \"every-plugin/version-manifest\";\nimport { bundleUrlToStagedPath, resolveContained } from \"./resolver\";\n\n/**\n * Version-manifest slot resolution (atomic-deploys 04): a config slot's\n * `pin` ({ manifest, integrity }) resolves to the derived entry-level fields\n * every consumer needs. The cache is keyed by the full pin — the pinned\n * bytes are immutable, so a verified entry is cached for the process\n * lifetime and serves as last-known-good if the origin later fails; a fetch\n * or SRI failure with nothing cached propagates (a boot-time resolution\n * failure fails the deploy, which is the platform's rollback).\n */\n\nexport interface ResolvedSlotVersion {\n  /** Absolute URL of the content-hashed container entry. */\n  entryUrl: string;\n  entryIntegrity: string;\n  /** Absolute URL of the hashed browser manifest (mf-manifest), when present. */\n  browserManifestUrl?: string;\n  /** Absolute URL of the content-hashed SSR entry, when present. */\n  ssrEntryUrl?: string;\n  ssrIntegrity?: string;\n  /** Full per-file digest map of the dist (object path → SRI), when the\n   * pinned manifest carries one — the diff base for skip-unchanged uploads. */\n  files?: Record<string, string>;\n}\n\nexport interface SlotPin {\n  /** versioned manifest filename, relative to the slot's production base */\n  manifest: string;\n  /** the manifest document's own SRI */\n  integrity: string;\n}\n\nconst cache = new Map<string, ResolvedSlotVersion>();\n\nexport function clearSlotVersionCache(): void {\n  cache.clear();\n}\n\nfunction fetchText(url: string, fetchImpl: typeof fetch): Promise<string> {\n  return fetchImpl(url).then((response) => {\n    if (!response.ok) throw new Error(`version manifest fetch failed: ${response.status}`);\n    return response.text();\n  });\n}\n\nfunction slotVersionFromManifest(\n  base: string,\n  manifest: WorkspaceVersionManifest,\n): ResolvedSlotVersion {\n  const trimmedBase = base.replace(/\\/$/, \"\");\n  return {\n    entryUrl: `${trimmedBase}/${manifest.entry}`,\n    entryIntegrity: manifest.entryIntegrity,\n    ...(manifest.browserManifest\n      ? { browserManifestUrl: `${trimmedBase}/${manifest.browserManifest.file}` }\n      : {}),\n    ...(manifest.ssr\n      ? {\n          ssrEntryUrl: `${trimmedBase}/${manifest.ssr.entry}`,\n          ssrIntegrity: manifest.ssr.integrity,\n        }\n      : {}),\n    ...(manifest.files ? { files: manifest.files } : {}),\n  };\n}\n\n/**\n * Staged-slot preference (ADR 0020/0021 self-contained tier): when a runtime\n * stages its own namespace under `BOS_BUNDLE_DIR`, a slot resolves from the\n * staged dist's own version manifest instead of the config's pin — pinned\n * manifest bytes that predate the image (deploy lag after a release bump)\n * cannot exist in the staged namespace, so their hashed files would 404 the\n * disk and fall through to the network, where the stale immutable bytes\n * still answer 200 and boot a foreign build. The staged manifest is trusted\n * (staged by the image build itself) and skipped entirely when the slot is\n * absent from the staged namespace or the pinned manifest is present (the\n * normal healthy case, which keeps the pin's SRI check).\n */\nfunction readStagedSlotVersion(base: string, pin: SlotPin): ResolvedSlotVersion | null {\n  const bundleDir = process.env.BOS_BUNDLE_DIR;\n  if (!bundleDir) return null;\n\n  const slotDir = bundleUrlToStagedPath(base, bundleDir);\n  if (!slotDir || !existsSync(slotDir)) return null;\n\n  const pinnedManifestPath = resolveContained(slotDir, pin.manifest);\n  if (!pinnedManifestPath || existsSync(pinnedManifestPath)) return null;\n\n  const versionsDir = path.join(slotDir, \"versions\");\n  if (!existsSync(versionsDir)) return null;\n  const manifests = readdirSync(versionsDir)\n    .filter((name) => name.endsWith(\".json\"))\n    .map((name) => path.join(versionsDir, name))\n    .filter((file) => statSync(file).isFile())\n    .sort((a, b) => statSync(b).mtimeMs - statSync(a).mtimeMs || (a < b ? -1 : 1));\n  if (manifests.length === 0) return null;\n  const manifestPath = manifests[0];\n  if (!manifestPath) return null;\n\n  try {\n    const manifest = WorkspaceVersionManifestSchema.parse(\n      JSON.parse(readFileSync(manifestPath, \"utf8\")),\n    );\n    return slotVersionFromManifest(base, manifest);\n  } catch {\n    return null;\n  }\n}\n\nexport async function resolveSlotVersion(input: {\n  base: string;\n  pin: SlotPin;\n  fetchImpl?: typeof fetch;\n}): Promise<ResolvedSlotVersion> {\n  const key = `${input.base}::${input.pin.manifest}::${input.pin.integrity}`;\n  // content-addressed: a verified pin is cached for the process lifetime and\n  // never refetched — the cache IS the last-known-good\n  const cached = cache.get(key);\n  if (cached) return cached;\n\n  const staged = readStagedSlotVersion(input.base, input.pin);\n  if (staged) {\n    cache.set(key, staged);\n    return staged;\n  }\n\n  const manifestUrl = `${input.base.replace(/\\/$/, \"\")}/${input.pin.manifest.replace(/^\\//, \"\")}`;\n  const body = await fetchText(manifestUrl, input.fetchImpl ?? fetch);\n  const computed = `sha384-${createHash(\"sha384\").update(body).digest(\"base64\")}`;\n  if (computed !== input.pin.integrity) {\n    throw new Error(\n      `[SRI] version manifest integrity mismatch for ${manifestUrl}\\n  Expected: ${input.pin.integrity}\\n  Computed: ${computed}`,\n    );\n  }\n  const manifest: WorkspaceVersionManifest = WorkspaceVersionManifestSchema.parse(JSON.parse(body));\n\n  const resolved = slotVersionFromManifest(input.base, manifest);\n  cache.set(key, resolved);\n  return resolved;\n}\n"],"mappings":";;;;;;;;;;AAwCA,MAAM,wBAAQ,IAAI,IAAiC;AAEnD,SAAgB,wBAA8B;CAC5C,MAAM,MAAM;AACd;AAEA,SAAS,UAAU,KAAa,WAA0C;CACxE,OAAO,UAAU,GAAG,CAAC,CAAC,MAAM,aAAa;EACvC,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,kCAAkC,SAAS,QAAQ;EACrF,OAAO,SAAS,KAAK;CACvB,CAAC;AACH;AAEA,SAAS,wBACP,MACA,UACqB;CACrB,MAAM,cAAc,KAAK,QAAQ,OAAO,EAAE;CAC1C,OAAO;EACL,UAAU,GAAG,YAAY,GAAG,SAAS;EACrC,gBAAgB,SAAS;EACzB,GAAI,SAAS,kBACT,EAAE,oBAAoB,GAAG,YAAY,GAAG,SAAS,gBAAgB,OAAO,IACxE,CAAC;EACL,GAAI,SAAS,MACT;GACE,aAAa,GAAG,YAAY,GAAG,SAAS,IAAI;GAC5C,cAAc,SAAS,IAAI;EAC7B,IACA,CAAC;EACL,GAAI,SAAS,QAAQ,EAAE,OAAO,SAAS,MAAM,IAAI,CAAC;CACpD;AACF;;;;;;;;;;;;;AAcA,SAAS,sBAAsB,MAAc,KAA0C;CACrF,MAAM,YAAY,QAAQ,IAAI;CAC9B,IAAI,CAAC,WAAW,OAAO;CAEvB,MAAM,UAAUA,uCAAsB,MAAM,SAAS;CACrD,IAAI,CAAC,WAAW,KAACC,oBAAW,OAAO,GAAG,OAAO;CAE7C,MAAM,qBAAqBC,kCAAiB,SAAS,IAAI,QAAQ;CACjE,IAAI,CAAC,0BAAsBD,oBAAW,kBAAkB,GAAG,OAAO;CAElE,MAAM,cAAcE,kBAAK,KAAK,SAAS,UAAU;CACjD,IAAI,KAACF,oBAAW,WAAW,GAAG,OAAO;CACrC,MAAM,gBAAYG,qBAAY,WAAW,CAAC,CACvC,QAAQ,SAAS,KAAK,SAAS,OAAO,CAAC,CAAC,CACxC,KAAK,SAASD,kBAAK,KAAK,aAAa,IAAI,CAAC,CAAC,CAC3C,QAAQ,aAASE,kBAAS,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CACzC,MAAM,GAAG,UAAMA,kBAAS,CAAC,CAAC,CAAC,cAAUA,kBAAS,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,KAAK,EAAE;CAC/E,IAAI,UAAU,WAAW,GAAG,OAAO;CACnC,MAAM,eAAe,UAAU;CAC/B,IAAI,CAAC,cAAc,OAAO;CAE1B,IAAI;EAIF,OAAO,wBAAwB,MAHdC,6DAA+B,MAC9C,KAAK,UAAMC,sBAAa,cAAc,MAAM,CAAC,CAEH,CAAC;CAC/C,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAsB,mBAAmB,OAIR;CAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,IAAI,MAAM,IAAI,SAAS,IAAI,MAAM,IAAI;CAG/D,MAAM,SAAS,MAAM,IAAI,GAAG;CAC5B,IAAI,QAAQ,OAAO;CAEnB,MAAM,SAAS,sBAAsB,MAAM,MAAM,MAAM,GAAG;CAC1D,IAAI,QAAQ;EACV,MAAM,IAAI,KAAK,MAAM;EACrB,OAAO;CACT;CAEA,MAAM,cAAc,GAAG,MAAM,KAAK,QAAQ,OAAO,EAAE,EAAE,GAAG,MAAM,IAAI,SAAS,QAAQ,OAAO,EAAE;CAC5F,MAAM,OAAO,MAAM,UAAU,aAAa,MAAM,aAAa,KAAK;CAClE,MAAM,WAAW,cAAUC,wBAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,QAAQ;CAC5E,IAAI,aAAa,MAAM,IAAI,WACzB,MAAM,IAAI,MACR,iDAAiD,YAAY,gBAAgB,MAAM,IAAI,UAAU,gBAAgB,UACnH;CAEF,MAAM,WAAqCF,6DAA+B,MAAM,KAAK,MAAM,IAAI,CAAC;CAEhG,MAAM,WAAW,wBAAwB,MAAM,MAAM,QAAQ;CAC7D,MAAM,IAAI,KAAK,QAAQ;CACvB,OAAO;AACT"}

package/dist/version-manifest-resolve.mjs

@@ -1,4 +1,4 @@
-import { bundleUrlToStagedPath, resolveContained } from "./bundle-path.mjs";
+import { bundleUrlToStagedPath, resolveContained } from "./resolver.mjs";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import path from "node:path";
 import { createHash } from "node:crypto";

package/dist/version-manifest-resolve.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"version-manifest-resolve.mjs","names":[],"sources":["../src/version-manifest-resolve.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { existsSync, readdirSync, readFileSync, statSync } from \"node:fs\";\nimport path from \"node:path\";\nimport {\n  type WorkspaceVersionManifest,\n  WorkspaceVersionManifestSchema,\n} from \"every-plugin/version-manifest\";\nimport { bundleUrlToStagedPath, resolveContained } from \"./bundle-path\";\n\n/**\n * Version-manifest slot resolution (atomic-deploys 04): a config slot's\n * `pin` ({ manifest, integrity }) resolves to the derived entry-level fields\n * every consumer needs. The cache is keyed by the full pin — the pinned\n * bytes are immutable, so a verified entry is cached for the process\n * lifetime and serves as last-known-good if the origin later fails; a fetch\n * or SRI failure with nothing cached propagates (a boot-time resolution\n * failure fails the deploy, which is the platform's rollback).\n */\n\nexport interface ResolvedSlotVersion {\n  /** Absolute URL of the content-hashed container entry. */\n  entryUrl: string;\n  entryIntegrity: string;\n  /** Absolute URL of the hashed browser manifest (mf-manifest), when present. */\n  browserManifestUrl?: string;\n  /** Absolute URL of the content-hashed SSR entry, when present. */\n  ssrEntryUrl?: string;\n  ssrIntegrity?: string;\n  /** Full per-file digest map of the dist (object path → SRI), when the\n   * pinned manifest carries one — the diff base for skip-unchanged uploads. */\n  files?: Record<string, string>;\n}\n\nexport interface SlotPin {\n  /** versioned manifest filename, relative to the slot's production base */\n  manifest: string;\n  /** the manifest document's own SRI */\n  integrity: string;\n}\n\nconst cache = new Map<string, ResolvedSlotVersion>();\n\nexport function clearSlotVersionCache(): void {\n  cache.clear();\n}\n\nfunction fetchText(url: string, fetchImpl: typeof fetch): Promise<string> {\n  return fetchImpl(url).then((response) => {\n    if (!response.ok) throw new Error(`version manifest fetch failed: ${response.status}`);\n    return response.text();\n  });\n}\n\nfunction slotVersionFromManifest(\n  base: string,\n  manifest: WorkspaceVersionManifest,\n): ResolvedSlotVersion {\n  const trimmedBase = base.replace(/\\/$/, \"\");\n  return {\n    entryUrl: `${trimmedBase}/${manifest.entry}`,\n    entryIntegrity: manifest.entryIntegrity,\n    ...(manifest.browserManifest\n      ? { browserManifestUrl: `${trimmedBase}/${manifest.browserManifest.file}` }\n      : {}),\n    ...(manifest.ssr\n      ? {\n          ssrEntryUrl: `${trimmedBase}/${manifest.ssr.entry}`,\n          ssrIntegrity: manifest.ssr.integrity,\n        }\n      : {}),\n    ...(manifest.files ? { files: manifest.files } : {}),\n  };\n}\n\n/**\n * Staged-slot preference (ADR 0020/0021 self-contained tier): when a runtime\n * stages its own namespace under `BOS_BUNDLE_DIR`, a slot resolves from the\n * staged dist's own version manifest instead of the config's pin — pinned\n * manifest bytes that predate the image (deploy lag after a release bump)\n * cannot exist in the staged namespace, so their hashed files would 404 the\n * disk and fall through to the network, where the stale immutable bytes\n * still answer 200 and boot a foreign build. The staged manifest is trusted\n * (staged by the image build itself) and skipped entirely when the slot is\n * absent from the staged namespace or the pinned manifest is present (the\n * normal healthy case, which keeps the pin's SRI check).\n */\nfunction readStagedSlotVersion(base: string, pin: SlotPin): ResolvedSlotVersion | null {\n  const bundleDir = process.env.BOS_BUNDLE_DIR;\n  if (!bundleDir) return null;\n\n  const slotDir = bundleUrlToStagedPath(base, bundleDir);\n  if (!slotDir || !existsSync(slotDir)) return null;\n\n  const pinnedManifestPath = resolveContained(slotDir, pin.manifest);\n  if (!pinnedManifestPath || existsSync(pinnedManifestPath)) return null;\n\n  const versionsDir = path.join(slotDir, \"versions\");\n  if (!existsSync(versionsDir)) return null;\n  const manifests = readdirSync(versionsDir)\n    .filter((name) => name.endsWith(\".json\"))\n    .map((name) => path.join(versionsDir, name))\n    .filter((file) => statSync(file).isFile())\n    .sort((a, b) => statSync(b).mtimeMs - statSync(a).mtimeMs || (a < b ? -1 : 1));\n  if (manifests.length === 0) return null;\n  const manifestPath = manifests[0];\n  if (!manifestPath) return null;\n\n  try {\n    const manifest = WorkspaceVersionManifestSchema.parse(\n      JSON.parse(readFileSync(manifestPath, \"utf8\")),\n    );\n    return slotVersionFromManifest(base, manifest);\n  } catch {\n    return null;\n  }\n}\n\nexport async function resolveSlotVersion(input: {\n  base: string;\n  pin: SlotPin;\n  fetchImpl?: typeof fetch;\n}): Promise<ResolvedSlotVersion> {\n  const key = `${input.base}::${input.pin.manifest}::${input.pin.integrity}`;\n  // content-addressed: a verified pin is cached for the process lifetime and\n  // never refetched — the cache IS the last-known-good\n  const cached = cache.get(key);\n  if (cached) return cached;\n\n  const staged = readStagedSlotVersion(input.base, input.pin);\n  if (staged) {\n    cache.set(key, staged);\n    return staged;\n  }\n\n  const manifestUrl = `${input.base.replace(/\\/$/, \"\")}/${input.pin.manifest.replace(/^\\//, \"\")}`;\n  const body = await fetchText(manifestUrl, input.fetchImpl ?? fetch);\n  const computed = `sha384-${createHash(\"sha384\").update(body).digest(\"base64\")}`;\n  if (computed !== input.pin.integrity) {\n    throw new Error(\n      `[SRI] version manifest integrity mismatch for ${manifestUrl}\\n  Expected: ${input.pin.integrity}\\n  Computed: ${computed}`,\n    );\n  }\n  const manifest: WorkspaceVersionManifest = WorkspaceVersionManifestSchema.parse(JSON.parse(body));\n\n  const resolved = slotVersionFromManifest(input.base, manifest);\n  cache.set(key, resolved);\n  return resolved;\n}\n"],"mappings":";;;;;;;AAwCA,MAAM,wBAAQ,IAAI,IAAiC;AAEnD,SAAgB,wBAA8B;CAC5C,MAAM,MAAM;AACd;AAEA,SAAS,UAAU,KAAa,WAA0C;CACxE,OAAO,UAAU,GAAG,CAAC,CAAC,MAAM,aAAa;EACvC,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,kCAAkC,SAAS,QAAQ;EACrF,OAAO,SAAS,KAAK;CACvB,CAAC;AACH;AAEA,SAAS,wBACP,MACA,UACqB;CACrB,MAAM,cAAc,KAAK,QAAQ,OAAO,EAAE;CAC1C,OAAO;EACL,UAAU,GAAG,YAAY,GAAG,SAAS;EACrC,gBAAgB,SAAS;EACzB,GAAI,SAAS,kBACT,EAAE,oBAAoB,GAAG,YAAY,GAAG,SAAS,gBAAgB,OAAO,IACxE,CAAC;EACL,GAAI,SAAS,MACT;GACE,aAAa,GAAG,YAAY,GAAG,SAAS,IAAI;GAC5C,cAAc,SAAS,IAAI;EAC7B,IACA,CAAC;EACL,GAAI,SAAS,QAAQ,EAAE,OAAO,SAAS,MAAM,IAAI,CAAC;CACpD;AACF;;;;;;;;;;;;;AAcA,SAAS,sBAAsB,MAAc,KAA0C;CACrF,MAAM,YAAY,QAAQ,IAAI;CAC9B,IAAI,CAAC,WAAW,OAAO;CAEvB,MAAM,UAAU,sBAAsB,MAAM,SAAS;CACrD,IAAI,CAAC,WAAW,CAAC,WAAW,OAAO,GAAG,OAAO;CAE7C,MAAM,qBAAqB,iBAAiB,SAAS,IAAI,QAAQ;CACjE,IAAI,CAAC,sBAAsB,WAAW,kBAAkB,GAAG,OAAO;CAElE,MAAM,cAAc,KAAK,KAAK,SAAS,UAAU;CACjD,IAAI,CAAC,WAAW,WAAW,GAAG,OAAO;CACrC,MAAM,YAAY,YAAY,WAAW,CAAC,CACvC,QAAQ,SAAS,KAAK,SAAS,OAAO,CAAC,CAAC,CACxC,KAAK,SAAS,KAAK,KAAK,aAAa,IAAI,CAAC,CAAC,CAC3C,QAAQ,SAAS,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CACzC,MAAM,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,SAAS,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,KAAK,EAAE;CAC/E,IAAI,UAAU,WAAW,GAAG,OAAO;CACnC,MAAM,eAAe,UAAU;CAC/B,IAAI,CAAC,cAAc,OAAO;CAE1B,IAAI;EAIF,OAAO,wBAAwB,MAHd,+BAA+B,MAC9C,KAAK,MAAM,aAAa,cAAc,MAAM,CAAC,CAEH,CAAC;CAC/C,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAsB,mBAAmB,OAIR;CAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,IAAI,MAAM,IAAI,SAAS,IAAI,MAAM,IAAI;CAG/D,MAAM,SAAS,MAAM,IAAI,GAAG;CAC5B,IAAI,QAAQ,OAAO;CAEnB,MAAM,SAAS,sBAAsB,MAAM,MAAM,MAAM,GAAG;CAC1D,IAAI,QAAQ;EACV,MAAM,IAAI,KAAK,MAAM;EACrB,OAAO;CACT;CAEA,MAAM,cAAc,GAAG,MAAM,KAAK,QAAQ,OAAO,EAAE,EAAE,GAAG,MAAM,IAAI,SAAS,QAAQ,OAAO,EAAE;CAC5F,MAAM,OAAO,MAAM,UAAU,aAAa,MAAM,aAAa,KAAK;CAClE,MAAM,WAAW,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,QAAQ;CAC5E,IAAI,aAAa,MAAM,IAAI,WACzB,MAAM,IAAI,MACR,iDAAiD,YAAY,gBAAgB,MAAM,IAAI,UAAU,gBAAgB,UACnH;CAEF,MAAM,WAAqC,+BAA+B,MAAM,KAAK,MAAM,IAAI,CAAC;CAEhG,MAAM,WAAW,wBAAwB,MAAM,MAAM,QAAQ;CAC7D,MAAM,IAAI,KAAK,QAAQ;CACvB,OAAO;AACT"}
+{"version":3,"file":"version-manifest-resolve.mjs","names":[],"sources":["../src/version-manifest-resolve.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { existsSync, readdirSync, readFileSync, statSync } from \"node:fs\";\nimport path from \"node:path\";\nimport {\n  type WorkspaceVersionManifest,\n  WorkspaceVersionManifestSchema,\n} from \"every-plugin/version-manifest\";\nimport { bundleUrlToStagedPath, resolveContained } from \"./resolver\";\n\n/**\n * Version-manifest slot resolution (atomic-deploys 04): a config slot's\n * `pin` ({ manifest, integrity }) resolves to the derived entry-level fields\n * every consumer needs. The cache is keyed by the full pin — the pinned\n * bytes are immutable, so a verified entry is cached for the process\n * lifetime and serves as last-known-good if the origin later fails; a fetch\n * or SRI failure with nothing cached propagates (a boot-time resolution\n * failure fails the deploy, which is the platform's rollback).\n */\n\nexport interface ResolvedSlotVersion {\n  /** Absolute URL of the content-hashed container entry. */\n  entryUrl: string;\n  entryIntegrity: string;\n  /** Absolute URL of the hashed browser manifest (mf-manifest), when present. */\n  browserManifestUrl?: string;\n  /** Absolute URL of the content-hashed SSR entry, when present. */\n  ssrEntryUrl?: string;\n  ssrIntegrity?: string;\n  /** Full per-file digest map of the dist (object path → SRI), when the\n   * pinned manifest carries one — the diff base for skip-unchanged uploads. */\n  files?: Record<string, string>;\n}\n\nexport interface SlotPin {\n  /** versioned manifest filename, relative to the slot's production base */\n  manifest: string;\n  /** the manifest document's own SRI */\n  integrity: string;\n}\n\nconst cache = new Map<string, ResolvedSlotVersion>();\n\nexport function clearSlotVersionCache(): void {\n  cache.clear();\n}\n\nfunction fetchText(url: string, fetchImpl: typeof fetch): Promise<string> {\n  return fetchImpl(url).then((response) => {\n    if (!response.ok) throw new Error(`version manifest fetch failed: ${response.status}`);\n    return response.text();\n  });\n}\n\nfunction slotVersionFromManifest(\n  base: string,\n  manifest: WorkspaceVersionManifest,\n): ResolvedSlotVersion {\n  const trimmedBase = base.replace(/\\/$/, \"\");\n  return {\n    entryUrl: `${trimmedBase}/${manifest.entry}`,\n    entryIntegrity: manifest.entryIntegrity,\n    ...(manifest.browserManifest\n      ? { browserManifestUrl: `${trimmedBase}/${manifest.browserManifest.file}` }\n      : {}),\n    ...(manifest.ssr\n      ? {\n          ssrEntryUrl: `${trimmedBase}/${manifest.ssr.entry}`,\n          ssrIntegrity: manifest.ssr.integrity,\n        }\n      : {}),\n    ...(manifest.files ? { files: manifest.files } : {}),\n  };\n}\n\n/**\n * Staged-slot preference (ADR 0020/0021 self-contained tier): when a runtime\n * stages its own namespace under `BOS_BUNDLE_DIR`, a slot resolves from the\n * staged dist's own version manifest instead of the config's pin — pinned\n * manifest bytes that predate the image (deploy lag after a release bump)\n * cannot exist in the staged namespace, so their hashed files would 404 the\n * disk and fall through to the network, where the stale immutable bytes\n * still answer 200 and boot a foreign build. The staged manifest is trusted\n * (staged by the image build itself) and skipped entirely when the slot is\n * absent from the staged namespace or the pinned manifest is present (the\n * normal healthy case, which keeps the pin's SRI check).\n */\nfunction readStagedSlotVersion(base: string, pin: SlotPin): ResolvedSlotVersion | null {\n  const bundleDir = process.env.BOS_BUNDLE_DIR;\n  if (!bundleDir) return null;\n\n  const slotDir = bundleUrlToStagedPath(base, bundleDir);\n  if (!slotDir || !existsSync(slotDir)) return null;\n\n  const pinnedManifestPath = resolveContained(slotDir, pin.manifest);\n  if (!pinnedManifestPath || existsSync(pinnedManifestPath)) return null;\n\n  const versionsDir = path.join(slotDir, \"versions\");\n  if (!existsSync(versionsDir)) return null;\n  const manifests = readdirSync(versionsDir)\n    .filter((name) => name.endsWith(\".json\"))\n    .map((name) => path.join(versionsDir, name))\n    .filter((file) => statSync(file).isFile())\n    .sort((a, b) => statSync(b).mtimeMs - statSync(a).mtimeMs || (a < b ? -1 : 1));\n  if (manifests.length === 0) return null;\n  const manifestPath = manifests[0];\n  if (!manifestPath) return null;\n\n  try {\n    const manifest = WorkspaceVersionManifestSchema.parse(\n      JSON.parse(readFileSync(manifestPath, \"utf8\")),\n    );\n    return slotVersionFromManifest(base, manifest);\n  } catch {\n    return null;\n  }\n}\n\nexport async function resolveSlotVersion(input: {\n  base: string;\n  pin: SlotPin;\n  fetchImpl?: typeof fetch;\n}): Promise<ResolvedSlotVersion> {\n  const key = `${input.base}::${input.pin.manifest}::${input.pin.integrity}`;\n  // content-addressed: a verified pin is cached for the process lifetime and\n  // never refetched — the cache IS the last-known-good\n  const cached = cache.get(key);\n  if (cached) return cached;\n\n  const staged = readStagedSlotVersion(input.base, input.pin);\n  if (staged) {\n    cache.set(key, staged);\n    return staged;\n  }\n\n  const manifestUrl = `${input.base.replace(/\\/$/, \"\")}/${input.pin.manifest.replace(/^\\//, \"\")}`;\n  const body = await fetchText(manifestUrl, input.fetchImpl ?? fetch);\n  const computed = `sha384-${createHash(\"sha384\").update(body).digest(\"base64\")}`;\n  if (computed !== input.pin.integrity) {\n    throw new Error(\n      `[SRI] version manifest integrity mismatch for ${manifestUrl}\\n  Expected: ${input.pin.integrity}\\n  Computed: ${computed}`,\n    );\n  }\n  const manifest: WorkspaceVersionManifest = WorkspaceVersionManifestSchema.parse(JSON.parse(body));\n\n  const resolved = slotVersionFromManifest(input.base, manifest);\n  cache.set(key, resolved);\n  return resolved;\n}\n"],"mappings":";;;;;;;AAwCA,MAAM,wBAAQ,IAAI,IAAiC;AAEnD,SAAgB,wBAA8B;CAC5C,MAAM,MAAM;AACd;AAEA,SAAS,UAAU,KAAa,WAA0C;CACxE,OAAO,UAAU,GAAG,CAAC,CAAC,MAAM,aAAa;EACvC,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,kCAAkC,SAAS,QAAQ;EACrF,OAAO,SAAS,KAAK;CACvB,CAAC;AACH;AAEA,SAAS,wBACP,MACA,UACqB;CACrB,MAAM,cAAc,KAAK,QAAQ,OAAO,EAAE;CAC1C,OAAO;EACL,UAAU,GAAG,YAAY,GAAG,SAAS;EACrC,gBAAgB,SAAS;EACzB,GAAI,SAAS,kBACT,EAAE,oBAAoB,GAAG,YAAY,GAAG,SAAS,gBAAgB,OAAO,IACxE,CAAC;EACL,GAAI,SAAS,MACT;GACE,aAAa,GAAG,YAAY,GAAG,SAAS,IAAI;GAC5C,cAAc,SAAS,IAAI;EAC7B,IACA,CAAC;EACL,GAAI,SAAS,QAAQ,EAAE,OAAO,SAAS,MAAM,IAAI,CAAC;CACpD;AACF;;;;;;;;;;;;;AAcA,SAAS,sBAAsB,MAAc,KAA0C;CACrF,MAAM,YAAY,QAAQ,IAAI;CAC9B,IAAI,CAAC,WAAW,OAAO;CAEvB,MAAM,UAAU,sBAAsB,MAAM,SAAS;CACrD,IAAI,CAAC,WAAW,CAAC,WAAW,OAAO,GAAG,OAAO;CAE7C,MAAM,qBAAqB,iBAAiB,SAAS,IAAI,QAAQ;CACjE,IAAI,CAAC,sBAAsB,WAAW,kBAAkB,GAAG,OAAO;CAElE,MAAM,cAAc,KAAK,KAAK,SAAS,UAAU;CACjD,IAAI,CAAC,WAAW,WAAW,GAAG,OAAO;CACrC,MAAM,YAAY,YAAY,WAAW,CAAC,CACvC,QAAQ,SAAS,KAAK,SAAS,OAAO,CAAC,CAAC,CACxC,KAAK,SAAS,KAAK,KAAK,aAAa,IAAI,CAAC,CAAC,CAC3C,QAAQ,SAAS,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CACzC,MAAM,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,SAAS,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,KAAK,EAAE;CAC/E,IAAI,UAAU,WAAW,GAAG,OAAO;CACnC,MAAM,eAAe,UAAU;CAC/B,IAAI,CAAC,cAAc,OAAO;CAE1B,IAAI;EAIF,OAAO,wBAAwB,MAHd,+BAA+B,MAC9C,KAAK,MAAM,aAAa,cAAc,MAAM,CAAC,CAEH,CAAC;CAC/C,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAsB,mBAAmB,OAIR;CAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,IAAI,MAAM,IAAI,SAAS,IAAI,MAAM,IAAI;CAG/D,MAAM,SAAS,MAAM,IAAI,GAAG;CAC5B,IAAI,QAAQ,OAAO;CAEnB,MAAM,SAAS,sBAAsB,MAAM,MAAM,MAAM,GAAG;CAC1D,IAAI,QAAQ;EACV,MAAM,IAAI,KAAK,MAAM;EACrB,OAAO;CACT;CAEA,MAAM,cAAc,GAAG,MAAM,KAAK,QAAQ,OAAO,EAAE,EAAE,GAAG,MAAM,IAAI,SAAS,QAAQ,OAAO,EAAE;CAC5F,MAAM,OAAO,MAAM,UAAU,aAAa,MAAM,aAAa,KAAK;CAClE,MAAM,WAAW,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,QAAQ;CAC5E,IAAI,aAAa,MAAM,IAAI,WACzB,MAAM,IAAI,MACR,iDAAiD,YAAY,gBAAgB,MAAM,IAAI,UAAU,gBAAgB,UACnH;CAEF,MAAM,WAAqC,+BAA+B,MAAM,KAAK,MAAM,IAAI,CAAC;CAEhG,MAAM,WAAW,wBAAwB,MAAM,MAAM,QAAQ;CAC7D,MAAM,IAAI,KAAK,QAAQ;CACvB,OAAO;AACT"}

package/dist/workspace.cjs

@@ -2,8 +2,8 @@ const require_run = require('./utils/run.cjs');
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 let effect = require("effect");
-let yaml = require("yaml");
 let node_fs_promises = require("node:fs/promises");
+let yaml = require("yaml");
 
 //#region src/workspace.ts
 var DepsBuildFailure = class extends effect.Data.TaggedError("DepsBuildFailure") {

package/dist/workspace.mjs

@@ -2,8 +2,8 @@ import { run } from "./utils/run.mjs";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { Data } from "effect";
-import { parse } from "yaml";
 import { readdir, stat } from "node:fs/promises";
+import { parse } from "yaml";
 
 //#region src/workspace.ts
 var DepsBuildFailure = class extends Data.TaggedError("DepsBuildFailure") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "everything-dev",
-  "version": "2.0.0-rc.6",
+  "version": "2.0.0-rc.8",
   "type": "module",
   "engines": {
     "node": ">=20.11"
@@ -54,10 +54,10 @@
       "import": "./dist/version-manifest-resolve.mjs",
       "require": "./dist/version-manifest-resolve.cjs"
     },
-    "./bundle-fs-resolve": {
-      "types": "./dist/bundle-fs-resolve.d.mts",
-      "import": "./dist/bundle-fs-resolve.mjs",
-      "require": "./dist/bundle-fs-resolve.cjs"
+    "./resolver": {
+      "types": "./dist/resolver.d.mts",
+      "import": "./dist/resolver.mjs",
+      "require": "./dist/resolver.cjs"
     },
     "./fastkv": {
       "types": "./dist/fastkv.d.mts",
@@ -69,10 +69,10 @@
       "import": "./dist/contract.meta.mjs",
       "require": "./dist/contract.meta.cjs"
     },
-    "./mf": {
-      "types": "./dist/mf.d.mts",
-      "import": "./dist/mf.mjs",
-      "require": "./dist/mf.cjs"
+    "./federation": {
+      "types": "./dist/federation.d.mts",
+      "import": "./dist/federation.mjs",
+      "require": "./dist/federation.cjs"
     },
     "./integrity": {
       "types": "./dist/integrity.d.mts",
@@ -243,7 +243,7 @@
     "dotenv": "^17.3.1",
     "effect": "4.0.0-rc.117",
     "@everything-dev/upload-app": "workspace:^",
-    "every-plugin": "^3.0.0-rc.4",
+    "every-plugin": "^3.0.0-rc.5",
     "execa": "^9.5.2",
     "glob": "^13.0.6",
     "near-kit": "^0.20.2",
@@ -253,8 +253,8 @@
     "zod": "4.6.5"
   },
   "peerDependencies": {
-    "@better-auth/api-key": "1.6.25",
-    "@better-auth/passkey": "1.6.25",
+    "@better-auth/api-key": "1.7.7",
+    "@better-auth/passkey": "1.7.7",
     "@lingui/core": "5.9.0",
     "@lingui/react": "5.9.0",
     "@orpc/client": "2.0.0-beta.35",
@@ -262,8 +262,8 @@
     "@orpc/tanstack-query": "2.0.0-beta.35",
     "@tanstack/react-query": ">=5.0.0",
     "@tanstack/react-router": ">=1.0.0",
-    "better-auth": "1.6.25",
-    "better-near-auth": "^2.0.0-rc.0",
+    "better-auth": "1.7.7",
+    "better-near-auth": "^2.0.0-rc.1",
     "effect": "4.0.0-rc.117",
     "react": "19.2.4",
     "react-dom": "19.2.4",
@@ -309,8 +309,8 @@
     }
   },
   "devDependencies": {
-    "@better-auth/api-key": "1.6.25",
-    "@better-auth/passkey": "1.6.25",
+    "@better-auth/api-key": "1.7.7",
+    "@better-auth/passkey": "1.7.7",
     "@lingui/core": "5.9.0",
     "@lingui/react": "5.9.0",
     "@module-federation/rsbuild-plugin": "^2.9.0",
@@ -327,8 +327,8 @@
     "@tanstack/router-plugin": "1.168.35",
     "@types/node": "^25.0.3",
     "@types/tar": "^7.0.0",
-    "better-auth": "1.6.25",
-    "better-near-auth": "^2.0.0-rc.0",
+    "better-auth": "1.7.7",
+    "better-near-auth": "^2.0.0-rc.1",
     "jsdom": "^30.0.1",
     "react": "19.2.4",
     "react-dom": "19.2.4",

package/skills/api-and-auth/SKILL.md

@@ -104,7 +104,7 @@ builder.myRoute.use(requireAuth).handler(async ({ input, context }) => {
 });
 ```
 
-Available: `requireAuth`, `requireAuthOrApiKey`, `requireRole("admin")`, `requireOrganization`, `requireOrgRole("owner")`, `requireApiKey`. Apply via `.use()`:
+Available: `requireAuth`, `requireAuthOrApiKey`, `requireRole("admin")`, `requireOrganization`, `requireOrgRole("owner")`, `requireApiKey`, `requirePermission("resource", "action")` (gates on the caller's effective permissions from the auth plugin's `getContext` — see `references/middleware.md`). Apply via `.use()`:
 
 ```ts
 builder.authHealth.use(requireAuth).handler(...)
@@ -204,16 +204,19 @@ initialize: (config, plugins, _tools) =>
   })
 ```
 
-Use `getAuthClient()` for in-process calls:
+Use the host's session middleware for in-process auth checks. The canonical middleware import is `everything-dev/api` (`packages/everything-dev/src/api/auth-middleware.ts:34`). For in-process calls, access the auth client via the injected `context.authClient` in route handlers, or use `useAuthClient()` from `@/app` in the UI.
 
-```ts
-import { getAuthClient, createAuthMiddleware } from "./lib/auth";
+## Auth on the Client
 
-const authClient = getAuthClient(services, { reqHeaders: context.reqHeaders });
-const session = await authClient.getSession();
-```
+Create the client in `ui/src/lib/auth.ts`:
 
-`AuthCapableServices` requires an `auth` factory. If unavailable, `getAuthClient()` throws.
+```ts
+export function createAuthClient(runtimeConfig) {
+  return betterAuth.createClient({
+    baseURL: runtimeConfig.authBaseUrl,
+    plugins: [siwn({ recipients, networkId }), passkey(), organization(), admin(), apiKey(), anonymous(), phone()],
+  });
+}
 
 ## Auth on the Client
 
@@ -428,7 +431,7 @@ The host (`host/src/program.ts`) creates RPC and OpenAPI handlers from each plug
 
 **"Add an admin-only route."** Contract declares `.errors({ UNAUTHORIZED, FORBIDDEN })`; handler is `.effect(function* ...)` and guards with `return yield* Effect.fail(errors.UNAUTHORIZED({ apiKeyProvided: !!context.apiKey }))` — note all-optional error shapes still need an explicit `data: {}`. For shared middleware shapes, see `packages/everything-dev/src/api/auth-middleware.ts`.
 
-**"Call the auth plugin from my route."** `getAuthClient(services, { reqHeaders: context.reqHeaders })` then `await authClient.getSession()` — in-process, no HTTP roundtrip.
+**"Call the auth plugin from my route."** The host injects `context.authClient` into route handlers via the plugin client. Access it as `context.authClient.getSession()` for in-process calls, or use `useAuthClient()` from `@/app` in the UI. See `packages/everything-dev/src/api/auth-middleware.ts` for the middleware pattern and `context.userId`/`context.user` narrowing with `requireAuth`.
 
 **"Wire an SSE route."** Contract: `.output(eventIterator(Schema))`. Handler: async generator that subscribes to the publisher and yields per event, filtering server-side on `pluginId`/query params.
 

package/skills/api-and-auth/references/middleware.md

@@ -36,3 +36,41 @@ ctx.organization.organization?.metadata?.plan;
 ```
 
 Also available: `OrgMemberAuthenticatedContext<TMeta>` (guarantees `organization.member` is non-null).
+
+## `requirePermission(resource, action)`
+
+Gates a route on the caller's **effective permissions** — the map the auth plugin's
+`getContext` returns (session principals: the active organization's role grants;
+API-key principals: the key's declared permissions; anonymous: null, denied).
+
+```ts
+const { requirePermission } = createAuthMiddleware(builder);
+
+builder.createProposal
+  .use(requireAuth)
+  .use(requirePermission("proposal", "create"))
+  .handler(...);
+```
+
+Fails `FORBIDDEN` with `data: { requiredPermissions: ["proposal:create"] }` when the
+map lacks the grant.
+
+**Team scope.** `getContext`'s `organization.teams` entries carry a per-team
+`permissions` map (the caller's `team_member.role` grants unioned per team). Pass a
+team resolver to gate on the team resolved from the route input:
+
+```ts
+builder.updateTeamTask
+  .use(requireAuth)
+  .use(requirePermission("team", "update", { scope: "team", teamId: (input) => input.teamId }))
+  .handler(...);
+```
+
+The check reads the caller's grants for that specific team; a team they are not a
+member of (or one lacking the grant) is denied. Scope boundary (ADR 0028): the middleware can only see the
+request context, so it gates *active-organization* permissions; checks against an
+*explicit* organization id from route input (or data-masking checks) stay
+service-side via Better Auth `hasPermission`, which evaluates the same
+config-declared roles. The permission surface itself is config-declared in the auth
+plugin's `siwn.permissions` — the plugin ships no defaults (see
+`docs/adr/0028-config-declared-permissions.md`).

package/skills/cli-reference/SKILL.md

@@ -9,7 +9,7 @@ metadata:
 
 # CLI Command Reference
 
-17 `bos` commands organised by workflow category.
+19 `bos` commands organised by workflow category.
 
 ## Development
 
@@ -135,7 +135,7 @@ Output includes installed vs latest versions for each workspace package, whether
 
 Publish the resolved config to the FastKV on-chain registry. Optionally build and deploy workspaces first.
 
-**Flags:** `--deploy` `--dry-run` `--network <mainnet|testnet>` `--private-key <key>` `--env <production|staging>` `--packages <list|all|local>`
+**Flags:** `--deploy` `--dry-run` `--network <mainnet|testnet>` `--private-key <key>` `--wallet` `--env <production|staging>` `--packages <list|all|local>`
 
 ```bash
 bos publish                          # publish current config snapshot
@@ -143,6 +143,7 @@ bos publish --deploy                 # build all + deploy + publish
 bos publish --deploy --packages local   # build/deploy only the workspaces owned by this repo (CI default)
 bos publish --dry-run                # preview what would be published
 bos publish --network testnet        # publish to testnet registry
+bos publish --wallet                 # gasless: sign in a browser, relayed delegate write — no local key needed
 ```
 
 → [`publish-sync`](.) skill for config sections, SRI integrity, rollback, and FastKV troubleshooting.
@@ -174,16 +175,31 @@ bos deploy --service my-railway         # override Railway service name
 
 → [`publish-sync`](.) skill and [`super-app`](.) for tenant-aware deploy considerations.
 
+### `bos login` / `bos logout`
+
+Establish publish/CLI identity without a seed phrase or private key. `bos login` opens a browser (one approval), persists a device-named API key in `.bos/session.json` (gitignored), and works for both the publish path and API access (`x-api-key` on `/api/*`, `/api/rpc/*`, `/api/mcp`).
+
+**Flags (login):** `--key` (additionally mint and export a publish-scoped function-call key to `~/.near-credentials`)
+
+```bash
+bos login          # browser approval → API key in .bos/session.json
+bos login --key    # also export a scoped publish key (near-CLI format)
+bos logout         # revoke the API key (best-effort) + delete the handle and exported key
+```
+
+Sessions/keys expire (90 days by default); re-login is non-destructive. → [`talk-to-the-app`](.) skill for the authentication model and MCP access.
+
 ### `bos key generate`
 
 Generate a publish access key (NEAR function-call key) scoped to the FastKV registry contract.
-If existing publish keys are found on the account, you will be prompted to remove them.
+If existing publish keys are found on the account, you will be prompted — the prompt defaults to **keeping** them.
 
-**Flags:** `--allowance <amount>` (default: `1NEAR`)
+**Flags:** `--allowance <amount>` (default: `1NEAR`) `--[no-]remove-old-keys` (default: ask on a TTY, keep when non-interactive)
 
 ```bash
-bos key generate                    # generate key with default allowance
-bos key generate --allowance 2NEAR  # custom allowance
+bos key generate                        # generate key with default allowance
+bos key generate --allowance 2NEAR      # custom allowance
+bos key generate --remove-old-keys      # also remove existing publish key(s) without prompting
 ```
 
 Outputs the public key, private key, and registry contract address. The generated key can only call the set and get methods on the BOS registry contract — it cannot transfer funds or call other contracts.

package/skills/talk-to-the-app/SKILL.md

@@ -36,19 +36,46 @@ There is no network parameter anywhere — the origin is the choice.
 
 ## Authentication
 
-All API operations require authentication. Use an **API key**:
+Every API surface — `/api/*` (REST), `/api/rpc/*` (oRPC RPC), and `/api/mcp`
+(MCP) — requires a session or an API key. Anonymous requests get `401` with a
+`WWW-Authenticate` hint (this includes MCP `tools/list`: the tool catalog is
+not disclosed to unauthenticated callers). Use an **API key**:
+
+**Path A — create one in the app UI.**
 
 1. Sign in with your NEAR wallet (SIWN) at the app.
 2. Navigate to **Settings → API Keys** at `/settings/api-keys`.
 3. Create a new key — the full secret (`api_...`) is shown once, copy it immediately.
-4. Pass it on every request:
+
+**Path B — no UI needed: `bos login`** (for CLI sessions and agents with a
+browser available):
+
+```bash
+bos login
+```
+
+Opens a browser, you approve once (NEAR SIWN), and the CLI persists a
+device-named API key in `.bos/session.json` (gitignored, 0600). Same key, same
+header — pass it on every request:
 
 ```
 x-api-key: api_your_key_here
 ```
 
-The header works for `/api/*` (REST), `/api/rpc/*` (oRPC RPC), and `/api/mcp`
-(MCP). Keys carry optional permissions; a call outside them refuses with 403.
+Keys carry optional permissions; a call outside them refuses with 403. Keys
+expire (90 days by default) and are revocable at `/settings/api-keys` —
+re-run `bos login` (or create a fresh key in the UI) when a key dies.
+
+**Other credentials:**
+
+- `bos login --key` mints a publish-scoped function-call access key
+  (`~/.near-credentials`) for the publish path — not an API-key replacement.
+- Device-link session tokens (`POST /device/token` +
+  `POST /device-link/claim`, one-time hashed claim) yield a real Better Auth
+  session that also passes the gate — cookie transport, no revocation UI.
+  For MCP and agent work, prefer the API key.
+- For CI or a browser-less agent: create a key once (UI or `bos login` from a
+  machine with a browser) and pass it as `x-api-key` in the pipeline.
 
 ## MCP
 
@@ -128,7 +155,7 @@ with write permission.
 
 | status | do |
 |---|---|
-| `401` | no or bad key — re-read `/settings/api-keys`; check the `x-api-key` header reached the request |
+| `401` | no key sent, a bad/revoked key, or an anonymous caller — if you have a key, check the `x-api-key` header reached the request; if not, get one (Paths A/B above); MCP `tools/list` is also gated |
 | `403` | the key lacks permission — the owner edits the key's permissions; do not retry unchanged |
 | `404` | wrong surface or path — re-check `/api/spec.json`; plugin RPC mounts are `/api/rpc/<pluginKey>` |
 | `429` | rate limited — wait as the response says, then once more |