ignotum 0.0.13 → 0.0.15

package/src/cli/managed-dev-platform.ts

@@ -0,0 +1,118 @@
+import { createHash } from "node:crypto";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { Effect, Path, Schema } from "effect";
+import { ExecutionSelection, PlatformRelease } from "@ignotum/contracts/platform";
+import { managedPreactPeers } from "./managed-exports.js";
+import { localManagedReleaseProvider } from "./managed-release.js";
+import { runViteBuild } from "./build/artifact.js";
+
+export type LocalManagedRelease = Effect.Success<ReturnType<typeof localManagedReleaseProvider>>;
+
+export const localPlatformUrl = (release: string, module: string) =>
+  `/_ignotum/platform/${release}/${module}`;
+
+export const localExecutionSelection = (appDirectory: string, provider: LocalManagedRelease) => {
+  const digest = (value: string) => createHash("sha256").update(value).digest("hex").slice(0, 24);
+  return Schema.decodeUnknownSync(ExecutionSelection)({
+    formatVersion: 1,
+    appId: `app_${digest(appDirectory)}`,
+    versionId: `dep_${digest(appDirectory)}`,
+    activationGeneration: 1,
+    platformReleaseId: `rel_${digest(provider.browser.sha256 + provider.guest.sha256)}`,
+    platformGeneration: 1,
+    dataHistoryId: `hist_${digest(appDirectory)}`,
+  });
+};
+
+export const localPlatformRelease = (
+  provider: LocalManagedRelease,
+  selection: ExecutionSelection,
+) =>
+  Schema.decodeUnknownSync(PlatformRelease)({
+    formatVersion: 1,
+    id: selection.platformReleaseId,
+    browser: {
+      graph: {
+        sha256: provider.browser.sha256,
+        entry: provider.browser.manifest.entries["ignotum/internal/bootstrap"],
+      },
+      clientApiVersion: 1,
+      protocolVersion: 1,
+    },
+    guest: {
+      graph: {
+        sha256: provider.guest.sha256,
+        entry: provider.guest.manifest.entries["ignotum/internal/host"],
+      },
+      serverApiVersion: 1,
+      protocolVersion: 1,
+    },
+    gateway: { implementation: provider.browser.sha256, browserProtocols: [1] },
+    host: { implementation: provider.guest.sha256, guestProtocols: [1] },
+    capabilities: ["operations", "routing", "images"],
+    persistentState: [],
+    publication: { state: "Ready", eligible: true },
+  });
+
+/** Development tools share the selected renderer; they never enter application modules. */
+export const buildLocalBrowserTools = Effect.fn("ManagedDev.buildBrowserTools")(function* (
+  provider: LocalManagedRelease,
+  selection: ExecutionSelection,
+) {
+  const path = yield* Path.Path;
+  const require = createRequire(import.meta.resolve("@prefresh/vite"));
+  const entries = {
+    core: require.resolve("@prefresh/core"),
+    utils: require.resolve("@prefresh/utils"),
+    debug: fileURLToPath(import.meta.resolve("preact/debug")),
+  };
+  const sources = new Map([
+    ["\0ignotum:dev-core", `import ${JSON.stringify(entries.core)};`],
+    ["\0ignotum:dev-utils", `export { flush } from ${JSON.stringify(entries.utils)};`],
+    ["\0ignotum:dev-debug", `import ${JSON.stringify(entries.debug)};`],
+  ]);
+  const files = new Map<string, string>();
+  yield* runViteBuild("local browser tools", {
+    configFile: false,
+    root: path.dirname(entries.core),
+    publicDir: false,
+    logLevel: "warn",
+    define: { "process.env.NODE_ENV": JSON.stringify("development") },
+    plugins: [
+      {
+        name: "ignotum:local-tooling-renderer",
+        generateBundle(_options, bundle) {
+          for (const item of Object.values(bundle))
+            if (item.type === "chunk") files.set(item.fileName, item.code);
+        },
+        load(id) {
+          return sources.get(id);
+        },
+        resolveId(id) {
+          if (sources.has(`\0${id}`)) return `\0${id}`;
+          if (managedPreactPeers.some((peer) => peer.specifier === id)) {
+            const module = provider.resolve("Browser", id);
+            if (module === undefined) this.error(`Missing managed rendering peer ${id}.`);
+            return { id: localPlatformUrl(selection.platformReleaseId, module), external: true };
+          }
+        },
+      },
+    ],
+    build: {
+      write: false,
+      minify: false,
+      target: "es2020",
+      rolldownOptions: {
+        input: { core: "ignotum:dev-core", utils: "ignotum:dev-utils", debug: "ignotum:dev-debug" },
+        preserveEntrySignatures: "strict",
+        output: {
+          format: "es",
+          entryFileNames: "[name].js",
+          chunkFileNames: "chunks/[name]-[hash].js",
+        },
+      },
+    },
+  });
+  return files;
+});

package/src/cli/managed-exports.ts

@@ -0,0 +1,219 @@
+import { Effect, FileSystem, Path, Schema } from "effect";
+import { satisfies, validRange } from "semver";
+import type { Plugin } from "vite";
+
+export interface ManagedExport {
+  readonly specifier: string;
+  /** Relative to the SDK src directory, or a Preact package specifier. */
+  readonly source: string;
+  readonly fileName: string;
+}
+
+export const managedPreactVersion = "10.29.8";
+export const managedPreactPeers = [
+  { specifier: "preact", source: "preact", fileName: "preact" },
+  { specifier: "preact/hooks", source: "preact/hooks", fileName: "preact-hooks" },
+  { specifier: "preact/jsx-runtime", source: "preact/jsx-runtime", fileName: "preact-jsx-runtime" },
+  {
+    specifier: "preact/jsx-dev-runtime",
+    source: "preact/jsx-dev-runtime",
+    fileName: "preact-jsx-dev-runtime",
+  },
+] as const satisfies ReadonlyArray<ManagedExport>;
+
+export const managedBrowserExports = [
+  { specifier: "ignotum/client", source: "client/index.ts", fileName: "client" },
+  {
+    specifier: "ignotum/client/jsx-runtime",
+    source: "client/jsx-runtime.ts",
+    fileName: "jsx-runtime",
+  },
+  {
+    specifier: "ignotum/client/jsx-dev-runtime",
+    source: "client/jsx-dev-runtime.ts",
+    fileName: "jsx-dev-runtime",
+  },
+  { specifier: "ignotum/internal/api", source: "internal/api.ts", fileName: "api" },
+  { specifier: "ignotum/internal/client", source: "internal/client.ts", fileName: "bindings" },
+  { specifier: "ignotum/internal/routes", source: "internal/routes.ts", fileName: "routes" },
+  { specifier: "ignotum/internal/bootstrap", source: "client/bootstrap.ts", fileName: "bootstrap" },
+  ...managedPreactPeers,
+] as const satisfies ReadonlyArray<ManagedExport>;
+
+export const managedGuestExports = [
+  { specifier: "ignotum/server", source: "server/index.ts", fileName: "server" },
+  { specifier: "ignotum/internal/server", source: "internal/server.ts", fileName: "bindings" },
+  { specifier: "ignotum/internal/api", source: "internal/api.ts", fileName: "api" },
+  { specifier: "ignotum/internal/host", source: "internal/host.ts", fileName: "host" },
+] as const satisfies ReadonlyArray<ManagedExport>;
+
+export const managedCompatibility = {
+  clientApiVersion: 1,
+  serverApiVersion: 1,
+  protocolVersions: [1],
+  capabilities: ["operations", "routing", "images"],
+} as const;
+
+export const resolveLocalManagedExport = Effect.fn("Deploy.resolveLocalManagedExport")(
+  function* (options: {
+    readonly target: "browser" | "guest";
+    readonly sdkSourceRoot: string;
+    readonly specifier: string;
+  }) {
+    const path = yield* Path.Path;
+    const entries = options.target === "browser" ? managedBrowserExports : managedGuestExports;
+    const entry = entries.find((entry) => entry.specifier === options.specifier);
+    return entry === undefined
+      ? undefined
+      : entry.source.startsWith("preact")
+        ? entry.source
+        : path.resolve(options.sdkSourceRoot, entry.source);
+  },
+);
+
+export class ManagedPeerError extends Schema.TaggedError<ManagedPeerError>()("ManagedPeerError", {
+  packageName: Schema.String,
+  message: Schema.String,
+}) {}
+
+export const validateManagedPreactPeer = (packageName: string, declaredRange: string): void => {
+  if (validRange(declaredRange) === null || !satisfies(managedPreactVersion, declaredRange)) {
+    throw ManagedPeerError.make({
+      packageName,
+      message: `${packageName} requires Preact ${declaredRange}, but the managed runtime supplies ${managedPreactVersion}. Choose a library version whose Preact peer range includes ${managedPreactVersion}.`,
+    });
+  }
+};
+
+const PackageMetadata = Schema.Struct({
+  name: Schema.optional(Schema.String),
+  peerDependencies: Schema.optional(Schema.Record(Schema.String, Schema.String)),
+  bundledDependencies: Schema.optional(Schema.Union([Schema.Boolean, Schema.Array(Schema.String)])),
+  bundleDependencies: Schema.optional(Schema.Union([Schema.Boolean, Schema.Array(Schema.String)])),
+  dependencies: Schema.optional(Schema.Record(Schema.String, Schema.String)),
+});
+
+const SourceMapMetadata = Schema.Struct({ sources: Schema.Array(Schema.String) });
+
+/** Compiler-only resolution: author modules must continue to import ignotum/client. */
+export const managedPreactPeerPlugin = Effect.fn("Deploy.managedPreactPeerPlugin")(
+  function* (options: { readonly resolvePeer: (specifier: string) => string }) {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const runPromise = Effect.runPromiseWith(yield* Effect.context<never>());
+    const owners = new Map<string, typeof PackageMetadata.Type | undefined>();
+    const sourceMapSources = Effect.fn("Deploy.managedPeerSourceMapSources")(function* (
+      code: string,
+      id: string,
+    ) {
+      const sources: string[] = [];
+      for (const match of code.matchAll(/^\s*\/\/[#@]\s*sourceMappingURL=(\S+)\s*$/gm)) {
+        const url = match[1]!;
+        let json: string;
+        if (url.startsWith("data:application/json;") && url.includes(";base64,")) {
+          json = Buffer.from(url.slice(url.indexOf(",") + 1), "base64").toString("utf8");
+        } else if (!url.includes(":") && path.isAbsolute(id)) {
+          const mapPath = path.resolve(path.dirname(id), url);
+          if (!(yield* fs.exists(mapPath))) continue;
+          json = yield* fs.readFileString(mapPath);
+        } else continue;
+        const map = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(SourceMapMetadata))(
+          json,
+        );
+        sources.push(...map.sources);
+      }
+      return sources;
+    });
+    const ownerOf = Effect.fn("Deploy.managedPeerOwner")(function* (id: string) {
+      const clean = id.split("?", 1)[0] ?? id;
+      if (!path.isAbsolute(clean) || !clean.replaceAll("\\", "/").includes("/node_modules/"))
+        return undefined;
+      let directory = path.dirname(clean);
+      if (owners.has(directory)) return owners.get(directory);
+      const start = directory;
+      while (path.dirname(directory) !== directory && path.basename(directory) !== "node_modules") {
+        const manifest = path.join(directory, "package.json");
+        if (yield* fs.exists(manifest)) {
+          const metadata = yield* Schema.decodeUnknownEffect(
+            Schema.fromJsonString(PackageMetadata),
+          )(yield* fs.readFileString(manifest));
+          if (
+            metadata.name !== undefined ||
+            path.basename(path.dirname(directory)) === "node_modules"
+          ) {
+            owners.set(start, metadata);
+            return metadata;
+          }
+        }
+        directory = path.dirname(directory);
+      }
+      owners.set(start, undefined);
+      return undefined;
+    });
+    const checkOwner = (owner: typeof PackageMetadata.Type | undefined, importer: string) => {
+      if (owner === undefined) return;
+      const name = owner.name ?? importer;
+      const range = owner.peerDependencies?.preact;
+      if (range !== undefined) validateManagedPreactPeer(name, range);
+      for (const bundled of [owner.bundledDependencies, owner.bundleDependencies]) {
+        if (
+          (bundled === true && owner.dependencies?.preact !== undefined) ||
+          (Array.isArray(bundled) && bundled.includes("preact"))
+        ) {
+          throw ManagedPeerError.make({
+            packageName: name,
+            message: `${name} bundles a private Preact renderer. Use a distribution that declares Preact as an external peer dependency.`,
+          });
+        }
+      }
+    };
+    return {
+      name: "ignotum:managed-preact-peers",
+      enforce: "pre",
+      async resolveId(specifier, importer) {
+        if (specifier !== "preact" && !specifier.startsWith("preact/")) return;
+        const owner = importer === undefined ? undefined : await runPromise(ownerOf(importer));
+        const name = owner?.name ?? importer ?? "application";
+        if (!managedPreactPeers.some((entry) => entry.specifier === specifier)) {
+          throw ManagedPeerError.make({
+            packageName: name,
+            message: `${name} imports unsupported Preact entry ${specifier}. Supported peer entries: ${managedPreactPeers.map((entry) => entry.specifier).join(", ")}.`,
+          });
+        }
+        checkOwner(owner, name);
+        if (owner?.peerDependencies?.preact === undefined) {
+          throw ManagedPeerError.make({
+            packageName: name,
+            message: `${name} imports ${specifier} without a Preact peer declaration. App source must import ignotum/client; UI libraries must declare Preact as a peer dependency.`,
+          });
+        }
+        return { id: options.resolvePeer(specifier), external: true };
+      },
+      async transform(code, id) {
+        const owner = await runPromise(ownerOf(id));
+        checkOwner(owner, id);
+        if (owner?.name === "preact") {
+          throw ManagedPeerError.make({
+            packageName: "preact",
+            message: `The app graph contains a private Preact renderer at ${id}. Remove direct renderer paths and use a library with external Preact peer imports.`,
+          });
+        }
+        // Source maps retain renderer provenance even when a library vendors it into one file.
+        const sources = [
+          ...this.getCombinedSourcemap().sources,
+          ...(await runPromise(sourceMapSources(code, id))),
+        ];
+        if (
+          sources.some((source) =>
+            /(?:^|\/)preact\/(?:src|dist)\//.test(source.replaceAll("\\", "/")),
+          )
+        ) {
+          throw ManagedPeerError.make({
+            packageName: owner?.name ?? id,
+            message: `${id} embeds a Preact renderer in its source map. Use a distribution that leaves Preact external.`,
+          });
+        }
+      },
+    } satisfies Plugin;
+  },
+);

package/src/cli/managed-release-bin.ts

@@ -0,0 +1,13 @@
+import { fileURLToPath } from "node:url";
+import { NodeRuntime, NodeServices } from "@effect/platform-node";
+import { Config, Effect, Path } from "effect";
+import { writeManagedReleaseGraphs } from "./managed-release.js";
+
+Effect.gen(function* () {
+  const path = yield* Path.Path;
+  const sdkDirectory = fileURLToPath(new URL("../../", import.meta.url));
+  const output = yield* Config.string("IGNOTUM_MANAGED_RELEASE_DIRECTORY").pipe(
+    Config.withDefault(path.join(sdkDirectory, "dist/managed")),
+  );
+  yield* writeManagedReleaseGraphs(sdkDirectory, output);
+}).pipe(Effect.provide(NodeServices.layer), NodeRuntime.runMain);

package/src/cli/managed-release.ts

@@ -0,0 +1,260 @@
+import { fileURLToPath } from "node:url";
+import { Effect, FileSystem, Path, Predicate, Schema } from "effect";
+import type { Plugin } from "vite";
+import { normalizePath } from "vite";
+import { ManagedReleaseManifest } from "@ignotum/contracts/managed-release";
+import {
+  encodeManagedReleaseManifest,
+  validateManagedReleaseGraph,
+} from "@ignotum/versions/managed-release";
+import { sha256, utf8Bytes } from "@ignotum/versions";
+import {
+  managedBrowserExports,
+  managedGuestExports,
+  managedPreactVersion,
+} from "./managed-exports.js";
+import { InvalidBuildOutput, runViteBuild } from "./build/artifact.js";
+
+interface EmittedModule {
+  readonly path: string;
+  readonly bytes: Uint8Array;
+  readonly imports: ReadonlyArray<string>;
+  readonly exports: ReadonlyArray<string>;
+}
+
+/** Release publication uses SDK sources; installed local development uses packed SDK entries. */
+export const buildManagedReleaseGraph = Effect.fn("ManagedRelease.buildGraph")(function* (
+  sdkDirectory: string,
+  kind: "Browser" | "Guest",
+  inputKind: "Source" | "Packed" = "Source",
+) {
+  const path = yield* Path.Path;
+  if (kind === "Browser") {
+    const fs = yield* FileSystem.FileSystem;
+    const preact = yield* Schema.decodeEffect(
+      Schema.fromJsonString(Schema.Struct({ version: Schema.String })),
+    )(yield* fs.readFileString(fileURLToPath(import.meta.resolve("preact/package.json"))));
+    if (preact.version !== managedPreactVersion)
+      return yield* InvalidBuildOutput.make({
+        message: `The installed Preact version ${preact.version} differs from compiler peer metadata ${managedPreactVersion}. Update and validate the shared managed export mapping before publishing.`,
+      });
+  }
+  const prefix = `ignotum/platform/${kind.toLowerCase()}/`;
+  const entries = kind === "Browser" ? managedBrowserExports : managedGuestExports;
+  const modules: Array<EmittedModule> = [];
+  const files: Array<{ path: string; bytes: Uint8Array }> = [];
+  const rendererRoots = new Set<string>();
+  const plugin: Plugin = {
+    name: "ignotum:managed-release-ownership",
+    enforce: "pre",
+    resolveId(id) {
+      if (id.startsWith("node:") || id.startsWith("@effect/platform-node"))
+        this.error(`Managed ${kind} modules cannot import Node capabilities: ${id}.`);
+    },
+    generateBundle(_options, bundle) {
+      for (const item of Object.values(bundle)) {
+        if (item.type === "asset") {
+          if (!item.fileName.endsWith(".js.map"))
+            this.error(`Unexpected managed release asset '${item.fileName}'.`);
+          const artifact = {
+            path: item.fileName,
+            bytes: Predicate.isString(item.source) ? utf8Bytes(item.source) : item.source,
+          };
+          const existing = files.findIndex((file) => file.path === artifact.path);
+          if (existing < 0) files.push(artifact);
+          else files[existing] = artifact;
+          continue;
+        }
+        for (const [id, module] of Object.entries(item.modules)) {
+          if (module.renderedLength === 0) continue;
+          const normalized = normalizePath(id);
+          if (
+            normalized.includes("/src/cli/") ||
+            normalized.includes("/platform-node/") ||
+            (kind === "Browser" &&
+              (normalized.includes("/runtime/src/guest.") ||
+                normalized.includes("/ignotum/src/server/") ||
+                normalized.includes("/ignotum/src/internal/host.")))
+          )
+            this.error(`Unexpected implementation in managed ${kind} graph: ${normalized}.`);
+          const marker = "/node_modules/preact/";
+          const renderer = normalized.lastIndexOf(marker);
+          if (renderer >= 0) rendererRoots.add(normalized.slice(0, renderer + marker.length));
+        }
+        const bytes = utf8Bytes(item.code);
+        if (!files.some((file) => file.path === `${item.fileName}.map`)) {
+          // Generated re-export facades have no source locations. Keep an explicit empty map.
+          const sourceMap =
+            item.map?.toString() ??
+            JSON.stringify({
+              version: 3,
+              file: item.fileName,
+              sources: [],
+              names: [],
+              mappings: "",
+            });
+          files.push({ path: `${item.fileName}.map`, bytes: utf8Bytes(sourceMap) });
+        }
+        modules.push({
+          path: item.fileName,
+          bytes,
+          imports: [...new Set([...item.imports, ...item.dynamicImports])].sort(),
+          exports: [...item.exports].sort(),
+        });
+        files.push({ path: item.fileName, bytes });
+      }
+      if (kind === "Browser" && rendererRoots.size !== 1)
+        this.error(
+          `Managed browser release must contain one Preact package, found ${rendererRoots.size}.`,
+        );
+      if (kind === "Guest" && rendererRoots.size !== 0)
+        this.error("Managed guest release cannot contain a renderer.");
+    },
+  };
+  const input = Object.fromEntries(
+    entries.map((entry) => [
+      entry.fileName,
+      entry.source.startsWith("preact")
+        ? fileURLToPath(import.meta.resolve(entry.source))
+        : inputKind === "Source"
+          ? path.join(sdkDirectory, "src", entry.source)
+          : path.join(
+              sdkDirectory,
+              "dist/runtime",
+              `${entry.specifier.slice("ignotum/".length)}.js`,
+            ),
+    ]),
+  );
+  yield* runViteBuild(`managed ${kind} release`, {
+    configFile: false,
+    root: sdkDirectory,
+    publicDir: false,
+    logLevel: "warn",
+    mode: "production",
+    define: { "process.env.NODE_ENV": JSON.stringify("production") },
+    plugins: [plugin],
+    resolve: {
+      alias: managedBrowserExports
+        .filter((entry) => entry.specifier.startsWith("preact"))
+        .map((entry) => ({
+          find: new RegExp(`^${entry.specifier}$`),
+          replacement: fileURLToPath(import.meta.resolve(entry.source)),
+        })),
+      conditions: ["@ignotum/source", "module", "browser", "production"],
+      dedupe: ["preact"],
+      noExternal: true,
+    },
+    build: {
+      write: false,
+      sourcemap: "hidden",
+      minify: "oxc",
+      target: "es2020",
+      modulePreload: false,
+      rolldownOptions: {
+        input,
+        preserveEntrySignatures: "strict",
+        output: {
+          format: "es",
+          entryFileNames: `${prefix}[name].js`,
+          chunkFileNames: `${prefix}chunks/[name]-[hash].js`,
+          sourcemapPathTransform: (source) => {
+            const normalized = normalizePath(source);
+            const dependency = normalized.lastIndexOf("/node_modules/");
+            return dependency >= 0
+              ? `ignotum://dependency/${normalized.slice(dependency + "/node_modules/".length)}`
+              : `ignotum://platform/${normalized.replace(/^(?:\.\.\/)+/, "")}`;
+          },
+        },
+      },
+    },
+  });
+  const descriptions = yield* Effect.forEach(modules, (module) =>
+    Effect.gen(function* () {
+      const sourceMap = files.find((file) => file.path === `${module.path}.map`);
+      if (sourceMap === undefined)
+        return yield* new InvalidBuildOutput({ message: `Missing source map for ${module.path}.` });
+      return {
+        path: module.path,
+        sha256: yield* sha256(module.bytes),
+        size: module.bytes.byteLength,
+        imports: module.imports,
+        exports: module.exports,
+        sourceMap: {
+          path: sourceMap.path,
+          sha256: yield* sha256(sourceMap.bytes),
+          size: sourceMap.bytes.byteLength,
+        },
+      };
+    }),
+  );
+  const manifest = yield* Schema.decodeUnknownEffect(ManagedReleaseManifest)({
+    formatVersion: 1,
+    kind,
+    entries: Object.fromEntries(
+      entries.map((entry) => [entry.specifier, `${prefix}${entry.fileName}.js`]),
+    ),
+    modules: descriptions.sort((a, b) => a.path.localeCompare(b.path)),
+  });
+  const manifestBytes = encodeManagedReleaseManifest(manifest);
+  const verified = yield* validateManagedReleaseGraph(manifestBytes, files);
+  return { ...verified, manifestBytes };
+});
+
+export const buildManagedReleaseGraphs = Effect.fn("ManagedRelease.buildGraphs")(function* (
+  sdkDirectory: string,
+  inputKind: "Source" | "Packed" = "Source",
+) {
+  // Build sequentially to bound compiler memory. Each graph has its own private dependencies.
+  const browser = yield* buildManagedReleaseGraph(sdkDirectory, "Browser", inputKind);
+  const guest = yield* buildManagedReleaseGraph(sdkDirectory, "Guest", inputKind);
+  return { browser, guest };
+});
+
+/** Fixtures and local development resolve exactly the entries that publication verifies. */
+export const localManagedReleaseProvider = Effect.fn("ManagedRelease.localProvider")(function* (
+  sdkDirectory: string,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const hasWorkspaceSources = yield* fs.exists(
+    path.resolve(sdkDirectory, "../contracts/src/schema/index.ts"),
+  );
+  const graphs = yield* buildManagedReleaseGraphs(
+    sdkDirectory,
+    hasWorkspaceSources ? "Source" : "Packed",
+  );
+  return {
+    ...graphs,
+    resolve: (kind: "Browser" | "Guest", specifier: string) =>
+      (kind === "Browser" ? graphs.browser : graphs.guest).manifest.entries[specifier],
+    read: (kind: "Browser" | "Guest", modulePath: string) =>
+      (kind === "Browser" ? graphs.browser : graphs.guest).files.get(modulePath)?.slice(),
+  };
+});
+
+export const writeManagedReleaseGraphs = Effect.fn("ManagedRelease.writeGraphs")(function* (
+  sdkDirectory: string,
+  outputDirectory: string,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const graphs = yield* buildManagedReleaseGraphs(sdkDirectory);
+  for (const graph of [graphs.browser, graphs.guest]) {
+    const directory = path.join(outputDirectory, graph.sha256);
+    yield* fs.makeDirectory(directory, { recursive: true });
+    for (const [name, bytes] of graph.files) {
+      const target = path.join(directory, name);
+      yield* fs.makeDirectory(path.dirname(target), { recursive: true });
+      yield* fs.writeFile(target, bytes);
+    }
+    yield* fs.writeFile(path.join(directory, "manifest.json"), graph.manifestBytes);
+    yield* Effect.logInfo("Built managed runtime graph", {
+      kind: graph.manifest.kind,
+      sha256: graph.sha256,
+      modules: graph.manifest.modules.length,
+      moduleBytes: graph.manifest.modules.reduce((sum, module) => sum + module.size, 0),
+      directory,
+    });
+  }
+  return graphs;
+});

package/src/cli/module-boundaries.ts

@@ -17,6 +17,8 @@ interface PackageEntry {
 const packageEntries: ReadonlyArray<PackageEntry> = [
   { graph: "Client", specifier: "ignotum/client" },
   { graph: "Client", specifier: "ignotum/internal/api" },
+  { graph: "Client", specifier: "ignotum/internal/client" },
+  { graph: "Client", specifier: "ignotum/internal/routes" },
   { graph: "Server", specifier: "ignotum/server" },
   { graph: "Server", specifier: "ignotum/internal/host" },
   { graph: "Server", specifier: "ignotum/internal/server" },
@@ -93,6 +95,8 @@ export const moduleBoundariesPlugin = Effect.fn("Deploy.moduleBoundariesPlugin")
   const clientDirectory = yield* canonicalModuleId(`${normalizedApp}/client`);
   const serverDirectory = yield* canonicalModuleId(`${normalizedApp}/server`);
   const generatedApi = yield* canonicalModuleId(`${normalizedApp}/_generated/api.ts`);
+  const generatedClient = yield* canonicalModuleId(`${normalizedApp}/_generated/client.ts`);
+  const generatedRoutes = yield* canonicalModuleId(`${normalizedApp}/_generated/routes.ts`);
   const generatedServer = yield* canonicalModuleId(`${normalizedApp}/_generated/server.ts`);
 
   const reject = (specifier: string, importer: string, reason: string): never => {
@@ -126,7 +130,13 @@ export const moduleBoundariesPlugin = Effect.fn("Deploy.moduleBoundariesPlugin")
       reject(specifier, importer, "the resolved module belongs to the server");
     }
 
-    if (graph === "Server" && (isWithin(cleaned, clientDirectory) || cleaned === generatedApi)) {
+    if (
+      graph === "Server" &&
+      (isWithin(cleaned, clientDirectory) ||
+        cleaned === generatedApi ||
+        cleaned === generatedClient ||
+        cleaned === generatedRoutes)
+    ) {
       reject(specifier, importer, "the resolved module belongs to the client");
     }
   };